<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[172170] branches/safari-537.78-branch/Source/WebCore/ChangeLog</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/172170">172170</a></dd>
<dt>Author</dt> <dd>dburkart@apple.com</dd>
<dt>Date</dt> <dd>2014-08-06 13:19:27 -0700 (Wed, 06 Aug 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Fixup ChangeLog from merge <a href="http://trac.webkit.org/projects/webkit/changeset/169475">r169475</a> -&gt; 171377</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari53778branchSourceWebCoreChangeLog">branches/safari-537.78-branch/Source/WebCore/ChangeLog</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari53778branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/Source/WebCore/ChangeLog (172169 => 172170)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/Source/WebCore/ChangeLog        2014-08-06 20:15:09 UTC (rev 172169)
+++ branches/safari-537.78-branch/Source/WebCore/ChangeLog        2014-08-06 20:19:27 UTC (rev 172170)
</span><span class="lines">@@ -1,5 +1,43 @@
</span><span class="cx"> 2014-07-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Merge r169475.
+
+    2014-05-28  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
+
+            Roll r168668 back in.
+
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=132621&gt;
+
+            Reviewed by Brent Fulgham.
+
+            Tests: fast/events/beforeload-assertion.html
+                   fast/events/beforeload-iframe-crash.html
+                   fast/events/beforeload-input-time-crash.html
+
+            * WebCore.exp.in:
+            * dom/Document.cpp:
+            (WebCore::Document::updateLayoutIgnorePendingStylesheets):
+            * dom/Document.h:
+            * html/HTMLAppletElement.cpp:
+            (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+            * html/HTMLEmbedElement.cpp:
+            (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
+            * html/HTMLObjectElement.cpp:
+            (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+            * page/FrameView.cpp:
+            (WebCore::FrameView::FrameView):
+            (WebCore::FrameView::reset):
+            (WebCore::FrameView::updateEmbeddedObjectsTimerFired):
+            (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
+            (WebCore::FrameView::performPostLayoutTasks):
+            * page/FrameView.h:
+            * testing/Internals.cpp:
+            (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks):
+            * testing/Internals.h:
+            * testing/Internals.idl:
+
+2014-07-22  Dana Burkart  &lt;dburkart@apple.com&gt;
+
</ins><span class="cx">         Merge r152704.
</span><span class="cx"> 
</span><span class="cx">     2013-07-15  Kangil Han  &lt;kangil.han@samsung.com&gt;
</span><span class="lines">@@ -25,51342 +63,35767 @@
</span><span class="cx">             (WebCore::RenderIFrame::isSeamless):
</span><span class="cx">             (WebCore::RenderIFrame::flattenFrame):
</span><span class="cx"> 
</span><del>-2014-05-28  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Roll r168668 back in.
</del><ins>+        Merge r170946
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=132621&gt;
</del><ins>+    2014-07-08  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            Fix flaky loading tests
+            https://bugs.webkit.org/show_bug.cgi?id=133696
</ins><span class="cx"> 
</span><del>-        Tests: fast/events/beforeload-assertion.html
-               fast/events/beforeload-iframe-crash.html
-               fast/events/beforeload-input-time-crash.html
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * dom/Document.cpp:
-        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
-        * dom/Document.h:
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::reset):
-        (WebCore::FrameView::updateEmbeddedObjectsTimerFired):
-        (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
-        (WebCore::FrameView::performPostLayoutTasks):
-        * page/FrameView.h:
-        * testing/Internals.cpp:
-        (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks):
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+            In some cases, the Frame may be destroyed while the loader is
+            initializing. Make sure we don't delete it too early.
</ins><span class="cx"> 
</span><del>-2014-05-29  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::init):
</ins><span class="cx"> 
</span><del>-        Support -apple-system-font on OS X
-        https://bugs.webkit.org/show_bug.cgi?id=133382
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r170135
</ins><span class="cx"> 
</span><del>-        Guard on both family names: &quot;-apple-system-font&quot; and &quot;-webkit-system-font&quot;
</del><ins>+    2014-06-11  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/fast/text/systemFont.html
</del><ins>+            Fix flaky beforeload tests
+            https://bugs.webkit.org/show_bug.cgi?id=133685
</ins><span class="cx"> 
</span><del>-        * platform/mac/WebFontCache.mm:
-        (+[WebFontCache internalFontWithFamily:traits:weight:size:]):
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-2014-05-29  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::loadURL):
</ins><span class="cx"> 
</span><del>-        Loading &lt;object&gt; from WebArchive crashes
-        https://bugs.webkit.org/show_bug.cgi?id=133386
-        &lt;rdar://problem/13345509&gt;
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+        Merge r170513
</ins><span class="cx"> 
</span><del>-        Test: webarchive/loading/object.html
</del><ins>+    2014-06-26  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This (a) fixes the crash, and (b) avoids the crash.
</del><ins>+            [Win] Always NULL-terminate the string in createUTF8String()
+            &lt;http://webkit.org/b/134353&gt;
+            &lt;rdar://problem/17471783&gt;
</ins><span class="cx"> 
</span><del>-        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::continueAfterContentPolicy):
-        Some types of substitute data - such as WebArchive - don't contain HTTP result codes,
-        so let's not drop to &lt;object&gt; fallback content when status is 0.
-        And if the load somehow failed anyway, don't crash by trying to deliver substitute data
-        to a finished loader.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-05-29  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            * plugins/PluginView.cpp:
+            (WebCore::createUTF8String): Pull out CString length into local
+            variable.  Switch to use memcpy.  Always NULL-terminate the
+            string.
</ins><span class="cx"> 
</span><del>-        [iOS WebGL] Fix depth buffer clearing issue.
-        https://bugs.webkit.org/show_bug.cgi?id=133388
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Merge r170028
</ins><span class="cx"> 
</span><del>-        No new tests, but this fixes webgl/1.0.1/conformance/canvas/buffer-preserve-test.html.
</del><ins>+    2014-06-16  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/WebGLLayer.mm:
-        (-[WebGLLayer display]):
-        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
-        (WebCore::GraphicsContext3D::prepareTexture):
-        Moved marking the layer as composited from the mac-only prepareTexture to
-        the end of [WebGLLayer display] which is called by mac and iOS.
</del><ins>+            AX: Safari crashed once in WebCore::AccessibilityObject::ariaIsHidden
+            https://bugs.webkit.org/show_bug.cgi?id=133825
</ins><span class="cx"> 
</span><del>-2014-05-29  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        Perserve caption selection in fullscreen.
-        https://bugs.webkit.org/show_bug.cgi?id=133350
</del><ins>+            Sometimes asking accessibilityIsIgnored() will cause a newObject to be detached immediately after its created. 
+            The creation function holds a reference with RefPtr as long as it lives, but when that method returns, the object goes away.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            With that out of the way, I saw the same backtrace lead to updateLayoutIgnorePendingStylesheets being called while still inLayout.
</ins><span class="cx"> 
</span><del>-        Use the logic from the inline player to calculate the selected caption index.
</del><ins>+            I tried my best but could not create a reproducible layout test.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::mediaControlsHost):
-        Expose mediaControlsHost() for use by WebVideoFullscreenModelMediaElement.
</del><ins>+            * accessibility/AXObjectCache.cpp:
+            (WebCore::AXObjectCache::getOrCreate):
+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::AccessibilityObject::updateBackingStore):
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::updateLegibleOptions):
-        Use logic from buildCaptionsMenu from mediaControlsApple.js.
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-29  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+        Merge r170026
</ins><span class="cx"> 
</span><del>-        Use correct version of requiresFullscreenForVideoPlayback().
-        https://bugs.webkit.org/show_bug.cgi?id=133331
</del><ins>+    2014-06-16  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            AX: Crash at WebCore::AXObjectCache::textChanged
+            https://bugs.webkit.org/show_bug.cgi?id=133873
</ins><span class="cx"> 
</span><del>-        Test: media/video-fullscreeen-only-controls.html
</del><ins>+            Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        Update the last place not yet using m_mediaSession-&gt;requiresFullscreenForVideoPlayback.
</del><ins>+            This looks like a very similar problem to 
+            https://bugs.webkit.org/show_bug.cgi?id=133825
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        switch to media session version for requriesFullscreenForVideoPlayback.
</del><ins>+            The object is being created and deallocated almost right away because calling accessibilityIsIgnored triggers
+            a deferred layout that invalidates the associated render element.
</ins><span class="cx"> 
</span><del>-2014-05-29  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            Despite my best efforts, I could not come up with a way to reproduce this in a layout test.
</ins><span class="cx"> 
</span><del>-        [GTK] Add support for HiDPI icons
-        https://bugs.webkit.org/show_bug.cgi?id=133377
</del><ins>+            * accessibility/AXObjectCache.cpp:
+            (WebCore::AXObjectCache::getOrCreate):
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Use the GTK+ missing icon at 16 or 32 size depending on the device
-        scale factor.
</del><ins>+        Merge r169849
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::loadMissingImageIconFromTheme):
-        (WebCore::Image::loadPlatformResource):
</del><ins>+    2014-06-11  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-29  Owen Taylor  &lt;otaylor@redhat.com&gt;
</del><ins>+            WindowFeatures arguments shoud ignore invalid characters in values
+            &lt;http://webkit.org/b/133703&gt;
+            &lt;rdar://problem/17254118&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Add HighDPI support for non-accelerated compositing contents
-        https://bugs.webkit.org/show_bug.cgi?id=131562
</del><ins>+            Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Test: fast/dom/Window/window-property-invalid-characters-ignored.html
</ins><span class="cx"> 
</span><del>-        No new tests. This will be tested once we have the proper dependencies in the WebKit testing
-        JHBuild.
</del><ins>+            * page/WindowFeatures.cpp:
+            (WebCore::WindowFeatures::WindowFeatures): Set |length| based on
+            |buffer|, not |features|.  Switch to using a for loop.  Switch
+            to unsigned types since we are working with positive offsets
+            into a String.
</ins><span class="cx"> 
</span><del>-        * platform/cairo/WidgetBackingStore.h:
-        (WebCore::WidgetBackingStore::WidgetBackingStore): Accept a device scale argument.
-        * platform/cairo/WidgetBackingStoreCairo.cpp: Use the device scale argument to make the surface the proper size and set the surface device scale.
-        * platform/cairo/WidgetBackingStoreCairo.h: Accept a device scale argument.
-        * platform/graphics/cairo/CairoUtilities.cpp: Add a new helper to set the device scale if Cairo built against is new enough.
-        * platform/graphics/cairo/CairoUtilities.h:
-        * platform/gtk/GtkVersioning.h: Add the HAVE_GTK_SCALE_FACTOR macro.
-        * platform/gtk/WidgetBackingStoreGtkX11.cpp: Use the device scale argument to make the surface the proper size and set the surface device scale.
-        * platform/gtk/WidgetBackingStoreGtkX11.h: Accept a device scale argument.
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Merge r169848
</ins><span class="cx"> 
</span><del>-        Captions during HLS playback flash/are difficult to readily
-        https://bugs.webkit.org/show_bug.cgi?id=133365
-        &lt;rdar://problem/16584132&gt;
</del><ins>+    2014-06-11  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Viewport arguments should ignore invalid characters in values
+            &lt;http://webkit.org/b/133555&gt;
+            &lt;rdar://problem/17179650&gt;
</ins><span class="cx"> 
</span><del>-        Correct two problems:
-        1. Add new logic to handle cues that are identical to existing cues, except
-           that they cover a slightly later moment in playback. For example, a cue
-           encoding device might emit a cue at 24 fps, with many of the cues containing
-           the same content but covering only 1/24th of a second.
-           
-           Rather than hiding and displaying our cues at the cue encoding rate, we should
-           simply continue to display the same cue as long as the content is unchanged.
-        2. The cue &quot;isEqual&quot; logic for TextTrackCueGeneric improperly short-circuited the
-           VTTCue isEqual logic. This was done to avoid a false failure due to the cue
-           type being 'generic' rather than 'vtt', but incorrectly treated cues with
-           non-matching text as equal.
</del><ins>+            Reviewed by Daniel Bates.
</ins><span class="cx"> 
</span><del>-        * html/track/DataCue.cpp:
-        (WebCore::DataCue::cueContentsMatch): Move cue comparison code to new method that
-        doesn't check that the 'type' of the cue is identical.
-        (WebCore::DataCue::isEqual): Modified to use new 'cueContentsMatch' method.
-        (WebCore::DataCue::isStartOfCue): Confirms cues match except for start and end times.
-        * html/track/DataCue.h:
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::hasCue): Modify to check if a new cue is simply a continuation
-        of an existing cue.
-        * html/track/TextTrackCue.cpp:
-        (WebCore::TextTrackCue::cueContentsMatch): New method containing the equality code
-        that used to live in 'isEqual'.
-        (WebCore::TextTrackCue::isEqual): Modified to use new 'cueContentsMatch' method.
-        (WebCore::TextTrackCue::isStartOfCue): Confirms cues match except for start and
-        end times.
-        * html/track/TextTrackCue.h:
-        * html/track/TextTrackCueGeneric.cpp:
-        (WebCore::TextTrackCueGeneric::cueContentsMatch): New method containing the equality
-        code that used to live in 'isEqual'.
-        (WebCore::TextTrackCueGeneric::isEqual): Modified to use new 'cueContentsMatch' method.
-        (WebCore::TextTrackCueGeneric::isStartOfCue): Confirms cues match except for start and
-        end times.
-        * html/track/TextTrackCueGeneric.h:
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::cueContentsMatch): New method containing the equality code that
-        used to live in 'isEqual'.
-        (WebCore::VTTCue::isEqual): Modified to use new 'cueContentsMatch' method.
-        (WebCore::VTTCue::isStartOfCue): Confirms cues match except for start and end times.
-        * html/track/VTTCue.h:
</del><ins>+            Test: fast/viewport/viewport-warnings-7.html
</ins><span class="cx"> 
</span><del>-2014-05-28  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::processArguments): Set |length| based on
+            |buffer|, not |features|.  Switch to using a for loop.  Switch
+            to unsigned types since we are working with positive offsets
+            into a String.
</ins><span class="cx"> 
</span><del>-        Whoops, update bindings tests results.
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-28  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+        Merge r169726
</ins><span class="cx"> 
</span><del>-        Make DOM properties exposed as instance properties use the base object instead of |this|
-        https://bugs.webkit.org/show_bug.cgi?id=133353
</del><ins>+    2014-06-09  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            Properly reset UStringSearch object in SearchBuffer constructor.
+            https://bugs.webkit.org/show_bug.cgi?id=133662
+            &lt;rdar://problem/17240136&gt;
</ins><span class="cx"> 
</span><del>-        Make the bindings generator emit code that uses the base object for
-        a property, rather than the this object. This means that attributes
-        that we need to be treated as instance properties will match their old
-        instance-based behaviour.
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (InterfaceRequiresAttributesOnInstanceForCompatibility):
-        (InterfaceRequiresAttributesOnInstance):
-        (GetCastingHelperForBaseObject):
-        (GenerateImplementation):
-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        (WebCore::jsTestActiveDOMObjectExcitingAttr):
-        * bindings/scripts/test/JS/JSTestException.cpp:
-        (WebCore::jsTestExceptionName):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::jsTestInterfaceImplementsStr3):
-        (WebCore::jsTestInterfaceSupplementalStr3):
-        (WebCore::setJSTestInterfaceConstructorImplementsStaticAttr):
-        (WebCore::setJSTestInterfaceImplementsStr2):
-        (WebCore::setJSTestInterfaceImplementsStr3):
-        (WebCore::setJSTestInterfaceImplementsNode):
-        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
-        (WebCore::setJSTestInterfaceSupplementalStr2):
-        (WebCore::setJSTestInterfaceSupplementalStr3):
-        (WebCore::setJSTestInterfaceSupplementalNode):
-        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
-        (WebCore::setJSTestNondeterministicNondeterministicWriteableAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicExceptionAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicGetterExceptionAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicSetterExceptionAttr):
-        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::jsTestTypedefsConstructorTestSubObj):
-        (WebCore::setJSTestTypedefsUnsignedLongLongAttr):
-        (WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
-        (WebCore::setJSTestTypedefsAttrWithGetterException):
-        (WebCore::setJSTestTypedefsAttrWithSetterException):
-        (WebCore::setJSTestTypedefsStringAttrWithGetterException):
-        (WebCore::setJSTestTypedefsStringAttrWithSetterException):
</del><ins>+            * editing/TextIterator.cpp: (WebCore::SearchBuffer::~SearchBuffer):
</ins><span class="cx"> 
</span><del>-2014-05-28  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2014-07-18  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Improve behavior of position:fixed inside accelerated overflow-scroll
-        https://bugs.webkit.org/show_bug.cgi?id=133352
</del><ins>+        Merge r169318
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+    2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When adjusting layers inside accelerated overflow-scroll, pass a delta
-        down to descendant nodes. Fix behavior of sticky nodes inside fixed nodes
-        inside overflow scroll (sticky should only be affected if the parent node
-        is a scrolling node).
</del><ins>+            Crash in WebCore::TextResourceDecoder::checkForCSSCharset
+            &lt;http://webkit.org/b/133257&gt;
+            &lt;rdar://problem/17027109&gt;
</ins><span class="cx"> 
</span><del>-        * page/scrolling/mac/ScrollingTreeFixedNode.mm:
-        (WebCore::ScrollingTreeFixedNode::updateLayersAfterAncestorChange): Just remove
-        some .get()
-        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
-        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange): Remove .get()s.
-        We never care about the cumulative delta here, because sticky nodes only respond to
-        changes in their direct scrolling ancestors. Only adjust the layer if the parent
-        is a scrolling node.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-2014-05-27  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+            Test: fast/encoding/css-charset-missing-semi-colon-and-newline.html
</ins><span class="cx"> 
</span><del>-        AX: WebKit does not recognize ARIA 1.1 tables
-        https://bugs.webkit.org/show_bug.cgi?id=133163
</del><ins>+            * loader/TextResourceDecoder.cpp:
+            (WebCore::TextResourceDecoder::checkForCSSCharset): Add early
+            return.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-05-30  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The AXObjectCache code that determines which object to create based on the role needs to be token fallback aware.
</del><ins>+        Supplementary build fix for &lt;rdar://problem/16848509&gt;, borrowed from &lt;rdar://problem/16701806&gt;.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/table-fallback-roles-expose-element-attributes.html
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        * accessibility/AXObjectCache.cpp:
-        (WebCore::nodeHasRole):
</del><ins>+2014-05-29  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-28  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Build fix for Mavericks
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): Invalid layout in multicol
-        https://bugs.webkit.org/show_bug.cgi?id=133322
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+2014-05-29  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        In some situations, deleting the line boxes of a multicol element causes the line to region
-        link to become invalid.
</del><ins>+        Build fix
</ins><span class="cx"> 
</span><del>-        Test: fast/multicol/newmulticol/multicol-inside-multicol.html
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::clearLinesToRegionMap):
-        (WebCore::RenderFlowThread::deleteLines):
-        (WebCore::RenderFlowThread::willBeDestroyed):
-        * rendering/RenderFlowThread.h:
</del><ins>+2014-05-27  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-28  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        Workaround for &lt;rdar://problem/16848509&gt;
</ins><span class="cx"> 
</span><del>-        Remove DocumentThreadableLoaderClient.h
-        https://bugs.webkit.org/show_bug.cgi?id=133341
</del><ins>+        Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
</ins><span class="cx"> 
</span><del>-        DocumentThreadableLoaderClient is not used anymore.
</del><ins>+2014-05-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.order:
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::redirectReceived):
-        * loader/DocumentThreadableLoaderClient.h: Removed.
-        * loader/ThreadableLoaderClient.h:
-        (WebCore::ThreadableLoaderClient::isDocumentThreadableLoaderClient): Deleted.
-
-2014-05-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
-
-        Unreviewed. Update GObject DOM bindings symbols file after r169017.
-
-        * bindings/gobject/webkitdom.symbols: Add webkit_dom_navigator_get_hardware_concurrency.
-
-2014-05-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
-
-        REGRESSION(r168868): [GTK] Element.offset* client* scroll* API changed
-        https://bugs.webkit.org/show_bug.cgi?id=133313
-
-        Reviewed by Philippe Normand.
-
-        Keep old API that uses long also for GObject bindings.
-
-        * dom/Element.idl:
-
-2014-05-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
-
-        Unreviewed, rolling out r169400.
-        https://bugs.webkit.org/show_bug.cgi?id=133338
-
-        Broke the iOS build in
-        LocalizedDateCache::calculateMaximumWidth() (Requested by smfr
-        on #webkit).
-
-        Reverted changeset:
-
-        &quot;SVG TextRuns do not always get RenderingContexts&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=133198
-        http://trac.webkit.org/changeset/169400
-
-2014-05-27  Timothy Horton  &lt;timothy_horton@apple.com&gt;
-
-        REGRESSION (Margin tiles): Background gradient on dom.spec.whatwg.org is very slow to render
-        https://bugs.webkit.org/show_bug.cgi?id=133335
-        &lt;rdar://problem/17011392&gt;
-
-        Reviewed by Simon Fraser.
-
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::drawTiled):
-        Make cross-platform and use some iOS code which avoids patterned drawing when the pattern buffer
-        would be very large. Instead, it calls draw() repeatedly over the pattern space, avoiding the allocation
-        of a huge (in the case of bug 133335, nearly 2GB) buffer.
-
-2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        [iOS WK2] Fix behavior of position:sticky inside accelerated overflow-scroll
-        https://bugs.webkit.org/show_bug.cgi?id=133334
-        &lt;rdar://problem/16462535&gt;
-
-        Reviewed by Tim Horton.
-
-        When the scroll position changes in an accelerated overflow-scroll element, we have
-        to update child nodes in the scrolling tree for position:sticky. That requires a
-        more generic ability to update the scrolling tree after some arbitrary zoom or
-        scroll. To do this, we need to know the current fixed position rect, rather than
-        having it passed in.
</del><ins>+        Fix for &lt;rdar://problem/17020210&gt;
+        Fix by Jon Honeycutt.
</ins><span class="cx">         
</span><del>-        So make the fixed position rect available from ScrollingTree, and make it possible
-        to get the current scrollPosition() from any ScrollingTreeScrollingNode.
-        
-        Also, implement updateLayersAfterDelegatedScroll() in ScrollingTreeOverflowScrollingNodeIOS,
-        and have it update descendant layers.
-        
-        Finally, fix ScrollingTreeOverflowScrollingNode to use the correct rectangle for its
-        constraints math, using the scroll position of the parent node if appropriate.
-
-        * page/scrolling/ScrollingTree.h:
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
-        * page/scrolling/ios/ScrollingTreeIOS.cpp:
-        (WebCore::ScrollingTreeIOS::fixedPositionRect):
-        * page/scrolling/ios/ScrollingTreeIOS.h:
-        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
-        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange):
-
-2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Do some renaming in the scrolling tree
-        https://bugs.webkit.org/show_bug.cgi?id=133333
-
-        Reviewed by Tim Horton.
-
-        Rename ScrollingTreeNode::parentScrollPositionDidChange() to updateLayersAfterAncestorChange()
-        since this goes deep and to indicate that it's about layer updating.
-        
-        Also rename the &quot;viewportRect&quot; parameter to &quot;fixedPositionRect&quot;, since on iOS
-        this is the custom fixed-position rect that changes on zooming.
-
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::viewportChangedViaDelegatedScrolling):
-        * page/scrolling/ScrollingTree.h:
-        * page/scrolling/ScrollingTreeFrameScrollingNode.h:
-        * page/scrolling/ScrollingTreeNode.h:
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h:
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterViewportChange):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
-        * page/scrolling/mac/ScrollingTreeFixedNode.h:
-        * page/scrolling/mac/ScrollingTreeFixedNode.mm:
-        (WebCore::ScrollingTreeFixedNode::updateLayersAfterAncestorChange):
-        (WebCore::ScrollingTreeFixedNode::parentScrollPositionDidChange): Deleted.
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
-        * page/scrolling/mac/ScrollingTreeStickyNode.h:
-        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
-        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange):
-        (WebCore::ScrollingTreeStickyNode::parentScrollPositionDidChange): Deleted.
-
-2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Instantiate a ScrollingTreeMac on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=133332
-
-        Reviewed by Tim Horton.
-
-        Mac previously instantiated a ThreadedScrollingTree, but this has no platform
-        knowledge. To support future expansion, create a ScrollingTreeMac subclass and
-        instantiate that on Mac.
-        
-        Also protect ScrollingCoordinatorMac in PLATFORM(MAC) #ifdefs and remove it from the
-        EXCLUDED_SOURCE_FILE_NAMES list in the xcconfig file, following general trends.
-
-        * Configurations/WebCore.xcconfig:
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/scrolling/ThreadedScrollingTree.cpp:
-        (WebCore::ThreadedScrollingTree::create): Deleted.
-        * page/scrolling/ThreadedScrollingTree.h:
-        * page/scrolling/mac/ScrollingCoordinatorMac.h:
-        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
-        (WebCore::ScrollingCoordinatorMac::ScrollingCoordinatorMac):
-        * page/scrolling/mac/ScrollingTreeMac.cpp: Copied from Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h.
-        (ScrollingTreeMac::create):
-        (ScrollingTreeMac::ScrollingTreeMac):
-        * page/scrolling/mac/ScrollingTreeMac.h: Copied from Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h.
-
-2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Prepare for position:sticky support inside accelerated overflow-scroll with WK2
-        https://bugs.webkit.org/show_bug.cgi?id=133329
-
-        Reviewed by Tim Horton.
-
-        RenderLayerCompositor::computeStickyViewportConstraints() was always using
-        the viewport rect as the constraining rect for sticky position. This is not
-        correct when inside overflow:scroll.
-        
-        Refactor code in RenderBoxModelObject to make getting the rect easy, and use
-        it to compute the constraints.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::constrainingRectForStickyPosition):
-        (WebCore::RenderBoxModelObject::stickyPositionOffset):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeStickyViewportConstraints):
-
-2014-05-27  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        vw/vh units used as font/line-height values don't scale with the viewport
-        https://bugs.webkit.org/show_bug.cgi?id=87846
-
-        Reviewed by Darin Adler.
-
-        This patch moves the resolution of viewport units to style recalc
-        time. Currently viewport units are left unresolved during style
-        recalcs, which leads to many problems with viewport units. Moving the
-        resolution will fix these problems, as well as reduce the plumbing
-        that goes on.
-
-        This patch touches a lot of files since the valueForLength functions
-        no longer need a RenderView. The interesting changes are in:
-
-        - CSSToLengthConversionData -&gt; CSSPrimitiveValue: for moving
-            resolution to style recalc time.
-        - Length / LengthFunctions: no longer needs to know about viewport
-            units.
-        - FrameView -&gt; Document -&gt; StyleResolver: for scheduling style recalcs
-            upon resize
-
-        Note that getComputedStyle will now return pixel values when viewport
-        units are used. This behavior matches Firefox and the css3-cascade
-        spec.
-
-        This is based on a Blink patch by timloh@chromium.org.
-
-        Tests: css3/viewport-percentage-lengths/viewport-percentage-lengths-anonymous-block.html
-               css3/viewport-percentage-lengths/viewport-percentage-lengths-calc.html
-               css3/viewport-percentage-lengths/viewport-percentage-lengths-percent-size-child.html
-               css3/viewport-percentage-lengths/viewport-percentage-lengths-relative-font-size.html
-               css3/viewport-percentage-lengths/viewport-percentage-lengths-resize.html
-
-        * WebCore.exp.in: Remove RenderView argument to floatValueForLength.
-        * accessibility/atk/WebKitAccessibleInterfaceText.cpp: 
-        (getAttributeSetForAccessibilityObject): Remove RenderView argument.
-        * css/BasicShapeFunctions.cpp:
-        (WebCore::convertToLength): Ditto.
-        (WebCore::floatValueForCenterCoordinate): Ditto.
-        * css/BasicShapeFunctions.h: Ditto.
-        * css/CSSCalculationValue.cpp:
-        (WebCore::unitCategory): Remove special handling for viewport units,
-            as they get resolved to pixels.
-        (WebCore::createCSS): Ditto.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::positionOffsetValue): Remove RendewView argument.
-        (WebCore::getBorderRadiusCornerValues): Remove handling of viewport
-            units, as they are already resolve to pixels here.
-        (WebCore::getBorderRadiusCornerValue): Remove RenderView argument.
-        (WebCore::getBorderRadiusShorthandValue): Ditto.
-        (WebCore::specifiedValueForGridTrackBreadth): Remove handling of
-            viewport units, as they are already resolved to pixels here.
-        (WebCore::specifiedValueForGridTrackSize): Remove RenderView argument.
-        (WebCore::valueForGridTrackList): Ditto.
-        (WebCore::lineHeightFromStyle): Ditto.
-        (WebCore::ComputedStyleExtractor::propertyValue): Ditto.
-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSLinearGradientValue::createGradient): Pass RenderView to
-            CSSToLengthConversionData constructor.
-        (WebCore::CSSRadialGradientValue::createGradient): Ditto.
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::unitCategory): Remove handling of
-            viewport units, as they get resolved to pixels.
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Ditto.
-        (WebCore::CSSPrimitiveValue::init): Ditto.
-        (WebCore::CSSPrimitiveValue::computeLengthDouble): Resolve viewport
-            units to pixels.
-        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory): Remove
-        handling of viewport units, since they get resolved to pixels.
-        (WebCore::CSSPrimitiveValue::viewportPercentageLength): Deleted.
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::isLength): Remove special handling of
-            viewport units, since they get resolved to pixels.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::convertToLength): Ditto.
-        * css/CSSToLengthConversionData.cpp:
-        (WebCore::CSSToLengthConversionData::viewportWidthFactor): Caclulate
-            conversion factor for viewport units to pixels. Note this does not
-            set hasViewportUnits on the RenderStyle if computing the font
-            size, because in the font size case, the RenderStyle is the
-            parent's style, not the current renderer's style.
-        (WebCore::CSSToLengthConversionData::viewportHeightFactor): Ditto.
-        (WebCore::CSSToLengthConversionData::viewportMinFactor): Ditto.
-        (WebCore::CSSToLengthConversionData::viewportMaxFactor): Ditto.
-        * css/CSSToLengthConversionData.h:
-        (WebCore::CSSToLengthConversionData::CSSToLengthConversionData): Add
-            RenderView parameter, and make RenderStyle non-const so that
-            hasViewportUnits can be set on the Style..
-        (WebCore::CSSToLengthConversionData::style): style is now non-const.
-        (WebCore::CSSToLengthConversionData::copyWithAdjustedZoom): Handle
-            RenderView argument.
-        * css/CSSToStyleMap.cpp:
-        (WebCore::CSSToStyleMap::mapFillXPosition): Remove handling of
-            viewport units, as they are already resolved to pixels here.
-        (WebCore::CSSToStyleMap::mapFillYPosition): Ditto.
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyLength::applyValue): Ditto.
-        (WebCore::ApplyPropertyBorderRadius::applyValue): Ditto.
-        (WebCore::ApplyPropertyComputeLength::applyValue): Ditto.
-        (WebCore::ApplyPropertyFontSize::applyValue): Ditto.
-        (WebCore::ApplyPropertyLineHeight::applyValue): Ditto.
-        (WebCore::ApplyPropertyLineHeightForIOSTextAutosizing::applyValue): Ditto.
-        (WebCore::ApplyPropertyWordSpacing::applyValue): Ditto.
-        (WebCore::ApplyPropertyVerticalAlign::applyValue): Ditto.
-        (WebCore::ApplyPropertyTextIndent::applyValue): Ditto.
-        * css/LengthFunctions.cpp:
-        (WebCore::minimumIntValueForLength): Remove RenderView argument.
-        (WebCore::intValueForLength): Remove RenderView argument and
-            roundPecentages.
-        (WebCore::minimumValueForLength): Remove RenderView argument, and
-            special handling of viewport units.
-        (WebCore::valueForLength): Ditto.
-        (WebCore::floatValueForLength): Ditto.
-        (WebCore::floatSizeForLengthSize): Remove RenderView argument.
-        * css/LengthFunctions.h: Ditto.
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::MediaQueryEvaluator::eval): Add RenderView argument for
-            CSSToLengthConversionData constuctor.
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::State::clear): Change to 0 arg constructor
-            for CSSToLengthConversionData.
-        (WebCore::StyleResolver::State::updateConversionData): In order to get
-            the RenderView, we need to have a valid Element set on the state.
-            Since this means that we need to set the conversion data in more
-            places, move the contruction of conversion data into this helper
-            method.
-        (WebCore::StyleResolver::State::initElement): Make sure conversion
-            data is up to date.
-        (WebCore::StyleResolver::State::initForStyleResolve): Ditto.
-        (WebCore::StyleResolver::State::setStyle): When the style is set, we
-            need to make sure to update the conversion data.
-        (WebCore::StyleResolver::styleForElement): If the style has viewport
-            units, flage the document so that we can make sure to recalc the
-            viewport unit values when the viewport is resized.
-        (WebCore::StyleResolver::pseudoStyleForElement): Ditto.
-        (WebCore::StyleResolver::updateFont): Make sure the font having
-            viewport units updates the style.
-        (WebCore::StyleResolver::convertToIntLength): Remove handling of
-        viewport units, as they are resolved to pixels.
-        (WebCore::StyleResolver::convertToFloatLength): Ditto.
-        (WebCore::StyleResolver::clearCachedPropertiesAffectedByViewportUnits):
-            Invalidate the matched properties cache for styles with viewport
-            units when the viewport is resized.
-        (WebCore::createGridTrackBreadth): Remove handling of viewport units,
-            as they are resolved to pixels.
-        (WebCore::StyleResolver::applyProperty): Ditto.
-        (WebCore::StyleResolver::hasMediaQueriesAffectedByViewportChange):
-            Rename to be less confusing, since it has nothing to do with
-            viewport units.
-        (WebCore::StyleResolver::createFilterOperations): Remove handling of
-            viewport units, as they are resolved to pixels.
-        (WebCore::StyleResolver::affectedByViewportChange): Deleted.
-        (WebCore::StyleResolver::viewportPercentageValue): Deleted.
-        * css/StyleResolver.h:
-        (WebCore::StyleResolver::State::State): C++11 cleanup: 0 -&gt; nullptr.
-        (WebCore::StyleResolver::State::setFontSizeHasViewportUnits): Set if
-            the font size is specified in viewport units.
-        (WebCore::StyleResolver::State::fontSizeHasViewportUnits): Ditto.
-        (WebCore::StyleResolver::State::setStyle): Deleted.
-        * css/TransformFunctions.cpp:
-        (WebCore::convertToFloatLength): Remove handling of viewport units,
-            since they are resolved to pixels.
-        * dom/Document.cpp:
-        (WebCore::Document::Document): Add flag to determine if some style in
-            the document has viewport units.
-        (WebCore::Document::pageSizeAndMarginsInPixels): Remove RenderView
-            argument.
-        (WebCore::Document::updateViewportUnitsOnResize): Mark elements with
-            viewport units for style recalc when the viewport size has
-            changed.
-        * dom/Document.h:
-        (WebCore::Document::setHasStyleWithViewportUnits): Flag to determine
-            if some style in the document has viewport units.
-        (WebCore::Document::hasStyleWithViewportUnits): Ditto.
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::getRegion): Remove RenderView argument.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout): When the viewport is resized, call
-            updateViewportUnitsOnResize on the document.
-        * platform/Length.h:
-        (WebCore::Length::isSpecified): Remove handling of viewport units,
-            since they are now resolved to pixels.
-        (WebCore::Length::viewportPercentageLength): Deleted.
-        (WebCore::Length::isViewportPercentage): Deleted.
-        * rendering/ClipPathOperation.h:
-        (WebCore::ShapeClipPathOperation::pathForReferenceRect): Remove
-            RenderView argument.
-        (WebCore::BoxClipPathOperation::pathForReferenceRect): Ditto.
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::updateBlockChildDirtyBitsBeforeLayout): Remove
-            handling of viewport units, since they get updated by
-            updateViewportUnitsOnResize when the viewport is resized.
-        (WebCore::RenderBlock::nodeAtPoint): Remove RenderView argument.
-        (WebCore::RenderBlock::lineHeight): Ditto.
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations): Remove RenderView argument.
-        (WebCore::RenderBox::computeContentAndScrollbarLogicalHeightUsing):
-            Remove handling of viewport units, as they are resolved to pixels.
-        (WebCore::RenderBox::computePercentageLogicalHeight): Ditto.
-        (WebCore::RenderBox::computeReplacedLogicalWidthUsing): Ditto.
-        (WebCore::RenderBox::computeReplacedLogicalHeightUsing): Ditto.
-        (WebCore::RenderBox::hasViewportPercentageLogicalHeight): Deleted.
-        * rendering/RenderBox.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect): Remove
-            RenderView argument.
-        (WebCore::RenderBoxModelObject::calculateFillTileSize): Remove
-            handling of viewport units, as they are resolved to pixels.
-        (WebCore::computeBorderImageSide): Remove RenderView argument.
-        (WebCore::RenderBoxModelObject::paintNinePieceImage): Ditto.
-        (WebCore::RenderBoxModelObject::paintBorder): Ditto.
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Ditto.
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::repaintAfterLayoutIfNeeded): Ditto.
-        * rendering/RenderElement.h:
-        (WebCore::RenderElement::valueForLength): Remove unused
-            roundPercentages argument.
-        (WebCore::RenderElement::minimumValueForLength): Remove unused
-            RoundPercentages and RenderView arguments.
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::layoutGridItems): Remove handling of viewport
-            units as they are resolved to pixels.
-        * rendering/RenderInline.cpp:
-        (WebCore::computeMargin): Ditto.
-        (WebCore::RenderInline::lineHeight): Remove RenderView argument.
</del><span class="cx">         * rendering/RenderLayer.cpp:
</span><del>-        (WebCore::RenderLayer::setupClipPath): Ditto.
-        * rendering/RenderLineBreak.cpp:
-        (WebCore::RenderLineBreak::lineHeight): Ditto.
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::calcScrollbarThicknessUsing): Ditto.
-        (WebCore::RenderScrollbarPart::computeScrollbarWidth): Ditto.
-        (WebCore::RenderScrollbarPart::computeScrollbarHeight): Ditto.
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::convertStyleLogicalHeightToComputedHeight):
-            Remove handling of viewport units, since they are resolved to
-            pixels.
-        (WebCore::RenderTable::computePreferredLogicalWidths): Now that
-            viewport unit values are resolved to pixels at style recalc time,
-            no special checking is needed to handle them, so update the
-            comment to reflect that.
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::applyCommonButtonPaddingToStyle): Add RenderView argument to
-            CSSToLengthConversionData constructor.
-        (WebCore::RenderThemeIOS::adjustButtonStyle): Ditto.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Remove
-            RenderView argument.
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::layout): Remove handling of viewport units,
-            since they are resolved to pixels.
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::ascentAndDescentForBox): Remove RenderView
-            argument.
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createShape): Remove RenderView argument.
-        * rendering/shapes/Shape.h:
-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::ShapeOutsideInfo::computedShape): Ditto.
-        * rendering/style/BasicShapes.cpp:
-        (WebCore::BasicShapeCircle::floatValueForRadiusInBox): Ditto.
-        (WebCore::BasicShapeCircle::path): Ditto.
-        (WebCore::BasicShapeEllipse::floatValueForRadiusInBox): Ditto.
-        (WebCore::BasicShapeEllipse::path): Ditto.
-        (WebCore::BasicShapePolygon::path): Ditto.
-        (WebCore::floatSizeForLengthSize): Ditto.
-        (WebCore::BasicShapeInset::path): Ditto.
-        * rendering/style/BasicShapes.h:
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::calcRadiiFor): Ditto.
-        (WebCore::RenderStyle::getRoundedBorderFor): Ditto.
-        (WebCore::RenderStyle::computedLineHeight): Remove handling of
-            viewport units since they are resolved to pixels.
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::setHasViewportUnits): Set if this style has
-        a property set with viewport units.
-        (WebCore::RenderStyle::hasViewportUnits): Ditto.
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::resolveLengthAttributeForSVG): Remove RenderView argument.
-        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): Ditto.
-        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Ditto.
-        * rendering/svg/SVGRenderingContext.cpp:
-        (WebCore::SVGRenderingContext::prepareToRenderSVGContent): Ditto.
</del><ins>+        (WebCore::RenderLayer::filterNeedsRepaint):
</ins><span class="cx"> 
</span><del>-2014-05-27  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+2014-05-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] serialization of the computed value should omit the default radii
-        https://bugs.webkit.org/show_bug.cgi?id=132747
</del><ins>+    Rollout r169219
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-05-23  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        We should omit closest-side value, whereever is possible. Specification:
-        http://www.w3.org/TR/2014/CR-css-shapes-1-20140320/#basic-shape-computed-values 
-        This change aligns the behavior to the specification.
</del><ins>+        Merge r165862
</ins><span class="cx"> 
</span><del>-        Added new test cases for the shape-outside parsing tests.
</del><ins>+        2014-03-18  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSBasicShapes.cpp:
-        (WebCore::buildCircleString):
-        (WebCore::CSSBasicShapeCircle::cssText):
-        (WebCore::CSSBasicShapeEllipse::cssText):
</del><ins>+                Unify &lt;media&gt; element callback registration and unregistration
+                https://bugs.webkit.org/show_bug.cgi?id=130417
</ins><span class="cx"> 
</span><del>-2014-05-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+                Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r169399.
-        https://bugs.webkit.org/show_bug.cgi?id=133326
</del><ins>+                * html/HTMLMediaElement.cpp:
+                (WebCore::HTMLMediaElement::HTMLMediaElement):
+                (WebCore::HTMLMediaElement::~HTMLMediaElement):
+                (WebCore::HTMLMediaElement::registerWithDocument):
+                (WebCore::HTMLMediaElement::unregisterWithDocument):
+                (WebCore::HTMLMediaElement::didMoveToNewDocument):
+                * html/HTMLMediaElement.h:
</ins><span class="cx"> 
</span><del>-        Causes assertion failures in tests.  See
-        http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r169399%20(5622)/results.html
-        (Requested by mlam on #webkit).
</del><ins>+2014-05-23  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Merge r160847
</ins><span class="cx"> 
</span><del>-        &quot;Caret's screen position does not update during an overflow
-        scroll&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=133256
-        http://trac.webkit.org/changeset/169399
</del><ins>+    2013-12-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+            overflowchanged event could cause a crash
+            https://bugs.webkit.org/show_bug.cgi?id=125978
</ins><span class="cx"> 
</span><del>-        Lists styled with SVG fonts are not rendered as expected
-        https://bugs.webkit.org/show_bug.cgi?id=133198
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Made the event asynchrnous by re-using Document's event queuing ability. Also removed
+            the infrastructure to queue up events in FrameView.
</ins><span class="cx"> 
</span><del>-        There were a couple places in RenderListMarker and RenderMenuList that were
-        implicitly creating TextRuns by passing a String to a function which
-        expected a TextRun. Because TextRun has a constructor which takes a single
-        String and isn't marked explicit, TextRuns were being created without
-        any of the associated code that initializes the TextRun (such as creating
-        a RenderingContext if necessary).
</del><ins>+            Test: fast/events/overflowchanged-inside-selection-collapse-crash.html
</ins><span class="cx"> 
</span><del>-        This patch marks the aforementioned constructor as &quot;explicit&quot; to discourage
-        such behavior in the future.
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::recalcStyle):
+            (WebCore::Document::enqueueOverflowEvent):
+            * dom/Document.h:
+            * page/FrameView.cpp:
+            (WebCore::FrameView::FrameView):
+            (WebCore::FrameView::~FrameView):
+            (WebCore::FrameView::layout):
+            (WebCore::FrameView::performPostLayoutTasks):
+            (WebCore::FrameView::updateOverflowStatus):
+            * page/FrameView.h:
+            * rendering/RenderBlock.cpp:
+            (WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
+            * rendering/RenderLayer.cpp:
+            (WebCore::RenderLayer::scrollRectToVisible):
+            * rendering/RenderMarquee.cpp:
+            (WebCore::RenderMarquee::start):
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/list-items-with-svg-font-family.html
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/TextRun.h:
-        (WebCore::TextRun::TextRun): Mark constructors as explicit.
-        * rendering/RenderListMarker.cpp:
-        (WebCore::RenderListMarker::computePreferredLogicalWidths): Call
-        RenderBlock::constructTextRun.
-        (WebCore::RenderListMarker::getRelativeMarkerRect): Ditto.
-        * rendering/RenderMenuList.cpp:
-        (RenderMenuList::updateOptionsWidth): Ditto.
</del><ins>+        Merge r168915
</ins><span class="cx"> 
</span><del>-2014-05-23  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+    2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Caret's screen position does not update during an overflow scroll
-        https://bugs.webkit.org/show_bug.cgi?id=133256
</del><ins>+            SVG element may reference arbitrary DOM element before running its insertion logic
+            https://bugs.webkit.org/show_bug.cgi?id=132757
+            &lt;rdar://problem/15703817&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        During a scroll, we set a flag which caret position is gated on, but we never
-        actually invalidate the caret's position. This patch does so.
</del><ins>+            Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
+            inserted in the tree.
</ins><span class="cx"> 
</span><del>-        Test: editing/input/caret-position-during-scroll.html
</del><ins>+            Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
+            element B it references (if any). If A is inserted before B and B has the same id as a later element in
+            the document then A can find B before B is notified that its been inserted into the document (i.e. before
+            Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
+            cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
+            processed their insertion-specific logic.
</ins><span class="cx"> 
</span><del>-        * editing/FrameSelection.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollTo):
</del><ins>+            Tests: svg/custom/reparent-animate-element.html
+                   svg/custom/reparent-feimage-element.html
+                   svg/custom/reparent-mpath-element.html
+                   svg/custom/reparent-textpath-element.html
+                   svg/custom/reparent-tref-element.html
+                   svg/custom/reparent-use-element.html
</ins><span class="cx"> 
</span><del>-2014-05-27  Timothy Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+            * svg/SVGFEImageElement.cpp:
+            (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
+            * svg/SVGFEImageElement.h:
+            * svg/SVGMPathElement.cpp:
+            (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
+            * svg/SVGMPathElement.h:
+            * svg/SVGTRefElement.cpp:
+            (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
+            * svg/SVGTRefElement.h:
+            * svg/SVGTextPathElement.cpp:
+            (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
+            * svg/SVGTextPathElement.h:
+            * svg/SVGUseElement.cpp:
+            (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
+            inserted.
+            (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
+            * svg/SVGUseElement.h:
+            * svg/animation/SVGSMILElement.cpp:
+            (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
+            * svg/animation/SVGSMILElement.h:
</ins><span class="cx"> 
</span><del>-        Turn on the LayerPool for iOS
-        https://bugs.webkit.org/show_bug.cgi?id=133299
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        Merge r169007
</ins><span class="cx"> 
</span><del>-        * Configurations/WebCore.xcconfig:
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::createTileLayer):
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::removeTiles):
-        Turn on the LayerPool for iOS.
-        We've used this on Mac for a long time, and the WebKit1
-        (&quot;legacy&quot;) iOS TileCache also had a similar pool.
-        This helps a good bit with flashiness while scrolling.
</del><ins>+    2014-05-17  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+            Don't attempt to update id or name for nodes that are already removed
+            https://bugs.webkit.org/show_bug.cgi?id=133041
</ins><span class="cx"> 
</span><del>-        REGRESSION: Audio volume scrubber does not show volume level thumb
-        &lt;rdar://problem/16902004&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=133310
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Tests: fast/dom/remove-element-with-id-that-was-inserted-on-DOMNodeRemoved.html
+                   fast/dom/remove-element-with-name-that-was-inserted-on-DOMNodeRemoved.html
</ins><span class="cx"> 
</span><del>-        This was just a silly mistake on my part with the setting of the pagination
-        layers. Layers inside transforms are supposed to clear out their pagination
-        status based off their ancestor containing block layers, and not off the
-        enclosing pagination layer.
-        
-        Added fast/multicol/pagination/nested-transforms.html
</del><ins>+            * dom/Element.cpp:
+            (WebCore::Element::removedFrom): Skip updating ids and names for an element not
+            in a treescope, as we already do for elements not in a document.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updatePagination):
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Merge r168636
</ins><span class="cx"> 
</span><del>-        [Mac] media controls should prevent 'click' events from reaching the page
-        https://bugs.webkit.org/show_bug.cgi?id=133268
</del><ins>+    2014-05-12  Martin Hock  &lt;mhock@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            Disallow drag and drop of non-displayable resources.
+            https://bugs.webkit.org/show_bug.cgi?id=132745
+            &lt;rdar://problem/10562662&gt;
</ins><span class="cx"> 
</span><del>-        Test: media/media-controls-cancel-events.html
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller.prototype.handleEvent): Allow event handler to cancel event default action.
-        (Controller.prototype.handleRewindButtonClicked): Cancel event default.
-        (Controller.prototype.handlePlayButtonClicked): Ditto.
-        (Controller.prototype.handleMuteButtonClicked): Ditto.
-        (Controller.prototype.handleMinButtonClicked): Ditto.
-        (Controller.prototype.handleCaptionButtonClicked): Ditto.
-        (Controller.prototype.handleFullscreenButtonClicked): Ditto.
-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.handlePlayButtonTouchEnd): Ditto.
-        (ControllerIOS.prototype.handlePlayButtonTouchCancel): Ditto.
-        (ControllerIOS.prototype.handleFullscreenTouchEnd): Ditto.
-        (ControllerIOS.prototype.handleFullscreenTouchCancel): Ditto.
-        (ControllerIOS.prototype.handleStartPlaybackButtonTouchEnd): Ditto.
-        (ControllerIOS.prototype.handleStartPlaybackButtonTouchCancel): Ditto.
-        (ControllerIOS.prototype.handleWirelessPickerButtonClicked): Ditto.
</del><ins>+            Test: http/tests/security/drag-drop-local-file.html
</ins><span class="cx"> 
</span><del>-2014-05-27  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+            * page/DragController.cpp:
+            (WebCore::DragController::startDrag):
</ins><span class="cx"> 
</span><del>-        Fix Mavericks bots from r169383.
-        https://bugs.webkit.org/show_bug.cgi?id=133311
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Merge r166741
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h: Update #ifdef to check for ENABLE(MEDIA_SOURCE).
-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm: Ditto.
</del><ins>+    2014-04-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            Harden FilterOperation type casting
+            https://bugs.webkit.org/show_bug.cgi?id=131142
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): Incorrect handling of multicol spanner
-        https://bugs.webkit.org/show_bug.cgi?id=133249
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            DefaultFilterOperation had an error-prone behavior where it set the base class
+            OperationType to the type of some other filter class, but overrode isDefault(). 
+            This made it very easy to write incorrect code that casted incorrectly based on type().
</ins><span class="cx"> 
</span><del>-        When removing the child of an object, the removeChild method should return the next element
-        following the one being deleted. This will ensure that proper iteration and destruction of
-        an object's children is possible.
</del><ins>+            Fix by making adding a DEFAULT filter operation type, and storing the represented
+            type on DefaultFilterOperation().
</ins><span class="cx"> 
</span><del>-        No new tests added. This is because the test that triggers this issue also triggers
-        another assertion, in RenderMultiColumnSet::requiresBalancing(). However, that is a totally
-        separate problem and will be handled in a separate bug: https://bugs.webkit.org/show_bug.cgi?id=133309
</del><ins>+            Also remove the OperationType argument for constructors of FilterOperations that
+            can only be of one type, to avoid possible mistakes.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::removeChild):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::removeChild):
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::removeChild):
-        * rendering/RenderButton.h:
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::removeChild):
-        (WebCore::RenderElement::removeChildInternal):
-        * rendering/RenderElement.h:
-        * rendering/RenderMenuList.cpp:
-        (RenderMenuList::removeChild):
-        * rendering/RenderMenuList.h:
-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
-        * rendering/RenderRuby.cpp:
-        (WebCore::RenderRubyAsInline::removeChild):
-        (WebCore::RenderRubyAsBlock::removeChild):
-        * rendering/RenderRuby.h:
-        * rendering/RenderRubyRun.cpp:
-        (WebCore::RenderRubyRun::removeChild):
-        * rendering/RenderRubyRun.h:
-        * rendering/mathml/RenderMathMLScripts.cpp:
-        (WebCore::RenderMathMLScripts::removeChildInternal):
-        (WebCore::RenderMathMLScripts::removeChild):
-        (WebCore::RenderMathMLScriptsWrapper::removeChildInternal):
-        (WebCore::RenderMathMLScriptsWrapper::removeChild):
-        * rendering/mathml/RenderMathMLScripts.h:
-        * rendering/svg/RenderSVGContainer.cpp:
-        (WebCore::RenderSVGContainer::removeChild):
-        * rendering/svg/RenderSVGContainer.h:
-        * rendering/svg/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::removeChild):
-        * rendering/svg/RenderSVGInline.h:
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::removeChild):
-        * rendering/svg/RenderSVGRoot.h:
-        * rendering/svg/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::removeChild):
-        * rendering/svg/RenderSVGText.h:
</del><ins>+            Make the type cast macros a bit more normal, and use them in a few places.
</ins><span class="cx"> 
</span><del>-2014-05-27  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+            Fixed PlatformCAFiltersMac to handle the default filter case more cleanly.
</ins><span class="cx"> 
</span><del>-        Update ENABLE(MEDIA_SOURCE) on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=133141
</del><ins>+            * WebCore.exp.in:
+            * css/CSSComputedStyleDeclaration.cpp:
+            (WebCore::ComputedStyleExtractor::valueForFilter):
+            * css/StyleResolver.cpp:
+            (WebCore::StyleResolver::createFilterOperations):
+            * platform/graphics/ca/PlatformCAFilters.h:
+            * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
+            (PlatformCAFilters::filterValueForOperation):
+            (PlatformCAFilters::colorMatrixValueForFilter):
+            * platform/graphics/filters/FilterOperation.cpp:
+            (WebCore::DefaultFilterOperation::operator==):
+            (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
+            (WebCore::ReferenceFilterOperation::operator==):
+            (WebCore::BlurFilterOperation::operator==):
+            (WebCore::BlurFilterOperation::blend):
+            (WebCore::DropShadowFilterOperation::operator==):
+            (WebCore::DropShadowFilterOperation::blend):
+            * platform/graphics/filters/FilterOperation.h:
+            (WebCore::FilterOperation::blend):
+            (WebCore::FilterOperation::type):
+            (WebCore::FilterOperation::isBasicColorMatrixFilterOperation):
+            (WebCore::FilterOperation::isBasicComponentTransferFilterOperation):
+            (WebCore::FilterOperation::isSameType):
+            (WebCore::DefaultFilterOperation::create):
+            (WebCore::DefaultFilterOperation::representedType):
+            (WebCore::DefaultFilterOperation::DefaultFilterOperation):
+            (WebCore::ReferenceFilterOperation::create):
+            (WebCore::BlurFilterOperation::create):
+            (WebCore::BlurFilterOperation::BlurFilterOperation):
+            (WebCore::DropShadowFilterOperation::create):
+            (WebCore::DropShadowFilterOperation::DropShadowFilterOperation):
+            (WebCore::FilterOperation::isDefault): Deleted.
+            * platform/graphics/filters/FilterOperations.cpp:
+            (WebCore::FilterOperations::outsets):
+            * rendering/FilterEffectRenderer.cpp:
+            (WebCore::FilterEffectRenderer::build):
+            * rendering/RenderLayerFilterInfo.cpp:
+            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
</del><ins>+        Merge r167851
</ins><span class="cx"> 
</span><del>-2014-05-27  Tibor Meszaros  &lt;tmeszaros.u-szeged@partner.samsung.com&gt;
</del><ins>+    2014-04-26  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove BLOB guards
-        https://bugs.webkit.org/show_bug.cgi?id=132863
</del><ins>+            Frame and page lifetime fixes in WebCore::createWindow
+            https://bugs.webkit.org/show_bug.cgi?id=132089
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * Modules/websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::WebSocketChannel):
-        (WebCore::WebSocketChannel::didFail):
-        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
-        (WebCore::WebSocketChannel::abortOutgoingFrameQueue):
-        * Modules/websockets/WebSocketChannel.h:
-        * WebCore.exp.in:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * bindings/js/JSBlobCustom.cpp:
-        (WebCore::JSBlobConstructor::constructJSBlob):
-        * bindings/js/JSFileReaderCustom.cpp:
-        * dom/DOMExceptions.in:
-        * dom/EventTargetFactory.in:
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::publicURLManager):
-        * dom/ScriptExecutionContext.h:
-        * fileapi/AsyncFileStream.cpp:
-        * fileapi/AsyncFileStream.h:
-        * fileapi/Blob.cpp:
-        (WebCore::Blob::Blob):
-        * fileapi/Blob.h:
-        (WebCore::Blob::slice):
-        * fileapi/Blob.idl:
-        * fileapi/FileError.h:
-        * fileapi/FileError.idl:
-        * fileapi/FileException.cpp:
-        * fileapi/FileException.h:
-        * fileapi/FileException.idl:
-        * fileapi/FileReader.cpp:
-        * fileapi/FileReader.h:
-        * fileapi/FileReader.idl:
-        * fileapi/FileReaderLoader.cpp:
-        * fileapi/FileReaderLoader.h:
-        * fileapi/FileReaderLoaderClient.h:
-        * fileapi/FileReaderSync.cpp:
-        * fileapi/FileReaderSync.h:
-        * fileapi/FileReaderSync.idl:
-        * fileapi/FileThread.cpp:
-        * fileapi/FileThread.h:
-        * fileapi/ThreadableBlobRegistry.cpp:
-        (WebCore::ThreadableBlobRegistry::registerFileBlobURL): Deleted.
-        (WebCore::ThreadableBlobRegistry::registerBlobURL): Deleted.
-        (WebCore::ThreadableBlobRegistry::registerBlobURLForSlice): Deleted.
-        (WebCore::ThreadableBlobRegistry::unregisterBlobURL): Deleted.
-        (WebCore::ThreadableBlobRegistry::blobSize): Deleted.
-        (WebCore::ThreadableBlobRegistry::getCachedOrigin): Deleted.
-        * fileapi/WebKitBlobBuilder.cpp:
-        (WebCore::BlobBuilder::append):
-        * fileapi/WebKitBlobBuilder.h:
-        * html/DOMURL.cpp:
-        * html/DOMURL.h:
-        * html/DOMURL.idl:
-        * html/PublicURLManager.cpp:
-        * html/PublicURLManager.h:
-        * loader/LoaderStrategy.cpp:
-        (WebCore::LoaderStrategy::createBlobRegistry):
-        * loader/LoaderStrategy.h:
-        * page/DOMWindow.idl:
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::shouldUseInnerURL):
-        (WebCore::getCachedOrigin):
-        * platform/FileStream.cpp:
-        * platform/FileStream.h:
-        * platform/FileStreamClient.h:
-        * platform/SchemeRegistry.cpp:
-        (WebCore::canDisplayOnlyIfCanRequestSchemes):
-        * platform/network/BlobRegistry.cpp:
-        * platform/network/BlobRegistryImpl.cpp:
-        * platform/network/BlobResourceHandle.cpp:
-        * platform/network/BlobResourceHandle.h:
-        * platform/network/FormData.cpp:
-        (WebCore::FormData::deepCopy):
-        (WebCore::FormData::appendFile):
-        (WebCore::FormData::appendBlob):
-        (WebCore::FormData::appendKeyValuePairItems):
-        (WebCore::FormData::resolveBlobReferences):
-        (WebCore::encodeElement):
-        (WebCore::decodeElement):
-        * platform/network/FormData.h:
-        (WebCore::FormDataElement::FormDataElement):
-        (WebCore::operator==):
-        * platform/network/cf/FormDataStreamCFNet.cpp:
-        (WebCore::closeCurrentStream):
-        (WebCore::advanceCurrentStream):
-        (WebCore::formCreate):
-        (WebCore::formRead):
-        (WebCore::setHTTPBody):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::getFormElementsCount):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::addEncodedBlobToSoupMessageBody):
-        (WebCore::addFormElementsToSoupMessage):
-        * workers/WorkerGlobalScope.idl:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::send):
-        (WebCore::XMLHttpRequest::createRequest):
</del><ins>+            Speculative fix because I was unable to reproduce the crash that was
+            reported with the test case attached to this bug.
</ins><span class="cx"> 
</span><del>-2014-05-27  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+            * loader/FrameLoader.cpp:
+            (WebCore::createWindow): Changed code to remove the assumption that calls
+            out will not destroy the page or frame. Use RefPtr for the frame, and
+            added early exits if frame-&gt;page() becomes null at any point before we
+            use a page pointer.
</ins><span class="cx"> 
</span><del>-        Allow building CMake based ports with WEB_REPLAY
-        https://bugs.webkit.org/show_bug.cgi?id=133154
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+        Merge r168641
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
</del><ins>+    2014-05-09  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  Adrian Perez de Castro  &lt;aperez@igalia.com&gt;
</del><ins>+            REGRESSION (r167818): editing/inserting/typing-space-to-trigger-smart-link.html fails on WebKit1 bots
</ins><span class="cx"> 
</span><del>-        [GStreamer] Add missing &lt;wtf/MathExtras.h&gt; header
-        https://bugs.webkit.org/show_bug.cgi?id=133236
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=132207&gt;
+            &lt;rdar://problem/16730393&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+            Reverts the previous workaround in favor of a more specific fix for the
+            null dereference.
</ins><span class="cx"> 
</span><del>-        In some configurations, not including &lt;wtf/MathExtras.h&gt; will cause
-        errors about undefined functions. In particular, this happens in
-        Linux with glibc 2.19 and compiling with Clang. Having the header
-        included is the correct thing to do anyway.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/GStreamerUtilities.cpp:
-        Include &lt;wtf/MathExtras.h&gt;
</del><ins>+            * editing/ApplyStyleCommand.cpp:
+            (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+            Check whether the run's start and end are still in the document, as
+            removeConflictingInlineStyleFromRun() may have removed them.
</ins><span class="cx"> 
</span><del>-2014-05-27  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+            * editing/CompositeEditCommand.cpp:
+            (WebCore::CompositeEditCommand::apply):
+            Reverted previous workaround.
+            (WebCore::ApplyEditCommand::ReentrancyGuard::isRecursiveCall): Deleted.
+            (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::Scope): Deleted.
+            (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::~Scope): Deleted.
</ins><span class="cx"> 
</span><del>-        Setting up OrderIterator shouldn't require an extra Vector
-        https://bugs.webkit.org/show_bug.cgi?id=119061
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Merge r167635
</ins><span class="cx"> 
</span><del>-        From Blink r153971 by &lt;jchaffraix@chromium.org&gt;
</del><ins>+    2014-04-21  Dan Bernstein  &lt;mitz@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This patches reuse the OrderIterator's Vector. It provides a helper class OrderIteratorPopulator, used for
-        manipulating the Vector directly. Which allows to consolidate the code into a single implementation across
-        flexbox and grid.
</del><ins>+            WebCore part of &lt;rdar://problem/16631323&gt; Page::setDefersLoading doesn’t do anything when using the Network process
+            https://bugs.webkit.org/show_bug.cgi?id=131939
</ins><span class="cx"> 
</span><del>-        No new tests, already covered by current tests.
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        * rendering/OrderIterator.cpp:
-        (WebCore::OrderIteratorPopulator::~OrderIteratorPopulator): Reset OrderIterator and call
-        removeDuplicatedOrderValues().
-        (WebCore::OrderIteratorPopulator::removeDuplicatedOrderValues): Sorts the Vector and removes the duplicated
-        order values.
-        (WebCore::OrderIteratorPopulator::collectChild): Collect order value information from child.
-        (WebCore::OrderIterator::setOrderValues): Deleted.
-        * rendering/OrderIterator.h:
-        (WebCore::OrderIteratorPopulator::OrderIteratorPopulator): Add helper class to manipulate OrderValues Vector.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Remove unneeded code related to old OrderValues vector.
-        (WebCore::RenderFlexibleBox::prepareOrderIteratorAndMargins): Populate OrderIterator using collectChild().
-        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Deleted.
-        * rendering/RenderFlexibleBox.h: Rename computeMainAxisPreferredSizes() to prepareOrderIteratorAndMargins().
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator): Populate OrderIterator using collectChild().
</del><ins>+            * WebCore.exp.in: Exported WebCore::ResourceHandle::setDefersLoading.
</ins><span class="cx"> 
</span><del>-2014-05-26  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+            * loader/ResourceLoadScheduler.cpp:
+            (WebCore::ResourceLoadScheduler::setDefersLoading): Added a no-op implementation.
+            * loader/ResourceLoadScheduler.h: Declared new virtual member function setDefersLoading.
</ins><span class="cx"> 
</span><del>-        [wk2] RemoteLayerBackingStore front buffers should be purgeable when unparented
-        https://bugs.webkit.org/show_bug.cgi?id=133020
-        &lt;rdar://problem/16521736&gt;
</del><ins>+            * loader/ResourceLoader.cpp:
+            (WebCore::ResourceLoader::setDefersLoading): Added a call to the above function.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/cg/IOSurfacePool.cpp:
-        (WebCore::IOSurfacePool::willAddSurface):
-        * platform/graphics/cocoa/IOSurface.h:
-        * platform/graphics/cocoa/IOSurface.mm:
-        (IOSurface::releaseGraphicsContext):
-        Rename clearGraphicsContext to releaseGraphicsContext for clarity.
</del><ins>+        Merge r167818
</ins><span class="cx"> 
</span><del>-2014-05-26  Philip Rogers  &lt;pdr@google.com&gt;
</del><ins>+    2014-04-23  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove special case for transparent SVG root layers
-        https://bugs.webkit.org/show_bug.cgi?id=116856
</del><ins>+            Crash applying editing commands from iframe onload event
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=132103&gt;
+            &lt;rdar://problem/15696351&gt;
</ins><span class="cx"> 
</span><del>-        This patch removes a special case from RenderLayer for root SVG layers
-        with opacity. Instead of checking whether a composited layer exists in
-        SVGRenderingContext::prepareToRenderSVGContent we now exclude the root
-        SVG renderobject from the opacity checks in prepareToRenderSVGContent.
</del><ins>+            This patch merges the Chromium bug workaround from
+            &lt;http://src.chromium.org/viewvc/blink?revision=162080&amp;view=revision&gt;,
+            which prevents reentrancy in CompositeEditCommand::apply().
</ins><span class="cx"> 
</span><del>-        This is a merge of https://src.chromium.org/viewvc/blink?view=rev&amp;revision=174102
-        by Philip Rogers &lt;pdr@chromium.org&gt;.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        No new tests as this is covered by svg/custom/composited-svg-with-opacity.html.
</del><ins>+            Test: editing/apply-style-iframe-crash.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::isTransparent): Deleted.
-        * rendering/RenderLayer.h:
-        * rendering/svg/SVGRenderingContext.cpp:
-        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
-            The opacity case for root svg renderers is now handled by
-            RenderLayer.
</del><ins>+            * editing/CompositeEditCommand.cpp:
+            (WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
+            (WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
+            (WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
+            (WebCore::CompositeEditCommand::apply):
+            If this is a recursive call, return early.
</ins><span class="cx"> 
</span><del>-2014-05-26  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        CSS JIT: Fix build error raised when CSS_SELECTOR_JIT_DEBUGGING is 1
-        https://bugs.webkit.org/show_bug.cgi?id=133266
</del><ins>+        Merge r167264
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+    2014-04-14  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When CSS_SELECTOR_JIT_DEBUGGING is 1, build erros occur on x86_64.
</del><ins>+            Use after free in WebCore::CachedResourceHandleBase::~CachedResourceHandleBase / WebCore::removeDetachedChildrenInContainer
+            https://bugs.webkit.org/show_bug.cgi?id=131169
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generatePrologue):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateEpilogue):
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-26  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+            Invalidate the WebCoreAVFResourceLoader owned by MediaPlayerPrivateAVFoundationObjC
+            in its destructor, to prevent a private function being called in response to the
+            WebCoreAVFResourceLoader being stopped.
</ins><span class="cx"> 
</span><del>-        Fix the quirks mode selector matching of the pseudo classes :hover and :active
-        https://bugs.webkit.org/show_bug.cgi?id=133063
</del><ins>+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC):
+            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
+            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
+            (WebCore::WebCoreAVFResourceLoader::invalidate):
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Our implementation of the quirks mode of :active and :hover was very wrong. The only
-        thing it was doing is verify the pseudo class is not the first selector of a fragment
-        (which was conveniently the only thing that was tested :)).
</del><ins>+        Merge r166628
</ins><span class="cx"> 
</span><del>-        Since those pseudo class were only checking for the order of the filters, something like
-            #target:hover
-        would succeed because :hover is not the first simple selector, while
-            :hover#target
-        would fail.
</del><ins>+    2014-04-13  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        That behavior is also a problem for the CSS JIT as it is an implementation detail of SelectorChecker
-        and compiling something like that with our out-of-order matching would be nonsense.
</del><ins>+            userVisibleString should not try to &quot;encode&quot; host names
+            https://bugs.webkit.org/show_bug.cgi?id=131587
+            rdar://problem/14686849
</ins><span class="cx"> 
</span><del>-        This patch update the implementation to follow http://quirks.spec.whatwg.org/#the-:active-and-:hover-quirk
-        Basically, the only cases that do not work in quirks mode are selectors composed only of &quot;*, :hover and :active&quot;.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        To implement this behavior, I needed to be able to inspect a complete selector fragment, including
-        what is before and after :hover/:active.
-        To do that, I replaced the boolean isSubSelector by a pointer to the first selector of the fragment.
-        When we need to match :active/:hover in quirks mode, we just go over all the selectors in the fragment
-        to find one of the qualifying match type.
</del><ins>+            * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.
</ins><span class="cx"> 
</span><del>-        Tests: fast/selectors/active-hover-quirks.html
-               fast/selectors/active-quirks.html
-               fast/selectors/hover-quirks.html
</del><ins>+            * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
+            Objective-C++ header compile in plain C++ files, which we never need to do.
+            Added missing argument name, baseURL, and changed mysterious CFIndex arguments
+            to the correct type, CFURLComponentType.
</ins><span class="cx"> 
</span><del>-        * css/SelectorChecker.cpp:
-        (WebCore::SelectorChecker::matchRecursively):
-        (WebCore::canMatchHoverOrActiveInQuirksMode):
-        (WebCore::SelectorChecker::checkOne):
-        * css/SelectorChecker.h:
-        (WebCore::SelectorChecker::SelectorCheckingContext::SelectorCheckingContext):
</del><ins>+            * platform/mac/WebCoreNSURLExtras.mm:
+            (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
+            more lookalike characters from the Mozilla list referenced here.
+            (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
+            (WebCore::dataForURLComponentType): Ditto.
+            (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
+            needed; no encoding here.
</ins><span class="cx"> 
</span><del>-2014-05-26  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Split the call to adjustForLocalZoom out into a separate expression.
-        https://bugs.webkit.org/show_bug.cgi?id=133286
</del><ins>+        Merge r166628
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+    2014-04-01  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This patch ensures that adjustForLocalZoom() always gets called before we look at
-        zoomFactor's value. (and not rely on the undefined behavior of the order of function argument evaluation)
</del><ins>+            Crash in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::offsetLeft):
-        (WebCore::Element::offsetTop):
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
+            &lt;rdar://problem/15073043&gt;
</ins><span class="cx"> 
</span><del>-2014-05-26  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Class name matching should use ASCII case-insensitive matching, not Unicode case folding
-        https://bugs.webkit.org/show_bug.cgi?id=133292
</del><ins>+            Test: svg/filters/first-letter-crash.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            * rendering/FilterEffectRenderer.cpp:
+            (WebCore::FilterEffectRenderer::buildReferenceFilter):
+            Added a null check to prevent crashes for anonymous RenderObjects.
</ins><span class="cx"> 
</span><del>-        Tests: fast/dom/getElementsByClassName/ASCII-case-insensitive.html
-               fast/dom/getElementsByClassName/case-sensitive.html
</del><ins>+            * rendering/RenderLayer.cpp:
+            (WebCore::RenderLayer::filterNeedsRepaint):
+            Get the enclosing element, if there is one, and recalculate its style.
+            We use the enclosing element so that we recalculate style for the
+            ancestor of an anonymous RenderElement.
+            (WebCore::RenderLayer::enclosingElement):
+            Remove an assertion; we may now reach this condition if loading a
+            cached SVG document results in RenderLayer::filterNeedsRepaint() being
+            called before the object has been inserted into the render tree.
</ins><span class="cx"> 
</span><del>-        * dom/SpaceSplitString.cpp:
-        (WebCore::hasNonASCIIOrUpper): Deleted.
-        (WebCore::tokenizeSpaceSplitString): Use a for loop instead of while.
-        (WebCore::spaceSplitStringTable): Renamed from sharedDataMap; the new name is supposed
-        to help us see the analogy with the atomic string table.
-        (WebCore::SpaceSplitString::set): Removed unneeded special case for null and preflight
-        since AtomicString::convertToASCIILowercase now handles both of those. Changed to call
-        convertToASCIILowercase instead of foldCase, since we don't want to fold non-ASCII.
-        (WebCore::SpaceSplitString::spaceSplitStringContainsValue): Ditto.
-        (WebCore::SpaceSplitStringData::create): Marked this inline since it's only called in
-        one place and that place is in this file. Also used auto a bit and used get instead of
-        find since the value type is a simple pointer.
-        (WebCore::SpaceSplitStringData::destroy): Removed unneeded check for null. We never
-        create any SpaceSplitStringData with empty strings, and a null is a kind of empty string.
</del><ins>+            * rendering/RenderLayerFilterInfo.cpp:
+            (WebCore::RenderLayer::FilterInfo::notifyFinished):
+            Tell the RenderLayer that the filter needs repainting.
+            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
+            Get the Element from the renderer rather than asking the renderer's
+            Element, which will be null for anonymous RenderObjects.
</ins><span class="cx"> 
</span><del>-        * dom/SpaceSplitString.h: Removed some unneeded includes and some unneeded uses of the
-        inline keyword. Changed types from size_t to unsigned in a couple places; we had a mix
-        of the types and there was no reason to use size_t there.
</del><ins>+            * rendering/RenderLayerFilterInfo.h:
+            Removed declaration for the old workaround function, layerElement().
</ins><span class="cx"> 
</span><del>-2014-05-26  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Implementation of the &quot;grid&quot; shorthand.
-        https://bugs.webkit.org/show_bug.cgi?id=132122
</del><ins>+        Merge r165206
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+    2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The grid property is a shorthand that sets all of the explicit
-        grid properties (grid-template-rows, grid-template-columns, and
-        grid-template-areas) as well as all the implicit grid properties
-        (grid-auto-rows, grid-auto-columns, and grid-auto-flow) in a
-        single declaration
</del><ins>+            Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</ins><span class="cx"> 
</span><del>-        Notice that either explicit or implicit grid can be specified,
-        assigning the initial values to the omitted properties.
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
+            &lt;rdar://problem/15073043&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/grid-shorthand-get-set.html
</del><ins>+            Clang appears to be optimizing out a branch in RenderObject::node()
+            when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
+            We'll work around this by factoring out the code in question into a
+            separate member function marked NEVER_INLINE.
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseGridShorthand):
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in:
-        * css/StylePropertyShorthand.cpp:
-        (WebCore::webkitGridShorthand):
-        * css/StylePropertyShorthand.h:
</del><ins>+            No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</ins><span class="cx"> 
</span><del>-2014-05-26  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        Subpixel layout: Legacy Element.offset* client* return values are invalid in certain cases.
-        https://bugs.webkit.org/show_bug.cgi?id=133272
</del><ins>+            * rendering/RenderLayerFilterInfo.cpp:
+            (WebCore::RenderLayer::FilterInfo::layerElement):
+            Code moved from updateReferenceFilterClients(). Returns the Element*
+            for m_layer.
+            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
+            Use layerElement().
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            * rendering/RenderLayerFilterInfo.h:
+            Declared layerElement().
</ins><span class="cx"> 
</span><del>-        Element.offset* client* functions applied various rounding strategies on the return values before r168868.
-        (for example, offsetLeft/Top either floored through implicit integer arithmetics or rounded explicitly depending
-        whether the zoom scale was 1. see http://trac.webkit.org/changeset/168868/trunk/Source/WebCore/dom/Element.cpp for details)
-        This patch mimics the legacy behavior by either rounding or flooring the return value.
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Not testable (legacy switch is not exposed)
</del><ins>+        Merge r164950
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::adjustForLocalZoom):
-        (WebCore::convertToNonSubpixelValueIfNeeded):
-        (WebCore::Element::offsetLeft):
-        (WebCore::Element::offsetTop):
</del><ins>+    2014-03-02  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-26  Michał Pakuła vel Rutka  &lt;m.pakula@samsung.com&gt;
</del><ins>+            Add protected casting to FilterOperation classes.
+            https://bugs.webkit.org/show_bug.cgi?id=124062
</ins><span class="cx"> 
</span><del>-        [EFL] Input fields and text areas are not rendered correctly after r167771
-        https://bugs.webkit.org/show_bug.cgi?id=133181
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+            Use the type cast macro generators to produce some toFilterOperation-style
+            functions, and then use them in our PlatformCA filter code.
</ins><span class="cx"> 
</span><del>-        r167771 changed arguments of RenderTheme two virtual method arguments which were not reflected
-        in changes in derived classes, which caused parent method to be called. Arguments in derived class
-        were updated, also 'override' specifiers were added to all virtual methods to prevent similar errors.
</del><ins>+            Test: css3/filters/animation-from-initial-values-with-color-matrix.html
</ins><span class="cx"> 
</span><del>-        Already covered by fast/forms/textarea-placeholder-wrapping.html
</del><ins>+            * platform/graphics/ca/mac/PlatformCAFiltersMac.mm: Use the toFilterOperation methods, in
+            some cases removing the unnecessary double cast.
+            (PlatformCAFilters::filterValueForOperation):
+            (PlatformCAFilters::colorMatrixValueForFilter):
+            * platform/graphics/filters/FilterOperation.cpp:
+            (WebCore::BasicColorMatrixFilterOperation::blend):
+            (WebCore::BasicColorMatrixFilterOperation::operator==): Move this to the .cpp file so it can use the casting methods.
+            (WebCore::BasicComponentTransferFilterOperation::blend):
+            (WebCore::BasicComponentTransferFilterOperation::operator==): Ditto.
+            * platform/graphics/filters/FilterOperation.h: Add the casting macros.
</ins><span class="cx"> 
</span><del>-        * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::RenderThemeEfl::paintTextField):
-        (WebCore::RenderThemeEfl::paintTextArea):
-        * platform/efl/RenderThemeEfl.h:
-        (WebCore::RenderThemeEfl::supportsHover):
-        (WebCore::RenderThemeEfl::supportsControlTints):
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        Merge r157816
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Children of grid containers must be turned into grid items
-        https://bugs.webkit.org/show_bug.cgi?id=132991
</del><ins>+    2013-10-22  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            GammaFilterOperation seems to be dead code
+            https://bugs.webkit.org/show_bug.cgi?id=123173
</ins><span class="cx"> 
</span><del>-        From Blink r150472 by &lt;jchaffraix@chromium.org&gt;
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        According to specs each child of a grid container must become a
-        grid item meaning that grid items are grid level boxes and thus,
-        do not participate in the block formatting context but in the grid
-        formatting one.
</del><ins>+            * platform/graphics/filters/FilterOperation.cpp:
+            * platform/graphics/filters/FilterOperation.h:
+            Remove dead code.
</ins><span class="cx"> 
</span><del>-        This change updates the grid items' 'display' property after style
-        resolution so that we match the specification (see section 4. Grid
-        Items). The spec basically instructs us to compute the value of
-        'display' by applying the table in CSS2.1 Chapter 9.7
-        http://www.w3.org/TR/CSS2/visuren.html#dis-pos-flo
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/grid-item-display.html
</del><ins>+        Merge r155315
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::isDisplayGridBox):
-        (WebCore::StyleResolver::adjustRenderStyle):
</del><ins>+    2013-09-08  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-26  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+            FrameView::scheduleEvent() is over-engineered.
+            &lt;https://webkit.org/b/121004&gt;
</ins><span class="cx"> 
</span><del>-        Remove Vector copies in ShorthandPropertyWrapper implementation and use
-        https://bugs.webkit.org/show_bug.cgi?id=133265
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Remove gratuitous FrameActionScheduler class that was really only being used
+            to defer the occassional &quot;overflowchanged&quot; event until layout had finished.
</ins><span class="cx"> 
</span><del>-        * page/animation/CSSPropertyAnimation.cpp:
-        (WebCore::ShorthandPropertyWrapper::ShorthandPropertyWrapper): Move the passed-in Vector
-        into the member variable instead of using Vector&lt;&gt;::swap().
-        (WebCore::ShorthandPropertyWrapper::propertyWrappers): Return a const reference of the member
-        variable instead of a const value.
-        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap): Move the Vector
-        object into the ShorthandProperthyWrapper constructor.
-        (WebCore::gatherEnclosingShorthandProperties): Deploy a range-based for-loop.
</del><ins>+            * CMakeLists.txt:
+            * GNUmakefile.list.am:
+            * Target.pri:
+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj.filters:
+            * WebCore.xcodeproj/project.pbxproj:
+            * page/FrameActionScheduler.cpp:
+            * page/FrameActionScheduler.h:
</ins><span class="cx"> 
</span><del>-2014-05-26  Tanay C  &lt;tanay.c@samsung.com&gt;
</del><ins>+                Removed FrameActionScheduler.
</ins><span class="cx"> 
</span><del>-        [EFL] Fix build error in blob.cpp after r168435
-        https://bugs.webkit.org/show_bug.cgi?id=132678
</del><ins>+            * page/FrameView.h:
+            * page/FrameView.cpp:
+            (WebCore::FrameView::FrameView):
+            (WebCore::FrameView::~FrameView):
+            (WebCore::FrameView::layout):
+            (WebCore::FrameView::ScheduledEvent::ScheduledEvent):
+            (WebCore::FrameView::scheduleEvent):
+            (WebCore::FrameView::pauseScheduledEvents):
+            (WebCore::FrameView::resumeScheduledEvents):
+            (WebCore::FrameView::performPostLayoutTasks):
+            (WebCore::FrameView::updateOverflowStatus):
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+                Replaced it with a Vector&lt;ScheduledEvent&gt; and a suppression counter.
+                A ScheduledEvent is just a { Node, Event } pair.
</ins><span class="cx"> 
</span><del>-        * fileapi/Blob.cpp:
-        (WebCore::Blob::size): Using isInBound to check range of local var
-        actualsize to resolve build error
</del><ins>+2014-05-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-25  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        erge r169098
</ins><span class="cx"> 
</span><del>-        [EFL] Remove TileCairo and TiledBackingStoreBackendCairo
-        https://bugs.webkit.org/show_bug.cgi?id=133274
</del><ins>+    2013-09-19  Bear Travis  &lt;betravis@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+            CSS_SHAPES not supported on AppleWin port
+            https://bugs.webkit.org/show_bug.cgi?id=118810
</ins><span class="cx"> 
</span><del>-        Now, TiledBackingStore is only used for CoordinatedGraphics and the EFL port.
-        CoordinatedGraphics does not use TileCairo and TiledBackingStoreBackendCairo.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        This patch removed them and refactored related files.
</del><ins>+            Enabling fast/shapes on windows.
</ins><span class="cx"> 
</span><del>-        * PlatformEfl.cmake:
-        * PlatformGTK.cmake:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * platform/graphics/TiledBackingStore.cpp:
-        (WebCore::TiledBackingStore::TiledBackingStore): Deleted.
-        * platform/graphics/TiledBackingStore.h:
-        * platform/graphics/TiledBackingStoreBackend.h:
-        * platform/graphics/cairo/TileCairo.cpp: Removed.
-        * platform/graphics/cairo/TiledBackingStoreBackendCairo.cpp: Removed.
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add missing shape includes.
+            * WebCore.vcxproj/WebCoreCommon.props: Include shapes source folder.
+            * WebCore.vcxproj/copyForwardingHeaders.cmd: Copy shapes headers.
+            * css/CSSPropertyNames.in: Tweak to ensure shapes properties are regenerated.
</ins><span class="cx"> 
</span><del>-2014-05-25  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+2014-05-08  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        setData() of DataTransfer has a void return type
-        https://bugs.webkit.org/show_bug.cgi?id=133108
</del><ins>+        Rollout r168034.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+2014-05-07  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        According to HTML5 spec, setData() of DataTranfer interface does not return value.
-        http://www.w3.org/TR/html/editing.html#the-datatransfer-interface
</del><ins>+    Rollout r168104
</ins><span class="cx"> 
</span><del>-        Test: editing/pasteboard/set_data_typeof_return.html
</del><ins>+2014-05-05  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/DataTransfer.cpp:
-        (WebCore::DataTransfer::setData):
-        * dom/DataTransfer.h:
-        * dom/DataTransfer.idl:
-        * platform/Pasteboard.h:
-        * platform/efl/PasteboardEfl.cpp:
-        (WebCore::Pasteboard::writeString):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writeString):
-        * platform/ios/PasteboardIOS.mm:
-        (WebCore::Pasteboard::writeString):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writeString):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeString):
</del><ins>+        Fix the Mountain Lion build.
</ins><span class="cx"> 
</span><del>-2014-05-25  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Some versions of Clang on Mountain Lion do not set __cplusplus to 201103L when compiling with -std=gnu++11,
+        which causes CF_ENUMs to be weakly-typed. Detect this case and export the correct symbols.
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Use ScrollView's scrollOffset as the unobscuredContentRect
-        https://bugs.webkit.org/show_bug.cgi?id=133262
</del><ins>+        On Lion, CFURLComponentType is not defined using CF_ENUM, so it will always be a weakly-typed enum.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
-
-        Since VisibleContentRect was fixed, we were no longer sending scroll events when updating the scrollOffset
-        when updating the visible content rects. The reason is that the scrollOffset was defined as the top left of the
-        VisibleContentRect, and as such was already at the end position after updating the unobscured rect.
-
-        This patch split the unobscuredContentRect in unobscuredContentSize (updated live on zoom) and the position defined
-        by the ScrollView's scrollOffset (updated when scrolling).
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * platform/ScrollView.h:
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::unobscuredContentRect):
-        (WebCore::ScrollView::setUnobscuredContentSize):
-        (WebCore::ScrollView::setUnobscuredContentRect): Deleted.
</del><span class="cx"> 
</span><del>-2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2014-05-03  Babak Shafiei  &lt;bshafiei@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add type-checked casts for TransformOperations
-        &lt;http://webkit.org/b/133217&gt;
</del><ins>+        Follow-up fix for the merge of r167480.
+        
+        Rubber stamped by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * platform/KURL.cpp:
+        (WebCore::KURL::host): Return empty string instead of null string.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::validateTransformOperations):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::getTransformFunctionValue):
-        - Switch to type-checked casts.
</del><ins>+2014-05-02  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/IdentityTransformOperation.h:
-        * platform/graphics/transforms/Matrix3DTransformOperation.h:
-        * platform/graphics/transforms/MatrixTransformOperation.h:
-        * platform/graphics/transforms/PerspectiveTransformOperation.h:
-        * platform/graphics/transforms/RotateTransformOperation.h:
-        * platform/graphics/transforms/ScaleTransformOperation.h:
-        * platform/graphics/transforms/SkewTransformOperation.h:
-        * platform/graphics/transforms/TranslateTransformOperation.h:
-        - Add 'final' to class declaration.
-        - Add 'override' to overridden methods.
-        - Add type-checked cast via TRANSFORMOPERATION_TYPE_CASTS macro.
-        - Move implementation of operator==(const TransformOperation&amp;)
-          from header to source file so it is able to use a type-checked
-          cast, and switch back to using a reference instead of a
-          pointer.
-        - Add or update ASSERT in private constructor to check for
-          correct OperationType in classes that represent multiple
-          types.
</del><ins>+        Merge r166420.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
</del><ins>+    2014-03-28  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
+    
+            Clear SVGInlineTextBox fragments when the text changes.
+            https://bugs.webkit.org/show_bug.cgi?id=130879
+    
+            Reviewed by Darin Adler.
+    
+            Ported from Blink: https://src.chromium.org/viewvc/blink?revision=150456&amp;view=revision
+    
+            This patch modifies SVGInlineTextBox::dirtyLineBoxes to clear all
+            following text boxes when invoked. Typically this method is called
+            when the underlying text string changes, and that change needs to
+            be propagated to all the boxes that use the text beyond the point
+            where the text is first modified.
+            
+            Also cleans up final function keywords for SVGRootInlineBox.
+    
+            Test: svg/custom/unicode-in-tspan-multi-svg-crash.html
+    
+            * rendering/InlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
+            (WebCore::InlineTextBox::dirtyOwnLineBoxes): Calls dirtyLineBoxes()
+            * rendering/svg/SVGInlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
+            (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes):
+            * rendering/svg/SVGInlineTextBox.cpp:
+            (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes): Non-recursive part of dirtyLineBoxes()
+            (WebCore::SVGInlineTextBox::dirtyLineBoxes): Calls dirtyOwnLineBoxes() in a loop
+            * rendering/svg/SVGRootInlineBox.h:
+    
+2014-05-02  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/MatrixTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::MatrixTransformOperation::blend):
-        - Switch to type-checked casts and use a reference.
</del><ins>+        Merge r165053.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::PerspectiveTransformOperation::blend):
-        * platform/graphics/transforms/RotateTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::RotateTransformOperation::blend):
-        * platform/graphics/transforms/ScaleTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::ScaleTransformOperation::blend):
-        * platform/graphics/transforms/SkewTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::SkewTransformOperation::blend):
-        * platform/graphics/transforms/TranslateTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::TranslateTransformOperation::blend):
-        - Switch to type-checked casts.
</del><ins>+    2014-03-03  David Kilzer  &lt;ddkilzer@apple.com&gt;
+    
+            SVGPropertyTearOffs should detachChildren before deleting its value.
+            &lt;http://webkit.org/b/129618&gt;
+            &lt;rdar://problem/15661617&gt;
+    
+            Reviewed by Maciej Stachowiak.
+    
+            Merged from Blink (patch by kouhei@chromium.org):
+            https://src.chromium.org/viewvc/blink?revision=158563&amp;view=revision
+            http://crbug.com/296276
+    
+            Test: svg/transforms/svg-matrix-tearoff-crash.html
+    
+            NOTE: The test does not reproduce a crash on WebKit using
+            JavaScriptCore.
+    
+            * svg/properties/SVGPropertyTearOff.h:
+            (WebCore::SVGPropertyTearOff::setValue):
+            (WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
+            - Call detachChildren() if m_value is a copy.  The original
+              Blink patch did not modify the destructor code path, although
+              that seems obvious via code inspection.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/TransformOperation.h:
-        (WebCore::TransformOperation::isRotateTransformOperationType):
-        (WebCore::TransformOperation::isScaleTransformOperationType):
-        (WebCore::TransformOperation::isSkewTransformOperationType):
-        (WebCore::TransformOperation::isTranslateTransformOperationType):
-        - Add type-checking methods used in constructors and type-checked
-          casts.
-        - Define TRANSFORMOPERATION_TYPE_CASTS macro used by subclasses.
</del><ins>+        Merge r164917.
</ins><span class="cx"> 
</span><del>-2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+    2014-03-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
+    
+            Fix lifetime handling of SVGPropertyTearOffs
+            &lt;http://webkit.org/b/129211&gt;
+            &lt;rdar://problem/15696025&gt;
+    
+            Reviewed by Maciej Stachowiak.
+    
+            Merged from Blink (patch by Ojan Vafai):
+            https://src.chromium.org/viewvc/blink?revision=157801&amp;view=revision
+            http://crbug.com/288771
+    
+                -Replace SVGStaticPropertyWithParentTearOff with SVGMatrixTearOff
+                since it's only used in that one place. This means we can get rid
+                of the templatizing and the method pointer.
+                -Change SVGPropertyTearOff to keep track of it's child tearoffs
+                and call detachWrapper on its child tearoffs when it's destroyed
+                or when it's wrapper is detached.
+                -Have SVGPropertyTearOff hold WeakPtrs to the child tearoffs
+                to avoid having a cycle.
+    
+            Test: svg/transforms/svg-matrix-tearoff-crash.html
+    
+            * GNUmakefile.list.am:
+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj.filters:
+            * WebCore.xcodeproj/project.pbxproj:
+            * bindings/scripts/CodeGeneratorJS.pm:
+            (NativeToJSValue):
+            * svg/properties/SVGMatrixTearOff.h: Renamed from Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h.
+            (WebCore::SVGMatrixTearOff::create):
+            (WebCore::SVGMatrixTearOff::commitChange):
+            (WebCore::SVGMatrixTearOff::SVGMatrixTearOff):
+            * svg/properties/SVGPropertyTearOff.h:
+            (WebCore::SVGPropertyTearOff::addChild):
+            (WebCore::SVGPropertyTearOff::detachChildren):
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Crash in WebCore::TextResourceDecoder::checkForCSSCharset
-        &lt;http://webkit.org/b/133257&gt;
-        &lt;rdar://problem/17027109&gt;
</del><ins>+        Merge r167295.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+    2014-04-14  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
+    
+            Assertion failure under FEImage::determineAbsolutePaintRect()
+    
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=131660&gt;
+            &lt;rdar://problem/15669294&gt;
+    
+            This patch merges Chromium r149536 (see
+            &lt;https://chromiumcodereview.appspot.com/14701012&gt;), which moves
+            m_absoluteTransform out of SVGFilter and into the base Filter class, so
+            that it isn't necessary to cast a Filter to SVGFilter to get the
+            absolute transform.
+    
+            Reviewed by Geoffrey Garen.
+    
+            Test: svg/filters/feImage-filter-assertion.html
+    
+            * platform/graphics/filters/Filter.h:
+            (WebCore::Filter::Filter):
+            Changed to take the absolute transform.
+            (WebCore::Filter::absoluteTransform):
+            Moved from SVGFilter.
+            (WebCore::Filter::mapAbsolutePointToLocalPoint):
+            Ditto.
+    
+            * rendering/FilterEffectRenderer.cpp:
+            (WebCore::FilterEffectRenderer::FilterEffectRenderer):
+            Pass a default AffineTransform() to the Filter base class.
+    
+            * svg/graphics/filters/SVGFEImage.cpp:
+            (WebCore::FEImage::determineAbsolutePaintRect):
+            Use the Filter without casting it to SVGFilter.
+            (WebCore::FEImage::platformApplySoftware):
+            Ditto.
+    
+            * svg/graphics/filters/SVGFilter.cpp:
+            (WebCore::SVGFilter::SVGFilter):
+            Pass the transform to the base class, and remove initialization of a
+            removed member var.
+    
+            * svg/graphics/filters/SVGFilter.h:
+            Member var moved to Filter.h.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/encoding/css-charset-missing-semi-colon-and-newline.html
</del><ins>+        Merge r166736.
</ins><span class="cx"> 
</span><del>-        * loader/TextResourceDecoder.cpp:
-        (WebCore::TextResourceDecoder::checkForCSSCharset): Add early
-        return.
</del><ins>+    2014-04-03  David Hyatt  &lt;hyatt@apple.com&gt;
+    
+            Continuations casting issue.
+            https://bugs.webkit.org/show_bug.cgi?id=130057
+            &lt;rdar://problem/16283406&gt;
+    
+            Reviewed by Simon Fraser.
+    
+            The code to update relative positioned anonymous block continuations should not
+            have assumed that all siblings were RenderBlocks. Make the code smarter and
+            make it bail when it hits something that isn't part of the block continuation
+            chain.
+    
+            Added fast/block/continuation-crash.html
+    
+            * rendering/RenderInline.cpp:
+            (WebCore::updateStyleOfAnonymousBlockContinuations):
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-24  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Merge r167480.
</ins><span class="cx"> 
</span><del>-        [Mac] preload AVAssetTrack properties before asking for them
-        https://bugs.webkit.org/show_bug.cgi?id=133240
</del><ins>+    2014-04-17  Darin Adler  &lt;darin@apple.com&gt;
+    
+            origin spoofing possible (HTTP Origin, postMessage event.origin) due to inappropriate URL escape sequence decoding
+            https://bugs.webkit.org/show_bug.cgi?id=131837
+            rdar://problem/15211936
+    
+            Reviewed by Anders Carlsson and Dave Hyatt.
+    
+            Tests: fast/dom/DOMURL/parsing.html
+                   fast/dom/HTMLAnchorElement/anchor-element-href-parsing.html
+    
+            * platform/URL.cpp:
+            (WebCore::URL::host): Removed unnecessary call to decodeURLEscapeSequences, which caused
+            problems and was not needed.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Merge r167524.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::assetTrackMetadataKeyNames): Add preferredTransform and naturalSize to the list
-            of properties we preload.
</del><ins>+    2014-04-18  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
+    
+            Harden RenderInline::inlineElementContinuation()
+    
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=131858&gt;
+    
+            Reviewed by Sam Weinig.
+    
+            No new tests, as there are no known cases of this happening.
+    
+            * rendering/RenderInline.cpp:
+            (WebCore::RenderInline::inlineElementContinuation):
+            Return nullptr if the continuation is neither a RenderInline nor a
+            RenderBlock.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-24  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+        Merge r167672.
</ins><span class="cx"> 
</span><del>-        Remove one of the CSSProperty constructor
-        https://bugs.webkit.org/show_bug.cgi?id=131094
</del><ins>+    2014-04-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
+    
+            Check (rather than assume) element is a RenderTableSection before using it
+            https://bugs.webkit.org/show_bug.cgi?id=121858
+    
+            Reviewed by David Kilzer.
+    
+            Test: fast/table/table-insert-object-before-td-crash.html
+    
+            * rendering/RenderTable.cpp:
+            (WebCore::RenderTable::addChild): Check that lastBox is a table section before
+            using the node as if it was one.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Merge r167569 (committing on behalf of Dana Burkart.)
</ins><span class="cx"> 
</span><del>-        Remove one of the CSSProperty constructor, because it is obsolete.
</del><ins>+    2014-04-19  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSProperty.h:
-        (WebCore::CSSProperty::CSSProperty): Deleted.
-        * css/StyleProperties.h:
-        (WebCore::StyleProperties::PropertyReference::toCSSProperty):
</del><ins>+            Crashes in HTMLFormElement::submit.
+            https://bugs.webkit.org/show_bug.cgi?id=131910
+            &lt;rdar://problem/15661790&gt;
</ins><span class="cx"> 
</span><del>-2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Based on a patch by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        Rename ScrollingTreeScrollingNode's m_scrollPosition to make it clear that it's the value committed from the state tree
-        https://bugs.webkit.org/show_bug.cgi?id=133254
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Tests: fast/forms/form-submission-crash-2.html
+                  fast/forms/form-submission-crash.html
</ins><span class="cx"> 
</span><del>-        Make ScrollingTreeScrollingNode::scrollPosition() pure virtual, and rename
-        the member variable and associated getter to make it clear that they relate
-        to the last committed scroll position.
</del><ins>+            Code that executes arbitrary JS needs to protect objects that it uses afterwards.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingTreeScrollingNode.cpp:
-        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        (WebCore::ScrollingTreeScrollingNode::lastCommittedScrollPosition):
-        (WebCore::ScrollingTreeScrollingNode::scrollPosition): Deleted.
</del><ins>+            * html/HTMLFormElement.cpp:
+            (WebCore::HTMLFormElement::prepareForSubmission):
+            (WebCore::HTMLFormElement::submit):
+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::submitForm):
</ins><span class="cx"> 
</span><del>-2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Share some more ScrollingTreeScrollingNode code
-        https://bugs.webkit.org/show_bug.cgi?id=133248
</del><ins>+        Merge r166650.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+    2014-04-02  David Kilzer  &lt;ddkilzer@apple.com&gt;
+    
+            Use outermost containing isolate when constructing bidi runs
+            &lt;http://webkit.org/b/131107&gt;
+            &lt;rdar://problem/15690021&gt;
+    
+            Reviewed by Darin Adler.
+    
+            Merged from Blink (patch by jww@chromium.org):
+            https://src.chromium.org/viewvc/blink?revision=157268&amp;view=revision
+            http://crbug.com/279277
+    
+                Update containingIsolate to go back all the way to top
+                isolate from current root, rather than stopping at the first
+                isolate it finds. This works because the current root is
+                always updated with each isolate run.
+    
+            Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
+                   fast/text/international/unicode-bidi-isolate-nested-with-removes.html
+    
+            * rendering/InlineIterator.h:
+            (WebCore::highestContainingIsolateWithinRoot):
+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::constructBidiRunsForSegment):
+    
+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Push scrollBy(), scrollByWithoutContentEdgeConstraints() and setScrollPosition()
-        down to ScrollingTreeFrameScrollingNode.
-        
-        This requires that scrollPosition() return the right thing for each class, so make
-        it virtual. Future patches will reduce the confusion between the committed scroll
-        position and the one derived from layers.
</del><ins>+    Rollout r168020.
+    This causes build failures on Lion/ML.  
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp:
-        (WebCore::ScrollingTreeFrameScrollingNode::scrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNode::scrollByWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNode::setScrollPosition):
-        * page/scrolling/ScrollingTreeFrameScrollingNode.h:
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        (WebCore::ScrollingTreeScrollingNode::scrollPosition):
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h:
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPosition): Deleted.
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollBy): Deleted.
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollByWithoutContentEdgeConstraints): Deleted.
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollByWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollBy): Deleted.
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollByWithoutContentEdgeConstraints): Deleted.
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Merge r166049
</ins><span class="cx"> 
</span><del>-        AX: fix coordinate mapping for iOS accessibility
-        https://bugs.webkit.org/show_bug.cgi?id=133188
</del><ins>+    2014-03-21  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            HTMLFrameOwnerElement should obey the SubframeLoadingDisabler when creating subframes
+            &lt;rdar://problem/15675780&gt;
</ins><span class="cx"> 
</span><del>-        Make WebCore aware of the accessibility point/rect conversion methods.
</del><ins>+            Merge Blink r156744 by Adam Klein.
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
-        (-[WebAccessibilityObjectWrapper convertRectToScreenSpace:]):
-        * loader/EmptyClients.h:
-        * page/Chrome.cpp:
-        (WebCore::Chrome::accessibilityScreenToRootView):
-        (WebCore::Chrome::rootViewToAccessibilityScreen):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * platform/HostWindow.h:
</del><ins>+            Test: fast/frames/set-iframe-src-in-pagehide-crash.html
</ins><span class="cx"> 
</span><del>-2014-05-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            * loader/SubframeLoader.cpp:
+            (WebCore::SubframeLoader::loadSubframe):
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Non-compositing transforms with subpixel coordinates paint to wrong position.
-        https://bugs.webkit.org/show_bug.cgi?id=133184
-        &lt;rdar://problem/16745606&gt;
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r167278
</ins><span class="cx"> 
</span><del>-        Snapping relative negative coordinate values should produce the same position as if they were
-        positive absolute coordinates.
-        When a child box gets positioned off of its containers towards top/left, its relative coordinates
-        become negative. Pixel snapping those negative values should produce the same
-        final painting position as if the child box was fixed positioned with positive coordinates.
-        Since halfway values always round away from zero, negative and positive halfway values
-        produce opposite rounding direction.
-        This patch ensures that negative halfway values round to the direction as if they were positive.  
</del><ins>+    2014-04-14  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/layers/hidpi-floor-negative-coordinate-values-to-maintain-rounding-direction.html
</del><ins>+            Assertion failure !node || node-&gt;isElementNode() in
+            WebCore::RenderBlock::inlineElementContinuation
</ins><span class="cx"> 
</span><del>-        * platform/LayoutUnit.h:
-        (WebCore::roundToDevicePixel):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
</del><ins>+            https://bugs.webkit.org/show_bug.cgi?id=108829
+            &lt;rdar://problem/13666405&gt;
</ins><span class="cx"> 
</span><del>-2014-05-24  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+            I can't reproduce this assertion failure, but there seems to be an
+            invalid assumption in RenderBlock::inlineElementContinuation() that
+            anything with the &quot;isInline()&quot; bit set is a RenderInline.
</ins><span class="cx"> 
</span><del>-        Use size variants and glyph assembly from the MATH data.
-        https://bugs.webkit.org/show_bug.cgi?id=130322
</del><ins>+            No new test because the test case in the bug does not repro for me.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        This patch modifies the RenderMathMLOperator code to use the MATH table
-        when one is provided in the current font on the &lt;math&gt; tag. More
-        precisely, the MathVariants table is used to draw a size variant or
-        a glyph assembly. The displaystyle attribute is not supported yet, so
-        for now large operators are always assumed to be in display style. The
-        MATH support does not work well with all platforms+fonts, so at the
-        moment the default font-family on the &lt;math&gt; is not changed.
</del><ins>+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::inlineElementContinuation):
+            Dave Hyatt says that this function should only return RenderInline
+            objects (not non-RenderInline inline objects), so update the checks
+            from isInline() to isRenderInline() before casting with
+            toRenderInline().
</ins><span class="cx"> 
</span><del>-        Tests: mathml/opentype/large-operators-LatinModern.html
-               mathml/opentype/opentype-stretchy.html
-               mathml/opentype/vertical-LatinModern.html
</del><ins>+            * rendering/RenderInline.cpp:
+            (WebCore::RenderInline::inlineElementContinuation):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        * css/mathml.css: We only specify the default font-family on the math root, so that people can easily style the mathematics.
-        For now, old fonts without the MATH table are still used as the default.
-        (math):
-        (math, mfenced &gt; *): Deleted.
-        (mo, mfenced): Deleted.
-        * platform/graphics/SimpleFontData.cpp: don't return the math data if the font is loading.
-        (WebCore::SimpleFontData::mathData):
-        * platform/graphics/opentype/OpenTypeMathData.cpp: update #ifdef so that disabling ENABLE_OPENTYPE_MATH won't lead to errors with unused parameters.
-        (WebCore::OpenTypeMathData::OpenTypeMathData):
-        (WebCore::OpenTypeMathData::getMathConstant):
-        (WebCore::OpenTypeMathData::getItalicCorrection):
-        (WebCore::OpenTypeMathData::getMathVariants):
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::boundsForGlyph):
-        (WebCore::RenderMathMLOperator::heightForGlyph):
-        (WebCore::RenderMathMLOperator::advanceForGlyph):
-        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): We handle preferred width of size variants.
-        (WebCore::RenderMathMLOperator::shouldAllowStretching): This function now only returns whether the operator will stretch and no longer has side effect.
-        (WebCore::RenderMathMLOperator::getGlyphAssemblyFallBack): We add a function to convert from the MathVariant table data to the format supported by RenderMathMLOperator.
-        (WebCore::RenderMathMLOperator::getDisplayStyleLargeOperator): We add a function to get the glyph that will be used for large operators in display style.
-        (WebCore::RenderMathMLOperator::findStretchyData): We make this function handle size variants.
-        (WebCore::RenderMathMLOperator::updateStyle): We handle size variants.
-        (WebCore::RenderMathMLOperator::paint): We handle size variants.
-        * rendering/mathml/RenderMathMLOperator.h:
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-23  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Merge r167211
</ins><span class="cx"> 
</span><del>-        REGRESSION (iOS WebKit2): requestAnimationFrame fires more than once between layer tree commits
-        https://bugs.webkit.org/show_bug.cgi?id=132794
-        &lt;rdar://problem/16877909&gt;
</del><ins>+    2014-04-13  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            userVisibleString should not try to &quot;encode&quot; host names
+            https://bugs.webkit.org/show_bug.cgi?id=131587
+            rdar://problem/14686849
</ins><span class="cx"> 
</span><del>-        Virtualize DisplayRefreshMonitor so that WebKit2 can implement its own DisplayRefreshMonitor for UI-side compositing views.
-        This allows the synchronization of requestAnimationFrame callbacks with UI-side compositing painting.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::graphicsLayerFactory):
-        (WebCore::ChromeClient::createDisplayRefreshMonitor):
-        * platform/graphics/DisplayRefreshMonitorFactory.h: Added.
-        * platform/graphics/GraphicsLayerUpdater.cpp:
-        (WebCore::GraphicsLayerUpdater::createDisplayRefreshMonitor):
-        * platform/graphics/GraphicsLayerUpdater.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::createDisplayRefreshMonitor):
-        * rendering/RenderLayerCompositor.h:
-        Give the ChromeClient a chance to provide us with a custom DisplayRefreshMonitor.
-        If it does not, we'll fall back to making a DisplayRefreshMonitorMac or
-        DisplayRefreshMonitorIOS depending on the platform.
</del><ins>+            * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.
</ins><span class="cx"> 
</span><del>-        * dom/ScriptedAnimationController.cpp:
-        * dom/ScriptedAnimationController.h:
-        * platform/graphics/DisplayRefreshMonitor.cpp:
-        * platform/graphics/DisplayRefreshMonitor.h:
-        * platform/graphics/DisplayRefreshMonitorClient.cpp: Added.
-        * platform/graphics/DisplayRefreshMonitorClient.h: Added.
-        * platform/graphics/DisplayRefreshMonitorManager.cpp: Added.
-        * platform/graphics/DisplayRefreshMonitorManager.h: Added.
-        Split DisplayRefreshMonitor.cpp into one file per class.
-        Use references in a few places.
-        Remove some useless comments.
</del><ins>+            * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
+            Objective-C++ header compile in plain C++ files, which we never need to do.
+            Added missing argument name, baseURL, and changed mysterious CFIndex arguments
+            to the correct type, CFURLComponentType.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/DisplayRefreshMonitor.cpp:
-        (WebCore::DisplayRefreshMonitor::displayDidRefresh):
-        Use takeAny() and remove a FIXME about it not existing.
</del><ins>+            * platform/mac/WebCoreNSURLExtras.mm:
+            (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
+            more lookalike characters from the Mozilla list referenced here.
+            (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
+            (WebCore::dataForURLComponentType): Ditto.
+            (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
+            needed; no encoding here.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/DisplayRefreshMonitorClient.cpp: Added.
-        (WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded):
-        Use an early return instead of having the whole function body in an if().
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ios/DisplayRefreshMonitorIOS.h: Added.
-        * platform/graphics/ios/DisplayRefreshMonitorIOS.mm:
-        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
-        * platform/graphics/mac/DisplayRefreshMonitorMac.h: Added.
-        Virtualize DisplayRefreshMonitorIOS and DisplayRefreshMonitorMac,
-        and move things specific to each of them out of DisplayRefreshMonitor itself.
</del><ins>+        Merge r167167
</ins><span class="cx"> 
</span><del>-2014-05-23  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</del><ins>+    2014-04-11  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        CSS JIT: Apply backtracking optimization to adjacent backtracking
-        https://bugs.webkit.org/show_bug.cgi?id=132951
</del><ins>+            Assertion failure changing select element size during focus event
+            dispatch
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=131566&gt;
+            &lt;rdar://problem/16400735&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-        Apply the backtracking optimization to the adjacent backtracking.
-        This optimization is already done for the descendant backtracking.
-        We apply this to the adjacent backtracking similarly.
</del><ins>+            Test: fast/forms/select-change-size-during-focus.html
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/backtracking-adjacent-optimized.html
</del><ins>+            * html/HTMLSelectElement.cpp:
+            (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+            Adopt the fix from Chromium r171216; check that the renderer is still
+            of the expected type, and return early if it is not.
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
-        (WebCore::SelectorCompiler::solveAdjacentBacktrackingActionForDirectAdjacent):
-        (WebCore::SelectorCompiler::solveBacktrackingAction):
-        (WebCore::SelectorCompiler::computeBacktrackingStartOffsetInChain):
-        (WebCore::SelectorCompiler::computeBacktrackingHeightFromDescendant):
-        (WebCore::SelectorCompiler::computeBacktrackingWidthFromIndirectAdjacent):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::linkFailures):
-        (WebCore::SelectorCompiler::computeBacktrackingStartHeightFromDescendant): Deleted.
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-23  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Merge r167135
</ins><span class="cx"> 
</span><del>-        Make CSS JIT run on ARM64.
-        https://bugs.webkit.org/show_bug.cgi?id=133156
</del><ins>+    2014-04-10  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Heap-use-after-free in WebCore::SpeechSynthesisUtterance::startTime
+            https://bugs.webkit.org/show_bug.cgi?id=131482
</ins><span class="cx"> 
</span><del>-        * cssjit/FunctionCall.h:
-        (WebCore::FunctionCall::saveAllocatedRegisters):
-        (WebCore::FunctionCall::restoreAllocatedRegisters):
-        Use StackAllocator's new push and pop functions to push and pop a vector instead of iterating it.
-        * cssjit/RegisterAllocator.h:
-        (WebCore::RegisterAllocator::reserveCalleeSavedRegisters):
-        (WebCore::RegisterAllocator::restoreCalleeSavedRegisters):
-        Return a vector of registers to allocate instead of doing the allocation to make the RegisterAllocator
-        not need to know about the StackAllocator and to use the new vector push and pop functions.
-        (WebCore::RegisterAllocator::~RegisterAllocator):
-        Store RegisterIDs instead of StackReferences to avoid needing to know about the stack.
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::compile):
-        Removed the requirement for assert to be disabled to print disassembly when debugging css jit.
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generatePrologue):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateEpilogue):
-        Added to correctly push the link register and frame pointer.
-        This is required if the jit code calls a function on arm64 and helpful for debugging tools on x86_64.
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
-        Generate the prologue and epilogue which respectively push and pop
-        the link register, frame pointer, and callee saved registers if needed.
-        * cssjit/StackAllocator.h:
-        (WebCore::StackAllocator::push):
-        (WebCore::StackAllocator::pop):
-        Added new vector push and pop functions to use stp and ldb instructions on arm64.
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-2014-05-23  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            Hold onto the utterance until it has time to fire, in case other references have been removed.
</ins><span class="cx"> 
</span><del>-        Hide fullscreen immediately when switching tabs.
-        https://bugs.webkit.org/show_bug.cgi?id=133239
</del><ins>+            Merged from Blink r171077 by &lt;dmazzoni@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Test: platform/mac/fast/speechsynthesis/speech-synthesis-gc-utterance-crash.html
</ins><span class="cx"> 
</span><del>-        This change allows fullscreen to disappear immediately while still cleaning
-        up fullscreen normally.
</del><ins>+            * Modules/speech/SpeechSynthesis.cpp:
+            (WebCore::SpeechSynthesis::handleSpeakingCompleted):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ios/WebVideoFullscreenControllerAVKit.h:
-        renamed function to requestHideAndExitFullscreen
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
-        renamed function to requestHideAndExitFullscreen
</del><ins>+        Merge r167093
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController requestHideAndExitFullscreen]):
-        rename of requestExitFullscreen that also hides.
</del><ins>+    2014-04-08  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController requestExitFullscreen]): Deleted.
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h: declare requestHideAndExitFullscreen()
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (WebVideoFullscreenInterfaceAVKit::requestHideAndExitFullscreen):
-        this hides the window before requesting exitfullscreen from the model.
</del><ins>+            Assertion failure in WebCore::FlexBoxIterator::next()
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=117176&gt;
+            &lt;rdar://problem/14054549&gt;
</ins><span class="cx"> 
</span><del>-2014-05-23  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+            Code added in r115687 began removing anonymous wrappers when children
+            become inline. However, there are some objects, like
+            RenderDeprecatedFlexBox, whose children should always be blocks.
</ins><span class="cx"> 
</span><del>-        [iOS] WKPDFView should have a page indicator
-        https://bugs.webkit.org/show_bug.cgi?id=133109
-        &lt;rdar://problem/16383003&gt;
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            * rendering/RenderBlock.h:
+            (WebCore::RenderBlock::canCollapseAnonymousBlockChild):
+            Made public.
</ins><span class="cx"> 
</span><del>-        * English.lproj/Localizable.strings:
</del><ins>+            * rendering/RenderObject.cpp:
+            (WebCore::RenderObject::removeAnonymousWrappersForInlinesIfNecessary):
+            Return early if we can't collapse anonymous block children.
</ins><span class="cx"> 
</span><del>-2014-05-23  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove invalid ASSERT in wordRangeForPosition.
-        https://bugs.webkit.org/show_bug.cgi?id=133232
</del><ins>+        Merge r167092
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+    2014-04-07  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        In WK2 for iOS this function is called on every selection change.
-        The selection could be set by Javascript in an element that is not visible.
-        In that case we won't be able to create a VisiblePosition therefore wordRangeForPosition
-        should not ASSERT that the VisiblePosition is not null, but rather
-        perform an early return if it is null.
</del><ins>+            Assertion failure, !node || node-&gt;isElementNode(), in
+            WebCore::RenderBlock::clone()
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=110489&gt;
+            &lt;rdar://problem/13666425&gt;
</ins><span class="cx"> 
</span><del>-        * editing/VisibleUnits.cpp:
-        (WebCore::wordRangeFromPosition):
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-05-23  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+            We're ending up in RenderBlock::splitBlocks() with |this| ==
+            |fromBlock|.  We then try to climb the ancestor block chain from
+            this-&gt;parent() to |fromBlock|, but this-&gt;parent() is already above
+            |fromBlock|, so we end up climbing up to the RenderView and trying to
+            clone it, causing the assertion failure.
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Use gridRowCount() and gridColumnCount() when possible
-        https://bugs.webkit.org/show_bug.cgi?id=133213
</del><ins>+            Adopt Chromium's mitigation for this from
+            &lt;https://codereview.chromium.org/13852041&gt;. This is not intended as a
+            fix for the underlying issue.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sergio Villar Senin.
</del><ins>+            Also, fix another issue that occurs with this fuzzed test case that's
+            not handled by the Chromium fix.
</ins><span class="cx"> 
</span><del>-        Use gridRowCount() and gridColumnCount() instead of m_grid.size() and
-        m_grid[0].size() to make the code more descriptive and easier to
-        understand.
</del><ins>+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::splitBlocks):
+            Ensure while we're in the loop that |curr| is a descendant of
+            |fromBlock|. From the Chromium patch:
</ins><span class="cx"> 
</span><del>-        No new tests (No change in behavior).
</del><ins>+                We need to check in every iteration of the loop because
+                moveChildrenTo could have moved |curr|. This is a mitigation and
+                not really a fix against a class of tree craziness.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::growGrid):
-        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
</del><ins>+            Finally, before moving children from |fromBlock| to |toBlock|, ensure
+            that the children are children of |fromBlock|. If we never entered the
+            loop, they will be siblings of |fromBlock|, not children.
</ins><span class="cx"> 
</span><del>-2014-05-23  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r153917): Chart for the Category Explorer within Quicken Essentials
-        does not draw until you force a redraw
-        https://bugs.webkit.org/show_bug.cgi?id=133228
-        &lt;rdar://problem/15221231&gt;
</del><ins>+        Merge r166601
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2014-04-01  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/RuntimeApplicationChecks.cpp: (WebCore::applicationIsQuickenEssentials):
-        * platform/RuntimeApplicationChecks.h:
-        Added a check for Quicken Essentials.
</del><ins>+            RenderQuote must destroy remaining text renderer before first letter renderer
+            https://bugs.webkit.org/show_bug.cgi?id=78023
+            &lt;rdar://problem/10830009&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mac/WidgetMac.mm: (WebCore::Widget::paint): Don't do an early return
-        for Quicken Essentials, it depends on drawing to update its layer.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-05-23  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+            Merged from Blink (patch by Abhishek Arya):
+            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=151270
</ins><span class="cx"> 
</span><del>-        REGRESSION(r169105): fast/regions/cssom/region-range-for-box-crash.html is more crashy than before
-        https://bugs.webkit.org/show_bug.cgi?id=133124
</del><ins>+            Following the fix for &lt;https://bugs.webkit.org/show_bug.cgi?id=114586&gt;, a
+            RenderQuote may have child render objects for the first letter of its text
+            and everything following the first letter so as to support the CSS first-
+            letter property. The latter renderer is responsible for destroying the former
+            on destruction. It's sufficient to reverse the destruction of the children of
+            RenderQuote to ensure that we destroy the remaining text renderer before we
+            destroy the first letter renderer.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            Test: fast/css-generated-content/quote-first-letter-crash.html
</ins><span class="cx"> 
</span><del>-        When adjusting the end points of a subtree selection in the case of a document
-        with named flows, we have to make sure that we pass the computed end
-        points to the visible selection algorithm only if the end points are
-        part of the same subtree, otherwise assume a selection clear behavior.
</del><ins>+            * rendering/RenderQuote.cpp:
+            (WebCore::RenderQuote::updateText):
</ins><span class="cx"> 
</span><del>-        The test fast/regions/cssom/region-range-for-box-crash.html is used to
-        test this behavior.
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/SelectionSubtreeRoot.cpp:
-        (WebCore::SelectionSubtreeRoot::adjustForVisibleSelection):
-        (WebCore::SelectionSubtreeRoot::selectionStartEndPositions): Moved to header file.
-        * rendering/SelectionSubtreeRoot.h:
-        (WebCore::SelectionSubtreeRoot::selectionStartEndPositions):
</del><ins>+        Merge r166457
</ins><span class="cx"> 
</span><del>-2014-05-23  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+    2014-03-29  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        reset m_havePreparedToPlay when changing media engines.
-        https://bugs.webkit.org/show_bug.cgi?id=133199
</del><ins>+            Preserve selection end positions in directionOfSelection
+            &lt;http://webkit.org/b/104813&gt;
+            &lt;rdar://problem/13666417&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        If a play request comes in before the media player is created, m_havePreparedToPlay
-        is set to true. But when the player is created, this prevents the new player from
-        getting the prepare call.
</del><ins>+            Merged from Blink (patch by kenrb@chromium.org):
+            https://src.chromium.org/viewvc/blink?revision=150621&amp;view=revision
+            http://crbug.com/164263
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::mediaPlayerEngineUpdated): set m_havePreparedToPlay false.
</del><ins>+                VisibleSelection::visibleStart() and VisibleSelection::visibleEnd()
+                can both cause layouts, which has the potential to invalidate any
+                rendertree-based objects. This was causing a problem in
+                FrameSelection::directionOfSelection(), where a reference to a
+                lineBox was being held across a call to visibleEnd().
</ins><span class="cx"> 
</span><del>-2014-05-23  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+                This patch ensures that the any layout is completed before linebox
+                references are retrieved.
</ins><span class="cx"> 
</span><del>-        Navigator object needs to have properties directly on the instance object
-        https://bugs.webkit.org/show_bug.cgi?id=133221
</del><ins>+            Test: editing/selection/layout-during-move-selection-crash.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Mark Lam.
</del><ins>+            * editing/FrameSelection.cpp:
+            (WebCore::FrameSelection::directionOfSelection):
</ins><span class="cx"> 
</span><del>-        Flag the Navigator object as requiring properties to be on the instance
-        as there were a few compatibility issues when on the prototype.
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (InterfaceRequiresAttributesOnInstance):
</del><ins>+        Merge r166428
</ins><span class="cx"> 
</span><del>-2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+    2014-03-28  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Switch CSSGradientValue to use more references
-        https://bugs.webkit.org/show_bug.cgi?id=133206
</del><ins>+            In some situations, partial layouts of floating elements produce incorrect results.
+            https://bugs.webkit.org/show_bug.cgi?id=122668
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Switch from pointers to references in various places.
</del><ins>+            When performing partial layout of float elements and checking if other float
+            elements are encountered, incorrect results were obtained by not checking
+            the size of the existing floats vector.
</ins><span class="cx"> 
</span><del>-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::image):
-        (WebCore::CSSGradientValue::addStops):
-        (WebCore::positionFromValue):
-        (WebCore::CSSGradientValue::computeEndPoint):
-        (WebCore::CSSLinearGradientValue::createGradient):
-        (WebCore::CSSRadialGradientValue::resolveRadius):
-        (WebCore::CSSRadialGradientValue::createGradient):
-        * css/CSSGradientValue.h:
</del><ins>+            Test: fast/block/float/floats-in-clean-line-crash.html
</ins><span class="cx"> 
</span><del>-2014-05-23  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::RenderBlockFlow::checkFloatsInCleanLine):
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Make webkit-box-shadow painting subpixel aware.
-        https://bugs.webkit.org/show_bug.cgi?id=133201
-        &lt;rdar://problem/16072830&gt;
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r166236
</ins><span class="cx"> 
</span><del>-        This patch enables webkit-box-shadow to be painted on a subpixel position. However, we
-        still truncate -webkit-box-shadow property values. Tracked here: http://webkit.org/b/133202
</del><ins>+    2014-03-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/box-shadow/hidpi-webkit-box-shadow-subpixel-position.html
</del><ins>+            Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
+            &lt;http://webkit.org/b/130713&gt;
+            &lt;rdar://problem/15661876&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/FloatRoundedRect.cpp:
-        (WebCore::FloatRoundedRect::inflateWithRadii): same as in from RoundedRect.
-        (WebCore::FloatRoundedRect::adjustRadii): same as in from RoundedRect.
-        * platform/graphics/FloatRoundedRect.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow):
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-05-22  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</del><ins>+            Merged from Blink (patch by Ian Beer):
+            http://crbug.com/303657
+            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=158938
</ins><span class="cx"> 
</span><del>-        [Curl] Crash when exceeding maximum cache limit.
-        https://bugs.webkit.org/show_bug.cgi?id=133185
</del><ins>+            Test: fast/forms/form-submission-crash-successful-submit-button.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            * html/HTMLFormElement.cpp:
+            (WebCore::HTMLFormElement::submit):
</ins><span class="cx"> 
</span><del>-        When the maximum cache limit is exceeded, I get a crash.
-        This happens when deleting cache entries, because a reference to the url string object in the LRU list
-        is used as a parameter to invalidateCacheEntry(), when called from makeRoomForNewEntry().
-        When the string is removed from the LRU list in makeRoomForNewEntry(), the string is deleted.
-        Next, the string is accessed again to remove the url from the index, and we crash.
</del><ins>+2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This can be fixed by removing the string from the LRU list after it is removed from the index.
</del><ins>+        Merge r160010.
</ins><span class="cx"> 
</span><del>-        Fixing the crash also revealed an infinite loop problem.
-        If the url for some reason only exist in the LRU list, and not in the index,
-        we will inifitely loop in makeRoomForNewEntry(), trying to remove this url from the cache, but never succeeding.
-        This can be fixed by removing the url from the LRU list, also when it's not in the index.
</del><ins>+    2013-12-03  László Langó  &lt;lango@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/curl/CurlCacheManager.cpp:
-        (WebCore::CurlCacheManager::makeRoomForNewEntry): Avoid infinite loop by checking if there are more cache entries to remove.
-        (WebCore::CurlCacheManager::invalidateCacheEntry): Avoid crash and infinite loop by removing url from LRU list last.
</del><ins>+            ASSERTION FAILED: !value || (value-&gt;isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
+            https://bugs.webkit.org/show_bug.cgi?id=125146
</ins><span class="cx"> 
</span><del>-2014-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Make viewport units work in CSS gradients
-        https://bugs.webkit.org/show_bug.cgi?id=133204
-        &lt;rdar://problem/17012259&gt;
-        
-        Reviewed by Tim Horton.
-        
-        Make viewport percentage lengths work in gradients.
</del><ins>+            Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
+            An implicit y-value can become explicit if specified as a separate longhand.
+            At the same time, its new value can be non-primitive.
</ins><span class="cx"> 
</span><del>-        Test: fast/gradients/viewport-units-gradient.html
</del><ins>+            Backported from Blink:
+            http://src.chromium.org/viewvc/blink?view=rev&amp;rev=153678
</ins><span class="cx"> 
</span><del>-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::addStops):
-        (WebCore::CSSLinearGradientValue::createGradient):
-        (WebCore::CSSRadialGradientValue::createGradient):
-        * css/CSSGradientValue.h:
</del><ins>+            Test: fast/css/webkit-mask-crash-implicit.html
</ins><span class="cx"> 
</span><del>-2014-05-22  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+            * css/StyleProperties.cpp:
+            (WebCore::StyleProperties::getLayeredShorthandValue):
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Add support for minimal-ui viewports
-        https://bugs.webkit.org/show_bug.cgi?id=133162
</del><ins>+2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Remove extraneous ! from merge of r166304.
</ins><span class="cx"> 
</span><del>-        Add support for minimal-ui directly into the Viewport configuration.
</del><ins>+2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        ViewportConfiguration knows about two kinds of layout size in scrollview coordinates:
-        -normal size
-        -minimal ui size.
</del><ins>+        Merge r166304.
</ins><span class="cx"> 
</span><del>-        Initially, the page is initialized with resetMinimalUI() and starts with a normal layout.
</del><ins>+    2014-03-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        At any time before the main resource is loaded, the Web page can update its viewport meta tag
-        to include minimal-ui. The viewport configuration is updated immediately to reflect the minimal-ui
-        layout size. Any layout after that takes minimal-ui into account.
</del><ins>+            REGRESSION(r162679): Poster image visible under the video
+            https://bugs.webkit.org/show_bug.cgi?id=130783
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * css/LengthFunctions.cpp:
-        (WebCore::minimumValueForLength):
-        (WebCore::floatValueForLength):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::viewportPercentageValue):
-        * dom/ViewportArguments.h:
-        (WebCore::ViewportArguments::operator==):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::setViewportSizeForCSSViewportUnits):
-        (WebCore::FrameView::viewportSizeForCSSViewportUnits):
-        (WebCore::FrameView::setViewportSize): Deleted.
-        (WebCore::FrameView::viewportSize): Deleted.
-        * page/FrameView.h:
-        * page/ViewportConfiguration.cpp:
-        (WebCore::ViewportConfiguration::ViewportConfiguration):
-        (WebCore::ViewportConfiguration::setMinimumLayoutSize):
-        (WebCore::ViewportConfiguration::setMinimumLayoutSizeForMinimalUI):
-        (WebCore::ViewportConfiguration::activeMinimumLayoutSizeInScrollViewCoordinates):
-        (WebCore::ViewportConfiguration::resetMinimalUI):
-        (WebCore::ViewportConfiguration::pageWillRenderFirstFrame):
-        (WebCore::ViewportConfiguration::initialScale):
-        (WebCore::ViewportConfiguration::minimumScale):
-        (WebCore::ViewportConfiguration::updateConfiguration):
-        (WebCore::ViewportConfiguration::layoutWidth):
-        (WebCore::ViewportConfiguration::layoutHeight):
-        (WebCore::ViewportConfiguration::description):
-        * page/ViewportConfiguration.h:
-        (WebCore::ViewportConfiguration::minimumLayoutSizeForMinimalUI):
-        (WebCore::ViewportConfiguration::usesMinimalUI):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::viewportSizeForCSSViewportUnits):
-        (WebCore::RenderView::viewportSize): Deleted.
-        * rendering/RenderView.h:
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-05-22  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+            In the listed revision, we started checking for isRenderImage()
+            instead of isImage(). RenderMedias return 'true' for the first
+            but 'false' for the second. Change the if() statement to check
+            for isRenderMedia() in addition to !isRenderImage().
</ins><span class="cx"> 
</span><del>-        Can't type in status in facebook.com on iOS Safari because keyboard disappears
-        https://bugs.webkit.org/show_bug.cgi?id=133196
</del><ins>+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2014-03-24  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fixed the bug by rolling out r156252.
</del><ins>+        Remove a commented line of code introduced by r166104.
</ins><span class="cx"> 
</span><del>-        When the user taps on the status on facebook.com, the page focuses a textarea,
-        which is then made momentarily invisible by setting display:none.
-        The page then removes display:none later and expects the textarea to be still focused.
</del><ins>+        Reviewed by Babak Shafiei.
</ins><span class="cx"> 
</span><del>-        With r156252, the focus is removed after the page sets display:none and the keyboard disappears.
-        Since the focus is never reset on the textarea, the user can never type in anything.
</del><ins>+        A line was commented out when it should have been deleted. This patch
+        corrects that oversight.
</ins><span class="cx"> 
</span><del>-        The specification may need to change here given that this (rather odd) behavior/expectation exists
-        on one of the most popular websites on the Web.
</del><ins>+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::recalcStyle):
-        (WebCore::Document::updateLayout):
-        (WebCore::Document::resetHiddenFocusElementSoon): Deleted.
-        (WebCore::Document::resetHiddenFocusElementTimer): Deleted.
-        * dom/Document.h:
</del><ins>+2014-03-22  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        Finish merge of r160065. The changes from Source/WebCore/rendering/RenderView.cpp were incorrectly
+        omitted from the original merge in r165142.
</ins><span class="cx"> 
</span><del>-        http/tests/security/xss-DENIED-xsl-document-redirect.xml fails with NetworkProcess
-        https://bugs.webkit.org/show_bug.cgi?id=132523
</del><ins>+    2013-12-03  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
+    
+            Potential crash in RenderView::selectionBounds and RenderView::repaintSelection
+            https://bugs.webkit.org/show_bug.cgi?id=125207
+    
+            Reviewed by Simon Fraser.
+            
+            Merge https://chromium.googlesource.com/chromium/blink/+/f9e6e288a5aa959f05c374806121aaf0fc52d440
+    
+            Update style in FrameSelection instead of RenderView's member functions. These are the last two
+            member functions of RenderView that updates the style.
+    
+            * editing/FrameSelection.cpp:
+            (WebCore::FrameSelection::focusedOrActiveStateChanged):
+            (WebCore::FrameSelection::bounds):
+            * rendering/RenderView.cpp:
+            (WebCore::RenderView::selectionBounds):
+            (WebCore::RenderView::repaintSelection):
+    
+2014-03-21  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        Merge r166090.
</ins><span class="cx"> 
</span><del>-        We should not manufacture a response in the event of an error during a
-        synchronous XHR. In addition, this test removes two places that are
-        sensitive to such a manufactured response.
</del><ins>+    2014-03-21  Oliver Hunt  &lt;oliver@apple.com&gt;
+    
+            Fix a crash when assigning an object to document.location
+            https://bugs.webkit.org/show_bug.cgi?id=130213
+    
+            Reviewed by Geoffrey Garen.
+    
+            Convert location to string before we make use the document.
+            This prevents us from attempting to navigate a frame that
+            has already been removed.
+    
+            Test: fast/dom/navigation-with-sideeffects-crash.html
+    
+            * bindings/js/JSDocumentCustom.cpp:
+            (WebCore::JSDocument::location):
+            (WebCore::JSDocument::setLocation):
+    
+2014-03-20  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Updates test expectations.
</del><ins>+        Merge r165821.
</ins><span class="cx"> 
</span><del>-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::loadRequest): Don't inspect a
-        loader response if there is an error
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Do not
-        manufacture a response
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Do not
-        manufacture a response
-        * xml/XSLTProcessorLibxslt.cpp:
-        (WebCore::docLoaderFunc): Only use the response's URL if no error
-        occurred.
</del><ins>+    2014-03-18  Antti Koivisto  &lt;antti@apple.com&gt;
+    
+            Mutating rules returned by getMatchedCSSRules can result in crash
+            https://bugs.webkit.org/show_bug.cgi?id=130209
+    
+            Reviewed by Andreas Kling.
+            
+            The non-standard getMatchedCSSRules API returns CSSStyleRule objects that don't
+            have parent stylesheet pointer (as we don't know which sheet the rule originated from).
+            Mutating the rule via such wrapper can lead to crashes later as we fail to invalidate
+            the underlying stylesheet.
+            
+            Fix by disallowing mutation of style rules that don't have parent sheet pointer. CSSStyleRule
+            has two mutable properties selectorText and style. The latter gives back CSSStyleDeclaration.
+            This patch disallows mutations in both cases for CSSStyleRules that don't have parent stylesheet
+            pointer.
+            
+            While it is technically possible to have CSSRules that are legitimately disconnected
+            from stylesheet (by removing rule from sheet while holding a reference to it) it never
+            makes sense to mutate such rule as there is no way to do anything with it afterwards.
+    
+            Tests: fast/css/getMatchedCSSProperties-rule-mutation.html
+                   fast/css/getMatchedCSSRules-crash.html
+    
+            * css/CSSStyleRule.cpp:
+            (WebCore::CSSStyleRule::setSelectorText):
+    
+                Bail out if parent stylesheet is null.
+    
+            * css/PropertySetCSSStyleDeclaration.cpp:
+            (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+            (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+            (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+            (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+            
+                Allow StyleRuleCSSStyleDeclaration subclass cancel the mutation via
+                boolean return value from willMutate.
+    
+            (WebCore::StyleRuleCSSStyleDeclaration::willMutate):
+            
+                Disallow mutation if the owning CSSStyleRule is null or has null stylesheet.
+    
+            (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
+            
+                We never get here with null rule or stylesheet anymore.
+    
+            * css/PropertySetCSSStyleDeclaration.h:
+            (WebCore::PropertySetCSSStyleDeclaration::willMutate):
+    
+2014-03-20  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</del><ins>+        Merge r165921.
</ins><span class="cx"> 
</span><del>-        Unreviewed typo fix.
</del><ins>+    2014-03-19  Antti Koivisto  &lt;antti@apple.com&gt;
+    
+            Crash with long selector list
+            https://bugs.webkit.org/show_bug.cgi?id=123006
+    
+            Reviewed by Andreas Kling.
+    
+            Test: fast/css/long-selector-list-crash.html
+    
+            * css/CSSSelectorList.cpp:
+            (WebCore::CSSSelectorList::CSSSelectorList):
+            (WebCore::CSSSelectorList::adoptSelectorVector):
+            (WebCore::CSSSelectorList::operator=):
+            * css/StyleRule.cpp:
+            (WebCore::StyleRule::create):
+    
+                Add a bunch of asserts.
+    
+            (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):
+            
+                This could produce a zero-length selector list.
+    
+2014-03-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by NOBODY.
</del><ins>+        Unreviewed Win64 build fix; explicit operators are not valid in VS2010.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        With the 'explicit bool' operator removed, just test weakThis.get() explicitly.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::dashesForIntersectionsWithRect): Accidentally said run.length() instead of glyphBuffer.size().
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):
</ins><span class="cx"> 
</span><del>-2014-05-22  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2014-03-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Web process should try to shrink its memory footprint when going into background.
-        &lt;https://webkit.org/b/133197&gt;
-        &lt;rdar://problem/17011561&gt;
</del><ins>+        Merge r165478.
</ins><span class="cx"> 
</span><del>-        Make releaseMemory() public so we can call it from the process-will-suspend callback.
</del><ins>+    2014-03-12  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+            [Mac] Crash when running media/fallback.html test in MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification()
+            https://bugs.webkit.org/show_bug.cgi?id=130136
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/MemoryPressureHandler.h:
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-22  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            MediaPlayerPrivateAVFoundation is trying to lock its m_queueMutex from an async thread after
+            while being destroyed in the main thread. To resolve this race condition, redispatch from
+            the async thread to the main thread, and use a WeakPtr to determine whether the object has
+            been destroyed or not.
</ins><span class="cx"> 
</span><del>-        Hook up a setting for showing detailed logging during memory pressure relief.
-        &lt;https://webkit.org/b/133194&gt;
</del><ins>+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):
</ins><span class="cx"> 
</span><del>-        Make the pressure relief logger opt-in. Also make it flush memory back to the
-        OS (for both malloc and FastMalloc) to get more accurate numbers at each step.
</del><ins>+2014-03-18  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+        Follow-up fix for the merge of r163579.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/MemoryPressureHandler.cpp:
-        * platform/MemoryPressureHandler.h:
-        (WebCore::MemoryPressureHandler::ReliefLogger::ReliefLogger):
-        (WebCore::MemoryPressureHandler::ReliefLogger::~ReliefLogger):
-        (WebCore::MemoryPressureHandler::ReliefLogger::setLoggingEnabled):
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::ReliefLogger::platformMemoryUsage):
</del><ins>+    2014-03-17  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+            Merge parts from Blink CLs 169865acce3b6bc85ac1adf07b2798aaf9aad67a and 04f613e7f0c35f444d5a9bd42da55c69df65cf64 that weren't merged to trunk
+            &lt;rdar://problem/16307742&gt;
</ins><span class="cx"> 
</span><del>-        Don't scan for phone numbers in editable regions
-        &lt;rdar://problem/16949846&gt; and https://bugs.webkit.org/show_bug.cgi?id=133192
</del><ins>+            Unreviewed Layout Test fix.
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+            * html/parser/HTMLConstructionSite.cpp:
+            (WebCore::insert):
+            (WebCore::executeInsertTask):
+            (WebCore::executeReparentTask):
+            (WebCore::executeInsertAlreadyParsedChildTask):
</ins><span class="cx"> 
</span><del>-        No new tests (Currently untested WK2-only feature)
</del><ins>+2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::scanRangeForTelephoneNumbers): Skip the range if the Node is editable.
</del><ins>+        Merge r165753.
</ins><span class="cx"> 
</span><del>-2014-05-22  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+    2014-03-16  Brent Fulgham  &lt;bfulgham@apple.com&gt;
+    
+            Provide preference to enable additional AVFoundation options
+            https://bugs.webkit.org/show_bug.cgi?id=130275
+    
+            Reviewed by Eric Carlson.
+    
+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::doesHaveAttribute): Added.
+            * html/HTMLMediaElement.h:
+            * page/Settings.in: Add new attribute.
+            * platform/graphics/MediaPlayer.cpp:
+            (WebCore::MediaPlayer::doesHaveAttribute): Added stub to call private player object's
+            implementation of doesHaveAttribute.
+            * platform/graphics/MediaPlayer.h:
+            (WebCore::MediaPlayerClient::doesHaveAttribute):
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundationCF::AVFWrapper::createAssetForURL): Check the &lt;media&gt; object,
+            and notify AVFoundationCF to use URI option if relevant.
+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Check the &lt;media&gt; object,
+            and notify AVFoundation to use URI option if relevant.
+    
+2014-03-17  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Captions layout incorrectly in fullscreen.
-        https://bugs.webkit.org/show_bug.cgi?id=133175
</del><ins>+        Merge r165583.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+    2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When doing layout for fullscreen, geometry should be absolute so it is not influenced
-        by the rest of the page. This change adds style for CSSPropertyPosition, CSSPropertyLeft,
-        and CSSPropertyTop.
</del><ins>+            Web Inspector: Network.loadResource should include the response status code
+            https://bugs.webkit.org/show_bug.cgi?id=130216
</ins><span class="cx"> 
</span><del>-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::updateDisplay):
-        Refactor style changes into updateStyleForTextTrackRepresentation().
-        (WebCore::MediaControlTextTrackContainerElement::updateTimerFired):
-        Refactor style changes into updateStyleForTextTrackRepresentation().
-        (WebCore::MediaControlTextTrackContainerElement::clearTextTrackRepresentation):
-        Refactor style changes into updateStyleForTextTrackRepresentation().
-        (WebCore::MediaControlTextTrackContainerElement::updateStyleForTextTrackRepresentation):
-        Consolidate style changes here. Include the two existing and three new style changes.
-        * html/shadow/MediaControlElements.h:
-        Declare updateStyleForTextTrackRepresentation().
</del><ins>+            Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-2014-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * inspector/InspectorResourceAgent.cpp:
+            Record and send the http status code.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r155977): Very stuttery 3D css animation on jtechcommunications.com
-        https://bugs.webkit.org/show_bug.cgi?id=133179
-        &lt;rdar://problem/16864666&gt;
</del><ins>+            * inspector/protocol/Network.json:
+            Include status code property in the success callback.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2014-03-17  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Revert code added in r155977 to try to pick a good contentsScale for layers
-        based on a root-relative transform. This resulted in pages with too much 
-        backing store, and too many cases where layers repainted during animations,
-        causing stutter.
</del><ins>+        Merge r165582.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::flushCompositingState):
-        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
-        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
-        (WebCore::GraphicsLayerCA::updateContentsOpaque):
-        (WebCore::GraphicsLayerCA::updateAnimations):
-        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
-        (WebCore::GraphicsLayerCA::setTransformAnimationEndpoints):
-        (WebCore::GraphicsLayerCA::setTransformAnimationKeyframes):
-        (WebCore::GraphicsLayerCA::updateContentsScale):
-        (WebCore::clampedContentsScaleForScale): Deleted.
-        (WebCore::maxScaleFromTransform): Deleted.
-        (WebCore::GraphicsLayerCA::updateRootRelativeScale): Deleted.
-        (WebCore::GraphicsLayerCA::getTransformFromAnimationsWithMaxScaleImpact): Deleted.
-        * platform/graphics/ca/GraphicsLayerCA.h:
</del><ins>+    2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+            Web Inspector: Network.loadResource XHR crash if page reloaded while request is ongoing
+            https://bugs.webkit.org/show_bug.cgi?id=130211
</ins><span class="cx"> 
</span><del>-        [iOS] Enable -apple-system- styled elements to respond to system font size changes.
-        https://bugs.webkit.org/show_bug.cgi?id=133186
-        &lt;rdar://problem/16583782&gt;
</del><ins>+            Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+            Merged from Blink with changes, (patch by vsevik@chromium.org):
+            http://src.chromium.org/viewvc/blink?view=revision&amp;revision=152712
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/RenderThemeIOS.h:
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::_contentSizeCategory):
-        (WebCore::RenderThemeIOS::contentSizeCategory):
-        (WebCore::RenderThemeIOS::setContentSizeCategory):
</del><ins>+            Using an XMLHttpRequest to download resources had a few issues. Being an
+            Active DOM Object the load could be paused. Without an extra retain,
+            when the load was cancelled (e.g. a page reload) the XHR would get
+            destructed and could cause a crash if the list of active DOM objects
+            was actively being iterated.
</ins><span class="cx"> 
</span><del>-2014-05-22  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Switch to a DocumentThreadableLoader to manage the load ourselves.
+            This still uses the Memory cache, but we have a little more control.
</ins><span class="cx"> 
</span><del>-        [MSE] Stored samples are not freed when SourceBuffer is removed from MediaSource
-        https://bugs.webkit.org/show_bug.cgi?id=133174
</del><ins>+            * inspector/InspectorResourceAgent.h:
+            * inspector/InspectorResourceAgent.cpp:
+            (WebCore::InspectorResourceAgent::InspectorResourceAgent):
+            (WebCore::InspectorResourceAgent::loadResource):
+            Switch from XHR to DocumentThreadableLoader.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            * xml/XMLHttpRequest.h:
+            * xml/XMLHttpRequest.cpp:
+            (WebCore::XMLHttpRequest::XMLHttpRequest):
+            (WebCore::XMLHttpRequest::createRequest):
+            (WebCore::XMLHttpRequest::sendForInspector):
+            Remove the now unnecessary XHR sendForInspector path.
</ins><span class="cx"> 
</span><del>-        Clear out stored MediaSamples from SourceBuffer's TrackBuffer storage when
-        aborting loading. Also, report the memory cost of those samples, so that the
-        SourceBuffer will be GCd more readily.
</del><ins>+2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add a mechanism for reporting the size of a MediaSample:
-        * Modules/mediasource/SourceBuffer.h:
-        * platform/MediaSample.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
</del><ins>+        Merge r165548.
</ins><span class="cx"> 
</span><del>-        Track the memory usage of a SampleMap when adding and removing samples, as well
-        as allowing the SampleMap to be cleared wholesale:
-        * Modules/mediasource/SampleMap.cpp:
-        (WebCore::SampleMap::clear): Release all stored MediaSamples.
-        (WebCore::SampleMap::addSample): Update m_totalSize.
-        (WebCore::SampleMap::removeSample): Ditto.
-        * Modules/mediasource/SampleMap.h:
-        (WebCore::SampleMap::SampleMap): Initialize m_totalSize.
-        (WebCore::SampleMap::sizeInBytes): Simple accessor.
</del><ins>+    2014-03-13  Andreas Kling  &lt;akling@apple.com&gt;
+    
+            Don't send synchronous resize events when FrameView has auto-sizing enabled.
+            &lt;https://webkit.org/b/130198&gt;
+            &lt;rdar://problem/15991333&gt;
+    
+            Reviewed by Dan Bernstein.
+    
+            * page/FrameView.cpp:
+            (WebCore::FrameView::sendResizeEventIfNeeded):
+    
+2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Clear the stored samples when loading is aborted, and report the extra memory
-        cost
-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::SourceBuffer): Initialize m_reportedExtraMemoryCost.
-        (WebCore::SourceBuffer::removedFromMediaSource): Clear all stored samples.
-        (WebCore::SourceBuffer::sourceBufferPrivateAppendComplete): Call reportExtraMemoryCost().
-        (WebCore::SourceBuffer::reportExtraMemoryCost): Inform the vm of the new
-            extra memory cost incurred by the object.
</del><ins>+        Reverse merge r165286.
</ins><span class="cx"> 
</span><del>-2014-05-22  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+    2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (WebKit2): Keyboard should have Search button in duckduckgo.com.
-        https://bugs.webkit.org/show_bug.cgi?id=133183
-        &lt;rdar://problem/17004207&gt;
</del><ins>+            Merge r165206.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoff Garen.
</del><ins>+        2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Adding new export.
</del><ins>+                Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+                &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
+                &lt;rdar://problem/15073043&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+                Clang appears to be optimizing out a branch in RenderObject::node()
+                when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
+                We'll work around this by factoring out the code in question into a
+                separate member function marked NEVER_INLINE.
</ins><span class="cx"> 
</span><del>-        REGRESSION(r163712): [GTK] Misspelling and grammar underline marks are no longer drawn
-        https://bugs.webkit.org/show_bug.cgi?id=133047
</del><ins>+                No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+                Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        Change two conditions changed by mistake in r163712.
</del><ins>+                * rendering/RenderLayerFilterInfo.cpp:
+                (WebCore::RenderLayer::FilterInfo::layerElement):
+                Code moved from updateReferenceFilterClients(). Returns the Element*
+                for m_layer.
+                (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
+                Use layerElement().
</ins><span class="cx"> 
</span><del>-        * editing/TextCheckingHelper.cpp:
-        (WebCore::findMisspellings): Enter the loop also when wordStart is 0.
-        (WebCore::TextCheckingHelper::findFirstMisspelling): Skip the work
-        when the text is a single character. Also reworked it to use a for
-        loop to improve the readability.
</del><ins>+                * rendering/RenderLayerFilterInfo.h:
+                Declared layerElement().
</ins><span class="cx"> 
</span><del>-2014-05-22  Piotr Grad  &lt;p.grad@samsung.com&gt;
</del><ins>+2014-03-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Video is resumed with old playback rate.
-        https://bugs.webkit.org/show_bug.cgi?id=132905
</del><ins>+        Merge r165331.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+    2014-03-10  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Setting '0' playback rate is causing pipeline to pause.
-        GStreamer player impl. exposed this information to upper layers but it should not.
-        Solution is to hidden such situation behind m_playbackRatePause flag.
</del><ins>+            Load source maps and their resources asynchronously.
</ins><span class="cx"> 
</span><del>-        Test: media/video-paused-0-rate.html
</del><ins>+            https://bugs.webkit.org/show_bug.cgi?id=112071
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
-        (WebCore::MediaPlayerPrivateGStreamer::play):
-        (WebCore::MediaPlayerPrivateGStreamer::pause):
-        (WebCore::MediaPlayerPrivateGStreamer::doSeek):
-        (WebCore::MediaPlayerPrivateGStreamer::updatePlaybackRate):
-        (WebCore::MediaPlayerPrivateGStreamer::paused):
-        (WebCore::MediaPlayerPrivateGStreamer::setRate):
-        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
</del><ins>+            Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-2014-05-22  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+            * inspector/InspectorPageAgent.cpp:
+            (WebCore::InspectorPageAgent::buildObjectForFrameTree):
+            Honor the hiddenFromInspector flag.
</ins><span class="cx"> 
</span><del>-        Text markers don't paint on simple lines
-        https://bugs.webkit.org/show_bug.cgi?id=133177
</del><ins>+            * inspector/InspectorResourceAgent.cpp:
+            (WebCore::InspectorResourceAgent::willSendRequest):
+            (WebCore::InspectorResourceAgent::markResourceAsCached):
+            (WebCore::InspectorResourceAgent::didReceiveResponse):
+            (WebCore::InspectorResourceAgent::didReceiveData):
+            (WebCore::InspectorResourceAgent::didFinishLoading):
+            (WebCore::InspectorResourceAgent::didFailLoading):
+            (WebCore::InspectorResourceAgent::replayXHR):
+            (WebCore::InspectorResourceAgent::loadResource):
+            * inspector/InspectorResourceAgent.h:
+            Honor the hiddenFromInspector flag by keeping track of
+            hidden identifiers in a HashSet.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
-        
-        Marker painting code does not yet support simple lines.
</del><ins>+            * inspector/protocol/Network.json:
+            (Network.loadResource): Added.
</ins><span class="cx"> 
</span><del>-        Tests: fast/text/mark-matches-rendering-simple-lines.html
-               fast/text/mark-matches-rendering.html
</del><ins>+            * platform/network/ResourceRequestBase.h:
+            (WebCore::ResourceRequestBase::hiddenFromInspector): Added.
+            (WebCore::ResourceRequestBase::setHiddenFromInspector): Added.
+            (WebCore::ResourceRequestBase::ResourceRequestBase):
+            Add a flag to hide the request from the Inspector.
</ins><span class="cx"> 
</span><del>-        * dom/DocumentMarkerController.cpp:
-        (WebCore::DocumentMarkerController::addMarker):
-        
-            Force text blocks with markers to use line boxes.
</del><ins>+            * xml/XMLHttpRequest.cpp:
+            (WebCore::XMLHttpRequest::XMLHttpRequest):
+            (WebCore::XMLHttpRequest::sendForInspector): Added.
+            (WebCore::XMLHttpRequest::sendForInspectorXHRReplay): Renamed.
+            (WebCore::XMLHttpRequest::createRequest):
+            * xml/XMLHttpRequest.h:
+            Make Inspector loads allow cross-origins and hide their request
+            from the Inspector itself.
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp:
-        (WebCore::Internals::setMarkedTextMatchesAreHighlighted):
-        
-            Expose this so we can make reftests for marker rendering.
</del><ins>+2014-03-10  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+        [Win] Build fix after r165379.
</ins><span class="cx"> 
</span><del>-2014-05-22  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::SerializedScriptValue): Revert to older-style C++ iteration
+        for Windows compatibility. This can be reverted when we use VS2013 on this branch.
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Guard RenderObject::isRenderGrid() method
-        https://bugs.webkit.org/show_bug.cgi?id=132380
</del><ins>+2014-03-07  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Merge r162972 and r163007.
</ins><span class="cx"> 
</span><del>-        Guard RenderObject::isRenderGrid() method under ENABLE_CSS_GRID_LAYOUT compilation flag.
</del><ins>+    2014-03-07  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeLogicalWidthInRegion):
-        * rendering/RenderObject.h:
</del><ins>+            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
+            https://bugs.webkit.org/show_bug.cgi?id=114586
</ins><span class="cx"> 
</span><del>-2014-05-21  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+            Reviewed by Dave Hyatt.
</ins><span class="cx"> 
</span><del>-        REGRESSION(r167870): Crash in simple line layout code with :after
-        https://bugs.webkit.org/show_bug.cgi?id=133155
-        &lt;rdar://problem/16977696&gt;
</del><ins>+            Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
-        
-        Fix https://bugs.webkit.org/show_bug.cgi?id=132241 in a safer way.
-        The underline behavior is tested by the existing fast/text/simple-lines-hover-underline.html
</del><ins>+            If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
+            Instead, we should make it a subclass of RenderElement, so that it can be split properly.
</ins><span class="cx"> 
</span><del>-        Test: fast/text/simple-lines-hover-after.html
</del><ins>+            Test: fast/css-generated-content/quote-first-letter.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::invalidateLineLayoutPath): Deleted.
</del><ins>+            * dom/PseudoElement.cpp:
+            (WebCore::PseudoElement::didRecalcStyle):
+            * rendering/RenderQuote.cpp:
+            (WebCore::RenderQuote::RenderQuote):
+            (WebCore::RenderQuote::willBeDestroyed):
+            (WebCore::RenderQuote::willBeRemovedFromTree):
+            (WebCore::RenderQuote::styleDidChange):
+            (WebCore::RenderQuote::updateText):
+            (WebCore::RenderQuote::computeText):
+            (WebCore::RenderQuote::updateDepth):
+            * rendering/RenderQuote.h:
+            * rendering/style/ContentData.cpp:
+            (WebCore::QuoteContentData::createContentRenderer):
</ins><span class="cx"> 
</span><del>-            Move to RenderBlockFlow.
</del><ins>+2014-03-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::invalidateLineLayoutPath):
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::styleDidChange):
-        
-            Invalidate layout if style changes in a manner that makes us ineligible to use the simple line layout path.
</del><ins>+        Merge r165339.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBlockFlow::invalidateLineLayoutPath):
-        
-            Drop the simple line layout on path invalidation if it exists. It may not be valid anymore.
-            Also invalidate the layout if this happens so we'll reconstruct the lines later.
</del><ins>+    2014-03-08  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBlockFlow::simpleLineLayout): Deleted.
-        (WebCore::RenderBlockFlow::ensureLineBoxes):
-        (WebCore::RenderBlockFlow::createLineBoxes): Deleted.
-                
-            Revert some of the changes made it r167870.
</del><ins>+            SerializedScriptValue may move Identifiers between worlds
+            https://bugs.webkit.org/show_bug.cgi?id=129979
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.h:
-        (WebCore::RenderBlockFlow::simpleLineLayout):
-        
-            Add strong validity assert.
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-05-21  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+            Test: fast/workers/worker-copy-shared-blob-url.html
</ins><span class="cx"> 
</span><del>-        [iOS] two media control button strings are not localized
-        https://bugs.webkit.org/show_bug.cgi?id=133160
</del><ins>+            Don't use Strings to store blob URLs as String's may be Identifiers
+            and they can only exist in one world/thread at a time.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            * Modules/indexeddb/IDBObjectStore.cpp:
+            (WebCore::IDBObjectStore::put):
+            * bindings/js/SerializedScriptValue.cpp:
+            (WebCore::CloneDeserializer::deserializeString):
+            (WebCore::SerializedScriptValue::addBlobURL):
+            (WebCore::SerializedScriptValue::SerializedScriptValue):
+            * bindings/js/SerializedScriptValue.h:
</ins><span class="cx"> 
</span><del>-        * English.lproj/mediaControlsLocalizedStrings.js:
</del><ins>+2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-21  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Merge r165138.
</ins><span class="cx"> 
</span><del>-        [iOS] Update some of the media controls buttons to be bigger
-        https://bugs.webkit.org/show_bug.cgi?id=133158
-        &lt;rdar://problem/16475828&gt;
</del><ins>+    2014-03-05  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement()
+            &lt;http://webkit.org/b/129751&gt;
+            &lt;rdar://problem/16237965&gt;
</ins><span class="cx"> 
</span><del>-        The buttons in the media controls on iOS are too small
-        to be comfortably pressed. Make them the size of the controls
-        panel and the expected iOS button size (44x44px).
</del><ins>+            Reviewed by Jon Honeycutt.
</ins><span class="cx"> 
</span><del>-        The artwork for the buttons now includes the padding. I've
-        added a file from which you can edit the artwork, then
-        copy it into the CSS (because editing directly in CSS is
-        a huge pain).
</del><ins>+            Merged from Blink (patch by Yuta Kitamura):
+            https://src.chromium.org/viewvc/blink?revision=168160&amp;view=revision
+            http://crbug.com/345005
</ins><span class="cx"> 
</span><del>-        So far just the play/pause and fullscreen button have been
-        updated. There will be a follow-up patch to fix the remaining
-        buttons and the scrubber.
</del><ins>+                The root cause is CompositeEditCommand::moveParagraphWithClones() passing
+                two positions |start| and |end| which do not follow the document order,
+                i.e. in some situations |start| is located after |end| because of
+                the difference in affinity.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/assets-apple-iOS.svg: Added.
-        * Modules/mediacontrols/mediaControlsiOS.css:
-        (audio::-webkit-media-controls-panel):
-        (audio::-webkit-media-controls-fullscreen-button):
-        (audio::-webkit-media-controls-play-button):
-        (audio::-webkit-media-controls-play-button:active):
-        (audio::-webkit-media-controls-play-button.paused):
-        (audio::-webkit-media-controls-fullscreen-button:active):
-        (@media only screen and (-webkit-min-device-pixel-ratio: 2)): Deleted.
</del><ins>+                This patch fixes this crash by normalizing |end| to |start| in such situations.
+                It also adds an ASSERT that checks the relationship between |start| and |end|.
</ins><span class="cx"> 
</span><del>-2014-05-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Test: editing/execCommand/format-block-crash.html
</ins><span class="cx"> 
</span><del>-        Garbage when rubber-banding at the right edge of a page zoomed to non-integral scale.
-        https://bugs.webkit.org/show_bug.cgi?id=133139
-        &lt;rdar://problem/16503353&gt;
</del><ins>+            * editing/CompositeEditCommand.cpp:
+            (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+            (WebCore::CompositeEditCommand::moveParagraphWithClones):
+            * editing/CompositeEditCommand.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Do not pixel align the root content layer. The alignment code expands the graphics's layer size
-        which makes the right and bottom tiles bigger than the content.
-        Painting the body's background color produces pixel cracks, because the content can not
-        fill the expanded tiles completely.
</del><ins>+        Merge r164876.
</ins><span class="cx"> 
</span><del>-        Not testable.
</del><ins>+    2014-02-28  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::GraphicsLayerClient::needsPixelAligment):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateGeometry):
-        (WebCore::GraphicsLayerCA::computePixelAlignment):
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::rectForTileIndex):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::needsPixelAligment):
-        * rendering/RenderLayerBacking.h:
</del><ins>+            Properly clear m_logicallyLastRun to remove use-after-free possibility
+            https://bugs.webkit.org/show_bug.cgi?id=129489
</ins><span class="cx"> 
</span><del>-2014-05-21  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): Invalid layout in WebCore::RenderBox::containingBlockLogicalWidthForPositioned
-        https://bugs.webkit.org/show_bug.cgi?id=132933
</del><ins>+            A use-after-free issue was caught in Blink because m_logicallyLastRun
+            is not cleared when the item it points to is deleted. Clearing it
+            turns the use-after-free into a segfault, and prevents any future
+            use-after-frees from happening.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * platform/text/BidiRunList.h:
+            (WebCore::BidiRunList&lt;Run&gt;::deleteRuns):
</ins><span class="cx"> 
</span><del>-        Invalid layout is performed when calling containingBlockLogicalWidthForPositioned for a RenderTableSection object.
</del><ins>+2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/multicol/newmulticol/table-section-crash.html
</del><ins>+        Merge r165206.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
</del><ins>+    2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-21  Simon Pena  &lt;simon.pena@samsung.com&gt;
</del><ins>+            Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</ins><span class="cx"> 
</span><del>-        [EFL] Ensure EGLOffScreenContext::initialize calls platformMakeCurrent on the surface
-        https://bugs.webkit.org/show_bug.cgi?id=124832
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
+            &lt;rdar://problem/15073043&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antonio Gomes.
</del><ins>+            Clang appears to be optimizing out a branch in RenderObject::node()
+            when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
+            We'll work around this by factoring out the code in question into a
+            separate member function marked NEVER_INLINE.
</ins><span class="cx"> 
</span><del>-        The original code was only calling platformMakeCurrent when the
-        GL_EXT_robustness extension is supported: the alternate code path
-        would only create a context, but it wouldn't make that context
-        current. This patch ensures platformMakeCurrent is also called for
-        the alternate code path, and, if it fails to make the context
-        current, will destroy the context. Effectively, this makes both
-        code paths behave in the same way.
</del><ins>+            No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/surfaces/egl/EGLContext.cpp:
-        (WebCore::EGLOffScreenContext::initialize):
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-2014-05-20  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            * rendering/RenderLayerFilterInfo.cpp:
+            (WebCore::RenderLayer::FilterInfo::layerElement):
+            Code moved from updateReferenceFilterClients(). Returns the Element*
+            for m_layer.
+            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
+            Use layerElement().
</ins><span class="cx"> 
</span><del>-        [Mac] DataCues do not work properly when rewinding video
-        https://bugs.webkit.org/show_bug.cgi?id=133138
-        &lt;rdar://problem/16979086&gt;
</del><ins>+            * rendering/RenderLayerFilterInfo.h:
+            Declared layerElement().
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Make the TrackPrivateBase responsible for knowing if a type of track needs a non-zero
-        startTimeVariance value.
</del><ins>+        Merge r164249.
</ins><span class="cx"> 
</span><del>-        Also, correct a bug in the equality test for DataCue objects.
</del><ins>+    2014-02-17  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/track/DataCue.cpp:
-        (WebCore::DataCue::isEqual): Handle the JSValue data types consistently, so that we don't attempt
-        to compare a JSNull against a default JSValue object.
-        * html/track/InbandTextTrack.cpp:
-        (WebCore::InbandTextTrack::startTimeVariance): Added.
-        * html/track/InbandTextTrack.h:
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::hasCue): Use new startTimeVariance method location.
-        * html/track/TextTrack.h:
-        (WebCore::TextTrack::startTimeVariance): Added.
-        * html/track/TextTrackCue.cpp:
-        (WebCore::TextTrackCue::hasEquivalentStartTime): Use new startTimeVariance location.
-        * html/track/TextTrackCue.h:
-        (WebCore::TextTrackCue::startTimeVariance): Deleted.
-        * html/track/TextTrackCueGeneric.h:
-        * platform/graphics/TrackPrivateBase.h:
-        (WebCore::TrackPrivateBase::startTimeVariance): Added.
-        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h:
</del><ins>+            AX: Invalid cast in WebCore::AccessibilityTable::isDataTable (CRBug 280352)
+            &lt;https://webkit.org/b/128925&gt;
+            &lt;rdar://problem/16087351&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+            Merged from Blink (patch by Dominic Mazzoni):
+            https://src.chromium.org/viewvc/blink?revision=159711&amp;view=revision
</ins><span class="cx"> 
</span><del>-        Watchdog timer should be lazily allocated
-        https://bugs.webkit.org/show_bug.cgi?id=133135
</del><ins>+            Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            Don't cast to a table cell element unless we are sure it is one.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+            Test: accessibility/display-table-cell-causes-crash.html
</ins><span class="cx"> 
</span><del>-        We incur a noticeable amount of overhead on some benchmarks due to checking if the Watchdog ever fired. 
-        There is no reason to do this checking if we never activated the Watchdog, which can only be done through 
-        JSContextGroupSetExecutionTimeLimit or JSContextGroupClearExecutionTimeLimit. 
</del><ins>+            * accessibility/AccessibilityTable.cpp:
+            (WebCore::AccessibilityTable::isDataTable):
</ins><span class="cx"> 
</span><del>-        By allocating the Watchdog lazily on the VM we can avoid all of the associated overhead when we don't use 
-        these two API functions (which is true of most clients).
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent):
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        (WebCore::WorkerScriptController::scheduleExecutionTermination):
-        (WebCore::WorkerScriptController::isExecutionTerminating):
</del><ins>+        Merge r159489.
</ins><span class="cx"> 
</span><del>-2014-05-20  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+    2013-11-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] Allow popup menus to override default appearance
-        https://bugs.webkit.org/show_bug.cgi?id=133129
</del><ins>+            Add more assertions with security implications in DocumentOrderedMap
+            https://bugs.webkit.org/show_bug.cgi?id=124559
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        WebKitSystemInterface's WKPopupMenu has a flag to hide
-        the arrows at the end of a popup-menu (e.g. &lt;select&gt;).
-        Expose that via adding a hasDefaultAppearance flag to
-        PopupMenuStyle, which then passes it on to WKSI.
</del><ins>+            Assert that newly added elements and existing elements in the document ordered map are in the same tree scope
+            as the document ordered map. Also exit early if we're about to add an element in a wrong document to the map.
+            We don't exit early in get() because the damage has already been done at that point (the element may have been
+            deleted already).
</ins><span class="cx"> 
</span><del>-        * platform/PopupMenuStyle.h:
-        (WebCore::PopupMenuStyle::PopupMenuStyle): New flag in constructor.
-        (WebCore::PopupMenuStyle::hasDefaultAppearance): New flag.
-        * platform/mac/WebCoreSystemInterface.h: wkPopupMenu signature has changed to accept
-        the new flag.
-        * platform/mac/WebCoreSystemInterface.mm: Ditto.
-        * rendering/RenderMenuList.cpp:
-        (RenderMenuList::itemStyle): Pass in true as default appearance when creating
-        the PopupMenuStyle. We don't need it.
-        (RenderMenuList::menuStyle): In this case we pass in the negated value of
-        style().hasAppearance(), which indicates if we are overriding the built-in drawing.
-        * rendering/RenderSearchField.cpp:
-        (WebCore::RenderSearchField::menuStyle): Use true as the default value.
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::addImageElementByLowercasedUsemap):
+            * dom/DocumentOrderedMap.cpp:
+            (WebCore::DocumentOrderedMap::add): Assert that the newly added element is in the current tree scope.
+            Also exit early if either the element is not in the tree scope or not in the right document.
+            While this doesn't make the function completely fault safe, it'll catch when we try to add a detached node.
+            (WebCore::DocumentOrderedMap::remove): Convert existing assertions to ones with security implication.
+            (WebCore::DocumentOrderedMap::get): Assert with security implication that the element we're about to return
+            is in the current tree scope. The element may have already been deleted if we ever hit these assertions.
+            (WebCore::DocumentOrderedMap::getAllElementsById):  Convert an existing assertion to an assertion with security
+            implication.
+            * dom/DocumentOrderedMap.h:
+            * dom/TreeScope.cpp:
+            (WebCore::TreeScope::addElementById):
+            (WebCore::TreeScope::addElementByName):
+            (WebCore::TreeScope::addImageMap):
+            (WebCore::TreeScope::addLabel):
+            * html/HTMLDocument.cpp:
+            (WebCore::HTMLDocument::addDocumentNamedItem):
+            (WebCore::HTMLDocument::addWindowNamedItem):
+            * html/HTMLImageElement.cpp:
+            (WebCore::HTMLImageElement::insertedInto): Set InTreeScope flag before calling addImageElementByLowercasedUsemap.
+            * html/HTMLMapElement.cpp:
+            (WebCore::HTMLMapElement::insertedInto): Ditto for addImageMap.
</ins><span class="cx"> 
</span><del>-2014-05-20  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] do not deactivate an audio session that has running I/O
-        https://bugs.webkit.org/show_bug.cgi?id=133127
</del><ins>+        Merge r165145.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+    2014-03-05  Daniel Bates  &lt;dabates@apple.com&gt;
+                And Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/Settings.h:
-        (WebCore::Settings::setShouldManageAudioSessionCategory): Renamed from setShouldManageAudioSession.
-        (WebCore::Settings::shouldManageAudioSessionCategory): Renamed from shouldManageAudioSession.
-        (WebCore::Settings::setShouldManageAudioSession): Deleted.
-        (WebCore::Settings::shouldManageAudioSession): Deleted.
</del><ins>+            ASSERT(newestManifest) fails in WebCore::ApplicationCacheGroup::didFinishLoadingManifest()
+            https://bugs.webkit.org/show_bug.cgi?id=129753
+            &lt;rdar://problem/12069835&gt;
</ins><span class="cx"> 
</span><del>-        * platform/audio/mac/MediaSessionManagerMac.cpp:
-        (MediaSessionManager::updateSessionState): Don't deactivate the session if there are any
-            Video or Audio sessions.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::assetStatus): Drive-by change to log errors 
-            returned by -statusOfValueForKey:error: in debug builds.
</del><ins>+            Fixes an issue where an assertion failure would occur when visiting a web site whose on-disk
+            app cache doesn't contain a manifest resource.
</ins><span class="cx"> 
</span><del>-2014-05-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            For some reason an app cache for a web site may be partially written to disk. In particular, the
+            app cache may only contain a CacheGroups entry. That is, the manifest resource and origin records
+            may not be persisted to disk. From looking over the code, we're unclear how such a situation can occur
+            and hence have been unable to create such an app cache. We were able to reproduce this issue using
+            an app cache database file that was provided by a person that was affected by this issue.
</ins><span class="cx"> 
</span><del>-        REGRESSION: All non-mainframe scrollbars don't paint after r169065
-        https://bugs.webkit.org/show_bug.cgi?id=133132
-        -and corresponding-
-        &lt;rdar://problem/16968850&gt;
</del><ins>+            No test included because it's not straightforward to write a test for this change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoff Garen.
</del><ins>+            * loader/appcache/ApplicationCacheGroup.cpp:
+            (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Assert that m_cacheBeingUpdated-&gt;manifestResource()
+            is non-null. Currently we only document this assumption in a code comment. Also separated a single assertion
+            expression into two assertion expressions to make it straightforward to identify the failing sub-expression
+            on failure.
+            * loader/appcache/ApplicationCacheStorage.cpp:
+            (WebCore::ApplicationCacheStorage::store): Modified to call ApplicationCacheStorage::deleteCacheGroupRecord()
+            to remove a cache group and associated cache records (if applicable) before inserting a cache group entry.
+            This replacement approach will ultimately repair incomplete app cache data for people affected by this bug.
+            (WebCore::ApplicationCacheStorage::loadCache): Log an error and return nullptr if the cache we loaded doesn't
+            have a manifest resource.
+            (WebCore::ApplicationCacheStorage::deleteCacheGroupRecord): Added.
+            (WebCore::ApplicationCacheStorage::deleteCacheGroup): Extracted deletion logic for cache group record into
+            ApplicationCacheStorage::deleteCacheGroupRecord().
+            * loader/appcache/ApplicationCacheStorage.h:
</ins><span class="cx"> 
</span><del>-        We should not universally return true here. This feature will only work for 
-        scrollbars with layers.
-        * platform/ScrollableArea.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::supportsUpdateOnSecondaryThread):
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Merge r156716.
</ins><span class="cx"> 
</span><del>-        Element within flattened frame may update its scroll state during the layout phase of the wrong RenderView
-        https://bugs.webkit.org/show_bug.cgi?id=133013
-        &lt;rdar://problem/16760154&gt;
</del><ins>+    2013-10-01  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            Center misspelling dots across width of word
+            https://bugs.webkit.org/show_bug.cgi?id=122046
</ins><span class="cx"> 
</span><del>-        Fixes an issue where the scroll state of an element may be updated during the layout of the wrong
-        RenderView. In particular, the scroll state of an element inside a CSS flex box in a flattened
-        frame f is updated during the layout of the RenderView associated with the parent frame of f instead
-        of during the layout of the RenderView associated with f.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        The layout machinery assumes that the scroll state of each scrollable element is updated before the
-        completion of layout for its associated RenderView. Currently we have logic to defer updating the scroll
-        state of a scrollable element until completion of recursive layout. For a page with a flattened frame, we
-        defer such updates until completion of layout for all RenderViews along the ancestor frame hierarchy of
-        each flattened frame regardless of the RenderView associated with the element that originated the
-        deferred scroll state request. Instead, only the RenderView associated with the element that deferred its
-        scroll state update should dispatch the scroll state update.
</del><ins>+            Test: editing/spelling/spelling.html
</ins><span class="cx"> 
</span><del>-        Tests: fast/frames/flattening/scrollable-flexbox-inside-iframe-with-zero-height-and-needs-full-repaint-crash.html
-               fast/frames/flattening/scrollable-flexbox-inside-iframe-with-zero-height-assertion-failure.html
</del><ins>+            * platform/graphics/GraphicsContext.h:
+            * platform/graphics/mac/GraphicsContextMac.mm:
+            (WebCore::GraphicsContext::drawLineForDocumentMarker):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp: Removed WTF::-prefix in typedef definition for ContinuationOutlineTableMap.
-        (WebCore::UpdateScrollInfoAfterLayoutTransaction::UpdateScrollInfoAfterLayoutTransaction): Added; a struct
-        that represents a RenderView v, nested transaction count, and a list of RenderBlocks in v that will need
-        to have their scroll state updated.
-        (WebCore::updateScrollInfoAfterLayoutTransactionStack): Added; returns the global stack of transactions.
-        (WebCore::RenderBlock::willBeDestroyed): Call removeFromUpdateScrollInfoAfterLayoutTransaction(), which
-        was formerly named as removeFromDelayedUpdateScrollInfoSet.
-        (WebCore::currentUpdateScrollInfoAfterLayoutTransaction): Added; returns the top-most transaction in the
-        global stack.
-        (WebCore::RenderBlock::beginUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to make use
-        of the global stack of transactions; formerly named startDelayUpdateScrollInfo.
-        (WebCore::RenderBlock::endAndCommitUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to
-        make use of the global stack of transactions; formerly named finishDelayUpdateScrollInfo.
-        (WebCore::RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to make
-        use of the global stack of transactions; formerly named removeFromDelayedUpdateScrollInfoSet.
-        (WebCore::RenderBlock::updateScrollInfoAfterLayout): Modified as appropriate to make use of the global
-        stack of transactions.
-        (WebCore::RenderBlock::layout): Ditto.
-        (WebCore::RenderBlock::startDelayUpdateScrollInfo): Deleted.
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo): Deleted.
-        (WebCore::RenderBlock::removeFromDelayedUpdateScrollInfoSet): Deleted.
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::willBeDestroyed): Call removeFromUpdateScrollInfoAfterLayoutTransaction(), which
-        was formerly named removeFromDelayedUpdateScrollInfoSet.
-        * rendering/RenderDeprecatedFlexibleBox.cpp:
-        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox): Call {begin, end}UpdateScrollInfoAfterLayoutTransaction(),
-        which was formerly named {start, end}DelayUpdateScrollInfo.
-        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): Ditto.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Merge r153788.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r169065): Mountain Lion run-api-tests failures: ASSERTION FAILED: 
-        Uncaught exception - -[NSRegularLegacyScrollerImp setPresentationValue:]: 
-        unrecognized selector sent to instance 0x7ff51aa38000
-        https://bugs.webkit.org/show_bug.cgi?id=133121
</del><ins>+    2013-08-07  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            2.5% regression on page cycler moz
+            https://bugs.webkit.org/show_bug.cgi?id=102822
</ins><span class="cx"> 
</span><del>-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::setPaintCharacteristicsForScrollbar):
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache() triggers a style recalc for quirks mode
+            documents in the beginning of document parsing via Document::setCompatibilityMode. This often coalesces 
+            with style recalc triggered by stylesheet loading. However on very simple documents it can generate genuinely
+            unnecessary work.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r169063) Fixed and sticky nodes misplaced on scrolling sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=133106
-        &lt;rdar://problem/16967648&gt;
</del><ins>+            * dom/DocumentStyleSheetCollection.cpp:
+            (WebCore::DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache):
+            
+                Check that we actually have cached injected stylesheets before triggering style recalc.
+                
+            * page/PageGroup.cpp:
+            (WebCore::PageGroup::addUserStyleSheetToWorld):
+            (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+            (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+            (WebCore::PageGroup::removeAllUserContent):
+            
+                Fix a misspelling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            (WebCore::PageGroup::invalidateInjectedStyleSheetCacheInAllFrames):
+            
+                Always invalidate style when user sheets change since we don't do that in
+                DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache anymore.
</ins><span class="cx"> 
</span><del>-        Fix regression from r169063. That commit removed scrolledContentsLayers from 
-        frame scrolling nodes, but they do actually use them.
-        
-        So put them back; not in the base class, because they have a somewhat different
-        meaning for overflow scrolling and frame scrolling.
</del><ins>+            * page/PageGroup.h:
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
-        (WebCore::AsyncScrollingCoordinator::updateFrameScrollingNode):
-        * page/scrolling/AsyncScrollingCoordinator.h:
-        * page/scrolling/ScrollingCoordinator.h:
-        (WebCore::ScrollingCoordinator::updateFrameScrollingNode):
-        * page/scrolling/ScrollingStateFrameScrollingNode.cpp:
-        (WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
-        (WebCore::ScrollingStateFrameScrollingNode::setScrolledContentsLayer):
-        * page/scrolling/ScrollingStateFrameScrollingNode.h:
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Merge r155071.
</ins><span class="cx"> 
</span><del>-        REGRESSION: [CSS Regions] Content flowed directly into the flow thread that ends up in the second region is not properly repainted
-        https://bugs.webkit.org/show_bug.cgi?id=133111
</del><ins>+    2013-09-04  Pratik Solanki  &lt;psolanki@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            Document::updateHoverActiveState() should allow for deferred style recalcs
+            https://bugs.webkit.org/show_bug.cgi?id=120700
</ins><span class="cx"> 
</span><del>-        When computing the repaint rect of an element flowed into a flow thread, if the element is flowed directly into
-        the flow thread (meaning its containing block is the flow thread itself), the region's position within the flow
-        must no longer be taken into consideration, because its already included in the element's |topLeft|.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/hover-element-flowed-second-region.html
</del><ins>+            Add an extra argument to Document::updateHoverActiveState() to specify if a style recalc
+            should be done. The default value keeps the current behavior of doing a style recalc. iOS
+            touch handling code will pass in DeferRecalcStyleIfNeeded to avoid the work.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeRectForRepaint):
</del><ins>+            No new tests because no functional changes.
</ins><span class="cx"> 
</span><del>-2014-05-20  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::updateHoverActiveState):
+            * dom/Document.h:
</ins><span class="cx"> 
</span><del>-        Fix web timing assertion failure.
-        https://bugs.webkit.org/show_bug.cgi?id=133094
-        &lt;rdar://problem/16966032&gt;
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        Merge r158802.
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getConnectionTimingData):
-        Set requestStart and responseStart to 0 instead of -1 to match the 
-        ResourceLoadTiming constructor and prevent the assertion failure in
-        PerformanceTiming::responseStart.
</del><ins>+    2013-11-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Prashant Hiremath  &lt;hiremathprashants@gmail.com&gt;
</del><ins>+            Crash in SliderThumbElement::dragFrom
+            https://bugs.webkit.org/show_bug.cgi?id=123873
</ins><span class="cx"> 
</span><del>-        Only set title on SVG documents
-        https://bugs.webkit.org/show_bug.cgi?id=133068
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            Moved Ref.
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/html_document_set_title.html
</del><ins>+            * html/RangeInputType.cpp:
+            (WebCore::RangeInputType::handleMouseDownEvent):
+            * html/shadow/SliderThumbElement.cpp:
+            (WebCore::SliderThumbElement::dragFrom):
</ins><span class="cx"> 
</span><del>-        * svg/SVGTitleElement.cpp:
-        (WebCore::SVGTitleElement::insertedInto):
-        (WebCore::SVGTitleElement::removedFrom):
-        (WebCore::SVGTitleElement::childrenChanged):
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</del><ins>+        Merge r158724.
</ins><span class="cx"> 
</span><del>-        [Curl] Invalid content in cache file, causes broken rendering.
-        https://bugs.webkit.org/show_bug.cgi?id=133069
</del><ins>+    2013-11-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            Use-after-free in SliderThumbElement::dragFrom
+            https://bugs.webkit.org/show_bug.cgi?id=123873
</ins><span class="cx"> 
</span><del>-        When data for a url is received as multiple parts, the cache file for the url is truncated when opened for writing,
-        and will only contain the last part of data received.
-        This is fixed by only opening the file once, and close it after all data has been received.
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * platform/network/curl/CurlCacheEntry.cpp:
-        (WebCore::CurlCacheEntry::CurlCacheEntry): Initialize cache file handle member.
-        (WebCore::CurlCacheEntry::~CurlCacheEntry): Close cache file.
-        (WebCore::CurlCacheEntry::saveCachedData): Only open cache file once to avoid truncating.
-        (WebCore::CurlCacheEntry::didFail): Close cache file.
-        (WebCore::CurlCacheEntry::didFinishLoading): Ditto.
-        (WebCore::CurlCacheEntry::openContentFile): Added method to open cache file.
-        (WebCore::CurlCacheEntry::closeContentFile): Added method to close cache file.
-        * platform/network/curl/CurlCacheEntry.h: Added file handle member, and methods to open and close cache file.
</del><ins>+            Ref the SliderThumbElement since it could go away inside dragFrom.
</ins><span class="cx"> 
</span><del>-2014-05-20  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            Test: fast/forms/range/range-type-change-onchange-2.html
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Block incorrectly sized when containing an unsplittable box
-        https://bugs.webkit.org/show_bug.cgi?id=132601
</del><ins>+            * html/RangeInputType.cpp:
+            (WebCore::RangeInputType::handleMouseDownEvent):
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When laying out elements in a region, when an inline element is encountered
-        the size of its parent must not be increased beyond the bottom of the current region,
-        unless if its the last region. This will ensure that the next sibling of the
-        inline element is correctly laid out at the top of the next region, instead
-        of leaving an empty space equal to the height of the overflow, as it did until now.
</del><ins>+        Merge r163599.
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/inline-block-inside-anonymous-overflow.html
-               fast/regions/inline-block-overflow.html
</del><ins>+    2014-02-06  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::adjustLinePositionForPagination):
-        (WebCore::RenderBlockFlow::hasNextPage):
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
-        (WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
-        (WebCore::RenderBlockFlow::determineStartPosition):
-        (WebCore::RenderBlockFlow::checkPaginationAndFloatsAtEndLine):
</del><ins>+            loadSubframe can return null in SubframeLoader::loadOrRedirectSubframe
+            https://bugs.webkit.org/show_bug.cgi?id=128344
</ins><span class="cx"> 
</span><del>-2014-05-20  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Crash while painting block selection gaps in regions
-        https://bugs.webkit.org/show_bug.cgi?id=132720
</del><ins>+            * loader/SubframeLoader.cpp:
+            (WebCore::SubframeLoader::loadOrRedirectSubframe):
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The fix for WebKit bug https://bugs.webkit.org/show_bug.cgi?id=131511
-        allowed selection highlight to match the DOM selection when the start
-        and end point of the selection were in different flow threads. In order
-        to enable that, the selection was performed separately on view and
-        render flow threads, considered selection subtrees.
</del><ins>+        Merge r164170.
</ins><span class="cx"> 
</span><del>-        However, the start and end points for each selection subtree were computed
-        by means of Range class but it is not always possible to construct a valid
-        Range from two pairs of RenderObjects and offsets.
</del><ins>+    2014-02-15  Renata Hodovan  &lt;rhodovan.u-szeged@partner.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        This patch keeps the substrees approach but instead of storing the endpoints
-        for each subtree in a Range and continuously extending the Range, it stores them
-        using the already available SelectionSubtreeRoot class. After the end points are
-        computed for each subtree and before processing the subtree selection, the end points
-        are adjusted in a similar fashion as the one used in FrameSelection::updateAppearance(),
-        to make sure we are passing the same expected information to the method implementing
-        the visible selection processing.
</del><ins>+            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
+            https://bugs.webkit.org/show_bug.cgi?id=128810
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/selection-gaps-paint-crash.html
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::splitSelectionBetweenSubtrees):
-        * rendering/SelectionSubtreeRoot.cpp:
-        (WebCore::SelectionSubtreeRoot::adjustForVisibleSelection):
-        * rendering/SelectionSubtreeRoot.h:
-        (WebCore::SelectionSubtreeRoot::selectionClear):
</del><ins>+            Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
+            doesn't contain |start|.
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
+            ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
+            patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
+            |outerNode| only if |outerNode| contains |start| position.
</ins><span class="cx"> 
</span><del>-        Scrolling pages with large TiledBacking content layers creates way too many tiles
-        https://bugs.webkit.org/show_bug.cgi?id=133101
</del><ins>+            Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&amp;view=revision by yosin@chromium.org.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Test: editing/execCommand/indent-with-uneditable-crash.html
</ins><span class="cx"> 
</span><del>-        Fix the GraphicsLayerCA::adjustTiledLayerVisibleRect() logic to avoid making giant rects if the old
-        and new visible rects don't overlap.
</del><ins>+            * editing/CompositeEditCommand.cpp:
+            (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/TiledBacking.h:
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::adjustTiledLayerVisibleRect):
-        * platform/graphics/ca/mac/TileController.h:
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Merge r160065.
</ins><span class="cx"> 
</span><del>-        Correctly maintain the &quot;isInWindow&quot; state for all TiledBackings
-        https://bugs.webkit.org/show_bug.cgi?id=133095
</del><ins>+    2013-12-03  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
-        
-        We never updated the &quot;isInWindow&quot; state for TiledBacking that wasn't the RenderView's
-        backing. Fix it by having RenderLayerCompositor::setIsInWindow() recurse through all
-        layers (if necessary), updating their state. Also set the state on newly created
-        TiledBackings.
</del><ins>+            Potential crash in RenderView::selectionBounds and RenderView::repaintSelection
+            https://bugs.webkit.org/show_bug.cgi?id=125207
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::layerTiledBackingUsageChanged):
-        (WebCore::RenderLayerCompositor::setIsInWindowForLayerIncludingDescendants):
-        (WebCore::RenderLayerCompositor::setIsInWindow):
-        (WebCore::RenderLayerCompositor::pageTiledBacking): Deleted.
-        * rendering/RenderLayerCompositor.h:
</del><ins>+            Reviewed by Simon Fraser.
+            
+            Merge https://chromium.googlesource.com/chromium/blink/+/f9e6e288a5aa959f05c374806121aaf0fc52d440
</ins><span class="cx"> 
</span><del>-2014-05-19  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            Update style in FrameSelection instead of RenderView's member functions. These are the last two
+            member functions of RenderView that updates the style.
</ins><span class="cx"> 
</span><del>-        [iOS] Use status display for live streams
-        https://bugs.webkit.org/show_bug.cgi?id=133097
</del><ins>+            * editing/FrameSelection.cpp:
+            (WebCore::FrameSelection::focusedOrActiveStateChanged):
+            (WebCore::FrameSelection::bounds):
+            * rendering/RenderView.cpp:
+            (WebCore::RenderView::selectionBounds):
+            (WebCore::RenderView::repaintSelection):
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Follow-on from https://bugs.webkit.org/show_bug.cgi?id=131390
-        Allow the iOS controls to use the status display field.
</del><ins>+        Merge r164367.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.configureInlineControls): Live streams should
-        not have a timeline or rewind button.
</del><ins>+    2014-02-19  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</del><ins>+            Do not dispatch change event twice in single step action
+            https://bugs.webkit.org/show_bug.cgi?id=116936
+            &lt;rdar://problem/16086828&gt;
</ins><span class="cx"> 
</span><del>-        Text decorations do not contribute to visual overflow
-        https://bugs.webkit.org/show_bug.cgi?id=132773
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Merged from Blink (patch by Kent Tamura):
+            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=151175
</ins><span class="cx"> 
</span><del>-        This patch creates a function, visualOverflowForDecorations, which computes
-        how much visual overflow to add around a text box due to text decorations. Most of the time,
-        text decorations are fully contained within the text box, so the result is usually 0.
</del><ins>+            Test: fast/forms/number/number-type-update-by-change-event.html
</ins><span class="cx"> 
</span><del>-        This function exists within style/InlineTextBoxStyle.cpp, which is an added file. This is
-        so that it can be called from setLogicalWidthForTextRun() inside RenderBlockLineLayout.cpp
-        and from RenderStyle::changeAffectsVisualOverflow(). The former case passes in the full
-        InlineTextBox and the latter case just passes in a RenderStyle (because the InlineTextBox
-        is unavailable.)
</del><ins>+            * html/InputType.cpp:
+            (WebCore::InputType::stepUpFromRenderer):
</ins><span class="cx"> 
</span><del>-        This patch also modifies RenderTableSection::spannedColumns() to fix an off-by-one error
-        that was causing table borders to not be drawn when they existed right on the edge of
-        a repaint rect.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/css3-text/css3-text-decoration/repaint/underline-outside-of-layout-rect.html
-        Tests: fast/repaint/border-collapse-table-off-by-one-expected.html
</del><ins>+        Merge r164204.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj: Adding reference to new InlineTextBoxStyle.cpp file
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Adding reference to new InlineTextBoxStyle files
-        * WebCore.xcodeproj/project.pbxproj: Adding reference to new InlineTextBoxStyle files
-        * rendering/InlineTextBox.cpp:
-        (WebCore::computeUnderlineOffset): Moved to InlineTextBox.cpp
-        (WebCore::getWavyStrokeParameters): Moved to InlineTextBox.cpp
-        (WebCore::InlineTextBox::paintDecoration): Update to use newly refactored functions
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::setLogicalWidthForTextRun): Call visualOverflowForDecorations()
-        * rendering/RenderTableSection.cpp:
-        * rendering/RenderTableSelection.cpp: Fix off-by-one error when the boundary of a repaint
-        rect lies exactly on top of a table column position
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeAffectsVisualOverflow): Inspects shadows and text decorations
-        (WebCore::RenderStyle::changeRequiresLayout): Calls changeAffectsVisualOverflow()
-        (WebCore::RenderStyle::changeRequiresRepaintIfTextOrBorderOrOutline): Moved code from here
-        to changeAffectsVisualOverflow().
-        * rendering/style/RenderStyle.h: Function signature
-        * style/InlineTextBoxStyle.cpp: Added.
-        (WebCore::computeUnderlineOffset): Moved from InlineTextBox.cpp
-        (WebCore::getWavyStrokeParameters): Moved from InlineTextBox.cpp
-        (WebCore::extendIntToFloat): Convenience function for dealing with the fact that
-        underline bounding boxes use floats and GlyphOverflow uses ints
-        (WebCore::visualOverflowForDecorations): Given
-        vertical overflow bounds, possibly extend those to include location of
-        decorations.
-        * style/InlineTextBoxStyle.h: Added. Function signatures.
-        (WebCore::textDecorationStrokeThickness): Refactored from InlineTextBox.cpp
-        (WebCore::wavyOffsetFromDecoration): Refactored from InlineTextBox.cpp
-        * platform/graphics/Font.h:
-        (WebCore::GlyphOverflow::isEmpty): Convenience function
-        (WebCore::GlyphOverflow::extendTo): Convenience function
</del><ins>+    2014-02-16  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Ensure that removing an iframe from the DOM tree disconnects its Frame.
+            &lt;https://webkit.org/b/128889&gt;
+            &lt;rdar://problem/15671221&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r169082
</del><ins>+            Merged from Blink (patch by Adam Klein):
+            https://src.chromium.org/viewvc/blink?revision=156174&amp;view=revision
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandle.h:
-        Added NSDictionary declaration.
</del><ins>+            SubframeLoadingDisabler wasn't catching the case when an &lt;iframe&gt; was,
+            in its unload handler, removed and re-added to the same parent.
+            Fix this by using a count of SubframeLoadingDisablers that are on the
+            stack for a given root, rather than a simple boolean.
</ins><span class="cx"> 
</span><del>-2014-05-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            Test: fast/frames/reattach-in-unload.html
</ins><span class="cx"> 
</span><del>-        REGRESSION: Standalone images need to take topContentInset into account
-        https://bugs.webkit.org/show_bug.cgi?id=133092
-        -and corresponding-
-        &lt;rdar://problem/16945791&gt;
</del><ins>+            * html/HTMLFrameOwnerElement.h:
+            (WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The FrameView’s size is accurate in terms of the NSWindow size, but that is not 
-        really what the ImageDocument code is looking for here. The ImageDocument wants to 
-        know the size of the unobscured viewport area. We should use visibleSize() for 
-        that.
-        * html/ImageDocument.cpp:
-        (WebCore::ImageDocument::scale):
-        (WebCore::ImageDocument::imageFitsInWindow):
-        (WebCore::ImageDocument::imageClicked):
</del><ins>+        Merge r157957.
</ins><span class="cx"> 
</span><del>-2014-05-19  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+    2013-10-24  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Collect web timing data on iOS.
-        https://bugs.webkit.org/show_bug.cgi?id=133075
</del><ins>+            Crash in WebCore::NavigationScheduler::startTimer()
+            https://bugs.webkit.org/show_bug.cgi?id=123288
+            &lt;rdar://problem/14055644&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandle.h:
-        Added setCollectsTimingData wrapper and getConnectionTimingData declarations.
-        getConnectionTimingData with a dictionary parameter is a private helper function.
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::start):
-        Call setCollectsTimingData wrapper when creating a connection to ensure that timing data is collected.
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.cpp:
-        (WebCore::ResourceHandleCFURLConnectionDelegate::didReceiveResponseCallback):
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
-        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.h:
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
-        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveResponse):
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.h:
-        Pass the CFURLConnectionRef to didReceiveResponse to get timing data from.
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getConnectionTimingData):
-        Moved from getTimingData to compile regardless of using CFNetwork and added wrapper with CFDictionaryRef.
-        (WebCore::ResourceHandle::setCollectsTimingData):
-        Added wrapper to call objc function from c++.
-        (WebCore::ResourceHandle::getTimingData):
-        Renamed to getConnectionTimingData.
-        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
-        Updated function name from getTimingData to getConnectionTimingData.
</del><ins>+            Currently NavigationScheduler::startTimer() synchronously notifies the client
+            before the Web Inspector of a scheduled redirect. If a client cancels this
+            redirect then NavigationScheduler::m_redirect will become null and we'll
+            subsequently crash when informing the Web Inspector of this formerly scheduled
+            redirect. Instead, NavigationScheduler::startTimer() should notify the Web
+            Inspector before it notifies the client of a scheduled redirect.
</ins><span class="cx"> 
</span><del>-2014-05-19  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+            As a side benefit of this change, the Web Inspector is notified of a scheduled
+            redirect before being notified of it being canceled when a client chooses to cancel
+            a scheduled redirect.
</ins><span class="cx"> 
</span><del>-        AX: VoiceOver sees the WebArea out of order when topContentInset is used
-        https://bugs.webkit.org/show_bug.cgi?id=133091
</del><ins>+            * loader/NavigationScheduler.cpp:
+            (WebCore::NavigationScheduler::startTimer):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Modify the scroll view's frame so that it recognizes the content inset.
-        This is needed so that when VoiceOver sorts elements to create an ordering,
-        the web area is not ordered at the top of the screen.
</del><ins>+        Merge r153829
</ins><span class="cx"> 
</span><del>-        Test: platform/mac-wk2/accessibility/content-inset-scrollview-frame.html
</del><ins>+    2013-08-08  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityScrollView.cpp:
-        (WebCore::AccessibilityScrollView::elementRect):
</del><ins>+            Inserting multiple rules into an empty style sheet should avoid style recalc if possible.
+            &lt;http://webkit.org/b/119568&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Scrollbars display incorrectly after switching between fast and slow scrolling 
-        mode, affects Find and real sites
-        https://bugs.webkit.org/show_bug.cgi?id=133077
-        -and corresponding-
-        &lt;rdar://problem/16888608&gt;
</del><ins>+            As a follow-up to &lt;http://webkit.org/b/119475&gt;, where I added a hack for inserting
+            a single rule into an empty style sheet, this broadens the optimization to support
+            any number of rules.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            This optimizes the scenario where a style sheet is added to the DOM and then populated
+            rule-by-rule via CSSOM insertRule()/addRule() calls. Previously we'd do a full style
+            recalc for this case, but now we'll treat it the same as a full sheet added at once.
</ins><span class="cx"> 
</span><del>-        We should always return true here when updating on the secondary thread is 
-        supported. It does not need to be gated on whether we are actively taking 
-        advantage of that support at this moment.
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::supportsUpdateOnSecondaryThread):
</del><ins>+            * css/CSSStyleSheet.h:
+            * css/CSSStyleSheet.cpp:
+            (WebCore::CSSStyleSheet::willMutateRules):
</ins><span class="cx"> 
</span><del>-        Always update the presentationValue whenever we update the doubleValue just to 
-        keep them in sync.
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::setPaintCharacteristicsForScrollbar):
</del><ins>+                Made willMutateRules() return whether the style sheet contents were cloned by the
+                copy-on-write mechanism.
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * dom/Document.h:
+            (WebCore::CSSStyleSheet::didMutateRules):
+            (WebCore::CSSStyleSheet::insertRule):
</ins><span class="cx"> 
</span><del>-        Split scrolling tree ScrollingNodes into FrameScrollingNodes and OverflowScrollingNodes
-        https://bugs.webkit.org/show_bug.cgi?id=133022
</del><ins>+                Replaced the InsertionIntoEmptySheet mutation type by a general RuleInsertion.
+                The mutation callback checks if we're inserting into a rule that's not (yet) part
+                of the document's active sheet set. In that case, we defer doing the style sheet
+                until all the insertions are done (or something forces us to style+layout.)
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+                Note that this optimization only happens if the style sheet had a single client.
+                Shared style sheets that just got cloned before mutation may have pointers into
+                them from the Document's StyleResolver, so we're forced to do an immediate sheet
+                update in that case.
</ins><span class="cx"> 
</span><del>-        In both the scrolling state tree and the scrolling tree, split the &quot;scrolling nodes&quot;
-        into FrameScrolling and OverflowScrolling nodes.
-        
-        Move what was the &quot;viewportSize&quot; property onto the base class for the scrolling
-        nodes, calling it &quot;scrollableAreaSize&quot;.
-        
-        Make minimum/maximumScrollPosition() virtual so we can share more code (and there
-        is more code sharing to be done in future).
</del><ins>+            (WebCore::CSSStyleSheet::RuleMutationScope::RuleMutationScope):
+            (WebCore::CSSStyleSheet::RuleMutationScope::~RuleMutationScope):
</ins><span class="cx"> 
</span><del>-        * Configurations/WebCore.xcconfig: Remove ScrollingStateScrollingNodeMac.mm and ScrollingTreeScrollingNodeMac.mm
-        from the list, using #ifdefs in the file instead.
-        * WebCore.exp.in: Lots of exports.
-        * WebCore.xcodeproj/project.pbxproj: New files.
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated):
-        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
-        (WebCore::AsyncScrollingCoordinator::updateFrameScrollingNode):
-        (WebCore::AsyncScrollingCoordinator::updateOverflowScrollingNode):
-        (WebCore::AsyncScrollingCoordinator::recomputeWheelEventHandlerCountForFrameView):
-        (WebCore::AsyncScrollingCoordinator::updateScrollingNode): Deleted.
-        (WebCore::AsyncScrollingCoordinator::setScrollbarPaintersFromScrollbarsForNode): Deleted.
-        This tiny function didn't need to exist.
-        * page/scrolling/AsyncScrollingCoordinator.h:
-        * page/scrolling/ScrollingCoordinator.h:
-        (WebCore::ScrollingCoordinator::updateFrameScrollingNode):
-        (WebCore::ScrollingCoordinator::updateOverflowScrollingNode):
-        (WebCore::ScrollingCoordinator::updateScrollingNode): Deleted.
-        * page/scrolling/ScrollingStateFrameScrollingNode.cpp: Copied from Source/WebCore/page/scrolling/ScrollingStateScrollingNode.cpp.
-        (WebCore::ScrollingStateFrameScrollingNode::create):
-        (WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
-        (WebCore::ScrollingStateFrameScrollingNode::~ScrollingStateFrameScrollingNode):
-        (WebCore::ScrollingStateFrameScrollingNode::clone):
-        (WebCore::ScrollingStateFrameScrollingNode::setFrameScaleFactor):
-        (WebCore::ScrollingStateFrameScrollingNode::setNonFastScrollableRegion):
-        (WebCore::ScrollingStateFrameScrollingNode::setWheelEventHandlerCount):
-        (WebCore::ScrollingStateFrameScrollingNode::setSynchronousScrollingReasons):
-        (WebCore::ScrollingStateFrameScrollingNode::setScrollBehaviorForFixedElements):
-        (WebCore::ScrollingStateFrameScrollingNode::setHeaderHeight):
-        (WebCore::ScrollingStateFrameScrollingNode::setFooterHeight):
-        (WebCore::ScrollingStateFrameScrollingNode::setTopContentInset):
-        (WebCore::ScrollingStateFrameScrollingNode::setCounterScrollingLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setInsetClipLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setContentShadowLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setHeaderLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setFooterLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setScrollbarPaintersFromScrollbars):
-        (WebCore::ScrollingStateFrameScrollingNode::dumpProperties):
-        * page/scrolling/ScrollingStateFrameScrollingNode.h: Copied from Source/WebCore/page/scrolling/ScrollingStateScrollingNode.h.
-        * page/scrolling/ScrollingStateNode.h:
-        (WebCore::LayerRepresentation::layerID):
-        (WebCore::ScrollingStateNode::isFrameScrollingNode):
-        (WebCore::ScrollingStateNode::isOverflowScrollingNode):
-        * page/scrolling/ScrollingStateOverflowScrollingNode.cpp: Added.
-        (WebCore::ScrollingStateOverflowScrollingNode::create):
-        (WebCore::ScrollingStateOverflowScrollingNode::ScrollingStateOverflowScrollingNode):
-        (WebCore::ScrollingStateOverflowScrollingNode::~ScrollingStateOverflowScrollingNode):
-        (WebCore::ScrollingStateOverflowScrollingNode::clone):
-        (WebCore::ScrollingStateOverflowScrollingNode::setScrolledContentsLayer):
-        (WebCore::ScrollingStateOverflowScrollingNode::dumpProperties):
-        * page/scrolling/ScrollingStateOverflowScrollingNode.h: Copied from Source/WebCore/page/scrolling/mac/ScrollingStateScrollingNodeMac.mm.
-        (WebCore::ScrollingStateOverflowScrollingNode::scrolledContentsLayer):
-        * page/scrolling/ScrollingStateScrollingNode.cpp:
-        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
-        (WebCore::ScrollingStateScrollingNode::setScrollableAreaSize):
-        (WebCore::ScrollingStateScrollingNode::setTotalContentsSize):
-        (WebCore::ScrollingStateScrollingNode::dumpProperties):
-        (WebCore::ScrollingStateScrollingNode::create): Deleted.
-        (WebCore::ScrollingStateScrollingNode::clone): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setViewportSize): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setFrameScaleFactor): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setNonFastScrollableRegion): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setWheelEventHandlerCount): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setSynchronousScrollingReasons): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setScrollBehaviorForFixedElements): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setHeaderHeight): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setFooterHeight): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setTopContentInset): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setScrolledContentsLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setCounterScrollingLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setInsetClipLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setContentShadowLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setHeaderLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setFooterLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setScrollbarPaintersFromScrollbars): Deleted.
-        * page/scrolling/ScrollingStateScrollingNode.h:
-        (WebCore::ScrollingStateScrollingNode::scrollableAreaSize):
-        (WebCore::ScrollingStateScrollingNode::totalContentsSize):
-        * page/scrolling/ScrollingStateTree.cpp:
-        (WebCore::ScrollingStateTree::attachNode):
-        (WebCore::ScrollingStateTree::commit):
-        * page/scrolling/ScrollingStateTree.h:
-        (WebCore::ScrollingStateTree::rootStateNode):
-        (WebCore::ScrollingStateTree::setRootStateNode):
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::commitNewTreeState):
-        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp: Added.
-        (WebCore::ScrollingTreeFrameScrollingNode::ScrollingTreeFrameScrollingNode):
-        (WebCore::ScrollingTreeFrameScrollingNode::~ScrollingTreeFrameScrollingNode):
-        (WebCore::ScrollingTreeFrameScrollingNode::updateBeforeChildren):
-        * page/scrolling/ScrollingTreeFrameScrollingNode.h: Copied from Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h.
-        (WebCore::ScrollingTreeFrameScrollingNode::updateLayersAfterDelegatedScroll):
-        (WebCore::ScrollingTreeFrameScrollingNode::synchronousScrollingReasons):
-        (WebCore::ScrollingTreeFrameScrollingNode::shouldUpdateScrollLayerPositionSynchronously):
-        (WebCore::ScrollingTreeFrameScrollingNode::frameScaleFactor):
-        (WebCore::ScrollingTreeFrameScrollingNode::headerHeight):
-        (WebCore::ScrollingTreeFrameScrollingNode::footerHeight):
-        (WebCore::ScrollingTreeFrameScrollingNode::topContentInset):
-        (WebCore::ScrollingTreeFrameScrollingNode::scrollBehaviorForFixedElements):
-        * page/scrolling/ScrollingTreeNode.h:
-        (WebCore::ScrollingTreeNode::isFrameScrollingNode):
-        (WebCore::ScrollingTreeNode::isOverflowScrollingNode):
-        * page/scrolling/ScrollingTreeOverflowScrollingNode.cpp: Copied from Source/WebKit2/UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.h.
-        (WebCore::ScrollingTreeOverflowScrollingNode::ScrollingTreeOverflowScrollingNode):
-        (WebCore::ScrollingTreeOverflowScrollingNode::~ScrollingTreeOverflowScrollingNode):
-        * page/scrolling/ScrollingTreeOverflowScrollingNode.h: Copied from Source/WebKit2/UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.h.
-        * page/scrolling/ScrollingTreeScrollingNode.cpp:
-        (WebCore::ScrollingTreeScrollingNode::ScrollingTreeScrollingNode):
-        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
-        (WebCore::ScrollingTreeScrollingNode::updateAfterChildren):
-        (WebCore::ScrollingTreeScrollingNode::setScrollPosition):
-        (WebCore::ScrollingTreeScrollingNode::setScrollPositionWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeScrollingNode::minimumScrollPosition):
-        (WebCore::ScrollingTreeScrollingNode::maximumScrollPosition):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        (WebCore::ScrollingTreeScrollingNode::scrollableAreaSize):
-        (WebCore::ScrollingTreeScrollingNode::totalContentsSize):
-        (WebCore::ScrollingTreeScrollingNode::totalContentsSizeForRubberBand):
-        (WebCore::ScrollingTreeScrollingNode::setTotalContentsSizeForRubberBand):
-        (WebCore::ScrollingTreeScrollingNode::synchronousScrollingReasons): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::shouldUpdateScrollLayerPositionSynchronously): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::viewportSize): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::frameScaleFactor): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::headerHeight): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::footerHeight): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::scrollBehaviorForFixedElements): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::topContentInset): Deleted.
-        * page/scrolling/ios/ScrollingCoordinatorIOS.mm:
-        (WebCore::ScrollingCoordinatorIOS::createScrollingTreeNode):
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h: Renamed from Source/WebCore/page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h.
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollLayer):
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm: Renamed from Source/WebCore/page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm.
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::create):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::ScrollingTreeFrameScrollingNodeIOS):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::~ScrollingTreeFrameScrollingNodeIOS):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateBeforeChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateAfterChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPositionWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollLayerPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterViewportChange):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterDelegatedScroll):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::minimumScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::maximumScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollByWithoutContentEdgeConstraints):
-        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
-        (WebCore::ScrollingCoordinatorMac::createScrollingTreeNode):
-        * page/scrolling/mac/ScrollingStateFrameScrollingNodeMac.mm: Renamed from Source/WebCore/page/scrolling/mac/ScrollingStateScrollingNodeMac.mm.
-        (WebCore::ScrollingStateFrameScrollingNode::setScrollbarPaintersFromScrollbars):
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h: Renamed from Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.h.
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm: Renamed from Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm.
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::create):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::ScrollingTreeFrameScrollingNodeMac):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateAfterChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::handleWheelEvent):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::allowsHorizontalStretching):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::allowsVerticalStretching):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::stretchAmount):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::pinnedInDirection):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::canScrollHorizontally):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::canScrollVertically):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::shouldRubberBandInDirection):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::absoluteScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollByWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::startSnapRubberbandTimer):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::stopSnapRubberbandTimer):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPositionWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateLayersAfterViewportChange):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::minimumScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::maximumScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollByWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateMainFramePinState):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::logExposedUnfilledArea):
-        (WebCore::logThreadedScrollingMode):
-        (WebCore::logWheelEventHandlerCountChanged):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
</del><ins>+                Moved these out-of-line.
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            (WebCore::CSSStyleSheet::didMutateRuleFromCSSStyleDeclaration):
+            * css/PropertySetCSSStyleDeclaration.cpp:
+            (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
</ins><span class="cx"> 
</span><del>-        Images missing sometimes with composited clipping layers
-        https://bugs.webkit.org/show_bug.cgi?id=133065
-        &lt;rdar://problem/15224559&gt;
</del><ins>+                Made a separate mutation callback for CSSStyleDeclaration since its needs are
+                so simple compared to the mutation callback from CSSStyleSheet. Seems better
+                than adding yet another mode to the enum.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
-        
-        When support for solid colors on layers was added, a layer was considered a candidate
-        for the solid color optimization without regard to whether it had descendent layers
-        with &quot;paintsIntoCompositedAncestor&quot; requirements.
-        
-        Fix hasVisibleNonCompositingDescendantLayers(), renaming it to isPaintDestinationForDescendentLayers()
-        and having it take into account whether descendent layers need to paint into an
-        ancestor.
-        
-        Also, this test has to happen after those descendent layers have had their
-        compositing state updated, so move the isSimpleContainerCompositingLayer() to
-        a new updateAfterDescendents() function which is called from the various
-        places we do compositing-udpate-tree-walks.
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::Document):
+            (WebCore::Document::recalcStyle):
+            (WebCore::Document::styleResolverChanged):
+            (WebCore::Document::optimizedStyleSheetUpdateTimerFired):
+            (WebCore::Document::scheduleOptimizedStyleSheetUpdate):
</ins><span class="cx"> 
</span><del>-        Test: compositing/backing/solid-color-with-paints-into-ancestor.html
</del><ins>+                Added mechanism to defer doing a RecalcStyleIfNeeded.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGeometry):
-        (WebCore::RenderLayerBacking::updateAfterDescendents):
-        (WebCore::RenderLayerBacking::paintsChildren):
-        (WebCore::compositedWithOwnBackingStore):
-        (WebCore::descendentLayerPaintsIntoAncestor):
-        (WebCore::RenderLayerBacking::isPaintDestinationForDescendentLayers):
-        (WebCore::hasVisibleNonCompositingDescendant): Deleted.
-        (WebCore::RenderLayerBacking::hasVisibleNonCompositingDescendantLayers): Deleted.
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
</del><ins>+            (WebCore::Document::updateStyleIfNeeded):
</ins><span class="cx"> 
</span><del>-2014-05-19  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+                Synchronize the optimized style sheet update if there's one scheduled.
+                This ensures that stuff like layout-dependent property access won't operate
+                on stale style.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r133351, sub-pixel layout): Right-to-left block with text-overflow: ellipsis truncates prematurely (breaks facebook.com Hebrew UI)
-        https://bugs.webkit.org/show_bug.cgi?id=112227
</del><ins>+            * dom/DocumentStyleSheetCollection.h:
+            (WebCore::DocumentStyleSheetCollection::pendingUpdateType):
+            (WebCore::DocumentStyleSheetCollection::setPendingUpdateType):
+            (WebCore::DocumentStyleSheetCollection::flushPendingUpdates):
+            * dom/DocumentStyleSheetCollection.cpp:
+            (WebCore::DocumentStyleSheetCollection::DocumentStyleSheetCollection):
+            (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):
</ins><span class="cx"> 
</span><del>-        Reviewed by Maciej Stachowiak.
</del><ins>+                Have DSSC track the kind of style sheet update it needs to do (instead of just
+                a boolean &quot;needs update.&quot;) This is used by Document::recalcStyle() to make sure
+                the right kind of update happens if there's one scheduled.
</ins><span class="cx"> 
</span><del>-        This patch removes unnecessary integral snapping of inlines at layout time.
</del><ins>+            (WebCore::DocumentStyleSheetCollection::activeStyleSheetsContains):
</ins><span class="cx"> 
</span><del>-        The general rule of thumb of using round/floor/ceil at layout time is to not use them.

-        When some computed values (x, y, width, height) get snapped during layout, while others don't,
-        intersecting/measuring mismatches could occur and they could end up producing visual artifacts such as truncations.
-        This patch also enables iframe content to be positioned on odd device pixel positions on retina displays.
-        
-        Tests: fast/frames/hidpi-position-iframe-on-device-pixel.html
-               fast/inline/hidpi-rtl-text-does-not-fit-line-and-gets-cut-off.html
</del><ins>+                Added helper to check if a CSSStyleSheet is part of the active set.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::logicalLeftOffsetForLine):
-        (WebCore::RenderBlock::pixelSnappedLogicalLeftOffsetForLine): Deleted.
-        (WebCore::RenderBlock::pixelSnappedLogicalRightOffsetForLine): Deleted.
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::updateLogicalInlinePositions):
-        (WebCore::RenderBlockFlow::deleteEllipsisLineBoxes):
-        (WebCore::RenderBlockFlow::checkLinesForTextOverflow):
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-18  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Merge r159970.
</ins><span class="cx"> 
</span><del>-        AX: iOS: using AXAttributeCacheEnabler is too slow for every accessibilityElementAtIndex:
-        https://bugs.webkit.org/show_bug.cgi?id=133043
</del><ins>+    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+            Add more CachedPage null checks
+            https://bugs.webkit.org/show_bug.cgi?id=125106
</ins><span class="cx"> 
</span><del>-        iOS Accessibility code tries to improve performance by caching attributes when accessing
-        elements through the platform API. However, those API calls can be used very frequently when 
-        iterating elements. Creating the AXAttributeCacheEnabler object and tearing it down is proving
-        to be the hottest code path in samples for accessibility access.
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        We need to move the logic for enabling/disabling the attribute cache to a level that can make
-        a more informed decision about when to enable/disable.
</del><ins>+            Only some functions in PageCache.cpp null-check the CachedPages in HistoryItems.
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper enableAttributeCaching]):
-        (-[WebAccessibilityObjectWrapper disableAttributeCaching]):
-        (-[WebAccessibilityObjectWrapper accessibilityElementCount]):
-        (-[WebAccessibilityObjectWrapper accessibilityElementAtIndex:]):
-        (-[WebAccessibilityObjectWrapper indexOfAccessibilityElement:]):
</del><ins>+            Every part that manipulates the CachedPage should.
</ins><span class="cx"> 
</span><del>-2014-05-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * history/PageCache.cpp:
+            (WebCore::PageCache::markPagesForVistedLinkStyleRecalc):
+            (WebCore::PageCache::markPagesForFullStyleRecalc):
+            (WebCore::PageCache::markPagesForDeviceScaleChanged):
+            (WebCore::PageCache::markPagesForCaptionPreferencesChanged):
</ins><span class="cx"> 
</span><del>-        Use RenderStyle&amp; in more places in RenderLayerBacking
-        https://bugs.webkit.org/show_bug.cgi?id=133061
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Merge r159986.
</ins><span class="cx"> 
</span><del>-        Convert several member functions to use references to RenderStyle rather
-        than pointers. Move canCreateTiledImage() higher in the file (no code
-        changes). Other minor cleanup.
</del><ins>+    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt; 
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateOpacity):
-        (WebCore::RenderLayerBacking::updateTransform):
-        (WebCore::RenderLayerBacking::updateFilters):
-        (WebCore::RenderLayerBacking::updateBlendMode):
-        (WebCore::RenderLayerBacking::updateGeometry):
-        (WebCore::hasBoxDecorations):
-        (WebCore::canCreateTiledImage):
-        (WebCore::hasBoxDecorationsOrBackgroundImage):
-        (WebCore::hasPerspectiveOrPreserves3D):
-        (WebCore::supportsDirectBoxDecorationsComposition):
-        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
-        (WebCore::RenderLayerBacking::contentChanged):
-        (WebCore::RenderLayerBacking::startTransition):
-        * rendering/RenderLayerBacking.h:
</del><ins>+            Possible crash in ProgressTracker::progressHeartbeatTimerFired(Timer&lt;ProgressTracker&gt;*) 
+            https://bugs.webkit.org/show_bug.cgi?id=125110 
</ins><span class="cx"> 
</span><del>-2014-05-17  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Darin Adler. 
</ins><span class="cx"> 
</span><del>-        Rename some RenderLayerBacking member functions
-        https://bugs.webkit.org/show_bug.cgi?id=133030
</del><ins>+            FrameLoader::loadProgressingStatusChanged() might be called while the Frame has a null FrameView. 
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            It’s unclear how to reproduce, but there’s no harm in a null check. 
</ins><span class="cx"> 
</span><del>-        Remove &quot;GraphicsLayer&quot; from some member function names on RenderLayerBacking.
-        
-        No behavior change.
</del><ins>+            * loader/FrameLoader.cpp: 
+            (WebCore::FrameLoader::loadProgressingStatusChanged): 
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::AVFWrapper::createAVCFVideoLayer):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivateQTKit::createQTMovieLayer):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        (WebCore::RenderLayerBacking::updateConfiguration):
-        (WebCore::RenderLayerBacking::updateGeometry):
-        (WebCore::RenderLayerBacking::contentChanged):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Deleted.
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Deleted.
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
-        (WebCore::RenderLayerCompositor::attachRootLayer):
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Merge r159974.
</ins><span class="cx"> 
</span><del>-        Fix assertion failure with simple line layout debug borders enabled.
</del><ins>+    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt; 
</ins><span class="cx"> 
</span><del>-        Rubber-stamped by Andreas Kling.
</del><ins>+            Possible crash in ProgressTracker::progressHeartbeatTimerFired(Timer&lt;ProgressTracker&gt;*) 
+            https://bugs.webkit.org/show_bug.cgi?id=125110 
</ins><span class="cx"> 
</span><del>-        * rendering/SimpleLineLayoutFunctions.cpp:
-        (WebCore::SimpleLineLayout::paintDebugBorders): We shoudn't try to paint empty rects.
</del><ins>+            Reviewed by Darin Adler. 
</ins><span class="cx"> 
</span><del>-2014-05-18  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            It’s possible to have a null m_originatingProgressFrame when the heartbeat timer fires. 
</ins><span class="cx"> 
</span><del>-        Reduce constructor copypasta in RenderText and RenderElement.
-        &lt;https://webkit.org/b/133056&gt;
</del><ins>+            On the surface this seems impossible because the only time m_originatingProgressFrame is cleared 
+            out the heartbeat timer is also stopped. 
</ins><span class="cx"> 
</span><del>-        Use delegating constructors to remove duplicated initializer lists
-        from the constructors of RenderText and RenderElement.
</del><ins>+            But there’s likely still a race condition in multi-threaded environments. 
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            There’s no harm in null-checking m_originatingProgressFrame before accessing its loader. 
</ins><span class="cx"> 
</span><del>-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::RenderElement):
-        * rendering/RenderElement.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::RenderText):
-        * rendering/RenderText.h:
</del><ins>+            * loader/ProgressTracker.cpp: 
+            (WebCore::ProgressTracker::progressHeartbeatTimerFired): 
</ins><span class="cx"> 
</span><del>-2014-05-18  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Crash during scroll when latched
-        https://bugs.webkit.org/show_bug.cgi?id=133064
</del><ins>+        Merge r162063.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2014-01-15  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::platformPrepareForWheelEvents): Prevent dereference of NULL
-        wheelEventTarget argument.
</del><ins>+            Suspend resource requests during computedStyle
+            https://bugs.webkit.org/show_bug.cgi?id=127034
</ins><span class="cx"> 
</span><del>-2014-05-18  Svetlana Redchenko  &lt;redchenko@yandex-team.ru&gt;
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Input ::selection pseudo class does not work leading to hidden selection
-        https://bugs.webkit.org/show_bug.cgi?id=38943
</del><ins>+            We have some cases where getting computed style leads to crashes in loadPendingImages. 
+            This is probably caused by load callbacks resulting in re-entering WebKit and killing the StyleResolver.
+            
+            As a speculative fix suspend resource loads (and so callbacks) when getting the computed style.
+            We do similar suspension during style recalc for the same reason.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::styleForElementIgnoringPendingStylesheets):
+            * loader/ResourceLoadScheduler.h:
+            (WebCore::ResourceLoadScheduler::Suspender::Suspender):
+            (WebCore::ResourceLoadScheduler::Suspender::~Suspender):
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/input-with-selection-pseudo-element.html
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When text is selected inside input element, it should change the
-        color and background color according to the ::selection pseudo element.
</del><ins>+        Merge r158697.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::selectionBackgroundColor):
-        (WebCore::RenderObject::selectionColor):
-        (WebCore::RenderObject::selectionPseudoStyle):
-        * rendering/RenderObject.h:
</del><ins>+    2013-11-05  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-18  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+            Full width semicolon is wrong in vertical text.
+            https://bugs.webkit.org/show_bug.cgi?id=123814
+            &lt;rdar://problem/15312541&gt;
</ins><span class="cx"> 
</span><del>-        [WebKit2] Implement ScriptMessageHandlers
-        https://bugs.webkit.org/show_bug.cgi?id=133053
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            The full width semicolon should always be upright.
+            Adding it to the list of characters that should
+            ignore rotation.
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make:
-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::finishCreation):
-        * bindings/js/JSUserMessageHandlersNamespaceCustom.cpp: Added.
-        (WebCore::JSUserMessageHandlersNamespace::getOwnPropertySlotDelegate):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::shouldHaveWebKitNamespaceForWorld):
-        (WebCore::DOMWindow::webkitNamespace):
-        * page/DOMWindow.h:
-        * page/UserContentController.cpp:
-        (WebCore::UserContentController::addUserMessageHandlerDescriptor):
-        (WebCore::UserContentController::removeUserMessageHandlerDescriptor):
-        * page/UserContentController.h:
-        (WebCore::UserContentController::userMessageHandlerDescriptors):
-        * page/UserMessageHandler.cpp: Added.
-        (WebCore::UserMessageHandler::UserMessageHandler):
-        (WebCore::UserMessageHandler::~UserMessageHandler):
-        (WebCore::UserMessageHandler::postMessage):
-        (WebCore::UserMessageHandler::name):
-        (WebCore::UserMessageHandler::world):
-        * page/UserMessageHandler.h: Added.
-        (WebCore::UserMessageHandler::create):
-        * page/UserMessageHandler.idl: Added.
-        * page/UserMessageHandlerDescriptor.cpp: Added.
-        (WebCore::UserMessageHandlerDescriptor::UserMessageHandlerDescriptor):
-        (WebCore::UserMessageHandlerDescriptor::~UserMessageHandlerDescriptor):
-        (WebCore::UserMessageHandlerDescriptor::name):
-        (WebCore::UserMessageHandlerDescriptor::world):
-        * page/UserMessageHandlerDescriptor.h: Added.
-        (WebCore::UserMessageHandlerDescriptor::Client::~Client):
-        (WebCore::UserMessageHandlerDescriptor::create):
-        (WebCore::UserMessageHandlerDescriptor::client):
-        * page/UserMessageHandlerDescriptorTypes.h: Added.
-        * page/UserMessageHandlersNamespace.cpp: Added.
-        (WebCore::UserMessageHandlersNamespace::UserMessageHandlersNamespace):
-        (WebCore::UserMessageHandlersNamespace::~UserMessageHandlersNamespace):
-        (WebCore::UserMessageHandlersNamespace::handler):
-        * page/UserMessageHandlersNamespace.h: Added.
-        (WebCore::UserMessageHandlersNamespace::create):
-        * page/UserMessageHandlersNamespace.idl: Added.
-        * page/WebKitNamespace.cpp: Added.
-        (WebCore::WebKitNamespace::WebKitNamespace):
-        (WebCore::WebKitNamespace::~WebKitNamespace):
-        (WebCore::WebKitNamespace::messageHandlers):
-        * page/WebKitNamespace.h: Added.
-        (WebCore::WebKitNamespace::create):
-        * page/WebKitNamespace.idl: Added.
</del><ins>+            * platform/graphics/FontGlyphs.cpp:
+            (WebCore::shouldIgnoreRotation):
</ins><span class="cx"> 
</span><del>-2014-05-18  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r156546): Default media controls are laid out incorrectly when media element is styled with direction:rtl
-        https://bugs.webkit.org/show_bug.cgi?id=132531
-        &lt;rdar://problem/16806267&gt;
-        
-        Reviewed by Mark Rowe.
</del><ins>+        Merge r163465.
</ins><span class="cx"> 
</span><del>-        This was already tested by the media/video-rtl.htm reftest, now unskipped.
</del><ins>+    2014-02-04  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.css:
-        (audio::-webkit-media-controls-panel): Add missing direction: ltr
</del><ins>+            Move characterAt index checks from InlineIterator to RenderText
+            https://bugs.webkit.org/show_bug.cgi?id=128224
</ins><span class="cx"> 
</span><del>-2014-05-18  Rik Cabanier  &lt;cabanier@adobe.com&gt;
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        support for navigator.hardwareConcurrency
-        https://bugs.webkit.org/show_bug.cgi?id=132588
</del><ins>+            Move characterAt index checks from InlineIterator to RenderText
+            so that all RenderText calls are covered. Few safe instances are
+            now covered with uncheckedCharacterAt.
</ins><span class="cx"> 
</span><del>-        Reviewed by Filip Pizlo.
</del><ins>+            Merged from Blink:
+            http://src.chromium.org/viewvc/blink?view=revision&amp;revision=150830
</ins><span class="cx"> 
</span><del>-        Added a new API that returns the number of CPU cores up to 8.
</del><ins>+            Test: fast/text/character-at-crash.html
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/navigator-hardwareConcurrency.html
</del><ins>+            * rendering/InlineIterator.h:
+            (WebCore::InlineIterator::characterAt):
+            * rendering/RenderText.cpp:
+            (WebCore::RenderText::computePreferredLogicalWidths):
+            * rendering/RenderText.h:
+            (WebCore::RenderText::operator[]):
+            (WebCore::RenderText::uncheckedCharacterAt):
+            (WebCore::RenderText::characterAt):
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * page/Navigator.cpp:
-        (WebCore::Navigator::hardwareConcurrency):
-        * page/Navigator.h:
-        * page/Navigator.idl:
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-18  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        Merge r164933.
</ins><span class="cx"> 
</span><del>-        Fix iOS build.
</del><ins>+    2014-03-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Move UserContentController symbols to the right place.
</del><ins>+        Ensure keySplines is valid in SMIL animations
+        &lt;http://webkit.org/b/129547&gt;
+        &lt;rdar://problem/15676128&gt;
</ins><span class="cx"> 
</span><del>-2014-05-18  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Build fix for r169006.
</del><ins>+        Merged from Blink (patch by Philip Rogers):
+        https://src.chromium.org/viewvc/blink?revision=156452&amp;view=revision
+        http://crbug.com/276111
</ins><span class="cx"> 
</span><del>-        Unreviewed.
</del><ins>+            This patch fixes a crash in SMIL animations when keySplines are not
+            specified. The SMIL spec is clear on this:
+            http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncCalcMode
+            &quot;If there are any errors in the keyTimes specification (bad values,
+            too many or too few values), the animation will have no effect.&quot;
</ins><span class="cx"> 
</span><del>-        * loader/ResourceLoader.h: Return didCreateQuickLookHandle() to public.
</del><ins>+            This patch simply checks that keyTimes is not empty. Previously,
+            splinesCount was set to be m_keySplines.size() + 1 in
+            SVGAnimationElement.cpp; this patch changes splinesCount to be equal
+            to m_keySplines.size() to make the logic easier to follow and to
+            match other checks in SVGAnimationElement::startedActiveInterval.
</ins><span class="cx"> 
</span><del>-2014-05-18  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Test: svg/animations/animate-keysplines-crash.html
</ins><span class="cx"> 
</span><del>-        REGRESSION (r160259): text-combine glyphs are not rendered
-        https://bugs.webkit.org/show_bug.cgi?id=127324
</del><ins>+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
-        
-        The original text gets overwritten by a change that is supposed to affect rendered text only.
-        Fixed by giving the text update functions well-defined purposes.
</del><ins>+2014-03-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/text/text-combine-rendering.html
</del><ins>+        Unreviewed build fix after bad merge of r154146.
+        &lt;rdar://problem/16223155&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderCombineText.cpp:
-        (WebCore::RenderCombineText::styleDidChange):
-        (WebCore::RenderCombineText::setRenderedText):
-        (WebCore::RenderCombineText::combineText):
-        (WebCore::RenderCombineText::setTextInternal): Deleted.
-        * rendering/RenderCombineText.h:
-        * rendering/RenderCounter.cpp:
-        (WebCore::RenderCounter::computePreferredLogicalWidths):
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::setRenderedText):
-        
-            This function now updates the rendered text but does not change the original.
-            Get the original text by calling originalText().
</del><ins>+        Two files were ommitted from the prior commit.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderText::setText):
-        
-            This the only place original text now changes.
</del><ins>+        * platform/win/WebCoreBundleWin.cpp: Added.
+        (WebCore::createWebKitBundle):
+        (WebCore::webKitBundle):
+        * platform/win/WebCoreBundleWin.h: Added.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderText::setTextInternal): Deleted.
-        
-            Renamed to setRenderedText.
</del><ins>+2014-03-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderText.h:
-        * rendering/svg/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::setRenderedText):
-        (WebCore::RenderSVGInlineText::setTextInternal): Deleted.
-        * rendering/svg/RenderSVGInlineText.h:
</del><ins>+        Unreviewed build fix.
+        &lt;rdar://problem/16197002&gt;
</ins><span class="cx"> 
</span><del>-2014-05-17  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Exclude 64-bit assembly code when building
+        32-bit DebugSuffix target.
</ins><span class="cx"> 
</span><del>-        Don't attempt to update id or name for nodes that are already removed
-        https://bugs.webkit.org/show_bug.cgi?id=133041
</del><ins>+2014-02-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Unreviewed build fix.
+        &lt;rdar://problem/16197002&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/dom/remove-element-with-id-that-was-inserted-on-DOMNodeRemoved.html
-               fast/dom/remove-element-with-name-that-was-inserted-on-DOMNodeRemoved.html
</del><ins>+        * WebCore.vcxproj/WebCore.proj: Remove trailing
+        slash from path names, as this was causing multiple arguments
+        to be concatenated together (the whitespace was getting escaped
+        by the slash.)
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::removedFrom): Skip updating ids and names for an element not
-        in a treescope, as we already do for elements not in a document.
</del><ins>+2014-02-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-17  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Merge r164660
</ins><span class="cx"> 
</span><del>-        REGRESSION (NetworkProcess): Trying to use appcache fallback crashes in ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache
-        https://bugs.webkit.org/show_bug.cgi?id=133007
-        &lt;rdar://problem/13702706&gt;
</del><ins>+    2014-02-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        appcache tests often fail on the Mac WebKit2 bot
-        https://bugs.webkit.org/show_bug.cgi?id=82061
</del><ins>+            [Win] Gracefully recover from missing 'naturalSize' parameter for media
+            https://bugs.webkit.org/show_bug.cgi?id=129278
</ins><span class="cx"> 
</span><del>-        Reviewed by Maciej Stachowiak.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Covered by existing tests, which this patch enables.
</del><ins>+            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Add declaration for
+            missing function call.
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::createMetadataKeyNames):
+            (WebCore::MediaPlayerPrivateAVFoundationCF::assetStatus): Don't treat missing 'naturalSize'
+            as a fatal error.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged): Handle case of asset track
+            not being available yet.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::sizeChanged): If the 'naturalSize' is empty,
+            use the Player Item's 'presentationSize' instead.
+            (WebCore::AVFWrapper::processNotification): Add missing handler for duration changed.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export ResourceLoader::cancel(const ResourceError&amp;). It used
-        to be virtual, but marking subclasses final has resulted in the compiler calling
-        it directly from WebKitLegacy framework. Seeing that no subclass overrides it,
-        I then made it non-virtual.
-        Also export ApplicationCacheHost functions that are now used from WebKit2.
</del><ins>+2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/ResourceLoader.h: Made the class abstract (as I didn't realize at first
-        that it's always either a SubresourceLoader or a NetscapePlugInStreamLoader).
-        Made ResourceHandleClient functions private, as they should never be called other
-        than via a ResourceHandleClient pointer.
</del><ins>+        Merge r163579.
</ins><span class="cx"> 
</span><del>-        * loader/NetscapePlugInStreamLoader.h:
-        * loader/SubresourceLoader.h:
-        Marked these final.
</del><ins>+    2014-02-04  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/ResourceLoader.cpp: (WebCore::ResourceLoader::willSwitchToSubstituteResource):
-        Added a function to be called when switching to a substitute resource. We still
-        need a ResourceLoader at this point, as substitute resource will be delivered through
-        it, but we don't want it to continue its current load.
</del><ins>+            Make adoption agency use the task queue
+            https://bugs.webkit.org/show_bug.cgi?id=109445
</ins><span class="cx"> 
</span><del>-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache):
-        Call the ResourceLoader function instead of using handle, which is null when
-        using out of process networking.
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            Tests: fast/parser/adoption-agency-crash-01.html
+                   fast/parser/adoption-agency-crash-02.html
+                   fast/parser/adoption-agency-crash-03.html
</ins><span class="cx"> 
</span><del>-        We shouldn't make a ScrollingThread on iOS.
-        &lt;https://webkit.org/b/133038&gt;
-        &lt;rdar://problem/16947589&gt;
</del><ins>+            * html/parser/HTMLConstructionSite.cpp:
+            (WebCore::insert):
+            (WebCore::executeInsertTask):
+            (WebCore::executeReparentTask):
+            (WebCore::executeInsertAlreadyParsedChildTask):
+            (WebCore::executeTakeAllChildrenTask):
+            (WebCore::executeTask):
+            (WebCore::HTMLConstructionSite::attachLater):
+            (WebCore::HTMLConstructionSite::executeQueuedTasks):
+            (WebCore::HTMLConstructionSite::insertTextNode):
+            (WebCore::HTMLConstructionSite::reparent):
+            (WebCore::HTMLConstructionSite::insertAlreadyParsedChild):
+            (WebCore::HTMLConstructionSite::takeAllChildren):
+            (WebCore::HTMLConstructionSite::fosterParent):
+            * html/parser/HTMLConstructionSite.h:
+            (WebCore::HTMLConstructionSiteTask::HTMLConstructionSiteTask):
+            (WebCore::HTMLConstructionSiteTask::oldParent):
+            * html/parser/HTMLTreeBuilder.cpp:
+            (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
</ins><span class="cx"> 
</span><del>-        Don't call ScrollingThred::dispatch() from the pressure relief
-        code on iOS since that will end up instantiating a scrolling thread
-        which we'd otherwise never have.
</del><ins>+2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Merge r162820.
</ins><span class="cx"> 
</span><del>-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::releaseMemory):
</del><ins>+    2014-01-26  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-17  Piotr Grad  &lt;p.grad@samsung.com&gt;
</del><ins>+            Part 2: Assertion failure in WebCore::PseudoElement::didRecalcStyle()
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=126761&gt;
+            &lt;rdar://problem/15793540&gt;
</ins><span class="cx"> 
</span><del>-        Setting playback rate on video with media controller is not ignored.
-        https://bugs.webkit.org/show_bug.cgi?id=129048
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            * bindings/objc/DOM.mm:
+            (-[DOMElement image]):
+            (-[DOMElement _imageTIFFRepresentation]):
+            * platform/gtk/PasteboardGtk.cpp:
+            (WebCore::Pasteboard::writeImage):
+            * platform/win/PasteboardWin.cpp:
+            (WebCore::Pasteboard::writeImage):
+            (WebCore::getCachedImage):
+            * rendering/HitTestResult.cpp:
+            (WebCore::HitTestResult::image):
+            - More places where toRenderImage() should be used instead of
+              toImage().
+            - Fixed last two places where static_cast&lt;WebCore::RenderImage*&gt;
+              was being used instead of toRenderImage().
</ins><span class="cx"> 
</span><del>-        Replaced queries for m_playbackRate with effectivePlaybackRate()
-        which includes media controller playback rate.
</del><ins>+2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: media/video-controller-child-rate.html
</del><ins>+        Merge r162679.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        * html/HTMLMediaElement.h:
</del><ins>+    2014-01-23  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-16  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+            Assertion failure in WebCore::PseudoElement::didRecalcStyle()
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=126761&gt;
+            &lt;rdar://problem/15793540&gt;
</ins><span class="cx"> 
</span><del>-        Expose WKUserScript as API
-        https://bugs.webkit.org/show_bug.cgi?id=133017
-        &lt;rdar://problem/16948059&gt;
</del><ins>+            Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            Test: fast/images/animate-list-item-image-assertion.html
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Export symbols.
</del><ins>+            * dom/PseudoElement.cpp:
+            (WebCore::PseudoElement::didRecalcStyle):
+            Check isRenderImage() rather than isImage() before casting to
+            RenderImage.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        Change UserContentController.h to be a private header.
</del><ins>+            * editing/ios/EditorIOS.mm:
+            (WebCore::getImage):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Set m_userContentController from the page configuration and add it if it's not null.
</del><ins>+            * editing/mac/EditorMac.mm:
+            (WebCore::getImage):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        * page/Page.h:
-        Add UserContentController to PageClients.
</del><ins>+            * html/HTMLImageElement.cpp:
+            (WebCore::HTMLImageElement::parseAttribute):
+            (WebCore::HTMLImageElement::didAttachRenderers):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addPage):
-        Only try to add a user content controller if the page doesn't already have one.
</del><ins>+            * loader/ImageLoader.cpp:
+            (WebCore::ImageLoader::renderImageResource):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        (WebCore::PageGroup::removePage):
-        Only try to remove the user content controller if it's the group one.
</del><ins>+            * page/DragController.cpp:
+            (WebCore::getCachedImage):
+            Ditto.
</ins><span class="cx"> 
</span><del>-2014-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
+            (WebCore::RenderLayerBacking::updateImageContents):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r166422): All RenderBox objects grew 104 bytes from adding repaint timers.
-        &lt;https://webkit.org/b/133027&gt;
-        &lt;rdar://problem/16867410&gt;
</del><ins>+2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Instead of storing a rarely-used repaint timer on every RenderBox, store one
-        on the RenderView, and keep a hash set of renderers needing repaint.
</del><ins>+        Merge r161925.
</ins><span class="cx"> 
</span><del>-        Renderers get a flag tracking whether they have a pending lazy repaint.
-        This way we can avoid hash lookups in the common case.
</del><ins>+    2014-01-13  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Also added a static assertion to catch RenderBox growing in the future.
</del><ins>+            Highlighting password field then making a Sticky Note via Safari Services exposes password
+            https://bugs.webkit.org/show_bug.cgi?id=126946
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::SameSizeAsRenderBox::~SameSizeAsRenderBox):
-        (WebCore::RenderBox::RenderBox):
-        (WebCore::RenderBox::~RenderBox):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::layoutOverflowRectForPropagation):
-        * rendering/RenderBox.h:
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::RenderElement):
-        * rendering/RenderElement.h:
-        (WebCore::RenderElement::setRenderBoxNeedsLazyRepaint):
-        (WebCore::RenderElement::renderBoxNeedsLazyRepaint):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::RenderView):
-        (WebCore::RenderView::scheduleLazyRepaint):
-        (WebCore::RenderView::unscheduleLazyRepaint):
-        (WebCore::RenderView::lazyRepaintTimerFired):
-        * rendering/RenderView.h:
</del><ins>+            Using the Services menu has a slightly different codepath than Editor::copy() does. This
+            patch duplicates the canCopy() check that Editor::copy() does.
</ins><span class="cx"> 
</span><del>-2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Testing is not possible because the Services menu is not accessible to our tests.
</ins><span class="cx"> 
</span><del>-        [Mac][MSE] setCurrentTime() goes down fastSeek path in MediaPlayerPrivateMediaSourceAVFObjC.
-        https://bugs.webkit.org/show_bug.cgi?id=133023
</del><ins>+            * editing/mac/EditorMac.mm:
+            (WebCore::Editor::stringSelectionForPasteboard):
+            (WebCore::Editor::stringSelectionForPasteboardWithImageAltText):
+            (WebCore::Editor::dataSelectionForPasteboard):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When seeking a MSE video, do not go down the fastSeekForMediaTime() path if the
-        seek resulted from a setCurrentTime() call. The logic can lead to attempted seeks
-        before buffered ranges.
</del><ins>+        Merge r158739.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekInternal):
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        (WebCore::MediaSourcePrivateAVFObjC::seekToTime):
</del><ins>+    2013-11-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-05-16  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+            Notify nodes removal to Range/Selection after dispatching blur and mutation event
+            https://bugs.webkit.org/show_bug.cgi?id=123880
</ins><span class="cx"> 
</span><del>-        [iOS] ScrollView::visibleContentRectInternal is bypassing the iOS code for unobscuredContentRect
-        https://bugs.webkit.org/show_bug.cgi?id=133008
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/b60576a0560d14f8757e58d55d37b7cefa48a6ac
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::visibleContentRectInternal):
-        ScrollView::visibleContentRectInternal() was calling the internal implementation of visibleContentRect().
-        That was skipping the iOS implementation and getting the framerect directly. That size is invalid on iOS
-        when the exposed rect and unobscured rect are not the same.
</del><ins>+            In willRemoveChildren in ContainerNode.cpp, call Document::nodeChildrenWillBeRemoved after instead of
+            before dispatching mutation events because we need to update ranges created by those mutation event
+            listeners. willRemoveChild was fixed in r115686.
</ins><span class="cx"> 
</span><del>-2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Tests: editing/selection/selection-change-in-blur-event-by-remove-children.html
+                   editing/selection/selection-change-in-mutation-event-by-remove-children.html
+                   fast/dom/Range/range-created-during-remove-children.html
</ins><span class="cx"> 
</span><del>-        [Mac] naturalSize not updated when preload=metadata
-        https://bugs.webkit.org/show_bug.cgi?id=132994
</del><ins>+            * dom/ContainerNode.cpp:
+            (WebCore::willRemoveChildren):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: media/video-load-preload-metadata-naturalsize.html
</del><ins>+        Merge r158719.
</ins><span class="cx"> 
</span><del>-        When preload=metadata, we never create an AVPlayerItem, and therefore never receive a
-        presentationSize KVO. When an AVAsset informs us that its tracks have changed, and there
-        is no AVPlayerItem, recalculate presentation size based on the first video track's natural
-        size.
</del><ins>+    2013-11-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekInternal):
</del><ins>+            Protect DOM nodes in IndentOutdentCommand::tryIndentingAsListItem()
+            https://bugs.webkit.org/show_bug.cgi?id=123861
</ins><span class="cx"> 
</span><del>-2014-05-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Remove &quot;region-based columns&quot; prefs
-        https://bugs.webkit.org/show_bug.cgi?id=133006
-        &lt;rdar://problem/16945824&gt;
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/297442eb539a2b764fdad323de79099a70179186 partially.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dave Hyatt.
</del><ins>+            * editing/IndentOutdentCommand.cpp:
+            (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Make selectedListItem, previousList, and nextList
+            RefPtr since they're are used after calling insertNodeBefore.
</ins><span class="cx"> 
</span><del>-        Remove &quot;region-based columns&quot; prefs and related code, since this is only
-        way to render columns now.
</del><ins>+2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/Settings.in:
</del><ins>+        Merge r158058.
</ins><span class="cx"> 
</span><del>-2014-05-16  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+    2013-10-25  Mark Lam  &lt;mark.lam@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Link search area for touch events is too large in some cases
-        https://bugs.webkit.org/show_bug.cgi?id=132988
-        &lt;rdar://problem/16917843&gt;
</del><ins>+            DatabaseManager's ProposedDatabases need to be thread-safe.
+            https://bugs.webkit.org/show_bug.cgi?id=123313.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * page/ios/FrameIOS.mm:
-        (WebCore::Frame::qualifyingNodeAtViewportLocation):
-        
-            - Adjust the search area to screen ppi.
-            - Remove cut-off at scale 1. This made us pick physically far-away elements when zoomed in.
-            
-        * platform/PlatformScreen.h:
-        * platform/ios/PlatformScreenIOS.mm:
-        (WebCore::mobileGestaltFloatValue):
-        (WebCore::screenPPIFactor):
</del><ins>+            No new tests.
</ins><span class="cx"> 
</span><del>-            Figure out screens physical PPI relative to a base.
</del><ins>+            * Modules/webdatabase/DatabaseManager.cpp:
+            (WebCore::DatabaseManager::DatabaseManager):
+            (WebCore::DatabaseManager::existingDatabaseContextFor):
+            (WebCore::DatabaseManager::registerDatabaseContext):
+            (WebCore::DatabaseManager::unregisterDatabaseContext):
+            (WebCore::DatabaseManager::didConstructDatabaseContext):
+            (WebCore::DatabaseManager::didDestructDatabaseContext):
+            (WebCore::DatabaseManager::openDatabaseBackend):
+            (WebCore::DatabaseManager::addProposedDatabase):
+            (WebCore::DatabaseManager::removeProposedDatabase):
+            (WebCore::DatabaseManager::fullPathForDatabase):
+            (WebCore::DatabaseManager::detailsForNameAndOrigin):
+            * Modules/webdatabase/DatabaseManager.h:
</ins><span class="cx"> 
</span><del>-2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [MSE] Crash at  WebCore::SourceBuffer::~SourceBuffer + 110
-        https://bugs.webkit.org/show_bug.cgi?id=132973
</del><ins>+        Merge r162486
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+    2014-01-21  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Change SourceBuffer::m_private into a Ref&lt;&gt;, and add an assertion to
-        SourceBufferPrivateAVFObjC's destructor if its client has not been cleared.
</del><ins>+            REGRESSION (r161580): Some PDFs render outside their &lt;img&gt;
+            https://bugs.webkit.org/show_bug.cgi?id=127381
+            &lt;rdar://problem/15872168&gt;
</ins><span class="cx"> 
</span><del>-        Eliminate unnecessary churn in MediaSourcePrivateAVFObjC by having the predicate
-        functor take bare pointers, rather than a PassRefPtr.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        The underlying problem seems to be in WebAVStreamDataParserListener. RefPtrs were
-        being created off the main thread to a non-thread safe ref counted class. In some
-        situations, this would result in double decrementing the ref, which would cause an
-        early destruction of the underlying object. Instead replace these RefPtr strong
-        pointers with explicit weak ones. Ensure the parser and its delegate are not freed
-        before the append operation completes by passing strong pointers into the async
-        append operation lambda.
</del><ins>+            * platform/graphics/cg/PDFDocumentImage.cpp:
+            (WebCore::transformContextForPainting):
+            Only try to make the scale uniform if it isn't already, and use the minimum
+            of the two original scales when doing so, so that it is absolutely certain
+            to fit inside space allocated for the image during layout.
</ins><span class="cx"> 
</span><del>-        There were a few places where we weren't null checking m_mediaSource before using it,
-        and at least one place where we weren't clearing m_mediaSource.
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::SourceBuffer): Use Ref instead of RefPtr.
-        (WebCore::SourceBuffer::appendBufferTimerFired): Ditto.
-        * Modules/mediasource/SourceBuffer.h:
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        (WebCore::MediaSourcePrivateAVFObjCHasAudio): Take a bare pointer, instead of a PassRefPtr.
-        (WebCore::MediaSourcePrivateAVFObjCHasVideo): Ditto.
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        (WebCore::MediaSourcePrivateAVFObjC::removeSourceBuffer): Clear the back pointer when removing a buffer.
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        (-[WebAVStreamDataParserListener initWithParser:parent:WebCore::]): Use WeakPtr instead of RefPtr.
-        (-[WebAVStreamDataParserListener invalidate]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]): Ditto.
-        (WebCore::SourceBufferPrivateAVFObjC::~SourceBufferPrivateAVFObjC):
-        (WebCore::SourceBufferPrivateAVFObjC::append): Ditto.
</del><ins>+        Merge r158870
</ins><span class="cx"> 
</span><del>-2014-05-16  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+    2013-11-07  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Push named flows in region to device pixel when painting.
-        https://bugs.webkit.org/show_bug.cgi?id=132986
</del><ins>+            Crash in HTMLMediaElement::contextDestroyed
+            https://bugs.webkit.org/show_bug.cgi?id=123963
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Remove integral rounding when named flow sets the painting offset on the graphics context.
-        Use device pixel snapping instead to ensure that we can paint on odd device pixel positions on retina displays. 
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/177999cdb34b707465670f0feff723922939f278
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/hidpi-region-with-auto-margin-on-subpixel-position.html
</del><ins>+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::~HTMLMediaElement):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-16  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Merge r154036
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Add ASSERT to make sure using the flowThread cache does not return incorrect results
-        https://bugs.webkit.org/show_bug.cgi?id=132906
</del><ins>+    2013-08-12  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Fix orphan needsLayout state in RenderTextControlSingleLine
+            https://bugs.webkit.org/show_bug.cgi?id=119726
</ins><span class="cx"> 
</span><del>-        If flowThreadContainingBlock() is called on an object which is in a different
-        flow thread than the one currently being laid out, this method will return an incorrect
-        result. I added an assertion for that to make sure we catch and treat any such scenarios.
-        For the moment, this assertion is only validated for regions, as multicol still has some issues.
</del><ins>+            Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        No new tests required.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/c0aec52ef348b2be0c882f8646fe3cf537831f59
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::locateFlowThreadContainingBlockNoCache):
-        (WebCore::RenderObject::locateFlowThreadContainingBlock):
-        * rendering/RenderObject.h:
</del><ins>+            We should mark the renderer for containerElement, which wraps innerTextElement and innerBlockElement
+            in cases of input[type=search] and input[type=number], dirty.
</ins><span class="cx"> 
</span><del>-2014-05-16  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+            * rendering/RenderTextControlSingleLine.cpp:
+            (WebCore::setNeedsLayoutOnAncestors):
+            (WebCore::RenderTextControlSingleLine::layout):
</ins><span class="cx"> 
</span><del>-        MemoryCache::addImageToCache should return the result of add().
-        https://bugs.webkit.org/show_bug.cgi?id=132928
-        &lt;rdar://problem/16651547&gt;
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        Merge r156082
</ins><span class="cx"> 
</span><del>-        API test: WebKit1.MemoryCacheADdImageToCache (MemoryCacheAddImageToCacheIOS.mm)
</del><ins>+    2013-09-18  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/cache/MemoryCache.cpp:
-        (WebCore::MemoryCache::addImageToCache):
</del><ins>+            [CSSRegions] Failed to retrieve named flow ranges for content with inline svg
+            https://bugs.webkit.org/show_bug.cgi?id=121489
</ins><span class="cx"> 
</span><del>-2014-05-16  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Reduce the RenderRegion invasiveness in rendering code
-        https://bugs.webkit.org/show_bug.cgi?id=132121
</del><ins>+            The inline SVG element behaves like a replaced element in HTML context. When computing the ranges
+            that are displayed inside a region for a named flow that contains an inline SVG element, we have
+            to treat the SVG as a replaced and run the checks only for the SVG root element, skipping the
+            other SVG elements inside.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Test: fast/regions/get-region-flow-ranges-inline-svg.html
</ins><span class="cx"> 
</span><del>-        Remove the RenderRegion / RenderNamedFlowFragment parameters and fields from
-        the painting / hit testing data structures and use a stateful approach to
-        correctly handle regions.
</del><ins>+            * rendering/RenderNamedFlowThread.cpp:
+            (WebCore::nextNodeInsideContentNode): Add function to retrieve the next node in traversal
+            under the contentNode subtree that should be used for getRanges inspection.
+            (WebCore::RenderNamedFlowThread::getRanges): Replace NodeTravesal::next with nextNodeInsideContentNode.
</ins><span class="cx"> 
</span><del>-        When painting or hit testing, the current flow thread is saved along the current
-        region. They are accessed through the |currentRenderNamedFlowFragment| helper
-        method on RenderObject or RenderLayer.
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The patch also changes a bunch of 0s to nullptrs.
</del><ins>+        Merge r153507
</ins><span class="cx"> 
</span><del>-        Tests: No new tests, no functional change.
</del><ins>+    2013-07-30  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
-        * rendering/HitTestLocation.cpp:
-        (WebCore::HitTestLocation::HitTestLocation):
-        (WebCore::HitTestLocation::operator=):
-        * rendering/HitTestLocation.h:
-        (WebCore::HitTestLocation::region): Deleted.
-        * rendering/HitTestResult.h:
-        * rendering/PaintInfo.h:
-        (WebCore::PaintInfo::PaintInfo):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::paintObject):
-        (WebCore::RenderBlock::selectionGaps):
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::nodeAtPoint):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::pushContentsClip):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paint):
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::paintLayerContents):
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
-        (WebCore::RenderLayer::collectFragments):
-        (WebCore::RenderLayer::updatePaintingInfoForFragments):
-        (WebCore::RenderLayer::paintTransformedLayerIntoFragments):
-        (WebCore::RenderLayer::paintBackgroundForFragments):
-        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
-        (WebCore::RenderLayer::paintOutlineForFragments):
-        (WebCore::RenderLayer::paintMaskForFragments):
-        (WebCore::RenderLayer::hitTest):
-        (WebCore::RenderLayer::hitTestFixedLayersInNamedFlows):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::hitTestTransformedLayerInFragments):
-        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::addToOverlapMap):
-        (WebCore::RenderLayerCompositor::clippedByAncestor):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::currentRenderNamedFlowFragment):
-        * rendering/RenderObject.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::nodeAtPoint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::nodeAtPoint):
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::writeLayers):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::paint):
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::paintReplaced):
</del><ins>+            Don't post accessibility notification on object in detached document.
+            https://bugs.webkit.org/show_bug.cgi?id=119286
</ins><span class="cx"> 
</span><del>-2014-05-16  Kiran  &lt;kiran.guduru@samsung.com&gt;
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        RTCDtmfSender default values need to be updated.
-        https://bugs.webkit.org/show_bug.cgi?id=132952
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/ef9fc9e70202dcf33e5cf2f0f0a2135945ffe17e%5E%21/#F0
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Don't post accessibility notification on object in detached document.
</ins><span class="cx"> 
</span><del>-        The default ToneDuration and ToneGap values are modified in the updated spec.
-        So these values need to be updated.
</del><ins>+            This can happen if an accessibility notification is queued on a node,
+            then that node is reparented to a different document that's not attached
+            anywhere before the accessibility notification is fired.
</ins><span class="cx"> 
</span><del>-        Test: fast/mediastream/RTCPeerConnection-dtmf.html.
</del><ins>+            * accessibility/AXObjectCache.cpp:
+            (WebCore::AXObjectCache::notificationPostTimerFired):
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/RTCDTMFSender.cpp:
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Merge r158676
</ins><span class="cx"> 
</span><del>-        Attempt to fix the Apple Mavericks Release, Apple MountainLion Release,
-        Apple MountainLion Release (32-bit Build), EFL, and GTK builds following
-        &lt;http://trac.webkit.org/changeset/168921&gt; (https://bugs.webkit.org/show_bug.cgi?id=132669)
</del><ins>+    2013-11-05  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp: Include SVGElement.h for the definition of Node::hasTagName(const SVGQualifiedName&amp;).
</del><ins>+            XSSAuditor should catch reflected srcdoc properties even without a &lt;frame&gt; tag injection
</ins><span class="cx"> 
</span><del>-2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+            From Blink r160615 by &lt;tsepez@chromium.org&gt;
+            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=160615
</ins><span class="cx"> 
</span><del>-        ASSERT_NOT_REACHED() in DocumentOrderedMap::get() when removing SVG subtree
-        https://bugs.webkit.org/show_bug.cgi?id=132669
-        &lt;rdar://problem/14931432&gt;
</del><ins>+            Test: http/tests/security/xssAuditor/iframe-srcdoc-property-blocked.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham and Ryosuke Niwa.
</del><ins>+            * html/parser/XSSAuditor.cpp:
+            (WebCore::XSSAuditor::filterIframeToken):
</ins><span class="cx"> 
</span><del>-        Fixes an assertion failure when removing an SVG element with a duplicate id.
</del><ins>+2014-02-05  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When removing an SVG element with id A we synchronously instruct each element that references A
-        to find the first element with id A, call this N, from the document root and register itself to
-        either receive subsequent notifications from N (say, there is another element with id A) or as
-        waiting for an element with id A (say, N = nullptr; =&gt; we removed the last element with id A from
-        the document). Because the elements that reference A perform this operation synchronously when
-        removing an element they consult an transient state of the DocumentOrderedMap when querying for the
-        element with id A.
-    
-        Without loss of generality, let E, E_1, E_2, and E_3 be elements, where E_1, E_2, E_3 are children
-        of E in that order and E_1.id = E_2.id = A and E_3.href = #A (that is, it references an element
-        with id A). Suppose we remove E then we remove E_1, update DocumentOrderedMap to decrement its count
-        for id A, and notify E_3 to look for an element with id A. This leads to an assertion failure since
-        DocumentOrderedMap expects to find an element with id A, E_2, but cannot find such an element when
-        traversing from the document root because E was unlinked from the document root (i.e. E_2 is in a
-        disjoint subtree).
</del><ins>+        Merge r154146, r155828, r156145
</ins><span class="cx"> 
</span><del>-        Tests: svg/custom/change-id-of-use-during-removal.html
-               svg/custom/remove-subtree-including-path-with-duplicate-id-referenced-by-later-textpath.html
-               svg/custom/remove-subtree-including-text-with-duplicate-id-referenced-by-later-tref.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-earlier-use.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-animate.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-feimage.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-mpath.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-use.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-use2.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-use-in-different-subtree.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-use-with-duplicate-id-in-different-subtree.html
-               svg/custom/remove-use-with-duplicate-id-referenced-by-later-use.html
</del><ins>+    2013-08-15  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::removeChild): Call SVGDocumentExtensions::rebuildElements() after we remove
-        a DOM subtree so that applicable SVG elements can update their referenced element when the DocumentOrderedMap
-        is in a stable-state.
-        (WebCore::ContainerNode::removeChildren): Ditto.
-        * svg/SVGDocumentExtensions.cpp:
-        (WebCore::SVGDocumentExtensions::rebuildElements): Added; notifies SVG elements that their href attribute
-        changed so that they query the DocumentOrderedMap for the element they reference by id in their href attribute.
-        (WebCore::SVGDocumentExtensions::clearTargetDependencies): Added; Called from removing
-        an SVG element S from the DOM. Appends all elements that reference the id of S to the end of a Vector of
-        elements to be rebuilt (when SVGDocumentExtensions::rebuildElements() is called) and notifies these elements
-        that have been marked to be rebuilt so that they can invalidate their state (e.g. stop animating).
-        (WebCore::SVGDocumentExtensions::rebuildAllElementReferencesForTarget): Changed to take its argument by reference
-        (since it's always non-null) and simplified logic to synchronously notify SVG updates that their referenced element
-        may have changed. Calling SVGElement::svgAttributeChanged() on an element E should at most remove the dependencies
-        of E.
-        * svg/SVGDocumentExtensions.h:
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::~SVGElement): Substitute &quot;*this&quot; for &quot;this&quot; as SVGDocumentExtensions::rebuildAllElementReferencesForTarget()
-        now takes a reference instead of a pointer.
-        (WebCore::SVGElement::removedFrom): Modified to call SVGDocumentExtensions::clearTargetDependencies().
-        (WebCore::SVGElement::attributeChanged): Substitute &quot;*this&quot; for &quot;this&quot; as SVGDocumentExtensions::rebuildAllElementReferencesForTarget()
-        now takes a reference instead of a pointer.
-        * svg/SVGElement.h:
-        (WebCore::SVGElement::callClearTarget): Added; calls through to private virtual SVGElement::clearTarget().
-        (WebCore::SVGElement::clearTarget): Added.
-        * svg/SVGTRefElement.cpp:
-        (WebCore::SVGTRefElement::clearTarget): Added.
-        * svg/SVGTRefElement.h:
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::SVGSMILElement::clearTarget): Added.
-        * svg/animation/SVGSMILElement.h:
</del><ins>+            [Windows] Consolidate WebKit Bundle Handling 
+            https://bugs.webkit.org/show_bug.cgi?id=119869 
</ins><span class="cx"> 
</span><del>-2014-05-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Tim Horton. 
</ins><span class="cx"> 
</span><del>-        [iOS WK2] When zoomed, fixed elements jump at the start of a scroll, and jump back at the end.
-        https://bugs.webkit.org/show_bug.cgi?id=132978
-        &lt;rdar://problem/16894428&gt;
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add new WebCoreBundleWin files. 
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto. 
+            * platform/network/curl/ResourceHandleManager.cpp: 
+            (WebCore::certificatePath): Use correct bundle handling logic. 
+            * platform/win/LocalizedStringsWin.cpp: Move bundle implementation to 
+            new WebCoreBundleWin.cpp file. 
+            * platform/win/WebCoreBundleWin.cpp: Added. 
+            (WebCore::createWebKitBundle): 
+            (WebCore::webKitBundle): 
+            * platform/win/WebCoreBundleWin.h: Added. 
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+2014-02-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This was the actual cause of the bug; r168560 changed the rect passed in here
-        to be the customFixedPositionRect rather than the unobscured rect, but we
-        used it to call FrameView::rectForViewportConstrainedObjects() which gave back
-        another bogus rect. So just use the rect passed in.
</del><ins>+        Build fix after last branch merge.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::updateLayersAfterViewportChange):
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Correct bad merge of media build steps.
</ins><span class="cx"> 
</span><del>-2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+2014-02-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        SVG element may reference arbitrary DOM element before running its insertion logic
-        https://bugs.webkit.org/show_bug.cgi?id=132757
-        &lt;rdar://problem/15703817&gt;
</del><ins>+        Unreviewed build fix after r162860.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        * platform/graphics/MediaPlayer.cpp: Prevent 64-bit build from using QuickTime SDK.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp: Ditto.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h: Ditto.
</ins><span class="cx"> 
</span><del>-        Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
-        inserted in the tree.
</del><ins>+2014-01-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
-        element B it references (if any). If A is inserted before B and B has the same id as a later element in
-        the document then A can find B before B is notified that its been inserted into the document (i.e. before
-        Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
-        cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
-        processed their insertion-specific logic.
</del><ins>+        Merge r162723.
</ins><span class="cx"> 
</span><del>-        Tests: svg/custom/reparent-animate-element.html
-               svg/custom/reparent-feimage-element.html
-               svg/custom/reparent-mpath-element.html
-               svg/custom/reparent-textpath-element.html
-               svg/custom/reparent-tref-element.html
-               svg/custom/reparent-use-element.html
</del><ins>+    2014-01-24  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
-        * svg/SVGFEImageElement.h:
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
-        * svg/SVGMPathElement.h:
-        * svg/SVGTRefElement.cpp:
-        (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
-        * svg/SVGTRefElement.h:
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
-        * svg/SVGTextPathElement.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
-        inserted.
-        (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
-        * svg/SVGUseElement.h:
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
-        * svg/animation/SVGSMILElement.h:
</del><ins>+            [Win] Convert some NMake files to MSBuild project files 
+            https://bugs.webkit.org/show_bug.cgi?id=127579 
</ins><span class="cx"> 
</span><del>-2014-05-15  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        JSDOMWindow should not claim HasImpureGetOwnPropertySlot
-        https://bugs.webkit.org/show_bug.cgi?id=132918
</del><ins>+            * WebCore.vcxproj/WebCore.make: Removed.
+            * WebCore.vcxproj/WebCore.proj: Added.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2014-01-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: js/cached-window-properties.html
-               js/cached-window-prototype-properties.html
</del><ins>+        Unreviewed build fix after r162631.
</ins><span class="cx"> 
</span><del>-        We now correctly handle the impurity of JSDOMWindow's custom getOwnPropertySlot without needing the 
-        blanket HasImpureGetOwnPropertySlot. We do this through the use of watchpoints and by explicitly forbidding
-        any caching beyond a certain point using PropertySlot::disableCaching. Getting rid of this flag will allow 
-        us to cache many properties/methods on both the JSDOMWindow and its prototype, which are very commonly used 
-        across the web.
</del><ins>+        * WebCore.vcxproj/WebCore.submit.sln: Do not build QTMovieWin for 64-bit architecture.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertySlot):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (HasComplexGetOwnProperty):
-        (InterfaceRequiresAttributesOnInstance):
-        (InstanceOverridesGetOwnPropertySlot):
-        (GenerateHeader):
</del><ins>+2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-15  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Merge r154470.
</ins><span class="cx"> 
</span><del>-        NetworkProcess crashes at ResourceHandle::continueDidReceiveResponse
-        https://bugs.webkit.org/show_bug.cgi?id=132966
-        &lt;rdar://problem/16373694&gt;
</del><ins>+    2013-08-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+            compositing/geometry/bounds-ignores-hidden-dynamic.html has incorrect initial rendering
+            https://bugs.webkit.org/show_bug.cgi?id=119825
</ins><span class="cx"> 
</span><del>-        Covered by many fast/files tests.
</del><ins>+            Reviewed by Tim Horton.
+            
+            r137526 and some earlier commits attempted to avoid unconditionally
+            repainting layers when their size changes, because this was causing
+            TiledBacking layers to repaint when the document size changed.
+            
+            However, the approach required that we have good information about
+            whether size changes require a repaint, which in some cases is hard
+            to determine, especially when RenderLayer changes affect our
+            decisions about which layers are composited.
+            
+            Fix by pushing the decision about whether to repaint on size change
+            into GraphicsLayer. The default is to repaint on size change,
+            but GraphicsLayer provides a function that can be overridden to
+            modify this behavior; GraphicsLayerCA does so to avoid repaints
+            when layers with TiledBackings get resized.
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobResourceHandle.cpp: (WebCore::BlobResourceHandle::continueDidReceiveResponse):
-        * platform/network/BlobResourceHandle.h:
-        * platform/network/ResourceHandle.h:
-        Don't call delegate's continueDidReceiveResponse when loading a blob:// URL,
-        the delegate is null. On the Mac, we used to lazily create it, which was also wrong,
-        but at least not observable.
</del><ins>+            Test: compositing/repaint/repaint-on-layer-grouping-change.html
</ins><span class="cx"> 
</span><del>-2014-05-15  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            * WebCore.exp.in: WebKit2 needs GraphicsLayer::setSize, which is no longer inline.
+            * platform/graphics/GraphicsLayer.cpp:
+            (WebCore::GraphicsLayer::setOffsetFromRenderer):
+            (WebCore::GraphicsLayer::setSize):
+            * platform/graphics/GraphicsLayer.h:
+            (WebCore::GraphicsLayer::shouldRepaintOnSizeChange):
+            * platform/graphics/ca/GraphicsLayerCA.cpp:
+            (WebCore::GraphicsLayerCA::shouldRepaintOnSizeChange):
+            * platform/graphics/ca/GraphicsLayerCA.h:
+            * rendering/RenderLayerBacking.h: No longer need m_boundsConstrainedByClipping
+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::RenderLayerBacking):
+            (WebCore::RenderLayerBacking::updateCompositedBounds):
+            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): setSize takes
+            care of repainting for us now, so we can remove all the conditional code.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168899.
-        https://bugs.webkit.org/show_bug.cgi?id=132965
</del><ins>+2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Broke some compositing regions tests on Mavericks (Requested
-        by mihnea___ on #webkit).
</del><ins>+        Unreviewed build fix after last commit. We haven't completely removed
+        QTMovieWin uses.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Build for 32-bit.
+        * WebCore.vcxproj/WebCore.submit.sln: Build QTMovieWin for 32-bit.
</ins><span class="cx"> 
</span><del>-        &quot;[CSS Regions] Reduce the RenderRegion invasiveness in
-        rendering code&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132121
-        http://trac.webkit.org/changeset/168899
</del><ins>+2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-15  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Merge r162621
</ins><span class="cx"> 
</span><del>-        Add pointer lock to features without enabling it.
-        https://bugs.webkit.org/show_bug.cgi?id=132961
</del><ins>+    2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            [Win] Update project and solution files for 64-bit builds
+            https://bugs.webkit.org/show_bug.cgi?id=127457
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        Added ENABLE_POINTER_LOCK to list of features.
-        * WebCore.exp.in:
-        Added linker symbols which differ with pointer lock enabled.
-        * WebCore.xcodeproj/project.pbxproj:
-        Added PointerLockController.cpp to build.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-15  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+            * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Specify v100 target
+            * WebCore.vcxproj/WebCore.submit.sln: Add x64 targets
+            * WebCore.vcxproj/WebCore.vcxproj: Specify v100 target for all builds
+            on this branch. Also exclude 32-bit specific assembly when building
+            64-bit target, and correct bad merge from branch.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Correct branch merge
+            * config.h: Handle 64-bit type definitions.
+            * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+            (PlatformCAAnimation::setFromValue): Use CGFloat to support 64-bit builds
+            (PlatformCAAnimation::setToValue): Ditto
+            (PlatformCAAnimation::setValues): Ditto
+            * platform/graphics/win/FontCustomPlatformData.cpp:
+            (WebCore::FontCustomPlatformData::fontPlatformData): Add cast to
+            support 32- and 64-bit targets.
+            * platform/graphics/win/GraphicsContextCGWin.cpp:
+            (WebCore::GraphicsContext::drawLineForDocumentMarker): Use CGFloat to
+            support 64-bit builds.
+            * platform/win/PasteboardWin.cpp:
+            (WebCore::Pasteboard::writeURLToDataObject): Specialize std::min to
+            work on 32- and 64-bit code.
+            (WebCore::createGlobalImageFileDescriptor): Ditto
+            * platform/win/StructuredExceptionHandlerSuppressor.cpp:
+            (WebCore::StructuredExceptionHandlerSuppressor::StructuredExceptionHandlerSuppressor):
+            Comment out 32-bit inline assembly.
+            (WebCore::StructuredExceptionHandlerSuppressor::~StructuredExceptionHandlerSuppressor):
+            Ditto
</ins><span class="cx"> 
</span><del>-        Move subframe name getter lookup later in JSDOMWindow::getOwnPropertySlot
-        https://bugs.webkit.org/show_bug.cgi?id=132922
</del><ins>+2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Unreviewed build fix for branch.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Correct merged files.
+        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
+        * platform/graphics/cg/GraphicsContextCG.cpp: Remove work-around implementation (from branch)
+        now that WKSI provides the method.
</ins><span class="cx"> 
</span><del>-        In JSDOMWindow::getOwnPropertySlot, we currently look for the property on the JSDOMWindow, 
-        then we search the window's subframes for name getters, then we look in the window's prototype 
-        chain. Apparently we were doing the lookup in this order to be compatible with Mozilla, but 
-        Mozilla no longer implements this behavior. Instead, they do the lookup on the prototype before 
-        looking for subframe name getters. We should change this to match Mozilla. This has the convenient 
-        side effect of allowing us to cache lookups in the window's prototype chain.
</del><ins>+2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertySlot):
</del><ins>+        Merge r154526
</ins><span class="cx"> 
</span><del>-2014-05-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+    2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [UI-side compositing] Fix copying animations between layers, and pausing them
-        https://bugs.webkit.org/show_bug.cgi?id=132943
-        &lt;rdar://problem/16906369&amp;16906541&gt;
</del><ins>+            [Windows] Unreviewed build correction. Need to force environment variable
+            to be escaped when running nmake command.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            * WebCore.vcxproj/WebCoreGenerated.make:
</ins><span class="cx"> 
</span><del>-        Pass the animation key back to animationStarted(), though this isn't used
-        when animations are running in-process.
</del><ins>+2014-01-09  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/PlatformCALayer.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (-[WebAnimationDelegate animationDidStart:]):
-        (PlatformCALayerMac::animationStarted):
-        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
-        (PlatformCALayerWin::animationStarted):
-        * platform/graphics/ca/win/PlatformCALayerWin.h:
</del><ins>+        Merge r161568: &lt;rdar://problem/15784802&gt;
</ins><span class="cx"> 
</span><del>-2014-05-15  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+    2014-01-09  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Reduce the RenderRegion invasiveness in rendering code
-        https://bugs.webkit.org/show_bug.cgi?id=132121
</del><ins>+            PDFDocumentImage can be very slow to do the initial paint
+            https://bugs.webkit.org/show_bug.cgi?id=126633
+            &lt;rdar://problem/15770980&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Remove the RenderRegion / RenderNamedFlowFragment parameters and fields from
-        the painting / hit testing data structures and use a stateful approach to
-        correctly handle regions.
</del><ins>+            * platform/graphics/cg/PDFDocumentImage.cpp:
+            (WebCore::PDFDocumentImage::PDFDocumentImage):
+            (WebCore::PDFDocumentImage::size):
+            (WebCore::transformContextForPainting):
+            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
+            (WebCore::applyRotationForPainting):
+            (WebCore::PDFDocumentImage::drawPDFPage):
+            * platform/graphics/cg/PDFDocumentImage.h:
+            * platform/graphics/mac/PDFDocumentImageMac.mm:
+            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
+            Store rotation from the PDF in degrees, since it can
+            only be 0, 90, 180, or 270, and don't do any trig to
+            perform the rotation, to avoid introducing minor rounding
+            issues in the size.
</ins><span class="cx"> 
</span><del>-        When painting or hit testing, the current flow thread is saved along the current
-        region. They are accessed through the |currentRenderNamedFlowFragment| helper
-        method on RenderObject or RenderLayer.
</del><ins>+            Once we're going to paint, if the difference between the
+            computed scale for each axis is due only to integer rounding
+            of the image size, use the same scale for both axes, to avoid
+            a CG slow-path which occurs whenever the scale is nonuniform.
</ins><span class="cx"> 
</span><del>-        The patch also changes a bunch of 0s to nullptrs.
</del><ins>+2014-01-07  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: No new tests, no functional change.
</del><ins>+        Merge r160479
</ins><span class="cx"> 
</span><del>-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
-        * rendering/HitTestLocation.cpp:
-        (WebCore::HitTestLocation::HitTestLocation):
-        (WebCore::HitTestLocation::operator=):
-        * rendering/HitTestLocation.h:
-        (WebCore::HitTestLocation::region): Deleted.
-        * rendering/HitTestResult.h:
-        * rendering/PaintInfo.h:
-        (WebCore::PaintInfo::PaintInfo):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::paintObject):
-        (WebCore::RenderBlock::selectionGaps):
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::nodeAtPoint):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::pushContentsClip):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paint):
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::paintLayerContents):
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
-        (WebCore::RenderLayer::collectFragments):
-        (WebCore::RenderLayer::updatePaintingInfoForFragments):
-        (WebCore::RenderLayer::paintTransformedLayerIntoFragments):
-        (WebCore::RenderLayer::paintBackgroundForFragments):
-        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
-        (WebCore::RenderLayer::paintOutlineForFragments):
-        (WebCore::RenderLayer::paintMaskForFragments):
-        (WebCore::RenderLayer::hitTest):
-        (WebCore::RenderLayer::hitTestFixedLayersInNamedFlows):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::hitTestTransformedLayerInFragments):
-        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::addToOverlapMap):
-        (WebCore::RenderLayerCompositor::clippedByAncestor):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::currentRenderNamedFlowFragment):
-        * rendering/RenderObject.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::nodeAtPoint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::nodeAtPoint):
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::writeLayers):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::paint):
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::paintReplaced):
</del><ins>+    2013-12-11  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            StylePendingImage needs to correctly manage the CSSValue pointer lifetime
+            https://bugs.webkit.org/show_bug.cgi?id=125468
</ins><span class="cx"> 
</span><del>-        Clean up &quot;has non-zero begin time&quot; terminology in animations
-        https://bugs.webkit.org/show_bug.cgi?id=132942
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Test: fast/css/pending-image-crash.xhtml
</ins><span class="cx"> 
</span><del>-        Change the &quot;non-zero beginTime&quot; terminology in the platform CA animations
-        code to &quot;explicit beginTime&quot;: this flag really means that we explicitly set
-        the beginTime of the animation, rather than let CA set the beginTime when
-        committing the animation. This flag is used for animations with negative
-        delay, and when pausing.
-        
-        The WKNonZeroBeginTimeFlag key was spread across PlatformCALayerMac and PlatformCAAnimationMac,
-        so hide it behind getter/setter functions.
-        
-        Remove lots of m_layer.get() in PlatformCAAnimationMac.
</del><ins>+            Disconnect the reference counted StylePendingImage from the CSSValue that owns
+            it when it's not needed any more, otherwise we could end up using a pointer
+            that might no longer be valid.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/PlatformCAAnimationMac.h:
-        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
-        (WebCore::hasExplicitBeginTime):
-        (WebCore::setHasExplicitBeginTime):
-        (PlatformCAAnimationMac::copy):
-        (PlatformCAAnimationMac::keyPath):
-        (PlatformCAAnimationMac::beginTime):
-        (PlatformCAAnimationMac::setBeginTime):
-        (PlatformCAAnimationMac::duration):
-        (PlatformCAAnimationMac::setDuration):
-        (PlatformCAAnimationMac::speed):
-        (PlatformCAAnimationMac::setSpeed):
-        (PlatformCAAnimationMac::timeOffset):
-        (PlatformCAAnimationMac::setTimeOffset):
-        (PlatformCAAnimationMac::repeatCount):
-        (PlatformCAAnimationMac::setRepeatCount):
-        (PlatformCAAnimationMac::autoreverses):
-        (PlatformCAAnimationMac::setAutoreverses):
-        (PlatformCAAnimationMac::fillMode):
-        (PlatformCAAnimationMac::setFillMode):
-        (PlatformCAAnimationMac::setTimingFunction):
-        (PlatformCAAnimationMac::copyTimingFunctionFrom):
-        (PlatformCAAnimationMac::isRemovedOnCompletion):
-        (PlatformCAAnimationMac::setRemovedOnCompletion):
-        (PlatformCAAnimationMac::isAdditive):
-        (PlatformCAAnimationMac::setAdditive):
-        (PlatformCAAnimationMac::valueFunction):
-        (PlatformCAAnimationMac::setValueFunction):
-        (hasNonZeroBeginTimeFlag): Deleted.
-        (setNonZeroBeginTimeFlag): Deleted.
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (-[WebAnimationDelegate animationDidStart:]):
</del><ins>+            * css/CSSCursorImageValue.cpp:
+            (WebCore::CSSCursorImageValue::detachPendingImage): Added. Calls detachFromCSSValue
+            on the current image if it is a StylePendingImage.
+            (WebCore::CSSCursorImageValue::~CSSCursorImageValue): Call detachPendingImage.
+            (WebCore::CSSCursorImageValue::cachedImage): Call detachPendingImage before changing
+            m_image to a new value.
+            (WebCore::CSSCursorImageValue::clearCachedImage): Ditto.
+            * css/CSSCursorImageValue.h: Added detachPendingImage.
</ins><span class="cx"> 
</span><del>-2014-05-15  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            * css/CSSImageSetValue.cpp:
+            (WebCore::CSSImageSetValue::detachPendingImage): Added. Calls detachFromCSSValue
+            on the current image set if it is a StylePendingImage.
+            (WebCore::CSSImageSetValue::~CSSImageSetValue): Call detachPendingImage.
+            (WebCore::CSSImageSetValue::cachedImageSet): Call detachPendingImage before changing
+            m_imageSet to a new value.
+            * css/CSSImageSetValue.h: Added detachPendingImage.
</ins><span class="cx"> 
</span><del>-        [GTK] Compile all installed resources as GResources
-        https://bugs.webkit.org/show_bug.cgi?id=131099
</del><ins>+            * css/CSSImageValue.cpp:
+            (WebCore::CSSImageValue::detachPendingImage): Added. Calls detachFromCSSValue on the
+            current image if it is a StylePendingImage.
+            (WebCore::CSSImageValue::~CSSImageValue): Call detachPendingImage.
+            (WebCore::CSSImageValue::cachedImage): Call detachPendingImage before changing m_image
+            to a new value.
+            * css/CSSImageValue.h: Added detachPendingImage.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+            * rendering/style/StylePendingImage.h:
+            (WebCore::StylePendingImage::cssImageValue): Added a null check.
+            (WebCore::StylePendingImage::cssImageGeneratorValue): Added a null check.
+            (WebCore::StylePendingImage::cssCursorImageValue): Added a null check.
+            (WebCore::StylePendingImage::cssImageSetValue): Added a null check.
+            (WebCore::StylePendingImage::detachFromCSSValue): Added. Sets m_value to null since
+            the style is no longer using this StylePendingImage.
+            (WebCore::StylePendingImage::data): Changed to use the &quot;this&quot; pointer since all we
+            need is some arbitrary pointer uniquely identifying the image. Before loading the image,
+            we have no suitable weak identifier, so it suffices to use the unique pointer to each
+            StylePendingImage object. This function is used only in a limited way; it would be nice
+            to find a way to make the code less strange long term.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Do not install the resources.
-        * platform/audio/gtk/AudioBusGtk.cpp:
-        (WebCore::AudioBus::loadPlatformResource): Load the audio resource
-        from GResources and use createBusFromInMemoryAudioFile().
-        * platform/graphics/Image.h: Remove unsued function loadPlatformThemeIcon.
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::loadImageFromGResource): Load the given icon name from GResources.
-        (WebCore::loadResourceSharedBuffer): Use char* instead of CString.
-        (WebCore::loadMissingImageIconFromTheme): Try to load the missing
-        icon from the current GTK icon theme.
-        (WebCore::Image::loadPlatformResource): Call
-        loadMissingImageIconFromTheme for missing icon or
-        loadImageFromGResource for any other icon name.
-        (WebCore::getPathToImageResource): Deleted.
-        (WebCore::getThemeIconFileName): Deleted.
-        (WebCore::loadImageFromFile): Deleted.
-        (WebCore::Image::loadPlatformThemeIcon): Deleted.
</del><ins>+2013-12-23  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Merge 161050: &lt;rdar://problem/15754482&gt;
</ins><span class="cx"> 
</span><del>-        Tiled scrolling indicator needs to take topContentInset into account
-        https://bugs.webkit.org/show_bug.cgi?id=132940
</del><ins>+    2013-12-23  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Crash in ReplaceSelectionCommand
+            https://bugs.webkit.org/show_bug.cgi?id=126107
</ins><span class="cx"> 
</span><del>-        The tiled scrolling indicator needs to move down by the value of the 
-        topContentInset. This patch makes that happen by caching the topContentInset in 
-        the TileController. This does feel a little silly since there is already a 
-        function called setTiledScrollingIndicatorPosition() on TiledBacking. However, it 
-        was often the case that calling that function had no effect because m_coverageMap 
-        had not yet been created, and then the information was lost. So instead, we cache 
-        the value.
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Set TiledBacking’s copy of topContentInset whenever it changes for the FrameView.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::topContentInsetDidChange):
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/c1ebe5c1e808daf9db5e348a8d0ab32570b9f7a5
+            except the test since it doesn't reproduce the crash in WebKit.
</ins><span class="cx"> 
</span><del>-        New function to set the inset. Use the inset to position the coverage map.
-        * platform/graphics/TiledBacking.h:
-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::TileController):
-        (WebCore::TileController::setTopContentInset):
</del><ins>+            * editing/ReplaceSelectionCommand.cpp:
+            (WebCore::ReplaceSelectionCommand::doApply):
</ins><span class="cx"> 
</span><del>-        When the coverage map is created, consult the value of the inset.
-        * platform/graphics/ca/mac/TileCoverageMap.mm:
-        (WebCore::TileCoverageMap::TileCoverageMap):
</del><ins>+2013-12-23  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Once the backing has been ensured, set the inset.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
</del><ins>+        Merge 161003: &lt;rdar://problem/15719584&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+    2013-12-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r1267628 from branch.
-        &lt;rdar://problem/15751219&gt;
</del><ins>+            &lt;rdar://problem/15682948&gt; Update copyright strings
</ins><span class="cx"> 
</span><del>-            Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+            Reviewed by Dan Bernstein
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.&quot;,
</del><ins>+            * Info.plist:
</ins><span class="cx"> 
</span><del>-            TileController relied on the tiling mode in TileCache to determine if it should use low-res
-            tiles when zooming. Unfortunately, sometimes the tiling mode gets set to Zooming even though
-            it's actually a pan. Thus we can end up with blurry tiles. Fix this by adding a new flag on
-            TileCache that controls this behavior and have UIKit set it only when we have an actual zoom
-            operation.

-        * platform/ios/LegacyTileCache.h:
-        (WebCore::LegacyTileCache::tileControllerShouldUseLowScaleTiles):
-        (WebCore::LegacyTileCache::setTileControllerShouldUseLowScaleTiles):
-        * platform/ios/LegacyTileCache.mm:
-        (WebCore::LegacyTileCache::LegacyTileCache):
-        * platform/ios/wak/WAKWindow.h:
-        * platform/ios/wak/WAKWindow.mm:
-        (-[WAKWindow setTileControllerShouldUseLowScaleTiles:]):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::contentsScaleMultiplierForNewTiles):
</del><ins>+2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Merge r160898: &lt;rdar://problems/15709940&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168750.
-        https://bugs.webkit.org/show_bug.cgi?id=132935
</del><ins>+    2013-12-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Caused repaint bugs (Requested by weinig on #webkit).
</del><ins>+            REGRESSION: cnn.com will continue to reveal 1 px of overhang after rubber-banding 
+            at the top
+            https://bugs.webkit.org/show_bug.cgi?id=126054
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        &quot;Text decorations do not contribute to visual overflow&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132773
-        http://trac.webkit.org/changeset/168750
</del><ins>+            This regression was caused by http://trac.webkit.org/changeset/160791 It turns out 
+            that the line of code I removed was not always a no-op. In some instances, like on 
+            cnn.com, it would ensure that our final scroll position after a rubber-band was 
+            not something within the overhang area. It was still wrong in its assumption that 
+            rubber-band is always bouncing back the spot it originated from. So this patch 
+            continues to ignore the rubber-bands origin, and instead finds the nearest point 
+            that is not in the overhang area, and scrolls to that point instead of the origin.
</ins><span class="cx"> 
</span><del>-2014-05-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
+            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+            (WebCore::ScrollingTreeScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary):
+            * platform/mac/ScrollAnimatorMac.h:
+            * platform/mac/ScrollAnimatorMac.mm:
+            (WebCore::ScrollAnimatorMac::adjustScrollPositionToBoundsIfNecessary):
+            * platform/mac/ScrollElasticityController.h:
+            * platform/mac/ScrollElasticityController.mm:
+            (WebCore::ScrollElasticityController::snapRubberBandTimerFired):
</ins><span class="cx"> 
</span><del>-        [New multicolumn] Spin in RenderMultiColumnSet::repaintFlowThreadContent()
-        https://bugs.webkit.org/show_bug.cgi?id=132884
</del><ins>+2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+        Merge r159463: &lt;rdar://problems/15701094&gt;
</ins><span class="cx"> 
</span><del>-        On iOS, wikipedia pages can hang under RenderMultiColumnSet::repaintFlowThreadContent().
-        It appears that computedColumnHeight is set to 0 in prepareForLayout, but layout never happens
-        on the RenderMultiColumnSet in some cases, leaving the column height set to zero.
-        This caused columnIndexAtOffset() to return bad values, which resulted in very long loops
-        in repaintFlowThreadContent().
-        
-        This fix is a stop-gap.
</del><ins>+    2013-11-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::columnIndexAtOffset):
</del><ins>+            At some scales, opaque compositing layers have garbage pixels around the edges
+            ​https://bugs.webkit.org/show_bug.cgi?id=124541
</ins><span class="cx"> 
</span><del>-2014-05-14  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Remove FrameView::viewportConstrainedExtentRect, it is unused
-        https://bugs.webkit.org/show_bug.cgi?id=132927
</del><ins>+            Layers get marked as having opaque contents when their background is
+            known to paint the entire layer. However, this failed to take into
+            account two reasons why every pixel may not get painted.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            First, subpixel layout can result in non-integral RenderLayer
+            bounds, which will get rounded up to an integral GraphicsLayer
+            size. When this happens we may not paint edge pixels.
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::viewportConstrainedExtentRect): Deleted.
-        * page/FrameView.h:
-        Simon replaced this by viewportConstrainedVisibleContentRect, remove the old code.
</del><ins>+            Second, at non-integral scale factors, graphics context scaling
+            may cause us to not paint edge pixels.
</ins><span class="cx"> 
</span><del>-2014-05-14  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+            Fix by only marking PlatformCALayers as having opaque contents
+            when the contentsScale of the layer is integral.
</ins><span class="cx"> 
</span><del>-        Only define MAX_GRID_TRACK_REPETITIONS if CSS_GRID_LAYOUT is enabled.
</del><ins>+            Not testable, because we can't guarantee to get garbage pixels
+            in a ref test, and layer dumps show GraphicsLayer's notion of
+            content opaqueness, not the one we set on the PlatformCALayer.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            * platform/graphics/ca/GraphicsLayerCA.cpp:
+            (WebCore::isIntegral):
+            (WebCore::clampedContentsScaleForScale):
+            (WebCore::GraphicsLayerCA::updateRootRelativeScale):
+            (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
+            (WebCore::GraphicsLayerCA::updateContentsOpaque):
+            (WebCore::GraphicsLayerCA::getTransformFromAnimationsWithMaxScaleImpact):
+            Drive-by typo fix.
+            (WebCore::GraphicsLayerCA::noteChangesForScaleSensitiveProperties):
+            * platform/graphics/ca/GraphicsLayerCA.h:
+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
</ins><span class="cx"> 
</span><del>-        This was causing -Wunused-const-variable errors.
</del><ins>+2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp: Add include guard.
</del><ins>+        Merge r160791: &lt;rdar://problems/15694289&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+    2013-12-18  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tile cache has way too many tiles when pinch-zoomed in
-        https://bugs.webkit.org/show_bug.cgi?id=132929
-        -and corresponding-
-        &lt;rdar://problem/16527172&gt;
</del><ins>+            Starting a momentum scroll while rubber banding can cause scrolling to jump back 
+            when the rubberband snaps
+            https://bugs.webkit.org/show_bug.cgi?id=119507
+            -and corresponding-
+            &lt;rdar://problem/14655893&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        This patch makes the margin sizing functions return the set margin size scaled by 
-        the TileGrid's scale. We also need to get rid of the old notion we used to have
-        that margin tiles might be allowed to have a different size than the other tiles. 
-        We don't want that. They should have the normal margin size, but they should
-        affect the overall coverage area.
</del><ins>+            This line of code was added with the very first implementation of rubber-banding. 
+            As far as I can tell, it was always a belt-and-suspenders line of code that is a 
+            no-op in all normal rubber-banding. In this J-shaped scrolling case, this line of 
+            code is what causes the bug to occur because this line of code assumes that your 
+            rubber-band is always trying to take you back to the origin. 
+            * platform/mac/ScrollElasticityController.mm:
+            (WebCore::ScrollElasticityController::snapRubberBandTimerFired):
</ins><span class="cx"> 
</span><del>-        Scale by the TileGrid's scale.
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::topMarginHeight):
-        (WebCore::TileController::bottomMarginHeight):
-        (WebCore::TileController::leftMarginWidth):
-        (WebCore::TileController::rightMarginWidth):
</del><ins>+2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Get rid of adjustRectAtTileIndexForMargin() since we do not want to ever do this 
-        adjustment. Use tileSize instead of margin size for all sizing computations.
-        * platform/graphics/ca/mac/TileGrid.h:
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::rectForTileIndex):
-        (WebCore::TileGrid::getTileIndexRangeForRect):
-        (WebCore::TileGrid::adjustRectAtTileIndexForMargin): Deleted.
</del><ins>+        Merge r160819: &lt;rdar://problems/15701133&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+    2013-12-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] Search fields should not use centered look
-        https://bugs.webkit.org/show_bug.cgi?id=132930
-        &lt;rdar://problem/16825842&gt;
</del><ins>+            Crash in WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches
+            https://bugs.webkit.org/show_bug.cgi?id=125970
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        We need to explicitly set the centeredLook property
-        to NO on modern releases of Mac.
</del><ins>+            The bug was caused by containingBlockForAbsolutePosition returning a non-RenderBlock render object.
+            Fixed the bug by obtaining its containg block.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeMac.mm: Declare a new private property and set it to NO.
-        (WebCore::RenderThemeMac::search):
</del><ins>+            Also changed the return type of containingBlockForFixedPosition, containingBlockForAbsolutePosition,
+            containingBlockForObjectInFlow from RenderElement to RenderBlock as all callers of these functions
+            had assumed the return value to be an instance of RenderBlock.
</ins><span class="cx"> 
</span><del>-2014-05-14  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Test: svg/text/select-text-inside-non-static-position.html
</ins><span class="cx"> 
</span><del>-        Subpixel layout: Change Element.offset* client* scroll* return type to double.
-        https://bugs.webkit.org/show_bug.cgi?id=132895
</del><ins>+            * rendering/LogicalSelectionOffsetCaches.h:
+            (WebCore::containingBlockForFixedPosition):
+            (WebCore::containingBlockForAbsolutePosition):
+            (WebCore::containingBlockForObjectInFlow):
+            (WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This patch changes Element.offset*, Element.client* and Element.scroll* APIs return
-        type from long to double to match the latest CSSOM View Module spec[1].
-        Element.offset* and Element.client* do return subpixel values from now on.
-        Element.scroll* still return integral values as the scrolling code hasn't adopted to subpixel rendering yet.
</del><ins>+        Merged patch from &lt;rdar://problems/15474133&gt;.  This patch is a port of r157821.
</ins><span class="cx"> 
</span><del>-        subpixelCSSOMElementMetricsEnabled setting is added to be able to turn this feature on/off
-        from WK2 preferences. It toggles the return value from subpixel to floored integral.
-        It does not change layout/rendering behavior.
</del><ins>+    2013-10-22  Samuel White  &lt;samuel_white@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reference list of what other browsers do:
-        IE: http://blogs.msdn.com/b/ie/archive/2012/02/17/sub-pixel-rendering-and-the-css-object-model.aspx
-        Blink: http://www.chromestatus.com/features/5497402177880064
-        Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=825607
</del><ins>+            AX: Add paramAttrs to fetch start and end text markers in a given rect.
+            https://bugs.webkit.org/show_bug.cgi?id=122164
</ins><span class="cx"> 
</span><del>-        [1] http://www.w3.org/TR/2013/WD-cssom-view-20131217/
</del><ins>+            Unreviewed change.
</ins><span class="cx"> 
</span><del>-        Test: cssom/subpixel-offsetleft-top-width-height-values.html
</del><ins>+            Added ability to fetch end and start text markers inside a given bounds. This gives ScreenReaders
+            like VoiceOver a way to retrieve the text markers for a specified column of page text.
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::localZoomForRenderer):
-        (WebCore::adjustForLocalZoom):
-        (WebCore::convertToNonSubpixelValueIfNeeded):
-        (WebCore::Element::offsetLeft):
-        (WebCore::Element::offsetTop):
-        (WebCore::Element::offsetWidth):
-        (WebCore::Element::offsetHeight):
-        (WebCore::Element::clientLeft):
-        (WebCore::Element::clientTop):
-        (WebCore::Element::clientWidth):
-        (WebCore::Element::clientHeight):
-        (WebCore::Element::scrollLeft):
-        (WebCore::Element::scrollTop):
-        (WebCore::Element::setScrollLeft):
-        (WebCore::Element::setScrollTop):
-        (WebCore::Element::scrollWidth):
-        (WebCore::Element::scrollHeight):
-        * dom/Element.h:
-        * dom/Element.idl:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::adjustForZoom):
-        (WebCore::HTMLBodyElement::scrollLeft):
-        (WebCore::HTMLBodyElement::setScrollLeft):
-        (WebCore::HTMLBodyElement::scrollTop):
-        (WebCore::HTMLBodyElement::setScrollTop):
-        (WebCore::HTMLBodyElement::scrollHeight):
-        (WebCore::HTMLBodyElement::scrollWidth):
-        * html/HTMLBodyElement.h:
-        * page/Settings.in:
</del><ins>+            Test: platform/mac/accessibility/text-marker-for-bounds.html
</ins><span class="cx"> 
</span><del>-2014-05-14  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::AccessibilityObject::mainFrame):
+            (WebCore::AccessibilityObject::topDocument):
+            (WebCore::AccessibilityObject::visiblePositionForBounds):
+            * accessibility/AccessibilityObject.h:
+            * accessibility/AccessibilityRenderObject.cpp:
+            * accessibility/AccessibilityRenderObject.h:
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (-[WebAccessibilityObjectWrapper screenToContents:]):
+            (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
</ins><span class="cx"> 
</span><del>-        Implement NSSharingServiceDelegate method &quot;transitionImageForShareItem&quot;
-        &lt;rdar://problem/16878020&gt; and https://bugs.webkit.org/show_bug.cgi?id=132911
</del><ins>+2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Merge r154513
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+    2013-08-23  Alex Christensen  &lt;achristensen@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Re-separating Win32 and Win64 builds.
+            https://bugs.webkit.org/show_bug.cgi?id=120178
</ins><span class="cx"> 
</span><del>-        Another unreviewed build fix.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getTimingData):
-        Added necessary UNUSED_PARAMs.
</del><ins>+            * WebCore.vcxproj/WebCoreGenerated.make:
+            * WebCore.vcxproj/WebCoreGeneratedWinCairo.make:
+            Pass PlatformArchitecture as a command line parameter to bash scripts
+            and use PlatformArchitecture to determine which directory to delete
+            while cleaning (obj32 or obj64).
+            * WebCore.vcxproj/WebCoreGeneratedWinCairoCommon.props:
+            Export PlatformArchitecture to be used by make and cmd scripts.
+            * WebCore.vcxproj/build-generated-files.sh:
+            Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
+            * WebCore.vcxproj/copyForwardingHeaders.cmd:
+            * WebCore.vcxproj/copyWebCoreResourceFiles.cmd:
+            Use PlatformArchitecture to determine which directory to copy to (obj32 or obj64).
</ins><span class="cx"> 
</span><del>-2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r168849.
</del><ins>+        Rollout r160469.  Not rolling out from trunk because r160469 was
+        applied on the branch from a patch file.
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getTimingData):
-        Protect use of timing data with ENABLE(WEB_TIMING).
</del><ins>+2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Merge r157821
</ins><span class="cx"> 
</span><del>-        Refactor duplicate code in web timing.
-        https://bugs.webkit.org/show_bug.cgi?id=132917
</del><ins>+    2013-10-22  Samuel White  &lt;samuel_white@apple.com&gt; 
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            AX: Add paramAttrs to fetch start and end text markers in a given rect. 
+            https://bugs.webkit.org/show_bug.cgi?id=122164 
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandle.h:
-        Added getTimingData declaration.
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getTimingData):
-        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
-        Moved duplicate code to ResourceHandle.
</del><ins>+            Reviewed by Chris Fleizach. 
</ins><span class="cx"> 
</span><del>-2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Added ability to fetch end and start text markers inside a given bounds. This gives ScreenReaders
+            like VoiceOver a way to retrieve the text markers for a specified column of page text.
</ins><span class="cx"> 
</span><del>-        Use references instead of pointers with ResourceLoadTiming.
-        https://bugs.webkit.org/show_bug.cgi?id=132846
</del><ins>+            Test: platform/mac/accessibility/text-marker-for-bounds.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::AccessibilityObject::mainFrame):
+            (WebCore::AccessibilityObject::topDocument):
+            (WebCore::AccessibilityObject::visiblePositionForBounds):
+            * accessibility/AccessibilityObject.h:
+            * accessibility/AccessibilityRenderObject.cpp:
+            * accessibility/AccessibilityRenderObject.h:
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (-[WebAccessibilityObjectWrapper screenToContents:]):
+            (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Removed ResourceResponseBase::setResourceLoadTiming linker symbol.
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::buildObjectForResourceResponse):
-        * page/PerformanceResourceTiming.cpp:
-        (WebCore::PerformanceResourceTiming::domainLookupStart):
-        (WebCore::PerformanceResourceTiming::domainLookupEnd):
-        (WebCore::PerformanceResourceTiming::connectStart):
-        (WebCore::PerformanceResourceTiming::connectEnd):
-        (WebCore::PerformanceResourceTiming::secureConnectionStart):
-        (WebCore::PerformanceResourceTiming::requestStart):
-        Use references instead of pointers.
-        * page/PerformanceResourceTiming.h:
-        Make an instance instead of a RefPtr.
-        * page/PerformanceTiming.cpp:
-        (WebCore::PerformanceTiming::domainLookupStart):
-        (WebCore::PerformanceTiming::domainLookupEnd):
-        (WebCore::PerformanceTiming::connectStart):
-        (WebCore::PerformanceTiming::connectEnd):
-        (WebCore::PerformanceTiming::secureConnectionStart):
-        (WebCore::PerformanceTiming::requestStart):
-        (WebCore::PerformanceTiming::responseStart):
-        Check to see if the loader exists, then use ResourceLoadTiming reference.
-        (WebCore::PerformanceTiming::resourceLoadTiming): Deleted.
-        * page/PerformanceTiming.h:
-        Removed resourceLoadTiming declaration.
-        * platform/network/ResourceLoadTiming.h:
-        (WebCore::ResourceLoadTiming::ResourceLoadTiming):
-        (WebCore::ResourceLoadTiming::operator=):
-        Replaced reference counting with copy constructors.
-        (WebCore::ResourceLoadTiming::create): Deleted.
-        (WebCore::ResourceLoadTiming::deepCopy): Deleted.
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::adopt):
-        (WebCore::ResourceResponseBase::copyData):
-        (WebCore::ResourceResponseBase::resourceLoadTiming):
-        (WebCore::ResourceResponseBase::setResourceLoadTiming):
-        (WebCore::ResourceResponseBase::compare):
-        * platform/network/ResourceResponseBase.h:
-        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::didStartRequest):
-        (WebCore::networkEventCallback):
-        Use references instead of pointers.
</del><ins>+2013-12-11  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Merge r159691
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168837.
-        https://bugs.webkit.org/show_bug.cgi?id=132913
</del><ins>+    2013-11-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The patch added an assertion which fires on 6 tests (Requested
-        by ap on #webkit).
</del><ins>+            [Win] Avoid deadlock when interacting with some AVFoundationCF content
+            &lt;rdar://problem/15482977&gt; and https://bugs.webkit.org/show_bug.cgi?id=124752
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+            Prevent deadlock caused by conflict over the &quot;mapLock&quot; mutex. Notification handling in the file,
+            which modify assets and make other changes, are required to happen on the main thread. This
+            patch enforces this requirement.
</ins><span class="cx"> 
</span><del>-        &quot;[CSS Regions] Add ASSERT to make sure using the flowThread
-        cache does not return incorrect results&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132906
-        http://trac.webkit.org/changeset/168837
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-13  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::NotificationCallbackData::NotificationCallbackData): Added
+            (WebCore::AVFWrapper::processNotification): Moved logic from 'notificationCallback', which was
+            sometimes happening on a background thread.
+            (WebCore::AVFWrapper::notificationCallback): Dispatch calls to main thread.
</ins><span class="cx"> 
</span><del>-        Revert &quot;Don't dispatch 'beforeload' event inside FrameView::layout()&quot;,
-        commit 84fe8cf6fbe8b5de9a06300ca3ef6d0ffc96948c, and associated
-        follow-up fixes:
</del><ins>+2013-12-11  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            &quot;platform/mac/plugins/testplugin-onnew-onpaint.html failing after
-                r168668&quot;, commit c17be3bf5127baf94310af4b4b9bf5a57d29aaf4
-            &quot;[Win] Unreviewed build fix after r168668.&quot;, commit
-                4fa470ad12c38ee7d4c114541b6dd321181a8bc9
</del><ins>+        Merge r159460
</ins><span class="cx"> 
</span><del>-        The original merged patch appears to have caused a regression in
-        fast/dom/HTMLObjectElement/object-as-frame.html.
</del><ins>+    2013-11-18  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=132886&gt;
</del><ins>+            Add a quirk to not respect center text-align when positioning
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            &lt;rdar://problem/15427571&gt;
+            https://bugs.webkit.org/show_bug.cgi?id=124522
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * dom/Document.cpp:
-        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
-        * dom/Document.h:
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::reset):
-        (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
-        (WebCore::FrameView::performPostLayoutTasks):
-        (WebCore::FrameView::updateEmbeddedObjectsTimerFired): Deleted.
-        * page/FrameView.h:
-        * testing/Internals.cpp:
-        (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks): Deleted.
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-05-14  Kiran  &lt;kiran.guduru@samsung.com&gt;
</del><ins>+            Added fast/block/legacy-text-align-position-quirk.html
</ins><span class="cx"> 
</span><del>-        alidation for getUserMedia() errorCallback is missing.
-        https://bugs.webkit.org/show_bug.cgi?id=132901
</del><ins>+            * page/Settings.in:
+            Add the quirk setting.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::RenderBlock::startAlignedOffsetForLine):
+            Don't pay attention to center text-align when the quirk is set.
</ins><span class="cx"> 
</span><del>-        The patch adds the validation for getUserMedia errorCallBack
-        and throws TypeMismatchError.
</del><ins>+2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/mediastream/getusermedia.html 
</del><ins>+        Merge 154333
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/NavigatorUserMedia.cpp:
-        (WebCore::NavigatorUserMedia::webkitGetUserMedia):
</del><ins>+    2013-08-20  Alex Christensen  &lt;achristensen@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Tibor Meszaros  &lt;tmeszaros.u-szeged@partner.samsung.com&gt;
</del><ins>+            Use PlatformArchitecture to distinguish between 32-bit and 64-bit builds on Windows.
+            https://bugs.webkit.org/show_bug.cgi?id=119512
</ins><span class="cx"> 
</span><del>-        Remove CSS_STICKY_POSITION guards
-        https://bugs.webkit.org/show_bug.cgi?id=132676
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj.filters:
+            * WebCore.vcxproj/WebCoreCommon.props:
+            * WebCore.vcxproj/WebCoreGeneratedCommon.props:
+            * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
+            * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters:
+            Replaced obj32, bin32, and lib32 with macros for 64-bit build.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * css/CSSParser.cpp:
-        (WebCore::isValidKeywordPropertyAndValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EPosition):
-        * css/CSSValueKeywords.in:
-        * editing/EditingStyle.cpp:
-        (WebCore::EditingStyle::convertPositionStyle):
</del><ins>+2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Merge 152982
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Add ASSERT to make sure using the flowThread cache does not return incorrect results
-        https://bugs.webkit.org/show_bug.cgi?id=132906
</del><ins>+    2013-07-22  Alex Christensen  &lt;achristensen@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+            Added assembly files to Windows 64-bit builds.
+            https://bugs.webkit.org/show_bug.cgi?id=118931
</ins><span class="cx"> 
</span><del>-        If flowThreadContainingBlock() is called on an object which is in a different
-        flow thread than the one currently being laid out, this method will return an incorrect
-        result. I added an assertion for that to make sure we catch and treat any such scenarios.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        No new tests required.
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Added PaintHooks.asm for x64 and enabled MASM.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Added PaintHooks.asm.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::locateFlowThreadContainingBlockNoCache):
-        (WebCore::RenderObject::locateFlowThreadContainingBlock):
-        * rendering/RenderObject.h:
</del><ins>+2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+        Merge 152921
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Don't relayout when updating the region range unless necessary
-        https://bugs.webkit.org/show_bug.cgi?id=132120
</del><ins>+    2013-07-19  Alex Christensen  &lt;achristensen@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Added x64 configuration to Visual Studio build.
+            https://bugs.webkit.org/show_bug.cgi?id=118888
</ins><span class="cx"> 
</span><del>-        The patch reduces the cases when a relayout is made for boxes that change the region range.
-        This lowers the amount of nested layouts in most cases and produces big layout speedups for trees
-        without overhanging floats.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Tests: Major performance improvement with speedups of 50-60% on:
-        Layout/RegionsAuto.html, Layout/RegionsAutoMaxHeight.html and Layout/RegionsFixed.html
</del><ins>+            * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCoreGenerated.vcxproj:
+            * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::updateRegionRangeForBoxChild): Ask the child box if it needs a relayout
-        in case its region range changes.
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::layoutBlockChild): It's not necessary to do two layouts here because
-        there's no block direction position change between them for the child.
-        (WebCore::RenderBlockFlow::needsLayoutAfterRegionRangeChange): If the block doesn't have floats
-        or if it expands to enclose the floats it doesn't need to relayout after a region range chage.
-        It's not possible for it to have a float inside overflow that must be repositioned using the new
-        range.
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::needsLayoutAfterRegionRangeChange): By default don't relayout after a region
-        range change.
</del><ins>+2013-11-20  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Merge r159481
</ins><span class="cx"> 
</span><del>-        RuleData should ref the StyleRule
-        https://bugs.webkit.org/show_bug.cgi?id=132865
</del><ins>+    2013-11-18  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            use after free in WebCore::DocumentOrderedMap::remove / WebCore::TreeScope::removeElementById
+            https://bugs.webkit.org/show_bug.cgi?id=121324
</ins><span class="cx"> 
</span><del>-        As a defensive move make RuleData ref the StyleRule. 
-        This adds some ref churn but the overall performance impact should be minimal.
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * css/RuleSet.h:
-        (WebCore::RuleData::rule):
</del><ins>+            Update the document ordered map for an image element before dispatching load or error events
+            when it's inserted into a document.
</ins><span class="cx"> 
</span><del>-2014-05-14  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+            Test: fast/dom/modify-node-and-while-in-the-callback-too-crash.html
</ins><span class="cx"> 
</span><del>-        GIF animations don't restart after scrolling on iOS WebKit1
-        https://bugs.webkit.org/show_bug.cgi?id=132900
</del><ins>+            * dom/DocumentOrderedMap.cpp: defensive fix to avoid use after free issues.
+            (WebCore::DocumentOrderedMap::remove):
+            * html/HTMLImageElement.cpp:
+            (WebCore::HTMLImageElement::insertedInto):
+            * loader/ImageLoader.cpp:
+            (WebCore::ImageLoader::updateFromElement): setting m_failedLoadURL makes
+            repeated updateFromElement calls return early.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-11-13  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        &lt;rdar://problem/15292359&gt;
+        Fix incorrect merge of r157299 made in r158605.
</ins><span class="cx"> 
</span><del>-2014-05-13  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+        * platform/graphics/DisplayRefreshMonitor.cpp:
+        (WebCore::DisplayRefreshMonitor::removeClient): Remember to remove clients
+        from m_clientsToBeNotified.
+        * platform/graphics/DisplayRefreshMonitor.h: Might as well make the code
+        more consistent with ToT while I'm here.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Assertion failure in some cases with inline blocks
-        https://bugs.webkit.org/show_bug.cgi?id=132859
</del><ins>+2013-11-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+        Merge r152867
</ins><span class="cx"> 
</span><del>-        The patch hardens the conditions when the region range caches are
-        populated to avoid desynchronizations when objects move during layout.
-        This is true especially in the case of the boxes found inside
-        inline blocks, that get their range from the containing line.
</del><ins>+    2013-07-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        There is a new function |computedRegionRangeForBox| that will always
-        return a region range for a box using a best effort algorithm. This should
-        be used only when there's no need to cache region information.
</del><ins>+            New PDFPlugin doesn't support WebKitOmitPDFSupport, acts as if Plug-ins are off
+            https://bugs.webkit.org/show_bug.cgi?id=118858
</ins><span class="cx"> 
</span><del>-        This change also allows better control over the lifecycle of the
-        |RenderBoxRegionInfo| objects stored on the regions. We can now iterate
-        over the full range of the box when cleaning up the region box info. The
-        same applies for the width change detection function.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/inline-block-shifted-region.html
</del><ins>+            Expand the scope of rejecting non video/ or audio/ MIME types when
+            filling the MIME type cache.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::updateRegionForLine): Don't set the containing
-        region if the block doesn't have a range. The returned value would not
-        be correctly clamped.
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBlock::hasRegionRangeInFlowThread):
-        * rendering/RenderBox.h:
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo): Iterate only over
-        the range of the box, not from the start of the region chain.
-        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock): Same as
-        above.
-        (WebCore::RenderFlowThread::hasCachedRegionRangeForBox):
-        (WebCore::RenderFlowThread::getRegionRangeForBoxFromCachedInfo):
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
-        (WebCore::RenderFlowThread::computedRegionRangeForBox): Best effort function
-        to determine the range of a box. It will always return something as long
-        as the flow thread has regions.
-        (WebCore::RenderFlowThread::objectShouldFragmentInFlowRegion): Use the new function
-        to determine the range.
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::absoluteQuadsForBox): Use the new function to determine
-        the range.
</del><ins>+            * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+            (WebCore::shouldRejectMIMEType): Added utility function.
</ins><span class="cx"> 
</span><del>-2014-05-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-11-07  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix &quot;ASSERTION FAILED: m_representation == PlatformLayerRepresentation&quot; with UI-side compositing
-        https://bugs.webkit.org/show_bug.cgi?id=132899
</del><ins>+        Merge r158743
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+    2013-11-06  Chris Fleizach  &lt;cfleizach@apple.com&gt; 

+        AX: Audio and Video attachments are not output to VoiceOver 
+        https://bugs.webkit.org/show_bug.cgi?id=123479 
</ins><span class="cx"> 
</span><del>-        Export some things
</del><ins>+        Reviewed by Mario Sanchez Prada. 
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        Video and audio elements don't appear as distinct objects in the AX hierarchy, 
+        nor are they treated as replaceable objects when emitting the text. We should 
+        treat these characters like attachments, for one. On the Mac platform, we should 
+        also identify them with special subroles. 
</ins><span class="cx"> 
</span><del>-2014-05-13  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+        Tests: platform/mac/accessibility/media-emits-object-replacement.html 
+              platform/mac/accessibility/media-role-descriptions.html 

+        * accessibility/AccessibilityNodeObject.cpp: 
+        (WebCore::AccessibilityNodeObject::isGenericFocusableElement): 
+        * accessibility/AccessibilityObject.h: 
+        * accessibility/AccessibilityRenderObject.cpp: 
+        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored): 
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): 
+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm: 
+        (createAccessibilityRoleMap): 
+        (-[WebAccessibilityObjectWrapper subrole]): 
+        (-[WebAccessibilityObjectWrapper roleDescription]): 
+        * editing/TextIterator.cpp: 
+        (WebCore::isRendererReplacedElement): 
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] line height grows around polygon and incorrectly causes text to wrap to next line
-        https://bugs.webkit.org/show_bug.cgi?id=131622
</del><ins>+2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+        Merge r158617
</ins><span class="cx"> 
</span><del>-        Corrected an earlier PolygonShape fix https://bugs.webkit.org/show_bug.cgi?id=132132
-        When the top or bottom of a layout line is coincident with a polygon edge vertex, we
-        only consider it an intersection if the edge extends into the line.
</del><ins>+    2013-11-04  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/shapes/shape-outside-floats/shape-outside-edge-case.html
</del><ins>+            AX: Mail attachments at the start of an email are not output by VoiceOver
+            https://bugs.webkit.org/show_bug.cgi?id=123697
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/PolygonShape.cpp:
-        (WebCore::OffsetPolygonEdge::clippedEdgeXRange):
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-05-13  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            VoiceOver is expecting that &quot;replaced elements&quot; (attachments in a Mail message in this case) to be
+            represented by the replacement character when asking for a stringForRange.
</ins><span class="cx"> 
</span><del>-        m_layerForOverhangAreas is sometimes not positioned correctly when topContentInset 
-        has changed
-        https://bugs.webkit.org/show_bug.cgi?id=132898
-        -and corresponding-
-        &lt;rdar://problem/16644710&gt;
</del><ins>+            However, when that replaced element is at the beginning of the document, the logic does not work because
+            there is a few code places that will take that first Position and advance it forward, not accounting for replaced elements.
+            When using the TextIterator normally, it does account for these, so that's why it's only affecting as at the beginning of the document.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Also a &quot;replaced element&quot; can be more than just renderer-&gt;isReplaced(), hence the externing of the isRendererReplacedElement method
+            and using that it in pertinent places.
</ins><span class="cx"> 
</span><del>-        This function is called whenever the topContentInset changes, so use it as an 
-        opportunity to ensure that m_layerForOverhangAreas has been positioned correctly.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::frameViewDidChangeSize):
</del><ins>+            Tests: platform/mac/accessibility/object-replacement-with-no-rendered-children-at-node-start.html
+                   platform/mac/accessibility/object-replacement-with-rendered-children-at-node-start.html
</ins><span class="cx"> 
</span><del>-        Everyone gets an anchor point!
-        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
</del><ins>+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::replacedNodeNeedsCharacter):
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (nsStringForReplacedNode):
+            * dom/Position.cpp:
+            (WebCore::Position::isCandidate):
+            * dom/PositionIterator.cpp:
+            * dom/Range.cpp:
+            (WebCore::Range::firstNode):
+            * editing/TextIterator.cpp:
+            (WebCore::isRendererReplacedElement):
+            * editing/TextIterator.h:
</ins><span class="cx"> 
</span><del>-2014-05-13  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Attempted build fix after https://bugs.webkit.org/show_bug.cgi?id=132891
</del><ins>+        Merge r158629
</ins><span class="cx"> 
</span><del>-        * page/PageDebuggable.cpp:
</del><ins>+    2013-11-04  Samuel White  &lt;samuel_white@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+            AX: AXShowMenu doesn't always work.
+            https://bugs.webkit.org/show_bug.cgi?id=123649
</ins><span class="cx"> 
</span><del>-        Force developerExtrasEnabled when a remote Inspector client connects.
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=132891
</del><ins>+            No new tests, the change occurs in a code path that forces the context menu to show which
+            locks up DRT if we try to test it (platform menu is shown). The change itself gives the mouse
+            event handler a chance to handle our platform mouse event BEFORE the event ends up in the show
+            context menu machinery. This is necessary because without it, the element will not become
+            focused. Without focus, accessibility shows different/less menu items than a mouse click. The
+            end result is that context menus shown via accessibility are consistent with menus shown via click.
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+            * page/ContextMenuController.cpp:
+            (WebCore::ContextMenuController::showContextMenuAt):
</ins><span class="cx"> 
</span><del>-        * page/PageDebuggable.cpp:
-        (WebCore::PageDebuggable::PageDebuggable): Initialize m_forcedDeveloperExtrasEnabled to false.
-        (WebCore::PageDebuggable::connect): Set m_forcedDeveloperExtrasEnabled if the setting is changed.
-        (WebCore::PageDebuggable::disconnect): Switch developerExtrasEnabled back to false
-        if m_forcedDeveloperExtrasEnabled is true.
-        * page/PageDebuggable.h: Added m_forcedDeveloperExtrasEnabled.
</del><ins>+2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Merge r154391
</ins><span class="cx"> 
</span><del>-        REGRESSION (topContentInset): Searching through Facebook Messenger's chat causes 
-        scrolling in News Feed
-        https://bugs.webkit.org/show_bug.cgi?id=132889
-        -and corresponding-
-        &lt;rdar://problem/16715716&gt;
</del><ins>+    2013-08-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            &lt;https://webkit.org/b/120113&gt; [Windows] Enable CSS_IMAGE_SET
</ins><span class="cx"> 
</span><del>-        First of all, scrollOffsetRelativeToDocument() was very poorly named. This patch 
-        re-names it to the much more accurate documentScrollOffsetRelativeToViewOrigin(). 
-        Re-naming it makes it clear that ONE call site was not getting the right offset. 
-        That call site does not want to know the document’s position relative to the view 
-        origin, but rather it wants to know the Document’s position relative to the 
-        scrolling origin.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Export new name.
-        * WebCore.exp.in:
</del><ins>+            We can now activate:
+            fast/css/image-set-parsing.html
+            fast/css/image-set-parsing-invalid.html
</ins><span class="cx"> 
</span><del>-        Use newly re-named documentScrollPositionRelativeToViewOrigin().
-        * page/FrameView.cpp:
-        (WebCore::FrameView::convertToRenderer):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::documentScrollOffsetRelativeToViewOrigin):
-        (WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin):
-        (WebCore::ScrollView::documentScrollOffsetRelativeToScrollableAreaOrigin):
-        (WebCore::ScrollView::rootViewToContents):
-        (WebCore::ScrollView::windowToContents):
-        (WebCore::ScrollView::scrollOffsetRelativeToDocument): Deleted.
-        (WebCore::ScrollView::scrollPositionRelativeToDocument): Deleted.
-        * platform/ScrollView.h:
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add missing image set implementation files.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
+            * css/CSSAllInOne.cpp: Add missing CSSImageSetValue.cpp
+            * rendering/style/StyleAllInOne.cpp: Add missing StyeCachedImageSet.cpp
</ins><span class="cx"> 
</span><del>-        THIS is the spot that needs the new function, 
-        documentScrollOffsetRelativeToScrollableAreaOrigin()()
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollRectToVisible):
</del><ins>+2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Merge r155130
</ins><span class="cx"> 
</span><del>-        [iOS] Page scale update messages for media controls should only fire at the end of zooming
-        https://bugs.webkit.org/show_bug.cgi?id=132857
-        &lt;rdar://problem/16631009&gt;
</del><ins>+    2013-09-05  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            [Windows] Unreviewed build/link improvement after r155127 to be
+            consistent about using debug-build support libraries.
</ins><span class="cx"> 
</span><del>-        As the user was zooming, the media controls that responded
-        to the page scale (and resized themselves) would do so
-        slightly out of sync with the screen refreshes, and it looked
-        terrible. They really only need to get told at the end
-        of the zoom that they need to relayout.
</del><ins>+            Now that &lt;rdar://problem/9898937&gt; is resolved, we should be linking
+            to debug AVFoundationCF as well.
</ins><span class="cx"> 
</span><del>-        Allow setPageScaleFactor to accept another parameter
-        that indicates if the change is stable. That way, changes
-        during a user triggers zoom gesture can be ignored for
-        media controls.
</del><ins>+            * page/CaptionUserPreferencesMediaAF.cpp: Link to AVFoundationCF_debug
+            when building with the DEBUG_ALL target.
+            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Ditto.
+            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Ditto.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Page::setPageScaleFactor takes a new parameter.
-        * dom/Document.cpp:
-        (WebCore::Document::pageScaleFactorChangedAndStable): Renamed from pageScaleFactorChanged.
-        (WebCore::Document::pageScaleFactorChanged): Deleted.
-        * dom/Document.h:
-        * page/Page.cpp:
-        (WebCore::Page::setPageScaleFactor): Accepts a new inStableState parameter,
-        and tells the main frame that the scale factor has changed if it's stable.
-        * page/Page.h:
</del><ins>+2013-11-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Merge r157773
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r168755.
</del><ins>+2013-10-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive):
</del><ins>+        [WIN] Properly support reverse animations without needing software fallback.
+        https://bugs.webkit.org/show_bug.cgi?id=85121
</ins><span class="cx"> 
</span><del>-2014-05-13  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        [Mac] hasVideo should return true when video is ready to display
-        https://bugs.webkit.org/show_bug.cgi?id=132885
</del><ins>+        Testing is provided by existing animation tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        * platform/animation/TimingFunction.h:
+        (WebCore::CubicBezierTimingFunction::createReversed): Added.
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::addAnimation): The early return when performing a reverse or
+        autoreverse animation is no longer needed.
+        * platform/graphics/ca/PlatformCAAnimation.h:
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (toCAMediaTimingFunction): Use new reversed function.
+        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+        (toCACFTimingFunction): Ditto.
+        (PlatformCAAnimation::setTimingFunction): Pass 'reverse' flag.
+        (PlatformCAAnimation::setTimingFunctions): Ditto.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
</del><ins>+2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/AudioTrackPrivateAVFObjC.mm:
-        (WebCore::AudioTrackPrivateAVFObjC::resetPropertiesFromTrack): Don't change the
-            enabled state of the AVPlayerItemTrack during setup.
</del><ins>+        Merge r154180
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): Initialize
-            m_cachedIsReadyForDisplay.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Remove &quot;enabled&quot; KVO observers.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer): Observe &quot;readyForDisplay&quot;
-            change notifications.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): Remove for &quot;readyForDisplay&quot;
-            observer.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::hasAvailableVideoFrame): Return cached readyForDisplay
-            state instead of polling every time.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Call setHasVideo(true) if the
-            player layer is ready for display.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateAudioTracks): Update logging.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoTracks): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::firstFrameAvailableDidChange): Cache readyForDisplay
-            state, call tracksChanged() if we haven't seen a video track yet.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::trackEnabledDidChange): New.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive): Correct logging.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksDidChange): Remove old &quot;enabled&quot; listeners
-            before release tracks, add new ones to new tracks.
-        (WebCore::assetTrackMetadataKeyNames): Add &quot;enabled&quot; to the list of properties we require to 
-            be loaded before announcing that metadata has loaded.
-        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]): Observe 
-            &quot;readyForDisplay&quot; and &quot;enabled&quot;.
</del><ins>+    2013-08-15  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/VideoTrackPrivateAVFObjC.cpp:
-        (WebCore::VideoTrackPrivateAVFObjC::resetPropertiesFromTrack): Don't change the
-            enabled state of the AVPlayerItemTrack during setup.
</del><ins>+            [Windows] Prevent dangling CACFLayer when switching to/from Tiled backing.
+            https://bugs.webkit.org/show_bug.cgi?id=119818
</ins><span class="cx"> 
</span><del>-2014-05-13  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Text decorations do not contribute to visual overflow
-        https://bugs.webkit.org/show_bug.cgi?id=132773
</del><ins>+            Covered by existing: compositing/tiling/empty-to-tiled.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+            (PlatformCALayer::~PlatformCALayer): Remove deleted layer from its
+            parent layer 
</ins><span class="cx"> 
</span><del>-        Tests: fast/css3-text/css3-text-decoration/repaint/underline-outside-of-layout-rect.html
</del><ins>+2013-11-04  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/InlineTextBox.cpp:
-        (WebCore::textDecorationStrokeThickness): Refactor into a common function
-        (WebCore::wavyOffsetFromDecoration): Ditto
-        (WebCore::InlineTextBox::extendVerticalVisualOverflowForDecorations): Given
-        vertical overflow bounds, possibly extend those to include location of
-        decorations.
-        (WebCore::InlineTextBox::paintDecoration): Use refactored functions.
-        * rendering/InlineTextBox.h: Function signature
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::setLogicalWidthForTextRun): Call extendVerticalVisualOverflowForDecorations()
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeAffectsVisualOverflow): Inspects shadows and text decorations
-        (WebCore::RenderStyle::changeRequiresLayout): Calls changeAffectsVisualOverflow()
-        (WebCore::RenderStyle::changeRequiresRepaintIfTextOrBorderOrOutline): Moved code from here
-        to changeAffectsVisualOverflow().
-        * rendering/style/RenderStyle.h: Function signature
</del><ins>+        &lt;rdar://problem/15292359&gt;
+        Merge r157299
</ins><span class="cx"> 
</span><del>-2014-05-13  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+    2013-10-10  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (WebKit2): Zooming to text field leaves it partially hidden by the form assistant.
-        https://bugs.webkit.org/show_bug.cgi?id=132879
-        &lt;rdar://problem/16318049&gt;
</del><ins>+            Use after free in WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded
+            https://bugs.webkit.org/show_bug.cgi?id=121033
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Adding some exports. The fix to setScrollPosition is to avoid clamping the scroll
-        position when using delegate scrolling.
</del><ins>+            For safe iteration, use a set rather than a vector, and remove the clients from
+            the set if they are removed during iteration.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setScrollPosition):
</del><ins>+            Test: fast/animation/request-animation-frame-remove-client.html
</ins><span class="cx"> 
</span><del>-2014-05-13  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+            * platform/graphics/DisplayRefreshMonitor.cpp:
+            (WebCore::DisplayRefreshMonitor::DisplayRefreshMonitor): Initialize the
+            m_clientsToBeNotified pointer to null.
+            (WebCore::DisplayRefreshMonitor::removeClient): If there is a m_clientsToBeNotified
+            set, remove from it as well as the real m_clients set.
+            (WebCore::DisplayRefreshMonitor::displayDidRefresh): Use a HashSet instead of a
+            vector for the copy of the clients set we iterate.
</ins><span class="cx"> 
</span><del>-        Followup to: Update positioning/drawing of the image controls button.
-        &lt;rdar://problem/16885077&gt; and https://bugs.webkit.org/show_bug.cgi?id=132883
</del><ins>+            * platform/graphics/DisplayRefreshMonitor.h: Moved some of the BlackBerry-specific
+            part of this out of the header. Added a new HashSet pointer, m_clientsToBeNotified,
+            to be used to remove clients during the notification process. Also added a FIXME.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp: Moved the
+            DisplayAnimationClient class in here.
</ins><span class="cx"> 
</span><del>-        Cleared up the actual intent behind review feedback on the original patch.
</del><ins>+2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        (WebCore::ImageControlsButtonElementMac::maybeCreate):
</del><ins>+        Merge r157436
</ins><span class="cx"> 
</span><del>-2014-05-13  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+    2013-10-14  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Update positioning/drawing of the image controls button.
-        &lt;rdar://problem/16885077&gt; and https://bugs.webkit.org/show_bug.cgi?id=132883
</del><ins>+            Crash in WebCore::BidiResolver&lt;WebCore::InlineIterator, WebCore::BidiRun&gt;::createBidiRunsForLine
+            https://bugs.webkit.org/show_bug.cgi?id=122776
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        (WebCore::ImageControlsButtonElementMac::maybeCreate): Add inline style for top/right
-          positioning based on the metrics from the render theme.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/aca89bc4d984705a1f94b623dae0ab03e239a248
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/imageControlsMac.css:
-        (.x-webkit-image-controls-button): Can’t hard code any positioning.
</del><ins>+            Fix modification of whitespace endpoints to not assume it's operating on RenderTexts
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::imageControlsButtonPositionOffset):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::servicesRolloverButtonCell):
-        (WebCore::RenderThemeMac::imageControlsButtonPositionOffset):
</del><ins>+            During line layout, we use midpoints to identify RenderObjects, or parts of
+            RenderObjects, that don't need InlineBoxes, usually because of collapsed whitespace.
</ins><span class="cx"> 
</span><del>-2014-05-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Prior to actually creating BidiRuns (the precursor to InlineBoxes), we use
+            checkMidpoints to fix up our lineMidpointState to handle the case where we start
+            ignoring spaces in our line, but don't stop until somewhere on the following line.
+            Previously, this function assumed that the final midpoint (called an endpoint)
+            was a RenderText, but this assumption is wrong if we have a beginning midpoint
+            created by shouldSkipWhitespaceAfterStartObject (which handles inlines and list
+            markers) and no endpoint on that line. In that case, we'd instead adjust the
+            position backwards on the beginning midpoint, which would cause us to fail to
+            create an InlineBox for the inline or list marker. In the new test added, this
+            would actually trigger a crash due to an assumption when visually re-ordering
+            BidiRuns that a non-empty line would actually contain at least one such run.
</ins><span class="cx"> 
</span><del>-        [iOS WK2] background-attachment:fixed behaves very poorly
-        https://bugs.webkit.org/show_bug.cgi?id=132881
-        &lt;rdar://problem/16789526&gt;
</del><ins>+            Test: fast/text/whitespace/whitespace-and-margin-wrap-after-list-marker-crash.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::checkMidpoints):
</ins><span class="cx"> 
</span><del>-        Remove the old ENABLE_FAST_MOBILE_SCROLLING code, and add a setting that
-        controls whether fixed backgrounds paint relative to the document, which
-        is enabled for iOS (WK1 and WK2). This setting is consulted when we repaint
-        fixed backgrounds on scrolling, when we paint them, and when we decide to make
-        a layer for fixed backgrounds.
-        
-        * page/Settings.cpp:
-        * page/Settings.in:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::styleWillChange):
-        (WebCore::RenderElement::willBeRemovedFromTree):
-        (WebCore::shouldRepaintFixedBackgroundsOnScroll): Deleted.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::needsFixedRootBackgroundLayer):
</del><ins>+2013-11-01  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Merge r157070
</ins><span class="cx"> 
</span><del>-        REGRESSSION(r168528) Subpixel rendering: Selection rect is not positioned properly when SVG text is selected.
-        https://bugs.webkit.org/show_bug.cgi?id=132868
</del><ins>+    2013-10-04  Ojan Vafai  &lt;ojan@chromium.org&gt; and Martin Robinson  &lt;mrobinson@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            [MathML] Remove RenderTree modification during layout and refactor the StretchyOp code
+            https://bugs.webkit.org/show_bug.cgi?id=121416
</ins><span class="cx"> 
</span><del>-        Scale the selection rect. r168528 missed applying this final transform on the selection/painting rect.
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Test: svg/text/hidpi-text-selection-rect-position.html
</del><ins>+            Tests: mathml/presentation/mo-minus.html
+                mathml/presentation/mo-stacked-glyphs.html
+                mathml/presentation/mo-stretchy-vertical-bar.html
+                mathml/very-large-stretchy-operators.html
</ins><span class="cx"> 
</span><del>-        * rendering/svg/SVGInlineTextBox.cpp:
-        (WebCore::SVGInlineTextBox::selectionRectForTextFragment):
</del><ins>+            MathML stretched operators by both modifying the width of the operator
+            and adding children to the operator node in the render tree.
</ins><span class="cx"> 
</span><del>-2014-05-13  Martin Hodovan  &lt;mhodovan.u-szeged@partner.samsung.com&gt;
</del><ins>+            Instead we make the operator width equal to the widest glyph possible that we use
+            to represent the operator.  Additionally instead of rendering stretchy glyphs via
+            stacked operator pieces in separate render tree nodes, keep only one node for the
+            glyph, and use a custom paint method to paint the stacked representation.
</ins><span class="cx"> 
</span><del>-        ASSERTION FAILED: leftCategory != CalcOther &amp;&amp; rightCategory != CalcOther
-        in WebCore::CSSCalcBinaryOperation::createSimplified
-        https://bugs.webkit.org/show_bug.cgi?id=132870
</del><ins>+            With this patch, rendering seems roughly equivalent on Mac and markedly better
+            on Linux.
</ins><span class="cx"> 
</span><del>-        According to the standard, calc() should be able to handle angle, time
-        and frequency values as well: http://www.w3.org/TR/css3-values/#calc
</del><ins>+            * css/mathml.css:
+            Not sure what this line-height:0 was here for, but it caused bugs with the new code
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * mathml/MathMLTextElement.cpp:
+            (WebCore::MathMLTextElement::attach):
+            (WebCore):
+            (WebCore::MathMLTextElement::childrenChanged):
+            Need to update the anonymous render tree below &lt;mo&gt; elements when their
+            children change or when the renderer is first attached.
</ins><span class="cx"> 
</span><del>-        Test: fast/css/calc-with-angle-time-frequency.html
</del><ins>+            * mathml/MathMLTextElement.h:
+            (MathMLTextElement):
+            * rendering/mathml/RenderMathMLBlock.cpp:
+            (WebCore::RenderMathMLBlock::RenderMathMLBlock):
+            * rendering/mathml/RenderMathMLBlock.h:
+            Now that the preferred width doesn't depend on the height, we don't
+            need to override computePreferredLogicalWidths at all.
</ins><span class="cx"> 
</span><del>-        * css/CSSCalculationValue.cpp:
-        (WebCore::unitCategory):
-        (WebCore::CSSCalcPrimitiveValue::createCalcExpression):
-        (WebCore::CSSCalcPrimitiveValue::computeLengthPx):
-        (WebCore::CSSCalcPrimitiveValue::addSubtractResult):
-        (WebCore::CSSCalcPrimitiveValue::determineCategory):
-        (WebCore::CSSCalcBinaryOperation::primitiveType)
-        * css/CSSCalculationValue.h: extending CalculationCategory
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validCalculationUnit):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::primitiveType):
</del><ins>+            * rendering/mathml/RenderMathMLFenced.cpp:
+            (WebCore::RenderMathMLFenced::makeFences):
+            (WebCore::RenderMathMLFenced::styleDidChange):
+            Need to update the anonymous renderers for the anonymous RenderMathMLOperators.
</ins><span class="cx"> 
</span><del>-2014-05-13  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+            * rendering/mathml/RenderMathMLOperator.cpp:
+            (WebCore::RenderMathMLOperator::expandedStretchHeight):
+            Store the non-expanded stretch height so that we can detect when the height
+            actually changed.
</ins><span class="cx"> 
</span><del>-        Try to fix the !ENABLE(ICONDATABASE) build
</del><ins>+            (WebCore::RenderMathMLOperator::stretchToHeight):
+            Only update the style on the anonymous render tree since this is called
+            from RenderMathMLRow::layout
</ins><span class="cx"> 
</span><del>-        * loader/icon/IconDatabase.h: Include WTFString.h.
</del><ins>+            (WebCore::RenderMathMLOperator::styleDidChange):
+            (WebCore::RenderMathMLOperator::glyphBoundsForCharacter): A helper to get glyph boundaries.
+            (WebCore::RenderMathMLOperator::glyphHeightForCharacter): Ditto for glyph width.
+            (WebCore::RenderMathMLOperator::advanceForCharacter): The advance is different from the width,
+            and we want the width of the operator to be the advance instead of the tight bounding width.
+            (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Use the max of all possible glyphs
+            we can use to render this operator.
+            (WebCore::RenderMathMLOperator::computeLogicalHeight): Return the stretched operator height, if appropriate.
+            (WebCore::RenderMathMLOperator::updateFromElement): We add a child for rendering the non-scaled
+            version of the glyph.
+            (WebCore::RenderMathMLOperator::firstCharacterForStretching): Helper to figure out what character
+            is the character used for stretching operations.
+            (WebCore::RenderMathMLOperator::findAcceptableStretchyCharacter): Helper to find an acceptable set
+            of glyph pieces for stretching characters.
+            (WebCore::RenderMathMLOperator::updateStyle): Resize the operator to the appropriate height and hide
+            the child if we are using the stretchy style.
+            (WebCore::RenderMathMLOperator::firstLineBoxBaseline):
+            (WebCore::RenderMathMLOperator::paintCharacter): Helper to paint a single character component of the
+            stretchy glyph.
+            (WebCore::RenderMathMLOperator::fillWithExtensionGlyph): Helper to paint the extender glue between
+            features of the stretchy glyph.
+            (WebCore::RenderMathMLOperator::paint): Properly paint stretchy glyphs.
+            * rendering/mathml/RenderMathMLOperator.h: Update method declarations.
</ins><span class="cx"> 
</span><del>-2014-05-13  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+2013-11-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION(r167771): [GTK] Text fields and areas are rendered unthemed
-        https://bugs.webkit.org/show_bug.cgi?id=132864
</del><ins>+        Merge r158334
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+    2013-10-30  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This is because the virtual methods changed the API in the parent,
-        and since we don't have the methods marked as override we didn't
-        noticed it. After using override keyword for all virtual methods
-        in the derived class another problem showed up, the ActiveListBox
-        selection methods were incorrectly named.
</del><ins>+            [Win] Legible Output callbacks should happen on notification queue
+            https://bugs.webkit.org/show_bug.cgi?id=123545
</ins><span class="cx"> 
</span><del>-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::paintTextArea): Update to API changes in the
-        parent class.
-        * platform/gtk/RenderThemeGtk.h: Mark all virtual methods as
-        override and the class as final.
-        * platform/gtk/RenderThemeGtk2.cpp:
-        (WebCore::RenderThemeGtk::paintTextField): Update to API changes
-        in the parent class.
-        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeGtk::activeListBoxSelectionBackgroundColor): Deleted.
-        (WebCore::RenderThemeGtk::inactiveListBoxSelectionBackgroundColor): Deleted.
-        (WebCore::RenderThemeGtk::activeListBoxSelectionForegroundColor): Deleted.
-        (WebCore::RenderThemeGtk::inactiveListBoxSelectionForegroundColor): Deleted.
-        * platform/gtk/RenderThemeGtk3.cpp:
-        (WebCore::RenderThemeGtk::paintTextField): Update to API changes
-        in the parent class.
-        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeGtk::activeListBoxSelectionBackgroundColor): Deleted.
-        (WebCore::RenderThemeGtk::inactiveListBoxSelectionBackgroundColor): Deleted.
-        (WebCore::RenderThemeGtk::activeListBoxSelectionForegroundColor): Deleted.
-        (WebCore::RenderThemeGtk::inactiveListBoxSelectionForegroundColor): Deleted.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-13  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</del><ins>+            Modify the callback creation for Legible Output items so that they
+            are made on our notification queue. The use of the main queue was a
+            holdover from some temporary code used during earlier development.
</ins><span class="cx"> 
</span><del>-        [GStreamer] Move toGstClockTime to utilities
-        https://bugs.webkit.org/show_bug.cgi?id=132702
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::AVFWrapper::AVFWrapper): Assert this happens on the main thread.
+            (WebCore::AVFWrapper::~AVFWrapper): Ditto.
+            (WebCore::destroyAVFWrapper): Ditto.
+            (WebCore::AVFWrapper::createPlayer): Ditto.
+            (WebCore::AVFWrapper::createPlayerItem): Ditto.
+            Also, instruct LegibleOutput callbacks to happen on our notification
+            queue, rather than the main thread.
+            (WebCore::AVFWrapper::createAVCFVideoLayer): Assert this happens on the main thread.
+            (WebCore::AVFWrapper::destroyVideoLayer): Ditto.
+            (WebCore::AVFWrapper::createImageGenerator): Ditto.
+            (WebCore::AVFWrapper::destroyImageGenerator): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+2013-10-31  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        toGstClockTime should be in GStreamerUtilities and corrected typo
-        in getGstPlayFlag.
</del><ins>+        Merge r157183
</ins><span class="cx"> 
</span><del>-        No new tests needed.
</del><ins>+    2013-10-09  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/GStreamerUtilities.cpp:
-        (WebCore::getGstPlayFlag): Renamed from getGstPlaysFlag.
-        (WebCore::toGstClockTime): Moved from MediaPlayerPrivateGStreamer.
-        (WebCore::getGstPlaysFlag): Deleted.
-        * platform/graphics/gstreamer/GStreamerUtilities.h:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::setDownloadBuffering):
-        Corrected getGstPlayFlag typo.
-        (WebCore::toGstClockTime): Deleted.
</del><ins>+            AX: VoiceOver double speaks all items in &lt;li&gt; nodes
+            https://bugs.webkit.org/show_bug.cgi?id=122564
</ins><span class="cx"> 
</span><del>-2014-05-12  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Make a few icon database improvements
-        https://bugs.webkit.org/show_bug.cgi?id=132812
</del><ins>+            Test: platform/mac/accessibility/native-list-item-should-not-expose-label.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+            * accessibility/AccessibilityNodeObject.cpp:
+            (WebCore::AccessibilityNodeObject::visibleText):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export more IconDatabase functions, since they are now called
-        by WebKit2 through pointers to a class marked final.
</del><ins>+2013-10-31  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/icon/IconDatabase.cpp: Removed unneeded includes. Use override for
-        virtual functions.
</del><ins>+        Merge r157056
</ins><span class="cx"> 
</span><del>-        * loader/icon/IconDatabase.h: Removed unneeded includes. Marked the class final.
-        Use override for virtual functions. Use a public constructor instead of a create
-        function.
</del><ins>+    2013-10-07  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/icon/IconDatabaseBase.h: Removed unneeded includes.
</del><ins>+            Animated images are not restarted when page visibility changes
+            https://bugs.webkit.org/show_bug.cgi?id=122464
+            &lt;rdar://problem/14293474&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Kiran  &lt;kiran.guduru@samsung.com&gt;
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        [MediaStream] MediaStream.addTrack Should not check for active state.
-        https://bugs.webkit.org/show_bug.cgi?id=132558
</del><ins>+            Always kickstart animated images when the page visibility changes,
+            which can occur via window occlusion, and which is independent of in-window
+            state, which we were previously using to advance animation.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            No new tests; attempts to make a test have resulted only in a flaky, timing-dependent test.
</ins><span class="cx"> 
</span><del>-        MediaStream.addTrack method is checking for active state of a
-        MediaStream, but it should not check for active state while adding a Track.
</del><ins>+            * page/Frame.cpp:
+            (WebCore::Frame::resumeActiveDOMObjectsAndAnimations):
+            Move this call to resumeAnimatingImages() up to Page.
</ins><span class="cx"> 
</span><del>-        Test: fast/mediastream/MediaStream-add-tracks-to-inactive-stream.html
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::setIsInWindow):
+            Move this call to resumeAnimatingImages() up to Page.
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/MediaStream.cpp:
-        (WebCore::MediaStream::addTrack):
</del><ins>+            * WebCore.exp.in
+            * page/FrameView.h:
+            * page/Page.h:
+            Move resumeAnimatingImages() itself up to Page.
</ins><span class="cx"> 
</span><del>-2014-05-12  Mark Lam  &lt;mark.lam@apple.com&gt;
</del><ins>+            * page/Page.cpp:
+            (WebCore::Page::setIsInWindow):
+            Resume animated images when we move in-window.
</ins><span class="cx"> 
</span><del>-        WebKit2 on iOS needs to capture the main thread's floating point environment.
-        &lt;https://webkit.org/b/132755&gt;
</del><ins>+            (WebCore::Page::setVisibilityState):
+            Resume animated images when we become visible.
+            This is the one we were previously missing.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            (WebCore::Page::resumeActiveDOMObjectsAndAnimations):
+            Resume animated images when we're told to.
</ins><span class="cx"> 
</span><del>-        For iOS, WorkerThread::workerThread() expects to be able to initialize the
-        worker thread's floating point environment to be the same as the one in the
-        main thread.  The FP env of the main thread is expected to have been captured
-        in the mainThreadFEnv global.  On WebKit2 for iOS, we neglected to initialize
-        mainThreadFEnv.
</del><ins>+            (WebCore::Page::resumeAnimatingImages):
+            Kickstart any animated images in all frames.
</ins><span class="cx"> 
</span><del>-        We now introduce a FloatingPointEnvironment class that will encapsulate the main
-        thread (aka &quot;UIThread&quot;) fenv, and we'll call FloatingPointEnv::saveMainThreadEnvironment()
-        from ChildProcess::platformInitialize() to ensure that the FloatingPointEnvironment
-        singleton instance is initialized properly for WebKit2.
</del><ins>+2013-10-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        In the ChildProcess::platformInitialize(), we also need to initialize the ARMv7
-        FP env to support denormalized numbers.  We'll do this before calling
-        saveMainThreadEnvironment().
</del><ins>+        
+        Merge r155221.
</ins><span class="cx"> 
</span><del>-        Tests: fast/workers/worker-floating-point.html
-               js/floating-point-denormalized.html
</del><ins>+ 
+    2013-09-06  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/ios/wak/FloatingPointEnvironment.cpp: Added.
-        (WebCore::FloatingPointEnvironment::env):
-        (WebCore::FloatingPointEnvironment::FloatingPointEnvironment):
-        (WebCore::FloatingPointEnvironment::enableDenormalSupport):
-        (WebCore::FloatingPointEnvironment::saveMainThreadEnvironment):
-        (WebCore::FloatingPointEnvironment::propagateMainThreadEnvironment):
-        * platform/ios/wak/FloatingPointEnvironment.h: Added.
-        * platform/ios/wak/WebCoreThread.h:
-        * platform/ios/wak/WebCoreThread.mm:
-        (RunWebThread):
-        (StartWebThread):
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::workerThread):
</del><ins>+            [Windows] StructuredExceptionHandlerSuppressor Causes Bad Interactions with Support Libraries
+            https://bugs.webkit.org/show_bug.cgi?id=120901
</ins><span class="cx"> 
</span><del>-2014-05-12  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        SVG root element accepts background color but fails to repaint it
-        https://bugs.webkit.org/show_bug.cgi?id=63153
</del><ins>+            Change from old &quot;crash on any exception&quot; implementation to a new version that leaves normal
+            exception handling infrastructure in place for use by support libraries. We check exceptions
+            and decide whether to abort or not based on the failure type.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add new implementation files.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
+            * platform/graphics/ca/win/LayerChangesFlusher.cpp:
+            (WebCore::LayerChangesFlusher::hookCallback): Allocate handler struct on stack.
+            * platform/win/StructuredExceptionHandlerSuppressor.cpp: Added.
+            (exceptionShouldTerminateProgram): New.
+            (exceptionHandler): New.
+            (WebCore::StructuredExceptionHandlerSuppressor::StructuredExceptionHandlerSuppressor): Moved
+            from header, and updated to add our new exception handler.
+            (WebCore::StructuredExceptionHandlerSuppressor::~StructuredExceptionHandlerSuppressor): Moved
+            from header.
+            * platform/win/StructuredExceptionHandlerSuppressor.h: Move implementation of constructor and
+            destructor from header file.
+            * platform/win/makesafeseh.asm: Added.
</ins><span class="cx"> 
</span><del>-        This is back ported from Blink. Don't know the exact commit though.
-        The patch checks if the SVGSVGElement is an outermost root element.
-        If it is, mark the whole element for repaint.
</del><ins>+2013-10-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/svg-root-background.html
</del><ins>+        Merge r155215.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateHasBoxDecorations):
-        (WebCore::RenderBoxModelObject::updateFromStyle):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::RenderSVGRoot):
-        (WebCore::RenderSVGRoot::layout):
-        (WebCore::RenderSVGRoot::paintReplaced):
-        (WebCore::RenderSVGRoot::clippedOverflowRectForRepaint):
-            This is a simple optimization by taking the necessary parts
-            from RenderReplaced and SVGRenderSupport.
-        * rendering/svg/RenderSVGRoot.h:
</del><ins>+     2013-09-06  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            [Windows] Unreviewed gardening: Spell 'Suppressor' properly
</ins><span class="cx"> 
</span><del>-        [iOS] Fixed items are sometimes clipped after rubber-banding
-        https://bugs.webkit.org/show_bug.cgi?id=132851
-        &lt;rdar://problem/16870790&gt;
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Change StructuredExceptionHandlerSupressor to StructuredExceptionHandlerSuppressor
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto
+            * platform/graphics/ca/win/LayerChangesFlusher.cpp:
+            (WebCore::LayerChangesFlusher::hookCallback): Ditto
+            * platform/win/StructuredExceptionHandlerSuppressor.h: Copied from platform/win/StructuredExceptionHandlerSupressor.h.
+            * platform/win/StructuredExceptionHandlerSupressor.h: Removed.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+2013-10-28  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        On iOS fixed-position layers would get clipped to the document rect,
-        but with rubber-banding, we can now have a custom fixed postion rect
-        that extends outside the document rect.
-        
-        Another issue was that we would un-composite fixed elements sometimes
-        when scrolling fast, again because they could fall outside of the document rect.
-        
-        A final issue was that pinching could reveal parts of fixed elements that should
-        lie outside the viewport, rather than clipping the layers.
-        
-        Fix by converting both call points to use viewportConstrainedVisibleContentRect()
-        rather than viewportConstrainedExtentRect(). On non-iOS platforms these are
-        the same, but on iOS viewportConstrainedVisibleContentRect() uses the
-        custom fixed position rect, which is the correct rect to intersect with.
</del><ins>+        Merge r157298
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
</del><ins>+    2013-10-10  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-06  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+            Use after free in WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded
+            http://webkit.org/b/121033
</ins><span class="cx"> 
</span><del>-        Don't dispatch 'beforeload' event inside FrameView::layout()
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=132621
-        &lt;rdar://problem/15661470&gt;
</del><ins>+            Add an ASSERT to detect if an animation client will be removed
+            during the callback dispatch.
</ins><span class="cx"> 
</span><del>-        This merges Blink revision 162073 with minor renaming and style
-        changes. From that commit:
</del><ins>+            Test: fast/animation/request-animation-frame-remove-client.html
</ins><span class="cx"> 
</span><del>-        Executing JavaScript code inside FrameView::layout() is problematic.
-        e.g. an assertion failure tested in fast/events/beforeload-assertion.html.
-        We should avoid it.
</del><ins>+            * platform/graphics/DisplayRefreshMonitor.cpp:
+            (WebCore::DisplayRefreshMonitor::displayDidRefresh):
</ins><span class="cx"> 
</span><del>-        This CL makes 'beforeload' event dispatching for plugins and iframes asynchronous,
-        except plugin access from JavaScript code (HTMLPlugInElement::
-        renderWidgetForJSBindings).
</del><ins>+2013-10-28  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        Merge r155554
</ins><span class="cx"> 
</span><del>-        Tests: fast/events/beforeload-assertion.html
-               fast/events/beforeload-iframe-crash.html
-               fast/events/beforeload-input-time-crash.html
</del><ins>+    2013-09-11  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * dom/Document.cpp:
-        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
-        * dom/Document.h:
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::reset):
-        (WebCore::FrameView::updateEmbeddedObjectsTimerFired):
-        (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
-        (WebCore::FrameView::performPostLayoutTasks):
-        * page/FrameView.h:
-        * testing/Internals.cpp:
-        (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks):
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+            Fix nested unicode-bidi: isolate
+            https://bugs.webkit.org/show_bug.cgi?id=120504
</ins><span class="cx"> 
</span><del>-2014-05-12  Roger Fong  &lt;roger_fong@apple.com&gt;
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Limit number of active graphics contexts per web process.
-        https://bugs.webkit.org/show_bug.cgi?id=132833.
-        &lt;rdar://problem/16888459&gt;
</del><ins>+            When we have a nested isolate renderer if the outer isolate has a text
+            and this text is not the first child, the isolated chain is not
+            rendered correctly. This happens because constructBidiRunsForSegment
+            uses always the first inner isolated renderer as isolated inline
+            container. This patch fixes the behavior described changing
+            containingIsolate to find the right isolated container.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/840a57050eade39dd04dde0c6603e129b783151c
</ins><span class="cx"> 
</span><del>-        Test: webgl/many-contexts.html
</del><ins>+            Tests: fast/text/international/unicode-bidi-isolate-nested-first-child-text.html
+                   fast/text/international/unicode-bidi-isolate-nested-simple.html
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/mac/GraphicsContext3DMac.mm: Limit number of active contexts to 16.
-        (WebCore::GraphicsContext3D::create):
-        (WebCore::GraphicsContext3D::~GraphicsContext3D):
</del><ins>+            * rendering/InlineIterator.h:
+            (WebCore::containingIsolate):
+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::constructBidiRunsForSegment):
</ins><span class="cx"> 
</span><del>-2014-05-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-10-28  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Build fix fix.
</del><ins>+        Merge r155665
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingCoordinator.cpp:
-        (WebCore::ScrollingCoordinator::contentShadowLayerForFrameView):
</del><ins>+    2013-09-12  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-12  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            [mac] Cache rendered image in PDFDocumentImage
+            https://bugs.webkit.org/show_bug.cgi?id=121207
</ins><span class="cx"> 
</span><del>-        DataDetectorUI doesn't update with resize
-        https://bugs.webkit.org/show_bug.cgi?id=132830
-        &lt;rdar://problem/16871179&gt;
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Tests: fast/images/pdf-as-image-too-big.html
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::scanSelectionForTelephoneNumbers): Add public, no-argument
-        version that can be called after layout changes.
-        (WebCore::Editor::didLayout): Reprocess telephone number data
-        since Ranges will have changed.
-        * editing/Editor.h:
-        * editing/FrameSelection.cpp:
-        (WebCore::FrameSelection::updateDataDetectorsForSelection): Added.
-        * editing/FrameSelection.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::performPostLayoutTasks): Ask the FrameSelection to update the
-        Range information for selected phone numbers.
</del><ins>+            * loader/cache/CachedImage.cpp:
+            (WebCore::CachedImage::createImage):
+            PDFDocumentImage takes a ImageObserver now so that it can report
+            decoded data size changes to the memory cache.
</ins><span class="cx"> 
</span><del>-2014-05-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * platform/graphics/Image.h:
+            (WebCore::Image::isPDFDocumentImage): Added.
</ins><span class="cx"> 
</span><del>-        Fix the iOS build.
</del><ins>+            * platform/graphics/cg/PDFDocumentImage.cpp:
+            (WebCore::PDFDocumentImage::PDFDocumentImage):
+            PDFDocumentImage takes a ImageObserver now so that it can report
+            decoded data size changes to the memory cache.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingCoordinator.cpp:
-        (WebCore::ScrollingCoordinator::contentShadowLayerForFrameView):
</del><ins>+            (WebCore::PDFDocumentImage::applyRotationForPainting):
+            Fix up some comments, and use GraphicsContext instead of CG API.
</ins><span class="cx"> 
</span><del>-2014-05-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            (WebCore::PDFDocumentImage::cacheParametersMatch):
+            Determine whether our cached image is still valid, given the new
+            destination's size, CTM scale, and source rect.
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Fuzzy tiles on some sites on loading
-        https://bugs.webkit.org/show_bug.cgi?id=132847
-        &lt;rdar://problem/16816178&gt;
</del><ins>+            (WebCore::transformContextForPainting): Added.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            (WebCore::PDFDocumentImage::updateCachedImageIfNeeded):
+            Cache a rendered bitmap of the PDF. Invalidate the cache if cacheParametersMatch
+            decides that the parameters don't match, unless we're painting in low quality mode,
+            in which case we'll scale the existing image (and then fully repaint when the
+            high-quality repaint timer fires).
+            Inform the memory cache of our new size.
</ins><span class="cx"> 
</span><del>-        Export WebCore::TileController::contentsScale() const
</del><ins>+            (WebCore::PDFDocumentImage::draw):
+            Update the cached image if needed.
+            Paint the cached image into the context if it's available (which it might not be,
+            if the image is way too big and the allocation fails). Otherwise, paint straight
+            into the context as we previously did.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+            (WebCore::PDFDocumentImage::destroyDecodedData):
+            Throw away the cached image if requested.
</ins><span class="cx"> 
</span><del>-2014-05-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            (WebCore::PDFDocumentImage::decodedSize):
+            (WebCore::PDFDocumentImage::drawPDFPage):
+            Drive-by use GraphicsContext instead of CG directly.
</ins><span class="cx"> 
</span><del>-        Add debug dumping for ViewportConfiguration
-        https://bugs.webkit.org/show_bug.cgi?id=132843
</del><ins>+            * platform/graphics/cg/PDFDocumentImage.h:
+            (WebCore::PDFDocumentImage::create):
+            Override isPDFDocumentImage().
+            Add storage for the cached image buffer and various cache parameters.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            * rendering/ImageQualityController.cpp:
+            (WebCore::ImageQualityController::shouldPaintAtLowQuality):
+            PDFDocumentImage is also interested in/capable of low-quality painting now.
</ins><span class="cx"> 
</span><del>-        Add some TextStream-based dumping for ViewportConfiguration.
</del><ins>+2013-10-28  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/ViewportConfiguration.cpp:
-        (WebCore::ViewportConfiguration::updateConfiguration):
-        (WebCore::ViewportConfigurationTextStream::ViewportConfigurationTextStream):
-        (WebCore::ViewportConfigurationTextStream::increaseIndent):
-        (WebCore::ViewportConfigurationTextStream::decreaseIndent):
-        (WebCore::dumpProperty):
-        (WebCore::ViewportConfigurationTextStream::writeIndent):
-        (WebCore::ViewportConfigurationTextStream::operator&lt;&lt;):
-        (WebCore::ViewportConfiguration::description):
-        (WebCore::ViewportConfiguration::dump):
-        * page/ViewportConfiguration.h:
</del><ins>+        Merge r155664
</ins><span class="cx"> 
</span><del>-2014-05-12  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+    2013-09-12  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Followup to &quot;Teach Editor to support more direct replacement of a Node&quot;
-        &lt;rdar://problem/16817952&gt; and https://bugs.webkit.org/show_bug.cgi?id=132834
</del><ins>+            Image doesn't always repaint at high quality in all tiles after a live resize
+            https://bugs.webkit.org/show_bug.cgi?id=121244
</ins><span class="cx"> 
</span><del>-        Pair programmed and pair reviewed by Brady Eidson and Darin Adler.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * editing/mac/EditorMac.mm:
-        (WebCore::maybeCopyNodeAttributesToFragment):
-        (WebCore::Editor::replaceNodeFromPasteboard):
</del><ins>+            Currently, ImageQualityController removes an image from its low-quality-images
+            list from inside shouldPaintAtLowQuality, if this is the first paint outside
+            of a live resize, but does not force the renderer to repaint in its entirety.
</ins><span class="cx"> 
</span><del>-2014-05-12  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            However, there's no guarantee we've invalidated the whole renderer, so this can
+            leave some parts of the image painted in low-quality.
</ins><span class="cx"> 
</span><del>-        Content shadow layer needs to move in sync with the content layer
-        https://bugs.webkit.org/show_bug.cgi?id=132841
-        -and corresponding-
-        &lt;rdar://problem/16641115&gt;
</del><ins>+            This just removes a short-circuit, instead using the ordinary high-quality-repaint
+            timer to ensure that the entire renderer is repainted.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            No new test; all attempts have failed, as this depends on tiled drawing
+            and a live resize occurring.
</ins><span class="cx"> 
</span><del>-        Now that the root content layer moves a little bit (for y scroll positions between 
-        0 and topContentInset), the shadow layer needs to move along with it since the 
-        shadow layer should always have the same position as the root content layer.
</del><ins>+            * rendering/ImageQualityController.cpp:
+            (WebCore::ImageQualityController::shouldPaintAtLowQuality):
</ins><span class="cx"> 
</span><del>-        Set the root state node’s shadow layer, and update the position whenever the root 
-        content layer’s position is updated.
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
-        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
</del><ins>+2013-10-28  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fetch the compositor’s layerForContentShadow().
-        * page/scrolling/ScrollingCoordinator.cpp:
-        (WebCore::ScrollingCoordinator::contentShadowLayerForFrameView):
-        * page/scrolling/ScrollingCoordinator.h:
</del><ins>+    Rollout 158067.
</ins><span class="cx"> 
</span><del>-        Hook up the contentShadowLayer in the state node.
-        * page/scrolling/ScrollingStateScrollingNode.cpp:
-        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
-        (WebCore::ScrollingStateScrollingNode::setContentShadowLayer):
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Hook it up in the ScrollingTreeNode as well. Move the layer whenever the m
-        _scrolledContentsLayer is moved.
-        * page/scrolling/ScrollingStateScrollingNode.h:
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::updateBeforeChildren):
-        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
</del><ins>+        Merge r155608
</ins><span class="cx"> 
</span><del>-        The shadow layer needs an anchor point now that we are moving it around.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
</del><ins>+    2013-09-12  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-12  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+            Crash in ScrollingStateStickyNode::updateConstraints
+            https://bugs.webkit.org/show_bug.cgi?id=119638
</ins><span class="cx"> 
</span><del>-        &lt;svg&gt; with opacity and compositing double-applies its opacity
-        https://bugs.webkit.org/show_bug.cgi?id=116856
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Ensure when a scrolling state node is removed from the state tree,
+            we remove both the current node and all its children from the
+            associated m_stateNodeMap lookup table.
</ins><span class="cx"> 
</span><del>-        The opacity is applied by the compositor. However, all SVG elements
-        create transparency layers on their own to apply opacity. So did
-        SVGSVGElement.
</del><ins>+            Test: fast/css/sticky/multiple-layers-sticky-crash.html
</ins><span class="cx"> 
</span><del>-        Added a check if the current element has a compositing layer and skip
-        creating transparency layer if it has.
</del><ins>+            * page/scrolling/ScrollingStateNode.cpp:
+            (WebCore::ScrollingStateNode::removeChild):
+            (WebCore::ScrollingStateNode::willBeRemovedFromStateTree):
+            * page/scrolling/ScrollingStateNode.h:
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/composited-svg-with-opacity.html
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/svg/SVGRenderingContext.cpp:
-        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
</del><ins>+        Merge r155546
</ins><span class="cx"> 
</span><del>-2014-05-12  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+    2013-09-10  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Teach Editor to support more direct replacement of a Node
-        &lt;rdar://problem/16817952&gt; and https://bugs.webkit.org/show_bug.cgi?id=132834
</del><ins>+            REGRESSION (143483): overflow:hidden doesn't quash big repaints from text-indent: -9999px
+            https://bugs.webkit.org/show_bug.cgi?id=121137
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        The new method &quot;Editor::replaceNodeFromPasteboard&quot; has the intent that the new DocumentFragment
-        from the pasteboard is as similar to the old Node as possible.
</del><ins>+            The change in r143483 made it so that negative text-indent gets added
+            to visual oveflow even when we have overflow:hidden, which is really bad
+            because it causes large repaints (and large layers) for a common-on-the-web
+            pattern.
</ins><span class="cx"> 
</span><del>-        In practice, the new DocumentFragment:
-        1 - Can represent a single node that's missing various attributes the original Node had.
-        2 - Can be an unwanted fragment of arbitrary depth when the replacement happens inside Mail.app
</del><ins>+            Revert the change, and add a new test to make sure it doesn't regress.
</ins><span class="cx"> 
</span><del>-        This fixes both of these issues.
</del><ins>+            I can't reproduce the bug it was trying to fix with the change reverted.
</ins><span class="cx"> 
</span><del>-        Add a MailBlockquoteHandling enum class for various Editor operations to pass through to the
-        ReplaceSelectionCommand:
-        * editing/Editor.cpp:
-        (WebCore::Editor::handleTextEvent):
-        (WebCore::Editor::pasteAsFragment):
-        (WebCore::Editor::pasteWithPasteboard):
-        (WebCore::Editor::replaceSelectionWithFragment):
-        * editing/Editor.h:
</del><ins>+            Tests: compositing/geometry/negative-text-indent-with-overflow-hidden-layer.html
+                   fast/repaint/negative-text-indent-with-overflow-hidden.html
</ins><span class="cx"> 
</span><del>-        * dom/TextEvent.cpp:
-        (WebCore::TextEvent::createForPlainTextPaste):
-        (WebCore::TextEvent::createForFragmentPaste):
-        (WebCore::TextEvent::TextEvent):
-        * dom/TextEvent.h:
-        (WebCore::TextEvent::mailBlockquoteHandling):
</del><ins>+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::computeOverflow):
</ins><span class="cx"> 
</span><del>-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::ReplaceSelectionCommand):
-        (WebCore::ReplaceSelectionCommand::doApply): Consider whether or not this particular Editor
-          operation was meant to give special consideration to Mail's Blockquotes.
-        * editing/ReplaceSelectionCommand.h:
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/efl/EditorEfl.cpp:
-        (WebCore::Editor::pasteWithPasteboard):
-        * editing/ios/EditorIOS.mm:
-        (WebCore::Editor::pasteWithPasteboard):
</del><ins>+        Merge r155468
</ins><span class="cx"> 
</span><del>-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::pasteWithPasteboard):
-        (WebCore::Editor::readSelectionFromPasteboard):
-        (WebCore::maybeCopyNodeAttributesToFragment): If the new DocumentFragment represents a single HTML node
-          with the same tag name is the original HTML node, copy over most attributes from the original node.
-        (WebCore::Editor::replaceNodeFromPasteboard): Create the fragment, run it through maybeCopyNodeAttributesToFragment.
</del><ins>+    2013-09-10  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+            [mac] PDFDocumentImage should use PDFKit to draw
+            https://bugs.webkit.org/show_bug.cgi?id=120651
+            &lt;rdar://problem/12810731&gt;
</ins><span class="cx"> 
</span><del>-2014-05-12  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Unreviewed hopeful build fix.
</ins><span class="cx"> 
</span><del>-        Progress on web timing.
-        https://bugs.webkit.org/show_bug.cgi?id=132574
</del><ins>+            * platform/graphics/mac/PDFDocumentImageMac.mm:
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        Removed ResourceLoadTiming.cpp.
-        * WebCore.exp.in:
-        Added linker symbols for ResourceLoadTiming.
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        Removed ResourceLoadTiming.cpp.
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::buildObjectForTiming):
-        * inspector/protocol/Network.json:
-        Updated ResourceTiming structure.
-        * loader/DocumentLoadTiming.cpp:
-        (WebCore::DocumentLoadTiming::setNavigationStart):
-        * loader/DocumentLoadTiming.h:
-         Deleted unused setNavigationStart function.
-        * page/Performance.idl:
-        Updated spec URL.
-        * page/PerformanceResourceTiming.cpp:
-        (WebCore::PerformanceResourceTiming::domainLookupStart):
-        (WebCore::PerformanceResourceTiming::domainLookupEnd):
-        (WebCore::PerformanceResourceTiming::connectStart):
-        (WebCore::PerformanceResourceTiming::secureConnectionStart):
-        (WebCore::PerformanceResourceTiming::responseEnd):
-        Updated ResourceLoadTiming member variable names.
-        (WebCore::PerformanceResourceTiming::responseStart):
-        * page/PerformanceResourceTiming.h:
-        * page/PerformanceResourceTiming.idl:
-        Deleted responseStart because it is not in the spec.
-        * page/PerformanceTiming.cpp:
-        (WebCore::PerformanceTiming::domainLookupStart):
-        (WebCore::PerformanceTiming::domainLookupEnd):
-        (WebCore::PerformanceTiming::connectStart):
-        (WebCore::PerformanceTiming::secureConnectionStart):
-        (WebCore::PerformanceTiming::requestStart):
-        (WebCore::PerformanceTiming::responseStart):
-        Updated ResourceLoadTiming member variable names.
-        (WebCore::PerformanceTiming::resourceLoadTimeRelativeToAbsolute):
-        Use navigationStart as base for resource load times.
-        * page/PerformanceTiming.idl:
-        Updated spec URL.
-        * platform/network/HTTPParsers.h:
-        Removed unused class declarations.
-        * platform/network/ResourceHandle.h:
-        Moved soup request time from ResourceLoadTiming to ResourceHandle.
-        * platform/network/ResourceLoadTiming.cpp: Removed.
-        * platform/network/ResourceLoadTiming.h:
-        (WebCore::ResourceLoadTiming::deepCopy):
-        (WebCore::ResourceLoadTiming::operator==):
-        (WebCore::ResourceLoadTiming::ResourceLoadTiming):
-        Updated ResourceLoadTiming member variable names.
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::createNSURLConnection):
-        Collect timing data.
-        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
-        Save timing data to a ResourceLoadTiming on the ResourceResponse.
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::gotHeadersCallback):
-        (WebCore::restartedCallback):
-        (WebCore::milisecondsSinceRequest):
-        (WebCore::ResourceHandle::didStartRequest):
-        (WebCore::networkEventCallback):
-        (WebCore::createSoupMessageForHandleAndRequest):
-        (WebCore::ResourceHandle::sendPendingRequest):
-        Updated ResourceLoadTiming member variable names.
-        (WebCore::wroteBodyCallback): Deleted.
</del><ins>+        Merge r155461
</ins><span class="cx"> 
</span><del>-2014-05-12  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+    2013-09-10  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        SVG outline property is broken and inefficient
-        https://bugs.webkit.org/show_bug.cgi?id=113666
</del><ins>+            [mac] PDFDocumentImage should use PDFKit to draw
+            https://bugs.webkit.org/show_bug.cgi?id=120651
+            &lt;rdar://problem/12810731&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Patch by Erik Dahlström backported from Blink.
</del><ins>+            Use PDFKit to draw PDF-in-&lt;img&gt; on Mac, so that annotations in PDF are painted.
</ins><span class="cx"> 
</span><del>-        &quot;[SVG2] css 'outline' property should apply to svg elements 
</del><ins>+            Test: fast/images/pdf-as-image-with-annotations.html
</ins><span class="cx"> 
</span><del>-        The 'outline' property was only partially working in SVG before
-        this patch, this makes it work on text and text content child
-        elements too. 
</del><ins>+            * WebCore.xcodeproj/project.pbxproj:
+            Add PDFDocumentImageMac.mm.
</ins><span class="cx"> 
</span><del>-        This makes SVG render the outlines as part of the foreground paint
-        phase. 
</del><ins>+            * platform/graphics/cg/PDFDocumentImage.cpp:
+            (WebCore::PDFDocumentImage::PDFDocumentImage):
+            We don't need to initialize m_document anymore because it's now a RetainPtr.
+            Initialize m_hasPage to false.
</ins><span class="cx"> 
</span><del>-        Partly based on Florin Malita's webkit patch https://bugs.webkit.org/show_bug.cgi?id=113666#c12.&quot;
</del><ins>+            (WebCore::PDFDocumentImage::~PDFDocumentImage):
+            We don't need to manually release our CGPDFDocumentRef anymore because it's now a RetainPtr.
</ins><span class="cx"> 
</span><del>-        Tests: svg/custom/outline-stacking-expected.svg
-               svg/custom/outline-stacking.svg
-               svg/custom/rgba-color-outline.svg
-               svg/text/text-outline-expected.svg
-               svg/text/text-outline-rgba.html
-               svg/text/text-outline.html
-               svg/text/textpath-outline-expected.svg
-               svg/text/textpath-outline.svg
-               svg/text/tspan-multiple-outline.svg
-               svg/text/tspan-outline-2-expected.svg
-               svg/text/tspan-outline-2.svg
-               svg/text/tspan-outline-expected.svg
-               svg/text/tspan-outline.html
</del><ins>+            (WebCore::PDFDocumentImage::size):
+            Use expandedIntSize for explicitness.
</ins><span class="cx"> 
</span><del>-        * rendering/svg/RenderSVGContainer.cpp:
-        (WebCore::RenderSVGContainer::paint): Draw outline in forground
-            paint phase.
-        * rendering/svg/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::paint): Draw outline in forground
-            paint phase.
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::paintReplaced): Pass paint offset.
-        * rendering/svg/RenderSVGShape.cpp:
-        (WebCore::RenderSVGShape::paint): Draw outline in forground
-            paint phase.
-        * rendering/svg/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::paint): Draw outline in forground
-            paint phase.
-        * rendering/svg/SVGInlineFlowBox.cpp:
-        (WebCore::SVGInlineFlowBox::paint): Pass paint offset.
-        * rendering/svg/SVGInlineTextBox.cpp:
-        (WebCore::SVGInlineTextBox::paint): Draw outline in forground
-            paint phase.
-        * rendering/svg/SVGRootInlineBox.cpp:
-        (WebCore::SVGRootInlineBox::paint): Pass paint offset.
</del><ins>+            (WebCore::PDFDocumentImage::applyRotationForPainting):
+            Rename adjustCTM to applyRotationForPainting, and move the one non-rotation related transformation out.
+            We need to do this because PDFKit applies the rotation transformation itself, so we don't need to.
+            Also, explicitly use std::min instead of importing the whole std namespace.
</ins><span class="cx"> 
</span><del>-2014-05-12  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            (WebCore::PDFDocumentImage::dataChanged):
+            Assert that we don't re-enter dataChanged after we've created a document,
+            because it seems like that shouldn't happen - we only create a document when
+            we've supposedly received all data, and it would be nice if we didn't have
+            all this varying code to deal with SharedBuffers changing out from under each other.
+            Factor the code to create a CGPDFDocumentRef out into createPDFDocument, so we can
+            replace it with a different implementation that creates a PDFDocument.
</ins><span class="cx"> 
</span><del>-        Layer for bottom overhang area needs to be offset by the topContentInset
-        https://bugs.webkit.org/show_bug.cgi?id=132835
-        -and corresponding-
-        &lt;rdar://problem/16641115&gt;
</del><ins>+            (WebCore::PDFDocumentImage::setCurrentPage):
+            Make all page-number-related things unsigned, since they are in CG and PDFKit,
+            and add m_hasPage to denote whether we've acquired a valid page yet.
+            Factor code to retrieve the PDF box bounds into computeBoundsForCurrentPage.
+            Remove setCurrentPage itself, as we never use a page other than the first page;
+            we will call computeBoundsForCurrentPage and set hasPage in dataChanged, now.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            (WebCore::PDFDocumentImage::draw):
+            Fix a weird comment.
+            Factor code that actually draws the PDF out into drawPDFPage.
</ins><span class="cx"> 
</span><del>-        Push this layer down by the topContentInset in addition to the root layer height, 
-        footer height, and header height.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateLayerForBottomOverhangArea):
</del><ins>+            The rest of the functions in this file are only built for USE(CG) &amp;&amp; !PLATFORM(MAC):
</ins><span class="cx"> 
</span><del>-2014-05-09  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+            (WebCore::PDFDocumentImage::createPDFDocument):
+            Factored out of dataChanged(). Use the PLATFORM(MAC) way of making a
+            CGDataProvider from a SharedBuffer everywhere; we're already using it on
+            iOS, and it should also work for Windows, the only other USE(CG) platform.
+            Since we only createPDFDocument() after all data has been received, remove
+            the comment about the SharedBuffer being secretly written to behind its back.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r167818): editing/inserting/typing-space-to-trigger-smart-link.html fails on WebKit1 bots
</del><ins>+            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
+            Factored out of setCurrentPage().
+            Use deg2rad since we have it.
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=132207&gt;
-        &lt;rdar://problem/16730393&gt;
</del><ins>+            (WebCore::PDFDocumentImage::pageCount):
+            (WebCore::PDFDocumentImage::drawPDFPage):
+            Factored out of draw().
+            Reduced an unnecessary transform (we were effectively doing mediaBox.origin - cropBox.origin - mediaBox.origin).
</ins><span class="cx"> 
</span><del>-        Reverts the previous workaround in favor of a more specific fix for the
-        null dereference.
</del><ins>+            * platform/graphics/cg/PDFDocumentImage.h:
+            Unindent all the things, as we don't indent the first level inside a namespace scope.
+            Forward-declare PDFDocument.
+            Make m_currentPage unsigned as it should be.
+            Add m_hasPage.
+            Make m_document a PDFDocument on PLATFORM(MAC) and a CGPDFDocumentRef on other platforms.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * platform/graphics/mac/PDFDocumentImageMac.mm: Added.
+            Soft-link in PDFKit and specifically the PDFDocument class.
</ins><span class="cx"> 
</span><del>-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
-        Check whether the run's start and end are still in the document, as
-        removeConflictingInlineStyleFromRun() may have removed them.
</del><ins>+            (WebCore::PDFDocumentImage::createPDFDocument):
+            Create our PDFDocument from the SharedBuffer's NSData directly. This shouldn't be a problem
+            (with respect to the SharedBuffer's data being appended to in secret), because we've waited
+            for the document to finish loading before getting here.
</ins><span class="cx"> 
</span><del>-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::apply):
-        Reverted previous workaround.
-        (WebCore::ApplyEditCommand::ReentrancyGuard::isRecursiveCall): Deleted.
-        (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::Scope): Deleted.
-        (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::~Scope): Deleted.
</del><ins>+            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
+            Ask PDFKit for the page's media and crop boxes; it automatically performs the correct fallback.
+            Ask PDFKit for the page's rotation.
</ins><span class="cx"> 
</span><del>-2014-05-12  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+            (WebCore::PDFDocumentImage::pageCount):
+            Ask PDFKit for the page count.
</ins><span class="cx"> 
</span><del>-        Clean up CrossThreadTask
-        https://bugs.webkit.org/show_bug.cgi?id=132800
</del><ins>+            (WebCore::PDFDocumentImage::drawPDFPage):
+            Paint the current page of the PDF. Note that we do not apply the rotation here
+            via applyRotationForPainting because PDFKit will do it itself.
+            Save and restore two bits of CG state which aren't saved and restored with the
+            graphics state, as PDFKit can mutate them above us (&lt;rdar://problem/14951759&gt;).
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * platform/mac/SoftLinking.h:
+            I couldn't find any clients of SOFT_LINK_FRAMEWORK_IN_CORESERVICES_UMBRELLA,
+            so I made it the more generic SOFT_LINK_FRAMEWORK_IN_UMBRELLA, taking the name
+            of the umbrella framework and the subframework, so I could use it to soft link
+            Quartz.framework's PDFKit.framework.
</ins><span class="cx"> 
</span><del>-        Remove the createCallbackTask overloads and the related CrossThreadTask helper classes.
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Instead, have one simple CrossThreadTask class that derives from ScriptExecutionContext::Task.
-        Its templated constructor takes in the method and the variadic pack of parameters. The cross-thread
-        copies of the parameters are then bound to that method and the resulting bind expression is used to
-        initialize the base class. The bind expression is constructed with a placeholder for the
-        ScriptExecutionContext* parameter that's provided through ScriptExecutionContext::Task::performTask().
</del><ins>+        Merge r155127
</ins><span class="cx"> 
</span><del>-        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didConnect):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessage):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didStartClosingHandshake):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessageError):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
-        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::send):
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::bufferedAmount):
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::didConnect):
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveMessage):
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveBinaryData):
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::didUpdateBufferedAmount):
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::didStartClosingHandshake):
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveMessageError):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::initialize):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::connect):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::bufferedAmount):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::close):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::fail):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::suspend):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::resume):
-        * dom/CrossThreadTask.h:
-        (WebCore::CrossThreadTask::CrossThreadTask):
-        (WebCore::CrossThreadTask1::CrossThreadTask1): Deleted.
-        (WebCore::CrossThreadTask1::performTask): Deleted.
-        (WebCore::CrossThreadTask2::CrossThreadTask2): Deleted.
-        (WebCore::CrossThreadTask2::performTask): Deleted.
-        (WebCore::CrossThreadTask3::CrossThreadTask3): Deleted.
-        (WebCore::CrossThreadTask3::performTask): Deleted.
-        (WebCore::CrossThreadTask4::CrossThreadTask4): Deleted.
-        (WebCore::CrossThreadTask4::performTask): Deleted.
-        (WebCore::CrossThreadTask5::CrossThreadTask5): Deleted.
-        (WebCore::CrossThreadTask5::performTask): Deleted.
-        (WebCore::CrossThreadTask6::CrossThreadTask6): Deleted.
-        (WebCore::CrossThreadTask6::performTask): Deleted.
-        (WebCore::CrossThreadTask7::CrossThreadTask7): Deleted.
-        (WebCore::CrossThreadTask7::performTask): Deleted.
-        (WebCore::CrossThreadTask8::CrossThreadTask8): Deleted.
-        (WebCore::CrossThreadTask8::performTask): Deleted.
-        (WebCore::createCallbackTask): Deleted.
-        * fileapi/FileReader.cpp:
-        (WebCore::FileReader::abort):
-        * loader/WorkerThreadableLoader.cpp:
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::destroy):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::didSendData):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailAccessControlCheck):
-        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
-        * loader/WorkerThreadableLoader.h:
-        * loader/cache/MemoryCache.cpp:
-        (WebCore::MemoryCache::removeRequestFromCache):
-        (WebCore::MemoryCache::removeRequestFromSessionCaches):
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
-        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
-        (WebCore::WorkerMessagingProxy::connectToInspector):
-        (WebCore::WorkerMessagingProxy::disconnectFromInspector):
-        (WebCore::WorkerMessagingProxy::sendMessageToInspector):
</del><ins>+    2013-09-04  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-12  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Vector::releaseBuffer should return an OwnPtr
+            https://bugs.webkit.org/show_bug.cgi?id=120718
</ins><span class="cx"> 
</span><del>-        Implement EXT_shader_texture_lod in WebGL.
-        https://bugs.webkit.org/show_bug.cgi?id=128985
-        &lt;rdar://problem/16111396&gt;
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Based on Chromium patch by bajones@chromium.org.
-        https://src.chromium.org/viewvc/blink?revision=171465&amp;view=revision
</del><ins>+            Change FormStreamFields::currentData to an OwnPtr.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            * platform/network/cf/FormDataStreamCFNet.cpp:
+            (WebCore::closeCurrentStream):
+            (WebCore::advanceCurrentStream):
+            (WebCore::formCreate):
</ins><span class="cx"> 
</span><del>-        Test: webgl/conformance/extensions/ext-shader-texture-lod.html
-        
-        * CMakeLists.txt:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        Added new EXTShaderTextureLOD files.
-        * bindings/js/JSWebGLRenderingContextCustom.cpp:
-        (WebCore::toJS):
-        Added EXTShaderTextureLOD.
-        * html/canvas/EXTShaderTextureLOD.cpp: Added.
-        (WebCore::EXTShaderTextureLOD::EXTShaderTextureLOD):
-        (WebCore::EXTShaderTextureLOD::~EXTShaderTextureLOD):
-        (WebCore::EXTShaderTextureLOD::getName):
-        * html/canvas/EXTShaderTextureLOD.h: Added.
-        * html/canvas/EXTShaderTextureLOD.idl: Added.
-        * html/canvas/WebGLExtension.h:
-        Added EXTShaderTextureLODName.
-        * html/canvas/WebGLObject.cpp:
-        Removed unused inclusion of EXTTextureFilterAnisotropic.h.
-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::getExtension):
-        Added EXT_shader_texture_lod.
-        * html/canvas/WebGLRenderingContext.h:
-        Added a EXTShaderTextureLOD member variable.
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-12  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+        Merge r154915
</ins><span class="cx"> 
</span><del>-        Disallow drag and drop of non-displayable resources.
-        https://bugs.webkit.org/show_bug.cgi?id=132745
-        &lt;rdar://problem/10562662&gt;
</del><ins>+    2013-08-30  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            [Windows] Update to incorporate additional suggestions
+            https://bugs.webkit.org/show_bug.cgi?id=120448
</ins><span class="cx"> 
</span><del>-        Test: http/tests/security/drag-drop-local-file.html
</del><ins>+            Reviewed by Darin Adler
</ins><span class="cx"> 
</span><del>-        * page/DragController.cpp:
-        (WebCore::DragController::startDrag):
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: Add
+            notes as to why AVFoundationCF needs this extra method call.
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h: Use OVERRIDE
+            * rendering/RenderVideo.cpp: Replace ternary operator with logical &amp;&amp;.
</ins><span class="cx"> 
</span><del>-2014-05-12  Jozsef Berta  &lt;jberta.u-szeged@partner.samsung.com&gt;
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        WinCairo buildfix after r168611
-        https://bugs.webkit.org/show_bug.cgi?id=132825
</del><ins>+        Merge r154914
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+    2013-08-30  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/curl/CurlDownload.cpp:
-        (WebCore::CurlDownloadManager::downloadThread):
-        (WebCore::CurlDownload::didReceiveHeader):
-        (WebCore::CurlDownload::didReceiveData):
</del><ins>+            [Windows] Vide element in page always uses non-hw accelerated mode.
+            https://bugs.webkit.org/show_bug.cgi?id=120448
</ins><span class="cx"> 
</span><del>-2014-05-12  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+            Reviewed by Darin Adler
</ins><span class="cx"> 
</span><del>-        REGRESSION (r159560): Text clips on tile border if line-height &lt; font-size
-        https://bugs.webkit.org/show_bug.cgi?id=132822
</del><ins>+            This patch is unfortunately larger than my original idea, but seems to make the
+            layout system happier. Instead of switching into composited mode when building
+            the media player, we now build the original layout tree with compositing active
+            if the underlying media element requires it. The AVFoundationCF player needs to
+            have the compositor available at construction time so it can attach to the
+            rendering device. Otherwise it falls back to CPU-only mode.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
-        
-        The first line of simple line layout run range was miscomputed.
</del><ins>+            * platform/graphics/MediaPlayer.cpp:
+            (WebCore::MediaPlayer::requiresImmediateCompositing): Added
+            * platform/graphics/MediaPlayer.h:
+            * platform/graphics/MediaPlayerPrivate.h:
+            (WebCore::MediaPlayerPrivateInterface::requiresImmediateCompositing): Added
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundationCF::createAVPlayer): Added
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
+            (WebCore::MediaPlayerPrivateAVFoundationCF::requiresImmediateCompositing):
+            * rendering/RenderLayerCompositor.cpp:
+            (WebCore::RenderLayerCompositor::requiresCompositingForVideo): Uses new
+            'requiresImmediateCompositing' to short-circuit check for whether a
+            compositor is required.
+            * rendering/RenderVideo.cpp:
+            (WebCore::RenderVideo::requiresImmediateCompositing):
+            * rendering/RenderVideo.h:
</ins><span class="cx"> 
</span><del>-        Test: fast/text/simple-lines-range-low-line-height.html
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/SimpleLineLayoutResolver.h:
-        (WebCore::SimpleLineLayout::RunResolver::lineIndexForHeight):
-        
-            Lines may overlap if line-height &lt; font-size. Apply different adjustment when searching for range begin
-            so that overflowing earlier lines are taken into account.
</del><ins>+        Merge r154890
</ins><span class="cx"> 
</span><del>-        (WebCore::SimpleLineLayout::RunResolver::rangeForRect):
</del><ins>+    2013-08-30  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-12  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            [Windows] Video inside page always uses non-hardware accelerated playback
+            https://bugs.webkit.org/show_bug.cgi?id=120448
</ins><span class="cx"> 
</span><del>-        Invalid information remaining in lineToRegion map of RenderFlowThread.
-        https://bugs.webkit.org/show_bug.cgi?id=132690
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundationCF::createAVPlayer): Check for
+            D3D device. If it doesn't exist, switch to compositing mode and try again.
</ins><span class="cx"> 
</span><del>-        Test: fast/multicol/newmulticol/lines-region-map-crash.html
</del><ins>+2013-10-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::deleteLines):
-        * rendering/RenderFlowThread.h:
</del><ins>+        Merge r154856
</ins><span class="cx"> 
</span><del>-2014-05-12  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+    2013-08-29  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Clean up MainThreadTask
-        https://bugs.webkit.org/show_bug.cgi?id=132799
</del><ins>+            SVG clipping, masking, and gradients-on-text do not respect the device scale factor
+            https://bugs.webkit.org/show_bug.cgi?id=120377
+            &lt;rdar://problem/14777944&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Only have one simple MainThreadTask class that derives from std::function&lt;void ()&gt;.
-        Its templated constructor takes in the method and a variadic pack of parameters.
-        The cross-thread copies of the parameter are then bound to the given method through
-        std::bind(), with the resulting bind expression used to initialize the base
-        std::function&lt;void ()&gt; class.
</del><ins>+            Tests: svg/custom/masking-clipping-hidpi.svg
</ins><span class="cx"> 
</span><del>-        The WebCore::callOnMainThread() functions and the helper classes are removed in favor
-        of passing MainThreadTask rvalues directly to WTF::callOnMainThread().
</del><ins>+            calculateTransformationToOutermostCoordinateSystem should include the page's
+            device scale factor in its transform.
</ins><span class="cx"> 
</span><del>-        * fileapi/AsyncFileStream.cpp:
-        (WebCore::AsyncFileStream::startOnFileThread):
-        (WebCore::AsyncFileStream::stopOnFileThread):
-        (WebCore::AsyncFileStream::getSizeOnFileThread):
-        (WebCore::AsyncFileStream::openForReadOnFileThread):
-        (WebCore::AsyncFileStream::openForWriteOnFileThread):
-        (WebCore::AsyncFileStream::readOnFileThread):
-        (WebCore::AsyncFileStream::writeOnFileThread):
-        (WebCore::AsyncFileStream::truncateOnFileThread):
-        * platform/MainThreadTask.h:
-        (WebCore::MainThreadTask::MainThreadTask):
-        (WebCore::MainThreadTaskBase::MainThreadTaskBase): Deleted.
-        (WebCore::MainThreadTaskBase::~MainThreadTaskBase): Deleted.
-        (WebCore::MainThreadTask1::create): Deleted.
-        (WebCore::MainThreadTask1::MainThreadTask1): Deleted.
-        (WebCore::MainThreadTask2::create): Deleted.
-        (WebCore::MainThreadTask2::MainThreadTask2): Deleted.
-        (WebCore::MainThreadTask3::create): Deleted.
-        (WebCore::MainThreadTask3::MainThreadTask3): Deleted.
-        (WebCore::MainThreadTask4::create): Deleted.
-        (WebCore::MainThreadTask4::MainThreadTask4): Deleted.
-        (WebCore::MainThreadTask5::create): Deleted.
-        (WebCore::MainThreadTask5::MainThreadTask5): Deleted.
-        (WebCore::MainThreadTask6::create): Deleted.
-        (WebCore::MainThreadTask6::MainThreadTask6): Deleted.
-        (WebCore::MainThreadTask7::create): Deleted.
-        (WebCore::MainThreadTask7::MainThreadTask7): Deleted.
-        (WebCore::MainThreadTask8::create): Deleted.
-        (WebCore::MainThreadTask8::MainThreadTask8): Deleted.
-        (WebCore::executeMainThreadTask): Deleted.
-        (WebCore::callOnMainThread): Deleted.
</del><ins>+            * rendering/svg/SVGRenderingContext.cpp:
+            (WebCore::SVGRenderingContext::calculateTransformationToOutermostCoordinateSystem):
</ins><span class="cx"> 
</span><del>-2014-05-11  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+2013-10-24  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Simplify FileThread::Task usage
-        https://bugs.webkit.org/show_bug.cgi?id=132798
</del><ins>+        Merge r154694
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+    2013-08-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove the createFileThreadTask functions and the related FileThreadTask helper classes.
</del><ins>+            [Windows] Correct method call for characteristic update.
</ins><span class="cx"> 
</span><del>-        Instead, the FileThread::Task class now has a templated constructor that takes in a pointer
-        to the object instance, a method, and a variadic pack of parameters. The pointer and the
-        cross-thread copies of all the parameters are then bound to the given method through std::bind().
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Instead of createFileThreadTask, std::make_unique&lt;&gt;() should be used to construct unique pointers
-        that wrap FileThread::Task objects.
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged):
+            [Windows] Correct method call (should have been &quot;characteristicsChanged&quot;, not
+            &quot;player()-&gt;characteristicChanged()&quot;
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * fileapi/AsyncFileStream.cpp:
-        (WebCore::AsyncFileStream::create):
-        (WebCore::AsyncFileStream::stop):
-        (WebCore::AsyncFileStream::getSize):
-        (WebCore::AsyncFileStream::openForRead):
-        (WebCore::AsyncFileStream::openForWrite):
-        (WebCore::AsyncFileStream::close):
-        (WebCore::AsyncFileStream::read):
-        (WebCore::AsyncFileStream::write):
-        (WebCore::AsyncFileStream::truncate):
-        * fileapi/FileThread.h:
-        (WebCore::FileThread::Task::Task):
-        (WebCore::FileThread::Task::performTask):
-        (WebCore::FileThread::Task::~Task): Deleted.
-        * fileapi/FileThreadTask.h: Removed.
</del><ins>+2013-10-24  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-11  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        Merge r154693
</ins><span class="cx"> 
</span><del>-        Do not create a temporary string to append the SVGLength's unit
-        https://bugs.webkit.org/show_bug.cgi?id=132807
</del><ins>+    2013-08-26  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            [Windows] some track language tags are not recognized
+            https://bugs.webkit.org/show_bug.cgi?id=120335
</ins><span class="cx"> 
</span><del>-        * svg/SVGLength.cpp:
-        (WebCore::lengthTypeToString):
-        The caller just append the string to a number string. The function
-        lengthTypeToString() was creating a new WTF::String from scratch,
-        copied the characters to make a new string, and destroyed the WTF::String.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Instead, just append the string literal.
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: Revise implementation
+            to match logic in platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjc.mm
</ins><span class="cx"> 
</span><del>-2014-05-11  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</del><ins>+2013-10-24  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        CSS JIT: reduce cost of computing backtracking height
-        https://bugs.webkit.org/show_bug.cgi?id=132546
</del><ins>+        Merge r154681
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+    2013-08-27  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Because compiler previously compute backtracking height for
-        previous child fragment, by leveraging this, we can limit the
-        `maxPrefixSize` for `computeBacktrackingHeightFromDescendant`.
</del><ins>+            Web Inspector: Column Breakpoint not working, may be off by 1
+            https://bugs.webkit.org/show_bug.cgi?id=120334
</ins><span class="cx"> 
</span><del>-        For example, consider selector &quot;c&gt;a&gt;b&gt;d&gt;a&gt;b e&quot;'s descendant chain,
-        &quot;c&gt;a&gt;b&gt;d&gt;a&gt;b&quot;.
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        At the &lt;a&gt; position, we have matching pattern [b, a, d, b, a] and
-        calculate the backtracking height by following method.
</del><ins>+            JavaScriptCore changed to 1-based column numbers at some point. We
+            need to update the ScriptDebugger assumption that they were 0-based.
</ins><span class="cx"> 
</span><del>-        pattern:    [b, a, d, b, a]
-        candidate0:    [b, a, d, b]  =&gt; Not matched.
-        candidate1:       [b, a, d]  =&gt; Not matched.
-        candidate2:          [b, a]  =&gt; Matched against the pattern.
</del><ins>+            Test: inspector-protocol/debugger/column-breakpoint.html
</ins><span class="cx"> 
</span><del>-        At this time, first candidate0's pattern size is `pattern.size() - 1`.
-        And get backtracking height from descendant 3, that is
-        `pattern.size() - candidate.size()`, `5 - 2`.
</del><ins>+            * bindings/js/ScriptDebugServer.cpp:
+            (WebCore::ScriptDebugServer::createCallFrame):
+            (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+2013-10-24  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        And next, at the &lt;c&gt; position, we calcucate the backtracking height
-        for this pattern.
</del><ins>+        Merge r154647
</ins><span class="cx"> 
</span><del>-        pattern:    [b, a, d, b, a, c]
-        candidate0:    [b, a, d, b, a]  =&gt; Not matched.
-        candidate1:       [b, a, d, b]  =&gt; Not matched.
-        candidate2:          [b, a, d]  =&gt; Not matched.
-        candidate3:             [b, a]  =&gt; Not matched.
-        candidate4:                [b]  =&gt; Not matched.
-        candidate5:                 []  =&gt; Matched against the pattern.
</del><ins>+    2013-08-23  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Then, we get the backtracking height, which is 6 (6 - 0).
-        However, in the above case, we already know that attempts from candidate0
-        to candidate1 always fail, since parts of these are already tested at
-        the &lt;b&gt; position trial and we know they don't match.
</del><ins>+            Fix issues found by the Clang Static Analyzer
+            https://bugs.webkit.org/show_bug.cgi?id=120230
</ins><span class="cx"> 
</span><del>-        So in this case, we should start this computation from candidate2,
-        such as,
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        pattern:    [b, a, d, b, a, c]
-        candidate2:          [b, a, d]  =&gt; Not matched.
-        candidate3:             [b, a]  =&gt; Not matched.
-        candidate4:                [b]  =&gt; Not matched.
-        candidate5:                 []  =&gt; Matched against the pattern.
</del><ins>+            * WebCore.xcodeproj/project.pbxproj: Removed FoundationExtras.h.
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm: Removed CFAutoreleaseHelper().
+            (AXTextMarkerRange): Used HardAutorelease() instead of
+            CFAutoreleaseHelper().
+            (AXTextMarkerRangeStart): Ditto.
+            (AXTextMarkerRangeEnd): Ditto.
+            (textMarkerForVisiblePosition): Ditto.
+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (-[WebCoreAVFMovieObserver initWithCallback:]): Called [super init]
+            first so that we don't later use ivars from the wrong self.
+            (-[WebCoreAVFLoaderDelegate initWithCallback:]): Ditto.
+            * platform/mac/FoundationExtras.h: Removed.
+            * platform/mac/KURLMac.mm:
+            (WebCore::KURL::operator NSURL *): Used WTF's HardAutorelease().
+            * platform/mac/WebCoreNSURLExtras.mm:
+            (WebCore::mapHostNameWithRange): Used HardAutorelease() instead of
+            WebCoreCFAutorelease().
+            (WebCore::URLWithData): Ditto.
+            (WebCore::userVisibleString): Ditto.
+            (WebCore::URLByRemovingComponentAndSubsequentCharacter): Used Vector&lt;&gt;
+            with an inline capacity rather than heap-allocating a buffer.
+            * platform/mac/WebCoreObjCExtras.h: Used HardAutorelease() instead of
+            WebCoreCFAutorelease().
+            * platform/text/mac/StringImplMac.mm:
+            (WTF::StringImpl::operator NSString *): Used WTF's HardAutorelease().
</ins><span class="cx"> 
</span><del>-        We can start computation with candidate size
-        `pattern.size() - previousChildFragmentBacktrackingHeight`.
-        In this example, `pattern.size()` is 6 and
-        `previousChildFragmentBacktrackingHeight` is 3, so candidate size is
-        3, that is candidate2.
</del><ins>+2013-10-24  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::computeBacktrackingStartHeightFromDescendant):
-        (WebCore::SelectorCompiler::computeBacktrackingHeightFromDescendant):
</del><ins>+        Merge r154527
</ins><span class="cx"> 
</span><del>-2014-05-11  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+    2013-08-23  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Headers and footers are not positioned correctly with topContentInset
-        https://bugs.webkit.org/show_bug.cgi?id=132787
-        -and corresponding-
-        &lt;rdar://problem/16641115&gt;
</del><ins>+            [Mac] some track language tags are not recognized
+            https://bugs.webkit.org/show_bug.cgi?id=119643
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Reviewed by Jere Noble.
</ins><span class="cx"> 
</span><del>-        Headers and footers need to take the inset into account, and they also need to 
-        factor in the fact that the root layer moves around now too.
</del><ins>+            No new tests, existing tests updated.
</ins><span class="cx"> 
</span><del>-        The existing yPositionForRootContentLayer() is actually the right calculation for 
-        the header layer. The root content layer wants that value, but pushed down by the 
-        header height. Now there are static functions for both of them and the footer to 
-        avoid duplicated code in the three spots where we need this information.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::yPositionForHeaderLayer):
-        (WebCore::FrameView::yPositionForRootContentLayer):
-        (WebCore::FrameView::yPositionForFooterLayer):
-        * page/FrameView.h:
</del><ins>+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_captionDisplayMode from settings
+                if possible.
+            (WebCore::HTMLMediaElement::configureTextTrackGroup): Don't enable a default track when preferences
+                say captions should be disabled. Don't disable an already visible track if we don't find
+                a match unless preferences say captions should be disabled. m_forcedOrAutomaticSubtitleTrackLanguage -&gt;
+                m_subtitleTrackLanguage.
+            (WebCore::HTMLMediaElement::mediaPlayerCharacteristicChanged): If the language of the primary
+                audio track changes, only kick off a text track recalc if caption preference are set to &quot;automatic&quot;.
+            * html/HTMLMediaElement.h:
</ins><span class="cx"> 
</span><del>-        Use the static functions to compute the layer positions.
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
</del><ins>+            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation): Initialize m_characteristicsChanged
+                and m_delayCharacteristicsChangedNotification.
+            (WebCore::MediaPlayerPrivateAVFoundation::setHasVideo): Call characteristicsChanged.
+            (WebCore::MediaPlayerPrivateAVFoundation::setHasAudio): Ditto.
+            (WebCore::MediaPlayerPrivateAVFoundation::setHasClosedCaptions): Ditto.
+            (WebCore::MediaPlayerPrivateAVFoundation::characteristicsChanged): New, allows us to coalesce 
+                calls to the media player when we know several characteristics may change.
+            (WebCore::MediaPlayerPrivateAVFoundation::setDelayCharacteristicsChangedNotification): Enable or
+                disable notification delay.
+            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
</ins><span class="cx"> 
</span><del>-        How did headers ever work with this bug?? I don’t know. We need to return that 
-        layer.
-        * page/scrolling/ScrollingCoordinator.cpp:
-        (WebCore::ScrollingCoordinator::headerLayerForFrameView):
</del><ins>+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Always call languageOfPrimaryAudioTrack(),
+                a track may have changed so we may have a new language.
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::languageOfPrimaryAudioTrack): Call [AVAssetTrack languageCode]
+                if [AVAssetTrack extendedLanguageTag] returns NULL in case the media file has an old
+                QuickTime language code.
</ins><span class="cx"> 
</span><del>-        Use the static functions to compute the layer positions.
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
-        (WebCore::RenderLayerCompositor::updateLayerForHeader):
-        (WebCore::RenderLayerCompositor::updateLayerForFooter):
</del><ins>+2013-10-24  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-11  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Merge r154308
</ins><span class="cx"> 
</span><del>-        Subpixel rendering[iOS]: &lt;select&gt; decoration is misaligned when the renderer is on subpixel position.
-        https://bugs.webkit.org/show_bug.cgi?id=132779
-        &lt;rdar://problem/16631071&gt;
</del><ins>+    2013-08-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            &lt;https://webkit.org/b/119930&gt; input[type=range]: Fix a crash by changing input type in 'input' event handler
</ins><span class="cx"> 
</span><del>-        Push &lt;select&gt; theme decoration's rect to device pixel position to ensure
-        that the theme bounds are aligned with the renderer's bounds. (in painting terms)
-        However, as the decoration code paints multiple items, they all need to use snapped 
-        final coordinates for painting : tracked here https://bugs.webkit.org/show_bug.cgi?id=132780
-        This patch also changes the padding values for &lt;select&gt; [iOS] to compensate for the integer
-        truncation that happened before subpixel. 
</del><ins>+            Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        Not testable.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/99afc9b55ce176b4f5fe053070e19dbebc1891a5
</ins><span class="cx"> 
</span><del>-        * css/html.css:
-        (select):
-        * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::RenderThemeEfl::paintMenuListButtonDecorations):
-        * platform/efl/RenderThemeEfl.h:
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::paintMenuListButtonDecorations):
-        * platform/gtk/RenderThemeGtk.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paintDecorations):
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::paintMenuListButtonDecorations):
-        * rendering/RenderThemeIOS.h:
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::paintMenuListButtonDecorations):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMenuListButtonDecorations):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::paintMenuListButtonDecorations):
-        * rendering/RenderThemeSafari.h:
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::paintMenuList):
-        (WebCore::RenderThemeWin::paintMenuListButtonDecorations):
-        * rendering/RenderThemeWin.h:
</del><ins>+            In SliderThumbElement::setPositionFromPoint, renderer() can be NULL after HTMLInputElement::setValueFromRenderer,
+            which dispatches 'input' event. Also, make a local vairable 'input' a RefPtr just in case.
</ins><span class="cx"> 
</span><del>-2014-05-11  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+            Also add null-poinetr checks for the host element as SliderThumbElement only weakly holds onto the host element.
</ins><span class="cx"> 
</span><del>-        Move Source/WebCore/workers/ code to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=132401
</del><ins>+            Test: fast/forms/range/range-type-change-oninput.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * html/shadow/SliderThumbElement.cpp:
+            (WebCore::SliderThumbElement::isDisabledFormControl):
+            (WebCore::SliderThumbElement::matchesReadOnlyPseudoClass):
+            (WebCore::SliderThumbElement::matchesReadWritePseudoClass):
+            (WebCore::SliderThumbElement::setPositionFromPoint):
+            (WebCore::SliderThumbElement::hostInput):
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr in code under Source/WebCore/workers (and related places)
-        with std::unique_ptr.
</del><ins>+2013-10-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setTimeout):
-        (WebCore::JSDOMWindow::setInterval):
-        * bindings/js/JSWorkerGlobalScopeCustom.cpp:
-        (WebCore::JSWorkerGlobalScope::setTimeout):
-        (WebCore::JSWorkerGlobalScope::setInterval):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::create):
-        * bindings/js/ScheduledAction.h:
-        * page/DOMTimer.cpp:
-        (WebCore::DOMTimer::DOMTimer):
-        (WebCore::DOMTimer::install):
-        (WebCore::DOMTimer::fired):
-        (WebCore::DOMTimer::didStop):
-        * page/DOMTimer.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::setTimeout):
-        (WebCore::DOMWindow::setInterval):
-        * page/DOMWindow.h:
-        * workers/WorkerEventQueue.h:
-        * workers/WorkerGlobalScope.cpp:
-        (WebCore::WorkerGlobalScope::WorkerGlobalScope):
-        (WebCore::WorkerGlobalScope::setTimeout):
-        (WebCore::WorkerGlobalScope::setInterval):
-        * workers/WorkerGlobalScope.h:
-        (WebCore::WorkerGlobalScope::clearScript):
-        * workers/WorkerLoaderProxy.h:
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::WorkerRunLoop):
-        * workers/WorkerRunLoop.h:
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::WorkerScriptLoader::createResourceRequest):
-        * workers/WorkerScriptLoader.h:
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        (WebCore::WorkerThread::workerThread):
-        (WebCore::WorkerThreadStartupData::create): Deleted.
-        * workers/WorkerThread.h:
</del><ins>+        Merge r154289
</ins><span class="cx"> 
</span><del>-2014-05-09  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</del><ins>+    2013-08-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] [iOS] Underlines are too low
-        https://bugs.webkit.org/show_bug.cgi?id=132770
</del><ins>+            ASSERTION FAILED: !node || node-&gt;isShadowRoot() in WebCore::EventRetargeter::eventTargetRespectingTargetRules
+            https://bugs.webkit.org/show_bug.cgi?id=119720
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-        computeUnderlineOffset() inside InlineTextBox.cpp lowers underlines from text
-        baseline by a value that is proportional to the font size. However, this
-        lowering was done a second time in
-        GraphicsContext::computeLineBoundsAndAntialiasingModeForText(). This patch
-        removes this second, platform-dependent lowering.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/4ce9bfbf54410179cd0f18b3d1a912045fc0ec3d
</ins><span class="cx"> 
</span><del>-        This duplication was caused by merging iOS into open source, where iOS used
-        the GraphicsContext approach and open source used the InlineTextBox approach.
</del><ins>+            * dom/EventRetargeter.h:
+            (WebCore::EventRetargeter::eventTargetRespectingTargetRules):
</ins><span class="cx"> 
</span><del>-        Covered by fast/css3-text/css3-text-decoration/text-decoration-thickness.html.
</del><ins>+2013-10-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::computeLineBoundsAndAntialiasingModeForText): Remove
-        redundant lowering code
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintDecoration): Clean up textDecorationThickness
-        variable
</del><ins>+        Merge r154183
</ins><span class="cx"> 
</span><del>-2014-05-11  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+    2013-08-16  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Text with simple line layout not getting pushed below float when there is not enough space for it
-        https://bugs.webkit.org/show_bug.cgi?id=126991
</del><ins>+            (NetworkProcess)  Sync XHRs should load using async ResourceHandles, not ResourceHandle::loadResourceSynchronously
+            https://bugs.webkit.org/show_bug.cgi?id=119493
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Tests: fast/text/simple-lines-intruding-wide-float-dynamic.html
-               fast/text/simple-lines-intruding-wide-float.html
</del><ins>+            No new tests (Covered by plenty of existing tests).
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::markLinesDirtyInBlockRange):
-        
-            Invalidate the line layout path when floats change. We need to check SimpleLineLayout::canUseFor again as
-            intruding floats may make this flow ineligible to use the path.
</del><ins>+            * WebCore.exp.in:
+            * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.h:
-        (WebCore::RenderBlockFlow::floatingObjectSet):
-        * rendering/SimpleLineLayout.cpp:
-        (WebCore::SimpleLineLayout::canUseFor):
-        
-            Test the top positions of all floats for case that would push text below the float instead of just testing 
-            the first line. We may have floats in the middle of the paragraph too.
</del><ins>+            * platform/network/SynchronousLoaderClient.h: Make platformBadResponseError public
</ins><span class="cx"> 
</span><del>-2014-05-11  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</del><ins>+            * platform/network/mac/ResourceHandleMac.mm:
+            (WebCore::ResourceHandle::platformLoadResourceSynchronously): Add comments/FIXMEs spelling out how wrong this code is.
</ins><span class="cx"> 
</span><del>-        WinCairo crashes on acid3 test
-        https://bugs.webkit.org/show_bug.cgi?id=131364
</del><ins>+2013-10-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        Merge r153975
</ins><span class="cx"> 
</span><del>-        When the 304 (Not-modified) response is received, the Curl backend should look up the cached response,
-        and call the client method didReceiveResponse with the cached response, instead of the 304 response.
-        Otherwise the response will contain an empty MIME type, which causes the request to be cancelled, and the client deleted.
-        When the Curl cache manager then accesses the client afterwards, it is deleted, and we crash.
</del><ins>+    2013-08-12  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/curl/CurlCacheManager.cpp:
-        (WebCore::CurlCacheManager::didReceiveResponse): Return early if request is cancelled.
-        (WebCore::CurlCacheManager::getCachedResponse): Added method to get cached response.
-        * platform/network/curl/CurlCacheManager.h: Ditto.
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::headerCallback): When 304 response is received, look up cached response, and use it.
</del><ins>+            Fix NULL de-refernce in HTMLAnchorElement::sendPings when settings doesn't exist
+            https://bugs.webkit.org/show_bug.cgi?id=119716
</ins><span class="cx"> 
</span><del>-2014-05-10  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        [WKWebView _updateScrollViewBackground] churns UI-and-CGColors while repainting
-        https://bugs.webkit.org/show_bug.cgi?id=132793
-        &lt;rdar://problem/16877870&gt;
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/d5783da353ab783e9994b8fbecd91880be5192a1
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+            No new tests since the test in the Blink change doesn't reproduce crash on WebKit.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Export a Color convenience function.
</del><ins>+            * html/HTMLAnchorElement.cpp:
+            (WebCore::HTMLAnchorElement::sendPings):
</ins><span class="cx"> 
</span><del>-2014-05-10  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-10-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168578.
-        https://bugs.webkit.org/show_bug.cgi?id=132789
</del><ins>+        Merge r153920
</ins><span class="cx"> 
</span><del>-        Speculative rollout since this appears to break PLT3.
-        (Requested by kling on #webkit).
</del><ins>+    2013-08-09  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+            Crash in com.apple.WebKit.WebContent at com.apple.MediaToolbox.
+            https://bugs.webkit.org/show_bug.cgi?id=119645
</ins><span class="cx"> 
</span><del>-        &quot;Move Source/WebCore/workers/ code to std::unique_ptr&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132401
-        http://trac.webkit.org/changeset/168578
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-10  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+            Work around crash caused by &lt;rdar://problem/14688471&gt; by releasing
+            m_request as soon as keys have been added to it.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r166853): fast/preloader/document-write.html is very flaky
-        https://bugs.webkit.org/show_bug.cgi?id=130942
</del><ins>+            * Modules/encryptedmedia/CDMPrivateAVFoundation.mm:
+            (WebCore::CDMSessionAVFoundation::update):
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+2013-10-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::suspendMemoryCacheClientCalls): Use a RefPtr to the main
-        frame as a weak pointer to a Page that will work unless the page is destroyed.
-        The old code tried to do it with a RefPtr to a document, but as the FIXME
-        points out, that won't work if the document is disassociated with its frame.
</del><ins>+        Merge r153913
</ins><span class="cx"> 
</span><del>-2014-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+    2013-08-09  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Block exceptions when trying to convert attributed strings to RTF and RTFD
-        https://bugs.webkit.org/show_bug.cgi?id=132778
-        &lt;rdar://problem/16675805&gt;
</del><ins>+            REGRESSION (r142755): window.open creates an invisible window when width and height are 0
+            https://bugs.webkit.org/show_bug.cgi?id=119633
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        When the iOS WebHTMLConverter was upstreamed, converting some attributed strings to RTF and RTFD
-        started throwing Objective-C exceptions (see &lt;rdar://problem/16876920&gt;).
-        
-        In WebKit2, we now crash on unhandled exceptions so work around that crash by adding exception blocking macros.
</del><ins>+            Test: fast/dom/Window/open-zero-size-as-default.html
</ins><span class="cx"> 
</span><del>-        * editing/ios/EditorIOS.mm:
-        (WebCore::dataInRTFDFormat):
-        (WebCore::dataInRTFFormat):
-        * editing/mac/EditorMac.mm:
-        (WebCore::dataInRTFDFormat):
-        (WebCore::dataInRTFFormat):
</del><ins>+            Relying on each WebKit to refuse setting size to zero was fragile - because this
+            required each one to have the check, and because by the time the client was called,
+            the initially zero size was not necessarily zero.
</ins><span class="cx"> 
</span><del>-2014-05-10  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+            * loader/FrameLoader.cpp: (WebCore::createWindow): When sizes are zero, keep the
+            size the window was created with, because that's the default one by definition.
</ins><span class="cx"> 
</span><del>-        Move Source/WebCore/workers/ code to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=132401
</del><ins>+            * page/DOMWindow.cpp: (WebCore::DOMWindow::adjustWindowRect): It's too late to
+            check for zero size now, it's been mangled to adjust for the difference between
+            window and viewport size.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-10-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr in code under Source/WebCore/workers (and related places)
-        with std::unique_ptr.
</del><ins>+        Merge r153909
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setTimeout):
-        (WebCore::JSDOMWindow::setInterval):
-        * bindings/js/JSWorkerGlobalScopeCustom.cpp:
-        (WebCore::JSWorkerGlobalScope::setTimeout):
-        (WebCore::JSWorkerGlobalScope::setInterval):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::create):
-        * bindings/js/ScheduledAction.h:
-        * page/DOMTimer.cpp:
-        (WebCore::DOMTimer::DOMTimer):
-        (WebCore::DOMTimer::install):
-        (WebCore::DOMTimer::fired):
-        (WebCore::DOMTimer::didStop):
-        * page/DOMTimer.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::setTimeout):
-        (WebCore::DOMWindow::setInterval):
-        * page/DOMWindow.h:
-        * workers/WorkerEventQueue.h:
-        * workers/WorkerGlobalScope.cpp:
-        (WebCore::WorkerGlobalScope::WorkerGlobalScope):
-        (WebCore::WorkerGlobalScope::setTimeout):
-        (WebCore::WorkerGlobalScope::setInterval):
-        * workers/WorkerGlobalScope.h:
-        (WebCore::WorkerGlobalScope::clearScript):
-        * workers/WorkerLoaderProxy.h:
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::WorkerRunLoop):
-        * workers/WorkerRunLoop.h:
-        * workers/WorkerScriptLoader.cpp:
-        (WebCore::WorkerScriptLoader::loadSynchronously):
-        (WebCore::WorkerScriptLoader::loadAsynchronously):
-        (WebCore::WorkerScriptLoader::createResourceRequest):
-        * workers/WorkerScriptLoader.h:
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        (WebCore::WorkerThread::workerThread):
-        (WebCore::WorkerThreadStartupData::create): Deleted.
-        * workers/WorkerThread.h:
</del><ins>+    2013-08-09  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-09  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            Captions menu needs to reset text-align
+            https://bugs.webkit.org/show_bug.cgi?id=119637
</ins><span class="cx"> 
</span><del>-        -webkit-filter prevents rendering at retina scale
-        https://bugs.webkit.org/show_bug.cgi?id=93471
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            Reset the text-align property on the menu so that it
+            doesn't get the inherited value. The full fix for all
+            controls is http://webkit.org/b/116100.
</ins><span class="cx"> 
</span><del>-        Implement 2x support for filters that go through
-        the -webkit-filter property. This includes all
-        shorthand filters, and any referenced SVG-style filters
-        (as long as they use only the supported subset of
-        operations - basically the same as is exposed for
-        the shorthands).
</del><ins>+            * css/mediaControlsQuickTime.css:
+            (video::-webkit-media-controls-closed-captions-container):
</ins><span class="cx"> 
</span><del>-        Tests: fast/hidpi/filters-blur.html
-               fast/hidpi/filters-hue-rotate.html
-               fast/hidpi/filters-invert.html
-               fast/hidpi/filters-multiple.html
-               fast/hidpi/filters-reference.html
-               fast/hidpi/filters-shadow.html
</del><ins>+2013-10-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::getUnmultipliedImageData): Scale the source rectangle if the method was
-        called using LogicalCoordinates.
-        (WebCore::ImageBuffer::getPremultipliedImageData): Ditto.
-        (WebCore::ImageBuffer::putByteArray): Ditto.
</del><ins>+        Merge r153877
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/FEDropShadow.cpp:
-        (WebCore::FEDropShadow::platformApplySoftware): Make sure to scale the blur radius by the filter
-        resolution, and call the byte-array methods with the native coordinate system.
-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        (WebCore::FEGaussianBlur::calculateUnscaledKernelSize): Fix typo.
-        (WebCore::FEGaussianBlur::platformApplySoftware): Scale the kernel and paint rectangles
-        by the filter scale.
</del><ins>+    2013-08-08  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/Filter.h:
-        (WebCore::Filter::Filter): Initialise the filter scale.
-        (WebCore::Filter::filterScale): New property which reflects the mapping between logical pixels
-        and device pixels.
-        (WebCore::Filter::setFilterScale):
</del><ins>+            navigator.plugins has plugins in it when plugins are disabled
+            https://bugs.webkit.org/show_bug.cgi?id=119607
+            &lt;rdar://problem/14678030&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::asImageBuffer): Make sure buffer creation takes scale into account.
-        (WebCore::FilterEffect::asUnmultipliedImage): Ditto.
-        (WebCore::FilterEffect::asPremultipliedImage): Ditto.
-        (WebCore::FilterEffect::copyImageBytes): Scale any incoming regions if they are talking about
-        device pixels rather than logical pixels.
-        (WebCore::FilterEffect::copyUnmultipliedImage): Ditto.
-        (WebCore::FilterEffect::copyPremultipliedImage): Ditto.
-        (WebCore::FilterEffect::createImageBufferResult): Take scale into account when creating byte array.
-        (WebCore::FilterEffect::createUnmultipliedImageResult): Ditto.
-        (WebCore::FilterEffect::createPremultipliedImageResult): Ditto.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * rendering/FilterEffectRenderer.cpp:
-        (WebCore::FilterEffectRenderer::allocateBackingStoreIfNeeded): Pass filter scale into buffer creation.
</del><ins>+            Test: plugins/navigator-plugins-disabled.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateOrRemoveFilterEffectRenderer): Make sure to set the filter scale to
-        the device scale factor, and notice if we ever change scales.
</del><ins>+            * page/Settings.cpp:
+            (WebCore::Settings::setPluginsEnabled):
+            Refresh the plugin database when plugins are enabled or disabled.
+            This is necessary to ensure that navigator.plugins will have the
+            correct set of plugins after dynamically changing whether plugins
+            are enabled, which makes the test for this patch possible (but it
+            makes sense in the browser as well).
</ins><span class="cx"> 
</span><del>-2014-05-10  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</del><ins>+2013-09-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [MediaStream] Rename NavigatorMediaStream as NavigatorUserMedia.
-        https://bugs.webkit.org/show_bug.cgi?id=132734
</del><ins>+        Merge r155203
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+    2013-09-06  Mike West  &lt;mkwst@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Spec: http://www.w3.org/TR/mediacapture-streams/#navigatorusermedia
</del><ins>+            Revalidation header blacklisting should be case-insensitive.
+            https://bugs.webkit.org/show_bug.cgi?id=120832
</ins><span class="cx"> 
</span><del>-        This patch replaces 'NavigatorMediaStream' with 'NavigatorUserMedia'
-        throughout the code to be consistent with W3C specifications.
-        Test cases remain the same as 'Navigator' implies 'NavigatorUserMedia'.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: Compiles NavigatorUserMedia.cpp
-        * DerivedSources.make: Compiles NavigatorUserMedia.idl
-        * Modules/mediastream/NavigatorMediaStream.cpp: Removed.
-        * Modules/mediastream/NavigatorMediaStream.h: Removed.
-        * Modules/mediastream/NavigatorMediaStream.idl: Removed.
-        * Modules/mediastream/NavigatorUserMedia.cpp: Added.
-        (WebCore::NavigatorUserMedia::NavigatorUserMedia):
-        (WebCore::NavigatorUserMedia::~NavigatorUserMedia):
-        (WebCore::NavigatorUserMedia::webkitGetUserMedia):
-        * Modules/mediastream/NavigatorUserMedia.h: Added.
-        * Modules/mediastream/NavigatorUserMedia.idl: Added.
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSNavigatorCustom.cpp:
-        (WebCore::JSNavigator::webkitGetUserMedia): NavigatorUserMedia
-        class is used instead of NavigatorMediaStream.
</del><ins>+            Headers like 'content-type' should be ignored for 304 responses,
+            even if they are delivered as 'Content-Type', or 'CoNtEnT-TyPe', etc.
</ins><span class="cx"> 
</span><del>-2014-05-10  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            I broke this behavior in http://trac.webkit.org/changeset/142068
+            (&quot;Entity-header extension headers honored on 304 responses&quot;). Pages like
+            https://learndev.unm.edu/ currently break on reload, as they incorrectly
+            send 'Content-Type: text/plain' for 304 responses for resources like
+            CSS and JavaScript. The browser should drop these headers, but because
+            we're comparing in a case-sensitive fashion, we don't.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Empty rects should remain empty after integrally enclosing them.
-        https://bugs.webkit.org/show_bug.cgi?id=132753
-        &lt;rdar://problem/16846801&gt;
</del><ins>+            https://code.google.com/p/chromium/issues/detail?id=246875 documents the
+            Blink-side fix; this patch is a port of that patch.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Test: http/tests/cache/content-type-ignored-during-revalidation.html
</ins><span class="cx"> 
</span><del>-        This patch ensures that empty LayoutRects remain empty after converting to integral enclosing rect.
-        LayoutRects with fractional position get expanded even if they are empty. This makes rectangle
-        operations unreliable and can result in undesired side effects.
</del><ins>+            * loader/cache/CachedResource.cpp:
+            (WebCore::shouldUpdateHeaderAfterRevalidation):
+            Compare the provided AtomicString 'header' to the revalidation
+            blacklists in a case-insensitive fashion.
</ins><span class="cx"> 
</span><del>-        No testable/covered by existing tests.
</del><ins>+2013-09-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/LayoutRect.cpp:
-        (WebCore::enclosingIntRect):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::localSelectionRect):
-        (WebCore::InlineTextBox::paintDocumentMarker):
-        (WebCore::InlineTextBox::paintTextMatchMarker):
-        (WebCore::InlineTextBox::computeRectForReplacementMarker):
-        (WebCore::integralEnclosingRectForSelection): Deleted.
</del><ins>+        Merge r154037
</ins><span class="cx"> 
</span><del>-2014-05-09  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+    2013-08-13  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: Allow Remote Inspector to entitlement check UIProcess through WebProcess
-        https://bugs.webkit.org/show_bug.cgi?id=132409
</del><ins>+            REGRESSION(r150187): Safari fails to render allrecipe.com comment popups
+            https://bugs.webkit.org/show_bug.cgi?id=119780
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorClient.h:
-        (WebCore::InspectorClient::parentProcessIdentifier): Deleted.
-        * page/PageDebuggable.cpp:
-        (WebCore::PageDebuggable::parentProcessIdentifier): Deleted.
-        * page/PageDebuggable.h:
-        pid per debuggable is no longer needed.
</del><ins>+            The bug was caused by SelectorDataList::executeFastPathForIdSelector not verifying that
+            elements found by getAllElementsById are descendents of rootNode when there are multiple
+            elements of the same id. This resulted in querySelector and querySelectorAll of an element
+            returning nodes outside of the element.
</ins><span class="cx"> 
</span><del>-2014-05-09  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            Fixed the bug by checking this condition when we have multiple elements of the same id.
</ins><span class="cx"> 
</span><del>-        [fullscreen] cursor should auto-hide when over video
-        https://bugs.webkit.org/show_bug.cgi?id=132758
</del><ins>+            Test: fast/selectors/querySelector-id-with-multiple-elements-with-same-id.html
</ins><span class="cx"> 
</span><del>-        Unreviewed followup based on test failure.
</del><ins>+            * dom/SelectorQuery.cpp:
+            (WebCore::SelectorDataList::executeFastPathForIdSelector):
</ins><span class="cx"> 
</span><del>-        * css/fullscreen.css: Append the previous rule - video children of fullscreen elements.
</del><ins>+2013-09-04  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-09  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        &lt;rdar://problem/14910916&gt; Disable CSS_SHAPES on safari-537-branch
</ins><span class="cx"> 
</span><del>-        [fullscreen] cursor should auto-hide when over video
-        https://bugs.webkit.org/show_bug.cgi?id=132758
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
</ins><span class="cx"> 
</span><del>-        Cursors were not auto-hiding over fullscreen video. There was
-        a small error in the CSS we load for fullscreen content.
</del><ins>+2013-09-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/fullscreen.css: Don't hide when video is a child of the fullscreen element - hide when it *is* the fullscreen element.
-        (video:-webkit-full-screen):
-        (:-webkit-full-screen video:hover): Deleted.
</del><ins>+        Merge r155014
</ins><span class="cx"> 
</span><del>-2014-05-09  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+    2013-09-03  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Subpixel rendering[iOS]: Top bar on apple.com/support jiggles when the swoosh animates.
-        https://bugs.webkit.org/show_bug.cgi?id=132750
-        &lt;rdar://problem/16803281&gt;
</del><ins>+            Can't select Katakana word by double-clicking.
+            &lt;rdar://problem/14654926&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Alexey Proskuryakov and Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        This patch ensures that GraphicsLayer and RemoteLayerBackingStore have the same dimensions.
-        
-        Remove integral enclosing when we set the size on RemoteLayerBackingStore. It makes the layer's size
-        different from the backingstore when the passed value is fractional.
-        We scale and integral round this value to size the shareable bitmap later. Rounding ensures that
-        the final size value matches what we calculated at GraphicsLayerCA::updateGeometry()
</del><ins>+            For some languages, like Japanese we need
+            to use more context for word breaking.
</ins><span class="cx"> 
</span><del>-        Currently not testable.
</del><ins>+            New test: editing/selection/doubleclick-japanese-text.html
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateGeometry):
-        (WebCore::GraphicsLayerCA::computePixelAlignment): include device scale factor to be able calculate the final content scale.
-        * platform/graphics/ca/GraphicsLayerCA.h:
</del><ins>+            * platform/text/TextBoundaries.h:
+            (WebCore::requiresContextForWordBoundary):
</ins><span class="cx"> 
</span><del>-2014-05-09  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+2013-09-02  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        JSDOMWindow should disable property caching after a certain point
-        https://bugs.webkit.org/show_bug.cgi?id=132751
</del><ins>+        Merge r154785
</ins><span class="cx"> 
</span><del>-        Reviewed by Filip Pizlo.
</del><ins>+    2013-08-28  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+            Fix compositing layers in columns
+            https://bugs.webkit.org/show_bug.cgi?id=120436
</ins><span class="cx"> 
</span><del>-        This is part of removing HasImpureGetOwnPropertySlot from JSDOMWindow. After the lookup in the static 
-        hash table for JSDOMWindow fails we want to disable property caching even if the code that follows thinks 
-        that it has provided a cacheable value.
</del><ins>+            Reviewed by Dave Hyatt.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertySlot):
</del><ins>+            Remove the old hack in RenderLayer::updateLayerPosition() for placing
+            layers in columns, which changed the layer position for composited
+            layers; this broke hit-testing.
</ins><span class="cx"> 
</span><del>-2014-05-09  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+            Fix a better way by moving compositing layers to the correct
+            positions that take column offsets into account, by fixing
+            RenderLayer::convertToLayerCoords() to optionally apply column
+            adjustment, and using this in the code which positions compositing layers.
</ins><span class="cx"> 
</span><del>-        Fix the export file after r168556
</del><ins>+            Tests: compositing/columns/ancestor-clipped-in-paginated.html
+                   compositing/columns/clipped-in-paginated.html
+                   compositing/columns/composited-columns-vertical-rl.html
+                   compositing/columns/composited-columns.html
+                   compositing/columns/composited-in-paginated-rl.html
+                   compositing/columns/composited-in-paginated-writing-mode-rl.html
+                   compositing/columns/composited-lr-paginated-repaint.html
+                   compositing/columns/composited-rl-paginated-repaint.html
+                   compositing/columns/hittest-composited-in-paginated.html
+                   compositing/columns/rotated-in-paginated.html
+                   compositing/columns/untransformed-composited-in-paginated.html
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: I forgot to fix the export file before landing.
</del><ins>+            * rendering/RenderLayer.cpp:
+            (WebCore::RenderLayer::updateLayerPosition):
+            (WebCore::RenderLayer::convertToPixelSnappedLayerCoords):
+            (WebCore::accumulateOffsetTowardsAncestor):
+            (WebCore::RenderLayer::convertToLayerCoords):
+            * rendering/RenderLayer.h:
+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::updateCompositedBounds):
+            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
</ins><span class="cx"> 
</span><del>-2014-05-09  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-08-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Set up the resize events
-        https://bugs.webkit.org/show_bug.cgi?id=132726
</del><ins>+        Merge r154528
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler and Simon Fraser.
</del><ins>+    2013-08-23  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Let the WebKit2 layer override the size used for resize events.
</del><ins>+            REGRESSION (r132545): Some PDFs generated by WebKit are blank when viewed in 
+            Adobe Reader
+            https://bugs.webkit.org/show_bug.cgi?id=120240
+            -and corresponding-
+            &lt;rdar://problem/14634453&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::sizeForResizeEvent):
-        (WebCore::FrameView::sendResizeEventIfNeeded):
-        (WebCore::FrameView::setCustomSizeForResizeEvent):
-        * page/FrameView.h:
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-05-09  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            This patch makes it so that we don’t use the infinite rect for the PDF context, 
+            and it adds WebCoreSystemInterface API to find out if the current content is the 
+            PDF context. 
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168518): Multiple tests for workers in blobs assert
-        https://bugs.webkit.org/show_bug.cgi?id=132728
</del><ins>+            * WebCore.exp.in:
+            * platform/graphics/cg/GraphicsContextCG.cpp:
+            (WebCore::GraphicsContext::clipOut):
+            * platform/mac/WebCoreSystemInterface.h:
+            * platform/mac/WebCoreSystemInterface.mm:
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2013-08-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Change File serialization to include name, so that we don't have to regenerate anything
-        on a secondary thread after deserialization.
</del><ins>+        Merge r154529
</ins><span class="cx"> 
</span><del>-        Files and Blobs can't be stored persistently, because URLs are transient (IndexedDB
-        has an explicit check, and fails if there were any blob URLs). API doesn't have the
-        check, but given that anyone who tried to use these to serialize a File would fail,
-        it seems OK to change the format.
</del><ins>+    2013-08-23  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::CloneSerializer::write):
-        (WebCore::CloneDeserializer::readFile):
-        * fileapi/File.cpp:
-        (WebCore::File::File):
-        * fileapi/File.h:
</del><ins>+            REGRESSION (r150516): Media controls are messed up on right-to-left webpages
+            https://bugs.webkit.org/show_bug.cgi?id=120234
</ins><span class="cx"> 
</span><del>-2014-05-08  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+            Reviewed by Dan Bernstein.
</ins><span class="cx"> 
</span><del>-        JSDOMWindow should have a WatchpointSet to fire on window close
-        https://bugs.webkit.org/show_bug.cgi?id=132721
</del><ins>+            Test: media/video-rtl.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Filip Pizlo.
</del><ins>+            Make the media control panel explicitly direction:ltr. The captions menu and captions
+            display are unaffected, so rtl content will continue to appear rtl there.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+            * css/mediaControls.css:
+            (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
</ins><span class="cx"> 
</span><del>-        This patch allows us to reset the inline caches that assumed they could skip 
-        the first part of JSDOMWindow::getOwnPropertySlot that checks if the window has 
-        been closed. This is part of getting rid of HasImpureGetOwnPropertySlot on JSDOMWindow.
</del><ins>+2013-08-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        JSDOMWindowBase now has a WatchpointSet that the underlying DOMWindow fires when its
-        frame is cleared. In getOwnPropertySlot, we now pass this WatchpointSet to PropertySlot
-        which will shepherd it back up to the code that generates the inline cache (and the 
-        Watchpoint for clearing it).
</del><ins>+        Merge r154535
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
-        (WebCore::JSDOMWindowBase::fireFrameClearedWatchpointsForWindow):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertySlot):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::frameDestroyed):
</del><ins>+    2013-08-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-09  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+            Improve scrolling behavior in iTunes
+            https://bugs.webkit.org/show_bug.cgi?id=120241
+            &lt;rdar://problem/14825344&gt;
</ins><span class="cx"> 
</span><del>-        ASSERTION FAILED: object-&gt;style()-&gt;overflowX() == object-&gt;style()-&gt;overflowY()
-        https://bugs.webkit.org/show_bug.cgi?id=121682
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            When vertically scrolling a page with horizontally scrollable overflow areas,
+            vertical scroll gestures would be interrupted when wheel events with non-zero
+            X deltas were intercepted by the overflow areas.
</ins><span class="cx"> 
</span><del>-        Add more overflow freedom to the SVG element:
-        -overflow-x and overflow-y for controlling each scrollbar independently is now supported
-        -overflow:scroll will display scrollbars regardless of the svg overflowing or not (as required by CSS)
-        -overflow:hidden will cause overflow to be clipped away and scrollbars to be hidden
</del><ins>+            Fix by storing a small history of wheel events deltas and using
+            it to determine of the scroll gesture is primarily vertical or horizontal.
+            When this is detected, avoid dispatching scroll events on the on the
+            non-dominant axis.
</ins><span class="cx"> 
</span><del>-        Merged from Blink r172126 by &lt;ed@opera.com&gt;
</del><ins>+            Currently this behavior is conditionalized to only apply in iTunes.
</ins><span class="cx"> 
</span><del>-        Tests: svg/W3C-SVG-1.1-SE/painting-marker-05-f.svg
-               svg/W3C-SVG-1.1-SE/painting-marker-06-f.svg
-               svg/animations/animate-viewport-overflow-2.html
-               svg/animations/animate-viewport-overflow.html
-               svg/in-html/overflow-repaint.html
-               svg/in-html/overflow-svg-root-attr.html
-               svg/in-html/overflow-svg-root-style.html
-               svg/in-html/overflow-svg-root.html
-               svg/overflow/overflow-on-outermost-svg-element-horizontal-auto.svg
-               svg/overflow/overflow-on-outermost-svg-element-vertical-auto.svg
-               svg/overflow/overflow-scroll-on-outermost-svg-element.svg
-               svg/overflow/overflow-x-hidden-on-outermost-svg-element-expected.svg
-               svg/overflow/overflow-x-hidden-on-outermost-svg-element.svg
-               svg/overflow/overflow-y-hidden-on-outermost-svg-element-expected.svg
-               svg/overflow/overflow-y-hidden-on-outermost-svg-element.svg
</del><ins>+            * page/EventHandler.cpp:
+            (WebCore::EventHandler::EventHandler):
+            (WebCore::EventHandler::recordWheelEventDelta):
+            (WebCore::deltaIsPredominantlyVertical):
+            (WebCore::EventHandler::dominantScrollGestureDirection):
+            (WebCore::EventHandler::handleWheelEvent):
+            (WebCore::EventHandler::defaultWheelEventHandler):
+            * page/EventHandler.h:
+            * platform/RuntimeApplicationChecks.cpp:
+            (WebCore::applicationIsITunes):
+            * platform/RuntimeApplicationChecks.h:
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::adjustRenderStyle):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::applyOverflowToViewport):
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::layout):
-        (WebCore::RenderSVGRoot::shouldApplyViewportClip):
-        (WebCore::RenderSVGRoot::paintReplaced):
-        (WebCore::RenderSVGRoot::computeFloatRectForRepaint):
-        * rendering/svg/RenderSVGRoot.h:
-        * rendering/svg/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderSupport::isOverflowHidden):
</del><ins>+2013-08-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-09  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Merge r154378
</ins><span class="cx"> 
</span><del>-        [MSE][Mac] Destroy the AVStreamDataParser when the SourceBuffer is removed from its MediaSource.
-        https://bugs.webkit.org/show_bug.cgi?id=132710
</del><ins>+    2013-08-20  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            &lt;https://webkit.org/b/120101&gt; [Mac] Suspended HTMLMediaElements can still hold power assertion after playback stops.
</ins><span class="cx"> 
</span><del>-        The AVStreamDataParser should be destroyed when the SourceBuffer is removed, so that subsequent
-        SourceBuffers can utilize resources released by the parser on destruction.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        (-[WebAVStreamDataParserListener invalidate]):
-        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]):  Protect against _parent being invalidated.
-        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]): Ditto.
-        (WebCore::SourceBufferPrivateAVFObjC::~SourceBufferPrivateAVFObjC): Call destroyParser();.
-        (WebCore::SourceBufferPrivateAVFObjC::removedFromMediaSource): Ditto.
-        (WebCore::SourceBufferPrivateAVFObjC::destroyParser): Call -[WebAVStreamDataParserListener invalidate].
</del><ins>+            Call updateDisplaySleep() when we clear our MediaPlayer, as doing so may kill any in-flight
+            rateChanged() notifications.
</ins><span class="cx"> 
</span><del>-2014-05-09  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::clearMediaPlayer):
+            (WebCore::HTMLMediaElement::stop):
</ins><span class="cx"> 
</span><del>-        [CSS Regions] 1-2% performance regression in html5-full-render after r168286
-        https://bugs.webkit.org/show_bug.cgi?id=132672
</del><ins>+2013-08-16  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+        Merge r154147
</ins><span class="cx"> 
</span><del>-        The patch optimizes the search of regions when there's a single region in the chain.
-        There's no need to execute advanced search logic, we can directly return that region.
</del><ins>+    2013-08-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: No function change, no tests.
</del><ins>+            &lt;https://webkit.org/b/119871&gt; Flash of garbage pixels when playing a show on Hulu
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::canComputeRegionRangeForBox):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::regionAtBlockOffset):
-        (WebCore::RenderFlowThread::hasCachedRegionRangeForBox): Renamed from hasRegionRangeForBox to
-        better suggest what the function does.
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
-        (WebCore::RenderFlowThread::hasRegionRangeForBox): Deleted.
-        * rendering/RenderFlowThread.h:
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2014-05-09  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            When starting a show on Hulu, there's a layer that gets marked as
+            opaque because it has a child RenderLayer whose background fills the
+            compositing layer. That child RenderLayer was recently position:fixed
+            but outside the viewport, so its viewportConstrainedNotCompositedReason
+            was set to a non-zero value.
</ins><span class="cx"> 
</span><del>-        [EME] Call suspendIfNeeded() in the MediaKeySession create() method to avoid an ASSERT.
-        https://bugs.webkit.org/show_bug.cgi?id=132712
</del><ins>+            However, we failed to clear the viewportConstrainedNotCompositedReason
+            when the layer became non-fixed. This caused painting the opaque
+            layer to bail in RenderLayer::paintLayer(), leaving garbage.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Test: compositing/contents-opaque/fixed-to-nonfixed.html
</ins><span class="cx"> 
</span><del>-        All ActiveDOMObject subclasses must call suspendIfNeeded() immediately after creation.
</del><ins>+            * rendering/RenderLayer.cpp:
+            (WebCore::RenderLayer::paintLayer): Add an assertion to catch this error in future.
+            * rendering/RenderLayerCompositor.cpp:
+            (WebCore::RenderLayerCompositor::updateBacking): Make sure we clear the
+            ViewportConstrainedNotCompositedReason if the layer is no longer fixed.
</ins><span class="cx"> 
</span><del>-        * Modules/encryptedmedia/MediaKeySession.cpp:
-        (WebCore::MediaKeySession::MediaKeySession):
</del><ins>+2013-08-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-09  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Merge r154115
</ins><span class="cx"> 
</span><del>-        Unreviewed. Another attempt to fix Windows build after r168528.
</del><ins>+    2013-08-15  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/win/FontWin.cpp:
-        (WebCore::Font::adjustSelectionRectForComplexText):
</del><ins>+            &lt;https://webkit.org/b/119853&gt; REGRESSION (r139343): WebKit crashes when canceling a load inside webView:resource:didFinishLoadingFromDataSource:
</ins><span class="cx"> 
</span><del>-2014-05-09  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Reviewed by Brady Eidson.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix for Win after r168528.
</del><ins>+            A client implementing webView:resource:didFinishLoadingFromDataSource:
+            might decide to call stopLoading: for the identifier that just finished
+            loading. If this happens we re-enter the loader and attempt to cancel a
+            load that has already finished and been removed from the set of active
+            loaders. Prevent this by clearing DocumentLoader's
+            m_identifierForLoadWithoutResourceLoader before calling
+            dispatchDidFinishLoading().
</ins><span class="cx"> 
</span><del>-        * platform/graphics/win/FontWin.cpp:
-        (WebCore::Font::adjustSelectionRectForComplexText):
</del><ins>+            New API test: WebKit1.StopLoadingFromDidFinishLoading.
</ins><span class="cx"> 
</span><del>-2014-05-09  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            * loader/DocumentLoader.cpp:
+            (WebCore::DocumentLoader::finishedLoading): Set
+            m_identifierForLoadWithoutResourceLoader to 0 before calling
+            dispatchDidFinishLoading().
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168095): 1-pixel gap between adjacent selection inlines
-        https://bugs.webkit.org/show_bug.cgi?id=132474
-        &lt;rdar://problem/16797394&gt;
</del><ins>+2013-08-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Merge r154123
</ins><span class="cx"> 
</span><del>-        This patch changes text selection rectangle calculation from integral to device
-        pixel snapping. It ensures that selection rect painting matches box boundaries for inline elements.
-        Directional rounding (horizontal only atm) is moved out from Font class and now accessible
-        to all the painting code. RTL snapping strategy is changed from floor to round to match ltr behavior.
-        However this patch does not address all the integral snapping across inline elements. There are
-        a few places where we still calculate enclosing rects where snapping is sufficient.
</del><ins>+    2013-08-15  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/inline/hidpi-pixel-gap-between-adjacent-selection-inlines.html
</del><ins>+            &lt;https://webkit.org/b/119824&gt; AX: WKView does not become first responder when the voiceover cursor lands on it
</ins><span class="cx"> 
</span><del>-        * platform/LayoutUnit.h:
-        (WebCore::roundToDevicePixel): added fudge factor to change rounding direction as directed.
-        * platform/graphics/Font.cpp:
-        (WebCore::Font::adjustSelectionRectForText):
-        (WebCore::Font::selectionRectForText): Deleted.
-        * platform/graphics/Font.h:
-        * platform/graphics/FontFastPath.cpp:
-        (WebCore::Font::adjustSelectionRectForSimpleText): removed directional rounding.
-        (WebCore::Font::selectionRectForSimpleText): Deleted.
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::drawHighlightForText): Deleted.
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/LayoutPoint.h:
-        (WebCore::roundedForPainting):
-        * platform/graphics/LayoutRect.h:
-        (WebCore::directionalPixelSnappedForPainting): Snap top right corner for rtl direction.
-        * platform/graphics/cairo/FontCairoHarfbuzzNG.cpp:
-        (WebCore::Font::adjustSelectionRectForComplexText):
-        (WebCore::Font::selectionRectForComplexText): Deleted.
-        * platform/graphics/mac/FontComplexTextMac.cpp:
-        (WebCore::Font::adjustSelectionRectForComplexText): removed directional rounding.
-        (WebCore::Font::selectionRectForComplexText): Deleted.
-        * platform/graphics/win/FontWin.cpp:
-        (WebCore::Font::adjustSelectionRectForComplexText):
-        (WebCore::Font::selectionRectForComplexText): Deleted.
-        * rendering/EllipsisBox.cpp:
-        (WebCore::EllipsisBox::selectionRect):
-        (WebCore::EllipsisBox::paintSelection):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::integralEnclosingRectForSelection): helper to address enclosing empty rect problem.
-        (WebCore::InlineTextBox::localSelectionRect):
-        (WebCore::InlineTextBox::paintSelection):
-        (WebCore::InlineTextBox::paintCompositionBackground):
-        (WebCore::InlineTextBox::paintDocumentMarker):
-        (WebCore::InlineTextBox::paintTextMatchMarker):
-        (WebCore::InlineTextBox::computeRectForReplacementMarker):
-        (WebCore::InlineTextBox::positionForOffset):
-        * rendering/svg/SVGInlineTextBox.cpp:
-        (WebCore::SVGInlineTextBox::selectionRectForTextFragment):
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-05-09  Martin Hodovan  &lt;mhodovan@inf.u-szeged.hu&gt;
</del><ins>+            Incorporate review feedback from Darin.
</ins><span class="cx"> 
</span><del>-        ASSERTION FAILED: !m_code || m_code == defaultExceptionCode
-        in WebCore::constructQualifiedName
-        https://bugs.webkit.org/show_bug.cgi?id=132343
</del><ins>+            * accessibility/AccessibilityScrollView.cpp:
+            (WebCore::AccessibilityScrollView::canSetFocusAttribute):
+            (WebCore::AccessibilityScrollView::isFocused):
+            * accessibility/AccessibilityScrollView.h:
</ins><span class="cx"> 
</span><del>-        'Remove bad assertion in SVGSMILElement's constructQualifiedName() by passing
-        IGNORE_EXCEPTION instead ASSERT_NO_EXCEPTION to Document::parseQualifiedName().
-        The constructQualifiedName() function handles parseQualifiedName() failures
-        propertly by returning early so there is no reason to assert on parsing
-        failures.'
</del><ins>+2013-08-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Blink merge: http://src.chromium.org/viewvc/blink?view=revision&amp;revision=173564
-        Based on the patch made by Christophe Dumez &lt;ch.dumez@samsung.com&gt;.
</del><ins>+        Merge r154083
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+    2013-08-14  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/bad-attributeName-crash.html
</del><ins>+            &lt;https://webkit.org/b/119824&gt; AX: WKView does not become first responder when the voiceover cursor lands on it
</ins><span class="cx"> 
</span><del>-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::constructQualifiedName):
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2014-05-08  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            VoiceOver lands on Scroll views by default. It expects that the scroll view will be able to handle the focus calls. 
+            We should forward scroll view focus requests to the web area to handle, which will trigger a becomeFirstResponder on WKView.
</ins><span class="cx"> 
</span><del>-        Multiple (stacked) cues when shuttling through video while playing closed captions
-        https://bugs.webkit.org/show_bug.cgi?id=132715
-        &lt;rdar://problem/16795782&gt;
</del><ins>+            There's not a great way to test this unfortunately, since it requires having focus comes from outside the webview into the webview.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            * accessibility/AccessibilityScrollView.cpp:
+            (WebCore::AccessibilityScrollView::canSetFocusAttribute):
+            (WebCore::AccessibilityScrollView::isFocused):
+            (WebCore::AccessibilityScrollView::setFocused):
+            * accessibility/AccessibilityScrollView.h:
</ins><span class="cx"> 
</span><del>-        Tests: media/track/track-in-band-cues-added-once.html
</del><ins>+2013-08-14  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::hasCue): Revise to use a relaxed time equality.
-        * html/track/TextTrackCue.cpp:
-        (WebCore::TextTrackCue::isEqual): Ditto.
-        (WebCore::TextTrackCue::hasEquivalentStartTime): Added.
-        * html/track/TextTrackCue.h:
-        (WebCore::TextTrackCue::startTimeVariance): Added.
-        * html/track/TextTrackCueGeneric.h:
-        * html/track/TextTrackCueGeneric.cpp:
-        (WebCore::TextTrackCueGeneric::isEqual): Do not call the VTTCue::isEqual method from
-        this class, since cueType() will not equal VTTCue, and the equality will fail.
</del><ins>+        Merge r154030
</ins><span class="cx"> 
</span><del>-2014-05-08  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+    2013-08-13  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Automatically zip document bundles used via File API
-        https://bugs.webkit.org/show_bug.cgi?id=132713
-        &lt;rdar://problem/13397892&gt;
</del><ins>+            [Windows] Windows is incorrectly using a LayerTypeTiledBackingLayer
+            https://bugs.webkit.org/show_bug.cgi?id=119772
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Tests: fast/files/filereader-zip-bundle.html
-               http/tests/local/fileapi/upload-zip-bundle-as-blob.html
</del><ins>+            * platform/graphics/ca/GraphicsLayerCA.cpp:
+            (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer): Ensure that we use
+            the correct (supported) tiled layer type for Windows.
+            * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+            (PlatformCALayer::PlatformCALayer): Add an assertion to notify us if
+            we introduce this mistake again in the future.
</ins><span class="cx"> 
</span><del>-        * FileMac.mm: Added.
-        (WebCore::File::shouldReplaceFile):
-        (WebCore::File::computeNameAndContentTypeForReplacedFile):
-        Added code that decides what to do with a bundle. We need this to happen in
-        WebProcess, because HTML5 dropzone depends on this, it needs to know file type
-        even before a File object can be created.
</del><ins>+2013-08-12  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export new functions.
</del><ins>+        Merge r153917
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj: Added new files.
</del><ins>+    2013-08-09  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/DataTransfer.cpp: (WebCore::DataTransfer::hasFileOfType): Updated for File
-        interface change.
</del><ins>+            Artifacts seen sometimes with layer backed WebKit1 plug-in
+            https://bugs.webkit.org/show_bug.cgi?id=119647
+            &lt;rdar://problem/14002715&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/File.h:
-        * fileapi/File.cpp:
-        (WebCore::File::File):
-        (WebCore::File::computeNameAndContentType):
-        (WebCore::File::contentTypeForFile):
-        (WebCore::File::contentTypeFromFilePathOrName): Deleted.
-        Make it possible for a subclass to affect file name and content type calculation.
</del><ins>+            Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobDataFileReference.cpp:
-        (WebCore::BlobDataFileReference::BlobDataFileReference):
-        (WebCore::BlobDataFileReference::~BlobDataFileReference):
-        (WebCore::BlobDataFileReference::path):
-        (WebCore::BlobDataFileReference::size):
-        (WebCore::BlobDataFileReference::expectedModificationTime):
-        (WebCore::BlobDataFileReference::startTrackingModifications):
-        * platform/network/BlobDataFileReference.h:
-        (WebCore::BlobDataFileReference::path): Deleted.
-        (WebCore::BlobDataFileReference::BlobDataFileReference): Deleted.
-        Use original or replaced file, as appropriate. 
</del><ins>+            Don't try to paint layer backed views - they will be painted by Core Animation.
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/BlobDataFileReferenceMac.mm: Added.
-        (WebCore::BlobDataFileReference::generateReplacementFile): Implements generateReplacementFile().
</del><ins>+            * platform/mac/WidgetMac.mm:
+            (WebCore::Widget::paint):
</ins><span class="cx"> 
</span><del>-        * platform/network/FormData.h: Added a FIXME.
</del><ins>+2013-08-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::send): Always use Blob code path
-        for blobs, don't unwrap them into a file path.
</del><ins>+        Merge r153907
</ins><span class="cx"> 
</span><del>-2014-05-08  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+    2013-08-09  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Occasional crash under AsyncScrollingCoordinator::frameViewRootLayerDidChange() on history navigation
-        https://bugs.webkit.org/show_bug.cgi?id=132723
</del><ins>+            AX: Not able to use arrow keys to read text in a WK2 app
+            https://bugs.webkit.org/show_bug.cgi?id=119605
+            -and corresponding-
+            &lt;rdar://problem/14281275&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
-        
-        Crash reports suggest that when we call AsyncScrollingCoordinator::frameViewRootLayerDidChange()
-        from HistoryController::restoreScrollPositionAndViewState(), the FrameView may not have a 
-        scrolling node ID, which suggests that either the FrameView doesn't have a RenderView,
-        or compositing hasn't happened yet.
-        
-        So if we enter AsyncScrollingCoordinator::frameViewRootLayerDidChange()
-        and the FrameView has no scrollLayerID, just return. We'll fix things up
-        when compositing kicks in later.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
</del><ins>+            This code from defaultKeyboardEventHandler() is the magic that makes this AX 
+            functionality work. This patch moves that into a separate function so that we can 
+            call it from WK2.
+            * WebCore.exp.in:
+            * page/EventHandler.cpp:
+            (WebCore::EventHandler::handleKeyboardSelectionMovementForAccessibility):
+            (WebCore::EventHandler::defaultKeyboardEventHandler):
+            * page/EventHandler.h:
</ins><span class="cx"> 
</span><del>-2014-05-08  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-08-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Bottom-relative position:fixed elements are misplaced on page load
-        https://bugs.webkit.org/show_bug.cgi?id=132719
-        &lt;rdar://problem/16860837&gt;
</del><ins>+        Merge r153809
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+    2013-08-07  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add a couple of functions, and sort.
</del><ins>+            Be more aggressive about sending fake mouse events less frequently
+            https://bugs.webkit.org/show_bug.cgi?id=119563
+            &lt;rdar://problem/14669029&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2014-05-08  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            r109151 added code that throttles back the fake mouse events that we
+            send during scrolling, but in such a way that a page could take up to
+            100ms to handle a single mousemove, and we'd still send fake mousemove
+            events every 100ms. This could cause serious scrolling stutter.
</ins><span class="cx"> 
</span><del>-        [Mac, iOS] Add source application accounting to AVURLAsset.
-        https://bugs.webkit.org/show_bug.cgi?id=132637
</del><ins>+            Fix by changing when we drop back to sending events every 250ms, rather than every
+            100ms: if the slowest mousemove takes 10ms or more (less than one frame), drop back
+            to a 250ms fake move interval.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            * page/EventHandler.cpp:
+            (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon):
</ins><span class="cx"> 
</span><del>-        Properly account for the application responisble for data loading by passing the source
-        application identifier through to AVFoundation through AVURLAsset options.
</del><ins>+2013-08-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        * html/HTMLMediaElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::sourceApplicationIdentifier):
-        * platform/graphics/MediaPlayer.h:
-        (WebCore::MediaPlayerClient::mediaPlayerSourceApplicationIdentifier):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):
-        * platform/network/NetworkingContext.h:
</del><ins>+        Merge r153867
</ins><span class="cx"> 
</span><del>-2014-05-08  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+    2013-08-08  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [MSE][Mac] Move AVStreamDataParser off-main-thread.
-        https://bugs.webkit.org/show_bug.cgi?id=132698
</del><ins>+            [EME] MediaKey APIs should be prefixed.
+            https://bugs.webkit.org/show_bug.cgi?id=119606
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        -[AVStreamDataParser appendStreamData:] can casue the main thread to hang when a
-        large amount of media data is appended at once. Move the actual parsing of data
-        to a background (synchronous) dispatch queue, and split SourceBuffer::appendBufferTimerFired
-        into two functions, the latter of which will be called after the background queue
-        completes.
</del><ins>+            No new tests; updated exsisting tests with new names.
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::appendBufferTimerFired): Split into sourceBufferPrivateAppendComplete.
-        (WebCore::SourceBuffer::sourceBufferPrivateAppendComplete): Split from appendBufferTimerFired.
-        * Modules/mediasource/SourceBuffer.h:
-        * platform/graphics/SourceBufferPrivate.h:
-        * platform/graphics/SourceBufferPrivateClient.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]): Re-dispatch to the
-                web thread.
-        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]): Ditto.
-        (WebCore::globalDataParserQueue): Added.
-        (WebCore::SourceBufferPrivateAVFObjC::append): Dispatch to the globalDataParserQueue.
-        (WebCore::SourceBufferPrivateAVFObjC::appendCompleted): Added.
-        * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
-        (WebCore::MockSourceBufferPrivate::append): Adopt sourceBufferPrivateAppendComplete.
-        * platform/mock/mediasource/MockSourceBufferPrivate.h:
</del><ins>+            Prefix all new classes with &quot;WebKit&quot; and new methods on existing unprefixed
+            classes with &quot;webkit&quot;
</ins><span class="cx"> 
</span><del>-        Update SourceBufferPrivateGStreamer to match the new append return value:
-        * platform/graphics/gstreamer/SourceBufferPrivateGStreamer.cpp:
-        (WebCore::SourceBufferPrivateGStreamer::append):
-        * platform/graphics/gstreamer/SourceBufferPrivateGStreamer.h:
</del><ins>+            * Modules/encryptedmedia/MediaKeyMessageEvent.idl: MediaKeyMessageEvent -&gt; WebKitMediaKeyMessageEvent
+            * Modules/encryptedmedia/MediaKeySession.idl: MediaKeySession -&gt; WebKitMediaKeySession
+            * Modules/encryptedmedia/MediaKeys.idl: MediaKeys -&gt; WebKitMediaKeys
+            * html/HTMLMediaElement.idl: keys -&gt; webkitKeys, setMediaKeys -&gt; webkitSetMediaKeys
+            * html/MediaKeyError.idl: MediaKeyError -&gt; WebKitMediaKeyError
</ins><span class="cx"> 
</span><del>-2014-05-08  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-08-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168498.
-        https://bugs.webkit.org/show_bug.cgi?id=132714
</del><ins>+        Merge r153851
</ins><span class="cx"> 
</span><del>-        broke Mavericks WK2 (Requested by litherum on #webkit).
</del><ins>+    2013-08-08  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+            [EME] setMediaKeys function as defined in the EME specification does not work
+            https://bugs.webkit.org/show_bug.cgi?id=119597
</ins><span class="cx"> 
</span><del>-        &quot;http/tests/security/xss-DENIED-xsl-document-redirect.xml
-        fails with NetworkProcess&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132523
-        http://trac.webkit.org/changeset/168498
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-05-08  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+            No new tests; updated media/encrypted-media/encrypted-media-v2-syntax.html
</ins><span class="cx"> 
</span><del>-        http/tests/security/xss-DENIED-xsl-document-redirect.xml fails with NetworkProcess
-        https://bugs.webkit.org/show_bug.cgi?id=132523
</del><ins>+            Rename the mediaKeys attribute 'keys' and make readonly, and add an explicit
+            setMediaKeys() method in HTMLMediaElement's IDL.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            * html/HTMLMediaElement.h:
+            (WebCore::HTMLMediaElement::keys):
+            * html/HTMLMediaElement.idl:
</ins><span class="cx"> 
</span><del>-        We should not manufacture a response in the event of an error during a
-        synchronous XHR. In addition, this test removes one place that is
-        sensitive to such a manufactured response.
</del><ins>+2013-08-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Updates test expectations.
</del><ins>+        Merge r153838
</ins><span class="cx"> 
</span><del>-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Do not
-        manufacture a response
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Do not
-        manufacture a response
-        * xml/XSLTProcessorLibxslt.cpp:
-        (WebCore::docLoaderFunc): Only use the response's URL if no error
-        occurred.
</del><ins>+    2013-08-08  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-08  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            [EME] Implement MediaKeys.isTypeSupported()
+            https://bugs.webkit.org/show_bug.cgi?id=119586
</ins><span class="cx"> 
</span><del>-        [iOS] WebKit should listen to critical memory warnings.
-        &lt;https://webkit.org/b/132704&gt;
-        &lt;rdar://problem/16857112&gt;
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Listen for DISPATCH_MEMORYSTATUS_PRESSURE_CRITICAL in addition to
-        DISPATCH_MEMORYSTATUS_PRESSURE_WARN, since we may only get the critical
-        notification on some systems.
</del><ins>+            Test: media/encrypted-media/encrypted-media-is-type-supported.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+            The EME spec has removed the extra keySystem parameter from
+            HTMLMediaElement.canPlayType() in favor of a new isTypeSupported()
+            method on MediaKeys.
</ins><span class="cx"> 
</span><del>-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::install):
</del><ins>+            To implement this method, the CDMFactory needs to know whether the
+            registered CDM supports the specified mime type.  CDMs must register
+            this new factory method, which requires changes to CDMPrivateAVFoundation
+            and MockCDM.
</ins><span class="cx"> 
</span><del>-2014-05-08  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+            Add the new MediaKeys.isTypeSupported() method:
+            * Modules/encryptedmedia/MediaKeys.cpp:
+            (WebCore::MediaKeys::isTypeSupported):
+            * Modules/encryptedmedia/MediaKeys.h:
+            * Modules/encryptedmedia/MediaKeys.idl:
</ins><span class="cx"> 
</span><del>-        Web Inspector: InspectorDOMAgent::getAccessibilityPropertiesForNode should gracefully handle bad node
-        https://bugs.webkit.org/show_bug.cgi?id=132697
</del><ins>+            Add the new factory CDMSupportsKeySystemAndMimeType method:
+            * Modules/encryptedmedia/CDM.cpp:
+            (WebCore::CDMFactory::CDMFactory): Now takes a third parameter.
+            (WebCore::installedCDMFactories): When adding the AVFoundation CDM, pass its new method.
+            (WebCore::CDM::registerCDMFactory): Now takes a third parameter.
+            (WebCore::CDM::keySystemSupportsMimeType): Added.
+            * Modules/encryptedmedia/CDM.h:
+            * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+            Register this new method with the factory for all concrete CDMs:
+            * Modules/encryptedmedia/CDMPrivateAVFoundation.h:
+            * Modules/encryptedmedia/CDMPrivateAVFoundation.mm:
+            (WebCore::CDMPrivateAVFoundation::supportsKeySystem):
+            (WebCore::CDMPrivateAVFoundation::supportsKeySystemAndMimeType):
+            * testing/Internals.cpp:
+            (WebCore::Internals::initializeMockCDM):
+            * testing/MockCDM.cpp:
+            (WebCore::MockCDM::supportsKeySystem):
+            (WebCore::MockCDM::supportsKeySystemAndMimeType):
+            * testing/MockCDM.h:
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::getAccessibilityPropertiesForNode):
-        Gracefully handle no node.
</del><ins>+2013-08-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-08  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Merge r153810
</ins><span class="cx"> 
</span><del>-        Fix the iOS build after r168476.
</del><ins>+    2013-08-07  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/GraphicsContextMac.mm:
-        (WebCore::GraphicsContext::drawFocusRing):
</del><ins>+            Avoid spurious &quot;all repaint&quot; layouts when scrolling WebViews on Retina displays
+            https://bugs.webkit.org/show_bug.cgi?id=119564
</ins><span class="cx"> 
</span><del>-2014-05-08  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+            Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Shapes do not resolve dimensions specified in viewport units
-        https://bugs.webkit.org/show_bug.cgi?id=124052
</del><ins>+            When scrolling WebViews on Macs with Retina displays, AppKit uses
+            device pixels for the scroll offset, so [scrollView() documentVisibleRect]
+            can return a CGRect with non-integral origin. This rect is used by layout,
+            via layoutSize(), to decide whether the view size changed, which prompts
+            a full repaint. However, FrameView gets a value which has been rounded
+            by enclosingIntRect(), which increases the height or width by 1px if the 
+            y or x offset is on a half-pixel, causing spurious full repaints.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            Fix by plumbing through platformVisibleContentSize(), which just
+            gets the size of the -documentVisibleRect.
</ins><span class="cx"> 
</span><del>-        Viewport unit resolution doesn't work unless the RenderView is passed
-        down into the floatValueForLength methods. All this does is plumb down
-        a RenderView in all of these cases.
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::layout): Don't get layoutHeight and layoutWidth
+            separately, since that is two calls down into platformVisibleContentSize.
+            * platform/ScrollView.cpp:
+            (WebCore::ScrollView::unscaledVisibleContentSize):
+            (WebCore::ScrollView::platformVisibleContentSize):
+            * platform/ScrollView.h:
+            * platform/mac/ScrollViewMac.mm:
+            (WebCore::ScrollView::platformVisibleContentSize):
</ins><span class="cx"> 
</span><del>-        Tests: css3/masking/clip-path-polygon-viewport-units.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-viewport-units.html
</del><ins>+2013-08-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/BasicShapeFunctions.cpp:
-        (WebCore::floatValueForCenterCoordinate):
-        * css/BasicShapeFunctions.h:
-        * css/LengthFunctions.cpp:
-        (WebCore::floatSizeForLengthSize):
-        * css/LengthFunctions.h:
-        * rendering/ClipPathOperation.h:
-        (WebCore::ShapeClipPathOperation::pathForReferenceRect):
-        (WebCore::BoxClipPathOperation::pathForReferenceRect):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::setupClipPath):
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createShape):
-        * rendering/shapes/Shape.h:
-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::ShapeOutsideInfo::computedShape):
-        * rendering/style/BasicShapes.cpp:
-        (WebCore::BasicShapeCircle::floatValueForRadiusInBox):
-        (WebCore::BasicShapeCircle::path):
-        (WebCore::BasicShapeEllipse::floatValueForRadiusInBox):
-        (WebCore::BasicShapeEllipse::path):
-        (WebCore::BasicShapePolygon::path):
-        (WebCore::floatSizeForLengthSize):
-        (WebCore::BasicShapeInset::path):
-        * rendering/style/BasicShapes.h:
-        * rendering/svg/SVGRenderingContext.cpp:
-        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
</del><ins>+        Merge r153845
</ins><span class="cx"> 
</span><del>-2014-05-08  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+    2013-08-08  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Cue display events may not be registered during page load.
-        https://bugs.webkit.org/show_bug.cgi?id=132696
-        &lt;rdar://problem/16652874&gt;
</del><ins>+            [Windows] Improper Caption Button Displayed to Users
+            https://bugs.webkit.org/show_bug.cgi?id=119593 
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller.prototype.handleTextTrackAdd): Don't register
-        for 'cuechange' events anymore.
-        (Controller.prototype.handleTextTrackRemove): Ditto.
-        (Controller.prototype.updateCaptionContainer): Reduce CSS
-        churn by not adding/removing 'Hidden' class every time a
-        new cue is processed. Only do this when transitioning
-        track display state.
-        (Controller.prototype.handleTextTrackCueChange): Deleted.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::updateTextTrackDisplay): Call
-        'updateTextTrackContainer' directory when processing cues,
-        rather than trampolining through the JS layer.
</del><ins>+            Remove the custom drawing code for the Windows port, and
+            have it render using the CSS/SVG markup like we do on OS X.
</ins><span class="cx"> 
</span><del>-2014-05-08  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            * rendering/RenderThemeWin.cpp: Remove drawing code.
+            * rendering/RenderThemeWin.h: Remove declaration.
</ins><span class="cx"> 
</span><del>-        Make BlobDataFileReference manage its sandbox extension
-        https://bugs.webkit.org/show_bug.cgi?id=132689
</del><ins>+2013-08-07  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Merge r153775
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export symbols that are now needed in WebKit2 to subclass BlobDataFileReference.
</del><ins>+    2013-08-06  Stephanie Lewis  &lt;slewis@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/ThreadableBlobRegistry.cpp: (WebCore::ThreadableBlobRegistry::registerFileBlobURL):
-        * platform/network/BlobData.cpp: (WebCore::BlobData::appendFile):
-        * platform/network/BlobData.h: (WebCore::BlobDataItem::BlobDataItem):
-        * platform/network/BlobRegistry.h:
-        * platform/network/BlobRegistryImpl.cpp: (WebCore::BlobRegistryImpl::registerFileBlobURL):
-        * platform/network/BlobRegistryImpl.h:
-        BlobRegistry now takes a BlobDataFileReference and not a path, so that WebKit2
-        could pass objects that include sandbox extensions.
</del><ins>+            Update Order Files for Safari
+            &lt;rdar://problem/14517392&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobDataFileReference.h:
-        * platform/network/BlobDataFileReference.cpp:
-        (WebCore::BlobDataFileReference::~BlobDataFileReference): Added a virtual destructor.
-        (WebCore::BlobDataFileReference::size): We now record the size and modification time right away, no need to lazily calculate them.
-        (WebCore::BlobDataFileReference::expectedModificationTime): Ditto.
-        (WebCore::BlobDataFileReference::startTrackingModifications): Record time and size
-        (since it's a single call). However, size calculation will become complicated again soon.
-        (WebCore::BlobDataFileReference::prepareForFileAccess): A hook for subclasses.
-        (WebCore::BlobDataFileReference::revokeFileAccess): Ditto.
-        (WebCore::BlobDataFileReference::computeFileSystemData): Deleted.
</del><ins>+            Unreviewed.
</ins><span class="cx"> 
</span><del>-2014-05-08  Rik Cabanier  &lt;cabanier@adobe.com&gt;
</del><ins>+            No change in functionality.
</ins><span class="cx"> 
</span><del>-        Add support for drawFocusIfNeeded
-        https://bugs.webkit.org/show_bug.cgi?id=132584
</del><ins>+            * WebCore.order:
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+2013-08-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The drawFocusIfNeeded API will draw a focus ring if the element that is passed
-        in is focused and a child element of the canvas.
</del><ins>+        Merge r153758
</ins><span class="cx"> 
</span><del>-        Test: fast/canvas/draw-focus-if-needed.html
</del><ins>+    2013-08-06  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawFocusIfNeeded):
-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/CanvasRenderingContext2D.idl:
</del><ins>+            Improper Calculation of In-band Cue Colors
+            https://bugs.webkit.org/show_bug.cgi?id=119523
</ins><span class="cx"> 
</span><del>-2014-05-08  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Can't activate text fields on Facebook
-        https://bugs.webkit.org/show_bug.cgi?id=132682
</del><ins>+            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
+            (WebCore::makeRGBA32FromARGBCFArray): Remove redundant multiplication by
+            255.  The internal conversion logic already converts to bytes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/DOMTimer.cpp:
-        (WebCore::DOMTimer::fired):
-        
-            The isDocument() test here had reversed in the merge breaking content change observer callback.
</del><ins>+        Merge r153725
</ins><span class="cx"> 
</span><del>-2014-05-07  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+    2013-08-05  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace DEPRECATED_DEFINE_STATIC_LOCAL by static NeverDestroyed&lt;T&gt; in svg/
-        https://bugs.webkit.org/show_bug.cgi?id=132647
</del><ins>+            &lt;rdar://problem/14637103&gt; REGRESSION (r153060?): Microphone appears in the way
+            of text when dictating an e-mail
+            https://bugs.webkit.org/show_bug.cgi?id=119496
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::isSupportedAttribute):
-        * svg/SVGAnimateMotionElement.cpp:
-        (WebCore::SVGAnimateMotionElement::isSupportedAttribute):
-        * svg/SVGAnimateTransformElement.cpp:
-        (WebCore::SVGAnimateTransformElement::isSupportedAttribute):
-        * svg/SVGAnimatedLength.cpp:
-        (WebCore::sharedSVGLength):
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::isSupportedAttribute):
-        * svg/SVGCircleElement.cpp:
-        (WebCore::SVGCircleElement::isSupportedAttribute):
-        * svg/SVGClipPathElement.cpp:
-        (WebCore::SVGClipPathElement::isSupportedAttribute):
-        * svg/SVGComponentTransferFunctionElement.cpp:
-        (WebCore::SVGComponentTransferFunctionElement::isSupportedAttribute):
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::isSupportedAttribute):
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::instancesForElement):
-        (WebCore::SVGElement::childShouldCreateRenderer):
-        * svg/SVGEllipseElement.cpp:
-        (WebCore::SVGEllipseElement::isSupportedAttribute):
-        * svg/SVGFEBlendElement.cpp:
-        (WebCore::SVGFEBlendElement::isSupportedAttribute):
-        * svg/SVGFEColorMatrixElement.cpp:
-        (WebCore::SVGFEColorMatrixElement::isSupportedAttribute):
-        * svg/SVGFEComponentTransferElement.cpp:
-        (WebCore::SVGFEComponentTransferElement::isSupportedAttribute):
-        * svg/SVGFECompositeElement.cpp:
-        (WebCore::SVGFECompositeElement::isSupportedAttribute):
-        * svg/SVGFEConvolveMatrixElement.cpp:
-        (WebCore::SVGFEConvolveMatrixElement::isSupportedAttribute):
-        * svg/SVGFEDiffuseLightingElement.cpp:
-        (WebCore::SVGFEDiffuseLightingElement::isSupportedAttribute):
-        * svg/SVGFEDisplacementMapElement.cpp:
-        (WebCore::SVGFEDisplacementMapElement::isSupportedAttribute):
-        * svg/SVGFEDropShadowElement.cpp:
-        (WebCore::SVGFEDropShadowElement::isSupportedAttribute):
-        * svg/SVGFEGaussianBlurElement.cpp:
-        (WebCore::SVGFEGaussianBlurElement::isSupportedAttribute):
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::isSupportedAttribute):
-        * svg/SVGFELightElement.cpp:
-        (WebCore::SVGFELightElement::isSupportedAttribute):
-        * svg/SVGFEMergeNodeElement.cpp:
-        (WebCore::SVGFEMergeNodeElement::isSupportedAttribute):
-        * svg/SVGFEMorphologyElement.cpp:
-        (WebCore::SVGFEMorphologyElement::isSupportedAttribute):
-        * svg/SVGFEOffsetElement.cpp:
-        (WebCore::SVGFEOffsetElement::isSupportedAttribute):
-        * svg/SVGFESpecularLightingElement.cpp:
-        (WebCore::SVGFESpecularLightingElement::isSupportedAttribute):
-        * svg/SVGFETileElement.cpp:
-        (WebCore::SVGFETileElement::isSupportedAttribute):
-        * svg/SVGFETurbulenceElement.cpp:
-        (WebCore::SVGFETurbulenceElement::isSupportedAttribute):
-        * svg/SVGFilterElement.cpp:
-        (WebCore::SVGFilterElement::isSupportedAttribute):
-        (WebCore::SVGFilterElement::childShouldCreateRenderer):
-        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
-        (WebCore::SVGFilterPrimitiveStandardAttributes::isSupportedAttribute):
-        * svg/SVGForeignObjectElement.cpp:
-        (WebCore::SVGForeignObjectElement::isSupportedAttribute):
-        * svg/SVGGElement.cpp:
-        (WebCore::SVGGElement::isSupportedAttribute):
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::isSupportedAttribute):
-        * svg/SVGGraphicsElement.cpp:
-        (WebCore::SVGGraphicsElement::isSupportedAttribute):
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::isSupportedAttribute):
-        * svg/SVGLength.cpp:
-        (WebCore::SVGLength::lengthModeForAnimatedLengthAttribute):
-        * svg/SVGLineElement.cpp:
-        (WebCore::SVGLineElement::isSupportedAttribute):
-        * svg/SVGLinearGradientElement.cpp:
-        (WebCore::SVGLinearGradientElement::isSupportedAttribute):
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::isSupportedAttribute):
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::isSupportedAttribute):
-        * svg/SVGMaskElement.cpp:
-        (WebCore::SVGMaskElement::isSupportedAttribute):
-        * svg/SVGPathElement.cpp:
-        (WebCore::SVGPathElement::isSupportedAttribute):
-        * svg/SVGPatternElement.cpp:
-        (WebCore::SVGPatternElement::isSupportedAttribute):
-        * svg/SVGPolyElement.cpp:
-        (WebCore::SVGPolyElement::isSupportedAttribute):
-        * svg/SVGRadialGradientElement.cpp:
-        (WebCore::SVGRadialGradientElement::isSupportedAttribute):
-        * svg/SVGRectElement.cpp:
-        (WebCore::SVGRectElement::isSupportedAttribute):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::isSupportedAttribute):
-        * svg/SVGStopElement.cpp:
-        (WebCore::SVGStopElement::isSupportedAttribute):
-        * svg/SVGStyleElement.cpp:
-        (WebCore::SVGStyleElement::isSupportedAttribute):
-        * svg/SVGSymbolElement.cpp:
-        (WebCore::SVGSymbolElement::isSupportedAttribute):
-        * svg/SVGTRefElement.cpp:
-        (WebCore::SVGTRefElement::isSupportedAttribute):
-        * svg/SVGTests.cpp:
-        (WebCore::SVGTests::attributeToPropertyMap):
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::SVGTextContentElement::textLengthAnimated):
-        (WebCore::SVGTextContentElement::isSupportedAttribute):
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::isSupportedAttribute):
-        * svg/SVGTextPositioningElement.cpp:
-        (WebCore::SVGTextPositioningElement::isSupportedAttribute):
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::isSupportedAttribute):
-        (WebCore::isDisallowedElement):
-        * svg/SVGViewElement.cpp:
-        (WebCore::SVGViewElement::isSupportedAttribute):
</del><ins>+            Test: platform/mac/editing/input/firstrectforcharacterrange-caret-in-br.html
</ins><span class="cx"> 
</span><del>-2014-05-08  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+            * rendering/RenderObject.cpp: (WebCore::RenderObject::absoluteBoundingBoxRectForRange):
+            FloatRect::unite() doesn't preserve empty rects, which we need here.
+            We alrady handle the case of collapsed range in Editor::firstRectForRange(), and
+            this is similar, but we can't currently cover both with one simple fix.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Replacing Unisolated with NotIsolated in variables and methods names
-        https://bugs.webkit.org/show_bug.cgi?id=132677
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Merge r152884
</ins><span class="cx"> 
</span><del>-        No new tests required.
</del><ins>+    2013-07-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::RenderLayer):
-        (WebCore::RenderLayer::updateAncestorChainHasBlendingDescendants):
-        (WebCore::RenderLayer::dirtyAncestorChainHasBlendingDescendants):
-        (WebCore::RenderLayer::updateDescendantDependentFlags):
-        hasUnisolatedBlendingDescendants -&gt; hasNotIsolatedBlendingDescendants
-        (WebCore::RenderLayer::addChild):
-        (WebCore::RenderLayer::removeChild):
-        (WebCore::RenderLayer::updateStackingContextsAfterStyleChange):
-        * rendering/RenderLayer.h:
-        m_hasUnisolatedBlendingDescendants -&gt; m_hasNotIsolatedBlendingDescendants
-        m_hasUnisolatedBlendingDescendantsStatusDirty -&gt; m_hasNotIsolatedBlendingDescendantsStatusDirty
-        hasUnisolatedBlendingDescendants() -&gt; hasNotIsolatedBlendingDescendants()
-        hasUnisolatedBlendingDescendantsStatusDirty() -&gt; hasNotIsolatedBlendingDescendantsStatusDirty()
-        m_hasUnisolatedCompositedBlendingDescendants -&gt; m_hasNotIsolatedCompositedBlendingDescendants
-        hasUnisolatedCompositedBlendingDescendants() -&gt; hasNotIsolatedCompositedBlendingDescendants()
-        setHasUnisolatedCompositedBlendingDescendants() -&gt; setHasNotIsolatedCompositedBlendingDescendants
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::CompositingState::CompositingState):
-        m_hasUnisolatedCompositedBlendingDescendants -&gt; m_hasNotIsolatedCompositedBlendingDescendants
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
</del><ins>+            Build fix after r152876.
</ins><span class="cx"> 
</span><del>-2014-05-08  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</del><ins>+            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundation::processNewAndRemovedTextTracks):
</ins><span class="cx"> 
</span><del>-        [GTK] Enable skipped http/tests/media/hls/video-controls-live-stream.html
-        https://bugs.webkit.org/show_bug.cgi?id=132329
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Merge r152876
</ins><span class="cx"> 
</span><del>-        GTK port needed to define what happened with live stream media
-        controls. Now we disable and dim the timeline and tweak the
-        timers.
</del><ins>+    2013-07-18  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: http/tests/media/hls/video-controls-live-stream.html.
</del><ins>+            [Media] Share more code between Mac and Windows implementation files.
+            https://bugs.webkit.org/show_bug.cgi?id=118801
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsGtk.js:
-        (ControllerGtk.prototype.configureControls): Moved logic from
-        setControlsType and changed to use an early return.
-        (ControllerGtk.prototype.reconnectControls): Redefined to just
-        configure the controls.
-        (ControllerGtk.prototype.handlePlay): If stream is live we don't
-        activate the current time just in case.
-        (ControllerGtk.prototype.updateDuration): Calls the superclass and
-        sets timeline.max to 0.
-        (ControllerGtk.prototype.setControlsType): Deleted.
-        (ControllerGtk.prototype.setIsLive): Configures controls and
-        disables the timeline if stream is live.
-        * css/mediaControlsGtk.css:
-        (audio::-webkit-media-controls-timeline[disabled])
-        (video::-webkit-media-controls-timeline[disabled]): Dimmed the
-        timeline by setting opacity to 0.3.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-08  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundation::clearTextTracks): Move
+            implementation from ObjC file to parent file.
+            (WebCore::MediaPlayerPrivateAVFoundation::processNewAndRemovedTextTracks):
+            Ditto.
+            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+            Remove duplicate implementation.
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            Ditto.
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
+            Ditto.
+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
+            Ditto.
+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            Ditto.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Changing isolation CSS property should not trigger repaint in RenderStyle::changeRequiresLayerRepaint
-        https://bugs.webkit.org/show_bug.cgi?id=131436
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Merge r153628
</ins><span class="cx"> 
</span><del>-        The isolation:isolate property will create a stacking context. This is done in
-        StyleResolver::adjustRenderStyle where z-index is forced to 0.
-        If the element is already a stacking context for any other reason,
-        changing the isolation flag should not have any effect.
</del><ins>+    2013-08-01  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: css3/blending/repaint/blend-mode-turn-off-isolation-no-effect.html
-               css3/blending/repaint/blend-mode-turn-off-isolation.html
</del><ins>+            [Windows] WebKit1 Fullscreen Video Play is Broken
+            https://bugs.webkit.org/show_bug.cgi?id=119415
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeRequiresLayerRepaint):
-        do not request repaint if isolation has changed.
</del><ins>+            Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-2014-05-08  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Add
+            call for ACFPlayerLayerSetFrame
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundationCF::platformSetVisible):
+            Tear down video player when leaving Fullscreen mode and not using
+            the newer Fullscreen feature.
+            (WebCore::AVFWrapper::disconnectAndDeleteAVFWrapper):
+            Disconnect from notifications for AVCFPlayerItemPresentationSizeChangedNotification,
+            AVCFPlayerItemDuratoinChangedNotification, and disconnect any
+            LegibleOutput items added to the player item.
+            (WebCore::AVFWrapper::createPlayerItem): Add notifications for
+            AVCFPlayerItemPresentationSizeChanged. 
+            (WebCore::LayerClient::platformCALayerLayoutSublayersOfLayer): Notify
+            the AVCFPLayerLayer when the display size has changed.
+            * platform/graphics/ca/win/CACFLayerTreeHost.h:
+            (WebCore::CACFLayerTreeHost::manualCreateRenderer): Added.
+            * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h:
+            (WebCore::WKCACFViewLayerTreeHost::manualCreateRenderer): Added.
+            * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
+            (WebCore::MediaPlayerPrivateFullscreenWindow::createWindow): Minor
+            cleanups.
+            (WebCore::MediaPlayerPrivateFullscreenWindow::setRootChildLayer):
+            Make sure a Direct3D renderer is created when building the full screen
+            window for Video playback.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r167652): SelectionState is not set properly for non leaf objects in pages with regions
-        https://bugs.webkit.org/show_bug.cgi?id=132493
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Merge r153377
</ins><span class="cx"> 
</span><del>-        Non selection leaf elements were not included in the selection ranges,
-        that was causing that their selection state was not set properly and
-        when one of the element was removed as it was marked as SelectionNone
-        current selection was not removed.
</del><ins>+    2013-07-26  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Due to this fix, the regression detected in bug #131982 arose again.
-        Reverted changes from r167675 and reopened bug as previous fix was not
-        right. Updated TestExpectations accordingly.
</del><ins>+            [Windows] Remove workarounds now that rdar://problem/14390466 is fixed.
+            https://bugs.webkit.org/show_bug.cgi?id=119150
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/selection/crash-select-all.html
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::splitSelectionBetweenSubtrees): We need to include
-        non selection leafs in the range, otherwise we won't be marking
-        selection state of some elements properly.
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::AVFWrapper::createPlayer): Remove workaround to add legible output
+            after player is created.
+            (WebCore::AVFWrapper::createPlayerItem): Remove workaround to delay adding
+            legible output until player is created.
+            (WebCore::AVFWrapper::platformLayer): Get rid of unused temporary.
</ins><span class="cx"> 
</span><del>-2014-05-08  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Can't select content within the area of the floating box when clip-path is applied
-        https://bugs.webkit.org/show_bug.cgi?id=131375
</del><ins>+        Merge r152861
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+    2013-07-17  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        According to http://www.w3.org/TR/css-masking-1/, the clipped part of the element should
-        not have pointer event dispatching. So add this logic to RenderBlock::nodeAtPoint. This
-        fixes the bug as it disallows selection on any clipped parts.
</del><ins>+            [Windows] Support in-band text tracks.
+            https://bugs.webkit.org/show_bug.cgi?id=103770
</ins><span class="cx"> 
</span><del>-        I implemented the proper selection for the various CSS box types and added testing
-        for them. Also, I made and run performance tests for exposing mouse events over the
-        clipped/non-clipped area, which results can be seen in bugzilla.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Based on the patch made by Rob Buis &lt;rob.buis@samsung.com&gt;
-        Blink revision: http://src.chromium.org/viewvc/blink?view=revision&amp;revision=172619
</del><ins>+            Existing media tests cover these features.
</ins><span class="cx"> 
</span><del>-        Tests: fast/masking/clip-path-selection.html
-               fast/shapes/shape-outside-floats/shape-outside-clip-path-selection.html
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add new files for Windows captions
+            * WebCore.vcxproj/WebCore.vcxproj.filters: ditto.
+            * config.h: Make sure proper buid flags are turned on when building
+            with AVCF_LEGIBLE_OUTPUT.
+            * page/CaptionUserPreferencesMediaAF.cpp: Revise to reduce soft linking
+            duplication between Mac and Windows.
+            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Update
+            to support Windows platform by removing compiler guards and adding
+            Windows declarations for soft-link functions.
+            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h: Ditto.
+            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+            Remove build guards preventing Windows from using LegibleOutput
+            features.
+            (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
+            (WebCore::MediaPlayerPrivateAVFoundation::seek):
+            (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted):
+            (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification):
+            (WebCore::MediaPlayerPrivateAVFoundation::trackModeChanged):
+            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+            (WebCore::MediaPlayerPrivateAVFoundation::contentsNeedsDisplay): Ditto
+            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h:
+            Add new LegibleOutput support functions, and try to reduce duplication
+            between Windows and Mac soft link declarations.
+            * platform/graphics/avfoundation/cf/CoreMediaSoftLinking.h: Ditto.
+            * platform/graphics/avfoundation/cf/InbandTextTrackPrivateAVCF.cpp: Added.
+            (WebCore::InbandTextTrackPrivateAVCF::InbandTextTrackPrivateAVCF):
+            (WebCore::InbandTextTrackPrivateAVCF::disconnect):
+            (WebCore::InbandTextTrackPrivateAVCF::kind):
+            (WebCore::InbandTextTrackPrivateAVCF::isClosedCaptions):
+            (WebCore::InbandTextTrackPrivateAVCF::isSDH):
+            (WebCore::InbandTextTrackPrivateAVCF::containsOnlyForcedSubtitles):
+            (WebCore::InbandTextTrackPrivateAVCF::isMainProgramContent):
+            (WebCore::InbandTextTrackPrivateAVCF::isEasyToRead):
+            (WebCore::InbandTextTrackPrivateAVCF::label):
+            (WebCore::InbandTextTrackPrivateAVCF::language):
+            (WebCore::InbandTextTrackPrivateAVCF::isDefault):
+            * platform/graphics/avfoundation/cf/InbandTextTrackPrivateAVCF.h: Added.
+            (WebCore::InbandTextTrackPrivateAVCF::create):
+            (WebCore::InbandTextTrackPrivateAVCF::~InbandTextTrackPrivateAVCF):
+            (WebCore::InbandTextTrackPrivateAVCF::mediaSelectionOption):
+            * platform/graphics/avfoundation/cf/InbandTextTrackPrivateLegacyAVCF.cpp: Added.
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::InbandTextTrackPrivateLegacyAVCF):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::disconnect):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::kind):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::isClosedCaptions):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::containsOnlyForcedSubtitles):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::isMainProgramContent):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::isEasyToRead):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::label):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::language):
+            * platform/graphics/avfoundation/cf/InbandTextTrackPrivateLegacyAVCF.h: Added.
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::create):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::~InbandTextTrackPrivateLegacyAVCF):
+            (WebCore::InbandTextTrackPrivateLegacyAVCF::avPlayerItemTrack):
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            Update to support LegibleOutput features for the Windows port.
+            (WebCore::AVFWrapper::currentTrack): Added.
+            (WebCore::AVFWrapper::legibleOutput): Added.
+            (WebCore::createMetadataKeyNames): Added missing key names.
+            (WebCore::avLegibleOutput): Added.
+            (WebCore::safeMediaSelectionGroupForLegibleMedia): Added.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::cancelLoad): Clear text
+            tracks when cancelling.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::setCurrentTrack): Added.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::currentTrack): Added.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::platformDuration): Revised
+            to match logic in Objective C implementation.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::currentTime): Revised
+            to match logic in Objective C implementation.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::paintCurrentFrameInContext):
+            Check presence of metadata before proceeding. Revised to match logic
+            in Objective C implementation.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::paint): Ditto.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged): Update for
+            in-band text tracks.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::clearTextTracks): Added.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::processLegacyClosedCaptionsTracks):
+            Added.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::processNewAndRemovedTextTracks):
+            Added.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::processMediaSelectionOptions):
+            Added.
+            (WebCore::AVFWrapper::setCurrentTrack): Added.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::languageOfPrimaryAudioTrack):
+            Added.
+            (WebCore::AVFWrapper::AVFWrapper): Add new initializers.
+            (WebCore::AVFWrapper::~AVFWrapper): Clean up text track information.
+            (WebCore::AVFWrapper::createPlayer): Add Legible Output support.
+            (WebCore::AVFWrapper::createPlayerItem): Ditto.
+            (WebCore::LegibleOutputData::LegibleOutputData): Added.
+            (WebCore::AVFWrapper::processCue): Added.
+            (WebCore::AVFWrapper::legibleOutputCallback): Added.
+            (WebCore::AVFWrapper::safeMediaSelectionGroupForLegibleMedia): Added.
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
+            Update to support LegibleOutput features for the Windows port.
+            * platform/win/SoftLinking.h: Change signature of variable accessor
+            to match Mac so reduce duplicate code.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::nodeAtPoint):
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-07  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+        Merge r153706
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Blending doesn't work if the parent stacking context is not a self painting layer
-        https://bugs.webkit.org/show_bug.cgi?id=130891
</del><ins>+    2013-08-03  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Loading a video with a custom URL scheme will result in stalling playback
+            https://bugs.webkit.org/show_bug.cgi?id=119469
</ins><span class="cx"> 
</span><del>-        The stacking context layers having unisolated blending descendants should be able
-        to create transparency layers or to become composited in order to restrict blending 
-        content to accessing the information outside the current stacking context.
-        Some layers are not self painting layers and these layers cannot crate transparency
-        layers and cannot be composited, thus they are not able to isolate blending descendants
-        when it's required.
-        
-        The solution in this patch is to make a layer isSelfPaintingLayer when
-        it needs to isolate blending descendants (hasUnisolatedBlendingDescendants).
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Tests: css3/blending/blend-mode-isolation-accelerated-overflow-hidden.html
-               css3/blending/blend-mode-isolation-overflow-hidden.html
-               css3/blending/blend-mode-isolation-turn-off-self-painting-layer.html
-               css3/blending/blend-mode-isolation-turn-off-self-painting-layer1.html
-               css3/blending/blend-mode-isolation-turn-off-self-painting-layer2.html
-               css3/blending/blend-mode-isolation-turn-on-self-painting-layer.html
</del><ins>+            Break the assumption that only one AVAssetResourceRequest will be outstanding simultaneously
+            by storing a HashMap of AVAssetResourceRequests and their resulting WebCoreAVFResourceLoader.
+            When loading is stopped (due to completion or error), notify the MediaPlayerPrivateAVFoundation
+            parent so that the map can be emptied.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateAncestorChainHasBlendingDescendants):
-        When hasUnisolatedBlendingDescendants is set we make sure that isSelfPaintingLayer flag is set too.
-        (WebCore::RenderLayer::updateDescendantDependentFlags):
-        The flags might be read or changed while walking the descendants, so we don't want to reset
-        them before traversing the tree.
-        (WebCore::RenderLayer::shouldBeSelfPaintingLayer):
-        Adding isolatesBlending() condition for a layer to be self painting.
-        * rendering/RenderLayer.h:
-        Removing ASSERT from hasUnisolatedBlendingDescendants(). It crashes in minibrowser
-        and in layout tests when painting contents. Similar bugs on other flags: #71044, #71277.
-        * rendering/RenderLayerModelObject.cpp:
-        (WebCore::RenderLayerModelObject::styleDidChange):
-        Telling ancestors that blend mode property has been removed from CSS when the layer for
-        this element is going to be removed; styleChanged will not be called anymore.
</del><ins>+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::shouldWaitForLoadingOfResource): Store the request
+                in m_resourceLoaderMap.
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::didCancelLoadingRequest): Pull the request from
+                m_resourceLoaderMap.
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::didStopLoadingRequest): Remove the requset from
+                m_resourceLoaderMap.
+            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
+            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
+            (WebCore::WebCoreAVFResourceLoader::create): Return a PassRefPtr, rather than a PassOwnPtr.
+            (WebCore::WebCoreAVFResourceLoader::stopLoading): Call didStopLoadingRequest.
</ins><span class="cx"> 
</span><del>-2014-05-06  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Dragging text from one paragraph to another does not render as expected
-        https://bugs.webkit.org/show_bug.cgi?id=132633
</del><ins>+        Merge r153699
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler and Ryosuke Niwa.
</del><ins>+    2013-08-04  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When we are dragging and dropping into a content editable field, we detect
-        if we are trying to put a &lt;p&gt; into an existing &lt;p&gt;, and if so, split the
-        outer &lt;p&gt; and insert the new &lt;p&gt; as its sibling. However, the outer &lt;p&gt;
-        might not be editable, so we don't want to do any splitting and inserting
-        at that location.
</del><ins>+            Inserting a rule into an empty style sheet shouldn't trigger style recalc unless necessary.
+            &lt;http://webkit.org/b/119475&gt;
+            &lt;rdar://problem/14643481&gt;
</ins><span class="cx"> 
</span><del>-        Test: editing/pasteboard/drag-drop-paragraph-crasher.html
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
</del><ins>+            This is kind of a cheesy optimization, but it turns out that the use case is quite common.
+            The pattern goes like this:
</ins><span class="cx"> 
</span><del>-2014-05-07  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+                (1) Create &lt;style&gt; element.
+                (2) Add it to the document's &lt;head&gt;.
+                (3) .addRule() one rule through the CSSOM API.
</ins><span class="cx"> 
</span><del>-        [CoordinatedGraphics][WK2] Scale factor and scroll position is not being restored properly in a back/forward load
-        https://bugs.webkit.org/show_bug.cgi?id=126022
</del><ins>+            Prior to this patch, (3) would always cause a full (deferred) style recalc.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Now that we exclude empty style sheets from the document's (effective) active set,
+            we can piggyback on the style invalidation analysis when transitioning from an empty
+            sheet to a single-rule sheet.
</ins><span class="cx"> 
</span><del>-        Original author : Thiago de Barros Lacerda, and finished by Gyuyoung Kim.
</del><ins>+            In other words, add a special code path for the first rule insertion into an empty,
+            in-document style sheet to minimize the amount of invalidation that happens.
</ins><span class="cx"> 
</span><del>-        When user is navigating back/forward to a page that has been scrolled and/or scaled, that page must be shown
-        with its last scroll position and scale factor. However, when fixed layout was enabled with CoordinatedGraphics
-        and TILED_BACKING_STORE, Page::setPageScaleFactor() doesn't send previous scroll position since r165652 and r165913.
</del><ins>+            * css/CSSStyleSheet.cpp:
+            (WebCore::CSSStyleSheet::didMutateRules):
+            (WebCore::CSSStyleSheet::insertRule):
+            * css/CSSStyleSheet.h:
+            (WebCore::CSSStyleSheet::RuleMutationScope::RuleMutationScope):
+            (WebCore::CSSStyleSheet::RuleMutationScope::~RuleMutationScope):
</ins><span class="cx"> 
</span><del>-        This patch allows the Page::setPageScaleFactor() send stored position to WK2 implementation by calling delegatedScrollRequested()
-        directly when delegatesScrolling() is on.
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::setPageScaleFactor): TILED_BACKING_STORE and delegateScrolling are enabled, we pass new scroll position to WK2 though
-        delegateScrolling is disabled.
-        * platform/ScrollView.cpp: delegatedScrollRequested() call is moved from ScrollView::setScrollPosition() to Page::setPageScaleFactor().
-        (WebCore::ScrollView::setScrollPosition): 
</del><ins>+        Merge r153696
</ins><span class="cx"> 
</span><del>-2014-05-07  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+    2013-08-04  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Using a fill pattern much larger than actual canvas reliably segfaults browser
-        https://bugs.webkit.org/show_bug.cgi?id=132635
</del><ins>+            [Mac] Disable screen font substitution at WebCore-level in OS X 10.9+
+            &lt;http://webkit.org/b/119474&gt;
+            &lt;rdar://problem/14643349&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Dan Bernstein.
</ins><span class="cx"> 
</span><del>-        Make sure that createPattern checks that the canvas it is about to use
-        as a source is valid.
</del><ins>+            Disable screen font substitution by default in Settings so internal WebCore clients
+            such as SVG-as-image will get the right default setting.
</ins><span class="cx"> 
</span><del>-        Test: fast/canvas/pattern-too-large-to-create.html
</del><ins>+            * page/Settings.cpp:
+            (WebCore::Settings::Settings):
+            (WebCore::Settings::shouldEnableScreenFontSubstitutionByDefault):
+            (WebCore::Settings::setScreenFontSubstitutionEnabled):
+            * page/Settings.h:
+            (WebCore::Settings::screenFontSubstitutionEnabled):
+            * page/Settings.in:
+            * page/mac/SettingsMac.mm:
+            (WebCore::Settings::shouldEnableScreenFontSubstitutionByDefault):
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createPattern): Check that the source canvas has
-        an ok ImageBuffer.
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-07  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+        Merge r153695
</ins><span class="cx"> 
</span><del>-        Use system defaults for hardware jpeg decoding
-        https://bugs.webkit.org/show_bug.cgi?id=132661
-        &lt;rdar://problem/11348201&gt;
</del><ins>+    2013-08-03  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Refine the unavailable plug-in indicator
+            https://bugs.webkit.org/show_bug.cgi?id=119400
+            &lt;rdar://problem/14616012&gt;
</ins><span class="cx"> 
</span><del>-        Remove code that explicitly disabled hardware image decoding. Let the system decide what to do.
</del><ins>+            Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/ImageSource.h:
-        (WebCore::ImageSource::acceleratedImageDecodingEnabled): Deleted.
-        (WebCore::ImageSource::setAcceleratedImageDecodingEnabled): Deleted.
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::imageSourceOptions):
</del><ins>+            Add a border, flip the text and background colors, and make the indicator
+            much higher contrast, to be more visible on a variety of sites.
+            Also, refine the arrow to be less blocky and inlaid inside a circle.
</ins><span class="cx"> 
</span><del>-2014-05-07  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::replacementTextRoundedRectPressedColor):
+            (WebCore::replacementTextRoundedRectColor):
+            (WebCore::replacementTextColor):
+            (WebCore::unavailablePluginBorderColor):
+            (WebCore::drawReplacementArrow):
+            (WebCore::RenderEmbeddedObject::paintReplaced):
+            (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
+            (WebCore::RenderEmbeddedObject::unavailablePluginIndicatorBounds):
+            (WebCore::RenderEmbeddedObject::isInUnavailablePluginIndicator):
+            * rendering/RenderEmbeddedObject.h:
</ins><span class="cx"> 
</span><del>-        Use after free in WebCore::RenderObject::nextSibling / WebCore::RenderBoxModelObject::moveChildrenTo
-        https://bugs.webkit.org/show_bug.cgi?id=132625
</del><ins>+2013-08-05  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Merge r153591
</ins><span class="cx"> 
</span><del>-        Fixed problem with dynamically inserting first letter elements.
</del><ins>+    2013-08-01  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/multicol/newmulticol/first-letter-create.html
</del><ins>+            Unavailable plug-in indicator arrow should be inside the rounded rect, not in its own circle
+            https://bugs.webkit.org/show_bug.cgi?id=119400
+            &lt;rdar://problem/14616012&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::getFirstLetter):
-        (WebCore::RenderBlock::updateFirstLetter):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::moveChildrenTo):
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-05-07  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
+            Shift the arrow in by 9px, and make the text's rounded rect include it,
+            instead of having the arrow in a separate circle.
</ins><span class="cx"> 
</span><del>-        WK2: Programatic scroll requests during scroll or zoom animation to reveal focused element are ignored.
-        https://bugs.webkit.org/show_bug.cgi?id=132657
-        &lt;rdar://problem/16468462&gt;
</del><ins>+2013-08-05  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        DFG optimizations don't handle neutered arrays properly
+        https://bugs.webkit.org/show_bug.cgi?id=119409
</ins><span class="cx"> 
</span><del>-        With the scrolling model we use on iOS, a programatic scroll
-        request can be received while we are still animating to reveal
-        the focused input element. The WebProcess is unaware that the
-        scroll position is being changed in the UIProcess, and does not
-        honor the scroll request from JavaScript.
-        This is patch changes the behavior for clients using scroll delegates
-        to always send the scroll request to the UIProcess without checking
-        the current scroll position.
-
-        * page/FrameView.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setScrollPosition):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::inProgrammaticScroll):
-
-2014-05-07  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [Mac, iOS] REGRESSION: WK2 YouTube support
-        https://bugs.webkit.org/show_bug.cgi?id=132568
-        &lt;rdar://problem/11464344&gt;
-
-        Reviewed by Darin Adler.
-
-        Move the custom YouTube loader code out of the WebFrameLoaderClient into a
-        PluginReplacement-based class.
-
-        * Modules/plugins/PluginReplacement.h:
-        (WebCore::PluginReplacement::supportsURL): New predicate so we can restrict
-        use of a plugin to a particular category of URLs.
-        * Modules/plugins/QuickTimePluginReplacement.mm:
-        (WebCore::QuickTimePluginReplacement): Updated for new registrar signature.
-        * Modules/plugins/YouTubePluginReplacement.h: Added.
-        (WebCore::YouTubePluginReplacement::parentElement):
-        * Modules/plugins/YouTubePluginReplacement.cpp: Added.
-        (WebCore::YouTubePluginReplacement::registerPluginReplacement):
-        (WebCore::YouTubePluginReplacement::create):
-        (WebCore::YouTubePluginReplacement::supportsMimeType):
-        (WebCore::YouTubePluginReplacement::supportsFileExtension):
-        (WebCore::kit):
-        (WebCore::YouTubePluginReplacement::YouTubePluginReplacement):
-        (WebCore::YouTubePluginReplacement::createElementRenderer):
-        (WebCore::objectForKey):
-        (WebCore::YouTubePluginReplacement::installReplacement):
-        (WebCore::createYouTubeURL):
-        (WebCore::processAndCreateYouTubeURL):
-        (WebCore::YouTubePluginReplacement::youTubeURL):
-        * WebCore.exp.in: Add new export from WebCore.
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/HTMLPlugInElement.cpp:
-        (WebCore::pluginReplacementForType): Update to also check that the URL is supported
-        by the plugin.
-        (WebCore::registeredPluginReplacements): Add new YouTubePluginReplacement to registry.
-        * html/HTMLPlugInImageElement.cpp:
-        (WebCore::HTMLPlugInImageElement::createElementRenderer): Remove custom YouTube code
-        now that this logic is handled in the plugin replacement class.
-        (WebCore::HTMLPlugInImageElement::createShadowIFrameSubtree): Deleted.
-        * html/HTMLPlugInImageElement.h:
-        * html/shadow/YouTubeEmbedShadowElement.cpp:
-        (WebCore::YouTubeEmbedShadowElement::YouTubeEmbedShadowElement):
-        (WebCore::YouTubeEmbedShadowElement::shadowPseudoId): Use correct pseudoID for the
-        plugin replacement architecture.
-        * html/shadow/YouTubeEmbedShadowElement.h:
-        * platform/mac/WebCoreNSURLExtras.h:
-        * platform/mac/WebCoreNSURLExtras.mm:
-        (WebCore::unescapedQueryValue): Moved from WebKit/Misc/WebNSURLExtras.
-        (WebCore::queryKeysAndValues): Ditto.
-
-2014-05-07  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        [iOS] Acclerated overflow-scrolling broken in WK1
-        https://bugs.webkit.org/show_bug.cgi?id=132665
-        &lt;rdar://problem/16842909&gt;
-
-        Reviewed by Tim Horton.
-
-        r168301 added a CALayer delegate to disable implicit animations,
-        but for some layers we wrap them in UIViews (which are themselves
-        layer delegates), so bad things happened.
</del><ins>+        Reviewed by Mark Hahnenberg and Oliver Hunt.
</ins><span class="cx">         
</span><del>-        Fix by falling back to setting the null actions dictionary for
-        layers with custom scrolling behavior.
</del><ins>+        This just neuters view wrappers also.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (PlatformCALayerMac::updateCustomBehavior):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateScrollingLayers):
</del><ins>+        Test: fast/js/dfg-typed-array-neuter.
</ins><span class="cx"> 
</span><del>-2014-05-07  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::neuterView):
+        (WebCore::SerializedScriptValue::transferArrayBuffers):
+        (WebCore::SerializedScriptValue::create):
+        * bindings/js/SerializedScriptValue.h:
</ins><span class="cx"> 
</span><del>-        HTMLMediaElement should exitFullscreen when view is removed from the window.
-        https://bugs.webkit.org/show_bug.cgi?id=132506
</del><ins>+2013-08-02  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Merge r153681
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenControllerAVKit.h:
-        Add -requestExitFullscreen.
</del><ins>+    2013-08-02  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
-        (-[WebVideoFullscreenController requestExitFullscreen]):
-        Forward request onto WebVideoFullscreenModelMediaElement.
</del><ins>+            Force elements with perspective or preserve-3d to disallow direct composited backgrounds
+            https://bugs.webkit.org/show_bug.cgi?id=119462
+            &lt;rdar://problem/14607548&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::requestExitFullscreen):
-        Add some protection here since this may be called when not in fullscreen.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-05-07  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            Bug 119461 (http://wkb.ug/119461) describes how a directly composited
+            background color can intersect with its children. It's not clear exactly
+            what the best way to fix that is, but for the moment we should disallow
+            any element that has perspective or a preserve-3d transform style from
+            getting a directly composited background.
</ins><span class="cx"> 
</span><del>-        Clean up the difference between painting focus rings and adding PDF annotations
-        https://bugs.webkit.org/show_bug.cgi?id=132638
</del><ins>+            Test: compositing/background-color/no-composited-background-color-when-perspective.html
</ins><span class="cx"> 
</span><del>-        Follow-up comments from Darin Adler.
</del><ins>+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::hasPerspectiveOrPreserves3D): New static helper.
+            (WebCore::supportsDirectBoxDecorationsComposition): Return false if the above function is true.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::paintOutline): Move &quot;else if&quot; to a separate &quot;if&quot; for clarity.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::paintFocusRing): Don't guard against outlineIsAuto(). ASSERT instead.
-        (WebCore::RenderObject::addPDFURLRect): Give &quot;rect&quot; variable a better name.
-        (WebCore::RenderObject::paintOutline): Move &quot;else if&quot; to a separate &quot;if&quot; for clarity.
</del><ins>+2013-08-02  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-07  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Merge r153672
</ins><span class="cx"> 
</span><del>-        Make blob size computation lazy
-        https://bugs.webkit.org/show_bug.cgi?id=132653
</del><ins>+    2013-08-02  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Removing a &lt;link&gt; element with an empty stylesheet shouldn't trigger style recalc.
+            &lt;http://webkit.org/b/119442&gt;
+            &lt;rdar://problem/14631785&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/Blob.cpp:
-        (WebCore::Blob::Blob):
-        (WebCore::Blob::size):
-        * fileapi/Blob.h:
-        (WebCore::Blob::size): Deleted.
-        * fileapi/File.cpp:
-        (WebCore::File::size): Deleted.
-        * fileapi/File.h:
-        * fileapi/ThreadableBlobRegistry.cpp:
-        (WebCore::ThreadableBlobRegistry::registerFileBlobURL):
-        (WebCore::ThreadableBlobRegistry::registerBlobURL):
-        (WebCore::ThreadableBlobRegistry::registerBlobURLForSlice):
-        (WebCore::ThreadableBlobRegistry::blobSize):
-        (WebCore::ThreadableBlobRegistry::unregisterBlobURL):
-        (WebCore::unregisterBlobURLTask): Deleted.
-        * fileapi/ThreadableBlobRegistry.h:
-        * platform/network/BlobData.cpp:
-        (WebCore::BlobData::appendData):
-        * platform/network/BlobRegistry.h:
-        * platform/network/BlobRegistryImpl.cpp:
-        (WebCore::BlobRegistryImpl::registerBlobURL):
-        (WebCore::BlobRegistryImpl::registerBlobURLForSlice):
-        * platform/network/BlobRegistryImpl.h:
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-05-06  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Let Document decide whether or not to do a style recalc after a &lt;link&gt; element is removed.
+            This avoids unnecessary work when removing a &lt;link&gt; that refers to an empty style sheet.
</ins><span class="cx"> 
</span><del>-        Add scrolling tree logging to RemoteLayerTree output
-        https://bugs.webkit.org/show_bug.cgi?id=132640
</del><ins>+            Some Facebook pages have a &lt;link rel=&quot;stylesheet&quot; href=&quot;data:text/css;base64,&quot;&gt; that gets
+            removed during the initial page load, causing style recalc.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+            * html/HTMLLinkElement.cpp:
+            (WebCore::HTMLLinkElement::removedFrom):
</ins><span class="cx"> 
</span><del>-        Support scrolling tree logging in the RemoteLayerTree log channel
-        output.
-        
-        ScrollingStateTree::commit() unconditionally set treeStateClone-&gt;m_hasChangedProperties
-        to true, but we should set it based on original scrolling state tree's 
-        m_hasChangedProperties.
-        
-        We have to encode all of the scrolling state nodes anyway (they only encode
-        changed properties), but we can use this for future optimizations, and to
-        avoid spurious logging.
-        
-        * WebCore.exp.in: Export a couple of things we need.
-        * page/scrolling/ScrollingStateTree.cpp:
-        (WebCore::ScrollingStateTree::commit):
</del><ins>+                Use DeferRecalcStyleIfNeeded. Since the style sheet is being removed, it will either
+                cause a recalc (because it's no longer in the set of active sheets) or do nothing.
</ins><span class="cx"> 
</span><del>-2014-05-07  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+2013-08-02  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        AX: aria-expanded changes are not communicated to clients
-        https://bugs.webkit.org/show_bug.cgi?id=132642
</del><ins>+        Merge r153632
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+    2013-07-31  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        When aria-expanded changes on non list/tree items, send out a generic
-        AXExpandedChange notification.
</del><ins>+            FormAssociatedElement shouldn't create out-of-tree FormAttributeTargetObserver
+            https://bugs.webkit.org/show_bug.cgi?id=119309
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/accessibility/expanded-notification.html
</del><ins>+            Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        * accessibility/AXObjectCache.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::handleAriaExpandedChanged):
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/6fbdcbf311de539107bc28711b3f7a527176e97b.
</ins><span class="cx"> 
</span><del>-2014-05-07  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            I'm not merging the test since the attached test case only works when the shadow DOM API is enabled.
</ins><span class="cx"> 
</span><del>-        Release build fix.
</del><ins>+            * html/FormAssociatedElement.cpp:
+            (WebCore::FormAssociatedElement::formAttributeChanged):
+            (WebCore::FormAssociatedElement::resetFormAttributeTargetObserver):
</ins><span class="cx"> 
</span><del>-        * platform/MIMETypeRegistry.cpp: (WebCore::initializeSupportedImageMIMETypes):
-        Removed unused globals.
</del><ins>+2013-08-02  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-07  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Merge r153641
</ins><span class="cx"> 
</span><del>-        Eliminate &quot;well known MIME type&quot; support
-        https://bugs.webkit.org/show_bug.cgi?id=132654
</del><ins>+    2013-08-01  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Removing an empty style sheet shouldn't trigger style recalc.
+            &lt;http://webkit.org/b/119248&gt;
+            &lt;rdar://problem/14629045&gt;
</ins><span class="cx"> 
</span><del>-        Vestiges of FileSystem API.
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * dom/DataTransfer.cpp:
-        (WebCore::DataTransfer::files):
-        (WebCore::DataTransfer::hasFileOfType):
-        * fileapi/File.cpp:
-        (WebCore::File::File):
-        (WebCore::File::contentTypeFromFilePathOrName):
-        * fileapi/File.h:
-        * html/FileInputType.cpp:
-        (WebCore::FileInputType::createFileList):
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedImageMIMETypes):
-        (WebCore::findMimeType): Deleted.
-        (WebCore::MIMETypeRegistry::getWellKnownMIMETypeForExtension): Deleted.
-        * platform/MIMETypeRegistry.h:
</del><ins>+            Teach DocumentStyleSheetCollection to filter out empty style sheets when deciding whether
+            or not to trigger a style recalc. We can then be clever when an empty style sheet is removed
+            from the document, and avoid causing extra work.
</ins><span class="cx"> 
</span><del>-2014-05-07  Christophe Dumez  &lt;ch.dumez@samsung.com&gt;
</del><ins>+            Some pages use this pattern:
</ins><span class="cx"> 
</span><del>-        [HTML] Default argument to HTMLTableElement.insertRow() should be -1
-        https://bugs.webkit.org/show_bug.cgi?id=132651
</del><ins>+                (1) Create a &lt;style&gt; element.
+                (2) Add it to the document's &lt;head&gt; element.
+                (3) Insert some CSS as a text child of the &lt;style&gt; element.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            Since the &lt;style&gt; element is already inside the document at (3), we had to treat this as an
+            old style sheet being removed, even though it was just an empty sheet of nothing.
</ins><span class="cx"> 
</span><del>-        HTMLTableElement.insertRow()'s argument default value should be -1, not 0,
-        as per the specification:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/tabular-data.html#htmltableelement
</del><ins>+            With this patch, Document gains enough smarts to know that removing/adding an empty sheet
+            won't affect layout/rendering in any meaningful way, thus a style recalc can be avoided.
</ins><span class="cx"> 
</span><del>-        The new behavior matches the one of Firefox 29 and IE11, and soon Blink:
-        https://codereview.chromium.org/270213007/
</del><ins>+            * dom/Document.h:
+            * dom/Document.cpp:
+            (WebCore::Document::styleResolverChanged):
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/HTMLTableElement/insertRow-default-argument.html
</del><ins>+                Add a DeferRecalcStyleIfNeeded mode to styleResolverChanged().
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableElement.h:
-        * html/HTMLTableElement.idl:
</del><ins>+            * css/CSSStyleSheet.h:
+            * css/CSSStyleSheet.cpp:
+            (WebCore::CSSStyleSheet::clearOwnerNode):
</ins><span class="cx"> 
</span><del>-2014-05-07  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+                Use DeferRecalcStyleIfNeeded when saying bye from a CSSStyleSheet and let Document decide
+                if removing the sheet should trigger style recalc instead of always assuming it should.
</ins><span class="cx"> 
</span><del>-        AX: AXSelectTextWithCriteria should support capitalize/lowercase/uppercase
-        https://bugs.webkit.org/show_bug.cgi?id=132622
</del><ins>+            * dom/DocumentStyleSheetCollection.cpp:
+            (WebCore::filterEnabledNonemptyCSSStyleSheets):
+            (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+                Exclude empty sheets from the activeAuthorStyleSheets() collection. They are still
+                visible through CSSOM's document.styleSheets.
</ins><span class="cx"> 
</span><del>-        The select text with criteria mechanism used through accessibility needs to support
-        a few more parameters to be complete (including capitalize, lowercase and uppercase).
</del><ins>+2013-08-02  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Updated: accessibility/select-text.html
</del><ins>+        Merge r153649
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::selectText):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-        (accessibilitySelectTextCriteriaForCriteriaParameterizedAttribute):
-        * rendering/RenderText.cpp:
-        (WebCore::makeCapitalized):
-        * rendering/RenderText.h:
</del><ins>+    2013-08-02  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-07  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</del><ins>+            REGRESSION (r130783): Scrolling is broken going back to a cached page from a page that still has outstanding subresources.
+            &lt;rdar://problem/14601124&gt; and https://bugs.webkit.org/show_bug.cgi?id=119416
</ins><span class="cx"> 
</span><del>-        DocumentLoader::dataReceived assertion failed
-        https://bugs.webkit.org/show_bug.cgi?id=132017
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            Test: http/tests/loading/unfinished-load-back-to-cached-page-callbacks.html
</ins><span class="cx"> 
</span><del>-        We need to call didReceiveResponse client method before the didReceiveData client method, otherwise we get a lot of asserts.
-        This patch also fixes frequent crashes in downloadTimerCallback method on page loading.
</del><ins>+            * loader/DocumentLoader.cpp:
+            (WebCore::DocumentLoader::stopLoading): Always explicitly cancel the Document parser when stopLoading is called.
</ins><span class="cx"> 
</span><del>-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::calculateWebTimingInformations): Initialize local variables.
-        (WebCore::headerCallback): Call didReceiveResponse client method here instead of in downloadTimerCallback.
-        (WebCore::ResourceHandleManager::downloadTimerCallback): Remove call to didReceiveResponse method.
-        (WebCore::ResourceHandleManager::dispatchSynchronousJob): Removed empty line.
</del><ins>+2013-08-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-06  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Merge r153595
</ins><span class="cx"> 
</span><del>-        REGRESSION: Animated GIF inside compositing layer never resumes animation when scrolled back into view
-        https://bugs.webkit.org/show_bug.cgi?id=132608
</del><ins>+    2013-08-01  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Layout should force a StyleResolver rebuild if there isn't one at all.
+            &lt;http://webkit.org/b/119378&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/repaint/animation-after-layer-scroll.html
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollTo):
-        
-            Check if any animations need to be restarted after layer scroll.
</del><ins>+            We can't tell if viewport-dependent media queries have been invalidated at layout,
+            unless we have a StyleResolver to ask about this.
+            In case there isn't one, take the same path as we would with an invalidated query
+            instead of relying on ensureStyleResolver() to build it.
</ins><span class="cx"> 
</span><del>-2014-05-07  Hyowon Kim  &lt;hw1008.kim@samsung.com&gt;
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::layout):
</ins><span class="cx"> 
</span><del>-        GraphicsLayer::client() should return a reference.
-        https://bugs.webkit.org/show_bug.cgi?id=126372
</del><ins>+2013-08-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r153553
</ins><span class="cx"> 
</span><del>-        GraphicsLayers always have a GraphicsLayerClient attached,
-        so make client() a reference and remove some unnecessary branches.
-        The author of the changes in the mac port is Andreas Kling &lt;akling@apple.com&gt;.
</del><ins>+    2013-07-31  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        (WebCore::GraphicsLayer::willBeDestroyed):
-        (WebCore::GraphicsLayer::paintGraphicsLayerContents):
-        (WebCore::GraphicsLayer::addRepaintRect):
-        (WebCore::dumpChildren):
-        (WebCore::GraphicsLayer::dumpProperties):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::client):
-        (WebCore::GraphicsLayer::pageScaleFactor):
-        (WebCore::GraphicsLayer::deviceScaleFactor):
-        * platform/graphics/GraphicsLayerFactory.h:
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayer::create):
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::initialize):
-        (WebCore::GraphicsLayerCA::platformCALayerAnimationStarted):
-        (WebCore::GraphicsLayerCA::computePositionRelativeToBase):
-        (WebCore::GraphicsLayerCA::flushCompositingStateForThisLayerOnly):
-        (WebCore::GraphicsLayerCA::computeVisibleRect):
-        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
-        (WebCore::GraphicsLayerCA::platformCALayerContentsScaleMultiplierForNewTiles):
-        (WebCore::GraphicsLayerCA::platformCALayerShouldAggressivelyRetainTiles):
-        (WebCore::GraphicsLayerCA::platformCALayerShouldTemporarilyRetainTileCohorts):
-        (WebCore::GraphicsLayerCA::updateContentsOpaque):
-        (WebCore::GraphicsLayerCA::updateContentsScale):
-        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
-        (WebCore::GraphicsLayerCA::noteLayerPropertyChanged):
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
-        (WebCore::GraphicsLayer::create):
-        (WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
-        (WebCore::GraphicsLayerTextureMapper::notifyChange):
-        (WebCore::GraphicsLayerTextureMapper::commitLayerChanges):
-        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
-        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
-        (WebCore::CompositingCoordinator::createRootLayer):
-        (WebCore::CompositingCoordinator::createGraphicsLayer):
-        * platform/graphics/texmap/coordinated/CompositingCoordinator.h:
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
-        (WebCore::CoordinatedGraphicsLayer::notifyFlushRequired):
-        (WebCore::CoordinatedGraphicsLayer::CoordinatedGraphicsLayer):
-        (WebCore::CoordinatedGraphicsLayer::computeTransformedVisibleRect):
-        (WebCore::CoordinatedGraphicsLayer::animationStartedTimerFired):
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createGraphicsLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateLayerForTopOverhangArea):
-        (WebCore::RenderLayerCompositor::updateLayerForBottomOverhangArea):
-        (WebCore::RenderLayerCompositor::updateLayerForHeader):
-        (WebCore::RenderLayerCompositor::updateLayerForFooter):
-        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
-        (WebCore::RenderLayerCompositor::ensureRootLayer):
</del><ins>+            Reuse of XMLHttpRequests causes character corruption in response text
+            https://bugs.webkit.org/show_bug.cgi?id=119358
</ins><span class="cx"> 
</span><del>-2014-05-07  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        [GStreamer] Corrected typo
-        https://bugs.webkit.org/show_bug.cgi?id=132609
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/6496e7bb9a0b46bc79032b86d5993b25f127a4cb
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+            Test: http/tests/xmlhttprequest/reopen-encoding.html
</ins><span class="cx"> 
</span><del>-        Corrected m_canFallBackToLastFinishedSeekPositon typo and
-        initialized in the constructor to prevent problems in the future.
</del><ins>+            * xml/XMLHttpRequest.cpp:
+            (WebCore::XMLHttpRequest::clearResponseBuffers):
+            (WebCore::XMLHttpRequest::didFinishLoading):
</ins><span class="cx"> 
</span><del>-        No test needed.
</del><ins>+2013-08-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
-        Initialized m_canFallBackToLastFinishedSeekPosition as false.
-        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
-        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
-        (WebCore::MediaPlayerPrivateGStreamer::asyncStateChangeDone):
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
-        m_canFallBackToLastFinishedSeekPositon -&gt;
-        m_canFallBackToLastFinishedSeekPosition
</del><ins>+        Merge r153494
</ins><span class="cx"> 
</span><del>-2014-05-07  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+    2013-07-30  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Convert PassOwnPtr to unique_ptr in CrossThreadTask.h
-        https://bugs.webkit.org/show_bug.cgi?id=132605
</del><ins>+            Inactive style sheets should not trigger style recalc when loaded.
+            &lt;http://webkit.org/b/119236&gt;
+            &lt;rdar://problem/14588132&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * dom/CrossThreadTask.h: Converted.
</del><ins>+            Style sheets that are either alternate sheets or are excluded by their media query should not trigger
+            a full style recalc when they finish loading, since the end result will not be observably different.
</ins><span class="cx"> 
</span><del>-2014-05-07  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            The sheets are still inspectable through document.styleSheets.
</ins><span class="cx"> 
</span><del>-        [SOUP] TLSErrors do not cause page load to fail when not ignored
-        https://bugs.webkit.org/show_bug.cgi?id=121548
</del><ins>+            Changed enums from Blocking/NonBlocking to ActiveSheet/InactiveSheet to clarify what's going on.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sergio Villar Senin.
</del><ins>+            * html/HTMLLinkElement.h:
+            * html/HTMLLinkElement.cpp:
+            (WebCore::HTMLLinkElement::HTMLLinkElement):
+            (WebCore::HTMLLinkElement::setDisabledState):
+            (WebCore::HTMLLinkElement::process):
+            (WebCore::HTMLLinkElement::startLoadingDynamicSheet):
+            (WebCore::HTMLLinkElement::addPendingSheet):
+            (WebCore::HTMLLinkElement::removePendingSheet):
</ins><span class="cx"> 
</span><del>-        This only happens in case of redirection, when the initial URL is
-        an HTTPS site with an invalid certificate, that redirects to
-        another location. We are starting the redirection without checking
-        the TLS errors.
</del><ins>+2013-08-01  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::sendRequestCallback): Check TLS errors before starting a
-        possible redirection.
</del><ins>+        &lt;rdar://problem/14616729&gt; REGRESSION (r144350): Overflow bounding boxes are way 
+        too big; prevents VoiceOver taps from activating the right elements
</ins><span class="cx"> 
</span><del>-2014-05-07  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Remove runtime feature
-        https://bugs.webkit.org/show_bug.cgi?id=132382
</del><ins>+        This is a partial-rollout of http://trac.webkit.org/changeset/144350 which is the 
+        change that caused this regression. This patch rolls out most of that patch, and 
+        it only leaves in the part that added a paintContainer variable to PaintInfo since 
+        that is now used in other places in the code. All uses of the paintContainer that 
+        were added with this patch have been removed since they contribute to the 
+        regression.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
-
-        Remove cssGridLayoutEnabled setting. Update methods using it accordingly.
-
-        * WebCore.order:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParserContext::CSSParserContext):
-        (WebCore::operator==):
-        (WebCore::isValidKeywordPropertyAndValue):
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseGridTemplateShorthand):
-        (WebCore::CSSParser::parseGridAreaShorthand):
-        (WebCore::CSSParser::cssGridLayoutEnabled): Deleted.
-        * css/CSSParser.h:
-        * css/CSSParserMode.h:
-        * dom/Document.cpp:
-        (WebCore::Document::cssGridLayoutEnabled): Deleted.
-        * dom/Document.h:
-        * page/Settings.in:
-
-2014-05-07  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
-
-        Fix build errors for BlobDataItem after r168391.
-        https://bugs.webkit.org/show_bug.cgi?id=132643
-
-        Reviewed by Carlos Garcia Campos.
-
-        Patch updates BlobDataItem params usage in ResourceHandleSoup.cpp
-        to be inline with r168391.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::blobIsOutOfDate): BlobDataItem class is updated in r168391.
-        Corresponding parameter changes are done to resolve build error.
-        (WebCore::addEncodedBlobItemToSoupMessageBody): BlobDataItem class is updated
-        in r168391. Corresponding parameter changes are done to resolve build error.
-
-2014-05-06  Dean Jackson  &lt;dino@apple.com&gt;
-
-        Clean up the difference between painting focus rings and adding PDF annotations
-        https://bugs.webkit.org/show_bug.cgi?id=132638
-
-        Reviewed by Simon Fraser.
-
-        The code to add a PDF annotation when printing was called from
-        drawFocusRing, which is quite confusing. With just little movement
-        of code, we can detect an annotation and call addPDFURLRect in the
-        paint phase, and drawFocusRing becomes something that only
-        draws focus rings.
-
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::paintContinuationOutlines):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::addFocusRingRects):
+        * rendering/RenderBox.h:
</ins><span class="cx">         * rendering/RenderInline.cpp:
</span><del>-        (WebCore::RenderInline::paintOutline): Split calls to drawFocusRing
-        and addPDFURLRect.
</del><ins>+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+        * rendering/RenderInline.h:
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::addFocusRingRects):
+        * rendering/RenderListBox.h:
</ins><span class="cx">         * rendering/RenderObject.cpp:
</span><del>-        (WebCore::RenderObject::paintFocusRing): Get rid of call to PDF.
-        (WebCore::RenderObject::addPDFURLRect): Change the signature so it
-        can be called externally, and calculates the rectangle itself.
-        (WebCore::RenderObject::paintOutline): Split the calls.
</del><ins>+        (WebCore::RenderObject::paintFocusRing):
+        (WebCore::RenderObject::paintOutline):
</ins><span class="cx">         * rendering/RenderObject.h:
</span><ins>+        (WebCore::RenderObject::addFocusRingRects):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintObject):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::paintOutlineForRowIfNeeded):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paint):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::addFocusRingRects):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/svg/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::addFocusRingRects):
+        * rendering/svg/RenderSVGContainer.h:
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        (WebCore::RenderSVGImage::addFocusRingRects):
+        * rendering/svg/RenderSVGImage.h:
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::paint):
+        (WebCore::RenderSVGShape::addFocusRingRects):
+        * rendering/svg/RenderSVGShape.h:
</ins><span class="cx"> 
</span><del>-2014-05-06  Rik Cabanier  &lt;cabanier@adobe.com&gt;
</del><ins>+2013-07-31  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Calling createPattern with a broken image must throw an invalidstate error
-        https://bugs.webkit.org/show_bug.cgi?id=132407
</del><ins>+        Merge r153511
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+    2013-07-30  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Updated createPattern so it throws an invalidState exception
-        if you pass it an image that is in the broken state.
</del><ins>+            DHTML drag can result in a null-deref under WebDragClient::startDrag
+            https://bugs.webkit.org/show_bug.cgi?id=119297
+            &lt;rdar://problem/14213012&gt;
</ins><span class="cx"> 
</span><del>-        Tests:
-        * canvas/philip/tests/2d.pattern.image.broken.html:
-        * canvas/philip/tests/2d.pattern.image.incomplete.empty.html:
-        * fast/canvas/canvas-empty-image-pattern.html:
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createPattern):
</del><ins>+            Test: fast/events/setDragImage-in-document-element-crash.html
</ins><span class="cx"> 
</span><del>-2014-05-06  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            * page/mac/FrameSnapshottingMac.mm:
+            (WebCore::snapshotDragImage):
+            We shouldn't waste time painting an empty image, nor should we return
+            an image with no size.
</ins><span class="cx"> 
</span><del>-        [iOS][Mac] Display sleeps while playing &lt;video&gt; content.
-        https://bugs.webkit.org/show_bug.cgi?id=132624
</del><ins>+2013-07-29  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Merge r153447
</ins><span class="cx"> 
</span><del>-        On iOS and Mac, create a DisplaySleepDisablerCocoa rather than an (no-op) DisplaySleepDisabler.
</del><ins>+    2013-07-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/cocoa/DisplaySleepDisablerCocoa.cpp:
-        (WebCore::DisplaySleepDisabler::create):
-        * platform/cocoa/DisplaySleepDisablerCocoa.h:
</del><ins>+            Fix crash due to unexpected Node deletion during MutationObserver registration book-keeping
+            https://bugs.webkit.org/show_bug.cgi?id=119124
</ins><span class="cx"> 
</span><del>-2014-05-06  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        [Mac] Allow focus rings to redraw themselves if necessary
-        https://bugs.webkit.org/show_bug.cgi?id=132593
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/b6afb927695b3acf2c75c25f05e99682660993e2
</ins><span class="cx"> 
</span><del>-        Fix iOS build.
</del><ins>+            No new tests since I could not reproduce the crash with the test attached in the Blink change.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/GraphicsContextMac.mm:
-        (WebCore::GraphicsContext::drawFocusRing): We no longer use the color parameter.
</del><ins>+            The bug was caused by Node::unregisterMutationObserver removing the MutationObserverRegistration
+            that holds the last ref to the node. Avoid that by explicitly allocating a local RefPtr to the node
+            in MutationObserverRegistration::unregister. Also rename it to unregisterAndDelete to clarify
+            the semantics and make it a static member function to be even safer.
</ins><span class="cx"> 
</span><del>-2014-05-06  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            * dom/MutationObserver.cpp:
+            (WebCore::MutationObserver::disconnect):
+            * dom/MutationObserverRegistration.cpp:
+            (WebCore::MutationObserverRegistration::unregisterAndDelete):
+            * dom/MutationObserverRegistration.h:
</ins><span class="cx"> 
</span><del>-        [Mac] Allow focus rings to redraw themselves if necessary
-        https://bugs.webkit.org/show_bug.cgi?id=132593
</del><ins>+2013-07-29  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r153418
</ins><span class="cx"> 
</span><del>-        Mac allows focus rings to change rendering over time. Expose this
-        functionality to WebKit by having the rendering code detect that
-        a focused element has asked to repaint itself, and also have
-        the FocusController object remember how long it has been since
-        an element was focused.
</del><ins>+    2013-07-28  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This patch removes WebCoreNSCellExtras, since a better version is
-        available in WebKitSystemInterface, and it was going to be cumbersome
-        to port the code from there into WebKit.
</del><ins>+            Don't update the text track override CSS every time a media element is created.
+            &lt;http://webkit.org/b/119199&gt;
+            &lt;rdar://problem/14572855&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export _wkDrawFocusRingAtTime and _wkDrawCellFocusRingWithFrameAtTime.
-        * WebCore.xcodeproj/project.pbxproj: Remove WebCoreNSCellExtras.
-        * page/FocusController.cpp:
-        (WebCore::FocusController::FocusController): Initialize the repaint timer.
-        (WebCore::FocusController::~FocusController): Stop the repaint timer on deletion.
-        (WebCore::FocusController::setFocusedElement): Keep track of the current time when focused.
-        (WebCore::FocusController::focusedElementNeedsRepaint): Start the repaint timer.
-        (WebCore::FocusController::focusRepaintTimerFired): Ask the focused element to repaint itself.
-        (WebCore::FocusController::timeSinceFocusWasSet):
-        * page/FocusController.h: Expose timeSinceFocusWasSet() and focusedElementNeedsRepaint(), as
-        well as add the timer for repainting.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * platform/ControlStates.h: Add timeSinceControlWasFocused member variable, allowing the platform
-        code such as Theme to obtain the value from FocusController.
-        (WebCore::ControlStates::ControlStates):
-        (WebCore::ControlStates::timeSinceControlWasFocused):
-        (WebCore::ControlStates::setTimeSinceControlWasFocused):
</del><ins>+            We should only have to update the CSS if the accessibility caption preferences are changed.
+            This was forcing a full style recalc in every Document any time a media element is instantiated.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsContext.h:
-        (WebCore::GraphicsContext::drawFocusRing): New Mac-only method that uses timeOffset.
</del><ins>+            * page/CaptionUserPreferencesMediaAF.cpp:
+            (WebCore::CaptionUserPreferencesMediaAF::setInterestedInCaptionPreferenceChanges):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/GraphicsContextMac.mm:
-        (WebCore::drawFocusRingToContext): No need to pass in color and radius - these are now
-        ignored in WKDrawFocusRing. However, I didn't want to change the signature of the
-        WKSI function.
-        (WebCore::drawFocusRingToContextAtTime): Call into the new method WKDrawFocusRingAtTime.
-        (WebCore::GraphicsContext::drawFocusRing): Color and radius no longer used.
</del><ins>+2013-07-28  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mac/ThemeMac.mm:
-        (WebCore::checkboxMargins): Update the margins since our focus ring can be a lot bigger.
-        (WebCore::radioMargins): Ditto.
-        (WebCore::paintToggleButton): Drawing a focus ring might trigger a repaint too.
-        (WebCore::buttonMargins): Increase the margins.
-        (WebCore::paintButton): If our focus ring wants to be drawn again, set the ControlStates flag.
</del><ins>+        Merge r153399
</ins><span class="cx"> 
</span><del>-        * platform/mac/WebCoreNSCellExtras.h: Removed.
-        * platform/mac/WebCoreNSCellExtras.m: Removed.
</del><ins>+    2013-07-26  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mac/WebCoreSystemInterface.h: Declare the new methods.
-        * platform/mac/WebCoreSystemInterface.mm:
</del><ins>+            Stop pretending to support &lt;string&gt; for text-align.
+            https://bugs.webkit.org/show_bug.cgi?id=119107
</ins><span class="cx"> 
</span><del>-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::initializeStyle): Expand the overflow rects by the maximum
-        focus ring width. This might be different from the current outline size.
-        (WebCore::RenderElement::setStyle): Ditto.
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::paintFocusRing): If we're on Mac, use the new drawFocusRing method,
-        which sets a parameter to true if the focused element needs a repaint.
</del><ins>+            Test: fast/css/text-align-string-crash.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::updateControlStatesForRenderer): Copy the value from FocusController
-        so that the platform Theme code can use it.
</del><ins>+            * css/CSSParser.cpp:
+            (WebCore::CSSParser::parseValue):
+            Stop pretending to support &lt;string&gt; for text-align.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::platformFocusRingMaxWidth): Add a way to get the maximum width
-        of a focus ring for the platform. This is used to extend the overflow rects.
-        * rendering/RenderThemeMac.h: Override the focus ring width.
-        * rendering/RenderThemeMac.mm: On newer versions of OS X, we have a larger focus ring.
-        (WebCore::RenderThemeMac::platformFocusRingMaxWidth):
-        (WebCore::RenderThemeMac::paintMenuList): If a menu is focused, and needs a repaint, mark
-        it as such.
</del><ins>+            * css/DeprecatedStyleBuilder.cpp:
+            (WebCore::ApplyPropertyTextAlign::applyValue):
+            ASSERT that only value IDs get passed.
</ins><span class="cx"> 
</span><del>-2014-05-06  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-07-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS] Animate AVPlayerLayer into and out of full screen
-        https://bugs.webkit.org/show_bug.cgi?id=132603
</del><ins>+        Merge r153378
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2013-07-26  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rather than synchronize animations across the WebProcess / UIProcess boundary, animate
-        the AVPlayerLayer into place by first resizing the full screen layer to occupy the
-        entire screen in the WebProcess, and use a sublayerTransform animation in the UIProcess
-        to scale the AVPlayer from its initial screen location, as well as back to its final screen
-        location.
</del><ins>+            Add a mode where autosizing fixes the FrameView height to at least the WKView height
+            https://bugs.webkit.org/show_bug.cgi?id=119104
+            &lt;rdar://problem/14549021&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GeometryUtilities.cpp:
-        (WebCore::largestRectWithAspectRatioInsideRect): Added utility method.
-        * platform/graphics/GeometryUtilities.h:
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (-[WebAVVideoLayer init]): Added, initialize video gravity and enable child layer masking.
-        (-[WebAVVideoLayer setBounds:]): Create a transform to scale the video area.
-        (WebVideoFullscreenInterfaceAVKit::enterFullscreen): Block implicit animations during setup.
-        (WebVideoFullscreenInterfaceAVKit::exitFullscreen): Reset the gravity to ResizeAspect
-            if necessary.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-05-06  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            * WebCore.exp.in: Export FrameView::setAutoSizeFixedMinimumHeight.
+            * page/FrameView.cpp:
+            (WebCore::FrameView::FrameView):
+            Initialize m_autoSizeFixedMinimumHeight to 0.
</ins><span class="cx"> 
</span><del>-        Make BlobDataItem use a refcounted object for files
-        https://bugs.webkit.org/show_bug.cgi?id=132628
</del><ins>+            (WebCore::FrameView::autoSizeIfEnabled):
+            Increase the FrameView height to m_autoSizeFixedMinimumHeight if necessary,
+            and do another layout. Store the computed intrinsic content size.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            (WebCore::FrameView::setAutoSizeFixedMinimumHeight): Added.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        Added BlobDataFileReference.{h|cpp}
</del><ins>+            * page/FrameView.h:
+            (WebCore::FrameView::autoSizingIntrinsicContentSize): Added.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Removed unused exports.
</del><ins>+2013-07-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobData.h:
-        (WebCore::BlobDataItem::offset):
-        (WebCore::BlobDataItem::BlobDataItem):
-        Use a wrapper class for files, not a path. Changed to be more class-like accordingly.
</del><ins>+        Merge r153349
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobData.cpp:
-        (WebCore::BlobData::appendData):
-        (WebCore::BlobData::appendFile):
-        (WebCore::BlobData::appendBlob): Deleted.
-        (WebCore::BlobData::BlobData): Deleted.
-        We never add blobs to BlobData, they are always resolved to data of file references.
-        Lots of very confusing code to delete.
</del><ins>+    2013-07-25  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobDataFileReference.h: Added.
-        * platform/network/BlobDataFileReference.cpp: Added.
-        (WebCore::BlobDataFileReference::size):
-        (WebCore::BlobDataFileReference::expectedModificationTime):
-        (WebCore::BlobDataFileReference::computeFileSystemData):
-        A unique reference to a file referenced by blob, to be preserved when you slice
-        or combine blobs.
</del><ins>+            Null check m_frame in maximum and minimumScrollPosition
+            https://bugs.webkit.org/show_bug.cgi?id=119109
+            &lt;rdar://problem/14545393&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobRegistryImpl.cpp:
-        (WebCore::BlobRegistryImpl::appendStorageItems):
-        (WebCore::BlobRegistryImpl::registerFileBlobURL):
-        (WebCore::BlobRegistryImpl::registerBlobURL):
-        (WebCore::BlobRegistryImpl::blobSize):
-        * platform/network/BlobResourceHandle.cpp:
-        (WebCore::BlobResourceHandle::getSizeForNext):
-        (WebCore::BlobResourceHandle::didGetSize):
-        (WebCore::BlobResourceHandle::readDataSync):
-        (WebCore::BlobResourceHandle::readFileSync):
-        (WebCore::BlobResourceHandle::readDataAsync):
-        (WebCore::BlobResourceHandle::readFileAsync):
-        * platform/network/BlobResourceHandle.h:
-        * platform/network/FormData.cpp:
-        (WebCore::appendBlobResolved):
-        Updated for BlobDataItem interface changes.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-05-06  Christophe Dumez  &lt;ch.dumez@samsung.com&gt;
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::minimumScrollPosition):
+            (WebCore::FrameView::maximumScrollPosition):
+            Null-check m_frame (and move the early-return after the clamp-to-0
+            as the revert in r152911 should have).
</ins><span class="cx"> 
</span><del>-        [HTML] Default argument to HTMLTableRowElement.insertCell() should be -1
-        https://bugs.webkit.org/show_bug.cgi?id=132615
</del><ins>+2013-07-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Merge r153366
</ins><span class="cx"> 
</span><del>-        HTMLTableRowElement.insertCell()'s argument default value should be -1, not
-        0, as per the specification:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/tabular-data.html#the-tr-element
</del><ins>+    2013-07-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        The new behavior matches the one of Firefox 29 and IE11, and soon Blink:
-        https://codereview.chromium.org/263323004/
</del><ins>+            Fix document leak when selection is created inside the document
+            https://bugs.webkit.org/show_bug.cgi?id=119122
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/HTMLTableRowElement/insertCell-default-argument.html
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableRowElement.h:
-        * html/HTMLTableRowElement.idl:
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/b908cb4c8da93316d787de31c93f2a43de332a10
</ins><span class="cx"> 
</span><del>-2014-05-06  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+            The bug was caused by FrameSelection::m_previousCaretNode holding onto a Node, leaking its document.
+            Fixed the bug by explicitly clearing it in FrameSelection::prepareForDestruction.
</ins><span class="cx"> 
</span><del>-        Fix build.
</del><ins>+            Test: editing/selection/leak-document-with-selection-inside.html
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+            * editing/FrameSelection.cpp:
+            (WebCore::FrameSelection::prepareForDestruction):
</ins><span class="cx"> 
</span><del>-2014-05-06  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-07-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add missing line from r168384.
</del><ins>+        Merge r153344
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.h:
-        (WebCore::ChildNodesLazySnapshot::~ChildNodesLazySnapshot):
</del><ins>+    2013-07-25  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-05-06  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+            -[WebHTMLView attributedSubstringForProposedRange:actualRange:] does not include strikethrough attribute in the returned attributed string
+            https://bugs.webkit.org/show_bug.cgi?id=119099
+            &lt;rdar://problem/13439291&gt;
</ins><span class="cx"> 
</span><del>-        Can't make a booking at virginamerica.com
-        https://bugs.webkit.org/show_bug.cgi?id=132626
</del><ins>+            Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            Tests:
+                API Test: AttributedStringTest_Strikethrough
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/assign-to-prototype-accessor-on-prototype-should-be-silent.html
</del><ins>+            * platform/mac/HTMLConverter.mm:
+            (+[WebHTMLConverter editingAttributedStringFromRange:]):
+            Set the NSStrikethroughStyleAttributeName attribute when text-decoration: line-through is seen.
</ins><span class="cx"> 
</span><del>-        We can't throw an exception when a site incorrectly attempts
-        to use a dom property setter directly on the prototype as
-        there are sites that do this as compatibility workarounds
-        for old browsers. Instead we treat use of the setter on
-        the prototype object in the same way we do getters, and just
-        log a warning to the console.
</del><ins>+2013-07-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportDeprecatedSetterError):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::setJSTestInterfaceImplementsStr2):
-        (WebCore::setJSTestInterfaceImplementsStr3):
-        (WebCore::setJSTestInterfaceImplementsNode):
-        (WebCore::setJSTestInterfaceSupplementalStr2):
-        (WebCore::setJSTestInterfaceSupplementalStr3):
-        (WebCore::setJSTestInterfaceSupplementalNode):
-        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
-        (WebCore::setJSTestNondeterministicNondeterministicWriteableAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicExceptionAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicGetterExceptionAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicSetterExceptionAttr):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
-        (WebCore::setJSTestObjEnumAttr):
-        (WebCore::setJSTestObjByteAttr):
-        (WebCore::setJSTestObjOctetAttr):
-        (WebCore::setJSTestObjShortAttr):
-        (WebCore::setJSTestObjUnsignedShortAttr):
-        (WebCore::setJSTestObjLongAttr):
-        (WebCore::setJSTestObjLongLongAttr):
-        (WebCore::setJSTestObjUnsignedLongLongAttr):
-        (WebCore::setJSTestObjStringAttr):
-        (WebCore::setJSTestObjTestObjAttr):
-        (WebCore::setJSTestObjXMLObjAttr):
-        (WebCore::setJSTestObjCreate):
-        (WebCore::setJSTestObjReflectedStringAttr):
-        (WebCore::setJSTestObjReflectedIntegralAttr):
-        (WebCore::setJSTestObjReflectedUnsignedIntegralAttr):
-        (WebCore::setJSTestObjReflectedBooleanAttr):
-        (WebCore::setJSTestObjReflectedURLAttr):
-        (WebCore::setJSTestObjReflectedCustomIntegralAttr):
-        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
-        (WebCore::setJSTestObjReflectedCustomURLAttr):
-        (WebCore::setJSTestObjTypedArrayAttr):
-        (WebCore::setJSTestObjAttrWithGetterException):
-        (WebCore::setJSTestObjAttrWithSetterException):
-        (WebCore::setJSTestObjStringAttrWithGetterException):
-        (WebCore::setJSTestObjStringAttrWithSetterException):
-        (WebCore::setJSTestObjCustomAttr):
-        (WebCore::setJSTestObjWithScriptStateAttribute):
-        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
-        (WebCore::setJSTestObjWithScriptStateAttributeRaises):
-        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
-        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
-        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
-        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
-        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
-        (WebCore::setJSTestObjConditionalAttr1):
-        (WebCore::setJSTestObjConditionalAttr2):
-        (WebCore::setJSTestObjConditionalAttr3):
-        (WebCore::setJSTestObjConditionalAttr4Constructor):
-        (WebCore::setJSTestObjConditionalAttr5Constructor):
-        (WebCore::setJSTestObjConditionalAttr6Constructor):
-        (WebCore::setJSTestObjAnyAttribute):
-        (WebCore::setJSTestObjMutablePoint):
-        (WebCore::setJSTestObjImmutablePoint):
-        (WebCore::setJSTestObjStrawberry):
-        (WebCore::setJSTestObjStrictFloat):
-        (WebCore::setJSTestObjId):
-        (WebCore::setJSTestObjReplaceableAttribute):
-        (WebCore::setJSTestObjNullableLongSettableAttribute):
-        (WebCore::setJSTestObjNullableStringValue):
-        (WebCore::setJSTestObjAttributeWithReservedEnumType):
-        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
-        (WebCore::setJSTestSerializedScriptValueInterfaceValue):
-        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::setJSTestTypedefsUnsignedLongLongAttr):
-        (WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
-        (WebCore::setJSTestTypedefsAttrWithGetterException):
-        (WebCore::setJSTestTypedefsAttrWithSetterException):
-        (WebCore::setJSTestTypedefsStringAttrWithGetterException):
-        (WebCore::setJSTestTypedefsStringAttrWithSetterException):
</del><ins>+        Merge r153102
</ins><span class="cx"> 
</span><del>-2014-05-06  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+    2013-07-24  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        ChildNodesLazySnapshot::m_childNodes needs two heap allocations.
-        &lt;https://webkit.org/b/132616&gt;
</del><ins>+            Use-after-free in ApplyStyleCommand::removeInlineStyle
+            https://bugs.webkit.org/show_bug.cgi?id=118627
</ins><span class="cx"> 
</span><del>-        This seems a bit silly, since ChildNodesLazySnapshot is always
-        allocated on the stack.
</del><ins>+            Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        Change it to be a bool + a Vector instead of using the nullity
-        as a presence indicator. This way we also don't end up with an
-        out-of-line ~OwnPtr for the Vector.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/b6471d077e012b05ccba14d0ce8e6d616106c8e6
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoff Garen.
</del><ins>+            Unfortunately, there is no test case for this bug.
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.h:
-        (WebCore::ChildNodesLazySnapshot::ChildNodesLazySnapshot):
-        (WebCore::ChildNodesLazySnapshot::nextNode):
-        (WebCore::ChildNodesLazySnapshot::takeSnapshot):
-        (WebCore::ChildNodesLazySnapshot::hasSnapshot):
</del><ins>+            * editing/ApplyStyleCommand.cpp:
+            (WebCore::ApplyStyleCommand::removeInlineStyle):
</ins><span class="cx"> 
</span><del>-2014-05-06  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-07-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Eliminate BlobStorageData
-        https://bugs.webkit.org/show_bug.cgi?id=132617
</del><ins>+        Merge r152905
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+    2013-07-19  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/network/BlobData.h:
-        (WebCore::BlobData::create):
-        (WebCore::BlobData::BlobData):
-        * platform/network/BlobRegistryImpl.cpp:
-        (WebCore::loadResourceSynchronously):
-        (WebCore::BlobRegistryImpl::appendStorageItems):
-        (WebCore::BlobRegistryImpl::registerFileBlobURL):
-        (WebCore::BlobRegistryImpl::registerBlobURL):
-        (WebCore::BlobRegistryImpl::registerBlobURLForSlice):
-        (WebCore::BlobRegistryImpl::getBlobDataFromURL):
-        (WebCore::BlobRegistryImpl::blobSize):
-        * platform/network/BlobRegistryImpl.h:
-        * platform/network/BlobResourceHandle.cpp:
-        (WebCore::BlobResourceHandle::createAsync):
-        (WebCore::BlobResourceHandle::loadResourceSynchronously):
-        (WebCore::BlobResourceHandle::BlobResourceHandle):
-        (WebCore::BlobResourceHandle::doStart):
-        (WebCore::BlobResourceHandle::getSizeForNext):
-        (WebCore::BlobResourceHandle::didGetSize):
-        (WebCore::BlobResourceHandle::seek):
-        (WebCore::BlobResourceHandle::readSync):
-        (WebCore::BlobResourceHandle::readDataSync):
-        (WebCore::BlobResourceHandle::readFileSync):
-        (WebCore::BlobResourceHandle::readAsync):
-        (WebCore::BlobResourceHandle::readDataAsync):
-        (WebCore::BlobResourceHandle::readFileAsync):
-        (WebCore::BlobResourceHandle::notifyResponseOnSuccess):
-        * platform/network/BlobResourceHandle.h:
-        * platform/network/BlobStorageData.h: Removed.
-        * platform/network/FormData.cpp:
-        (WebCore::appendBlobResolved):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::addEncodedBlobToSoupMessageBody):
</del><ins>+            TrailingObjects shouldn't shrink vector capacity in a loop
+            https://bugs.webkit.org/show_bug.cgi?id=118322
</ins><span class="cx"> 
</span><del>-2014-05-06  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Fix the iOS build.
</del><ins>+            This seems to take about 3% off the profile of loading a large text file.
</ins><span class="cx"> 
</span><del>-        WebCore::Editor::replaceNodeFromPasteboard(WebCore::Node*, WTF::String const&amp;) is Mac-only.
-        Also sort the export file.
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::TrailingObjects::clear): clear() has the built-in side effect
+            of throwing away existing capacity. Use shrink(0) to indicate that we
+            want to keep our existing capacity.
+            
+2013-07-24  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        Merge r153092
</ins><span class="cx"> 
</span><del>-2014-05-06  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+    2013-07-24  Jessie Berlin  &lt;jberlin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Begin Removal of Old Multi-Column Code.
-        https://bugs.webkit.org/show_bug.cgi?id=132480
</del><ins>+            Remove WKPageGetPlugInInformation - it is not used anymore
+            https://bugs.webkit.org/show_bug.cgi?id=119047
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Rubber-stamped by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::regionBasedColumnsEnabled): Deleted.
-        * dom/Document.h:
-        * page/FrameView.cpp:
-        (WebCore::updateLayerPositionFlags):
-        * page/Settings.in:
-        * rendering/LayoutState.cpp:
-        (WebCore::LayoutState::LayoutState):
-        (WebCore::LayoutState::clearPaginationInformation):
-        (WebCore::LayoutState::addForcedColumnBreak): Deleted.
-        * rendering/LayoutState.h:
-        (WebCore::LayoutState::LayoutState):
-        (WebCore::LayoutState::isPaginatingColumns): Deleted.
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::~RenderBlock):
-        (WebCore::RenderBlock::addChildToContinuation):
-        (WebCore::RenderBlock::addChild):
-        (WebCore::RenderBlock::addChildIgnoringContinuation):
-        (WebCore::RenderBlock::removeLeftoverAnonymousBlock):
-        (WebCore::canMergeContiguousAnonymousBlocks):
-        (WebCore::RenderBlock::removeChild):
-        (WebCore::RenderBlock::recomputeLogicalWidth):
-        (WebCore::RenderBlock::addOverflowFromChildren):
-        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
-        (WebCore::RenderBlock::simplifiedLayout):
-        (WebCore::RenderBlock::layoutPositionedObjects):
-        (WebCore::RenderBlock::paintObject):
-        (WebCore::RenderBlock::selectionGaps):
-        (WebCore::RenderBlock::nodeAtPoint):
-        (WebCore::RenderBlock::offsetForContents):
-        (WebCore::RenderBlock::computeIntrinsicLogicalWidths):
-        (WebCore::RenderBlock::createAnonymousBoxWithSameTypeAs):
-        (WebCore::RenderBlock::childBoxIsUnsplittableForFragmentation):
-        (WebCore::RenderBlock::renderName):
-        (WebCore::RenderBlock::addChildToAnonymousColumnBlocks): Deleted.
-        (WebCore::RenderBlock::containingColumnsBlock): Deleted.
-        (WebCore::RenderBlock::splitFlow): Deleted.
-        (WebCore::RenderBlock::makeChildrenAnonymousColumnBlocks): Deleted.
-        (WebCore::RenderBlock::columnsBlockForSpanningElement): Deleted.
-        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): Deleted.
-        (WebCore::RenderBlock::updateLogicalWidthAndColumnWidth): Deleted.
-        (WebCore::RenderBlock::isTopLayoutOverflowAllowed): Deleted.
-        (WebCore::RenderBlock::isLeftLayoutOverflowAllowed): Deleted.
-        (WebCore::RenderBlock::paintColumnRules): Deleted.
-        (WebCore::RenderBlock::initialBlockOffsetForPainting): Deleted.
-        (WebCore::RenderBlock::blockDeltaForPaintingNextColumn): Deleted.
-        (WebCore::RenderBlock::paintColumnContents): Deleted.
-        (WebCore::ColumnRectIterator::ColumnRectIterator): Deleted.
-        (WebCore::ColumnRectIterator::advance): Deleted.
-        (WebCore::ColumnRectIterator::columnRect): Deleted.
-        (WebCore::ColumnRectIterator::hasMore): Deleted.
-        (WebCore::ColumnRectIterator::adjust): Deleted.
-        (WebCore::ColumnRectIterator::update): Deleted.
-        (WebCore::RenderBlock::hitTestColumns): Deleted.
-        (WebCore::RenderBlock::adjustForColumnRect): Deleted.
-        (WebCore::RenderBlock::availableLogicalWidth): Deleted.
-        (WebCore::RenderBlock::columnGap): Deleted.
-        (WebCore::RenderBlock::computeColumnCountAndWidth): Deleted.
-        (WebCore::RenderBlock::requiresColumns): Deleted.
-        (WebCore::RenderBlock::setComputedColumnCountAndWidth): Deleted.
-        (WebCore::RenderBlock::updateColumnProgressionFromStyle): Deleted.
-        (WebCore::RenderBlock::computedColumnWidth): Deleted.
-        (WebCore::RenderBlock::computedColumnCount): Deleted.
-        (WebCore::RenderBlock::columnInfo): Deleted.
-        (WebCore::RenderBlock::columnCount): Deleted.
-        (WebCore::RenderBlock::columnRectAt): Deleted.
-        (WebCore::RenderBlock::adjustPointToColumnContents): Deleted.
-        (WebCore::RenderBlock::adjustRectForColumns): Deleted.
-        (WebCore::RenderBlock::flipForWritingModeIncludingColumns): Deleted.
-        (WebCore::RenderBlock::adjustStartEdgeForWritingModeIncludingColumns): Deleted.
-        (WebCore::RenderBlock::adjustForColumns): Deleted.
-        (WebCore::RenderBlock::adjustIntrinsicLogicalWidthsForColumns): Deleted.
-        (WebCore::RenderBlock::paginationUnit): Deleted.
-        (WebCore::RenderBlock::createAnonymousColumnsWithParentRenderer): Deleted.
-        (WebCore::RenderBlock::createAnonymousColumnSpanWithParentRenderer): Deleted.
-        (WebCore::RenderBlock::computeLineGridPaginationOrigin): Deleted.
-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::pixelSnappedLogicalRightOffsetForLine):
-        (WebCore::RenderBlock::createAnonymousBlock):
-        (WebCore::RenderBlock::paintColumnRules):
-        (WebCore::RenderBlock::createAnonymousColumnsBlock): Deleted.
-        (WebCore::RenderBlock::createAnonymousColumnSpanBlock): Deleted.
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::adjustIntrinsicLogicalWidthsForColumns):
-        (WebCore::RenderBlockFlow::computeIntrinsicLogicalWidths):
-        (WebCore::RenderBlockFlow::recomputeLogicalWidthAndColumnWidth):
-        (WebCore::RenderBlockFlow::columnGap):
-        (WebCore::RenderBlockFlow::computeColumnCountAndWidth):
-        (WebCore::RenderBlockFlow::layoutBlock):
-        (WebCore::inNormalFlow):
-        (WebCore::RenderBlockFlow::applyBeforeBreak):
-        (WebCore::RenderBlockFlow::applyAfterBreak):
-        (WebCore::RenderBlockFlow::updateMinimumPageHeight):
-        (WebCore::RenderBlockFlow::computeOverflow):
-        (WebCore::RenderBlockFlow::addOverhangingFloats):
-        (WebCore::RenderBlockFlow::hasOverhangingFloat):
-        (WebCore::RenderBlockFlow::relayoutForPagination):
-        (WebCore::RenderBlockFlow::checkForPaginationLogicalHeightChange):
-        (WebCore::RenderBlockFlow::requiresColumns):
-        (WebCore::RenderBlockFlow::setComputedColumnCountAndWidth):
-        (WebCore::RenderBlockFlow::updateColumnProgressionFromStyle):
-        (WebCore::RenderBlockFlow::computedColumnWidth):
-        (WebCore::RenderBlockFlow::computedColumnCount):
-        * rendering/RenderBlockFlow.h:
-        (WebCore::RenderBlockFlow::hasOverhangingFloats):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::styleDidChange):
-        (WebCore::RenderBox::offsetFromContainer):
-        (WebCore::RenderBox::computeRectForRepaint):
-        (WebCore::RenderBox::layoutOverflowRectForPropagation):
-        * rendering/RenderBox.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
-        (WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
-        * rendering/RenderBoxModelObject.h:
-        (WebCore::RenderBoxModelObject::canHaveBoxInfoInRegion):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderGeometryMap.cpp:
-        (WebCore::canMapBetweenRenderers):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::clippedOverflowRectForRepaint):
-        (WebCore::RenderInline::computeRectForRepaint):
-        (WebCore::RenderInline::offsetFromContainer):
-        (WebCore::RenderInline::mapLocalToContainer):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::RenderLayer):
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::updatePagination):
-        (WebCore::accumulateOffsetTowardsAncestor):
-        (WebCore::RenderLayer::paintList):
-        (WebCore::RenderLayer::hitTestList):
-        (WebCore::checkContainingBlockChainForPagination): Deleted.
-        (WebCore::RenderLayer::useRegionBasedColumns): Deleted.
-        (WebCore::RenderLayer::paintPaginatedChildLayer): Deleted.
-        (WebCore::RenderLayer::paintChildLayerIntoColumns): Deleted.
-        (WebCore::RenderLayer::hitTestPaginatedChildLayer): Deleted.
-        (WebCore::RenderLayer::hitTestChildLayerColumns): Deleted.
-        * rendering/RenderLayer.h:
-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::shouldCheckColumnBreaks):
-        * rendering/RenderMultiColumnFlowThread.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::computeRectForRepaint):
-        (WebCore::RenderObject::mapLocalToContainer):
-        (WebCore::RenderObject::pushMappingToContainer):
-        (WebCore::RenderObject::offsetFromContainer):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isAnonymousBlock):
-        (WebCore::RenderObject::RenderObjectBitfields::RenderObjectBitfields):
-        (WebCore::RenderObject::hasColumns): Deleted.
-        (WebCore::RenderObject::setHasColumns): Deleted.
-        (WebCore::RenderObject::isAnonymousColumnsBlock): Deleted.
-        (WebCore::RenderObject::isAnonymousColumnSpanBlock): Deleted.
-        (WebCore::RenderObject::adjustForColumns): Deleted.
-        (WebCore::RenderObject::offsetForColumns): Deleted.
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::selectionRectForRepaint):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::availableLogicalHeight):
-        (WebCore::RenderView::pageOrViewLogicalHeight):
-        (WebCore::RenderView::unextendedBackgroundRect):
-        (WebCore::RenderView::backgroundRect):
-        (WebCore::RenderView::shouldDisableLayoutStateForSubtree):
-        (WebCore::RenderView::pageNumberForBlockProgressionOffset):
-        (WebCore::RenderView::pageCount):
-        (WebCore::RenderView::paginationUnit): Deleted.
-        * rendering/RenderView.h:
-        (WebCore::LayoutStateMaintainer::LayoutStateMaintainer):
-        (WebCore::LayoutStateMaintainer::push):
-        * rendering/SimpleLineLayout.cpp:
-        (WebCore::SimpleLineLayout::canUseFor):
-        * rendering/svg/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::layout):
-        * style/StyleResolveForDocument.cpp:
-        (WebCore::Style::resolveForDocument):
</del><ins>+            Revert r152328, which added a key used only in the callback info for
+            WKPageGetPlugInInformation.
</ins><span class="cx"> 
</span><del>-2014-05-06  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+            * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Don't select an image that is about to have its menu shown.
-        &lt;rdar://problem/16807845&gt; and https://bugs.webkit.org/show_bug.cgi?id=132579
</del><ins>+2013-07-24  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Merge r153002
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+    2013-07-22  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/Editor.h:
-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::replaceNodeFromPasteboard): New method that first selects
-          the Node and then immediately pastes over it. Since it’s synchronous the 
-          selection never has a chance to paint.
</del><ins>+            AX: VoiceOver only read the first column in a safari table
+            https://bugs.webkit.org/show_bug.cgi?id=118992
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        (WebCore::ImageControlsButtonElementMac::defaultEventHandler): Don’t select the image.
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2014-05-06  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+            In case the first section has fewer columns than the rest of the table, the AXTable was only reporting the number of
+            columns for the first section. We need to take the max number of columns out of all sections.
</ins><span class="cx"> 
</span><del>-        [Mac] make metadata cue attributes consistent
-        https://bugs.webkit.org/show_bug.cgi?id=132610
</del><ins>+            Test: accessibility/table-with-mismatch-column-count-in-initial-section.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            * accessibility/AccessibilityTable.cpp:
+            (WebCore::AccessibilityTable::addChildren):
</ins><span class="cx"> 
</span><del>-        No new tests, updated http/tests/media/track-in-band-hls-metadata.html.
</del><ins>+2013-07-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mac/SerializedPlatformRepresentationMac.mm:
-        (WebCore::jsValueWithAVMetadataItemInContext): Don't include keys @dataTypeNamespace
-            or @pictureType, @dataType -&gt; @type.
</del><ins>+        Merge r153072
</ins><span class="cx"> 
</span><del>-2014-05-06  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+    2013-07-23  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Flash of content without image&quot; when pasting a raw image from the pasteboard
-        &lt;rdar://problem/16826199&gt; and https://bugs.webkit.org/show_bug.cgi?id=132612
</del><ins>+            REGRESSION(r150867): FrameView auto-sizing + delegate denied image load may cause StyleResolver to re-enter itself.
+            &lt;rdar://problem/14324895&gt;
+            &lt;http://webkit.org/b/119023&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Let an ArchiveResource be flagged as &quot;should load immediately&quot;:
-        * loader/archive/ArchiveResource.cpp:
-        (WebCore::ArchiveResource::ArchiveResource):
-        * loader/archive/ArchiveResource.h:
-        (WebCore::ArchiveResource::setShouldLoadImmediately):
-        (WebCore::ArchiveResource::shouldLoadImmediately):
</del><ins>+            The bug happened when FrameView::autoSizeIfEnabled() was getting called below FrameLoader::checkCompleted()
+            triggered by an incorrect loadDone() callback originating in SubresourceLoader::didCancel().
</ins><span class="cx"> 
</span><del>-        Set that flag on the ArchiveResource for the image.
-        Note we quite explicitly do this only in the &quot;read a single image&quot; from the pasteboard
-        case, because we don't want to do this synchronous step for multiple images at once
-        such as when pasting a WebArchive:
-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::WebContentReader::readImage):
</del><ins>+            * css/StyleResolver.cpp:
+            (WebCore::StyleResolver::loadPendingResources):
</ins><span class="cx"> 
</span><del>-        When creating a new CachedResource, if there is an ArchiveResource that is set to
-        load immediately, populate the CachedResource immediately instead of scheduling a load:
-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::CachedResourceLoader::requestResource):
</del><ins>+                Add an assertion that this function is not getting re-entered. If a similar bug occurs
+                in the future, this will help the lucky person debugging.
</ins><span class="cx"> 
</span><del>-2014-05-06  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            * loader/SubresourceLoader.cpp:
+            (WebCore::SubresourceLoader::didCancel):
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix for debug after r168367.
</del><ins>+                Don't notifyDone() if the SubresourceLoader is in Uninitialized state.
</ins><span class="cx"> 
</span><del>-        * platform/NotImplemented.cpp:
-        Added include NotImplemented.h.
</del><ins>+2013-07-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-06  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Merge r153068
</ins><span class="cx"> 
</span><del>-        Removed unnecessary notImplemented.h includes.
-        https://bugs.webkit.org/show_bug.cgi?id=132587
</del><ins>+    2013-07-23  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Pixel-snap the unavailable plugin indicator arrow for maximum sharpness
+            https://bugs.webkit.org/show_bug.cgi?id=119024
+            &lt;rdar://problem/14523331&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/webdatabase/Database.cpp:
-        * accessibility/AccessibilityObject.cpp:
-        * bindings/js/Dictionary.h:
-        * bindings/js/SerializedScriptValue.cpp:
-        * html/HTMLMediaSession.cpp:
-        * html/ImageDocument.cpp:
-        * html/parser/HTMLFormattingElementList.cpp:
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        * page/mac/EventHandlerMac.mm:
-        * platform/NotImplemented.cpp:
-        * platform/audio/ios/MediaSessionManagerIOS.mm:
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        * platform/graphics/mac/GraphicsContext3DMac.mm:
-        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
-        * platform/ios/PlatformScreenIOS.mm:
-        * platform/mac/PlatformScreenMac.mm:
-        * platform/mac/WidgetMac.mm:
-        * platform/mediastream/MediaStreamTrackPrivate.cpp:
-        * platform/mediastream/mac/AVCaptureDeviceManager.mm:
-        * platform/mediastream/mac/AVMediaCaptureSource.mm:
-        * rendering/RenderGrid.cpp:
-        * workers/SharedWorkerGlobalScope.cpp:
-        * workers/WorkerGlobalScope.cpp:
-        * workers/WorkerMessagingProxy.cpp:
-        Removed notImplemented from list of includes.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-05-06  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::addReplacementArrowPath):
+            (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
+            Pixel-snap the unavailable plugin indicator arrow. Snapping directions
+            were chosen by eye/symmetry to look best on 1x and 2x devices at
+            1x and 2x page scale.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after http://trac.webkit.org/changeset/168364
</del><ins>+2013-07-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLineBreak.cpp:
</del><ins>+        Merge r153060
</ins><span class="cx"> 
</span><del>-2014-05-06  Christophe Dumez  &lt;ch.dumez@samsung.com&gt;
</del><ins>+    2013-07-23  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [HTML] Default argument to HTMLTableSectionElement.insertRow() should be -1
-        https://bugs.webkit.org/show_bug.cgi?id=132570
</del><ins>+            Dictionary hotkey does not work on vertical text
+            https://bugs.webkit.org/show_bug.cgi?id=118993
+            &lt;rdar://problem/14478260&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        HTMLTableSectionElement.insertRow()'s argument default value should be -1, not
-        0, as per the specification:
-        http://www.whatwg.org/specs/web-apps/current-work/multipage/tabular-data.html#the-tbody-element
</del><ins>+            Test: platform/mac/editing/input/firstrectforcharacterrange-vertical.html
</ins><span class="cx"> 
</span><del>-        The new behavior matches the one of Firefox 29 and IE11, and soon Blink:
-        https://code.google.com/p/chromium/issues/detail?id=369803
</del><ins>+            * editing/Editor.cpp:
+            (WebCore::collapseCaretWidth): A helper function.
+            (WebCore::Editor::firstRectForRange): Many changes:
+            - use RenderObject::absoluteBoundingBoxRectForRange() in regular case, because
+            that's more direct that getting caret rects and computing bounding rect from those.
+            - handle collapsed ranges separately, because absoluteBoundingBoxRectForRange()
+            doesn't provide the needed result, and because it can be done faster.
+            - wherever we use carets to compute the result, account for vertical text (in a hackish
+            way, as we don't have layout information at Editor level).
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/HTMLTableSectionElement/insertRow-default-argument.html
</del><ins>+            * rendering/RenderBlock.cpp: (WebCore::RenderBlock::localCaretRect): Removed
+            dead code.
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableSectionElement.h:
-        * html/HTMLTableSectionElement.idl:
</del><ins>+2013-07-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        Merge r153003
</ins><span class="cx"> 
</span><del>-        REGRESSION(r155957): Selection rects are incorrect when the selection contains BR elements.
-        https://bugs.webkit.org/show_bug.cgi?id=132596
-        &lt;rdar://problem/16692206&gt;
</del><ins>+    2013-07-22  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            segfault in RenderLayerCompositor when the iframe's position attribute is changed and it embeds &lt;object&gt;.
+            https://bugs.webkit.org/show_bug.cgi?id=118965
</ins><span class="cx"> 
</span><del>-        This patch adds an implementation of collectSelectionRects to RenderLineBreak.
-        It uses the same logic used by RenderText to compute and annotate the returned rect
-        which is computed, like the caret rect, using information from the rootline box.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLineBreak.cpp:
-        (WebCore::RenderLineBreak::collectSelectionRects):
-        * rendering/RenderLineBreak.h:
</del><ins>+            Do not change the composition state unless we can reliably figure out the iframe's size.
+            If the renderer is not yet attached, its size is not computable.
</ins><span class="cx"> 
</span><del>-2014-05-06  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+            Test: compositing/iframes/iframe-position-absolute-with-padding-percentage-crash.html
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Optimize the number of regions invalidations
-        https://bugs.webkit.org/show_bug.cgi?id=132611
</del><ins>+            * rendering/RenderLayerCompositor.cpp:
+            (WebCore::RenderLayerCompositor::requiresCompositingForFrame):
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        It is possible to invalidate the region chain of a flow thread
-        during the layout of the region when its height is not final.
</del><ins>+        Merge r153017
</ins><span class="cx"> 
</span><del>-        This patch places the check after the height of the region
-        is determined, reducing the number of invalidations.
</del><ins>+    2013-07-22  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: Less invalidations and repaints in the repaint tests for
-        the flow threads.
</del><ins>+            Plug-in unavailability indicator should not be displayed if a blocked plugin's indicator is clipped
+            https://bugs.webkit.org/show_bug.cgi?id=118998
+            &lt;rdar://problem/14511268&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::updateLogicalHeight):
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::layoutBlock):
-        (WebCore::RenderNamedFlowFragment::invalidateRegionIfNeeded):
-        * rendering/RenderNamedFlowFragment.h:
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-05-03  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+            * html/HTMLEmbedElement.cpp:
+            (WebCore::HTMLEmbedElement::updateWidget):
+            * html/HTMLObjectElement.cpp:
+            (WebCore::HTMLObjectElement::updateWidget):
+            * html/HTMLPlugInElement.cpp:
+            (WebCore::HTMLPlugInElement::defaultEventHandler):
+            (WebCore::HTMLPlugInElement::supportsFocus):
+            * html/HTMLPlugInImageElement.cpp:
+            (WebCore::HTMLPlugInImageElement::updateWidgetIfNecessary):
+            * loader/SubframeLoader.cpp:
+            (WebCore::SubframeLoader::createJavaAppletWidget):
+            (WebCore::SubframeLoader::loadPlugin):
+            * page/FrameView.cpp:
+            (WebCore::FrameView::updateWidget):
+            Rename showsUnavailablePluginIndicator to isPluginUnavailable, since being unavailable
+            and actually showing the indicator are two totally different things.
</ins><span class="cx"> 
</span><del>-        [Extended Background] Respect repeat-x/repeat-y when creating margin tiles
-        https://bugs.webkit.org/show_bug.cgi?id=132534
</del><ins>+            * WebCore.exp.in: Expose setUnavailablePluginIndicatorIsHidden.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::RenderEmbeddedObject::RenderEmbeddedObject):
+            Rename m_showsUnavailablePluginIndicator to m_isPluginUnavailable.
+            Add m_isUnavailablePluginIndicatorHidden, defaulting to false.
</ins><span class="cx"> 
</span><del>-        If the background image that is causing margin tiles only repeats in dimension only create
-        the tiles in that dimension.
</del><ins>+            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReasonWithDescription):
+            Set m_isPluginUnavailable when we get an unavailability reason.
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateExtendBackgroundIfNecessary):
-        (WebCore::FrameView::calculateExtendedBackgroundMode):
-        (WebCore::FrameView::updateTilesForExtendedBackgroundMode):
-        (WebCore::FrameView::setBackgroundExtendsBeyondPage): Deleted.
-        (WebCore::FrameView::needsExtendedBackgroundRectForPainting): Deleted.
-        (WebCore::FrameView::setHasExtendedBackgroundRectForPainting): Deleted.
-        * page/FrameView.h:
-        * page/Settings.cpp:
-        (WebCore::Settings::setBackgroundShouldExtendBeyondPage):
-        * platform/graphics/TiledBacking.h:
-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::hasHorizontalMargins):
-        (WebCore::TileController::hasVerticalMargins):
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::styleWillChange):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::setTiledBackingHasMargins):
-        * rendering/RenderLayerBacking.h:
</del><ins>+            (WebCore::RenderEmbeddedObject::paint):
+            (WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsHidden): Added.
</ins><span class="cx"> 
</span><del>-2014-05-06  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+            * rendering/RenderEmbeddedObject.h:
+            (WebCore::RenderEmbeddedObject::isPluginUnavailable): Added.
</ins><span class="cx"> 
</span><del>-        AX: VoiceOver does not announce text changes for content editable regions in Safari
-        https://bugs.webkit.org/show_bug.cgi?id=132577
</del><ins>+            (WebCore::RenderEmbeddedObject::showsUnavailablePluginIndicator):
+            Repurpose &quot;showsUnavailablePluginIndicator&quot; to actually represent whether
+            the indicator is displayed (i.e. the plugin is unavailable, and the
+            indicator is not hidden).
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When text or children are changed inside of a contenteditable region, we need to 
-        convert those actions into AXValueChange notifications.
</del><ins>+        Merge r153014
</ins><span class="cx"> 
</span><del>-        Test: accessibility/content-editable-set-inner-text-generates-axvalue-notification.html
</del><ins>+    2013-07-22  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityNodeObject.cpp:
-        (WebCore::AccessibilityNodeObject::childrenChanged):
-        (WebCore::AccessibilityNodeObject::hasContentEditableAttributeSet): Deleted.
-        * accessibility/AccessibilityNodeObject.h:
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::hasContentEditableAttributeSet):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::textChanged):
</del><ins>+            RenderEmbeddedObject::isReplacementObscured should include the arrow in its area-of-interest
+            https://bugs.webkit.org/show_bug.cgi?id=118995
+            &lt;rdar://problem/14516421&gt;
</ins><span class="cx"> 
</span><del>-2014-05-06  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        [SVG2] Share &quot;on&quot;- event attributes with HTMLElement
-        https://bugs.webkit.org/show_bug.cgi?id=132604
</del><ins>+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::RenderEmbeddedObject::unavailablePluginIndicatorBounds):
+            Rename method from replacementTextRect to unavailablePluginIndicatorBounds for accuracy.
+            Use the bounding box of the indicator's path, which includes the rounded rect behind
+            the text as well as the arrow button.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+            (WebCore::RenderEmbeddedObject::isReplacementObscured):
+            * rendering/RenderEmbeddedObject.h:
</ins><span class="cx"> 
</span><del>-        Share &quot;on&quot; event attribute parsing between SVGElement and HTMLElement.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/dom/script-tests/event-attribute-availability.js:
</del><ins>+        Merge r153013
</ins><span class="cx"> 
</span><del>-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::populateEventNameForAttributeLocalNameMap):
-        (WebCore::populateEventNameForAttributeLocalNameMap): Deleted.
-        * html/HTMLElement.h: Make populateEventNameForAttributeLocalNameMap
-            public for use in SVGElement.
-        * svg/SVGElement.cpp: Use HTMLElement code to parse &quot;on&quot; event
-            attributes.
-        (WebCore::SVGElement::parseAttribute):
</del><ins>+    2013-07-22  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+            &lt;applet&gt; plugins are instantiated post-attach (instead of post-layout like for object and embed)
+            https://bugs.webkit.org/show_bug.cgi?id=118994
+            &lt;rdar://problem/14511232&gt;
</ins><span class="cx"> 
</span><del>-        [Soup] Use std::unique_ptr&lt;char[]&gt; for the read buffer in SocketStreamHandle
-        https://bugs.webkit.org/show_bug.cgi?id=132559
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+            Make &lt;applet&gt; consistent with &lt;object&gt; and &lt;embed&gt;, deferring plugin
+            instantiation to post-layout, so that layout is up-to-date if anything
+            needs it (like RenderEmbeddedObject::isReplacementObscured) during creation.
</ins><span class="cx"> 
</span><del>-        Manage the read buffer array through a std::unique_ptr&lt;char[]&gt; object.
-        This avoids handling with the raw pointer and also ensures that the memory
-        allocated with the new[] operator is deleted with the delete[] operator,
-        a problem exposed by the AddressSanitizer in WebSocket tests.
</del><ins>+            * html/HTMLAppletElement.cpp:
+            (WebCore::HTMLAppletElement::updateWidget):
+            Copy code from HTMLObjectElement/HTMLEmbedElement that defers plugin
+            creation until post-layout tasks. Java is always an NPAPI plugin, so
+            we should always defer if requested.
</ins><span class="cx"> 
</span><del>-        * platform/network/soup/SocketStreamHandle.h:
-        * platform/network/soup/SocketStreamHandleSoup.cpp:
-        (WebCore::SocketStreamHandle::SocketStreamHandle):
-        (WebCore::SocketStreamHandle::connected):
-        (WebCore::SocketStreamHandle::readBytes):
-        (WebCore::SocketStreamHandle::platformClose):
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        Merge r152989
</ins><span class="cx"> 
</span><del>-        Adapt inline SVG sizing behavior to Firefox and Blink
-        https://bugs.webkit.org/show_bug.cgi?id=132569
</del><ins>+    2013-07-22  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            PlugIn content can disappear after restarting
+            https://bugs.webkit.org/show_bug.cgi?id=118982
</ins><span class="cx"> 
</span><del>-        This patch is ported from Blink CR 308992. Thanks to David Vest for helping
-        with back porting his Blink patch. From the commit message:
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        &quot;The basis of this change is to map explicit width and height
-        attributes to CSS properties, essentially promoting them to
-        presentation attributes. Note that implicit &quot;100%&quot; width and height
-        are not mapped.
-        
-        This enables us to remove the concept of &quot;percentage intrinsic size&quot;
-        and rely on normal CSS rules to resolve percentage values.
-        
-        The change has been approved by the SVG WG and the spec is being
-        updated. Minutes here:
-        
-        http://www.w3.org/2014/04/07-svg-minutes.html#item03&quot;
</del><ins>+            When a snapshotted plug-in is restarted, we inserted its compositing
+            layer back into the tree, but didn't recalculate style. This meant
+            that a subsequent compositing tree operation (such as any hardware
+            animation) could cause the content to disappear.
</ins><span class="cx"> 
</span><del>-        The new model was indeed approved by the SVG WG and is basically following
-        the CSS 2.1 model for replaced elements.
</del><ins>+            * html/HTMLPlugInImageElement.cpp:
+            (WebCore::HTMLPlugInImageElement::setDisplayState): Force a style recalc.
+            (WebCore::HTMLPlugInImageElement::removeSnapshotTimerFired): Ditto.
</ins><span class="cx"> 
</span><del>-        With this patch WebKit, Firefox and Blink have the same behavior for inline SVG.
-        This is the first successful approach to unify the sizing behavior of SVG
-        across UAs.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: svg/as-object/sizing/svg-in-object-placeholder-height-auto.html
-               svg/as-object/sizing/svg-in-object-placeholder-height-fixed.html
-               svg/as-object/sizing/svg-in-object-placeholder-height-percentage.html
-               svg/in-html/sizing/svg-inline.html
</del><ins>+        Merge r152951
</ins><span class="cx"> 
</span><del>-        * css/svg.css: Root SVG elements still need to be sized with height: 100% and
-            width: 100%. This is necessary since width and height are presentation
-            attributes now.
-        (svg:root):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::computeIntrinsicRatioInformation): Remove all special
-            behavior for intrinsic and percentage based sizes in SVG. This simplifies and
-            unifies the code a lot. Most of the logic that is used is in RenderBox and
-            RenderReplaced now. RenderSVGRoot was cleaned up a lot and is much lighter. 
-            And so it SVGSVGElement.
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::hasAutoHeightOrContainingBlockWithAutoHeight):
-        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions):
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::computeIntrinsicRatioInformation):
-        * rendering/RenderImage.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox):
-        (WebCore::RenderReplaced::computeIntrinsicRatioInformation):
-        (WebCore::RenderReplaced::computeReplacedLogicalWidth):
-        (WebCore::RenderReplaced::computeReplacedLogicalHeight):
-        (WebCore::RenderReplaced::computePreferredLogicalWidths):
-        * rendering/RenderReplaced.h:
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::computeIntrinsicRatioInformation):
-        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
-        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
-        (WebCore::RenderSVGRoot::hasRelativeDimensions):
-        (WebCore::RenderSVGRoot::hasRelativeIntrinsicLogicalWidth): Deleted.
-        (WebCore::RenderSVGRoot::hasRelativeLogicalHeight): Deleted.
-        * rendering/svg/RenderSVGRoot.h:
-        * svg/SVGElement.h:
-        (WebCore::SVGElement::invalidateSVGPresentationAttributeStyle):
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::isPresentationAttribute):
-        (WebCore::SVGSVGElement::collectStyleForPresentationAttribute):
-        (WebCore::SVGSVGElement::svgAttributeChanged):
-        (WebCore::SVGSVGElement::currentViewportSize):
-        (WebCore::SVGSVGElement::hasIntrinsicWidth):
-        (WebCore::SVGSVGElement::hasIntrinsicHeight):
-        (WebCore::SVGSVGElement::intrinsicWidth):
-        (WebCore::SVGSVGElement::intrinsicHeight):
-        (WebCore::SVGSVGElement::widthAttributeEstablishesViewport): Deleted.
-        (WebCore::SVGSVGElement::heightAttributeEstablishesViewport): Deleted.
-        * svg/SVGSVGElement.h:
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::containerSize):
-        * xml/XMLErrors.cpp: If an error occurs in a stand alone SVG file, we create
-            an XHTML document with the error message and append the SVG file.
-            This SVG file now follows the CSS sizing behavior as inline SVG.
-            Therefore, we need to set width and height to 100% explicitly.
-        (WebCore::XMLErrors::insertErrorMessageBlock):
</del><ins>+    2013-07-21  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+            KURL creates duplicate strings when completing data: URIs.
+            &lt;http://webkit.org/b/118952&gt;
+            &lt;rdar://problem/14504480&gt;
</ins><span class="cx"> 
</span><del>-        [EFL] REGRESSION(167145): JavaScript media controls are broken
-        https://bugs.webkit.org/show_bug.cgi?id=131573
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            When checking if the original URL input string can be reused, compare against the part
+            of the parsing buffer that we would actually return, not the entire buffer.
</ins><span class="cx"> 
</span><del>-        * PlatformEfl.cmake: Add the localized strings file to the list of user agent scripts.
-        * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::RenderThemeEfl::mediaControlsScript): Include the localized strings file in the script body.
</del><ins>+            632 kB progression on &lt;http://www.nytimes.com/&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            Test: KURLTest.KURLDataURIStringSharing
</ins><span class="cx"> 
</span><del>-        Implement scan backward and forward in video fullscreen.
-        https://bugs.webkit.org/show_bug.cgi?id=132517
</del><ins>+            * platform/KURL.cpp:
+            (WebCore::KURL::parse):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Implement scanning forward and backward. This implements methods in 
-        WebAVPlayerController and forwards them through WebVideoFullscreenModelMediaElement
-        and on to HTMLMediaElement.
</del><ins>+        Merge r152941
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: necessary exports.
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (-[WebAVPlayerController seekToTime:]):
-        Use fastSeek in this case.
-        (-[WebAVPlayerController canScanForward]): If you can play, you can scan.
-        (+[WebAVPlayerController keyPathsForValuesAffectingCanScanForward]): ditto
-        (-[WebAVPlayerController beginScanningForward:]): ditto
-        (-[WebAVPlayerController endScanningForward:]): ditto
-        (-[WebAVPlayerController canScanBackward]): If you can play, you can scan.
-        (+[WebAVPlayerController keyPathsForValuesAffectingCanScanBackward]): ditto
-        (-[WebAVPlayerController beginScanningBackward:]): ditto
-        (-[WebAVPlayerController endScanningBackward:]): ditto
-        (-[WebAVPlayerController canSeekToBeginning]):
-        This looks at seekableRanges to determine if any seeking is possible.
-        (+[WebAVPlayerController keyPathsForValuesAffectingCanSeekToBeginning]):
-        depends on seekableRanges.
-        (-[WebAVPlayerController seekToBeginning:]): seek to -ininity
-        (-[WebAVPlayerController canSeekToEnd]):
-        This looks at seekableRanges to determine if any seeking is possible.
-        (+[WebAVPlayerController keyPathsForValuesAffectingCanSeekToEnd]):
-        depends on seekableRanges.
-        (-[WebAVPlayerController seekToEnd:]): seek to INFINITY.
-        * platform/ios/WebVideoFullscreenModel.h:
-        Add 4 new functions.
-        * platform/ios/WebVideoFullscreenModelMediaElement.h:
-        ditto
-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::fastSeek): forwards to HTMLMediaEelement
-        (WebVideoFullscreenModelMediaElement::beginScanningForward): forwards to HTMLMediaEelement
-        (WebVideoFullscreenModelMediaElement::beginScanningBackward): forwards to HTMLMediaEelement
-        (WebVideoFullscreenModelMediaElement::endScanning): forwards to HTMLMediaEelement
</del><ins>+    2013-07-19  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+            Pages should not be able to abuse users inside beforeunload handlers.
+            &lt;rdar://problem/14475779&gt; and https://bugs.webkit.org/show_bug.cgi?id=118871.
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Prefetch DNS hostnames on tap highlight
-        https://bugs.webkit.org/show_bug.cgi?id=132509
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            Tests: fast/loader/show-only-one-beforeunload-dialog.html
+                   http/tests/misc/iframe-beforeunload-dialog-matching-ancestor-securityorigin.html
+                   http/tests/misc/iframe-beforeunload-dialog-not-matching-ancestor-securityorigin.html
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * dom/Element.cpp:
-        * dom/Element.h:
-        (WebCore::Element::absoluteLinkURL()):
</del><ins>+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::FrameLoader):
+            (WebCore::FrameLoader::shouldClose):
+            (WebCore::FrameLoader::handleBeforeUnloadEvent):
+            (WebCore::FrameLoader::shouldCloseFiringBeforeUnloadEvent): Renamed from fireBeforeUnloadEvent.
+              Add logic to enforce &quot;1 beforeunload dialog per navigation&quot; as well as &quot;iframes can only show beforeunload 
+              dialogs if their entire ancestry's security origins match the navigating frame.&quot;
+            * loader/FrameLoader.h:
+            * loader/FrameLoader.h:
</ins><span class="cx"> 
</span><del>-2014-05-05  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Add the ability for Page to know when any frame is dispatching beforeunload:
+            * page/Page.cpp:
+            (WebCore::Page::Page):
+            (WebCore::Page::incrementFrameHandlingBeforeUnloadEventCount):
+            (WebCore::Page::decrementFrameHandlingBeforeUnloadEventCount):
+            (WebCore::Page::isAnyFrameHandlingBeforeUnloadEvent):
+            * page/Page.h:
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Flickery scrolling inside overflow-scrolling: touch
-        https://bugs.webkit.org/show_bug.cgi?id=132591
-        &lt;rdar://problem/16760466&gt;
</del><ins>+            * page/DOMWindow.cpp:
+            (WebCore::DOMWindow::print): Disallow if any frame is in beforeunload dispatch.
+            (WebCore::DOMWindow::alert): Ditto.
+            (WebCore::DOMWindow::confirm): Ditto.
+            (WebCore::DOMWindow::prompt): Ditto.
+            (WebCore::DOMWindow::showModalDialog): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Avoid triggering layer tree commits that touch the layer's boundsOrigin
-        while the user is scrolling in the UI process.
-        
-        Fix the WKOverflowScrollViewDelegate to pass along an &quot;inUserInteration&quot;
-        flag to the ScrollingTree to say that we're in the middle of a user interaction
-        (and also to send a final non-interactive update). That gets passed along
-        to the web process, and turned into &quot;SyncScrollingLayerPosition&quot; update.
-        AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll() consults
-        this, and uses it to set a flag on the ScrollableArea to say that the scroll
-        is a user scroll.
-        
-        RenderLayerBacking then makes use of this (in existing code, shared with WK1)
-        to avoid triggering layer bounds setting. Instead, it now just calls syncBoundsOrigin(),
-        which updates the GraphicsLayer without touching platform layers. This is necessary
-        so that GraphicsLayer geometry is up-to-date (used for tiled layer visibility
-        computations).
-        
-        Finally, a hack in GraphicsLayerCA::computeVisibleRect() is conditionalized
-        for WebKit1 by checking the type of platform layer.
</del><ins>+        Merge r152939
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::scrollPositionChangedViaDelegatedScrolling):
-        * page/scrolling/ScrollingTree.h:
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::syncBoundsOrigin):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::computeVisibleRect):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
</del><ins>+    2013-07-19  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            AX: VoiceOver not detecting misspelled words don't work in all cases
+            https://bugs.webkit.org/show_bug.cgi?id=118924
</ins><span class="cx"> 
</span><del>-        Stop using BlobData on client side
-        https://bugs.webkit.org/show_bug.cgi?id=132582
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            VoiceOver is now looking for a new misspelled attribute.
</ins><span class="cx"> 
</span><del>-        Blob registration now uses either a single file path, or a vector of much simpler
-        BlobPart objects, not an array with arbitrarily sliced blobs or files, which can't happen.
</del><ins>+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (AXAttributeStringSetSpelling):
+            (AXAttributedStringAppendText):
</ins><span class="cx"> 
</span><del>-        * Modules/websockets/WebSocket.cpp:(WebCore::WebSocket::didReceiveBinaryData):
-        Use a new simpler Blob constructor.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj: Added BlobPart, removed BlobRegistrationData.
</del><ins>+        Merge r152939
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSBlobCustom.cpp: (WebCore::JSBlobConstructor::constructJSBlob):
-        Use Vector&lt;BlobPart&gt; instead of BlobData (1 line of code instead of 5).
</del><ins>+    2013-07-19  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/DataTransfer.cpp: (WebCore::DataTransfer::hasFileOfType): Updated for
-        File::contentTypeFromFilePathOrName rename.
</del><ins>+            AX: VoiceOver not detecting misspelled words don't work in all cases
+            https://bugs.webkit.org/show_bug.cgi?id=118924
</ins><span class="cx"> 
</span><del>-        * fileapi/Blob.cpp: (WebCore::Blob::Blob):
-        * fileapi/Blob.h:
-        (WebCore::Blob::create):
-        (WebCore::Blob::deserialize):
-        * fileapi/File.cpp:
-        (WebCore::File::File):
-        (WebCore::File::contentTypeFromFilePathOrName):
-        (WebCore::createBlobDataForFileWithType): Deleted.
-        (WebCore::createBlobDataForFile): Deleted.
-        (WebCore::createBlobDataForFileWithName): Deleted.
-        (WebCore::File::contentTypeFromFilePath): Deleted.
-        * fileapi/File.h: (WebCore::File::deserialize): Deleted.
-        Added and updated constructors to not use BlobData. Changed special case constructors
-        to use name tags instead of non-enforced comments.
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * fileapi/ThreadableBlobRegistry.h:
-        * fileapi/ThreadableBlobRegistry.cpp:
-        (WebCore::BlobRegistryContext::BlobRegistryContext): Updated with new data members
-        that were split out of BlobData.
-        (WebCore::ThreadableBlobRegistry::registerFileBlobURL): Added.
-        (WebCore::ThreadableBlobRegistry::registerBlobURL): Updated to pass Content-Type
-        explicitly, as it's no longer hidden in BlobData.
</del><ins>+            VoiceOver is now looking for a new misspelled attribute.
</ins><span class="cx"> 
</span><del>-        * fileapi/WebKitBlobBuilder.h:
-        * fileapi/WebKitBlobBuilder.cpp:
-        (WebCore::BlobBuilder::append):
-        (WebCore::BlobBuilder::finalize):
-        (WebCore::BlobBuilder::appendBytesData): Deleted.
-        Updated to use BlobPart. There is no longer any need to special case Files,
-        the registry takes care of that.
</del><ins>+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (AXAttributeStringSetSpelling):
+            (AXAttributedStringAppendText):
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobData.h:
-        * platform/network/BlobData.cpp:
-        (WebCore::BlobDataItem::detachFromCurrentThread): Deleted.
-        (WebCore::BlobData::detachFromCurrentThread): Deleted.
-        BlobData will only be used on main thread by the registry.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobPart.h: Added. A new class to encapsulate a list of blobs
-        that are combined into a new blob, as exposed to JS via Blob constructor.
</del><ins>+        Merge r152911
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobRegistry.h:
-        * platform/network/BlobRegistryImpl.cpp:
-        (WebCore::BlobRegistryImpl::registerFileBlobURL):
-        (WebCore::BlobRegistryImpl::registerBlobURL):
-        * platform/network/BlobRegistryImpl.h:
-        Updated for the new registration methods. We no longer have arbitrary BlobDatas
-        coming in.
</del><ins>+    2013-07-19  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/FormData.cpp: Don't include BlobData for now (but really,
-        BlobStorageData is the same thing, and they will be merged soon).
-        Unfortunately, FormData is used by both client and registry side, and there is
-        no clear delimitation at the time.

-        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::responseBlob): Use the new simpler
-        way to create a Blob.
</del><ins>+            OSX: ePub: Unable to select text in vertical Japanese book
+            https://bugs.webkit.org/show_bug.cgi?id=118864
+            &lt;rdar://problem/14109351&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+            Reviewed by Dan Bernstein and Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Clean up Image Document and tweak the layout and viewport
-        https://bugs.webkit.org/show_bug.cgi?id=132552
</del><ins>+            This patch fixes all of the various writing-mode and pagination combinations
+            so that the columns are painted in the correct location. The code that sets up
+            the initial painting translation offset in the block direction and that advances
+            that offset has been pulled into two helper functions, initialBlockOffsetForPainting
+            and blockDeltaForPaintingNextColumn, and that code is now shared by the four call
+            sites that need it (painting and hit testing in RenderBlock and painting and hit testing
+            in RenderLayer).
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            This patch also backs out the maximumScrollPosition change, since it only occurred because
+            of incorrect sizing of the RenderView, and this sizing issue has now been corrected by
+            ensuring that computeLogicalHeight() always makes sure you are the size of the viewport
+            and does not shrink you to the column height.
</ins><span class="cx"> 
</span><del>-        The #ifdef in every function was making quite a mess. A lot of that code does
-        not make sense on iOS.
</del><ins>+            There was also a race condition that caused pagination to be incorrect if layout occurred
+            before the html/body renderer that set the writing-mode were available. When this happened,
+            the writing mode got propagated up to the view, but the column styles didn't get
+            adjusted to compensate for the writing mode change.
</ins><span class="cx"> 
</span><del>-        This patch make a clean split between mouse related stuff and iOS.
</del><ins>+            Added tests for every pagination and writing-mode combination in fast/multicol/pagination.
</ins><span class="cx"> 
</span><del>-        Also:
-        -Change the viewport to be only width based, and avoid scaling in portrait.
-        -Center the image horizontally in the view.
</del><ins>+            * css/StyleResolver.cpp:
+            (WebCore::StyleResolver::styleForDocument):
+            (WebCore::StyleResolver::adjustRenderStyle):
+            Move setStylesForPaginationMode into RenderStyle and make it a member function. This is
+            necessary so that the style can be adjusted dynamically to fix the race condition mentioned
+            above.
</ins><span class="cx"> 
</span><del>-        * html/ImageDocument.cpp:
-        (WebCore::ImageDocument::ImageDocument):
-        (WebCore::ImageDocument::createDocumentStructure):
-        (WebCore::ImageDocument::imageUpdated):
-        (WebCore::ImageDocument::scale):
-        (WebCore::ImageDocument::resizeImageToFit):
-        (WebCore::ImageDocument::imageFitsInWindow):
-        (WebCore::ImageDocument::windowSizeChanged):
-        (WebCore::ImageDocument::imageClicked):
-        * html/ImageDocument.h:
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::maximumScrollPosition):
+            Back out this change since the symptom it was fixing only occurred because the logical
+            height of the view was being set incorrectly.
</ins><span class="cx"> 
</span><del>-2014-05-05  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::checkForPaginationLogicalHeightChange):
+            Patch the column code that sets up the initial page height to use the pagination API's
+            page height rather than the viewport logical height. This allows the view to still match
+            the viewport in dimensions rather than being incorrectly sized to the column height.
</ins><span class="cx"> 
</span><del>-        Need a delegate that informs the UI process when the page's pin state changes
-        https://bugs.webkit.org/show_bug.cgi?id=132583
-        -and corresponding-
-        &lt;rdar://problem/16806231&gt;
</del><ins>+            (WebCore::RenderBlock::initialBlockOffsetForPainting):
+            (WebCore::RenderBlock::blockDeltaForPaintingNextColumn):
+            Two new helper functions used to set up the block direction paint/hit testing translation.
+            The major bug fix that occurred in this code is that the old block axis code didn't handle
+            reversal correctly and it also used physical coordinates to try to determine the translation
+            offset, when you really need to use logical coordinates in the original writing mode coordinate
+            system to determine the offset.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            (WebCore::RenderBlock::paintColumnContents):
+            Patched to call the new helper functions.
</ins><span class="cx"> 
</span><del>-        We should default all of these pin-state value to true.
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::ScrollingTree):
</del><ins>+            (WebCore::ColumnRectIterator::ColumnRectIterator):
+            (WebCore::ColumnRectIterator::adjust):
+            (WebCore::ColumnRectIterator::update):
+            Patched to call the new helper functions.
</ins><span class="cx"> 
</span><del>-2014-05-05  Christophe Dumez  &lt;ch.dumez@samsung.com&gt;
</del><ins>+            * rendering/RenderBlock.h:
+            Add the two new helper functions to the RenderBlock header.
</ins><span class="cx"> 
</span><del>-        Named element cache can become invalid during HTMLCollection::updateNamedElementCache()
-        https://bugs.webkit.org/show_bug.cgi?id=132575
</del><ins>+            * rendering/RenderBox.cpp:
+            (WebCore::RenderBox::styleDidChange):
+            If the writing mode of the html/body propagates to the viewport and changes its writing mode,
+            also change our column styles to match if we're in paginated mode.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+            (WebCore::RenderBox::computeLogicalHeight):
+            (WebCore::RenderBox::computePercentageLogicalHeight):
+            Call the new pageOrViewLogicalHeight function on RenderView instead of
+            RenderBox::viewLogicalHeightForPercentages (which is now removed).
</ins><span class="cx"> 
</span><del>-        Make sure the named element cache object stays valid in
-        HTMLCollection::updateNamedElementCache() while it is populating it.
</del><ins>+            * rendering/RenderLayer.cpp:
+            (WebCore::RenderLayer::paintChildLayerIntoColumns):
+            (WebCore::RenderLayer::hitTestChildLayerColumns):
+            Patched to use the two new helper functions for block direction paint offset setup and
+            advancement.
</ins><span class="cx"> 
</span><del>-        The method was previously creating and setting the cache first, and then start
-        traversing the DOM tree to populate it. As a consequence, hasNamedElementCache()
-        would start returning true before the cache is actually populated.
-        The issue is that finding matches in the DOM tree can cause
-        HTMLCollection::invalidateCache() to be called under certain circumstances and
-        thus the named element cache object can become invalid while
-        updateNamedElementCache() is populating it.
</del><ins>+            * rendering/RenderView.cpp:
+            (WebCore::RenderView::pageOrViewLogicalHeight):
+            New helper function that does what viewLogicalHeightForPercentages used to do but also
+            handles returning the page length for block axis column progression. Again, this is to
+            allow the view to retain its correct size (matching the viewport).
</ins><span class="cx"> 
</span><del>-        To avoid the issue, this patch updates updateNamedElementCache() so that the
-        named element cache map is set *after* traversing the DOM tree. This way,
-        hasNamedElementCache() returns false while the cache is being populated and
-        there is no chance of it being invalidated too early.
</del><ins>+            (WebCore::RenderView::viewLogicalHeight):
+            Back out the code that made the view grow or shrink to the size of the Pagination API page
+            length when the progression was block axis. This was the source of most of the scroll origin
+            and scrolling issues.
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/htmlcollection-selectedOptions-namedItem-crash.html
</del><ins>+            * rendering/RenderView.h:
+            Add the new pageOrViewLogicalHeight() function.
</ins><span class="cx"> 
</span><del>-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::updateNamedElementCache):
-        * html/HTMLCollection.h:
-        (WebCore::HTMLCollection::setNameItemCache):
-        (WebCore::HTMLCollection::createNameItemCache): Deleted.
-        * html/HTMLFormControlsCollection.cpp:
-        (WebCore::HTMLFormControlsCollection::updateNamedElementCache):
</del><ins>+            * rendering/style/RenderStyle.cpp:
+            (WebCore::RenderStyle::setColumnStylesFromPaginationMode):
+            This is the old StyleResolver function for setting up the column styles. It's in RenderStyle
+            now so that it can be called at any time to change a style rather than only at style resolution
+            time.
</ins><span class="cx"> 
</span><del>-2014-05-05  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+            * rendering/style/RenderStyle.h:
+            Declaration of the setColumnStylesFromPaginationMode function.
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Special case ViewGestureGeometryCollector::collectGeometryForSmartMagnificationGesture() for image documents
-        https://bugs.webkit.org/show_bug.cgi?id=132553
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Merge r152907
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/ImageDocument.cpp:
-        (WebCore::ImageDocument::imageElement):
-        * html/ImageDocument.h:
</del><ins>+    2013-07-19  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+            Hover doesn't work for block elements inside a href element
+            https://bugs.webkit.org/show_bug.cgi?id=118907
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Webkit-blend-mode fails for accelerated parent with overflow:hidden
-        https://bugs.webkit.org/show_bug.cgi?id=126160
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        When the isolating layer has overflow:hidden, it will create a descendant clipping layer
-        (m_childContainmentLayer), which will restrict the bleding layer to reading the backdrop
-        from the isolating layer.
-        The solution in this patch is to forbid the isolating layer to create a descendant clipping
-        layer and make all the children to get their own ancestor clipping layers instead.
</del><ins>+            Added test for hovering block elements inside a href element.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Test: fast/css/hover-display-block.html
</ins><span class="cx"> 
</span><del>-        Tests: css3/compositing/blend-mode-accelerated-parent-overflow-hidden.html
-               css3/compositing/blend-mode-clip-accelerated-blending-canvas.html
-               css3/compositing/blend-mode-clip-accelerated-blending-child.html
-               css3/compositing/blend-mode-clip-accelerated-blending-double.html
-               css3/compositing/blend-mode-clip-accelerated-blending-with-siblings.html
-               css3/compositing/blend-mode-clip-accelerated-transformed-blending.html
-               css3/compositing/blend-mode-clip-rect-accelerated-blending.html
</del><ins>+            * rendering/RenderObject.cpp:
+            (WebCore::RenderObject::hoverAncestor):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        when the compositing ancestor isolates blending we take it into account for computing
-        the clipping rect for this layer, because it was not allowed to create the descendant
-        clipping layer. 
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::clippedByAncestor):
-        when the compositing ancestor isolates blending we decide if a layer is clipped by ancestor
-        by computing the clipping rect taking into account all the ancestors up to and including
-        the compositing ancestor.
-        (WebCore::RenderLayerCompositor::clipsCompositingDescendants):
-        if a layer isolates blending, it is not allowed to create a descendant clipping layer.
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        Merge r152858
</ins><span class="cx"> 
</span><del>-        AX: tabindex support in SVG2
-        https://bugs.webkit.org/show_bug.cgi?id=130212
</del><ins>+    2013-07-18  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+            Crash in WebCore::createMarkup()
+            https://bugs.webkit.org/show_bug.cgi?id=118847
</ins><span class="cx"> 
</span><del>-        The patch is mainly based on a patch for Blink by Erik Dahlström.
-        https://src.chromium.org/viewvc/blink?revision=172964&amp;view=revision
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        It adds support for tabindex to SVG by reusing the HTML code.
</del><ins>+            Also check that we have a containingBlock() for the renderer() so that we
+            may safely call node() on it.
</ins><span class="cx"> 
</span><del>-        Spec: https://svgwg.org/svg2-draft/interact.html#sequential-focus-navigation-and-the-tabindex-attribute
-        IDL attribute: https://svgwg.org/svg2-draft/types.html#__svg__SVGElement__tabIndex
</del><ins>+            * editing/markup.cpp:
+            (WebCore::highestAncestorToWrapMarkup):
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/tabindex-order.html
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::setTabIndex): Moved from HTMLElement and shared with all elements.
-        * dom/Element.h:
-        * html/HTMLAnchorElement.cpp: Remove outdated comment.
-        (WebCore::HTMLAnchorElement::canStartSelection):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::setTabIndex): Deleted.
-        * html/HTMLElement.h:
-        * svg/SVGAElement.cpp: Uses the same logic as HTMLAnchorElement now.
-        (WebCore::SVGAElement::tabIndex):
-        (WebCore::SVGAElement::supportsFocus):
-        (WebCore::SVGAElement::isMouseFocusable):
-        (WebCore::SVGAElement::isKeyboardFocusable):
-        (WebCore::SVGAElement::canStartSelection):
-        * svg/SVGAElement.h:
-        * svg/SVGCircleElement.h:
-        * svg/SVGClipPathElement.h:
-        * svg/SVGDefsElement.h:
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::tabIndex): Return -1 if element can not be focused.
-        (WebCore::SVGElement::parseAttribute):
-        (WebCore::SVGElement::isMouseFocusable):
-        (WebCore::SVGElement::isKeyboardFocusable): Deleted. Use function on Element.
-        * svg/SVGElement.h:
-        * svg/SVGElement.idl:
-        * svg/SVGEllipseElement.h:
-        * svg/SVGGElement.h:
-        * svg/SVGGraphicsElement.h: Remove supportsFocus() from inheriting functions.
-            Don't just return true. SVG elements should not be focusable by default.
-            Instead check if tabindex was set explicitly.
-        * svg/SVGImageElement.h:
-        * svg/SVGLineElement.h:
-        * svg/SVGPathElement.h:
-        * svg/SVGPolyElement.h:
-        * svg/SVGRectElement.h:
-        * svg/SVGSVGElement.h:
-        * svg/SVGSwitchElement.h:
-        * svg/SVGSymbolElement.h:
-        * svg/SVGTextElement.h:
</del><ins>+        Merge r152839
</ins><span class="cx"> 
</span><del>-2014-05-05  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+    2013-07-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Implement beginScrubbing and endScrubbing for video fullscreen.
-        https://bugs.webkit.org/show_bug.cgi?id=132520
</del><ins>+            willWriteSelectionToPasteboard and willPerformDragSourceAction editing callbacks are not called for drag and drop
+            https://bugs.webkit.org/show_bug.cgi?id=118828
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Reviewed by Gavin Barraclough.
</ins><span class="cx"> 
</span><del>-        Plumb through beginScrubbing and endScrubbing from AVKit down to HTMLMediaElement.
-        This keeps the playback state consistent while scrubbing and allows playback state
-        to return to the original state when scrubbing is complete.
</del><ins>+            Call these two callbacks when we start a drag and drop.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (-[WebAVPlayerController beginScrubbing:]):
-        (-[WebAVPlayerController endScrubbing:]):
-        * platform/ios/WebVideoFullscreenModel.h:
-        * platform/ios/WebVideoFullscreenModelMediaElement.h:
-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::beginScrubbing):
-        (WebVideoFullscreenModelMediaElement::endScrubbing):
</del><ins>+            No new tests for now but we should start logging these callbacks in DRT and WTR's EditorClients.
</ins><span class="cx"> 
</span><del>-2014-05-05  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+            * page/DragController.cpp:
+            (WebCore::DragController::startDrag):
</ins><span class="cx"> 
</span><del>-        More long hangs under IOSurfacePool::evict
-        https://bugs.webkit.org/show_bug.cgi?id=132576
-        &lt;rdar://problem/16769469&gt;
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r152824
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cg/IOSurfacePool.cpp:
-        (WebCore::IOSurfacePool::evict):
-        If the pool is too full, we should be evicting in-use surfaces
-        even if the size of the in-use surfaces has dropped below maximumInUseBytes,
-        otherwise we can get stuck in an infinite loop with 0 cached surfaces
-        and 1+ in-use surfaces.
</del><ins>+    2013-07-17  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            Update blocked/missing plug-in UI
+            https://bugs.webkit.org/show_bug.cgi?id=118347
+            &lt;rdar://problem/14209318&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Remove regionLayoutUpdate event
-        https://bugs.webkit.org/show_bug.cgi?id=132564
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            * WebCore.exp.in:
+            Export RenderEmbeddedObject::setPluginUnavailabilityReasonWithDescription.
</ins><span class="cx"> 
</span><del>-        The regionLayoutUpdate event was removed from the regions spec and was replaced by two other events: 
-        regionOversetChange and regionFragmentChange.
</del><ins>+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::replacementTextRoundedRectPressedColor):
+            (WebCore::replacementTextRoundedRectColor):
+            (WebCore::replacementTextColor):
+            Change colors to new design and add some more constants.
</ins><span class="cx"> 
</span><del>-        No new tests needed, this patch removes a feature.
</del><ins>+            (WebCore::shouldUnavailablePluginMessageBeButton): Added.
</ins><span class="cx"> 
</span><del>-        * dom/EventNames.h:
-        * dom/WebKitNamedFlow.cpp:
-        (WebCore::WebKitNamedFlow::dispatchRegionLayoutUpdateEvent): Deleted.
-        * dom/WebKitNamedFlow.h:
-        * inspector/InspectorCSSAgent.cpp:
-        (WebCore::InspectorCSSAgent::resetNonPersistentData):
-        (WebCore::InspectorCSSAgent::willRemoveNamedFlow):
-        (WebCore::UpdateRegionLayoutTask::UpdateRegionLayoutTask): Deleted.
-        (WebCore::UpdateRegionLayoutTask::scheduleFor): Deleted.
-        (WebCore::UpdateRegionLayoutTask::unschedule): Deleted.
-        (WebCore::UpdateRegionLayoutTask::reset): Deleted.
-        (WebCore::UpdateRegionLayoutTask::timerFired): Deleted.
-        (WebCore::InspectorCSSAgent::didUpdateRegionLayout): Deleted.
-        (WebCore::InspectorCSSAgent::regionLayoutUpdated): Deleted.
-        * inspector/InspectorCSSAgent.h:
-        * inspector/InspectorInstrumentation.cpp:
-        (WebCore::InspectorInstrumentation::didUpdateRegionLayoutImpl): Deleted.
-        * inspector/InspectorInstrumentation.h:
-        (WebCore::InspectorInstrumentation::didUpdateRegionLayout): Deleted.
-        * inspector/protocol/CSS.json:
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::updateOversetState):
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::RenderNamedFlowThread):
-        (WebCore::RenderNamedFlowThread::removeRegionFromThread):
-        (WebCore::RenderNamedFlowThread::layout):
-        (WebCore::RenderNamedFlowThread::dispatchRegionLayoutUpdateEventIfNeeded): Deleted.
-        (WebCore::RenderNamedFlowThread::regionLayoutUpdateEventTimerFired): Deleted.
-        * rendering/RenderNamedFlowThread.h:
</del><ins>+            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReasonWithDescription): Added.
+            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReason):
+            Call through to the -WithDescription variant.
</ins><span class="cx"> 
</span><del>-2014-05-05  Rik Cabanier  &lt;cabanier@adobe.com&gt;
</del><ins>+            (WebCore::RenderEmbeddedObject::paintReplaced):
+            Fill the background, and otherwise match the new design.
</ins><span class="cx"> 
</span><del>-        Enhance IDL compiler so it supports unrestricted float and double
-        https://bugs.webkit.org/show_bug.cgi?id=132460
</del><ins>+            (WebCore::addReplacementArrowPath):
+            Add an arrow to the given path, inside the given rect.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
+            Add a 1px padding to the bottom of the text.
+            Add a circle and an arrow into the indicator as per the new design.
</ins><span class="cx"> 
</span><del>-        Updated IDL compiler so it supports unrestricted types.
-        Also updated the IDL files so they use unrestricted float and
-        double.
</del><ins>+            (WebCore::RenderEmbeddedObject::isInUnavailablePluginIndicator):
+            Hit-test the indicator arrow as well; otherwise, the fact that the arrow
+            is a hole in the path means it won't be hit.
</ins><span class="cx"> 
</span><del>-        Tests:
-        * canvas/philip/tests/2d.gradient.linear.nonfinite.html:
-        * canvas/philip/tests/2d.gradient.object.invalidoffset.html:
-        * canvas/philip/tests/2d.gradient.radial.nonfinite.html:
-        * canvas/philip/tests/2d.imageData.get.nonfinite.html:
-        * canvas/philip/tests/2d.imageData.put.nonfinite.html:
-        * canvas/philip/tests/2d.missingargs.html:
-        * fast/canvas/canvas-getImageData-invalid-expected.txt:
-        * fast/canvas/canvas-putImageData-expected.txt:
-        * fast/canvas/canvas-putImageData.js:
</del><ins>+            * rendering/RenderEmbeddedObject.h:
</ins><span class="cx"> 
</span><del>-        * Modules/battery/BatteryManager.idl:
-        * Modules/gamepad/Gamepad.idl:
-        * Modules/geolocation/Coordinates.idl:
-        * Modules/mediasource/MediaSource.idl:
-        * Modules/mediasource/SourceBuffer.idl:
-        * Modules/mediasource/VideoPlaybackQuality.idl:
-        * Modules/mediastream/MediaSourceStates.idl:
-        * Modules/proximity/DeviceProximityEvent.idl:
-        * Modules/speech/SpeechGrammar.idl:
-        * Modules/speech/SpeechGrammarList.idl:
-        * Modules/speech/SpeechRecognitionAlternative.idl:
-        * Modules/speech/SpeechSynthesisEvent.idl:
-        * Modules/speech/SpeechSynthesisUtterance.idl:
-        * Modules/webaudio/AnalyserNode.idl:
-        * Modules/webaudio/AudioBuffer.idl:
-        * Modules/webaudio/AudioBufferSourceNode.idl:
-        * Modules/webaudio/AudioContext.idl:
-        * Modules/webaudio/AudioListener.idl:
-        * Modules/webaudio/AudioParam.idl:
-        * Modules/webaudio/AudioProcessingEvent.idl:
-        * Modules/webaudio/OfflineAudioContext.idl:
-        * Modules/webaudio/OscillatorNode.idl:
-        * Modules/webaudio/PannerNode.idl:
-        * bindings/scripts/CodeGenerator.pm:
-        * bindings/scripts/CodeGeneratorGObject.pm:
-        (GetGValueTypeName):
-        (GetGlibTypeName):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        (GenerateParametersCheck):
-        (JSValueToNative):
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        (GetObjCType):
-        (GenerateHeader):
-        * bindings/scripts/test/TestObj.idl:
-        * bindings/scripts/test/TestTypedefs.idl:
-        * css/CSSPrimitiveValue.idl:
-        * css/WebKitCSSMatrix.idl:
-        * dom/ClientRect.idl:
-        * dom/DeviceMotionEvent.idl:
-        * dom/DeviceOrientationEvent.idl:
-        * dom/Document.idl:
-        * dom/RequestAnimationFrameCallback.idl:
-        * dom/Touch.idl:
-        * dom/TransitionEvent.idl:
-        * dom/WebKitAnimationEvent.idl:
-        * dom/WebKitTransitionEvent.idl:
-        * dom/WheelEvent.idl:
-        * html/HTMLInputElement.idl:
-        * html/HTMLMediaElement.idl:
-        * html/HTMLMeterElement.idl:
-        * html/HTMLProgressElement.idl:
-        * html/MediaController.idl:
-        * html/TextMetrics.idl:
-        * html/TimeRanges.idl:
-        * html/canvas/CanvasRenderingContext2D.idl:
-        * html/canvas/WebGLRenderingContext.idl:
-        * html/track/DataCue.idl:
-        * html/track/TextTrackCue.idl:
-        * html/track/VTTCue.idl:
-        * html/track/VTTRegion.idl:
-        * inspector/InspectorFrontendHost.idl:
-        * inspector/ScriptProfile.idl:
-        * inspector/ScriptProfileNode.idl:
-        * page/DOMWindow.idl:
-        * page/Performance.idl:
-        * page/PerformanceEntry.idl:
-        * page/PerformanceResourceTiming.idl:
-        * page/SpeechInputResult.idl:
-        * page/WebKitPoint.idl:
-        * svg/SVGAngle.idl:
-        * svg/SVGAnimatedNumber.idl:
-        * svg/SVGAnimationElement.idl:
-        * svg/SVGFEDropShadowElement.idl:
-        * svg/SVGFEGaussianBlurElement.idl:
-        * svg/SVGFEMorphologyElement.idl:
-        * svg/SVGGlyphRefElement.idl:
-        * svg/SVGLength.idl:
-        * svg/SVGMatrix.idl:
-        * svg/SVGNumber.idl:
-        * svg/SVGPathElement.idl:
-        * svg/SVGPathSegArcAbs.idl:
-        * svg/SVGPathSegArcRel.idl:
-        * svg/SVGPathSegCurvetoCubicAbs.idl:
-        * svg/SVGPathSegCurvetoCubicRel.idl:
-        * svg/SVGPathSegCurvetoCubicSmoothAbs.idl:
-        * svg/SVGPathSegCurvetoCubicSmoothRel.idl:
-        * svg/SVGPathSegCurvetoQuadraticAbs.idl:
-        * svg/SVGPathSegCurvetoQuadraticRel.idl:
-        * svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl:
-        * svg/SVGPathSegCurvetoQuadraticSmoothRel.idl:
-        * svg/SVGPathSegLinetoAbs.idl:
-        * svg/SVGPathSegLinetoHorizontalAbs.idl:
-        * svg/SVGPathSegLinetoHorizontalRel.idl:
-        * svg/SVGPathSegLinetoRel.idl:
-        * svg/SVGPathSegLinetoVerticalAbs.idl:
-        * svg/SVGPathSegLinetoVerticalRel.idl:
-        * svg/SVGPathSegMovetoAbs.idl:
-        * svg/SVGPathSegMovetoRel.idl:
-        * svg/SVGPoint.idl:
-        * svg/SVGRect.idl:
-        * svg/SVGSVGElement.idl:
-        * svg/SVGTextContentElement.idl:
-        * svg/SVGTransform.idl:
-        * svg/SVGZoomEvent.idl:
-        * testing/InternalSettings.idl:
-        * testing/Internals.idl:
-        * xml/XPathResult.idl:
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Rollout r152701
</ins><span class="cx"> 
</span><del>-        Use a layer delegate instead of web_disableAllActions wherever possible
-        https://bugs.webkit.org/show_bug.cgi?id=132560
-        &lt;rdar://problem/16459284&gt;
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r152793
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (PlatformCALayerMac::commonInit):
-        If we own the platform layer, set its delegate to the action-disabling WebActionDisablingCALayerDelegate.
-        If we don't, its actual owner might want to control the delegate, so continue using web_disableAllActions.
</del><ins>+    2013-07-17  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cocoa/WebActionDisablingCALayerDelegate.h: Added.
-        * platform/graphics/cocoa/WebActionDisablingCALayerDelegate.mm: Added.
-        (+[WebActionDisablingCALayerDelegate shared]):
-        (-[WebActionDisablingCALayerDelegate actionForLayer:forKey:]):
-        Add a class that can act as the delegate of a CALayer, and disables all actions.
</del><ins>+            Wrong linebox height, when block element parent has vertical-align property defined.
+            https://bugs.webkit.org/show_bug.cgi?id=118245
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cocoa/WebCoreCALayerExtras.h: Renamed from Source/WebCore/platform/graphics/mac/WebCoreCALayerExtras.h.
-        * platform/graphics/cocoa/WebCoreCALayerExtras.mm: Renamed from Source/WebCore/platform/graphics/mac/WebCoreCALayerExtras.mm.
-        (-[CALayer web_disableAllActions]):
-        Move WebCoreCALayerExtras from mac/ to cocoa/.
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-2014-05-05  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+            Do not push the current element to the next, when it is still considered empty, even with
+            some object(s) in front. Behave as if it was actually empty.
+            Inline elements like &lt;span&gt;&lt;/span&gt; generate such lines.
</ins><span class="cx"> 
</span><del>-        Session-aware plugin autostart data
-        https://bugs.webkit.org/show_bug.cgi?id=131758
-        &lt;rdar://problem/15906540&gt;
</del><ins>+            Test: fast/css/empty-span-with-parent-div-and-vertical-align.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
</ins><span class="cx"> 
</span><del>-        * html/HTMLPlugInImageElement.cpp:
-        (WebCore::HTMLPlugInImageElement::userDidClickSnapshot):
-        * page/PlugInClient.h:
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-05  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Merge r152788
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Elements with overflow:auto are not painted inside regions when following a float
-        https://bugs.webkit.org/show_bug.cgi?id=131161
</del><ins>+    2013-07-17  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            CSS selector list splitting should be by component, not by selector.
+            &lt;http://webkit.org/b/118761&gt;
+            &lt;rdar://problem/14421609&gt;
</ins><span class="cx"> 
</span><del>-        When a float-avoiding element (such as overflow:auto) is flowed into a flow thread after a float, its 
-        logical left is not set on its frameRect or its layer's topLeft, but is instead kept in its RenderBoxRegionInfo
-        structure. In some situation, this causes paint rejection to kick-in because intersecting the layer's rect
-        (which DOESN'T contain the logical left from the region info object) with the computed background rect 
-        (which contains the logical left from the region info object) results in an empty rect.
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/overflow-auto-after-float.html
</del><ins>+            Test (amended): fast/css/rule-selector-overflow.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
</del><ins>+            * css/CSSSelectorList.h:
+            * css/CSSSelectorList.cpp:
+            (WebCore::CSSSelectorList::CSSSelectorList):
+            (WebCore::CSSSelectorList::componentCount):
+            * css/CSSStyleRule.cpp:
+            (WebCore::CSSStyleRule::setSelectorText):
</ins><span class="cx"> 
</span><del>-2014-05-05  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+                Renamed CSSSelectorList::length() to componentCount() and made it public.
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Slider displayed wrong in regions
-        https://bugs.webkit.org/show_bug.cgi?id=132243
</del><ins>+            * css/RuleSet.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+                maximumSelectorCount =&gt; maximumSelectorComponentCount
</ins><span class="cx"> 
</span><del>-        In case a box didn't have a range, getRegionRangeForBox was searching for
-        the top-most unplittable ancestor. This is not correct in every case. It's
-        possible to have a box with range that has children without ranges (e.g. an
-        absolutely positioned inline box with shadow descendants).
</del><ins>+            * css/StyleRule.cpp:
+            (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):
</ins><span class="cx"> 
</span><del>-        I've modified getRegionRangeForBox to search for the first ancestor that
-        has a cached range and use that instead of looking for an unsplittable box.
-        The range of the box is the region at the top of the box, clamped by the
-        range of the ancestor. This will be correct all the time once all the layout
-        systems are region range aware and are able to cache it.
</del><ins>+                Make the splits after accumulating 'maximumSelectorComponentCount' components.
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/positioned-slider-in-regions.html
</del><ins>+            * css/StyleRule.h:
+            * css/StyleSheetContents.cpp:
+            (WebCore::StyleSheetContents::parserAppendRule):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::hasRegionRangeForBox):
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
-        * rendering/RenderFlowThread.h:
</del><ins>+                splitIntoMultipleRulesWithMaximumSelectorCount =&gt; splitIntoMultipleRulesWithMaximumSelectorComponentCount
</ins><span class="cx"> 
</span><del>-2014-05-05  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] ASSERT when hovering over region
-        https://bugs.webkit.org/show_bug.cgi?id=128809
</del><ins>+        Merge r152783
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+    2013-07-17  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        There's no point in hit-testing a box for a region if it's not contained inside
-        that region.
</del><ins>+            Regression: columnheader/rowheader roles not exposed correctly
+            https://bugs.webkit.org/show_bug.cgi?id=113628
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/hit-test-box-non-containing-region.html
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::nodeAtPoint):
</del><ins>+            When we determine the row and column headers we look at the ARIA role being returned, but
+            since TableCell overrides the determineAccessibilityRole method, the ARIA role is never set.
</ins><span class="cx"> 
</span><del>-2014-05-04  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            Test: platform/mac/accessibility/aria-columnrowheaders.html
</ins><span class="cx"> 
</span><del>-        Optimize JSRopeString for resolving directly to AtomicString.
-        &lt;https://webkit.org/b/132548&gt;
</del><ins>+            * accessibility/AccessibilityTableCell.cpp:
+            (WebCore::AccessibilityTableCell::determineAccessibilityRole):
</ins><span class="cx"> 
</span><del>-        Add two bindings generator attributes for parameters to influence
-        the way that JS rope strings are resolved:
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        - AtomicString
</del><ins>+        Merge r152743
</ins><span class="cx"> 
</span><del>-            Generates code that avoids allocating a new StringImpl if there
-            is already an existing AtomicString we can reuse.
</del><ins>+    2013-07-16  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        - RequiresExistingAtomicString
</del><ins>+            Atomicize HTMLAnchorElement.hash before passing it to JS.
+            &lt;http://webkit.org/b/118748&gt;
+            &lt;rdar://problem/14459780&gt;
</ins><span class="cx"> 
</span><del>-            Generates code that fails immediately if the provided string
-            is not found in the AtomicString table. This is now used for
-            document.getElementById(), and works because any existing ID
-            is guaranteed to be in the table.
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Filip Pizlo.
</del><ins>+            Instead of generating a unique string from '#' + the URL hash every time HTMLAnchorElement.hash
+            is queried, turn it into an AtomicString. This prevents massive memory usage in scripts that
+            fetch .hash a lot.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateParametersCheck):
-        (JSValueToNative):
-        * bindings/scripts/IDLAttributes.txt:
-        * dom/Document.idl:
</del><ins>+            Reduces memory consumption by 4.65 MB when viewing the full HTML5 spec at &lt;http://whatwg.org/c&gt;
</ins><span class="cx"> 
</span><del>-2014-05-04  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * html/HTMLAnchorElement.cpp:
+            (WebCore::HTMLAnchorElement::hash):
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Compositing layers in iframes are misplaced
-        https://bugs.webkit.org/show_bug.cgi?id=132554
-        &lt;rdar://problem/16203027&gt;
</del><ins>+2013-07-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Merge r152721
</ins><span class="cx"> 
</span><del>-        Have requiresScrollLayer() only consider frameView.delegatesScrolling()
-        for the main frame, so that iframes get scroll layers (even though they
-        will never scroll), so that the rest of geometry code works as on other
-        platforms.
</del><ins>+    2013-07-16  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresScrollLayer):
</del><ins>+            HTMLMediaElement should not add cues for disabled text tracks
+            https://bugs.webkit.org/show_bug.cgi?id=118682
</ins><span class="cx"> 
</span><del>-2014-05-04  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Use std::unique_ptr in m_taskTimer of Notification class
-        https://bugs.webkit.org/show_bug.cgi?id=132544
</del><ins>+            Merge https://src.chromium.org/viewvc/blink?view=rev&amp;revision=153810
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Tests: media/track/track-disabled-addcue.html
+                   media/track/track-disabled.html
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::textTrackAddCues): Do nothing if the track is disabled.
+            (WebCore::HTMLMediaElement::textTrackAddCue): Ditto.
</ins><span class="cx"> 
</span><del>-        * Modules/notifications/Notification.cpp:
-        (WebCore::Notification::Notification):
-        * Modules/notifications/Notification.h: Use std::unique_ptr instead of OwnPtr.
</del><ins>+2013-07-16  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-04  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Merge r152701
</ins><span class="cx"> 
</span><del>-        Long hangs under IOSurfacePool::evict
-        https://bugs.webkit.org/show_bug.cgi?id=132549
-        &lt;rdar://problem/16769469&gt;
</del><ins>+    2013-07-15  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Update blocked/missing plug-in UI
+            https://bugs.webkit.org/show_bug.cgi?id=118347
+            &lt;rdar://problem/14209318&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cg/IOSurfacePool.cpp:
-        (WebCore::IOSurfacePool::willAddSurface):
-        Run eviction before adding the new surface to m_bytesCached/m_inUseBytesCached.
-        We use the additionalSize parameter to make space for the new surface.
</del><ins>+            Reviewed by Sam Weinig.
+            Patch by Anders Carlsson, Antoine Quint, Sam Weinig, and myself.
</ins><span class="cx"> 
</span><del>-        (WebCore::IOSurfacePool::evict):
-        If we want to free up the entire pool, we can do so by throwing away everything.
-        This also avoids an underflow if additionalSize is larger than the maximum pool size.
</del><ins>+            * CMakeLists.txt:
+            * DerivedSources.make:
+            * DerivedSources.pri:
+            * GNUmakefile.am:
+            * WebCore.exp.in:
+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj.filters:
+            * WebCore.xcodeproj/project.pbxproj:
+            * css/CSSDefaultStyleSheets.cpp:
+            * css/unavailablePlugIns.css: Added.
+            Add new Source/WebCore/css/unavailablePlugIns.css stylesheet.
</ins><span class="cx"> 
</span><del>-2014-05-04  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+            * dom/EventListener.h:
+            New event listener type to support the creation of an event listener
+            for the label and icon for missing / blocked plug-in UI.
</ins><span class="cx"> 
</span><del>-        Shortcircuit shouldUseCredentialStorage callback
-        https://bugs.webkit.org/show_bug.cgi?id=132308
-        &lt;rdar://problem/16806708&gt;
</del><ins>+            * html/HTMLPlugInElement.cpp:
+            (WebCore::HTMLPlugInElement::defaultEventHandler):
+            Remove explicit event handling since we're now using a DOM event handler
+            on the label and icon in the shadow root.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            * html/HTMLPlugInImageElement.cpp:
+            (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
+            Don't populate the shadow root with plugin snapshotting elements
+            if we're not planning on showing a snapshot, because this means that
+            the shadow root was created for the unavailable plugin indicator instead.
</ins><span class="cx"> 
</span><del>-        If we are going to return true from the shouldUseCredentialStorage callback then we don't
-        really need to have CFNetwork/Foundation call us. We can just disable the callback and
-        CFNetwork will assume true. Add a separate subclass that implements this callback when we
-        need to return false. We can also eliminate the corresponding async callbacks. This avoids
-        pingponging between dispatch queue and main thread in the common case.
</del><ins>+            * page/ChromeClient.h:
+            (WebCore::ChromeClient::shouldUnavailablePluginMessageIncludeButton):
+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::RenderEmbeddedObject::RenderEmbeddedObject):
+            (WebCore::shouldUnavailablePluginMessageIncludeButton):
+            Rename from shouldUnavailablePluginMessageBeButton to
+            shouldUnavailablePluginMessageIncludeButton for accuracy.
</ins><span class="cx"> 
</span><del>-        No new tests because no change in functionality.
</del><ins>+            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReasonDescription):
+            Set custom text to be displayed in the unavailability indicator.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/network/ResourceHandle.cpp:
-        * platform/network/ResourceHandle.h:
-        * platform/network/ResourceHandleClient.cpp:
-        * platform/network/ResourceHandleClient.h:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::createCFURLConnection):
-        (WebCore::ResourceHandle::shouldUseCredentialStorage):
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
-        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::shouldUseCredentialStorage):
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.h:
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::makeDelegate):
-        (WebCore::ResourceHandle::delegate):
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously):
-        (WebCore::ResourceHandle::shouldUseCredentialStorage):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.h:
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleWithCredentialStorageAsOperationQueueDelegate connectionShouldUseCredentialStorage:]):
-        * platform/network/soup/ResourceHandleSoup.cpp:
</del><ins>+            (WebCore::RenderEmbeddedObject::setPluginUnavailabilityReason):
+            (WebCore::RenderEmbeddedObject::handleUnavailablePluginButtonClickEvent):
+            (WebCore::RenderEmbeddedObject::willBeDestroyed):
+            (WebCore::RenderEmbeddedObject::isReplacementObscured):
+            (WebCore::RenderEmbeddedObjectEventListener::handleEvent):
+            (WebCore::RenderEmbeddedObjectEventListener::operator==):
+            Remove the old code used to render the missing / blocked plug-in UI in C++ in favor
+            of populating a shadow root in setPluginUnavailabilityReason(). We add a DOM event
+            listener in the shadow root to eventually call into unavailablePluginButtonClicked()
+            on the ChromeClient.
</ins><span class="cx"> 
</span><del>-2014-05-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            (WebCore::RenderEmbeddedObject::paint):
+            (WebCore::RenderEmbeddedObject::layout):
+            Paint and lay out UA shadow root children.
</ins><span class="cx"> 
</span><del>-        [iOS] deviceScaleFactor is being double-applied when rendering captions in full screen mode 
-        https://bugs.webkit.org/show_bug.cgi?id=132481
-        &lt;rdar://problem/16507482&gt;
</del><ins>+            (WebCore::RenderEmbeddedObject::canHaveChildren):
+            canHaveChildren can use the existence of a UA shadow root to decide
+            whether a RenderEmbeddedObject can have children.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            * rendering/RenderEmbeddedObject.h:
+            (WebCore::RenderEmbeddedObjectEventListener::create):
+            (WebCore::RenderEmbeddedObjectEventListener::cast):
+            (WebCore::RenderEmbeddedObjectEventListener::RenderEmbeddedObjectEventListener):
+            Create the new event listener class necessary to handle events in the shadow root.
</ins><span class="cx"> 
</span><del>-        Add a new 'syncTextTrackBounds' method (and relaying functions) to keep the text track container in sync
-        with changes to the video player's display layer.
</del><ins>+            (WebCore::RenderEmbeddedObject::pluginUnavailabilityReasonDescription): Added.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::syncTextTrackBounds: Added.
-        * html/HTMLMediaElement.h:
-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Don't set the platform scale factor here. It is already
-        being accounted for in the createTextTrackRepresentationImage method.
-        (WebCore::MediaControlTextTrackContainerElement::updateSizes): Synchronize the text track representation
-        with any new video layer changes.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::syncTextTrackBounds): Added.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::syncTextTrackBounds): Added.
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer): Use new sync function.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenFrame): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::syncTextTrackBounds): Added. Keep the text track layer size in sync with
-        the current video layer size. This may change during animations, rotations, etc.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setTextTrackRepresentation): Use new sync function.
</del><ins>+            * rendering/RenderWidget.h:
+            Promote willBeDestroyed() to be public so we may override it in the RenderEmbeddedObject subclass.
</ins><span class="cx"> 
</span><del>-2014-05-04  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Top content inset: Margin tiles should not display in the inset area when pinned 
-        to the top of the page
-        https://bugs.webkit.org/show_bug.cgi?id=132535
-        -and corresponding-
-        &lt;rdar://problem/16613039&gt;
</del><ins>+        Merge r152689
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2013-07-15  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Prior to this change, topContentInset was implemented by positioning 
-        RenderLayerCompositor’s m_rootContentLayer based on the inset value. In order to 
-        ensure that no content is displayed in the inset area when we are pinned to the 
-        top of the page, we’ll have to take a different approach. In this patch, when you 
-        are pinned to the top of the page, the m_rootContentLayer is positioned at (0,0), 
-        much like it would be without an inset, but the m_clip layer IS positioned at (0, 
-        topContentInset). Then for all y-scroll values between 0 and topContentInset, the 
-        positions of the clip layer and the contents layer are adjusted so that the clip 
-        layer approaches a position of (0,0), and the root layer approaches a position of 
-        (0, topContentInset). This makes sure that any content above the top the document 
-        is aways clipped out of the inset area.
</del><ins>+            Pack WebCore::Font slightly better.
+            &lt;http://webkit.org/b/118681&gt;
+            &lt;rdar://problem/14446014&gt;
</ins><span class="cx"> 
</span><del>-        In order to achieve this, the scrolling thread needs to know about the 
-        topContentInset, the clip layer, and the root contents layer.
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        AsyncScrollingCoordinator::updateScrollingNode() now takes an additional parameter 
-        for the clip layer. Also export the topContentInset symbol for UI-side 
-        compositing.
-        * WebCore.exp.in:
</del><ins>+            Knock 8 bytes off of Font by packing the members better. Reduces memory consumption by 429 kB when
+            viewing the full HTML5 spec at &lt;http://whatwg.org/c&gt;
</ins><span class="cx"> 
</span><del>-        Here is the new computation. Implemented in one spot that can be called from the 
-        scrolling thread, AsyncScrollingCoordinator and RenderLayerCompositor.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::yPositionForInsetClipLayer):
-        (WebCore::FrameView::yPositionForRootContentLayer):
-        * page/FrameView.h:
</del><ins>+            * platform/graphics/Font.h:
+            (WebCore::Font::typesettingFeatures):
</ins><span class="cx"> 
</span><del>-        Set the topContentInset, the insetClipLayer, and the scrolledContentsLayer when 
-        appropriate.
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated):
-        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Set or sync the positions for the inset layer and the contents layer.
-        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
-        (WebCore::AsyncScrollingCoordinator::updateScrollingNode):
-        * page/scrolling/AsyncScrollingCoordinator.h:
</del><ins>+        Merge r152653
</ins><span class="cx"> 
</span><del>-        Convenience functions for getting the clipLayer() and the rootContentLayer() from 
-        the RenderLayerCompositor.
-        * page/scrolling/ScrollingCoordinator.cpp:
-        (WebCore::ScrollingCoordinator::insetClipLayerForFrameView):
-        (WebCore::ScrollingCoordinator::rootContentLayerForFrameView):
-        * page/scrolling/ScrollingCoordinator.h:
-        (WebCore::ScrollingCoordinator::updateScrollingNode):
</del><ins>+    2013-07-15  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        ScrollingStateScrolling nodes have two new members now. m_insetClipLayer and 
-        m_topContentInset. We can use m_scrolledContentsLayer for the rootContentsLayer 
-        since previously that member was not used for FrameViews; it was only used for 
-        accelerated overflow:scroll nodes.
-        * page/scrolling/ScrollingStateScrollingNode.cpp:
-        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
-        (WebCore::ScrollingStateScrollingNode::setTopContentInset):
-        (WebCore::ScrollingStateScrollingNode::setInsetClipLayer):
-        * page/scrolling/ScrollingStateScrollingNode.h:
</del><ins>+            Text with &quot;text-overflow:ellipsis&quot; and an SVG font do not render correctly
+            https://bugs.webkit.org/show_bug.cgi?id=118669
</ins><span class="cx"> 
</span><del>-        Similarly, ScrollingTreeScrollingNode has two new members for m_topContentInset 
-        and m_clipLayer.
-        * page/scrolling/ScrollingTreeScrollingNode.cpp:
-        (WebCore::ScrollingTreeScrollingNode::ScrollingTreeScrollingNode):
-        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        (WebCore::ScrollingTreeScrollingNode::topContentInset):
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::updateBeforeChildren):
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        Compute positions for the two new layers.
-        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
</del><ins>+            Partial runs may be routed through the complex path in several Font functions. While incomplete,
+            we can check for a non-NULL run.renderingContext() and exempt runs that have it from being forced
+            down the complex path. A more thorough fix is already tracked by http://webkit.org/b/100050.
</ins><span class="cx"> 
</span><del>-        Now use the static FrameView functions to compute the positions for these layers.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::frameViewDidChangeSize):
-        (WebCore::RenderLayerCompositor::positionForClipLayer):
-        (WebCore::RenderLayerCompositor::clipLayer):
-        (WebCore::RenderLayerCompositor::rootContentLayer):
-        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
-        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
-        (WebCore::RenderLayerCompositor::ensureRootLayer):
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
-        * rendering/RenderLayerCompositor.h:
</del><ins>+            Adding a new testcase which is a copy of svg/text/text-overflow-ellipsis-svgfont.html with kerning
+            and ligatures turned on explicitly since DRT runs with those off by default and this option is required
+            to be on for the issue to reproduce.
</ins><span class="cx"> 
</span><del>-2014-05-04  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+            Fix courtesy of Dan Bernstein.
</ins><span class="cx"> 
</span><del>-        Clear the Selector Query caches on memory pressure
-        https://bugs.webkit.org/show_bug.cgi?id=132545
</del><ins>+            Test: svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            * platform/graphics/Font.cpp:
+            (WebCore::Font::drawText):
+            (WebCore::Font::drawEmphasisMarks):
+            (WebCore::Font::selectionRectForText):
</ins><span class="cx"> 
</span><del>-        The Selector Query Cache can use quite a bit of memory if many
-        complex selectors are compiled. This patch makes sure the cache gets
-        cleared on memory pressure.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::clearSelectorQueryCache):
-        (WebCore::Document::setCompatibilityMode):
-        (WebCore::Document::updateBaseURL):
-        * dom/Document.h:
-        * dom/SelectorQuery.cpp:
-        (WebCore::SelectorQueryCache::invalidate): Deleted.
-        * dom/SelectorQuery.h:
-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::releaseMemory):
</del><ins>+        Rollout r152686.  Previously merged.
</ins><span class="cx"> 
</span><del>-2014-05-04  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Convert OwnPtr to std::unique_ptr in CDM
-        https://bugs.webkit.org/show_bug.cgi?id=132467
</del><ins>+        Merge r152382
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+    2013-07-03  Gordon Sheridan  &lt;gordon_sheridan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Use std::unique_ptr in CDM class.
</del><ins>+            Implement mechanism to detect (partially) hidden blocked plugins.
+            https://bugs.webkit.org/show_bug.cgi?id=117998
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        * Modules/encryptedmedia/CDM.cpp:
-        (WebCore::CDM::create):
-        (WebCore::CDM::CDM):
-        * Modules/encryptedmedia/CDM.h:
-        * Modules/encryptedmedia/CDMPrivateMediaPlayer.h:
-        (WebCore::CDMPrivateMediaPlayer::CDMPrivateMediaPlayer):
-        (WebCore::CDMPrivateMediaPlayer::create):
-        * Modules/encryptedmedia/MediaKeys.cpp:
-        (WebCore::MediaKeys::create):
-        (WebCore::MediaKeys::MediaKeys):
-        * Modules/encryptedmedia/MediaKeys.h:
-        * WebCore.exp.in:
</del><ins>+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::RenderEmbeddedObject::replacementTextRect):
+            Added private method for calculating the size of the replacement text for blocked plugins.
</ins><span class="cx"> 
</span><del>-2014-05-03  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            (WebCore::RenderEmbeddedObject::isReplacementObscured):
+            Added public method to determine if the EMBED element used for a blocked plugin is inaccessible to the user.
+            * rendering/RenderEmbeddedObject.h:
+            Declare the two new methods mentioned above.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168232.
-        https://bugs.webkit.org/show_bug.cgi?id=132543
</del><ins>+            * WebCore.exp.in:
+            Export RenderEmbeddedObject::isReplacementObscured().
</ins><span class="cx"> 
</span><del>-        broke ~15 tests on WK2 debug (Requested by kling on #webkit).
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Merge r152623
</ins><span class="cx"> 
</span><del>-        &quot;Shortcircuit shouldUseCredentialStorage callback&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132308
-        http://trac.webkit.org/changeset/168232
</del><ins>+    2013-07-14  Jon Lee  &lt;jonlee@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-03  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            Origins with invalid ports are not marked as unique (118652)
+            https://bugs.webkit.org/show_bug.cgi?id=118652
+            &lt;rdar://problem/14437753&gt;
</ins><span class="cx"> 
</span><del>-        RenderSVGResourcePattern should deal in RenderElement&amp;.
-        &lt;https://webkit.org/b/132536&gt;
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Tweak buildPattern() and buildTileImageTransform() to take RenderElement&amp;
-        instead of RenderObject* since we know that these functions will always
-        be called with non-null RenderElement subclasses.
</del><ins>+            * page/SecurityOrigin.cpp:
+            (WebCore::SecurityOrigin::create): Return a unique origin if the port is out of range.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/svg/RenderSVGResourceContainer.cpp:
-        (WebCore::RenderSVGResourceContainer::shouldTransformOnTextPainting):
-        * rendering/svg/RenderSVGResourceContainer.h:
-        * rendering/svg/RenderSVGResourceGradient.cpp:
-        (WebCore::RenderSVGResourceGradient::applyResource):
-        * rendering/svg/RenderSVGResourcePattern.cpp:
-        (WebCore::RenderSVGResourcePattern::buildPattern):
-        (WebCore::RenderSVGResourcePattern::applyResource):
-        (WebCore::RenderSVGResourcePattern::buildTileImageTransform):
-        * rendering/svg/RenderSVGResourcePattern.h:
</del><ins>+        Merge r152613
</ins><span class="cx"> 
</span><del>-2014-05-03  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</del><ins>+    2013-07-13  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        CSS JIT: optimize direct / indirect adjacent's traversal backtracking
-        https://bugs.webkit.org/show_bug.cgi?id=132319
</del><ins>+            Unreviewed, rolling out r151978.
+            http://trac.webkit.org/changeset/151978
+            https://bugs.webkit.org/show_bug.cgi?id=118651
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Caused regressions at least 3 websites (Requested by rniwa on
+            #webkit).
</ins><span class="cx"> 
</span><del>-        Since adjacent backtracking stack reference is pre-allocated
-        in prologue in http://trac.webkit.org/changeset/166834,
-        clearing stack phase is not needed. So we can drop
-        JumpToClearAdjacentTail from backtracking action and simplify
-        backtracking handling.
-        And optimize direct / indirect adjacent's traversal backtracking by
-        using appropriate backtracking height.
</del><ins>+            * bindings/js/JSDOMBinding.cpp:
+            * bindings/js/JSDOMBinding.h:
+            * bindings/scripts/CodeGeneratorJS.pm:
+            (GetNativeTypeFromSignature):
+            (JSValueToNative):
+            * bindings/scripts/IDLAttributes.txt:
+            * bindings/scripts/test/JS/JSTestObj.cpp:
+            (WebCore::setJSTestObjReflectedStringAttr):
+            (WebCore::setJSTestObjReflectedURLAttr):
+            (WebCore::setJSTestObjReflectedCustomURLAttr):
+            * dom/Document.idl:
+            * dom/Element.idl:
+            * dom/Node.idl:
</ins><span class="cx"> 
</span><del>-        When solving adjacent traversal backtracking action,
-        1) When there's no descendant relation on the right, traversal
-        failure becomes global failure.
-        2) When `tagNameMatchedBacktrackingStartHeightFromDescendant` ==
-        `heightFromDescendant` + 1, the descendant backtracking starts with
-        the parent of the current element. So we can use the current element
-        and the backtracking action is JumpToDescendantTreeWalkerEntryPoint.
-        3) Otherwise, currently we take the conservative approach,
-        JumpToDescendantTail.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        NOTE:
-        And if `hasDescendantRelationOnTheRight` is true and there's no child
-        fragment on the right, the backtracking element register is not
-        effective. So we should ensure that fragment doesn't use the
-        backtracking element register. Such a fragment fulfills the following
-        conditions. 1. tagNameMatchedBacktrackingStartHeightFromDescendant is
-        always 1 (tagNames.size(), that contains only descendant fragment) 2.
-        heightFromDescendant is always 0 (-- See
-        computeBacktrackingHeightFromDescendant implementation) Therefore such
-        a fragment's action always becomes
-        JumpToDescendantTreeWalkerEntryPoint. So we can ensure that the
-        backtracking element register is not used.
</del><ins>+        Merge r152580
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/backtracking-adjacent.html
</del><ins>+    2013-07-10  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::solveDescendantBacktrackingActionForChild):
-        (WebCore::SelectorCompiler::solveAdjacentTraversalBacktrackingAction):
-        (WebCore::SelectorCompiler::solveBacktrackingAction):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::linkFailures):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAdjacentBacktrackingTail):
-        (WebCore::SelectorCompiler::isAfterChildRelation): Deleted.
</del><ins>+            Plugins that don't support snapshotting should not all autostart.
+            https://bugs.webkit.org/show_bug.cgi?id=118572
+            &lt;rdar://problem/14324391&gt;.
</ins><span class="cx"> 
</span><del>-2014-05-03  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Clear the JSString cache when under memory pressure.
-        &lt;https://webkit.org/b/132539&gt;
</del><ins>+            Test: plugins/snapshotting/quicktime-plugin-snapshotted.html
</ins><span class="cx"> 
</span><del>-        The WeakGCMap used for fast mapping from StringImpl* to JSString*
-        can actually get pretty big, and if we find ourselves under memory
-        pressure, it's entirely inessential.
</del><ins>+            * html/HTMLPlugInImageElement.cpp:
+            (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot): Pass in information about whether or not a snapshot exists
+            to the shadow dom.
+            * plugins/PluginViewBase.h:
+            (WebCore::PluginViewBase::shouldNotAddLayer): This method determines whether or not we should add the plugin's layer to the tree.
+            It should not be added if the plugin is in it's snapshotted state but does not actually support snapshotting.
+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): We should only add the layer to the tree when the plugin
+            is actually playing. Otherwise we run into an issue where the contents of the layer initially appear on the screen briefly 
+            on page load before we display the substitute for a plugin that doesn't support snapshotting.
</ins><span class="cx"> 
</span><del>-        1.1 MB progression on Membuster3.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Merge r152568
</ins><span class="cx"> 
</span><del>-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::releaseMemory):
</del><ins>+    2013-07-11  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-03  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+            Revert r149313: Don't check for @media rules affected by viewport changes in every layout.
+            &lt;rdar://problem/14277905&gt;
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Support disabling speculative tiling
-        https://bugs.webkit.org/show_bug.cgi?id=132512
</del><ins>+            Rubber-stamped by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            This changed caused more harm than good. setFrameRect() is not the only path in FrameView
+            that can cause media queries to need invalidation.
</ins><span class="cx"> 
</span><del>-        Move ScrollView::setScrollVelocity() and ScrollView::computeCoverageRect() to FrameView.
-        When speculative tiling is disabled, return an unmodified exposed rect.
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::setFrameRect):
+            (WebCore::FrameView::layout):
</ins><span class="cx"> 
</span><del>-        Time/velocity adjusments are completely unnecessary at the moment since speculative tiling
-        is enabled as soon as the view scrolls.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::setScrollVelocity):
-        (WebCore::FrameView::computeCoverageRect):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::setScrollVelocity): Deleted.
-        (WebCore::ScrollView::computeCoverageRect): Deleted.
</del><ins>+        Merge r152554
</ins><span class="cx"> 
</span><del>-2014-05-02  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+    2013-07-10  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Shortcircuit shouldUseCredentialStorage callback
-        https://bugs.webkit.org/show_bug.cgi?id=132308
-        &lt;rdar://problem/16806708&gt;
</del><ins>+            Range.getClientRects() not working correctly for partially contained vertically styled text nodes
+            &lt;rdar://problem/14305675&gt;
+            https://bugs.webkit.org/show_bug.cgi?id=118447
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        If we are going to return true from the shouldUseCredentialStorage callback then we don't
-        really need to have CFNetwork/Foundation call us. We can just disable the callback and
-        CFNetwork will assume true. Add a separate subclass that implements this callback when we
-        need to return false. We can also eliminate the corresponding async callbacks. This avoids
-        pingponging between dispatch queue and main thread in the common case.
</del><ins>+            Original patch by Mac Murrett, tweaked by me.
</ins><span class="cx"> 
</span><del>-        No new tests because no change in functionality.
</del><ins>+            Test: fast/dom/Range/getClientRects-vertical.html
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/network/ResourceHandle.cpp:
-        * platform/network/ResourceHandle.h:
-        * platform/network/ResourceHandleClient.cpp:
-        * platform/network/ResourceHandleClient.h:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::createCFURLConnection):
-        (WebCore::ResourceHandle::shouldUseCredentialStorage):
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
-        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::shouldUseCredentialStorage):
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.h:
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::makeDelegate):
-        (WebCore::ResourceHandle::delegate):
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously):
-        (WebCore::ResourceHandle::shouldUseCredentialStorage):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.h:
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleWithCredentialStorageAsOperationQueueDelegate connectionShouldUseCredentialStorage:]):
-        * platform/network/soup/ResourceHandleSoup.cpp:
</del><ins>+            * rendering/RenderText.cpp:
+            (WebCore::localQuadForTextBox):
+            Use the physical accessors rather than the logical ones to get the correct metrics.
</ins><span class="cx"> 
</span><del>-2014-05-03  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Invalidate scrollbars when custom scrollbar style changes dynamically.
-        &lt;https://webkit.org/b/132529&gt;
</del><ins>+        Merge r152547
</ins><span class="cx"> 
</span><del>-        Add a ScrollView::styleDidChange() and call that from RenderView::styleDidChange()
-        so that the scrollbars are sure to get repainted with potentially different style.
</del><ins>+    2013-07-10  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            [Mac] every enabled text track should be listed in the track menu
+            https://bugs.webkit.org/show_bug.cgi?id=118477
</ins><span class="cx"> 
</span><del>-        Test: fast/css/scrollbar-dynamic-style-change.html
</del><ins>+            Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::styleDidChange):
-        * platform/ScrollView.h:
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::styleDidChange):
</del><ins>+            Test: media/video-controls-captions-trackmenu-includes-enabled-track.html
</ins><span class="cx"> 
</span><del>-2014-05-03  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * html/shadow/MediaControlElements.cpp:
+            (WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay): Don't select the
+                &quot;Off&quot; menu item if a track is enabled.
</ins><span class="cx"> 
</span><del>-        Very fuzzy layers under non-decompasable matrices
-        https://bugs.webkit.org/show_bug.cgi?id=132516
-        &lt;rdar://problem/16717478&gt;
</del><ins>+            * page/CaptionUserPreferencesMediaAF.cpp:
+            (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu): Always include a track
+                that is showing in the menu. Add more diagnostic logging.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
-        
-        r155977 added code to modify layer contentsScale based on a root-relative
-        scale, so that scaled-up layers remained sharp. It does this by decomposing
-        an accumulated matrix, but failed to test whether the decomposition
-        succeeded. This would result in contentsScale of 0, which is clamped to 0.1,
-        resulting in very fuzzy layers.
-        
-        Fix by testing for success of decomposition.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: compositing/contents-scale/non-decomposable-matrix.html
</del><ins>+        Merge r152532
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::maxScaleFromTransform):
-        * platform/graphics/transforms/TransformationMatrix.cpp:
-        (WebCore::TransformationMatrix::decompose2): Return early for identity matrices,
-        with fix for m11 and m22.
-        (WebCore::TransformationMatrix::decompose4): Return early for identity matrices.
-        * platform/graphics/transforms/TransformationMatrix.h:
-        Make Decomposed2Type and Decomposed4Type into C++ structs.
-        (WebCore::TransformationMatrix::Decomposed2Type::operator==): Added to make it easier
-        to write code that asserts that decomposition is correct.
-        (WebCore::TransformationMatrix::Decomposed4Type::operator==): Ditto.
</del><ins>+    2013-07-10  James Craig  &lt;james@cookiecrook.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-03  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            AX: AccessibilityNodeObject::supportsRequiredAttribute() should switch on CellRole
+            https://bugs.webkit.org/show_bug.cgi?id=117817
</ins><span class="cx"> 
</span><del>-        Fix crash in WebKit client app when zooming
-        https://bugs.webkit.org/show_bug.cgi?id=132475
-        &lt;rdar://problem/16703405&gt;
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            CellRole supports the required attribute now for accessibility, according to ARIA spec. 
+            Updated existing test coverage.
</ins><span class="cx"> 
</span><del>-        It's possible for a WebTiledBackingLayer CALayer to remain in the CALayer
-        hierarchy after we've called -invalidate on it, which clears the _tileController.
-        Project the getters against null derefs to handle this.
</del><ins>+            * accessibility/AccessibilityNodeObject.cpp:
+            (WebCore::AccessibilityNodeObject::supportsRequiredAttribute):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/WebTiledBackingLayer.mm:
-        (-[WebTiledBackingLayer isOpaque]):
-        (-[WebTiledBackingLayer acceleratesDrawing]):
-        (-[WebTiledBackingLayer contentsScale]):
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-03  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+        Merge r152522
</ins><span class="cx"> 
</span><del>-        Unreviewed. Fix GTK+ build after r168209.
</del><ins>+    2013-07-09  James Craig  &lt;james@cookiecrook.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/leveldb/LevelDBDatabase.cpp:
-        (WebCore::LevelDBDatabase::write):
</del><ins>+            @readonly and @aria-readonly=&quot;false&quot; are not exposed correctly to accessibility
+            https://bugs.webkit.org/show_bug.cgi?id=118475
</ins><span class="cx"> 
</span><del>-2014-05-03  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Fieldset legend has a horizontal line through, when the fieldset is painted on odd device pixel position.
-        https://bugs.webkit.org/show_bug.cgi?id=132521
-        &lt;rdar://problem/16803305&gt;
</del><ins>+            Account for implicit and explicit @readonly/@aria-readonly mismatches. Updated existing test coverage.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            * accessibility/AccessibilityRenderObject.cpp:
+            (WebCore::AccessibilityRenderObject::canSetValueAttribute):
</ins><span class="cx"> 
</span><del>-        Use device pixel snapping when the fieldset's border gets clipped out for the legend's text. It ensures that
-        the device pixel snapped border gets properly clipped out.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Existing fieldset tests cover it.
</del><ins>+        Merge r152520
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations):
</del><ins>+    2013-07-09  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-02  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        CodeCleanup: Remove *MaintainsPixelAlignment from GraphicsLayer*.
-        https://bugs.webkit.org/show_bug.cgi?id=132501
</del><ins>+            Remember the scroll position and restore after exiting full-screen mode.
+            https://bugs.webkit.org/show_bug.cgi?id=61956
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            No new tests, adds a client callback used by WebKit and WebKit2 win.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setMaintainsPixelAlignment): Deleted.
-        (WebCore::GraphicsLayer::maintainsPixelAlignment): Deleted.
-        (WebCore::GraphicsLayer::pixelAlignmentOffset): Deleted.
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateGeometry):
-        (WebCore::GraphicsLayerCA::computePixelAlignment):
-        (WebCore::GraphicsLayerCA::setMaintainsPixelAlignment): Deleted.
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createGraphicsLayer):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::keepLayersPixelAligned): Deleted.
-        * rendering/RenderLayerCompositor.h:
</del><ins>+            * platform/graphics/win/FullScreenController.cpp:
+            (FullScreenController::enterFullScreen):
+            (FullScreenController::exitFullScreen):
+            * platform/graphics/win/FullScreenControllerClient.h:
</ins><span class="cx"> 
</span><del>-2014-05-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Tiled layer content missing on pages with animated tiled layers
-        https://bugs.webkit.org/show_bug.cgi?id=132507
-        &lt;rdar://problem/16765740&gt;
</del><ins>+        Merge r152459
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+    2013-07-08  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Updating the tiling area of content TileControllers while
-        CSS animations are running depends on GraphicsLayerUpdater
-        triggering repeated layer flushes. With UI-side compositing, those
-        flushes were happening, but nothing triggered RemoteLayerTreeDrawingArea
-        to flush changes to the UI process.
-        
-        Fix by having RenderLayerCompositor schedule a flush, rather
-        than just doing a flush, in response to GraphicsLayerUpdater.
-        
-        Also change the name of the GraphicsLayerUpdaterClient function
-        to indicate that it suggests that a flush is required soon, rather than
-        that the flushing has to be synchronous.
</del><ins>+            Fix TextTrackCue::cueIndex() to handle the null case of TextTrack::cues(() properly
+            https://bugs.webkit.org/show_bug.cgi?id=117815
+            &lt;rdar://problem/14211041&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayerUpdater.cpp:
-        (WebCore::GraphicsLayerUpdater::displayRefreshFired):
-        * platform/graphics/GraphicsLayerUpdater.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::flushLayersSoon):
-        (WebCore::RenderLayerCompositor::flushLayers): Deleted.
-        * rendering/RenderLayerCompositor.h:
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-02  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            Merge https://src.chromium.org/viewvc/blink?revision=153206&amp;view=revision
</ins><span class="cx"> 
</span><del>-        Use displayNameForTrack instead of textTrack-&gt;label() for captions.
-        https://bugs.webkit.org/show_bug.cgi?id=131311
</del><ins>+            No new tests, only behavior change is preventing a crash in the release build.
+            cueIndex() is only used for sorting cues, so returning an invalidCueIndex in the case
+            where track()-&gt;cues() is null makes sense and won't modify behavior.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * html/track/TextTrackCue.cpp:
+            (WebCore::TextTrackCue::cueIndex):
</ins><span class="cx"> 
</span><del>-        Use the same mechanism as the desktop to build the captions list so it has the correct
-        names in the correct order including none and automatic.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.h:
-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::setMediaElement):
-        move legible track code into updateLegibleOptions()
</del><ins>+        Merge r152388
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::handleEvent):
-        updateLegibleOptions on addTrack and removeTrack
</del><ins>+    2013-07-03  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::selectLegibleMediaOption):
-        select the corresponding TextTrack on HTMLMediaElement.
</del><ins>+            AX: Items the img aria role aren't inserting an object replacement character
+            https://bugs.webkit.org/show_bug.cgi?id=118259
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::updateLegibleOptions):
-        use the same mechanism as desktop to build the captions menu.
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2014-05-02  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            VoiceOver relies on object replacement characters being emitted when asking for selected text.
+            This has worked if a real &lt;img&gt; is used, but if role=&quot;img&quot; is used on a &lt;div&gt;, for example,
+            no emission is performed, which leads to missed elements in text.
</ins><span class="cx"> 
</span><del>-        CSS-based Media Controls Show Different times content longer than 1 hour.
-        https://bugs.webkit.org/show_bug.cgi?id=132443
</del><ins>+            Test: platform/mac/accessibility/aria-image-emits-object-replacement.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            * editing/TextIterator.cpp:
+            (WebCore::isRendererReplacedElement):
+            (WebCore::TextIterator::advance):
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.css:
-        (audio::-webkit-media-controls-timeline-container .hour-long-time):
-        This class has a wider width for longer duration times.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller.prototype.updateDuration):
-        Apply .hour-long-time class as appropriate.
</del><ins>+        Merge r152345
</ins><span class="cx"> 
</span><del>-        (Controller.prototype.formatTime):
-        More robust formatting to handle hours.
</del><ins>+    2013-07-03  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsiOS.css:
-        (audio::-webkit-media-controls-timeline-container .hour-long-time):
-        This class has a wider width for longer duration times.
</del><ins>+            [CSS Regions] Improve implementation of elements in region being flowed to another flow thread
+            https://bugs.webkit.org/show_bug.cgi?id=118300
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.formatTime):
-        More robust formatting to handle hours.
</del><ins>+            Based on patch by Zoltán Árvai &lt;zarvai@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-2014-05-02  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Reviewed by Csaba Osztrogonác.
</ins><span class="cx"> 
</span><del>-        [MSE][Mac] AVAssetTrack returns incorrect track size
-        https://bugs.webkit.org/show_bug.cgi?id=132469
</del><ins>+            Fixed CSS_REGIONS guard.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            * dom/Element.h:
+            * dom/NodeRenderingContext.cpp:
+            (WebCore::NodeRenderingContext::elementInsideRegionNeedsRenderer):
+            (WebCore::NodeRenderingContext::moveToFlowThreadIfNeeded):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        (WebCore::SourceBufferPrivateAVFObjC::didParseStreamDataAsAsset):  Remove the sizeChanged() notification.
-        (WebCore::SourceBufferPrivateAVFObjC::processCodedFrame): Cache the last parsed video frame size.
-        (WebCore::SourceBufferPrivateAVFObjC::naturalSize): Return the cached value.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-02  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Merge r152330
</ins><span class="cx"> 
</span><del>-        Subpixel rendering[iOS]: Use pixelSnappedRoundedRectForPainting() to clip text area rect.
-        https://bugs.webkit.org/show_bug.cgi?id=132499
-        &lt;rdar://problem/16631050&gt;
</del><ins>+    2013-07-02  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Change event should not be dispatched by clicking a scrollbar of select listbox
+            https://bugs.webkit.org/show_bug.cgi?id=118019
+            &lt;rdar://problem/14297760&gt;
</ins><span class="cx"> 
</span><del>-        Snap to device pixels properly instead of relying on float arithmetics while converting from RoundedRect
-        to FloatRoundedRect. This is the second, cleanup part of the text-area decoration is off-by-one painting issue.
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Currently not testable.
</del><ins>+            Test: fast/forms/select/listbox-click-on-scrollbar.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::paintTextFieldDecorations):
</del><ins>+            Merge the following:
+            http://src.chromium.org/viewvc/blink?view=revision&amp;revision=151689
+            https://chromium.googlesource.com/chromium/blink/+/492549b0fcaa58a85aa0797446b62985a263704f
</ins><span class="cx"> 
</span><del>-2014-05-02  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            Previously, a select element with the multiple attribute would dispatch
+            an onChanged event when the scrollbar is clicked. This patch corrects this
+            issue by only calling listBoxOnChange(), which fires the onChanged event, 
+            when an actual option is clicked.
</ins><span class="cx"> 
</span><del>-        Remove HistogramSupport.
-        &lt;https://webkit.org/b/132354&gt;
</del><ins>+            * html/HTMLSelectElement.cpp:
+            (WebCore::HTMLSelectElement::childrenChanged): Updated to clear the list
+            of selected items when when an &lt;option&gt; element is added to/deleted from its &lt;select&gt; element.
+            (Without this addition, if a option was selected, and then JavaScript was used to modify 
+            the &lt;select&gt; element, and then the scrollbar was clicked, an onChanged event would fire 
+            because it remembers the previously selected option.)
</ins><span class="cx"> 
</span><del>-        Prune some leftover Chromium gunk that no other ports ever used.
</del><ins>+            (WebCore::HTMLSelectElement::listBoxOnChange):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): Updated to
+            only call listBoxOnChange() if at least one option is selected. 
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * Modules/indexeddb/IDBDatabase.cpp:
-        (WebCore::IDBDatabase::createObjectStore):
-        (WebCore::IDBDatabase::deleteObjectStore):
-        (WebCore::IDBDatabase::transaction):
-        * Modules/indexeddb/IDBFactory.cpp:
-        (WebCore::IDBFactory::openInternal):
-        (WebCore::IDBFactory::deleteDatabase):
-        * Modules/indexeddb/IDBHistograms.h: Removed.
-        * Modules/indexeddb/leveldb/IDBBackingStoreLevelDB.cpp:
-        (WebCore::IDBBackingStoreLevelDB::open):
-        (WebCore::IDBBackingStoreLevelDB::openInMemory):
-        (WebCore::recordInternalError): Deleted.
-        * Modules/indexeddb/leveldb/IDBBackingStoreTransactionLevelDB.cpp:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSParser.cpp:
-        (WebCore::cssPropertyID):
-        * dom/Document.cpp:
-        (WebCore::Document::~Document):
-        (WebCore::histogramMutationEventUsage): Deleted.
-        * dom/ShadowRoot.cpp:
-        * fileapi/Blob.cpp:
-        * fileapi/WebKitBlobBuilder.cpp:
-        (WebCore::BlobBuilder::append):
-        * history/PageCache.cpp:
-        (WebCore::logCanCacheFrameDecision):
-        (WebCore::logCanCachePageDecision):
-        * platform/HistogramSupport.cpp: Removed.
-        * platform/HistogramSupport.h: Removed.
-        * platform/leveldb/LevelDBDatabase.cpp:
-        (WebCore::LevelDBDatabase::open):
-        (WebCore::histogramLevelDBError): Deleted.
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateNeedsCompositedScrolling):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::send):
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-02  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        Merge r152320
</ins><span class="cx"> 
</span><del>-        Stop flipping the ImageControlsButton
-        &lt;rdar://problem/16773238&gt; and https://bugs.webkit.org/show_bug.cgi?id=132502
</del><ins>+    2013-07-02  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            [CSS Regions] Improve implementation of elements in region being flowed to another flow thread
+            https://bugs.webkit.org/show_bug.cgi?id=118300
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintImageControlsButton):
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-2014-05-02  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            Methods that must be const have been turned back into const. Code has been better organized. 
+            Performance is better. Tests have been added to.
</ins><span class="cx"> 
</span><del>-        Fullscreen UI does not appear after WebProcess has crashed
-        https://bugs.webkit.org/show_bug.cgi?id=132442
</del><ins>+            * dom/Element.cpp:
+            (WebCore::Element::detach):
+            (WebCore::Element::setIsInsideRegion):
+            (WebCore::Element::isInsideRegion):
+            (WebCore::Element::shouldMoveToFlowThread):
+            * dom/Element.h:
+            * dom/ElementRareData.h:
+            (WebCore::ElementRareData::isInsideRegion):
+            (WebCore::ElementRareData::setIsInsideRegion):
+            (WebCore::ElementRareData::ElementRareData):
+            * dom/Node.cpp:
+            (WebCore::Node::isRegisteredWithNamedFlow):
+            * dom/Node.h:
+            * dom/NodeRenderingContext.cpp:
+            (WebCore::NodeRenderingContext::parentRenderer):
+            (WebCore::NodeRenderingContext::shouldCreateRenderer):
+            (WebCore::NodeRenderingContext::elementInsideRegionNeedsRenderer):
+            (WebCore::NodeRenderingContext::moveToFlowThreadIfNeeded):
+            (WebCore::NodeRenderingContext::createRendererForElementIfNeeded):
+            * dom/NodeRenderingContext.h:
+            * dom/PseudoElement.h:
+            * dom/Text.cpp:
+            (WebCore::Text::textRendererIsNeeded):
+            * dom/Text.h:
+            * rendering/FlowThreadController.cpp:
+            (WebCore::FlowThreadController::unregisterNamedFlowContentNode):
+            (WebCore::FlowThreadController::isContentNodeRegisteredWithAnyNamedFlow):
+            * rendering/FlowThreadController.h:
+            * rendering/RenderObject.h:
+            * rendering/RenderRegion.h:
+            * svg/SVGElement.cpp:
+            (WebCore::SVGElement::shouldMoveToFlowThread):
+            * svg/SVGElement.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-07-15  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Clean up immediately when there is a WebProcess crash.
</del><ins>+        Merge r151845
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (WebVideoFullscreenInterfaceAVKit::invalidate):
-        Clean-up resources immediately.
</del><ins>+    2013-06-21  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-02  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            Fix TextTrackCue::cueIndex() to handle the null case of TextTrack::cues(() properly
+            https://bugs.webkit.org/show_bug.cgi?id=117815
+            &lt;rdar://problem/14211041&gt; 
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168192.
-        https://bugs.webkit.org/show_bug.cgi?id=132498
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Was not the correct fix (blurry!) (Requested by bfulgham_ on
-        #webkit).
</del><ins>+            This patch adds assert statements to try to catch when 
+            track()-&gt;cues() returns a null pointer.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+            * html/track/TextTrackCue.cpp:
+            (WebCore::TextTrackCue::cueIndex):
</ins><span class="cx"> 
</span><del>-        &quot;[iOS] deviceScaleFactor is being double-applied when
-        rendering captions in full screen mode&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132481
-        http://trac.webkit.org/changeset/168192
</del><ins>+2013-07-12  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-02  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Merge r152571
</ins><span class="cx"> 
</span><del>-        Remove Blob contentDisposition handling
-        https://bugs.webkit.org/show_bug.cgi?id=132490
</del><ins>+    2013-07-11  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            Revert r152267 and soft link WebInspectorUI.framework again.
</ins><span class="cx"> 
</span><del>-        Dead code.
</del><ins>+            https://bugs.webkit.org/show_bug.cgi?id=118544
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobData.h:
-        (WebCore::BlobData::contentDisposition): Deleted.
-        (WebCore::BlobData::setContentDisposition): Deleted.
-        * platform/network/BlobRegistryImpl.cpp:
-        (WebCore::BlobRegistryImpl::registerBlobURL):
-        (WebCore::BlobRegistryImpl::registerBlobURLForSlice):
-        * platform/network/BlobResourceHandle.cpp:
-        (WebCore::BlobResourceHandle::notifyResponseOnSuccess):
-        * platform/network/BlobStorageData.h:
-        (WebCore::BlobStorageData::create):
-        (WebCore::BlobStorageData::contentType):
-        (WebCore::BlobStorageData::BlobStorageData):
-        (WebCore::BlobStorageData::contentDisposition): Deleted.
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-2014-05-02  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+            * platform/mac/SoftLinking.h: Rename SOFT_LINK_STAGED_FRAMEWORK_OPTIONAL
+            to SOFT_LINK_STAGED_FRAMEWORK and ASSERT since we don't want to silently
+            fail anymore when using this macro.
</ins><span class="cx"> 
</span><del>-        Implement FormData decoding using KeyedDecoder
-        https://bugs.webkit.org/show_bug.cgi?id=132494
</del><ins>+2013-07-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Rollout r152556.  &lt;rdar://problem/14305675&gt;
</ins><span class="cx"> 
</span><del>-        * platform/KeyedCoding.h:
-        (WebCore::KeyedDecoder::decodeEnum):
-        * platform/network/FormData.cpp:
-        (WebCore::decodeElement):
-        (WebCore::FormData::decode):
-        * platform/network/FormData.h:
</del><ins>+2013-07-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-02  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Merge r152554
</ins><span class="cx"> 
</span><del>-        [iOS] deviceScaleFactor is being double-applied when rendering captions in full screen mode
-        https://bugs.webkit.org/show_bug.cgi?id=132481
</del><ins>+    2013-07-10  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            Range.getClientRects() not working correctly for partially contained vertically styled text nodes
+            &lt;rdar://problem/14305675&gt;
+            https://bugs.webkit.org/show_bug.cgi?id=118447
</ins><span class="cx"> 
</span><del>-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Don't set the platform scale factor here. It is already
-        being accounted for in the createTextTrackRepresentationImage method.
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-2014-05-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Original patch by Mac Murrett, tweaked by me.
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Don't create backing store for -webkit-overflow-scrolling:touch that can't scroll
-        https://bugs.webkit.org/show_bug.cgi?id=132487
-        &lt;rdar://problem/16758041&gt;
</del><ins>+            Test: fast/dom/Range/getClientRects-vertical.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            * rendering/RenderText.cpp:
+            (WebCore::localQuadForTextBox):
+            Use the physical accessors rather than the logical ones to get the correct metrics.
</ins><span class="cx"> 
</span><del>-        Previously, -webkit-overflow-scrolling:touch would cause us to make compositing
-        layers for any element that had overflow: auto or scroll on either axis. This
-        created lots of backing store when not required.
-        
-        Improve this to only create compositing for scrolling when there is actually
-        scrollable overflow. This makes things slightly more complex, because we can
-        only know when layout is up to date.
</del><ins>+2013-07-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeRectForRepaint): usesCompositedScrolling() tells
-        us if we're actually doing composited overflow.
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasTouchScrollableOverflow):
-        (WebCore::RenderLayer::handleTouchEvent):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::layerOrAncestorIsTransformedOrUsingCompositedScrolling):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Only update
-        scrolling and clipping layers if layout is not pending.
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateScrollingLayers): The caller calls
-        updateInternalHierarchy(), so no need to do it here.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingForScrolling): We
-        can only determine that we're scrollable after layout.
-        (WebCore::isStickyInAcceleratedScrollingLayerOrViewport):
-        (WebCore::isMainFrameScrollingOrOverflowScrolling):
</del><ins>+        Merge r152548
</ins><span class="cx"> 
</span><del>-2014-05-02  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+    2013-07-10  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Clean up FormDataElement
-        https://bugs.webkit.org/show_bug.cgi?id=132483
</del><ins>+            Deferring layer flushes can cause painting without layout being done
+            https://bugs.webkit.org/show_bug.cgi?id=118493
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        * platform/network/FormData.cpp:
-        (WebCore::FormData::FormData):
-        (WebCore::FormData::deepCopy):
-        (WebCore::FormData::expandDataStore):
-        (WebCore::FormData::flatten):
-        (WebCore::FormData::resolveBlobReferences):
-        (WebCore::FormData::generateFiles):
-        (WebCore::FormData::hasGeneratedFiles):
-        (WebCore::FormData::hasOwnedGeneratedFiles):
-        (WebCore::FormData::removeGeneratedFilesIfNeeded):
-        (WebCore::encodeElement):
-        (WebCore::decodeElement):
-        * platform/network/FormData.h:
-        (WebCore::FormDataElement::FormDataElement):
-        (WebCore::operator==):
-        * platform/network/cf/FormDataStreamCFNet.cpp:
-        (WebCore::advanceCurrentStream):
-        (WebCore::setHTTPBody):
-        * platform/network/curl/FormDataStreamCurl.cpp:
-        (WebCore::FormDataStream::read):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::setupFormData):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::addFormElementsToSoupMessage):
</del><ins>+            r147797 added a mechanism for the TileController to inform RenderLayerCompositor
+            that it had performed an action (setNeedsDisplay, etc.) that would cause CoreAnimation
+            to call back into us to paint in this runloop, and that it shouldn't throttle the next
+            layer flush.
</ins><span class="cx"> 
</span><del>-2014-05-02  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            However, if tiles were created and left unparented (because the TileController was
+            out-of-window), when they are later parented, we failed to inform RenderLayerCompositor
+            that they were about to call back for painting, and so it would happily throttle the
+            next layer flush, and layout would be out of date, and garbage and corruption could result.
</ins><span class="cx"> 
</span><del>-        [iOS] Wireless playback button not blue when active
-        https://bugs.webkit.org/show_bug.cgi?id=132473
</del><ins>+            To resolve this, rework the logic surrounding parenting existing-but-unparented tiles
+            to ensure that they get added to the TileController's dirtyRect.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            No new tests; the bug only reproduces under specific timing circumstances, and
+            manifests itself as an assertion failure or garbage on the screen, so it's quite
+            hard to make a workable test.
</ins><span class="cx"> 
</span><del>-        The playback button's class was being set to 'undefined', due to Controller.ClassNames.active being undefined.
</del><ins>+            * platform/graphics/ca/mac/TileController.mm:
+            (WebCore::TileController::revalidateTiles):
+            - Factor out the code to parent unparented tiles so that it is shared between the
+                created-new-tile and reparenting-existing-tile cases.
+            - Keep track of whether we updated the frame of a pre-existing tile.
+            - If the tile is dirty and needed to be parented (because either it's new
+                or hadn't been parented before), add it to the dirty rect list.
+            - If the tile changed size, add it to the dirty rect list.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.js:
</del><ins>+            (WebCore::TileController::ensureTilesForRect):
+            Ditto everything from revalidateTiles.
</ins><span class="cx"> 
</span><del>-2014-05-02  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            (WebCore::TileController::createTileLayer):
+            - Explicitly mark fresh tiles as needing display, so that we can depend on
+                [WebTileLayer needsDisplay] in revalidateTiles to tell us that it's dirty.
</ins><span class="cx"> 
</span><del>-        Don't abuse Blob deserialization constructor in WebSocket
-        https://bugs.webkit.org/show_bug.cgi?id=132478
</del><ins>+2013-07-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Merge r152541
</ins><span class="cx"> 
</span><del>-        * Modules/websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::send):
-        (WebCore::WebSocketChannel::enqueueBlobFrame): This is the important change -
-        Blob::create was called for no reason. If the blob came from a worker, it was
-        already cloned for cross-thread messaging, otherwise there is no reason to make
-        a new one.
</del><ins>+    2013-07-09  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/Blob.h:
-        (WebCore::Blob::deserialize):
-        (WebCore::Blob::create): Deleted.
-        * fileapi/File.h:
-        (WebCore::File::deserialize):
-        (WebCore::File::create): Deleted.
-        Renamed a special case of &quot;create&quot; function to avoid explaining what it is for.
</del><ins>+            HTMLPluginElement's state should be Playing before firing mouse click event.
+            https://bugs.webkit.org/show_bug.cgi?id=118398.
+            &lt;rdar://problem/14262126&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/websockets/ThreadableWebSocketChannel.h:
-        * Modules/websockets/WebSocket.cpp:
-        (WebCore::WebSocket::send):
-        * Modules/websockets/WebSocketChannel.h:
-        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
-        (WebCore::WorkerThreadableWebSocketChannel::send): Print a full URL in LOG(),
-        not one shortened to 1024 characters.
-        (WebCore::WorkerThreadableWebSocketChannel::Peer::send):
-        (WebCore::WorkerThreadableWebSocketChannel::mainThreadSendBlob):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
-        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::CloneDeserializer::readFile):
-        (WebCore::CloneDeserializer::readTerminal):
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-05-02  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+            Test: plugins/snapshotting/plugin-receives-click-event.html
</ins><span class="cx"> 
</span><del>-        Add and implement KeyedDecoder::decodeBytes
-        https://bugs.webkit.org/show_bug.cgi?id=132479
</del><ins>+            * html/HTMLPlugInImageElement.cpp:
+            (WebCore::HTMLPlugInImageElement::simulatedMouseClickTimerFired):
+            The defaultEventHandler returns early if the state is not Playing.
+            This is because we only want the plugin to deal with user interaction normally if the
+            plugin is actually enabled (not being snapshotted).
+            When we click on the snapshotted plugin to start it, we mimic what would happen to the plugin
+            normally by dispatching another click event on top of where we just clicked.
+            However, we were sending the click event before setting the state to Playing which meant that our
+            simulated click was not being handled. 
+            We should be setting this state before sending the click, not after.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+2013-07-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/KeyedCoding.h:
-        (WebCore::KeyedDecoder::decodeBytes):
</del><ins>+        Merge r152426
</ins><span class="cx"> 
</span><del>-2014-05-02  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+    2013-07-05  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS] WebKit2 File Upload Support
-        https://bugs.webkit.org/show_bug.cgi?id=132024
</del><ins>+            [Windows] Identify OS-level at build-time.
+            https://bugs.webkit.org/show_bug.cgi?id=118428
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * English.lproj/Localizable.strings:
-        New localized strings for &lt;input type=&quot;file&quot;&gt; on iOS.
</del><ins>+            * DerivedSources.make: Activate legible output features if present.
+            * WebCorePrefix.h: Activate MSVC 2010 workarounds for CGFloat if
+            building with VS2010.
+            * config.h: Activate legible output features if present.
</ins><span class="cx"> 
</span><del>-2014-05-02  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        AX: WK2: iOS web page scrolling doesn't work with VoiceOver
-        https://bugs.webkit.org/show_bug.cgi?id=132028
</del><ins>+        Merge r152514
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+    2013-07-09  Jeff Miller  &lt;jeffm@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        With the AX tree residing in the WebProcess, scrolling needs to be implemented in
-        WebCore using accessibilityScroll: in order for accessibility clients to scroll through the AX API.
</del><ins>+            AuthenticationMac.mm does not handle NSURLAuthenticationMethodNegotiate in WebCore::mac()
+            https://bugs.webkit.org/show_bug.cgi?id=118518
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::scrollViewAncestor):
-        (WebCore::AccessibilityObject::scrollToMakeVisibleWithSubFocus):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.h:
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper _accessibilityConvertPointToViewSpace:]):
-        (-[WebAccessibilityObjectWrapper _accessibilityScrollToVisible]):
-        (-[WebAccessibilityObjectWrapper accessibilityScroll:]):
-        (-[WebAccessibilityObjectWrapper postScrollStatusChangeNotification]):
-        (-[WebAccessibilityObjectWrapper _accessibilityScrollPosition]):
-        (-[WebAccessibilityObjectWrapper _accessibilityScrollSize]):
-        (-[WebAccessibilityObjectWrapper _accessibilityScrollVisibleRect]):
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-2014-05-02  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            * platform/network/mac/AuthenticationMac.mm:
+            (WebCore::mac):
+            Map ProtectionSpaceAuthenticationSchemeNegotiate to NSURLAuthenticationMethodNegotiate.
</ins><span class="cx"> 
</span><del>-        Pause playback on exit fullscreen when inline playback not allowed.
-        https://bugs.webkit.org/show_bug.cgi?id=132450
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Merge r152513
</ins><span class="cx"> 
</span><del>-        Use correct method of determining if inline playback is allowed.
</del><ins>+    2013-07-09  Jeff Miller  &lt;jeffm@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        Use m_mediaSession-&gt;requiresFullscreenForVideoPlayback to detect if inline playback is allowed.
</del><ins>+            AuthenticationMac.mm does not handle NSURLAuthenticationMethodNegotiate
+            https://bugs.webkit.org/show_bug.cgi?id=118517
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::requestExitFullscreen):
-        Prevent duplicate exit requests.
</del><ins>+            Reviewed by Brady Eidson.
</ins><span class="cx"> 
</span><del>-2014-05-02  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+            * platform/network/mac/AuthenticationMac.mm:
+            (WebCore::core):
+            Map &quot;NSURLAuthenticationMethodNegotiate&quot; to ProtectionSpaceAuthenticationSchemeNegotiate.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Remove support for non-separable blend modes from background-blend-mode
-        https://bugs.webkit.org/show_bug.cgi?id=132327
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Merge r152494
</ins><span class="cx"> 
</span><del>-        Removed support for non-separable background blend modes from the CSS parser.
-        Covered by existing tests.
</del><ins>+    2013-07-09  Mark Lam  &lt;mark.lam@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillProperty):
</del><ins>+            Fix 30% JSBench regression (caused by adding column numbers to stack traces).
+            https://bugs.webkit.org/show_bug.cgi?id=118481.
</ins><span class="cx"> 
</span><del>-2014-05-02  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+            Reviewed by Mark Hahnenberg and Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Clean up #include &lt;OwnPtr.h&gt;|&lt;PassOwnPtr.h&gt; in Supplementable classes
-        https://bugs.webkit.org/show_bug.cgi?id=132466
</del><ins>+            Test: fast/js/line-column-numbers.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Updated the bindings to use StackFrame::computeLineAndColumn(). The old
+            StackFrame::line() and StackFrame::column() has been removed. The new
+            algorithm always computes the 2 values together anyway. Hence it is more
+            efficient to return them as a pair instead of doing the same computation
+            twice for each half of the result.
</ins><span class="cx"> 
</span><del>-        Since r168144, Supplementable classes don't need to include OwnPtr.h or PassOwnPtr.h.
-        Clean up those inclusions.
</del><ins>+            * bindings/js/ScriptCallStackFactory.cpp:
+            (WebCore::createScriptCallStack):
+            (WebCore::createScriptCallStackFromException):
+            * bindings/js/ScriptSourceCode.h:
+            (WebCore::ScriptSourceCode::ScriptSourceCode):
</ins><span class="cx"> 
</span><del>-        No new tests, just clean up patch.
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/encryptedmedia/CDMPrivate.h:
-        * Modules/gamepad/NavigatorGamepad.cpp:
-        * Modules/geolocation/GeolocationController.cpp:
-        (WebCore::GeolocationController::create): Deleted. Don't need to have a factory function.
-        * Modules/geolocation/GeolocationController.h:
-        * Modules/mediasource/MediaSource.h:
-        * Modules/mediastream/UserMediaController.h:
-        * Modules/notifications/NotificationCenter.h:
-        * Modules/notifications/NotificationController.cpp:
-        * Modules/quota/StorageErrorCallback.h:
-        * Modules/vibration/Vibration.h:
-        * Modules/webdatabase/Database.cpp:
-        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
-        * Modules/websockets/WebSocket.cpp:
-        * Modules/websockets/WebSocket.h:
</del><ins>+        Merge r152453
</ins><span class="cx"> 
</span><del>-2014-05-01  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+    2013-07-08  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove TiledBackingStore stuff from Frame
-        https://bugs.webkit.org/show_bug.cgi?id=132458
</del><ins>+            REGRESSION(r125294): A style rule with more than 8192 selectors can cause style corruption.
+            &lt;http://webkit.org/b/118369&gt;
+            &lt;rdar://problem/14291428&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Although TiledBackingStore is using for the CoordinatedGraphics,
-        CoordinatedGraphics does not use tiledBackingStore of Frame.
</del><ins>+            Add a semi-hard cap of 8192 selectors per CSS rule. Rules with longer selector lists will be split into
+            multiple rules (with 8192 selectors per rule.) The style properties are shared behind the scenes
+            so it's all pretty efficient.
</ins><span class="cx"> 
</span><del>-        This patch removed TiledBackingStore related code of the Frame.
</del><ins>+            This does generate a different CSSOM for gigantic selector lists, I've added a test to document this.
+            Note that setting CSSStyleRule.selectorText with over 8192 selectors will now fail, the splitting into
+            multiple rules only happens when parsing full style sheets.
</ins><span class="cx"> 
</span><del>-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::Frame::setView):
-        (WebCore::Frame::setTiledBackingStoreEnabled): Deleted.
-        (WebCore::Frame::tiledBackingStorePaintBegin): Deleted.
-        (WebCore::Frame::tiledBackingStorePaint): Deleted.
-        (WebCore::Frame::tiledBackingStorePaintEnd): Deleted.
-        (WebCore::Frame::tiledBackingStoreContentsRect): Deleted.
-        (WebCore::Frame::tiledBackingStoreVisibleRect): Deleted.
-        (WebCore::Frame::tiledBackingStoreBackgroundColor): Deleted.
-        * page/Frame.h:
-        (WebCore::Frame::tiledBackingStore): Deleted.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::repaintContentRectangle):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setTiledBackingStoreEnabled): Deleted.
-        * page/Settings.h:
-        (WebCore::Settings::tiledBackingStoreEnabled): Deleted.
</del><ins>+            Test: fast/css/rule-selector-overflow.html
</ins><span class="cx"> 
</span><del>-2014-05-01  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+            * css/CSSSelectorList.cpp:
+            (WebCore::CSSSelectorList::selectorCount):
</ins><span class="cx"> 
</span><del>-        Migrate all uses of DeviceMotionController and DeviceOrientationController to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=132461
</del><ins>+                Add a helper to count the number of selectors in a list (not the number of raw selector components.)
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix.
</del><ins>+            * css/RuleSet.h:
+            * css/CSSStyleRule.cpp:
+            (WebCore::CSSStyleRule::setSelectorText):
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+                Add RuleData::maximumSelectorCount constant and cap CSSStyleRule.selectorText to that many selectors.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        * dom/Document.h:
-        * platform/ios/DeviceMotionClientIOS.h:
-        (WebCore::DeviceMotionClientIOS::create): Deleted.
-        * platform/ios/DeviceOrientationClientIOS.h:
-        (WebCore::DeviceOrientationClientIOS::create): Deleted.
</del><ins>+            * css/CSSSelectorList.h:
+            (WebCore::CSSSelectorList::adoptSelectorArray):
+            * css/StyleRule.cpp:
+            (WebCore::StyleRule::create):
+            (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorCount):
+            * css/StyleRule.h:
+            (WebCore::StyleRule::parserAdoptSelectorArray):
+            * css/StyleSheetContents.cpp:
+            (WebCore::StyleSheetContents::parserAppendRule):
</ins><span class="cx"> 
</span><del>-2014-05-01  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+                The meat of this change. Split rules with &gt;8K selectors into multiple rules with 8K selectors in each.
</ins><span class="cx"> 
</span><del>-        Convert OwnPtr and PassOwnPtr uses to std::unique_ptr in Supplement
-        https://bugs.webkit.org/show_bug.cgi?id=132165
</del><ins>+            * css/StyleRule.h:
+            (WebCore::toStyleRule):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+                Added a toStyleRule() helper for good measure.
</ins><span class="cx"> 
</span><del>-        According to convert from PassOwnPtr to std::unique_ptr, provideTo() callers also begin
-        to use std::make_unique.
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/battery/BatteryController.cpp:
-        (WebCore::provideBatteryTo):
-        * Modules/battery/BatteryController.h:
-        * Modules/battery/NavigatorBattery.cpp:
-        (WebCore::NavigatorBattery::from):
-        * Modules/gamepad/NavigatorGamepad.cpp:
-        (WebCore::NavigatorGamepad::from):
-        * Modules/geolocation/GeolocationController.cpp:
-        (WebCore::provideGeolocationTo):
-        * Modules/geolocation/GeolocationController.h:
-        * Modules/geolocation/NavigatorGeolocation.cpp:
-        (WebCore::NavigatorGeolocation::from):
-        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
-        (WebCore::DOMWindowIndexedDatabase::from):
-        * Modules/indexeddb/PageGroupIndexedDatabase.cpp:
-        (WebCore::PageGroupIndexedDatabase::from):
-        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:
-        (WebCore::WorkerGlobalScopeIndexedDatabase::from):
-        * Modules/mediastream/UserMediaController.cpp:
-        (WebCore::provideUserMediaTo):
-        (WebCore::UserMediaController::create): Deleted.
-        * Modules/mediastream/UserMediaController.h:
-        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
-        (WebCore::provideNavigatorContentUtilsTo):
-        (WebCore::NavigatorContentUtils::create): Deleted.
-        * Modules/navigatorcontentutils/NavigatorContentUtils.h:
-        * Modules/notifications/DOMWindowNotifications.cpp:
-        (WebCore::DOMWindowNotifications::from):
-        * Modules/notifications/NotificationController.cpp:
-        (WebCore::provideNotification):
-        (WebCore::NotificationController::create): Deleted.
-        * Modules/notifications/NotificationController.h:
-        * Modules/notifications/WorkerGlobalScopeNotifications.cpp:
-        (WebCore::WorkerGlobalScopeNotifications::from):
-        * Modules/proximity/DeviceProximityController.cpp:
-        (WebCore::provideDeviceProximityTo):
-        (WebCore::DeviceProximityController::create): Deleted.
-        * Modules/proximity/DeviceProximityController.h:
-        * Modules/quota/DOMWindowQuota.cpp:
-        (WebCore::DOMWindowQuota::from):
-        * Modules/quota/NavigatorStorageQuota.cpp:
-        (WebCore::NavigatorStorageQuota::from):
-        * Modules/quota/WorkerNavigatorStorageQuota.cpp:
-        (WebCore::WorkerNavigatorStorageQuota::from):
-        * Modules/speech/DOMWindowSpeechSynthesis.cpp:
-        (WebCore::DOMWindowSpeechSynthesis::from):
-        * Modules/speech/SpeechRecognitionController.cpp:
-        (WebCore::provideSpeechRecognitionTo):
-        * Modules/vibration/Vibration.cpp:
-        (WebCore::provideVibrationTo):
-        (WebCore::Vibration::create): Deleted.
-        * Modules/vibration/Vibration.h:
-        * dom/DeviceMotionController.cpp:
-        (WebCore::provideDeviceMotionTo):
-        (WebCore::DeviceMotionController::create): Deleted.
-        * dom/DeviceMotionController.h:
-        * dom/DeviceOrientationController.cpp:
-        (WebCore::provideDeviceOrientationTo):
-        (WebCore::DeviceOrientationController::create): Deleted.
-        * dom/DeviceOrientationController.h:
-        * page/SpeechInput.cpp:
-        (WebCore::provideSpeechInputTo):
-        (WebCore::SpeechInput::create): Deleted.
-        * page/SpeechInput.h:
-        * platform/Supplementable.h:
-        (WebCore::Supplement::provideTo):
-        (WebCore::Supplementable::provideSupplement):
-        * testing/InternalSettings.cpp:
-        (WebCore::InternalSettings::from):
</del><ins>+        Merge r152434
</ins><span class="cx"> 
</span><del>-2014-05-01  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+    2013-07-05  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        HTMLMediaElement: Remove two unnecessary virtual overrides.
-        &lt;https://webkit.org/b/132445&gt;
</del><ins>+            Tons of crashes on bots after r152425
+            https://bugs.webkit.org/show_bug.cgi?id=118440
+            &lt;rdar://problem/14366772&gt;
</ins><span class="cx"> 
</span><del>-        Now that ENABLE_PLUGIN_PROXY_FOR_VIDEO is gone, we can remove
-        these overrides:
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-            - defaultEventHandler()
-            - willRespondToMouseClickEvents()
</del><ins>+            Null-check the frame's page and early return. It's OK to do this
+            because it only happens when we're being torn down.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::minimumScrollPosition):
+            (WebCore::FrameView::maximumScrollPosition):
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        * html/HTMLMediaElement.h:
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-01  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Merge r152433
</ins><span class="cx"> 
</span><del>-        ViewportConfiguration::minimumScale() uses the initial scale as initial value
-        https://bugs.webkit.org/show_bug.cgi?id=132451
-        &lt;rdar://problem/16780111&gt;
</del><ins>+    2013-07-05  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+            Fix r152265: FrameView's pagination mode is only one of two, and the logic was totally wrong
+            https://bugs.webkit.org/show_bug.cgi?id=118439
+            &lt;rdar://problem/14366120&gt;
</ins><span class="cx"> 
</span><del>-        * page/ViewportConfiguration.cpp:
-        (WebCore::ViewportConfiguration::minimumScale):
-        The initial minimum scale was set to the initial scale, preventing some pages from zooming
-        out.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-05-01  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::maximumScrollPosition):
+            - Test both Page and FrameView's pagination modes.
+            - *Don't* clamp negatives to zero if we are paginated with scroll offset set,
+                like the original changelog claimed, but the code did the opposite.
+            - Don't clamp in *all* pagination modes; with 'direction: RTL' it's still possible
+                to have a negative maximum position in LTR/TB pagination modes.
</ins><span class="cx"> 
</span><del>-        Build fix for !ENABLE(BLOB) builds.
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/ThreadableBlobRegistry.cpp:
-        (WebCore::ThreadableBlobRegistry::registerBlobURL):
-        (WebCore::ThreadableBlobRegistry::registerBlobURLForSlice):
</del><ins>+        Merge r152430
</ins><span class="cx"> 
</span><del>-2014-05-01  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+    2013-07-05  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Move size computation for Blob constructor into BlobRegistryImpl
-        https://bugs.webkit.org/show_bug.cgi?id=132439
</del><ins>+            WKPageFindStringMatches with kWKFindOptionsBackwards still doesn't work
+            &lt;rdar://problem/13881024&gt;
+            https://bugs.webkit.org/show_bug.cgi?id=118436
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * Modules/websockets/WebSocket.cpp: (WebCore::WebSocket::didReceiveBinaryData):
-        Don't pass the size, anyone who cares can get it from BlobData.
</del><ins>+            * page/Page.cpp:
+            (WebCore::Page::findStringMatchingRanges):
+            - When searching backwards, use END_TO_START rather than START_TO_END.
+            - If there is no selection and we are searching backwards, we now select the last item,
+              not the first.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSBlobCustom.cpp: (WebCore::JSBlobConstructor::constructJSBlob):
-        Updated for BlobBuilder changes.
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/Blob.cpp: (WebCore::Blob::Blob):
-        * fileapi/Blob.h: (WebCore::Blob::create):
-        No longer take a precomputed size with BlobData, BlobRegistry will compute it as
-        part of registration.
</del><ins>+        Merge r152425
</ins><span class="cx"> 
</span><del>-        * fileapi/File.h:
-        * fileapi/File.cpp:
-        (WebCore::File::File): Don't pass a size (that's unknown anyway).
-        (WebCore::File::captureSnapshot): Deleted. Finally, only the registry is responsible
-        for snapshot tracking now (I doubt that either new or old code is particularly compliant).
</del><ins>+    2013-07-05  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/ThreadableBlobRegistry.cpp:
-        (WebCore::ThreadableBlobRegistry::registerBlobURL):
-        * fileapi/ThreadableBlobRegistry.h:
-        Plumbing to make this version of registerBlobURL return a size. I may make size
-        calculation lazy and the function async later, but this is needed to move the behavior
-        to the right place first.
</del><ins>+            [wk2] Add API to lock the scroll position at the top or bottom of the page
+            https://bugs.webkit.org/show_bug.cgi?id=118429
+            &lt;rdar://problem/14120323&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/WebKitBlobBuilder.h:
-        * fileapi/WebKitBlobBuilder.cpp:
-        (WebCore::BlobBuilder::BlobBuilder):
-        (WebCore::BlobBuilder::append):
-        (WebCore::BlobBuilder::appendBytesData):
-        (WebCore::BlobBuilder::finalize):
-        (WebCore::BlobBuilder::getBlob): Deleted.
-        Don't track sizes or modification times, registry will do that with appropriate laziness.
-        Cleaned up the API - now that BlobBuilder is not exposed to JS as an object, it
-        does not need to be reusable.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobRegistry.h: Made this version of registerBlobURL return a size.
-        * platform/network/BlobRegistryImpl.h:
-        * platform/network/BlobRegistryImpl.cpp:
-        (WebCore::BlobRegistryImpl::appendStorageItems): Assert that length computations are accurate.
-        (WebCore::BlobRegistryImpl::registerBlobURL): Compute a size to return, and record
-        modification time as necessary.
</del><ins>+            Test (API): WebKit2.ScrollPinningBehaviors
</ins><span class="cx"> 
</span><del>-        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::responseBlob): Don't pass the
-        size, which can be computed from data. Soon, I want to add a constructor that doesn't
-        require wrapping a single Vector as BlobData to construct a Blob.
</del><ins>+            * WebCore.exp.in:
+            Expose FrameView::setScrollPinningBehavior.
</ins><span class="cx"> 
</span><del>-2014-05-01  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::FrameView):
+            Our pinning behavior should be DoNotPin by default.
</ins><span class="cx"> 
</span><del>-        [iOS] audio and video should automatically play to active external device
-        https://bugs.webkit.org/show_bug.cgi?id=132428
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::minimumScrollPosition):
+            (WebCore::FrameView::maximumScrollPosition):
+            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+            (WebCore::ScrollingTreeScrollingNodeMac::minimumScrollPosition):
+            (WebCore::ScrollingTreeScrollingNodeMac::maximumScrollPosition):
+            Fix the minimum scroll position's vertical location to the maximum if
+            we're pinned to the bottom, and vice-versa if we're pinned to the top.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            (WebCore::FrameView::setScrollPinningBehavior): Added.
+            If scroll pinning behavior has changed, inform ScrollingCoordinator
+            and update scrollbars (which will also re-pin the scroll position).
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): Set 
-            AVPlayer.usesExternalPlaybackWhileExternalScreenIsActive.
</del><ins>+            * page/FrameView.h:
+            Override minimumScrollPosition, add setScrollPinningBehavior,
+            and storage for m_scrollPinningBehavior.
</ins><span class="cx"> 
</span><del>-2014-05-01  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+            * page/scrolling/ScrollingCoordinator.h:
+            (WebCore::ScrollingCoordinator::setScrollPinningBehavior): Added.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): [New Multicolumn] Selection into and out of column-span elements doesn't work
-        https://bugs.webkit.org/show_bug.cgi?id=132066
</del><ins>+            * page/scrolling/ScrollingTree.cpp:
+            (WebCore::ScrollingTree::ScrollingTree):
+            Our pinning behavior should be DoNotPin by default.
</ins><span class="cx"> 
</span><del>-        Reviewed by Oliver Hunt.
</del><ins>+            (WebCore::ScrollingTree::setScrollPinningBehavior):
+            (WebCore::ScrollingTree::scrollPinningBehavior):
+            Getter/setter for m_scrollPinningBehavior, scrolling-thread-safe.
</ins><span class="cx"> 
</span><del>-        Make a new SelectionIterator struct that knows how to drill into and out of
-        column span placeholders. Also change spans to be selection roots (in the painting
-        sense).
</del><ins>+            * page/scrolling/ScrollingTree.h:
+            * page/scrolling/mac/ScrollingCoordinatorMac.h:
+            * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+            (WebCore::ScrollingCoordinatorMac::setScrollPinningBehavior):
+            Inform ScrollingTree of the scroll pinning behavior change.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::isSelectionRoot):
-        (WebCore::RenderBlock::selectionGaps):
-        * rendering/RenderView.cpp:
-        (WebCore::SelectionIterator::SelectionIterator):
-        (WebCore::SelectionIterator::checkForSpanner):
-        (WebCore::SelectionIterator::current):
-        (WebCore::SelectionIterator::next):
-        (WebCore::RenderView::subtreeSelectionBounds):
-        (WebCore::RenderView::repaintSubtreeSelection):
-        (WebCore::RenderView::setSubtreeSelection):
</del><ins>+            * platform/ScrollTypes.h:
+            Add ScrollPinningBehavior enum.
</ins><span class="cx"> 
</span><del>-2014-05-01  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Don't always make backing store for -webkit-backface-visibility:hidden
-        https://bugs.webkit.org/show_bug.cgi?id=132420
</del><ins>+        Merge r152424
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
-        
-        Previously, -webkit-backface-visibility:hidden unconditionally created
-        compositing layers with backing store. This results in high memory use
-        on pages with this style applied to many elements (a cargo-cult &quot;optimization&quot;).
-        
-        Fix by only having -webkit-backface-visibility:hidden create compositing layers
-        if some ancestor has a 3D transform. That's the only scenario in which the
-        element can be flipped around to reveal the back side, so the only time we need
-        to do compositing for this property. In future, we could be smarter, and only
-        consider 3D transforms in the current preserve-3d context.
</del><ins>+    2013-07-05  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: compositing/backing/backface-visibility-in-3dtransformed.html
-               compositing/backing/backface-visibility-in-transformed.html
-               compositing/backing/backface-visibility.html
</del><ins>+            iframe constrained by max-width in full screen
+            https://bugs.webkit.org/show_bug.cgi?id=118250
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::RenderLayer):
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::hitTestLayer):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresOwnBackingStore):
-        (WebCore::RenderLayerCompositor::requiresCompositingForBackfaceVisibility):
-        * rendering/RenderLayerCompositor.h:
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-05-01  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Ensure that contents inside iframe can go full screen properly.
</ins><span class="cx"> 
</span><del>-        Finish updating ANGLE.
-        https://bugs.webkit.org/show_bug.cgi?id=132434
</del><ins>+            Set max-width and max-height values to the default 'none', so that iframes are not
+            constrained when entering full screen.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Test: fullscreen/full-screen-iframe-with-max-width-height.html
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        Removed Uniform.cpp which is no longer in ANGLE.
</del><ins>+            * css/fullscreen.css:
+            (iframe:-webkit-full-screen):
</ins><span class="cx"> 
</span><del>-2014-05-01  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (new multi-column): WebKit2.ResizeReversePaginatedWebView fails on debug bots
-        https://bugs.webkit.org/show_bug.cgi?id=132429
</del><ins>+        Merge r152422
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
-        
-        Make sure to get the column count directly from the column set.
-        I was returning the theoretical column count from the flow thread,
-        and that wasn't the right value.
</del><ins>+    2013-07-05  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.h:
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::pageCount):
</del><ins>+            [Mac] .webkitClosedCaptionsVisible doesn't work with &quot;Automatic&quot; caption mode
+            https://bugs.webkit.org/show_bug.cgi?id=118319
</ins><span class="cx"> 
</span><del>-2014-05-01  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-        Fix handling of attributes prior to compiling shader
-        https://bugs.webkit.org/show_bug.cgi?id=132430
</del><ins>+            Track when captions are enabled with the old 'webkitClosedCaptionsVisible' attribute and
+            consider that when determining which track should be enabled.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Test: media/track/track-legacyapi-with-automatic-mode.html
</ins><span class="cx"> 
</span><del>-        WebGL programs that called bindAttribLocations prior to compiling shader sources
-        would perform the bind using the non-hashed symbol name, but would later create
-        the attributes as hashed names. Consequently, the program would refer to
-        attributes that were never actually part of any shader, resulting in some amazing
-        display artifacts.
</del><ins>+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_webkitLegacyClosedCaptionOverride.
+            (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): Set m_webkitLegacyClosedCaptionOverride.
+            (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): Return m_webkitLegacyClosedCaptionOverride.
+            * html/HTMLMediaElement.h:
</ins><span class="cx"> 
</span><del>-        This patch adds a dictionary of hashed symbol names so that we can tell the WebGL
-        program the proper name that will be used when the shader is eventually compiled,
-        allowing the WebGL program to link against the proper symbol after compiling and
-        linking completes.
</del><ins>+            * page/CaptionUserPreferencesMediaAF.cpp:
+            (WebCore::CaptionUserPreferencesMediaAF::textTrackSelectionScore): Don't apply &quot;automatic&quot;
+                logic when captions were enabled with .webkitClosedCaptionsVisible.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
-        (WebCore::generateHashedName): Function uses the ANGLE hashing
-        function to generate correct symbol.
-        (WebCore::GraphicsContext3D::mappedSymbolName): If we haven't compiled shaders yet, look
-        in our set of potentially unused attributes.
-        (WebCore::GraphicsContext3D::originalSymbolName): Ditto, for reverse lookup.
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-01  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Merge r152383
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Make selection gaps painting subpixel aware.
-        https://bugs.webkit.org/show_bug.cgi?id=132169
</del><ins>+    2013-07-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            [Windows] Updates to support changes in CoreGraphics libraries.
+            https://bugs.webkit.org/show_bug.cgi?id=118373
</ins><span class="cx"> 
</span><del>-        Push selection gaps painting to device pixel boundaries instead of integral CSS pixel positions.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Test: fast/inline/hidpi-selection-gap-on-subpixel-position.html
</del><ins>+            * WebCorePrefix.h: Include definitions for isnan/round/roundf for versions of
+            Visual Studio that do not provide them natively.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::blockSelectionGap):
-        (WebCore::RenderBlock::logicalLeftSelectionGap):
-        (WebCore::RenderBlock::logicalRightSelectionGap):
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Merge r152382
</ins><span class="cx"> 
</span><del>-        Really remove ENABLE_PLUGIN_PROXY_FOR_VIDEO
-        &lt;http://webkit.org/b/132432&gt;
</del><ins>+    2013-07-03  Gordon Sheridan  &lt;gordon_sheridan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Implement mechanism to detect (partially) hidden blocked plugins.
+            https://bugs.webkit.org/show_bug.cgi?id=117998
</ins><span class="cx"> 
</span><del>-        * platform/graphics/wince/MediaPlayerPrivateWinCE.h: Remove
-        methods and ivar in ENABLE(PLUGIN_PROXY_FOR_VIDEO).
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-05-01  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
</del><ins>+            * rendering/RenderEmbeddedObject.cpp:
+            (WebCore::RenderEmbeddedObject::replacementTextRect):
+            Added private method for calculating the size of the replacement text for blocked plugins.
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Clamping the number of repetitions in repeat()
-        https://bugs.webkit.org/show_bug.cgi?id=131023
</del><ins>+            (WebCore::RenderEmbeddedObject::isReplacementObscured):
+            Added public method to determine if the EMBED element used for a blocked plugin is inaccessible to the user.
+            * rendering/RenderEmbeddedObject.h:
+            Declare the two new methods mentioned above.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            * WebCore.exp.in:
+            Export RenderEmbeddedObject::isReplacementObscured().
</ins><span class="cx"> 
</span><del>-        The ED suggests now to be able to clamp the number of repetitions when
-        using the repeat() function, taking precautions about excessive memory
-        usage.
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The implemented max repetitions is 10K.
</del><ins>+        Merge r152348
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/grid-element-repeat-max-repetitions.html
</del><ins>+    2013-07-03  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseGridTrackRepeatFunction):
</del><ins>+            H&amp;R Block 2010 Help window can not be reopened.
+            https://bugs.webkit.org/show_bug.cgi?id=118342
</ins><span class="cx"> 
</span><del>-2014-04-30  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        [MSE] Seeking between two buffered ranges enquues incorrect buffers.
-        https://bugs.webkit.org/show_bug.cgi?id=132416
</del><ins>+            http://trac.webkit.org/changeset/118916 changed the window.focus() behaviour so that
+            only the opener can (re)focus() a particular window.
+            H&amp;R Block app relies on the relaxed window.focus() rules.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            * WebCore.exp.in:
+            * platform/RuntimeApplicationChecks.cpp:
+            (WebCore::applicationIsHRBlock):
+            * platform/RuntimeApplicationChecks.h:
</ins><span class="cx"> 
</span><del>-        std::equal_range(begin, end, value) will return an empty range if equal values cannot
-        be found. But the range is not necessarily [end, end).  It may be some other value n,
-        such that the empty range is [n, n). Check to see if the returned range is empty in
-        findSampleContainingPresentationTime() and its reverse version, and if so, explicitly
-        return presentationEnd() or reversePresentationEnd() respectively.
</del><ins>+2013-07-09  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Drive-by fix: make the comparator functions take const&amp; arguments to minimize object
-        creation.
</del><ins>+        Merge r152324
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/SampleMap.cpp:
-        (WebCore::SampleIsLessThanMediaTimeComparator::operator()):
-        (WebCore::SampleIsGreaterThanMediaTimeComparator::operator()):
-        (WebCore::SampleMap::findSampleContainingPresentationTime):
-        (WebCore::SampleMap::reverseFindSampleContainingPresentationTime):
</del><ins>+    2013-07-02  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-01  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            media/unsupported-rtsp.html is failing
+            https://bugs.webkit.org/show_bug.cgi?id=118327
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Inline text selection painting should not snap to integral CSS pixel position.
-        https://bugs.webkit.org/show_bug.cgi?id=132164
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Fixes the media/unsupported-rtsp.html test.
</ins><span class="cx"> 
</span><del>-        Inline text selection painting now snaps to device pixels. It uses the same rounding logic as
-        other painting functions.
</del><ins>+            Set the contentType field of contentInformationRequest in order to trigger AVFoundation to 
+            notice that loading failed and generate an error.
</ins><span class="cx"> 
</span><del>-        Test: fast/inline/hidpi-select-inline-on-subpixel-position.html
</del><ins>+            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
+            (WebCore::WebCoreAVFResourceLoader::notifyFinished):
</ins><span class="cx"> 
</span><del>-        * rendering/EllipsisBox.cpp:
-        (WebCore::EllipsisBox::paintSelection):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintSelection):
-        (WebCore::alignSelectionRectToDevicePixels): Deleted.
-        * rendering/InlineTextBox.h:
</del><ins>+2013-07-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-01  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        Merge r152315
</ins><span class="cx"> 
</span><del>-        [EFL] There are many warnings with software backend
-        https://bugs.webkit.org/show_bug.cgi?id=132422
</del><ins>+    2013-07-02  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+            Always flip the coordinate system before drawing NSViews from Widget::paint
+            https://bugs.webkit.org/show_bug.cgi?id=118318
+            &lt;rdar://problem/13895483&gt;
</ins><span class="cx"> 
</span><del>-        ecore_evas_gl_x11_window_get should be called when only engine is opengl_x11.
</del><ins>+            Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        This patch refactors not to call unnecessary API by checking engine type.
-        In addition, removed unnecessary isUsingEcoreX().
</del><ins>+            Undo the change that would not flip on 10.9; turns out the bug was in AppKit. Also remove the
+            _hasCanDrawSubviewsIntoLayerOrAncestor workaround since drawing works correctly now.
</ins><span class="cx"> 
</span><del>-        * platform/efl/EflScreenUtilities.cpp:
-        (WebCore::applyFallbackCursor):
-        (WebCore::getEcoreXWindow):
-        (WebCore::isUsingEcoreX): Deleted.
-        * platform/efl/EflScreenUtilities.h:
</del><ins>+            Also, pass flipped:NO when creating the NSGraphicsContext to indicate that the graphics context
+            is unflipped as far as AppKit knows (since we flipped it earlier).
</ins><span class="cx"> 
</span><del>-2014-05-01  Rik Cabanier  &lt;cabanier@adobe.com&gt;
</del><ins>+            * platform/mac/WidgetMac.mm:
+            (WebCore::Widget::paint):
</ins><span class="cx"> 
</span><del>-        Calling createPattern with a broken image must throw an invalidstate error
-        https://bugs.webkit.org/show_bug.cgi?id=132407
</del><ins>+2013-07-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Merge r152303
</ins><span class="cx"> 
</span><del>-        Per the WebIDL spec, passing non-finite parameter to a method that
-        takes doubles, should generate a type error.
</del><ins>+    2013-07-02  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests:
-        * canvas/philip/tests/2d.imageData.create2.nonfinite.html:
-        * fast/canvas/canvas-2d-imageData-create-nonfinite.html:
</del><ins>+            constrainScrollPositionForOverhang needs to handle scrollOrigin correctly
+            https://bugs.webkit.org/show_bug.cgi?id=118176
+            &lt;rdar://problem/14301271&gt;
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createImageData):
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-04-30  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+            Test: compositing/geometry/fixed-position-flipped-writing-mode.html
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): [New Multicolumn] LeftToRight-rl.html (and all the other reversed/block-axis pagination tests) fail
-        https://bugs.webkit.org/show_bug.cgi?id=132419
</del><ins>+            WebCore makes use of constrainScrollPositionForOverhang not only for
+            constraining fixed- and sticky-positioned elements to the viewport, but
+            also for clamping the tile cache's visible rect.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Therefore, constrainScrollPositionForOverhang needs to correctly take
+            the scrollOrigin into account. The easiest way I saw to do this was to
+            reimplement the function in terms of a pair of rect intersections
+            between a virtual scrollable &quot;viewport&quot; and the document (with a bit
+            of complication from headers and footers).
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::initialBlockOffsetForPainting):
-        Don't flip here. The old code needed to do that, but the new code doesn't.
</del><ins>+            The first intersection is performed, then if the viewport doesn't fit,
+            it is pushed down and to the right, from the origin. Next, we intersect
+            again, this time pushing the rect up by the amount it overflowed the document
+            rect from the bottom right. This performs effectively the same constraint
+            as previously, but handles the scrollOrigin correctly and is also somewhat
+            easier to read and understand (with pictures).
</ins><span class="cx"> 
</span><del>-2014-04-30  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+            (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
+            Subtract the scrollOrigin out of the offset passed to scrollOffsetForFixedPosition,
+            it's expecting an offset without the origin included.
</ins><span class="cx"> 
</span><del>-        Roll out fix for https://bugs.webkit.org/show_bug.cgi?id=131637:
-        Clean up unnecessary methods in the BackForwardClient interface
</del><ins>+            * platform/ScrollableArea.cpp:
+            (WebCore::ScrollableArea::constrainScrollPositionForOverhang):
+            Reimplement the function as described above.
</ins><span class="cx"> 
</span><del>-        It broke a regression test and an API test.
</del><ins>+2013-07-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * history/BackForwardClient.h:
-        (WebCore::BackForwardClient::backItem):
-        (WebCore::BackForwardClient::currentItem):
-        (WebCore::BackForwardClient::forwardItem):
-        * history/BackForwardController.cpp:
-        (WebCore::BackForwardController::BackForwardController):
-        * history/BackForwardController.h:
-        (WebCore::BackForwardController::client):
-        * history/BackForwardList.cpp:
-        (WebCore::BackForwardList::BackForwardList):
-        (WebCore::BackForwardList::close):
-        * history/BackForwardList.h:
-        (WebCore::BackForwardList::create):
-        (WebCore::BackForwardList::page):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::PageClients::PageClients):
-        * page/Page.h:
</del><ins>+        Rollout r151510. &lt;rdar://problem/14380353&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-07-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        More iOS build fixing. MediaPlayerPrivateIOS is defunct and can be removed.
-        Fix some build errors in other media files.
</del><ins>+        Merge r152306
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/MediaPlayer.cpp:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        * platform/graphics/ios/MediaPlayerPrivateIOS.h: Removed.
-        * platform/graphics/ios/MediaPlayerPrivateIOS.mm: Removed.
</del><ins>+    2013-07-02  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            plainText() is O(N^2)
+            https://bugs.webkit.org/show_bug.cgi?id=118282
+            &lt;rdar://problem/14284360&gt;
</ins><span class="cx"> 
</span><del>-        Fix the iOS build, which no longer needs these calls
-        to enter/exitFullscreen.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
</del><ins>+            * editing/TextIterator.cpp:
+            (WebCore::plainText): Linear growth for a vector data type is O(N^2).
+            Don't do that. Luckily, StringBuilder does the right thing automatically,
+            so we can just delete code.
</ins><span class="cx"> 
</span><del>-2014-04-30  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-07-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove ENABLE_PLUGIN_PROXY_FOR_VIDEO
-        https://bugs.webkit.org/show_bug.cgi?id=132396
</del><ins>+        Merge r151737
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+    2013-06-19  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Remove ENABLE_PLUGIN_PROXY_FOR_VIDEO and related code.
</del><ins>+            Incorrect computation of shrink-to-fit width for block with white-space:nowrap and floating children
+            https://bugs.webkit.org/show_bug.cgi?id=114879
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * WebCore.exp.in:
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::canShareStyleWithElement):
-        * dom/DOMImplementation.cpp:
-        (WebCore::DOMImplementation::createDocument):
-        * editing/TextIterator.cpp:
-        (WebCore::isRendererReplacedElement):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        (WebCore::HTMLMediaElement::parseAttribute):
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::setNeedWidgetUpdate): Deleted.
-        * html/HTMLMediaSession.cpp:
-        (WebCore::HTMLMediaSession::showPlaybackTargetPicker):
-        (WebCore::HTMLMediaSession::hasWirelessPlaybackTargets):
-        (WebCore::HTMLMediaSession::setHasPlaybackTargetAvailabilityListeners):
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::createElementRenderer):
-        (WebCore::HTMLVideoElement::didAttachRenderers):
-        (WebCore::HTMLVideoElement::parseAttribute):
-        (WebCore::HTMLVideoElement::setDisplayMode):
-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::updateSizes):
-        * loader/EmptyClients.cpp:
-        (WebCore::EmptyFrameLoaderClient::createMediaPlayerProxyPlugin): Deleted.
-        * loader/EmptyClients.h:
-        * loader/FrameLoaderClient.h:
-        * loader/SubframeLoader.cpp:
-        (WebCore::SubframeLoader::loadPlugin):
-        (WebCore::SubframeLoader::loadMediaPlayerProxyPlugin): Deleted.
-        * loader/SubframeLoader.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateEmbeddedObject):
-        * page/Settings.cpp:
-        (WebCore::Settings::setVideoPluginProxyEnabled): Deleted.
-        * page/Settings.h:
-        (WebCore::Settings::isVideoPluginProxyEnabled): Deleted.
-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::GraphicsLayerClient::mediaLayerMustBeUpdatedOnMainThread): Deleted.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::installedMediaEngines):
-        (WebCore::MediaPlayer::MediaPlayer):
-        (WebCore::MediaPlayer::loadWithNextMediaEngine):
-        (WebCore::NullMediaPlayerPrivate::deliverNotification): Deleted.
-        (WebCore::NullMediaPlayerPrivate::setMediaPlayerProxy): Deleted.
-        (WebCore::NullMediaPlayerPrivate::setControls): Deleted.
-        (WebCore::MediaPlayer::deliverNotification): Deleted.
-        (WebCore::MediaPlayer::setMediaPlayerProxy): Deleted.
-        (WebCore::MediaPlayer::setControls): Deleted.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::deliverNotification): Deleted.
-        (WebCore::MediaPlayerPrivateInterface::setMediaPlayerProxy): Deleted.
-        (WebCore::MediaPlayerPrivateInterface::setControls): Deleted.
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateGeometry):
-        (WebCore::GraphicsLayerCA::updateContentsRects):
-        (WebCore::GraphicsLayerCA::mediaLayerMustBeUpdatedOnMainThread): Deleted.
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * rendering/RenderEmbeddedObject.cpp:
-        (WebCore::RenderEmbeddedObject::canHaveChildren):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::mediaLayerMustBeUpdatedOnMainThread): Deleted.
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
</del><ins>+            Reviewed by David Hyatt.
+            Per http://www.w3.org/TR/CSS21/visudet.html#Computing_widths_and_margins when width is auto then floating non-replaced,
+            absolute non-replaced, and inline-block non-replaced elements should use shrink-to-fit width. This trumps any no-wrap property 
+            on the element so if we are shrinking to fit ensure our minimum width respects all possible line breaks.
</ins><span class="cx"> 
</span><del>-2014-04-30  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Test: fast/block/shrink-to-fit-width-container-with-floating-children.html
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Some accerated overflow-scroll doesn't scroll correctly
-        https://bugs.webkit.org/show_bug.cgi?id=132375
</del><ins>+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::computeIntrinsicLogicalWidths):
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
-        
-        We set the size of the scrolling layer (which becomes the bounds of
-        the UIScrollView) to a non-pixel-snapped padding box size, but the
-        size of the contents layer is an integral-snapped scroll size.
-        This would result in a fractional difference between the two, which
-        makes us thing that the element is scrollable when it really is not.
-        
-        Fix by setting the size of the scroll layer to pixel snapped client size,
-        which is what we also use for scrollability computation.
-        
-        Added some FIXMEs in code that requires pixel snapping.
-        
-        Also use #if PLATFORM(IOS)/#else to bracket some code that never runs on iOS
-        but tries to do something similar to iOS-only code.
</del><ins>+2013-07-02  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
</del><ins>+        Merge r152328
</ins><span class="cx"> 
</span><del>-2014-04-30  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+    2013-07-02  Jessie Berlin  &lt;jberlin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): [New Multicolumn] Painting order is wrong for columns and fixed positioned elements
-        https://bugs.webkit.org/show_bug.cgi?id=132377
</del><ins>+            The callback for WKPageGetPlugInInformation needs info about whether or not there are any
+            non-playing instances of the plug-in on the page
+            https://bugs.webkit.org/show_bug.cgi?id=118330
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/fixed-stack.html
</del><ins>+            * WebCore.exp.in:
+            Expose a symbol so it can be used in WebKit2.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::shouldBeSelfPaintingLayer):
-        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
-        Change the flow thread layer for multicolumn layout to be normal flow only and to
-        stay self-painting. This has the effect of keeping the flow thread layer grouped
-        with the enclosing multicolumn layer, and this keeps the paint order correct when
-        compositing kicks in (or when something would otherwise try to get between the
-        two layers).
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Merge r152265
</ins><span class="cx"> 
</span><del>-        [iOS] do not pause video when entering background while playing to external device
-        https://bugs.webkit.org/show_bug.cgi?id=132374
</del><ins>+    2013-07-01  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            Maximum scroll position can be negative in some cases
+            https://bugs.webkit.org/show_bug.cgi?id=118175
+            &lt;rdar://problem/14301217&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Update beginInterruption signature.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::canOverrideBackgroundPlaybackRestriction): New, return true when
-            playing to external device.
-        * html/HTMLMediaElement.h:
</del><ins>+            Test (API): WebKit2.ResizeReversePaginatedWebView
</ins><span class="cx"> 
</span><del>-        * platform/audio/MediaSession.cpp:
-        (WebCore::MediaSession::beginInterruption): Add interruption type to beginInterruption.
-        * platform/audio/MediaSession.h:
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::maximumScrollPosition):
+            * page/FrameView.h:
+            Override maximumScrollPosition() in FrameView and don't clamp to zero if
+            a reverse pagination mode is enabled, as it is possible (and common) to
+            have a negative maximum scroll position with reverse pagination.
</ins><span class="cx"> 
</span><del>-        * platform/audio/MediaSessionManager.cpp:
-        (WebCore::MediaSessionManager::beginInterruption): Ditto.
-        (WebCore::MediaSessionManager::applicationWillEnterBackground): Ditto.
-        (WebCore::MediaSessionManager::systemWillSleep): Ditto.
-        * platform/audio/MediaSessionManager.h:
</del><ins>+            * platform/ScrollView.cpp:
+            (WebCore::ScrollView::updateScrollbars):
+            Drive-by adoption of toIntSize().
</ins><span class="cx"> 
</span><del>-        * platform/audio/ios/AudioDestinationIOS.h:
-        * platform/audio/ios/MediaSessionManagerIOS.mm:
-        (-[WebMediaSessionHelper interruption:]): Ditto.
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/audio/mac/AudioDestinationMac.h: Make most methods private. Add 
-            canOverrideBackgroundPlaybackRestriction. Add missing overrides.
-        * testing/Internals.cpp:
-        (WebCore::Internals::beginMediaSessionInterruption): Pass interruption type.
</del><ins>+        Merge r152204
</ins><span class="cx"> 
</span><del>-2014-04-30  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+    2013-06-28  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167879 and r167942.
-        https://bugs.webkit.org/show_bug.cgi?id=132408
</del><ins>+            [Mac] adopt new AVFoundation caption API
+            https://bugs.webkit.org/show_bug.cgi?id=118207
</ins><span class="cx"> 
</span><del>-        OrderIterator changes caused regressions in flexbox (Requested
-        by rego on #webkit).
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        We're keeping the new layout test introduced in r167942
-        (fast/flexbox/order-iterator-crash.html) to avoid similar
-        regressions in the future.
</del><ins>+            No new tests, I was not able to come up with a reliable layout test.
</ins><span class="cx"> 
</span><del>-        Reverted changesets:
</del><ins>+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::flushCues): New, call currentTrack-&gt;resetCueValues().
+            (-[WebCoreAVFMovieObserver outputSequenceWasFlushed:]): New delegate method.
</ins><span class="cx"> 
</span><del>-        &quot;OrderIterator refactoring to avoid extra loops&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=119061
-        http://trac.webkit.org/changeset/167879
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;REGRESSION (r167879): Heap-use-after-free in
-        WebCore::RenderFlexibleBox&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132337
-        http://trac.webkit.org/changeset/167942
</del><ins>+        Merge r152185
</ins><span class="cx"> 
</span><del>-2014-04-30  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+    2013-06-28  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Cursor gets thinner on empty lines.
-        https://bugs.webkit.org/show_bug.cgi?id=132411
-        &lt;rdar://problem/15994556&gt;
</del><ins>+            -webkit-line-break: after-white-space sometimes truncates DOM on copy &amp; paste
+            https://bugs.webkit.org/show_bug.cgi?id=118164
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        RenderLineBreak::localCaretRect should not define
-        locally the constant caretWidth, but use the one from
-        RenderObject.h which knows about the differences between
-        iOS and the other platforms.
</del><ins>+            We can't assume that all subsequent ancestors contain exactly one child since they could have been
+            added in the first if statement matching: currentNode-&gt;parentNode() != rootNode &amp;&amp; isRemovableBlock(currentNode)
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLineBreak.cpp:
-        (WebCore::RenderLineBreak::localCaretRect):
</del><ins>+            Exit early when we encounter such an ancestor since removing its ancestor (that contains multiple children
+            some of which aren't in nodesToRemove) can clobber more nodes than we're allowed to remove.
</ins><span class="cx"> 
</span><del>-2014-04-30  Víctor Manuel Jáquez Leal  &lt;vjaquez@igalia.com&gt;
</del><ins>+            Test: editing/pasteboard/simplfiying-markup-should-not-strip-content.html
</ins><span class="cx"> 
</span><del>-        [GStreamer] Use GstMetaVideo
-        https://bugs.webkit.org/show_bug.cgi?id=132247
</del><ins>+            * editing/SimplifyMarkupCommand.cpp:
+            (WebCore::SimplifyMarkupCommand::doApply):
+            (WebCore::SimplifyMarkupCommand::pruneSubsequentAncestorsToRemove):
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        In WebKitVideoSink we announce the usage of GstMetaVideo, but we do
-        not use it when handling the video frames. This might break
-        some decoders and filters that rely on buffer's meta, rather
-        that in the caps structures.
</del><ins>+        Merge r152234
</ins><span class="cx"> 
</span><del>-        This patch enables the use of GstMetaVideo through the GstVideoFrame
-        API. And it is used everywhere the buffer mapping is required.
</del><ins>+    2013-06-27  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Also this patch changes to nullptr where zeros were used.
</del><ins>+            Audio in apps which embed WebViews is corrupted.
+            https://bugs.webkit.org/show_bug.cgi?id=118163
</ins><span class="cx"> 
</span><del>-        Also, compile conditionally the video buffer conversion when it is
-        ARGB/BGRA, since it is only required for the Cairo backend.
</del><ins>+            Reviewed by Maciej Stachowiak.
</ins><span class="cx"> 
</span><del>-        No new tests, already covered by current tests.
</del><ins>+            Add a preference, which defaults to off, which controls whether the
+            AudioSessionManager will switch to a large audio buffer setting for
+            power-savings during &lt;video&gt; playback.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/GStreamerUtilities.cpp:
-        (WebCore::getVideoSizeAndFormatFromCaps): init the GstVideoInfo before
-        used and remove caps fixate check since it is done by
-        gst_video_info_from_caps().
-        * platform/graphics/gstreamer/ImageGStreamer.h:
-        * platform/graphics/gstreamer/ImageGStreamerCairo.cpp:
-        (ImageGStreamer::ImageGStreamer): use GstVideoFrame for buffer mapping
-        and unmapping.
-        (ImageGStreamer::~ImageGStreamer): ditto.
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
-        (WebCore::MediaPlayerPrivateGStreamerBase::updateTexture): ditto.
-        (WebCore::MediaPlayerPrivateGStreamerBase::currentVideoSinkCaps):
-        return nullptr if failed.
-        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
-        (webkitVideoSinkRender): rely on GstVideoInfo rather than on the
-        caps. Use GstVideoFrame for buffer mapping and unmapping. Add guards
-        for buffer transformation, since it's only used by Cairo.
-        (webkitVideoSinkDispose): remove glib version guards.
-        (webkitVideoSinkSetCaps): update the value of the private
-        GstVideoInfo.
</del><ins>+            * WebCore.exp.in:
+            * page/Settings.cpp:
+            (WebCore::Settings::setLowPowerVideoAudioBufferSizeEnabled): Added.  Simple setter.
+            * page/Settings.h:
+            (WebCore::Settings::lowPowerVideoAudioBufferSizeEnabled): Added.  Simple getter.
+            * platform/audio/mac/AudioSessionManagerMac.cpp:
+            (AudioSessionManager::updateSessionState): Only set the large audio buffer
+                size if lowPowerVideoAudioBufferSize is enabled.
</ins><span class="cx"> 
</span><del>-2014-04-30  Víctor Manuel Jáquez Leal  &lt;vjaquez@igalia.com&gt;
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK][GStreamer] Remove unnecessary GLIB_CHECK_VERSION #ifdefs
-        https://bugs.webkit.org/show_bug.cgi?id=132390
</del><ins>+        Merge r152231
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+    2013-07-01  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Since EFL port use GLib 2.38 and GTK+, 2.33.2, I assume it is OK
-        remove, in GTK+ and GST, the existing glib version guards.
</del><ins>+            Unreviewed. Make WebCore.make copy over QTMovieWin DLL's and PDB's.
+            &lt;rdar://problem/14321403&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, already covered by current tests.
</del><ins>+            * WebCore.vcxproj/WebCore.make:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
-        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
-        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
-        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
-        (webkitVideoSinkDispose):
-        (webkitVideoSinkFinalize): Deleted.
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Merge r152207
</ins><span class="cx"> 
</span><del>-        Updated ANGLE.
-        https://bugs.webkit.org/show_bug.cgi?id=132367
-        &lt;rdar://problem/16211451&gt;
</del><ins>+    2013-06-29  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            REGRESSION(151586): multipart/x-mixed-replace images are broken
+            https://bugs.webkit.org/show_bug.cgi?id=118169
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt
-        Fixed ANGLE compiling with the update.
-        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
-        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE):
-        Removed SH_MAP_LONG_VARIABLE_NAMES which is no longer defined in ANGLE.
-        See https://chromium.googlesource.com/angle/angle/+/3cdfcce86b38ef31a0afd71855887193a7924468
-        * platform/graphics/opengl/Extensions3DOpenGLES.h:
-        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
-        Updated type names from ANGLE.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-2014-04-30  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            When loading multipart content the resource data will change as
+            the next part is loaded, so we need to make a copy of the data
+            before sending it to the resource.
</ins><span class="cx"> 
</span><del>-        Move Blob.slice() implementation into BlobRegistryImpl
-        https://bugs.webkit.org/show_bug.cgi?id=132402
</del><ins>+            * loader/SubresourceLoader.cpp:
+            (WebCore::SubresourceLoader::didReceiveResponse):
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Part or centralizing the responsibility for file size tracking.
</del><ins>+        Merge r152202
</ins><span class="cx"> 
</span><del>-        * fileapi/Blob.cpp:
-        (WebCore::Blob::Blob):
-        (WebCore::Blob::slice): Deleted.
-        * fileapi/Blob.h:
-        (WebCore::Blob::slice):
-        * fileapi/ThreadableBlobRegistry.cpp:
-        (WebCore::ThreadableBlobRegistry::registerBlobURL):
-        (WebCore::ThreadableBlobRegistry::registerBlobURLForSlice):
-        (WebCore::registerBlobURLTask): Deleted.
-        (WebCore::registerBlobURLFromTask): Deleted.
-        * fileapi/ThreadableBlobRegistry.h:
-        * platform/network/BlobRegistry.h:
-        * platform/network/BlobRegistryImpl.cpp:
-        (WebCore::BlobRegistryImpl::appendStorageItems):
-        (WebCore::BlobRegistryImpl::registerBlobURLForSlice):
-        (WebCore::BlobRegistryImpl::blobSize):
-        * platform/network/BlobRegistryImpl.h:
</del><ins>+    2013-06-28  Gavin Barraclough  &lt;barraclough@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            PageThrottler::shouldThrottleTimers is wrong.
+            https://bugs.webkit.org/show_bug.cgi?id=118210
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r168041.
</del><ins>+            Reviewed by Anders Carlson.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Add missing iOS exports.
</del><ins>+            m_throttleState == PageNotThrottledState
+                -&gt; page NOT throttled, so should NOT throttle timers
+            m_throttleState != PageNotThrottledState
+                -&gt; page NOT NOT throttled, so should throttle timers
</ins><span class="cx"> 
</span><del>-2014-04-30  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            This needs cleaning up, but for now, 1 character fix.
</ins><span class="cx"> 
</span><del>-        Always-visible scrollbars continuously repaint after non-momentum scrollling
-        https://bugs.webkit.org/show_bug.cgi?id=132403
-        -and corresponding-
-        &lt;rdar://problem/16553878&gt;
</del><ins>+            * page/PageThrottler.h:
+            (WebCore::PageThrottler::shouldThrottleTimers):
+                == -&gt; !=
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No longer universally opt into presentation value mode whenever the scroll 
-        position changes on the scrolling thread. We really only want it for momentum 
-        scrolls, and this will ensure that we always set it to NO once we have set it to 
-        YES.
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::handleWheelEvent):
-        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
</del><ins>+        Merge r152198
</ins><span class="cx"> 
</span><del>-        Expose shouldUsePresentationValue.
-        * platform/mac/NSScrollerImpDetails.h:
</del><ins>+    2013-06-28  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+            An element with -webkit-user-select: all should be selected on single click
+            https://bugs.webkit.org/show_bug.cgi?id=117864
</ins><span class="cx"> 
</span><del>-        Move the legacy WebKit API into WebKitLegacy.framework and move it inside WebKit.framework
-        https://bugs.webkit.org/show_bug.cgi?id=132399
-        &lt;rdar://problem/15920046&gt;
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+            Set m_mouseDownMayStartSelect true even when the node cannot start selection
+            if the node was inside an element with -webkit-user-select: all.
</ins><span class="cx"> 
</span><del>-        Allow WebKitLegacy to link against WebCore.
</del><ins>+            Test: editing/selection/user-select-all-with-single-click.html
</ins><span class="cx"> 
</span><del>-        * Configurations/WebCore.xcconfig:
</del><ins>+            * page/EventHandler.cpp:
+            (WebCore::canMouseDownStartSelect):
</ins><span class="cx"> 
</span><del>-2014-04-30  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] ASSERTs in fast/dynamic/continuation-detach-crash.html
-        https://bugs.webkit.org/show_bug.cgi?id=132392
</del><ins>+        Merge r152196
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+    2013-06-28  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::setRegionRangeForBox):
-        Add ASSERTs in case we ever try to set regions from the wrong flow thread
-        as part of the box's region range.
</del><ins>+            [Mac] Crash when loading is stopped from -didReceiveResponse
+            https://bugs.webkit.org/show_bug.cgi?id=118209
+            &lt;rdar://problem/14259249&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
-        Add a bunch of code that handles the discovery of a span from an outer flow thread
-        being inserted into an inner flow thread. This forces us to delete that placeholder
-        and shift the outer spanning content into the inner flow thread in order to get a new
-        mapping/placeholder created in the inner flow thread.
</del><ins>+            Reviewed by Brady Eidson.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderMultiColumnFlowThread::flowThreadRelativeWillBeRemoved):
-        Tighten this code to use the parent() just in case we change the invariant of
-        parent = containingBlock later.
</del><ins>+            Test: TestWebKitAPI/Tests/mac/StopLoadingFromDidReceiveResponse.mm.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.h:
-        Add a static guard when shifting a spanner to prevent the outer flow thread from
-        thinking the spanner belongs to it when it gets punted out of the inner flow thread.
-        A better long-term solution might be to make the spanner map global instead of
-        per-flow thread.
</del><ins>+            * loader/SubresourceLoader.cpp: (WebCore::SubresourceLoader::didReceiveResponse):
+            Added yet another check for reachedTerminalState().
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSpannerPlaceholder.cpp:
-        (WebCore::RenderMultiColumnSpannerPlaceholder::RenderMultiColumnSpannerPlaceholder):
-        * rendering/RenderMultiColumnSpannerPlaceholder.h:
-        Cache the flow thread so that we can get back to it in order to detect if the
-        placeholder belongs to us or not.
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::insertedIntoTree):
-        Notifications from insertedIntoTree are problematic, since this can be called during
-        the layout of the outer flow thread for content inside an inner flow thread that is
-        not getting a layout yet. This makes the currentFlowThread in the flow thread controller
-        inaccurate, so we have to add code to clear it out and put it back.
</del><ins>+        Merge r152194
</ins><span class="cx"> 
</span><del>-2014-04-29  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+    2013-06-28  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        AX: Make &quot;contenteditable&quot; regions into AXTextAreas
-        https://bugs.webkit.org/show_bug.cgi?id=132379
</del><ins>+            Cached pages don't update their backing scale factor when it changes
+            https://bugs.webkit.org/show_bug.cgi?id=118206
+            -and-
+            &lt;rdar://problem/14261627&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Make contenteditable regions into AXTextAreas. This will allow for a more standardized
-        interface for interaction with assistive technologies.
</del><ins>+            It is not sufficient to mark pages in the PageCache as needing a full style 
+            recalc. We also need to ensure that the RenderLayerCompositors for the CachesPages 
+            get updated.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/content-editable-as-textarea.html
</del><ins>+            Keep track of whether device scale has been updated with 
+            m_needsDeviceScaleChanged. If that has been marked true, then restore() will call 
+            Frame::deviceOrPageScaleFactorChanged().
+            * history/CachedPage.cpp:
+            (WebCore::CachedPage::CachedPage):
+            (WebCore::CachedPage::restore):
+            * history/CachedPage.h:
+            (WebCore::CachedPage::markForDeviceScaleChanged):
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityNodeObject.cpp:
-        (WebCore::AccessibilityNodeObject::hasContentEditableAttributeSet):
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::contentEditableAttributeIsEnabled):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::documentBasedSelectedTextRange):
-        (WebCore::AccessibilityRenderObject::selectedText):
-        (WebCore::AccessibilityRenderObject::selectedTextRange):
-        (WebCore::AccessibilityRenderObject::renderObjectIsObservable):
-        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
-        (WebCore::AccessibilityRenderObject::ariaSelectedTextRange): Deleted.
-        * accessibility/AccessibilityRenderObject.h:
</del><ins>+            Propagate markForDeviceScaleChanged() to all of the CachedPages.
+            * history/PageCache.cpp:
+            (WebCore::PageCache::markPagesForDeviceScaleChanged):
+            * history/PageCache.h:
</ins><span class="cx"> 
</span><del>-2014-04-30  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+            Call PageCache::markPagesForDeviceScaleChanged()
+            * page/Page.cpp:
+            (WebCore::Page::setDeviceScaleFactor):
</ins><span class="cx"> 
</span><del>-        Clean up unnecessary methods in the BackForwardClient interface
-        https://bugs.webkit.org/show_bug.cgi?id=131637
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Merge r152117
</ins><span class="cx"> 
</span><del>-        Demote back/current/forwardItem and iOS-specific methods from the
-        BackForwardClient interface. Convert the class to not be refcounted.
</del><ins>+    2013-06-27  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior was changed.
</del><ins>+            Polish context menus for media elements
+            https://bugs.webkit.org/show_bug.cgi?id=118078
+            &lt;rdar://problem/14278960&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * history/BackForwardClient.h:
-        (WebCore::BackForwardClient::~BackForwardClient): Deleted.
-        (WebCore::BackForwardClient::backItem): Deleted.
-        (WebCore::BackForwardClient::currentItem): Deleted.
-        (WebCore::BackForwardClient::forwardItem): Deleted.
-        * history/BackForwardController.cpp:
-        (WebCore::BackForwardController::BackForwardController):
-        * history/BackForwardController.h: Take ownership of the passed BackForwardClient.
-        (WebCore::BackForwardController::client): Return a reference.
-        * history/BackForwardList.h: Remove the Page field, since it isn't used any more.
-        (WebCore::BackForwardList::create): Deleted.
-        * page/Page.h: Remove RefPtr from PageClient.
-        * page/Page.cpp:
-        (WebCore::PageClients::PageClients): Initialize client to nullptr.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-04-30  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            No new tests: media/context-menu-action.html,
+            which has been disabled by bug 116651, is used to test context menus.
</ins><span class="cx"> 
</span><del>-        [Mac, iOS] Support caption activation via JS webkitHasClosedCaptions method
-        https://bugs.webkit.org/show_bug.cgi?id=132320
</del><ins>+            * English.lproj/Localizable.strings: Changed &quot;Fullscreen&quot; to &quot;Full Screen&quot;
+            and added strings &quot;Show Controls&quot; and &quot;Hide Controls&quot;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            * page/ContextMenuController.cpp: Updated to include a new context menu item 
+            that toggles betweeen &quot;Show Controls&quot; and &quot;Hide Controls&quot;.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.css:
-        (video::-webkit-media-text-track-container .hidden): Added.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::configureTextTrackGroup): Added call to
-        new 'updateCaptionsContainer'.
-        (WebCore::HTMLMediaElement::updateCaptionContainer): Added.
-        * html/HTMLMediaElement.h:
</del><ins>+            * platform/ContextMenuItem.h:
</ins><span class="cx"> 
</span><del>-2014-04-30  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            * platform/LocalizedStrings.cpp:
+            * platform/LocalizedStrings.h:
+            * platform/efl/LocalizedStringsEfl.cpp:
+            * platform/gtk/LocalizedStringsGtk.cpp:
+            * platform/qt/LocalizedStringsQt.cpp:
+            Added equivalents of localized strings &quot;Show Controls&quot; and &quot;Hide Controls&quot;.
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=132363
-        Make Blob RawData immutable
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Merge r152065
</ins><span class="cx"> 
</span><del>-        * Modules/websockets/WebSocket.cpp: (WebCore::WebSocket::didReceiveBinaryData):
-        Create RawData in one step.
</del><ins>+    2013-06-26  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Don't export a constructor that we no longer have (and the new one is inline).
</del><ins>+            Add an accessibility delegate interface to AppleWin port.
+            https://bugs.webkit.org/show_bug.cgi?id=118094.
</ins><span class="cx"> 
</span><del>-        * fileapi/Blob.cpp: Removed entirely dead code.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        * fileapi/WebKitBlobBuilder.cpp:
-        * fileapi/WebKitBlobBuilder.h:
-        Updated to collect data in a plain Vector, so that we don't have to modify RawData.
-        Removed FIXMEs about renaming - there used to be a BlobBuilder exposed to JS, but
-        now this is just a helper to implement JS Blob constructor. We should probably
-        still rename it, but not how the FIXME suggested.
</del><ins>+            * accessibility/win/AXObjectCacheWin.cpp: We call the page client's AXStartFrameLoad and AXFinishFrameLoad methods here, which will in turn call the AccessibilityDelegate's callbacks.
+            (WebCore::AXObjectCache::frameLoadingEventPlatformNotification):
+            * loader/EmptyClients.h:
+            (WebCore::EmptyChromeClient::AXStartFrameLoad):
+            (WebCore::EmptyChromeClient::AXFinishFrameLoad):
+            * page/ChromeClient.h:
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobData.cpp:
-        (WebCore::BlobDataItem::detachFromCurrentThread): RawData::detachFromCurrentThread()
-        was a no-op.
-        (WebCore::BlobDataHandle::BlobDataHandle): Deleted. This was entirely dead code.
-        (WebCore::BlobDataHandle::~BlobDataHandle): Ditto.
</del><ins>+2013-07-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobData.h: Made RawData immutable.
</del><ins>+        Merge r151978
</ins><span class="cx"> 
</span><del>-        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::responseBlob):
-        Create RawData in one step.
</del><ins>+    2013-06-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+            JSString should remember AtomicString
+            https://bugs.webkit.org/show_bug.cgi?id=117386
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Region offset not factored in when mapping to local coords
-        https://bugs.webkit.org/show_bug.cgi?id=132383
</del><ins>+            Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Added &quot;Atomic&quot; attribute as a WebKit extension to WebIDL, and deployed it in Element.idl and Node.idl so that
+            the binding code can use newly added JSValue::toAtomic to update JSString's m_value.
</ins><span class="cx"> 
</span><del>-        Make sure to cache the offset of the multicolumn set from its parent and then
-        add that in to the translation offset.
</del><ins>+            * bindings/js/JSDOMBinding.cpp:
+            (WebCore::valueToAtomicStringWithNullCheck): Added.
+            (WebCore::valueToAtomicStringWithUndefinedOrNullCheck): Added.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::mapAbsoluteToLocalPoint):
</del><ins>+            * bindings/js/JSDOMBinding.h:
</ins><span class="cx"> 
</span><del>-2014-04-30  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+            * bindings/scripts/CodeGeneratorJS.pm:
+            (GetNativeTypeFromSignature): Return const AtomicString&amp; when either Atomic attribute is specified or the type is
+            Reflect. Note that setAttribute and getAttribute both use AtomicString for all arguments.
+            (JSValueToNative): Use AtomicString equivalents when possible when converting DOMString to a WebCore object.
</ins><span class="cx"> 
</span><del>-        Move removeEquivalentProperties functions to EditingStyle
-        https://bugs.webkit.org/show_bug.cgi?id=131093
</del><ins>+            * bindings/scripts/IDLAttributes.txt: Added &quot;Atomic&quot; attribute.
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+            * bindings/scripts/test/JS/JSTestObj.cpp: Baselined test cases.
+            (WebCore::setJSTestObjReflectedStringAttr):
+            (WebCore::setJSTestObjReflectedURLAttr):
+            (WebCore::setJSTestObjReflectedCustomURLAttr):
</ins><span class="cx"> 
</span><del>-        A follow-up to r167967. Use single line declaration for template methods.
</del><ins>+            * dom/Document.idl:
+            * dom/Element.idl:
+            * dom/Node.idl:
</ins><span class="cx"> 
</span><del>-        * editing/EditingStyle.h:
</del><ins>+2013-06-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-30  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+        Merge r152038
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Enable runtime feature by default
-        https://bugs.webkit.org/show_bug.cgi?id=132189
</del><ins>+    2013-06-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Potential use-after-free after neutering AudioBuffer's underlying ArrayBuffer.
+            https://bugs.webkit.org/show_bug.cgi?id=118040
</ins><span class="cx"> 
</span><del>-        * page/Settings.in: Set cssGridLayoutEnabled to true.
</del><ins>+            Reviewed by Filip Pizlo.
</ins><span class="cx"> 
</span><del>-2014-04-30  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+            Test: webaudio/audiobuffer-neuter.html
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Wrap some specific grid code under compilation flag
-        https://bugs.webkit.org/show_bug.cgi?id=132341
</del><ins>+            When creating an AudioBuffer's backing ArrayBufferView objects, mark them as 'unneuterable',
+            meaning the underlying data will be copied in a neuter scenario rather than transferred. This
+            means the underlying assumtions of the webaudio code can continue to assume that the memory
+            areas owned by the ArrayBufferView will be present until the AudioBuffer is itself destroyed.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            In order to not expose the 'unneuterable' behavior to JavaScript, return a fresh Float32Array
+            wrapper around the ArrayBuffer object, rather than our own.
</ins><span class="cx"> 
</span><del>-        Some static variables in RenderBox are only used for CSS Grid Layout code. Wrap them and the related methods
-        under ENABLE_CSS_GRID_LAYOUT compilation flag.
</del><ins>+            * Modules/webaudio/AudioBuffer.cpp:
+            (WebCore::AudioBuffer::AudioBuffer): Mark the newly created channels as not neuterable.
+            (WebCore::AudioBuffer::getChannelData): Return a new Float32Array object rather than a pointer to our own.
+            * Modules/webaudio/AudioBuffer.h:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::willBeDestroyed):
-        (WebCore::RenderBox::containingBlockLogicalWidthForContent):
-        (WebCore::RenderBox::containingBlockLogicalHeightForContent):
-        (WebCore::RenderBox::perpendicularContainingBlockLogicalHeight):
-        (WebCore::RenderBox::computePercentageLogicalHeight):
-        * rendering/RenderBox.h:
</del><ins>+2013-06-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Merge r152035
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167962 and r167975.
-        https://bugs.webkit.org/show_bug.cgi?id=132376
</del><ins>+    2013-06-26  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Mysteriously broke many tests (Requested by ap on #webkit).
</del><ins>+            [Windows] Enable CaptionUserPreferencesMediaAF on Windows.
+            https://bugs.webkit.org/show_bug.cgi?id=118076
</ins><span class="cx"> 
</span><del>-        Reverted changesets:
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        &quot;[Mac, iOS] Support caption activation via JS
-        webkitHasClosedCaptions method&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132320
-        http://trac.webkit.org/changeset/167962
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Enable building the CaptionUserPreferencesMediaAF source file.
+            * page/CaptionUserPreferencesMediaAF.cpp: Add soft-link commands for CoreText symbols needed in
+              the implementation for Windows.
+            * platform/LocalizedStrings.cpp: Enable Text Track-related strings on Windows.
+            * platform/LocalizedStrings.h: Ditto.
</ins><span class="cx"> 
</span><del>-        &quot;Unreviewed test fix after r167962.&quot;
-        http://trac.webkit.org/changeset/167975
</del><ins>+2013-06-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        Merge r152004
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Multiple tests assert in RenderGeometryMap
-        https://bugs.webkit.org/show_bug.cgi?id=132285
</del><ins>+    2013-06-26  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Prepare CaptionUserPreferencesMac for use on Windows port.
+            https://bugs.webkit.org/show_bug.cgi?id=118069
</ins><span class="cx"> 
</span><del>-        Implement offsetFromContainer for RenderMultiColumnFlowThread so that the
-        geometry map gets the right offsets. This is really only relevant for the 
-        geometry map, since I already overrode mapAbsoluteToLocalPoint and multicolumn
-        flow threads are repaint containers (so mapLocalToAbsolute never needs offsetFromContainer).
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::offsetFromContainer):
-        * rendering/RenderMultiColumnFlowThread.h:
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add new files.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
+            * WebCore.xcodeproj/project.pbxproj: Update for new file name.
+            * page/CaptionUserPreferencesMac.h: Removed.
+            * page/CaptionUserPreferencesMac.mm: Removed.
+            * page/CaptionUserPreferencesMediaAF.cpp: Copied from page/CaptionUserPreferencesMac.mm.
+            * page/CaptionUserPreferencesMediaAF.h: Copied from page/CaptionUserPreferencesMac.h.
+            * page/PageGroup.cpp:
+            (WebCore::PageGroup::captionPreferences): Updated to new class name.
</ins><span class="cx"> 
</span><del>-2014-04-29  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-06-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] When pageScaleFactor * deviceScaleFactor = 1, the tile grid is completely messed up
-        https://bugs.webkit.org/show_bug.cgi?id=132368
</del><ins>+        Merge r151868
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2013-06-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::TileController):
-        The initial device scale factor was initialized to 1. We were returning the wrong zoomedOutContentsScale() and
-        contentsScale() on retina devices until the next successful scale update.
</del><ins>+            AX: Title for ListItemRole should consist of concatenated child text elements.
+            https://bugs.webkit.org/show_bug.cgi?id=117892
</ins><span class="cx"> 
</span><del>-2014-04-29  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        Remove an unused override of BlobRegistryImpl::appendStorageItems
-        https://bugs.webkit.org/show_bug.cgi?id=132365
</del><ins>+            accessibility/listitem-title.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            * accessibility/AccessibilityNodeObject.cpp:
+            (WebCore::AccessibilityNodeObject::visibleText): Add ListItemRole to set of
+            elements that concatenate their children for display purposes.
+            (WebCore::AccessibilityNodeObject::title): Ditto.
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobRegistryImpl.cpp:
-        (WebCore::BlobRegistryImpl::appendStorageItems): Deleted.
-        * platform/network/BlobRegistryImpl.h:
</del><ins>+2013-06-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Merge r151841
</ins><span class="cx"> 
</span><del>-        [Mac] tag the video layers with descriptive name to aid debugging
-        https://bugs.webkit.org/show_bug.cgi?id=132371
</del><ins>+    2013-06-20  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            [Windows] AX: Radio buttons with &quot;tab&quot; role should describe themselves as tabs
+            https://bugs.webkit.org/show_bug.cgi?id=117837
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer): Set the AVPlayerLayer
-            name in a debug build.
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-2014-04-29  Nikos Andronikos  &lt;nikos.andronikos-webkit@cisra.canon.com.au&gt;
</del><ins>+            accessibility/aria-tab-role-on-buttons.html
</ins><span class="cx"> 
</span><del>-        [GTK][cmake] CMake variable (non)expansion causing 'File name too long' build error.
-        https://bugs.webkit.org/show_bug.cgi?id=132244
</del><ins>+            * accessibility/AccessibilityNodeObject.cpp:
+            (WebCore::AccessibilityNodeObject::canSetSelectedAttribute): Indicate that certain accessibility
+            types (such as Tabs) can be selected.
+            * accessibility/AccessibilityNodeObject.h: Signature for canSelectAttribute override.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+2013-06-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Removing quotes around include directory variable ${WebCore_INCLUDE_DIRECTORIES} in
-        the include_directories cmake macro enables the variable to be expanded correctly.
</del><ins>+        Merge r151778
</ins><span class="cx"> 
</span><del>-        No tests created as this fixes a platform specific build issue.
</del><ins>+    2013-06-19  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake:
</del><ins>+            AX: List Items should support a default action
+            https://bugs.webkit.org/show_bug.cgi?id=117812
</ins><span class="cx"> 
</span><del>-2014-04-29  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        Unreviewed test fix after r167962.
-        * Modules/mediacontrols/mediaControlsApple.css:
-        (.hidden): Use common '.hidden' class for controls.
-        (video::-webkit-media-text-track-container .hidden): Deleted.
</del><ins>+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::AccessibilityObject::actionVerb): Provide a &quot;select&quot; verb
+            for use in ListItemRole objects.
+            * platform/LocalizedStrings.cpp:
+            (WebCore::AXListItemActionVerb): Added.
+            * platform/LocalizedStrings.h:
+            * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+            (WebCore::AXListItemActionVerb):
+            * platform/efl/LocalizedStringsEfl.cpp:
+            (WebCore::AXListItemActionVerb):
+            * platform/gtk/LocalizedStringsGtk.cpp:
+            (WebCore::AXListItemActionVerb):
</ins><span class="cx"> 
</span><del>-2014-04-29  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+2013-06-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Handle selection services menu.
-        &lt;rdar://problem/16727798&gt; and https://bugs.webkit.org/show_bug.cgi?id=132362
</del><ins>+        Merge r151745
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+    2013-06-19  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+            [Windows] AX: Extend notification handling
+            https://bugs.webkit.org/show_bug.cgi?id=117761.
</ins><span class="cx"> 
</span><del>-2014-04-29  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Removing unused argument in InlineFlowBox::placeBoxesInInlineDirection()
-        https://bugs.webkit.org/show_bug.cgi?id=132369
</del><ins>+            accessibility/press-works-on-control-types.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * accessibility/win/AXObjectCacheWin.cpp:
+            (WebCore::AXObjectCache::postPlatformNotification): Add handlers for more event notifications.
+            * accessibility/win/AccessibilityObjectWrapperWin.cpp:
+            (WebCore::AccessibilityObjectWrapper::accessibilityAttributeValue): Protect against null
+            pointer dereference found during testing.
+            * dom/Document.cpp:
+            (WebCore::Document::implicitClose): Execute notification handler for Windows as well as Mac.
+            * page/FrameView.cpp:
+            (WebCore::FrameView::layout): Ditto.
</ins><span class="cx"> 
</span><del>-        This was not caught by our compiler because placeBoxesInInlineDirection()
-        is mutually-recursive with placeBoxRangeInInlineDirection().
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests are necessary because there should be no behavior change.
</del><ins>+        Merge r152020
</ins><span class="cx"> 
</span><del>-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
-        (WebCore::InlineFlowBox::placeBoxRangeInInlineDirection):
-        * rendering/InlineFlowBox.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForLine):
</del><ins>+    2013-06-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Speed up SVG sprites by only painting the source rect in SVGImage::draw
+            https://bugs.webkit.org/show_bug.cgi?id=118070
</ins><span class="cx"> 
</span><del>-        [WinCairo] Switch video from GStreamer to Media Foundation.
-        https://bugs.webkit.org/show_bug.cgi?id=132358
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/d359ab67fdd76a877d666dca91c311505dd27bbf.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        Removed dependencies on GStreamer.
</del><ins>+            * svg/graphics/SVGImage.cpp:
+            (WebCore::SVGImage::draw):
</ins><span class="cx"> 
</span><del>-2014-04-29  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove some PLATFORM(IOS) #ifdefs related to hasAcceleratedTouchScrolling()
-        https://bugs.webkit.org/show_bug.cgi?id=132353
</del><ins>+        Merge r151998
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton &amp; Darin Adler.
</del><ins>+    2013-06-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Minor cleanup and refactoring to remove #idefs.
</del><ins>+            Set Attr.ownerDocument in Element#setAttributeNode()
+            https://bugs.webkit.org/show_bug.cgi?id=118031
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollTo): No need for this #ifdef, usesCompositedScrolling()
-        gives the right answser already.
-        (WebCore::RenderLayer::visibleContentRectInternal): Use showsOverflowControls() to
-        avoid #ifdef.
-        (WebCore::RenderLayer::invalidateScrollbarRect): Ditto.
-        (WebCore::RenderLayer::invalidateScrollCornerRect): Ditto.
-        (WebCore::RenderLayer::verticalScrollbarWidth): Ditto.
-        (WebCore::RenderLayer::horizontalScrollbarHeight): Ditto.
-        (WebCore::RenderLayer::showsOverflowControls): Return false on iOS.
-        (WebCore::RenderLayer::paintOverflowControls): Ditto.
-        (WebCore::RenderLayer::calculateClipRects): Ditto.
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::layerOrAncestorIsTransformedOrUsingCompositedScrolling):
-        Just #ifdef in side of this function rather than having two similar functions.
-        (WebCore::RenderLayerBacking::shouldClipCompositedBounds):
-        (WebCore::hasNonZeroTransformOrigin):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Use a local bool
-        to reduce #ifdefs.
-        (WebCore::layerOrAncestorIsTransformedOrScrolling): Deleted.
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-04-29  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/fa739fe5369f55bbdcb3fa123cb64df36b8ae414.
</ins><span class="cx"> 
</span><del>-        Remove Settings::compositedScrollingForFramesEnabled
-        https://bugs.webkit.org/show_bug.cgi?id=132352
</del><ins>+            Adopt Attr node as needed.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Test: fast/dom/Attr/set-attribute-node-from-iframe.html
</ins><span class="cx"> 
</span><del>-        The usesCompositedScrolling setting was only used by Chromium, so
-        remove it and associated code.
</del><ins>+            * dom/Element.cpp:
+            (WebCore::Element::setAttributeNode):
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::usesCompositedScrolling): Deleted.
-        * page/FrameView.h:
-        * page/Settings.in:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollLayerPosition):
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+        Merge r151997
</ins><span class="cx"> 
</span><del>-        Move removeEquivalentProperties functions to EditingStyle
-        https://bugs.webkit.org/show_bug.cgi?id=131093
</del><ins>+    2013-06-25  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Flex boxes (both old and new) don't handle max-height images correctly.
+            https://bugs.webkit.org/show_bug.cgi?id=118000
</ins><span class="cx"> 
</span><del>-        Moved the removeEquivalentProperties functions
-        from StyleProperties to EditingStyle class.
</del><ins>+            Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        * css/StyleProperties.cpp:
-        (WebCore::MutableStyleProperties::removeEquivalentProperties): Deleted.
-        * css/StyleProperties.h:
-        * editing/EditingStyle.cpp:
-        (WebCore::EditingStyle::removeStyleAddedByNode):
-        (WebCore::EditingStyle::removeStyleConflictingWithStyleOfNode):
-        (WebCore::EditingStyle::prepareToApplyAt):
-        (WebCore::EditingStyle::removeEquivalentProperties):
-        (WebCore::extractPropertiesNotIn):
-        * editing/EditingStyle.h:
</del><ins>+            Tests: css3/flexbox/image-percent-max-height.html
+                   fast/flexbox/image-percent-max-height.html
</ins><span class="cx"> 
</span><del>-2014-04-29  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::dirtyForLayoutFromPercentageHeightDescendants):
+            (WebCore::RenderBlock::layoutBlockChildren):
+            Pull the percentage height descendant code that dirties those descendants
+            out of layoutBlockChildren and into a protected helper function,
+            dirtyForLayoutFromPercentageHeightDescendants, that can be called from the 
+            flex box code.
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Implement support for compositing
-        https://bugs.webkit.org/show_bug.cgi?id=132298
</del><ins>+            Also patch dirtyForLayoutFromPercentageHeightDescendants so that it will dirty
+            preferred logical widths when a child has an aspect ratio, since we know that
+            percentage height changes will potentially affect the preferred widths of the image and
+            its ancestor blocks.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            * rendering/RenderBlock.h:
+            Declaration of the new dirtyForLayoutFromPercentageHeightDescendants function.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::accumulateOffsetTowardsAncestor):
-        Add in a case for the new columns that calls into the multi-column flow thread
-        to get an offset to adjust by.
</del><ins>+            * rendering/RenderDeprecatedFlexibleBox.cpp:
+            (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+            Make the old flex box code call dirtyForLayoutFromPercentageHeightDescendants so
+            that everything is dirtied properly.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::adjustAncestorCompositingBoundsForFlowThread):
-        Make sure this code only runs for named flow threads.
</del><ins>+            (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
+            (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
+            Remove the isReplaced()/percentage height/width dirtying now that the old flexible
+            box is using the same dirtying mechanism as RenderBlock.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::canBeComposited):
-        Turn on compositing support for in-flow RenderFlowThreads instead of always returning
-        false
</del><ins>+            * rendering/RenderFlexibleBox.cpp:
+            (WebCore::RenderFlexibleBox::layoutBlock):
+            Patch the new flexible box code to use the dirtying mechanism that RenderBlock
+            uses for percentage heights/widths on replaced descendants.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::physicalTranslationOffsetFromFlowToRegion):
-        Changed this function to fix a couple of bugs exposed by compositing/columns tests. Its
-        end goal is the same, but the approach is improved.
</del><ins>+            * rendering/RenderObject.h:
+            (WebCore::RenderObject::hasAspectRatio):
+            Pulled the static helper function from RenderReplaced into a full-blown method
+            on RenderObject, so that dirtyForLayoutFromPercentageHeightDescendants can call
+            it to check if an object has an aspect ratio.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::endFlow):
-        Don't pad out to a multiple of column height. You can't flip around a flow thread
-        to get back to accurate physical coordinates if bogus padding is introduced. This
-        seemed to have no effect on any layout tests when removed, so I don't think it 
-        was really serving any useful purpose.
</del><ins>+            * rendering/RenderReplaced.cpp:
+            (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox):
+            (WebCore::RenderReplaced::computeIntrinsicRatioInformation):
+            Patch the call sites of the static helper function to use hasAspectRatio instead
+            and get rid of the static in the cpp file.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderMultiColumnSet::columnTranslationForOffset):
-        Don't factor in the overall flow thread portion, since this is handled by the callers
-        now.
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderMultiColumnSet::adjustRegionBoundsFromFlowThreadPortionRect):
-        * rendering/RenderMultiColumnSet.h:
-        Change this function to be ASSERT_NOT_REACHED(), since we want to know if someone calls
-        it. It only runs for named flow thread compositing code, so it would be a mistake if
-        this ever gets invoked.
</del><ins>+        Merge r151994
</ins><span class="cx"> 
</span><del>-2014-04-29  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+    2013-06-26  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        JSProxies should be cacheable
-        https://bugs.webkit.org/show_bug.cgi?id=132351
</del><ins>+            [Mac] Document URL is not updated by HSTS
+            &lt;rdar://problem/14241270&gt; and https://bugs.webkit.org/show_bug.cgi?id=118003
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            Patch started by Alexey Proskuryakov, finished by Brady Eidson.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+            Reviewed by Brady Eidson and then Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Whenever we encounter a proxy in an inline cache we should try to cache on the 
-        proxy's target instead of giving up.
</del><ins>+            Synthesize a response and properly handle willSendRequest when the URL changes in a way that's typical for HSTS.
</ins><span class="cx"> 
</span><del>-        This patch adds support for a simple &quot;recursive&quot; inline cache if the base object
-        we're accessing is a pure forwarding proxy. JSGlobalObject and its subclasses 
-        are the only ones to benefit from this right now.
</del><ins>+            * platform/network/mac/WebCoreURLResponse:
+            * platform/network/mac/WebCoreURLResponse:
+            (WebCore::synthesizeRedirectResponseIfNecessary): Synthesize a redirect response and when the URL changes in a way that's
+              typical for HSTS connections.
</ins><span class="cx"> 
</span><del>-        This is performance neutral on the benchmarks we track. Currently we won't
-        cache on JSDOMWindow due to HasImpureGetOwnPropertySlot, but this issue will be fixed soon.
</del><ins>+            * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
+            (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): Call synthesizeRedirectResponseIfNecessary.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
</del><ins>+            * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
+            (-[WebCoreResourceHandleAsOperationQueueDelegate connection:willSendRequest:redirectResponse:]): Ditto.
</ins><span class="cx"> 
</span><del>-2014-04-29  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [Mac, iOS] Support caption activation via JS webkitHasClosedCaptions method
-        https://bugs.webkit.org/show_bug.cgi?id=132320
</del><ins>+        Merge r151986
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+    2013-06-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.css:
-        (video::-webkit-media-text-track-container .hidden): Added.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::configureTextTrackGroup): Added call to
-        new 'updateCaptionsContainer'.
-        (WebCore::HTMLMediaElement::updateCaptionContainer): Added.
-        * html/HTMLMediaElement.h:
-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::hide): Use CSS class .hidden instead of
-        hard-coded &quot;display:none&quot;.
-        (WebCore::MediaControlTextTrackContainerElement::show): Ditto.
-        * html/shadow/MediaControlElements.h:
</del><ins>+            Use-after-free in RadioInputType::handleKeydownEvent
+            https://bugs.webkit.org/show_bug.cgi?id=118035
</ins><span class="cx"> 
</span><del>-2014-04-28  Roger Fong  &lt;roger_fong@apple.com&gt;
</del><ins>+            Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        Plugins hidden by images should autoplay.
-        https://bugs.webkit.org/show_bug.cgi?id=132222.
-        &lt;rdar://problem/16653536&gt;
</del><ins>+            Use RefPtr for inputElement since setFocusedNode could blow it away.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jon Lee and Darin Adler.
</del><ins>+            * html/RadioInputType.cpp:
+            (WebCore::RadioInputType::handleKeydownEvent):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Add exports needed by WK2.
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</del><ins>+        Merge r151971
</ins><span class="cx"> 
</span><del>-        Use LLVM as a backend for the fourth-tier DFG JIT (a.k.a. the FTL JIT)
-        https://bugs.webkit.org/show_bug.cgi?id=112840
</del><ins>+    2013-06-25  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rubber stamped by Geoffrey Garen.
</del><ins>+            Don't snapshot plug-ins that come from the same host as the page
+            https://bugs.webkit.org/show_bug.cgi?id=117969
+            &lt;rdar://problem/12885400&gt;
</ins><span class="cx"> 
</span><del>-        It already has a lot of tests.
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
</del><ins>+            If a page is serving plug-in content directly, then that content
+            is typically very important to the page. For example, embedding
+            a video or audio player. In this case, don't snapshot the plug-ins.
</ins><span class="cx"> 
</span><del>-2014-04-29  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+            * html/HTMLPlugInImageElement.cpp:
+            (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Add a test
+            that compares the plug-in's URL against the main page's URL and don't snapshot
+            if they are the same.
</ins><span class="cx"> 
</span><del>-        Change Image Controls replacement to use selection and paste
-        &lt;rdar://problem/16302722&gt; and https://bugs.webkit.org/show_bug.cgi?id=131992
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Merge r151934
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Remove deleted symbol.
</del><ins>+    2013-06-24  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        (WebCore::ImageControlsButtonElementMac::defaultEventHandler):
</del><ins>+            Fix various crashes on sites with fixed backgrounds
+            https://bugs.webkit.org/show_bug.cgi?id=117959
</ins><span class="cx"> 
</span><del>-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::showImageControlsMenu): Select the image element
-          before showing the menu.
-        (WebCore::ContextMenuController::replaceControlledImage): Deleted.
-        * page/ContextMenuController.h:
</del><ins>+            Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-2014-04-29  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            FrameView::removeSlowRepaintObject() would assume that addSlowRepaintObject()
+            had been called before it, but this isn't always the case. For example, if
+            a page has a fixed background on the body, this falls into the accelerated
+            path in WK2 tiled mode, so addSlowRepaintObject() is never called. However,
+            we still call removeSlowRepaintObject() if the body is removed.
</ins><span class="cx"> 
</span><del>-        [iOS] Remove workaround for &lt;rdar://problem/16578727&gt;.
-        https://bugs.webkit.org/show_bug.cgi?id=132338
</del><ins>+            So null-check m_slowRepaintObjects to avoid crashing.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Test: platform/mac-wk2/tiled-drawing/fixed-background/fixed-background-removal.html
</ins><span class="cx"> 
</span><del>-        Now that &lt;rdar://problem/16578727&gt; is fixed, remove the workaround by replacing the
-        call to -_updatePlaybackControlsViewController with one to -layoutIfNeeded.
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::removeSlowRepaintObject):
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (WebVideoFullscreenInterfaceAVKit::enterFullscreen):
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        Merge r151916
</ins><span class="cx"> 
</span><del>-        ScriptExecutionContext::Task should work well with C++11 lambdas
-        https://bugs.webkit.org/show_bug.cgi?id=129795
</del><ins>+    2013-06-24  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Potential crash when in-band track is removed
+            https://bugs.webkit.org/show_bug.cgi?id=117938
+            &lt;rdar://problem/14246763&gt;
</ins><span class="cx"> 
</span><del>-        Instead of having classes that subclass ScriptExecutionContext::Task and override
-        the performTask(ScriptExecutionContext*) method, have the ScriptExecutionContext::Task
-        take in a std::function&lt;void (ScriptExecutionContext*)&gt;-like object trough the constructor
-        which would contain the code currently kept in the performTask() methods.
</del><ins>+            Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-        This enables inlining C++11 lambdas into ScriptExecutionContext::postTask() calls. For
-        cleanup tasks, the Task object can be implicitly constructed by using the initializer list
-        constructor with the first argument being the ScriptExecutionContext::Task::CleanupTask tag.
-        The ScriptExecutionContext class remains non-copyable and now stores the passed-in invokable
-        object in the std::function wrapper, along with a boolean member that indicates whether the
-        task is of cleanup nature.
</del><ins>+            This is timing dependent and I was unable to come up with a reliable test.
</ins><span class="cx"> 
</span><del>-        * Modules/quota/StorageErrorCallback.cpp:
-        (WebCore::StorageErrorCallback::CallbackTask::CallbackTask):
-        (WebCore::StorageErrorCallback::CallbackTask::performTask): Deleted.
-        * Modules/quota/StorageErrorCallback.h:
-        (WebCore::StorageErrorCallback::CallbackTask::create): Deleted.
-        * Modules/webdatabase/Database.cpp:
-        (WebCore::Database::~Database):
-        (WebCore::Database::runTransaction):
-        (WebCore::Database::scheduleTransactionCallback):
-        (WebCore::DerefContextTask::create): Deleted.
-        (WebCore::DerefContextTask::performTask): Deleted.
-        (WebCore::DerefContextTask::isCleanupTask): Deleted.
-        (WebCore::DerefContextTask::DerefContextTask): Deleted.
-        (WebCore::callTransactionErrorCallback): Deleted.
-        (WebCore::DeliverPendingCallbackTask::create): Deleted.
-        (WebCore::DeliverPendingCallbackTask::performTask): Deleted.
-        (WebCore::DeliverPendingCallbackTask::DeliverPendingCallbackTask): Deleted.
-        * Modules/webdatabase/DatabaseManager.cpp:
-        (WebCore::DatabaseManager::openDatabase):
-        (WebCore::DatabaseCreationCallbackTask::create): Deleted.
-        (WebCore::DatabaseCreationCallbackTask::performTask): Deleted.
-        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask): Deleted.
-        * Modules/webdatabase/DatabaseSync.cpp:
-        (WebCore::CloseSyncDatabaseOnContextThreadTask::create): Deleted.
-        (WebCore::CloseSyncDatabaseOnContextThreadTask::performTask): Deleted.
-        (WebCore::CloseSyncDatabaseOnContextThreadTask::CloseSyncDatabaseOnContextThreadTask): Deleted.
-        * Modules/webdatabase/SQLCallbackWrapper.h:
-        (WebCore::SQLCallbackWrapper::clear):
-        (WebCore::SQLCallbackWrapper::SafeReleaseTask::create): Deleted.
-        (WebCore::SQLCallbackWrapper::SafeReleaseTask::performTask): Deleted.
-        (WebCore::SQLCallbackWrapper::SafeReleaseTask::isCleanupTask): Deleted.
-        (WebCore::SQLCallbackWrapper::SafeReleaseTask::SafeReleaseTask): Deleted.
-        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didConnect):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessage):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didStartClosingHandshake):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessageError):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
-        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
-        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
-        (WebCore::WorkerThreadableWebSocketChannel::mainThreadDestroy):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
-        (WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::create): Deleted.
-        (WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::~WorkerGlobalScopeDidInitializeTask): Deleted.
-        (WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::WorkerGlobalScopeDidInitializeTask): Deleted.
-        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
-        * bindings/js/JSCallbackData.h:
-        (WebCore::DeleteCallbackDataTask::DeleteCallbackDataTask):
-        (WebCore::DeleteCallbackDataTask::create): Deleted.
-        (WebCore::DeleteCallbackDataTask::performTask): Deleted.
-        (WebCore::DeleteCallbackDataTask::isCleanupTask): Deleted.
-        * bindings/js/JSDOMGlobalObjectTask.cpp:
-        (WebCore::JSGlobalObjectTask::JSGlobalObjectTask):
-        (WebCore::JSGlobalObjectTask::~JSGlobalObjectTask): Deleted.
-        (WebCore::JSGlobalObjectTask::performTask): Deleted.
-        * bindings/js/JSDOMGlobalObjectTask.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::queueTaskToEventLoop):
-        * bindings/js/JSWorkerGlobalScopeBase.cpp:
-        (WebCore::JSWorkerGlobalScopeBase::queueTaskToEventLoop):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/test/JS/JSTestCallback.cpp:
-        (WebCore::JSTestCallback::~JSTestCallback):
-        (GenerateCallbackImplementation):
-        * dom/CrossThreadTask.h:
-        (WebCore::CrossThreadTask1::performTask):
-        (WebCore::CrossThreadTask2::performTask):
-        (WebCore::CrossThreadTask3::performTask):
-        (WebCore::CrossThreadTask4::performTask):
-        (WebCore::CrossThreadTask5::performTask):
-        (WebCore::CrossThreadTask6::performTask):
-        (WebCore::CrossThreadTask7::performTask):
-        (WebCore::CrossThreadTask8::performTask):
-        (WebCore::createCallbackTask):
-        (WebCore::CrossThreadTask1::create): Deleted.
-        (WebCore::CrossThreadTask2::create): Deleted.
-        (WebCore::CrossThreadTask3::create): Deleted.
-        (WebCore::CrossThreadTask4::create): Deleted.
-        (WebCore::CrossThreadTask5::create): Deleted.
-        (WebCore::CrossThreadTask6::create): Deleted.
-        (WebCore::CrossThreadTask7::create): Deleted.
-        (WebCore::CrossThreadTask8::create): Deleted.
-        * dom/Document.cpp:
-        (WebCore::Document::addConsoleMessage):
-        (WebCore::Document::addMessage):
-        (WebCore::Document::postTask):
-        (WebCore::Document::pendingTasksTimerFired):
-        (WebCore::PerformTaskContext::PerformTaskContext): Deleted.
-        (WebCore::Document::didReceiveTask): Deleted.
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::processMessagePortMessagesSoon):
-        (WebCore::ScriptExecutionContext::timerAlignmentInterval):
-        (WebCore::ProcessMessagesSoonTask::create): Deleted.
-        (WebCore::ScriptExecutionContext::AddConsoleMessageTask::performTask): Deleted.
-        (WebCore::ScriptExecutionContext::Task::~Task): Deleted.
-        * dom/ScriptExecutionContext.h:
-        (WebCore::ScriptExecutionContext::Task::Task):
-        (WebCore::ScriptExecutionContext::Task::performTask):
-        (WebCore::ScriptExecutionContext::Task::isCleanupTask):
-        (WebCore::ScriptExecutionContext::AddConsoleMessageTask::AddConsoleMessageTask):
-        (WebCore::ScriptExecutionContext::AddConsoleMessageTask::create): Deleted.
-        * dom/StringCallback.cpp:
-        (WebCore::StringCallback::scheduleCallback):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::postListenerTask):
-        (WebCore::CallCacheListenerTask::create): Deleted.
-        (WebCore::CallCacheListenerTask::CallCacheListenerTask): Deleted.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::postTaskToLoader):
-        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerGlobalScope):
-        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
-        (WebCore::SharedWorkerConnectTask::create): Deleted.
-        (WebCore::SharedWorkerConnectTask::performTask): Deleted.
-        * workers/WorkerEventQueue.cpp:
-        (WebCore::WorkerEventQueue::EventDispatcher::EventDispatcher):
-        (WebCore::WorkerEventQueue::EventDispatcher::~EventDispatcher):
-        (WebCore::WorkerEventQueue::EventDispatcher::dispatch):
-        (WebCore::WorkerEventQueue::enqueueEvent):
-        (WebCore::WorkerEventQueue::cancelEvent):
-        (WebCore::WorkerEventQueue::close):
-        * workers/WorkerEventQueue.h:
-        * workers/WorkerGlobalScope.cpp:
-        (WebCore::WorkerGlobalScope::close):
-        (WebCore::WorkerGlobalScope::postTask):
-        (WebCore::WorkerGlobalScope::addConsoleMessage):
-        (WebCore::WorkerGlobalScope::addMessage):
-        (WebCore::CloseWorkerGlobalScopeTask::create): Deleted.
-        (WebCore::CloseWorkerGlobalScopeTask::performTask): Deleted.
-        (WebCore::CloseWorkerGlobalScopeTask::isCleanupTask): Deleted.
-        * workers/WorkerGlobalScope.h:
-        * workers/WorkerLoaderProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope):
-        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerGlobalScope):
-        (WebCore::WorkerMessagingProxy::postTaskToLoader):
-        (WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
-        (WebCore::WorkerMessagingProxy::workerThreadCreated):
-        (WebCore::WorkerMessagingProxy::notifyNetworkStateChange):
-        (WebCore::WorkerMessagingProxy::workerGlobalScopeDestroyed):
-        (WebCore::WorkerMessagingProxy::workerGlobalScopeClosed):
-        (WebCore::WorkerMessagingProxy::postMessageToPageInspector):
-        (WebCore::WorkerMessagingProxy::confirmMessageFromWorkerObject):
-        (WebCore::WorkerMessagingProxy::reportPendingActivity):
-        (WebCore::MessageWorkerGlobalScopeTask::create): Deleted.
-        (WebCore::MessageWorkerGlobalScopeTask::MessageWorkerGlobalScopeTask): Deleted.
-        (WebCore::MessageWorkerGlobalScopeTask::performTask): Deleted.
-        (WebCore::MessageWorkerTask::create): Deleted.
-        (WebCore::MessageWorkerTask::MessageWorkerTask): Deleted.
-        (WebCore::MessageWorkerTask::performTask): Deleted.
-        (WebCore::WorkerExceptionTask::create): Deleted.
-        (WebCore::WorkerExceptionTask::WorkerExceptionTask): Deleted.
-        (WebCore::WorkerExceptionTask::performTask): Deleted.
-        (WebCore::WorkerGlobalScopeDestroyedTask::create): Deleted.
-        (WebCore::WorkerGlobalScopeDestroyedTask::WorkerGlobalScopeDestroyedTask): Deleted.
-        (WebCore::WorkerGlobalScopeDestroyedTask::performTask): Deleted.
-        (WebCore::WorkerTerminateTask::create): Deleted.
-        (WebCore::WorkerTerminateTask::WorkerTerminateTask): Deleted.
-        (WebCore::WorkerTerminateTask::performTask): Deleted.
-        (WebCore::WorkerThreadActivityReportTask::create): Deleted.
-        (WebCore::WorkerThreadActivityReportTask::WorkerThreadActivityReportTask): Deleted.
-        (WebCore::WorkerThreadActivityReportTask::performTask): Deleted.
-        (WebCore::PostMessageToPageInspectorTask::create): Deleted.
-        (WebCore::PostMessageToPageInspectorTask::PostMessageToPageInspectorTask): Deleted.
-        (WebCore::PostMessageToPageInspectorTask::performTask): Deleted.
-        (WebCore::NotifyNetworkStateChangeTask::create): Deleted.
-        (WebCore::NotifyNetworkStateChangeTask::NotifyNetworkStateChangeTask): Deleted.
-        (WebCore::NotifyNetworkStateChangeTask::performTask): Deleted.
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::postTask):
-        (WebCore::WorkerRunLoop::postTaskAndTerminate):
-        (WebCore::WorkerRunLoop::postTaskForMode):
-        (WebCore::WorkerRunLoop::Task::create):
-        (WebCore::WorkerRunLoop::Task::performTask):
-        (WebCore::WorkerRunLoop::Task::Task):
-        * workers/WorkerRunLoop.h:
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::stop):
-        (WebCore::WorkerThread::releaseFastMallocFreeMemoryInAllThreads):
-        (WebCore::WorkerThreadShutdownFinishTask::create): Deleted.
-        (WebCore::WorkerThreadShutdownFinishTask::performTask): Deleted.
-        (WebCore::WorkerThreadShutdownFinishTask::isCleanupTask): Deleted.
-        (WebCore::WorkerThreadShutdownStartTask::create): Deleted.
-        (WebCore::WorkerThreadShutdownStartTask::performTask): Deleted.
-        (WebCore::WorkerThreadShutdownStartTask::isCleanupTask): Deleted.
</del><ins>+            * html/track/InbandTextTrack.cpp:
+            (WebCore::InbandTextTrack::willRemoveTextTrackPrivate): Early return if the media element
+                has been cleared.
</ins><span class="cx"> 
</span><del>-2014-04-29  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox
-        https://bugs.webkit.org/show_bug.cgi?id=132337
</del><ins>+        Merge r151894
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2013-06-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        From Blink r154582 by &lt;jchaffraix@chromium.org&gt;
</del><ins>+            Hittest finds the truncated text instead of the floating input, when the input is clicked.
+            https://bugs.webkit.org/show_bug.cgi?id=115675
</ins><span class="cx"> 
</span><del>-        This is a regression from the changes in OrderIterator. The issue is
-        that we don't invalidate our iterator when a child is removed. This
-        means that we could hold onto free'd memory until the next layout
-        when we will recompute the iterator.
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        The solution is simple: just clear the memory when we remove a child.
</del><ins>+            Ignore truncated text on inline textbox and everything beyond the ellipsis box on
+            the root inlinebox while hittesting. (provided that nodeAtPoint finds no hit for any of
+            the root inline's children.)
</ins><span class="cx"> 
</span><del>-        Note that RenderGrid is not impacted by this bug as we don't use the
-        iterator outside layout yet, but if we do it at some point the very same
-        problem will arise, so the same treatment was applied to the class.
</del><ins>+            Test: fast/css/text-overflow-ellipsis-and-floating-input-hittest.html
</ins><span class="cx"> 
</span><del>-        Test: fast/flexbox/order-iterator-crash.html
</del><ins>+            * rendering/InlineFlowBox.cpp:
+            (WebCore::InlineFlowBox::nodeAtPoint):
+            * rendering/InlineTextBox.cpp:
+            (WebCore::InlineTextBox::nodeAtPoint):
+            (WebCore::InlineTextBox::paint):
</ins><span class="cx"> 
</span><del>-        * rendering/OrderIterator.cpp:
-        (WebCore::OrderIterator::invalidate): Clear m_children Vector.
-        * rendering/OrderIterator.h:
-        (WebCore::OrderIteratorPopulator::OrderIteratorPopulator): Use
-        invalidate() method.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::removeChild): Invalidate m_orderIterator.
-        * rendering/RenderFlexibleBox.h: Add removeChild() signature.
-        * rendering/RenderGrid.cpp: Invalidate m_orderIterator.
-        (WebCore::RenderGrid::removeChild):
-        * rendering/RenderGrid.h: Add removeChild() header.
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        Merge r151879
</ins><span class="cx"> 
</span><del>-        iOS build fix after http://trac.webkit.org/changeset/167937.
-        Unreviewed.
</del><ins>+    2013-06-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::adjustButtonStyle):
</del><ins>+            Followup from r151877 .
+            Fix crash in fast/frames/iframe-access-screen-of-deleted.html by null-checking the widget.
</ins><span class="cx"> 
</span><del>-2014-04-29  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+            * platform/mac/PlatformScreenMac.mm:
+            (WebCore::screenForWidget):
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] off-by-one error in Shape::createRasterShape()
-        https://bugs.webkit.org/show_bug.cgi?id=132154
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+        Merge r151877
</ins><span class="cx"> 
</span><del>-        This is a port of a patch for a bug that was reported by and fixed in Blink by
-        David Vest: https://codereview.chromium.org/237123002/.  Shape::createRasterShape()
-        now consistently reports &quot;end-point exclusive&quot; intervals. Before the patch
-        an entire row of pixels was above the shape-image-threshold, the interval's end
-        index was reported as image.width. Now it's image.width + 1, which is consistent
-        with the way the end index is reported if the last above threshold pixel is within
-        an image row.
</del><ins>+    2013-06-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Two existing tests were revised to account for this change.
</del><ins>+            screen.availWidth always returns width of primary display
+            https://bugs.webkit.org/show_bug.cgi?id=117863
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/RasterShape.cpp:
-        (WebCore::RasterShape::getExcludedIntervals):
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createRasterShape):
</del><ins>+            Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-2014-04-29  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+            In WebKit2, Widgets have no platformWidget, so trying to get to the
+            NSScreen via the platform widget's window never succeeded, and we always
+            fell back on getting info for the main display.
</ins><span class="cx"> 
</span><del>-        Wrap CSS length conversion arguments in an object
-        https://bugs.webkit.org/show_bug.cgi?id=131552
</del><ins>+            However, we were already pushing the WKView's displayID down to the
+            WebProcess for the requestAnimationFrame infrastructure, so use that.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Add a virtual function on Widget windowDisplayID(), that is overridden
+            in FrameView to return the PlatformDisplayID which Page has.
</ins><span class="cx"> 
</span><del>-        This patch introduces a class CSSToLengthConversionData to wrap the
-        data required to convert CSS lengths to Lengths. This simplifies the
-        plumbing that goes on whenever we need to resolve CSS lengths and
-        makes it easier to update the arguments needed for resolving these (in
-        particular adding a RenderView for resolving viewport units at style
-        recalc time; removing the computingFontSize bool also appears
-        possible).
</del><ins>+            Fix PlatformScreenMac to fall back to Widget::windowDisplayID() when it fails
+            to get an NSWindow from the Widget.
</ins><span class="cx"> 
</span><del>-        Note that the zoom argument, which was previously a float in some
-        places and a double in others is now a float.
</del><ins>+            Add a utility category on NSScreen to get an NSScreen's displayID, and to
+            find an NSScreen given a displayID.
</ins><span class="cx"> 
</span><del>-        This is a port of a Blink patch by timloh@chromium.org.
</del><ins>+            * WebCore.exp.in:
+            * WebCore.xcodeproj/project.pbxproj:
+            * page/FrameView.cpp:
+            (WebCore::FrameView::windowDisplayID):
+            * page/FrameView.h:
+            * platform/Widget.cpp:
+            (WebCore::Widget::windowDisplayID):
+            * platform/Widget.h:
+            * platform/mac/PlatformScreenMac.h: Added.
+            * platform/mac/PlatformScreenMac.mm:
+            (+[NSScreen screenForDislayID:]):
+            (-[NSScreen displayID]):
+            (WebCore::screenRect):
+            (WebCore::screenAvailableRect):
+            * platform/mac/WidgetMac.mm:
+            (WebCore::Widget::windowDisplayID):
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/BasicShapeFunctions.cpp:
-        (WebCore::convertToLength):
-        (WebCore::convertToLengthSize):
-        (WebCore::convertToCenterCoordinate):
-        (WebCore::cssValueToBasicShapeRadius):
-        (WebCore::basicShapeForValue):
-        * css/BasicShapeFunctions.h:
-        * css/CSSCalculationValue.cpp:
-        (WebCore::CSSCalcValue::computeLengthPx):
-        (WebCore::determineCategory):
-        * css/CSSCalculationValue.h:
-        (WebCore::CSSCalcValue::createCalculationValue):
-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::addStops):
-        (WebCore::positionFromValue):
-        (WebCore::CSSGradientValue::computeEndPoint):
-        (WebCore::CSSLinearGradientValue::createGradient):
-        (WebCore::CSSRadialGradientValue::resolveRadius):
-        (WebCore::CSSRadialGradientValue::createGradient):
-        * css/CSSGradientValue.h:
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::computeLength):
-        (WebCore::CSSPrimitiveValue::computeLengthDouble):
-        * css/CSSPrimitiveValue.h:
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::convertToLength):
-        * css/CSSToLengthConversionData.cpp: Added.
-        (WebCore::CSSToLengthConversionData::zoom):
-        * css/CSSToLengthConversionData.h: Added.
-        (WebCore::CSSToLengthConversionData::CSSToLengthConversionData):
-        (WebCore::CSSToLengthConversionData::style):
-        (WebCore::CSSToLengthConversionData::rootStyle):
-        (WebCore::CSSToLengthConversionData::computingFontSize):
-        (WebCore::CSSToLengthConversionData::copyWithAdjustedZoom):
-        * css/CSSToStyleMap.cpp:
-        (WebCore::CSSToStyleMap::CSSToStyleMap):
-        (WebCore::CSSToStyleMap::mapFillSize):
-        (WebCore::CSSToStyleMap::mapFillXPosition):
-        (WebCore::CSSToStyleMap::mapFillYPosition):
-        (WebCore::CSSToStyleMap::mapNinePieceImageQuad):
-        * css/CSSToStyleMap.h:
-        (WebCore::CSSToStyleMap::CSSToStyleMap): Deleted.
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyAuto::applyValue):
-        (WebCore::ApplyPropertyClip::convertToLength):
-        (WebCore::ApplyPropertyLength::applyValue):
-        (WebCore::ApplyPropertyBorderRadius::applyValue):
-        (WebCore::ApplyPropertyComputeLength::applyValue):
-        (WebCore::ApplyPropertyFontSize::applyValue):
-        (WebCore::csstoLengthConversionDataWithTextZoomFactor):
-        (WebCore::ApplyPropertyMarqueeIncrement::applyValue):
-        (WebCore::ApplyPropertyLineHeight::applyValue):
-        (WebCore::ApplyPropertyLineHeightForIOSTextAutosizing::applyValue):
-        (WebCore::ApplyPropertyWordSpacing::applyValue):
-        (WebCore::ApplyPropertyPageSize::mmLength):
-        (WebCore::ApplyPropertyPageSize::inchLength):
-        (WebCore::ApplyPropertyPageSize::applyValue):
-        (WebCore::ApplyPropertyVerticalAlign::applyValue):
-        (WebCore::ApplyPropertyClipPath::applyValue):
-        (WebCore::ApplyPropertyShape::applyValue):
-        (WebCore::ApplyPropertyTextIndent::applyValue):
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::colorMediaFeatureEval):
-        (WebCore::color_indexMediaFeatureEval):
-        (WebCore::monochromeMediaFeatureEval):
-        (WebCore::orientationMediaFeatureEval):
-        (WebCore::aspect_ratioMediaFeatureEval):
-        (WebCore::device_aspect_ratioMediaFeatureEval):
-        (WebCore::device_pixel_ratioMediaFeatureEval):
-        (WebCore::resolutionMediaFeatureEval):
-        (WebCore::gridMediaFeatureEval):
-        (WebCore::computeLength):
-        (WebCore::device_heightMediaFeatureEval):
-        (WebCore::device_widthMediaFeatureEval):
-        (WebCore::heightMediaFeatureEval):
-        (WebCore::widthMediaFeatureEval):
-        (WebCore::min_colorMediaFeatureEval):
-        (WebCore::max_colorMediaFeatureEval):
-        (WebCore::min_color_indexMediaFeatureEval):
-        (WebCore::max_color_indexMediaFeatureEval):
-        (WebCore::min_monochromeMediaFeatureEval):
-        (WebCore::max_monochromeMediaFeatureEval):
-        (WebCore::min_aspect_ratioMediaFeatureEval):
-        (WebCore::max_aspect_ratioMediaFeatureEval):
-        (WebCore::min_device_aspect_ratioMediaFeatureEval):
-        (WebCore::max_device_aspect_ratioMediaFeatureEval):
-        (WebCore::min_device_pixel_ratioMediaFeatureEval):
-        (WebCore::max_device_pixel_ratioMediaFeatureEval):
-        (WebCore::min_heightMediaFeatureEval):
-        (WebCore::max_heightMediaFeatureEval):
-        (WebCore::min_widthMediaFeatureEval):
-        (WebCore::max_widthMediaFeatureEval):
-        (WebCore::min_device_heightMediaFeatureEval):
-        (WebCore::max_device_heightMediaFeatureEval):
-        (WebCore::min_device_widthMediaFeatureEval):
-        (WebCore::max_device_widthMediaFeatureEval):
-        (WebCore::min_resolutionMediaFeatureEval):
-        (WebCore::max_resolutionMediaFeatureEval):
-        (WebCore::animationMediaFeatureEval):
-        (WebCore::transitionMediaFeatureEval):
-        (WebCore::transform_2dMediaFeatureEval):
-        (WebCore::transform_3dMediaFeatureEval):
-        (WebCore::view_modeMediaFeatureEval):
-        (WebCore::video_playable_inlineMediaFeatureEval):
-        (WebCore::hoverMediaFeatureEval):
-        (WebCore::pointerMediaFeatureEval):
-        (WebCore::MediaQueryEvaluator::eval):
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::StyleResolver::applySVGProperty):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::State::clear):
-        (WebCore::StyleResolver::State::initForStyleResolve):
-        (WebCore::StyleResolver::convertToIntLength):
-        (WebCore::StyleResolver::convertToFloatLength):
-        (WebCore::createGridTrackBreadth):
-        (WebCore::StyleResolver::applyProperty):
-        (WebCore::StyleResolver::createFilterOperations):
-        * css/StyleResolver.h:
-        (WebCore::StyleResolver::State::setStyle):
-        (WebCore::StyleResolver::State::cssToLengthConversionData):
-        * css/TransformFunctions.cpp:
-        (WebCore::convertToFloatLength):
-        (WebCore::transformsForValue):
-        * css/TransformFunctions.h:
-        * css/WebKitCSSMatrix.cpp:
-        (WebCore::WebKitCSSMatrix::setMatrixValue):
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::applyCommonButtonPaddingToStyle):
-        (WebCore::RenderThemeIOS::adjustButtonStyle):
</del><ins>+        Merge r151875
</ins><span class="cx"> 
</span><del>-2014-04-29  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+    2013-06-21  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] complex calc args for inset round vanish
-        https://bugs.webkit.org/show_bug.cgi?id=132293
</del><ins>+            Crashes due to NULL dereference beneath WebCore::StyleResolver::loadPendingSVGDocuments and related functions
+            https://bugs.webkit.org/show_bug.cgi?id=117903
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        In order to use calc in the rounded parameters for inset shapes, we need
-        to pass RenderStyle for the value creation as we did for the width arguments.
-        Without taking RenderStyle into account, we hit an assert not reache
-        in CSSPrimitiveValue::init in the debug builds.
</del><ins>+            * css/StyleResolver.cpp:
+            (WebCore::StyleResolver::loadPendingSVGDocuments): Add a NULL check for
+            RenderStyle here...
+            (WebCore::StyleResolver::loadPendingResources): ...and here.
</ins><span class="cx"> 
</span><del>-        I've added new parsing test.
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/BasicShapeFunctions.cpp:
-        (WebCore::valueForBasicShape):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::init):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::create):
-        * css/CSSValuePool.h:
-        (WebCore::CSSValuePool::createValue):
</del><ins>+        Merge r151873
</ins><span class="cx"> 
</span><del>-2014-04-29  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+    2013-06-21  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] complex calc values for shape-margin return null for computed style
-        https://bugs.webkit.org/show_bug.cgi?id=132313
</del><ins>+            Occasional crash swiping between pages
+            https://bugs.webkit.org/show_bug.cgi?id=117902
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+            Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        We need to pass RenderStyle* to the cssValuePool when parsing
-        shape-margin in order to use calc() as a parameter.
</del><ins>+            m_scrollingStateTree-&gt;rootStateNode() can be null when quickly swiping between pages,
+            so check this in ScrollingCoordinatorMac::commitTreeState().
</ins><span class="cx"> 
</span><del>-        I've added the new test case to parsing-shape-margin.html
</del><ins>+            * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+            (WebCore::ScrollingCoordinatorMac::commitTreeState):
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-29  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Merge r151852
</ins><span class="cx"> 
</span><del>-        AX: Row span info is wrong for table cells when a footer section is placed above a body section
-        https://bugs.webkit.org/show_bug.cgi?id=131832
</del><ins>+    2013-06-21  James Craig  &lt;james@cookiecrook.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+            AX: audio/video playback control timers (elapsed and remaining) should be exposed as ApplicationTimerRole
+            https://bugs.webkit.org/show_bug.cgi?id=117883
</ins><span class="cx"> 
</span><del>-        If a &lt;footer&gt; section is placed before the body, it renders AX row information and order incorrectly.
-        This also affects ARIA tables because they add their children by looking at renderer children, instead
-        interrogating the RenderTable directly.
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/table-with-footer-section-above-body.html
</del><ins>+            Some of the media controls were returning the wrong role. Updated existing test coverage.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityARIAGrid.cpp:
-        (WebCore::AccessibilityARIAGrid::addTableCellChild):
-        (WebCore::AccessibilityARIAGrid::addChildren):
-        * accessibility/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::addChildren):
-        (WebCore::AccessibilityTable::addChildrenFromSection):
-        * accessibility/AccessibilityTable.h:
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::rowIndexRange):
-        (WebCore::AccessibilityTableCell::columnIndexRange):
</del><ins>+            * accessibility/AccessibilityMediaControls.h:
+            (WebCore::AccessibilityMediaTimeDisplay::roleValue):
</ins><span class="cx"> 
</span><del>-2014-04-29  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        AX: SpeechSynthesisUtterance cannot addEventListener
-        https://bugs.webkit.org/show_bug.cgi?id=132321
</del><ins>+        Merge r151836
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+    2013-06-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Modified an existing test (speech-synthesis-speak.html) to use addEventTarget.
</del><ins>+            Rollout r150602: Restoring text-overflow vs. floating rendering behaviour.
+            https://bugs.webkit.org/show_bug.cgi?id=117871
</ins><span class="cx"> 
</span><del>-        * Modules/speech/SpeechSynthesisUtterance.idl:
</del><ins>+            Unreviewed. Rolling out r150602.
+            Undesirable rendering behaviour.
</ins><span class="cx"> 
</span><del>-2014-04-29  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::RenderBlock::checkLinesForTextOverflow):
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] shape-outside polygon fails when first vertex is 0,0
-        https://bugs.webkit.org/show_bug.cgi?id=132132
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+        Merge r151832
</ins><span class="cx"> 
</span><del>-        ShapeInterval now distinguishes between x1==x2 - isEmpty() and x1,x2 haven't been
-        set yet - isUndefined(). Removed the ShapeInterval setX1() and setX2() methods, since
-        they're no longer used.
</del><ins>+    2013-06-21  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        The polygon algorithm for computing excluded intervals now ignores horizontal
-        edges. It also ignores edges whose lower vertex matches the top of the line, if
-        the edge's Y direction is upwards (away from the top of the line). The rationale
-        for this was explained here:
-        http://hansmuller-webkit.blogspot.com/2012/11/revised-horizontal-box-algorithm.html
</del><ins>+            REGRESSION (r150663): Using webkitAudioContext in Inspector makes it undefined everywhere
+            https://bugs.webkit.org/show_bug.cgi?id=117825
</ins><span class="cx"> 
</span><del>-        Test: fast/shapes/shape-outside-floats/shape-outside-polygon-zero-vertex.html
</del><ins>+            Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/PolygonShape.cpp:
-        (WebCore::OffsetPolygonEdge::clippedEdgeXRange):
-        (WebCore::PolygonShape::getExcludedIntervals):
-        * rendering/shapes/ShapeInterval.h:
-        (WebCore::ShapeInterval::ShapeInterval):
-        (WebCore::ShapeInterval::isUndefined):
-        (WebCore::ShapeInterval::x1):
-        (WebCore::ShapeInterval::x2):
-        (WebCore::ShapeInterval::width):
-        (WebCore::ShapeInterval::isEmpty):
-        (WebCore::ShapeInterval::setX1):
-        (WebCore::ShapeInterval::setX2):
-        (WebCore::ShapeInterval::overlaps):
-        (WebCore::ShapeInterval::contains):
-        (WebCore::ShapeInterval::unite):
</del><ins>+            Partially revert r150663 so that we use Settings to enable WebAudio instead of
+            RuntimeEnabledFeatures.
</ins><span class="cx"> 
</span><del>-2014-04-29  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+            Introduce a new [EnabledBySetting] IDL extended attribute which behaves similarly to
+            the existing [EnabledAtRuntime] but relies on Settings instead of RuntimeEnabledFeatures
+            to determine if the feature should be enabled. Make use of this new IDL attribute for
+            webkitAudioContext interface.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Fix getClientRects() for content nodes
-        https://bugs.webkit.org/show_bug.cgi?id=117407
</del><ins>+            No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            * Modules/webaudio/AudioContext.idl:
+            * WebCore.exp.in:
+            * WebCore.order:
+            * bindings/generic/RuntimeEnabledFeatures.cpp:
+            * bindings/generic/RuntimeEnabledFeatures.h:
+            * bindings/scripts/CodeGeneratorJS.pm:
+            (GenerateImplementation):
+            * bindings/scripts/IDLAttributes.txt:
+            * bindings/scripts/preprocess-idls.pl:
+            (GenerateConstructorAttribute):
+            * bindings/scripts/test/JS/JSTestObj.cpp:
+            (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
+            (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
+            * bindings/scripts/test/JS/JSTestObj.h:
+            * bindings/scripts/test/ObjC/DOMTestObj.h:
+            * bindings/scripts/test/ObjC/DOMTestObj.mm:
+            (-[DOMTestObj TestSubObjEnabledBySetting]):
+            (-[DOMTestObj setTestSubObjEnabledBySetting:]):
+            * bindings/scripts/test/TestObj.idl:
+            * page/Settings.in:
</ins><span class="cx"> 
</span><del>-        This patch modifies getClientRects() to return a list of fragments
-        for a fragmented box instead of a single rectangle positioned inside
-        the region where the box center would appear.
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The approach is to split the border box of the element in regions using
-        the layout positioning. Then each fragment is mapped to the view coordinates
-        and the result added to the list of rectangles. To preserve the originating
-        region when mapping the fragment through the ancestor tree I've introduced
-        the concept of a current region. The current region is stored inside a
-        CurrentRenderRegionMaintainer object, created whenever an algorithm needing
-        it needs to run. When the maintainer is destroyed, the cleanup is made
-        automatically. The RenderFlowThread holds a pointer to this structure for
-        easy access.
</del><ins>+        Merge r151822
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/cssom/client-rects-fixed-content.html
-               fast/regions/cssom/client-rects-forced-breaks.html
-               fast/regions/cssom/client-rects-inline-complex.html
-               fast/regions/cssom/client-rects-inline.html
-               fast/regions/cssom/client-rects-nested-regions.html
-               fast/regions/cssom/client-rects-positioned.html
-               fast/regions/cssom/client-rects-relative-position.html
-               fast/regions/cssom/client-rects-simple-block.html
-               fast/regions/cssom/client-rects-transforms.html
-               fast/regions/cssom/client-rects-unsplittable-float.html
</del><ins>+    2013-06-20  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::absoluteQuads): Split the box in fragments.
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::absoluteQuads): Split the box in fragments.
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::RenderFlowThread):
-        (WebCore::RenderFlowThread::mapFromFlowToRegion):
-        (WebCore::RenderFlowThread::mapLocalToContainer):
-        (WebCore::RenderFlowThread::currentRegion):
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::absoluteQuadsForBoxInRegion): Get
-        the fragments for this box in the region.
-        * rendering/RenderNamedFlowFragment.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::absoluteQuadsForBox): Virtual function
-        that can be used to implement fragments to client rects mapping.
-        * rendering/RenderNamedFlowThread.h:
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::rectFlowPortionForBox): Small change to correctly
-        map empty rectangles to containers.
-        (WebCore::CurrentRenderRegionMaintainer::CurrentRenderRegionMaintainer):
-        (WebCore::CurrentRenderRegionMaintainer::~CurrentRenderRegionMaintainer):
-        * rendering/RenderRegion.h:
-        (WebCore::RenderRegion::absoluteQuadsForBoxInRegion):
-        (WebCore::CurrentRenderRegionMaintainer::region):
</del><ins>+            REGRESSION(r145788): mouse drag on canvas shouldn't start selection
+            https://bugs.webkit.org/show_bug.cgi?id=117860
</ins><span class="cx"> 
</span><del>-2014-04-29  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Store the containing region map inside the flow thread
-        https://bugs.webkit.org/show_bug.cgi?id=131647
</del><ins>+            Like HTMLImageElement, HTMLCanvasElement shouldn't start selection.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+            Also uninline some virtual function overrides.
</ins><span class="cx"> 
</span><del>-        The patch moves the containing region map inside the flow thread where
-        it can be better handled in case the region chain changes and the map
-        needs to be cleared.
</del><ins>+            Test: fast/events/mosuedrag-on-canvas-should-not-start-selection.html
</ins><span class="cx"> 
</span><del>-        As a result of this move we are able to also cleanup the lines region
-        information of a block flow when it is removed from the tree.
</del><ins>+            * html/HTMLCanvasElement.cpp:
+            (WebCore::HTMLCanvasElement::areAuthorShadowsAllowed):
+            (WebCore::HTMLCanvasElement::canContainRangeEndPoint):
+            (WebCore::HTMLCanvasElement::canStartSelection):
+            * html/HTMLCanvasElement.h:
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/inline-strike-through.html
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::InlineFlowBox):
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::addOverflowFromInlineChildren):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::removeFlowChildInfo):
-        (WebCore::RenderFlowThread::invalidateRegions):
-        (WebCore::RenderFlowThread::removeLineRegionInfo):
-        (WebCore::RenderFlowThread::checkLinesConsistency):
-        (WebCore::RenderFlowThread::containingRegionMap):
-        * rendering/RenderFlowThread.h:
-        * rendering/RootInlineBox.cpp:
-        (WebCore::containingRegionMap):
-        (WebCore::RootInlineBox::~RootInlineBox):
-        (WebCore::RootInlineBox::paint):
-        (WebCore::RootInlineBox::containingRegion):
-        (WebCore::RootInlineBox::clearContainingRegion):
-        (WebCore::RootInlineBox::setContainingRegion):
</del><ins>+        Merge r151821
</ins><span class="cx"> 
</span><del>-2014-04-28  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+    2013-06-20  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        SelectorCodeGenerator::generateElementIsNthChild() leaks the parent register :nth-child() is non-filtering
-        https://bugs.webkit.org/show_bug.cgi?id=132311
</del><ins>+            REGRESSION(r149652): accessing items in .children via id doesn't work when element is not rooted in DOM tree
+            https://bugs.webkit.org/show_bug.cgi?id=117836
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        In two cases, the parent register was never returned to the register allocator:
-        -Non filtering selectors (the early return).
-        -Non marking selectors (at the moment: only querySelector API).
</del><ins>+            When the root node of a HTML collection is not in the document or in a shadow tree,
+            we shouldn't use its tree scope's id and name maps to find name getters.
</ins><span class="cx"> 
</span><del>-        Unfortunately, generateElementIsNthChild() makes function call, which forces us to do this manual allocation
-        of the parentElement register. Long term, I want RegisterAllocator and FunctionCall to have a special type for that.
</del><ins>+            Always use the slow path in such cases.
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/several-nth-child.html
</del><ins>+            Test: fast/dom/htmlallcollection-detached-node-children.html
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild):
</del><ins>+            * html/HTMLCollection.cpp:
+            (WebCore::HTMLCollection::namedItem):
</ins><span class="cx"> 
</span><del>-2014-04-28  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        CSS JIT: backtracking with current / parent element for child
-        https://bugs.webkit.org/show_bug.cgi?id=132057
</del><ins>+        Merge r151812
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+    2013-06-20  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Calculate appropriate backtracking start height from the closest
-        descendant. And at first, we use it for a simple optimization.
</del><ins>+            https://bugs.webkit.org/show_bug.cgi?id=116495
+            Fix null-pointer deref in DocumentLoader::responseReceived()
</ins><span class="cx"> 
</span><del>-        1. When backtracking start height equals to current height, we
-        can simply jump to a descendant element check phase.
-        2. When backtracking start height equals to current height + 1, we
-        can simply jump to a descendant element traversing phase.
</del><ins>+            Patch by Nate Chapin, reviewed by Mike West and myself.
</ins><span class="cx"> 
</span><del>-        We can apply this optimization to fragments with adjacent combinators.
-        But, in the meantime, we start to implement it for a fragment with
-        child combinator.
</del><ins>+            Test: http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event.html
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
-        (WebCore::SelectorCompiler::TagNamePattern::TagNamePattern):
-        (WebCore::SelectorCompiler::solveDescendantBacktrackingActionForChild):
-        (WebCore::SelectorCompiler::solveBacktrackingAction):
-        (WebCore::SelectorCompiler::equalTagNames):
-        (WebCore::SelectorCompiler::equalTagNamePatterns):
-        (WebCore::SelectorCompiler::computeBacktrackingStartHeightFromDescendant):
-        (WebCore::SelectorCompiler::computeBacktrackingHeightFromDescendant):
-        (WebCore::SelectorCompiler::requiresAdjacentTail):
-        (WebCore::SelectorCompiler::requiresDescendantTail):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToParentNode):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToParentElement):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateParentElementTreeWalker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAncestorTreeWalker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
</del><ins>+            * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::responseReceived): Added
+            a null check.
</ins><span class="cx"> 
</span><del>-2014-04-28  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Restore the scroll position and scale from the HistoryItem (mostly)
-        https://bugs.webkit.org/show_bug.cgi?id=132307
</del><ins>+        Merge r151807
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2013-06-20  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+            Initial advance on the first glyph of the run is not correctly set for rtl text.
+            https://bugs.webkit.org/show_bug.cgi?id=117839
+            &lt;rdar://problem/13860717&gt;
</ins><span class="cx"> 
</span><del>-2014-04-28  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Scrollbars do not update properly when topContentInset changes dynamically
-        https://bugs.webkit.org/show_bug.cgi?id=132309
-        -and corresponding-
-        &lt;rdar://problem/16642232&gt;
</del><ins>+            We need to set the initial advance to the glyphBuffer, using the
+            initial advance of the complex run that will be drawn first.
+            In order to choose the run correctly we must consider the text direction.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Test: fast/text/complex-first-glyph-with-initial-advance.html
</ins><span class="cx"> 
</span><del>-        It is not sufficient to do a layout and call updateScrollbars(). We must also call 
-        RenderLayerCompositor::frameViewDidChangeSize() in order to properly adjust the 
-        size and position of all of the scrolling-related layers.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::topContentInsetDidChange):
</del><ins>+            * platform/graphics/mac/ComplexTextController.cpp:
+            (WebCore::ComplexTextController::advance):
</ins><span class="cx"> 
</span><del>-2014-04-28  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] event.offsetX/offsetY don't work correctly
-        https://bugs.webkit.org/show_bug.cgi?id=132284
</del><ins>+        Merge r151804
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2013-06-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
-        Change the code here to only trigger for CSS Regions and not for
-        multi-column. Add a FIXME pointing out that the code is broken even for
-        CSS regions.
</del><ins>+            FrameView needs to initialize paintsEntireContents on creation
+            https://bugs.webkit.org/show_bug.cgi?id=117844
</ins><span class="cx"> 
</span><del>-         * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::mapAbsoluteToLocalPoint):
-        Override mapAbsoluteToLocalPoint in order to guess a region and attempt
-        to translate the point from that region to the flow thread local coordinate
-        space.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderMultiColumnFlowThread::physicalTranslationFromRegionToFlow):
-        * rendering/RenderMultiColumnFlowThread.h:
-        New helper function that just wraps calling the region's logical translation
-        function and converting to/from physical coordinates.
</del><ins>+            In WebKit1, if the WebView is layer-backed, WebHTMLView gets a layer.
+            In this mode, FrameView::paintsEntireContents() is true. However,
+            we would only call setPaintsEntireContents(true) on the FrameView
+            when the view's layer-backed status changes. FrameView also needs
+            to fetch this state when it is initialized, because we may be creating
+            a new FrameView for an already layer-backed WebHTMLView.
</ins><span class="cx"> 
</span><del>-2014-04-28  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            * page/ChromeClient.h:
+            (WebCore::ChromeClient::shouldPaintEntireContents):
+            * page/FrameView.cpp:
+            (WebCore::FrameView::init):
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167857.
-        https://bugs.webkit.org/show_bug.cgi?id=132305
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        the change was rolled out, roll out the new expectations as
-        well (Requested by thorton on #webkit).
</del><ins>+        Merge r151803
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+    2013-06-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Unreviewed. Updating one bindings test baseline after
-        r167855.&quot;
-        http://trac.webkit.org/changeset/167857
</del><ins>+            Sticky elements are missing or misplaced sometimes when reloading a page that scrolls to a named anchor
+            https://bugs.webkit.org/show_bug.cgi?id=117819
</ins><span class="cx"> 
</span><del>-2014-04-28  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        [Mac] Use the animated version of setHighlighted on NSButtonCell where available
-        https://bugs.webkit.org/show_bug.cgi?id=132295
-        &lt;rdar://problem/16747240&gt;
</del><ins>+            At the end of FrameView::performPostLayoutTasks() we call scrollToAnchor() which attempts
+            to restore the scroll position to a named anchor, even when the document has been
+            changed by layout. This ends up in a call to ScrollView::scrollTo(), which in turn
+            calls repaintFixedElementsAfterScrolling(). However, repaintFixedElementsAfterScrolling()
+            would bail if m_nestedLayoutCount != 0, so we never updated layer positions which
+            depend on scroll position (but which would not be updated by layout, since their
+            renderers are not marked for layout when scrolling happens).
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+            We've solved this problem once before in updateFixedElementsAfterScrolling() which
+            checks for m_nestedLayoutCount &lt;= 1, so that we do work on the outermost nested layout.
+            Apply that same fix to repaintFixedElementsAfterScrolling().
</ins><span class="cx"> 
</span><del>-        Like setState, there is an animated version of setHighlighted available.
</del><ins>+            Very timing-dependent, so hard to make a test.
</ins><span class="cx"> 
</span><del>-        * platform/mac/ThemeMac.mm:
-        (WebCore::updateStates): Use private version of _setHighlighted where possible.
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::repaintFixedElementsAfterScrolling):
</ins><span class="cx"> 
</span><del>-2014-04-28  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167855.
-        https://bugs.webkit.org/show_bug.cgi?id=132301
</del><ins>+        Merge r151796
</ins><span class="cx"> 
</span><del>-        Broke the windows build (Requested by bfulgham on #webkit).
</del><ins>+    2013-06-20  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+            ASSERT removing then adding a &lt;track&gt; element
+            https://bugs.webkit.org/show_bug.cgi?id=117814
</ins><span class="cx"> 
</span><del>-        &quot;ScriptExecutionContext::Task should work well with C++11
-        lambdas&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=129795
-        http://trac.webkit.org/changeset/167855
</del><ins>+            Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-2014-04-24  Andy Estes  &lt;aestes@apple.com&gt;
</del><ins>+            Test: media/track/add-and-remove-track.html
</ins><span class="cx"> 
</span><del>-        [iOS] Implement WebQuickLookHandleClient for WebKit2
-        https://bugs.webkit.org/show_bug.cgi?id=132157
</del><ins>+            * html/HTMLTrackElement.cpp:
+            (WebCore::HTMLTrackElement::insertedInto): Always call ensureTrack before adding the track
+                to the parent &lt;video&gt; element.
+            (WebCore::HTMLTrackElement::ensureTrack): Call m_track-&gt;setTrackElement() in case the
+                parent was cleared after m_track was created.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * html/track/LoadableTextTrack.cpp:
+            (WebCore::LoadableTextTrack::setTrackElement): New, set m_trackElement.
+            * html/track/LoadableTextTrack.h:
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Exported QuickLookHandle::previewUTI().
-        * platform/network/ios/QuickLook.h:
-        * platform/network/ios/QuickLook.mm:
-        (WebCore::QuickLookHandle::previewFileName): Changed to return a WTF::String.
-        (WebCore::QuickLookHandle::previewUTI): Added.
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-28  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Merge r151793
</ins><span class="cx"> 
</span><del>-        REGRESSION: Intermittent crash in SpeechSynthesis::didFinishSpeaking
-        https://bugs.webkit.org/show_bug.cgi?id=111613
</del><ins>+    2013-06-20  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mark Lam.
</del><ins>+            [Mac] Downloaded file name encoding is incorrect when download link opens in a new window
+            https://bugs.webkit.org/show_bug.cgi?id=117818
+            &lt;rdar://problem/14212635&gt;
</ins><span class="cx"> 
</span><del>-        I think it's possible that didFinishSpeaking ends up calling directly back into start speaking, and the utterance reference
-        we were holding can get cleared, so protecting this should avoid a few asserts.
</del><ins>+            Reviewed by Brady Eidson.
</ins><span class="cx"> 
</span><del>-        * platform/mock/PlatformSpeechSynthesizerMock.cpp:
-        (WebCore::PlatformSpeechSynthesizerMock::speakingFinished):
</del><ins>+            No tests added. The machinery we have for logging downloaded file name is very
+            far from being able to work in a secondary window.
</ins><span class="cx"> 
</span><del>-2014-04-28  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            * loader/FrameLoader.cpp: (WebCore::FrameLoader::addExtraFieldsToRequest):
+            Made a targeted fix - don't update encoding fallback array if we already have one,
+            there is no chance for it to be more correct. In this case, it's incorrect because
+            it comes from a new blank window, instead of original referer.
+            We have a lot of code in addExtraFieldsToRequest() to struggle with this, and we have
+            a FIXME to try not calling it from policy delegate.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167871.
-        https://bugs.webkit.org/show_bug.cgi?id=132290
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        broke a newmulticol test (spanner-nested-dynamic) (Requested
-        by thorton on #webkit).
</del><ins>+        Merge r151776
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+    2013-06-20  James Craig  &lt;james@cookiecrook.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Store the containing region map inside the flow thread&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131647
-        http://trac.webkit.org/changeset/167871
</del><ins>+            AX: aria-required is not exposed on all expected roles
+            https://bugs.webkit.org/show_bug.cgi?id=115123
</ins><span class="cx"> 
</span><del>-2014-04-28  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167853.
-        https://bugs.webkit.org/show_bug.cgi?id=132288
</del><ins>+            aria-required is now exposed on more roles. Updated existing test file.
</ins><span class="cx"> 
</span><del>-        caused crashes+timeouts+layout test failures described in the
-        bug (Requested by thorton on #webkit).
</del><ins>+            * accessibility/AccessibilityNodeObject.cpp:
+            (WebCore::AccessibilityNodeObject::supportsRequiredAttribute):
+            * accessibility/AccessibilityNodeObject.h:
+            * accessibility/AccessibilityObject.h:
+            (WebCore::AccessibilityObject::supportsRequiredAttribute):
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (-[WebAccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Coalesce responses on network process side&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132229
-        http://trac.webkit.org/changeset/167853
</del><ins>+        Merge r151785
</ins><span class="cx"> 
</span><del>-2014-04-24  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+    2013-06-19  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] flickery scrolling with overflow-scrolling:touch
-        https://bugs.webkit.org/show_bug.cgi?id=132150
</del><ins>+            Roll-on in-band captions are displayed bottom-to-top rather than top-to-bottom.
+            https://bugs.webkit.org/show_bug.cgi?id=117811
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Fix typo in a comment.
</del><ins>+            When comparing Generic cues, we should check that their type is Generic, not WebVTT.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::scheduleUpdateScrollPositionAfterAsyncScroll):
</del><ins>+            * html/track/TextTrackCueGeneric.cpp:
+            (WebCore::TextTrackCueGeneric::isOrderedBefore):
</ins><span class="cx"> 
</span><del>-2014-04-28  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Builtin cursors do not properly handle transparency
-        https://bugs.webkit.org/show_bug.cgi?id=131866
</del><ins>+        Merge r151774
</ins><span class="cx"> 
</span><del>-        Reviewed by Gustavo Noronha Silva.
</del><ins>+    2013-06-20  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Tested by ManualTests/cursor.html.
</del><ins>+            Web Inspector: Use console.timeStamp instead of console.markTimeline
+            https://bugs.webkit.org/show_bug.cgi?id=117810
</ins><span class="cx"> 
</span><del>-        * platform/gtk/CursorGtk.cpp:
-        (WebCore::createNamedCursor): Instead of interpreting the source bitmap as an A1 image, use
-        it as a 1-bit black and white image. We do this by:
-            1. Painting the result to a full color image with transparency instead of an alpha-only surface.
-            2. Masking a white background using the cursor alpha surface.
-            3. Painting the black parts of the cursor by painting the source surface, where black pixels
-            will be interpreted as full opaque pixels.
</del><ins>+            Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-2014-04-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            Webkit supports both console.timeStamp and console.markTimeline.
+            And they do the exact same thing.
+            This patch gets rid of console.markTimeline for Chrome/Firebug compatibility.
</ins><span class="cx"> 
</span><del>-        Unreviewed. Update GObject DOM bindings symbols file.
</del><ins>+            No new functionality, no new tests.
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/webkitdom.symbols: Add missing symbols.
</del><ins>+            * WebCore.order:
+            * page/Console.cpp:
+            * page/Console.h:
+            * page/Console.idl:
</ins><span class="cx"> 
</span><del>-2014-04-28  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+2013-06-26  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        OrderIterator refactoring to avoid extra loops
-        https://bugs.webkit.org/show_bug.cgi?id=119061
</del><ins>+        Merge r151719
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+    2013-06-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        This patch removes order values Vector and use a Vector of pairs instead. The pairs are formed by a child
-        (RenderBox) and the index of this child. In addition, OrderIterator code is simplified.
</del><ins>+            Input type range slider is not updated when min or max are changed
+            https://bugs.webkit.org/show_bug.cgi?id=117778
</ins><span class="cx"> 
</span><del>-        It provides a helper class OrderIteratorPopulator, used for manipulating the Vector directly. Which allows to
-        consolidate the code into a single implementation across flexbox and grid. OrderIteratorPopulator part is based
-        on a patch from Blink r153971 by &lt;jchaffraix@chromium.org&gt;.
</del><ins>+            Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        Current implementation is O(number of children * number of order values). Now it will just do a sort operation
-        and then a regular loop. So if you have different order values in a flexbox or grid the performance will
-        improve.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/089c7a0ba2d85b9b59632c2603fbc6472b310be1.
</ins><span class="cx"> 
</span><del>-        Comparing results of perf-tests:
-        * Layout/auto-grid-lots-of-data: ~0.5% worse.
-        * Layout/fixed-grid-lots-of-data: ~0.5% worse.
-        * Layout/fixed-grid-lots-of-data (setting 100 different order values): ~50% better.
-        * Layout/flexbox-lots-of-data: ~5% better.
</del><ins>+            Test: fast/forms/range/range-change-min-max.html
</ins><span class="cx"> 
</span><del>-        No new tests, already covered by current tests.
</del><ins>+            * html/RangeInputType.cpp:
+            (WebCore::RangeInputType::minOrMaxAttributeChanged):
</ins><span class="cx"> 
</span><del>-        * rendering/OrderIterator.cpp:
-        (WebCore::OrderIterator::currentChild): Return current child according to m_childrenIndex.
-        (WebCore::OrderIterator::first): Initialize m_childrenIndex and return current child.
-        (WebCore::OrderIterator::next): Increase m_childrenIndex and return current child.
-        (WebCore::compareByOrderValueAndIndex): Sorts the Vector by order value and index.
-        (WebCore::OrderIteratorPopulator::~OrderIteratorPopulator): Calls compareByOrderValueAndIndex() if there is any
-        child with non default order value.
-        (WebCore::OrderIteratorPopulator::collectChild): Adds the child and index to the Vector. Update
-        m_allChildrenHaveDefaultOrderValue accordingly.
-        (WebCore::OrderIterator::OrderIterator): Deleted.
-        (WebCore::OrderIterator::setOrderValues): Deleted.
-        (WebCore::OrderIterator::reset): Deleted.
-        * rendering/OrderIterator.h:
-        (WebCore::OrderIteratorPopulator::OrderIteratorPopulator): New helper class to manipulate the Vector.
-        (WebCore::OrderIterator::currentChild): Deleted.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::RenderFlexibleBox): Remove OrderIterator intialization.
-        (WebCore::RenderFlexibleBox::layoutBlock): Remove unneeded code related to old OrderValues vector.
-        (WebCore::RenderFlexibleBox::prepareOrderIteratorAndMargins): Populate OrderIterator using collectChild().
-        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Deleted.
-        * rendering/RenderFlexibleBox.h: Rename computeMainAxisPreferredSizes() to prepareOrderIteratorAndMargins().
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::RenderGrid): Remove OrderIterator initialization.
-        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator): Populate OrderIterator using collectChild().
</del><ins>+2013-06-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-28  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        Merge r151747
</ins><span class="cx"> 
</span><del>-        std::bitset&lt;&gt;::test() does unnecessary bounds checks on CSSPropertyID bitsets
-        https://bugs.webkit.org/show_bug.cgi?id=131685
</del><ins>+    2013-06-19  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Incorrect use of jsCast in a finalizer
+            https://bugs.webkit.org/show_bug.cgi?id=117807
</ins><span class="cx"> 
</span><del>-        Use std::bitset&lt;&gt;::operator[]() instead of std::bitset&lt;&gt;::test() to avoid
-        bounds checks which are not necessary as long as a CSSPropertyID value is used.
</del><ins>+            Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::filterProperties):
-        * css/StyleProperties.cpp:
-        (WebCore::StyleProperties::asText):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::CascadedProperties::hasProperty):
-        (WebCore::StyleResolver::CascadedProperties::set):
</del><ins>+            We can't use jsCast in a finalizer as it checks an object's structure,
+            and the structure may already have been swept by that point.  Use a
+            static_cast instead.
</ins><span class="cx"> 
</span><del>-2014-04-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            * bridge/runtime_array.cpp:
+            (JSC::RuntimeArray::destroy):
</ins><span class="cx"> 
</span><del>-        [GTK] TextTrack kind and mode attributes are enums since r166180
-        https://bugs.webkit.org/show_bug.cgi?id=132228
</del><ins>+2013-06-25  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        Merge r151929
</ins><span class="cx"> 
</span><del>-        Improve coding style according to review comments, that I forgot
-        to do before landing previous commit.
</del><ins>+    2013-06-24  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/WebKitDOMCustom.cpp:
-        (webkit_dom_text_track_get_kind):
-        (webkit_dom_text_track_get_mode):
-        (webkit_dom_text_track_set_mode):
</del><ins>+            Expose the mediaHasAudio() function in WK2
+            https://bugs.webkit.org/show_bug.cgi?id=117946
+            &lt;rdar://problem/14250527&gt;
</ins><span class="cx"> 
</span><del>-2014-04-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        [GTK] TextTrack kind and mode attributes are enums since r166180
-        https://bugs.webkit.org/show_bug.cgi?id=132228
</del><ins>+            * WebCore.exp.in: Updated to include symbol for
+            HTMLMediaElement::mediaHasAudio() function.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+2013-06-21  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        We don't support enum values yet in GObject DOM bindings, but they
-        are internally strings anyway, so we can keep the old
-        implementations using strings as custom functions until we
-        properly support enums.
</del><ins>+        Merge r151787
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/WebKitDOMCustom.cpp:
-        (webkit_dom_text_track_get_kind):
-        (webkit_dom_text_track_get_mode):
-        (webkit_dom_text_track_set_mode):
-        * bindings/gobject/WebKitDOMCustom.h:
-        * bindings/gobject/WebKitDOMCustom.symbols:
</del><ins>+    2013-06-20  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            Make Windows makefile copy build output to a different folder.
+            &lt;rdar://problem/14219184&gt;.
</ins><span class="cx"> 
</span><del>-        [GTK] TextTrack::addCue can raise an exception since r163974
-        https://bugs.webkit.org/show_bug.cgi?id=132227
</del><ins>+            * WebCore.vcxproj/WebCore.make:
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+2013-06-20  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        webkit_dom_text_track_add_cue() now receives a GError paramater
-        which is an API break. Add
-        webkit_dom_text_track_add_cue_with_error and keep
-        webkit_dom_text_track_add_cue as deprecated to keep API
-        compatibility.
</del><ins>+        Merge r151799
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/WebKitDOMDeprecated.cpp:
-        (webkit_dom_text_track_add_cue):
-        * bindings/gobject/WebKitDOMDeprecated.h:
-        * bindings/gobject/WebKitDOMDeprecated.symbols:
-        * bindings/gobject/webkitdom.symbols:
-        * bindings/scripts/CodeGeneratorGObject.pm:
-        (GetEffectiveFunctionName):
</del><ins>+2013-06-20  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+        Merge r151762
</ins><span class="cx"> 
</span><del>-        [GTK] TextTrackCue API changed in r163649
-        https://bugs.webkit.org/show_bug.cgi?id=132226
</del><ins>+    2013-06-19  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+            [Mac] Common crashes when playing media
+            https://bugs.webkit.org/show_bug.cgi?id=117813
+            &lt;rdar://problem/13837412&gt;
</ins><span class="cx"> 
</span><del>-        TextTrackCue is now a base class and part of its API was moved to
-        the derived class VTTCue. Update the GObject DOM bindings to keep
-        backwards compatibility.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Generate bindings for DataCue and VTTCue.
-        * bindings/gobject/WebKitDOMDeprecated.cpp:
-        (webkit_dom_text_track_cue_get_cue_as_html): Mark as deprecated in
-        favor of VTTCue API.
-        (webkit_dom_text_track_cue_get_vertical): Ditto.
-        (webkit_dom_text_track_cue_set_vertical): Ditto.
-        (webkit_dom_text_track_cue_get_snap_to_lines): Ditto.
-        (webkit_dom_text_track_cue_set_snap_to_lines): Ditto.
-        (webkit_dom_text_track_cue_get_line): Ditto.
-        (webkit_dom_text_track_cue_set_line): Ditto.
-        (webkit_dom_text_track_cue_get_position): Ditto.
-        (webkit_dom_text_track_cue_set_position): Ditto.
-        (webkit_dom_text_track_cue_get_size): Ditto.
-        (webkit_dom_text_track_cue_set_size): Ditto.
-        (webkit_dom_text_track_cue_get_align): Ditto.
-        (webkit_dom_text_track_cue_set_align): Ditto.
-        (webkit_dom_text_track_cue_get_text): Ditto.
-        (webkit_dom_text_track_cue_set_text): Ditto.
-        * bindings/gobject/WebKitDOMDeprecated.h:
-        * bindings/gobject/WebKitDOMDeprecated.symbols: Add new deprecated symbols.
-        * bindings/gobject/WebKitDOMPrivate.cpp:
-        (WebKit::wrap): Add generic wrap for TextTrackCue now that it's a
-        base class to generate DataCue or VTTCue objects.
-        * bindings/gobject/WebKitDOMPrivate.h:
-        * bindings/gobject/webkitdom.symbols: Add DataCue symbols.
-        * bindings/scripts/CodeGeneratorGObject.pm:
-        (IsPolymorphic): Add TextTrackCue to the list of polymorphic classes.
</del><ins>+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (-[WebCoreAVFLoaderDelegate resourceLoader:didCancelLoadingRequest:]):
+            This method may be called from a secondary thread, but it does things that are
+            not thread safe.
</ins><span class="cx"> 
</span><del>-2014-04-27  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+2013-06-18  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Store the containing region map inside the flow thread
-        https://bugs.webkit.org/show_bug.cgi?id=131647
</del><ins>+        Disable some feature flags.
+        &lt;rdar://problem/14171207&gt;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+        Rubberstamped by Jon Lee.
</ins><span class="cx"> 
</span><del>-        The patch moves the containing region map inside the flow thread where
-        it can be better handled in case the region chain changes and the map
-        needs to be cleared.
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
</ins><span class="cx"> 
</span><del>-        As a result of this move we are able to also cleanup the lines region
-        information of a block flow when it is removed from the tree.
</del><ins>+2013-06-18  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/inline-strike-through.html
</del><ins>+        Improve style of null checks in FrameView::setFrameRect
+        https://bugs.webkit.org/show_bug.cgi?id=117681
</ins><span class="cx"> 
</span><del>-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::InlineFlowBox):
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::addOverflowFromInlineChildren):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::removeFlowChildInfo):
-        (WebCore::RenderFlowThread::invalidateRegions):
-        (WebCore::RenderFlowThread::removeLineRegionInfo):
-        (WebCore::RenderFlowThread::checkLinesConsistency):
-        (WebCore::RenderFlowThread::containingRegionMap):
-        * rendering/RenderFlowThread.h:
-        * rendering/RootInlineBox.cpp:
-        (WebCore::containingRegionMap):
-        (WebCore::RootInlineBox::~RootInlineBox):
-        (WebCore::RootInlineBox::paint):
-        (WebCore::RootInlineBox::containingRegion):
-        (WebCore::RootInlineBox::clearContainingRegion):
-        (WebCore::RootInlineBox::setContainingRegion):
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-2014-04-27  Darin Adler  &lt;darin@apple.com&gt;
-
-        REGRESSION (r159345): The hover state for links in the top navigation of Yahoo.com doesn't work
-        https://bugs.webkit.org/show_bug.cgi?id=132241
-        rdar://problem/16501924
-
-        Reviewed by Andreas Kling.
-
-        Test: fast/text/simple-lines-hover-underline.html
-
-        Checked that this does not hurt performance by running the
-        run-perf-tests PerformanceTests/Layout/line-layout.html command before and after.
-
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::hitTestInlineChildren): Use simpleLineLayout function rather than
-        getting at the data member directly.
-        (WebCore::RenderBlockFlow::firstLineBaseline): Ditto.
-        (WebCore::RenderBlockFlow::inlineBlockBaseline): Ditto.
-        (WebCore::RenderBlockFlow::lineCount): Ditto.
-        (WebCore::RenderBlockFlow::paintInlineChildren): Ditto.
-        (WebCore::RenderBlockFlow::hasLines): Ditto.
-        (WebCore::RenderBlockFlow::simpleLineLayout): Added logic to determine which path to use if
-        m_lineLayoutPath is undetermined, and call createLineBoxes if it's not simple.
-        (WebCore::RenderBlockFlow::ensureLineBoxes): Factored out most of the code into a new
-        createLineBoxes function.
-        (WebCore::RenderBlockFlow::createLineBoxes): Ditto.
-
-        * rendering/RenderBlockFlow.h: Made simpleLineLayout function no longer an inline.
-        Added a private createLineBoxes function.
-
-2014-04-27  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
-
-        [MediaStream] .ended shouldn't be part of MediaStream IDL
-        https://bugs.webkit.org/show_bug.cgi?id=132104
-
-        Reviewed by Eric Carlson.
-
-        .ended attribute is spec'ed out of MediaStream IDL. Instead, .active
-        is introduced to handle more scenarios. This patch replaces all 'ended'
-        attribute calls with corresponding 'active' attributes. 
-
-        MediaStream-add-remove-tracks.html is updated.
-
-        * Modules/mediastream/MediaStream.cpp:
-        (WebCore::MediaStream::addTrack): Replaced ended() with active().
-        (WebCore::MediaStream::removeTrack): setEnded() isn't called. setActive()
-        is retained which propagates oninactive event.
-        (WebCore::MediaStream::trackDidEnd): setEnded() isn't called.
-        (WebCore::MediaStream::removeRemoteSource): Replaced ended() with active().
-        (WebCore::MediaStream::addRemoteTrack): Replaced ended() with active().
-        (WebCore::MediaStream::removeRemoteTrack): Replaced ended() with active().
-        (WebCore::MediaStream::ended): Deleted.
-        (WebCore::MediaStream::setEnded): Deleted.
-        (WebCore::MediaStream::streamDidEnd): Deleted.
-        * Modules/mediastream/MediaStream.h:
-        * Modules/mediastream/MediaStream.idl:
-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::didRemoveRemoteStream): Replaced setEnded()
-        with setActive().
-        * platform/mediastream/MediaStreamPrivate.cpp:
-        (WebCore::MediaStreamPrivate::MediaStreamPrivate):
-        (WebCore::MediaStreamPrivate::setActive): Updated comment from bug 
-        https://bugs.webkit.org/show_bug.cgi?id=131973
-        (WebCore::MediaStreamPrivate::setEnded): Deleted.
-        * platform/mediastream/MediaStreamPrivate.h:
-        (WebCore::MediaStreamPrivate::ended): Deleted.
-
-2014-04-25  Andy Estes  &lt;aestes@apple.com&gt;
-
-        [iOS] Stop creating a WKWebResourceQuickLookDelegate for every WebResourceLoader
-        https://bugs.webkit.org/show_bug.cgi?id=132215
-
-        Reviewed by Dan Bernstein.
-
-        * WebCore.exp.in: Moved QuickLook symbols to the USE(QUICK_LOOK) stanza.
-        * platform/network/ios/QuickLook.h: Changed one of the create() overloads to no longer take a delegate argument.
-        * platform/network/ios/QuickLook.mm: Moved WKWebResourceQuickLookDelegate to here and renamed to WebResourceLoaderQuickLookDelegate.
-        (WebCore::QuickLookHandle::create): Created a WebResourceLoaderQuickLookDelegate only if QuickLook can handle the response.
-
-2014-04-27  Sam Weinig  &lt;sam@webkit.org&gt;
-
-        [iOS WebKit2] Add support for text autosizing
-        &lt;rdar://problem/16545245&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=132237
-
-        Reviewed by Tim Horton.
-
-        Move text autosizing width from Frame to Page, as it is a Page level concept.
-
-        * WebCore.exp.in:
-        * page/Frame.cpp:
-        (WebCore::Frame::textAutosizingWidth): Deleted.
-        (WebCore::Frame::setTextAutosizingWidth): Deleted.
-        * page/Frame.h:
</del><span class="cx">         * page/FrameView.cpp:
</span><del>-        (WebCore::FrameView::layout):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-        (WebCore::Page::textAutosizingWidth):
-        (WebCore::Page::setTextAutosizingWidth):
</del><ins>+        (WebCore::FrameView::setFrameRect): Used nested if statements and local variables
+        to tighten this code up a little.
</ins><span class="cx"> 
</span><del>-2014-04-27  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+2013-06-18  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed. Updating one bindings test baseline after r167855.
</del><ins>+        Move IDL extended attributes to their correct location
+        https://bugs.webkit.org/show_bug.cgi?id=117732
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/test/JS/JSTestCallback.cpp:
-        (WebCore::JSTestCallback::~JSTestCallback):
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-2014-04-27  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Move IDL extended attributes to their correct location according to the
+        latest Web IDL specification. We used to be inconsistent in the positioning
+        of the extended attributes. This simplifies a lot the code of the IDL parser
+        and makes our IDL files more standard.
</ins><span class="cx"> 
</span><del>-        Webpages can trigger loads with invalid URLs
-        https://bugs.webkit.org/show_bug.cgi?id=132224
-        rdar://problem/16697142
</del><ins>+        Based on Blink r148345 by Kentaro Hara &lt;haraken@chromium.org&gt;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Invalid URLs can be a way to trick the user about what website they
-        are looking at.  Still trying to figure out a good way to regression-test this.
</del><ins>+        * Modules/encryptedmedia/MediaKeyMessageEvent.idl:
+        * Modules/notifications/Notification.idl:
+        * Modules/speech/SpeechSynthesisVoice.idl:
+        * bindings/scripts/IDLParser.pm:
+        (parseDefinitions):
+        (parseInterfaceMembers):
+        (parseInterfaceMember):
+        (parseDictionaryMembers):
+        (parseAttributeOrOperationOrIterator):
+        (parseAttribute):
+        * css/CSSFontFaceLoadEvent.idl:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Node.idl:
+        * html/HTMLBodyElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameSetElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLSourceElement.idl:
+        * page/DOMWindow.idl:
+        * svg/SVGElementInstance.idl:
+        * svg/SVGScriptElement.idl:
+        * testing/TypeConversions.idl:
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::processHttpEquiv): Pass a URL rather than a String to
-        the navigation scheduler.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::receivedFirstData): Ditto.
</del><ins>+2013-06-18  Jessie Berlin  &lt;jberlin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/NavigationScheduler.cpp:
-        (WebCore::ScheduledURLNavigation::ScheduledURLNavigation): Take a URL rather
-        than a string.
-        (WebCore::ScheduledURLNavigation::url): Ditto.
-        (WebCore::ScheduledRedirect::ScheduledRedirect): Ditto.
-        (WebCore::ScheduledLocationChange::ScheduledLocationChange): Ditto.
-        (WebCore::ScheduledRefresh::ScheduledRefresh): Ditto.
-        (WebCore::NavigationScheduler::shouldScheduleNavigation): Added a check that
-        prevents navigation to any URL that is invalid, except for JavaScript URLs,
-        which need not be valid.
-        (WebCore::NavigationScheduler::scheduleRedirect): Use URL instead of String.
-        (WebCore::NavigationScheduler::scheduleLocationChange): Use URL instead of
-        String. Also got rid of empty string check since empty URLs are also invalid,
-        and so shouldScheduleNavigation will take care of it.
-        (WebCore::NavigationScheduler::scheduleRefresh): Use URL instead of String.
</del><ins>+        Let the script to update the Localizable.strings file do the reordering it wants to do.
</ins><span class="cx"> 
</span><del>-        * loader/NavigationScheduler.h: Take URL instead of String. Also removed some
-        unneeded incldues and uses of WTF_MAKE_NONCOPYABLE. NavigationScheduler is
-        already noncopyable because it has a reference for a data member, and the
-        disabler doesn't have any real reason to be noncopyable.
</del><ins>+        Rubber-stamped by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * loader/SubframeLoader.cpp:
-        (WebCore::SubframeLoader::loadOrRedirectSubframe): Pass a URL rather than a
-        String to the NavigationScheduler.
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::createWindow): Ditto.
</del><ins>+        * English.lproj/Localizable.strings:
</ins><span class="cx"> 
</span><del>-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::urlWithUniqueSecurityOrigin): Return a URL instead
-        of a String.
-        * page/SecurityOrigin.h: Updated for above change.
</del><ins>+2013-06-18  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-27  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        [Windows] Unreviewed gardening -- show missing AccessibilityNodeObject source
+        files in Visual Studio.
</ins><span class="cx"> 
</span><del>-        ScriptExecutionContext::Task should work well with C++11 lambdas
-        https://bugs.webkit.org/show_bug.cgi?id=129795
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Add missing files.
+        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-06-18  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Instead of having classes that subclass ScriptExecutionContext::Task and override
-        the performTask(ScriptExecutionContext*) method, have the ScriptExecutionContext::Task
-        take in a std::function&lt;void (ScriptExecutionContext*)&gt;-like object trough the constructor
-        which would contain the code currently kept in the performTask() methods.
</del><ins>+        Unreviewed, rolling out r151513.
+        http://trac.webkit.org/changeset/151513
+        https://bugs.webkit.org/show_bug.cgi?id=117763
</ins><span class="cx"> 
</span><del>-        This enables inlining C++11 lambdas into ScriptExecutionContext::postTask() calls. For
-        cleanup tasks, the Task object can be implicitly constructed by using the initializer list
-        constructor with the first argument being the ScriptExecutionContext::Task::CleanupTask tag.
-        The ScriptExecutionContext class remains non-copyable and now stores the passed-in invokable
-        object in the std::function wrapper, along with a boolean member that indicates whether the
-        task is of cleanup nature.
</del><ins>+        It causes assertions in debug (Requested by benjaminp on
+        #webkit).
</ins><span class="cx"> 
</span><del>-        * Modules/quota/StorageErrorCallback.cpp:
-        (WebCore::StorageErrorCallback::CallbackTask::CallbackTask):
-        (WebCore::StorageErrorCallback::CallbackTask::performTask): Deleted.
-        * Modules/quota/StorageErrorCallback.h:
-        (WebCore::StorageErrorCallback::CallbackTask::create): Deleted.
-        * Modules/webdatabase/Database.cpp:
-        (WebCore::Database::~Database):
-        (WebCore::Database::runTransaction):
-        (WebCore::Database::scheduleTransactionCallback):
-        (WebCore::DerefContextTask::create): Deleted.
-        (WebCore::DerefContextTask::performTask): Deleted.
-        (WebCore::DerefContextTask::isCleanupTask): Deleted.
-        (WebCore::DerefContextTask::DerefContextTask): Deleted.
-        (WebCore::callTransactionErrorCallback): Deleted.
-        (WebCore::DeliverPendingCallbackTask::create): Deleted.
-        (WebCore::DeliverPendingCallbackTask::performTask): Deleted.
-        (WebCore::DeliverPendingCallbackTask::DeliverPendingCallbackTask): Deleted.
-        * Modules/webdatabase/DatabaseManager.cpp:
-        (WebCore::DatabaseManager::openDatabase):
-        (WebCore::DatabaseCreationCallbackTask::create): Deleted.
-        (WebCore::DatabaseCreationCallbackTask::performTask): Deleted.
-        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask): Deleted.
-        * Modules/webdatabase/DatabaseSync.cpp:
-        (WebCore::CloseSyncDatabaseOnContextThreadTask::create): Deleted.
-        (WebCore::CloseSyncDatabaseOnContextThreadTask::performTask): Deleted.
-        (WebCore::CloseSyncDatabaseOnContextThreadTask::CloseSyncDatabaseOnContextThreadTask): Deleted.
-        * Modules/webdatabase/SQLCallbackWrapper.h:
-        (WebCore::SQLCallbackWrapper::clear):
-        (WebCore::SQLCallbackWrapper::SafeReleaseTask::create): Deleted.
-        (WebCore::SQLCallbackWrapper::SafeReleaseTask::performTask): Deleted.
-        (WebCore::SQLCallbackWrapper::SafeReleaseTask::isCleanupTask): Deleted.
-        (WebCore::SQLCallbackWrapper::SafeReleaseTask::SafeReleaseTask): Deleted.
-        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didConnect):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessage):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didStartClosingHandshake):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessageError):
-        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
-        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
-        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
-        (WebCore::WorkerThreadableWebSocketChannel::mainThreadDestroy):
-        (WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
-        (WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::create): Deleted.
-        (WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::~WorkerGlobalScopeDidInitializeTask): Deleted.
-        (WebCore::WorkerThreadableWebSocketChannel::WorkerGlobalScopeDidInitializeTask::WorkerGlobalScopeDidInitializeTask): Deleted.
-        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
-        * bindings/js/JSCallbackData.h:
-        (WebCore::DeleteCallbackDataTask::DeleteCallbackDataTask):
-        (WebCore::DeleteCallbackDataTask::create): Deleted.
-        (WebCore::DeleteCallbackDataTask::performTask): Deleted.
-        (WebCore::DeleteCallbackDataTask::isCleanupTask): Deleted.
-        * bindings/js/JSDOMGlobalObjectTask.cpp:
-        (WebCore::JSGlobalObjectTask::JSGlobalObjectTask):
-        (WebCore::JSGlobalObjectTask::~JSGlobalObjectTask): Deleted.
-        (WebCore::JSGlobalObjectTask::performTask): Deleted.
-        * bindings/js/JSDOMGlobalObjectTask.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::queueTaskToEventLoop):
-        * bindings/js/JSWorkerGlobalScopeBase.cpp:
-        (WebCore::JSWorkerGlobalScopeBase::queueTaskToEventLoop):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateCallbackImplementation):
-        * dom/CrossThreadTask.h:
-        (WebCore::CrossThreadTask1::performTask):
-        (WebCore::CrossThreadTask2::performTask):
-        (WebCore::CrossThreadTask3::performTask):
-        (WebCore::CrossThreadTask4::performTask):
-        (WebCore::CrossThreadTask5::performTask):
-        (WebCore::CrossThreadTask6::performTask):
-        (WebCore::CrossThreadTask7::performTask):
-        (WebCore::CrossThreadTask8::performTask):
-        (WebCore::createCallbackTask):
-        (WebCore::CrossThreadTask1::create): Deleted.
-        (WebCore::CrossThreadTask2::create): Deleted.
-        (WebCore::CrossThreadTask3::create): Deleted.
-        (WebCore::CrossThreadTask4::create): Deleted.
-        (WebCore::CrossThreadTask5::create): Deleted.
-        (WebCore::CrossThreadTask6::create): Deleted.
-        (WebCore::CrossThreadTask7::create): Deleted.
-        (WebCore::CrossThreadTask8::create): Deleted.
-        * dom/Document.cpp:
-        (WebCore::Document::addConsoleMessage):
-        (WebCore::Document::addMessage):
-        (WebCore::Document::postTask):
-        (WebCore::Document::pendingTasksTimerFired):
-        (WebCore::PerformTaskContext::PerformTaskContext): Deleted.
-        (WebCore::Document::didReceiveTask): Deleted.
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::processMessagePortMessagesSoon):
-        (WebCore::ScriptExecutionContext::timerAlignmentInterval):
-        (WebCore::ProcessMessagesSoonTask::create): Deleted.
-        (WebCore::ScriptExecutionContext::AddConsoleMessageTask::performTask): Deleted.
-        (WebCore::ScriptExecutionContext::Task::~Task): Deleted.
-        * dom/ScriptExecutionContext.h:
-        (WebCore::ScriptExecutionContext::Task::Task):
-        (WebCore::ScriptExecutionContext::Task::performTask):
-        (WebCore::ScriptExecutionContext::Task::isCleanupTask):
-        (WebCore::ScriptExecutionContext::AddConsoleMessageTask::AddConsoleMessageTask):
-        (WebCore::ScriptExecutionContext::AddConsoleMessageTask::create): Deleted.
-        * dom/StringCallback.cpp:
-        (WebCore::StringCallback::scheduleCallback):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::postListenerTask):
-        (WebCore::CallCacheListenerTask::create): Deleted.
-        (WebCore::CallCacheListenerTask::CallCacheListenerTask): Deleted.
-        * workers/DefaultSharedWorkerRepository.cpp:
-        (WebCore::SharedWorkerProxy::postTaskToLoader):
-        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerGlobalScope):
-        (WebCore::SharedWorkerConnectTask::SharedWorkerConnectTask):
-        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
-        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
-        (WebCore::SharedWorkerConnectTask::create): Deleted.
-        (WebCore::SharedWorkerConnectTask::performTask): Deleted.
-        * workers/WorkerEventQueue.cpp:
-        (WebCore::WorkerEventQueue::EventDispatcher::EventDispatcher):
-        (WebCore::WorkerEventQueue::EventDispatcher::~EventDispatcher):
-        (WebCore::WorkerEventQueue::EventDispatcher::dispatch):
-        (WebCore::WorkerEventQueue::enqueueEvent):
-        (WebCore::WorkerEventQueue::cancelEvent):
-        (WebCore::WorkerEventQueue::close):
-        * workers/WorkerEventQueue.h:
-        * workers/WorkerGlobalScope.cpp:
-        (WebCore::WorkerGlobalScope::close):
-        (WebCore::WorkerGlobalScope::postTask):
-        (WebCore::WorkerGlobalScope::addConsoleMessage):
-        (WebCore::WorkerGlobalScope::addMessage):
-        (WebCore::CloseWorkerGlobalScopeTask::create): Deleted.
-        (WebCore::CloseWorkerGlobalScopeTask::performTask): Deleted.
-        (WebCore::CloseWorkerGlobalScopeTask::isCleanupTask): Deleted.
-        * workers/WorkerGlobalScope.h:
-        * workers/WorkerLoaderProxy.h:
-        * workers/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope):
-        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerGlobalScope):
-        (WebCore::WorkerMessagingProxy::postTaskToLoader):
-        (WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
-        (WebCore::WorkerMessagingProxy::workerThreadCreated):
-        (WebCore::WorkerMessagingProxy::notifyNetworkStateChange):
-        (WebCore::WorkerMessagingProxy::workerGlobalScopeDestroyed):
-        (WebCore::WorkerMessagingProxy::workerGlobalScopeClosed):
-        (WebCore::WorkerMessagingProxy::postMessageToPageInspector):
-        (WebCore::WorkerMessagingProxy::confirmMessageFromWorkerObject):
-        (WebCore::WorkerMessagingProxy::reportPendingActivity):
-        (WebCore::MessageWorkerGlobalScopeTask::create): Deleted.
-        (WebCore::MessageWorkerGlobalScopeTask::MessageWorkerGlobalScopeTask): Deleted.
-        (WebCore::MessageWorkerGlobalScopeTask::performTask): Deleted.
-        (WebCore::MessageWorkerTask::create): Deleted.
-        (WebCore::MessageWorkerTask::MessageWorkerTask): Deleted.
-        (WebCore::MessageWorkerTask::performTask): Deleted.
-        (WebCore::WorkerExceptionTask::create): Deleted.
-        (WebCore::WorkerExceptionTask::WorkerExceptionTask): Deleted.
-        (WebCore::WorkerExceptionTask::performTask): Deleted.
-        (WebCore::WorkerGlobalScopeDestroyedTask::create): Deleted.
-        (WebCore::WorkerGlobalScopeDestroyedTask::WorkerGlobalScopeDestroyedTask): Deleted.
-        (WebCore::WorkerGlobalScopeDestroyedTask::performTask): Deleted.
-        (WebCore::WorkerTerminateTask::create): Deleted.
-        (WebCore::WorkerTerminateTask::WorkerTerminateTask): Deleted.
-        (WebCore::WorkerTerminateTask::performTask): Deleted.
-        (WebCore::WorkerThreadActivityReportTask::create): Deleted.
-        (WebCore::WorkerThreadActivityReportTask::WorkerThreadActivityReportTask): Deleted.
-        (WebCore::WorkerThreadActivityReportTask::performTask): Deleted.
-        (WebCore::PostMessageToPageInspectorTask::create): Deleted.
-        (WebCore::PostMessageToPageInspectorTask::PostMessageToPageInspectorTask): Deleted.
-        (WebCore::PostMessageToPageInspectorTask::performTask): Deleted.
-        (WebCore::NotifyNetworkStateChangeTask::create): Deleted.
-        (WebCore::NotifyNetworkStateChangeTask::NotifyNetworkStateChangeTask): Deleted.
-        (WebCore::NotifyNetworkStateChangeTask::performTask): Deleted.
-        * workers/WorkerMessagingProxy.h:
-        * workers/WorkerRunLoop.cpp:
-        (WebCore::WorkerRunLoop::postTask):
-        (WebCore::WorkerRunLoop::postTaskAndTerminate):
-        (WebCore::WorkerRunLoop::postTaskForMode):
-        (WebCore::WorkerRunLoop::Task::create):
-        (WebCore::WorkerRunLoop::Task::performTask):
-        (WebCore::WorkerRunLoop::Task::Task):
-        * workers/WorkerRunLoop.h:
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::stop):
-        (WebCore::WorkerThread::releaseFastMallocFreeMemoryInAllThreads):
-        (WebCore::WorkerThreadShutdownFinishTask::create): Deleted.
-        (WebCore::WorkerThreadShutdownFinishTask::performTask): Deleted.
-        (WebCore::WorkerThreadShutdownFinishTask::isCleanupTask): Deleted.
-        (WebCore::WorkerThreadShutdownStartTask::create): Deleted.
-        (WebCore::WorkerThreadShutdownStartTask::performTask): Deleted.
-        (WebCore::WorkerThreadShutdownStartTask::isCleanupTask): Deleted.
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
</ins><span class="cx"> 
</span><del>-2014-04-27  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-06-18  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Coalesce responses on network process side
-        https://bugs.webkit.org/show_bug.cgi?id=132229
</del><ins>+        Replace tools32 folder with tools and update WebKit Windows solution accordingly.
+        &lt;rdar://problem/14118143&gt;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Rubberstamped by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinCairoDebug.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinCairoRelease.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinDebug.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinPostBuild.cmd:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinProduction.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinRelease.props:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCoreDebug.props:
+        * WebCore.vcxproj/WebCoreDebugWinCairo.props:
+        * WebCore.vcxproj/WebCoreGenerated.vcxproj:
+        * WebCore.vcxproj/WebCoreGeneratedDebug.props:
+        * WebCore.vcxproj/WebCoreGeneratedDebugWinCairo.props:
+        * WebCore.vcxproj/WebCoreGeneratedProduction.props:
+        * WebCore.vcxproj/WebCoreGeneratedRelease.props:
+        * WebCore.vcxproj/WebCoreGeneratedReleaseWinCairo.props:
+        * WebCore.vcxproj/WebCoreProduction.props:
+        * WebCore.vcxproj/WebCoreRelease.props:
+        * WebCore.vcxproj/WebCoreReleaseWinCairo.props:
+        * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
+        * WebCore.vcxproj/build-generated-files.sh:
</ins><span class="cx"> 
</span><del>-2014-04-27  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2013-06-18  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Roll out changes not part of the patch reviewed for Bug 132089
-        &lt;http://webkit.org/b/132089&gt;
</del><ins>+        [CSS Shapes] Remove lineOverflowsFromShapeInside boolean from RenderBlock::layoutRunsAndFloatsInRange function
+        https://bugs.webkit.org/show_bug.cgi?id=117757
</ins><span class="cx"> 
</span><del>-        * loader/SubframeLoader.cpp:
-        (WebCore::SubframeLoader::loadOrRedirectSubframe):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::setLocation):
-        (WebCore::DOMWindow::createWindow):
-        (WebCore::DOMWindow::open):
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-2014-04-26  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        We don't need keep lineOverflowsFromShapeInside boolean in RenderBlock::layoutRunsAndFloatsInRange and in its
+        helpers because it's easy to decide whether we are in an shape content overflow state or not, so I got rid of
+        lineOverflowsFromShapeInside's occurences and updated the affected functions.
</ins><span class="cx"> 
</span><del>-        Frame and page lifetime fixes in WebCore::createWindow
-        https://bugs.webkit.org/show_bug.cgi?id=132089
</del><ins>+        Covered by existing overflow tests in fast/exclusions/shape-inside and fast/regions/shape-inside.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        * rendering/RenderBlock.h: Update helper's definition.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::pushShapeContentOverflowBelowTheContentBox): Add condition when overflow is already positioned.
+        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLine): Remove lineOverflowsFromShapeInside.
+        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLineInFlowThread):  Remove lineOverflowsFromShapeInside.
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):  Remove lineOverflowsFromShapeInside.
</ins><span class="cx"> 
</span><del>-        Speculative fix because I was unable to reproduce the crash that was
-        reported with the test case attached to this bug.
</del><ins>+2013-06-18  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/FrameLoader.cpp:
-        (WebCore::createWindow): Changed code to remove the assumption that calls
-        out will not destroy the page or frame. Use RefPtr for the frame, and
-        added early exits if frame-&gt;page() becomes null at any point before we
-        use a page pointer.
</del><ins>+        widthMediaFeatureEval ends up with null FrameView during iframe unload.
+        https://bugs.webkit.org/show_bug.cgi?id=117754
</ins><span class="cx"> 
</span><del>-2014-04-26  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Local files should not be allowed to read pasteboard data during drag
-        https://bugs.webkit.org/show_bug.cgi?id=131767
</del><ins>+        Ensure that MediaQueryEvaluator checks against NULL FrameView.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        While frames are being unloaded, the Frame object does not necessarily have valid
+        FrameView anymore. Layout on the main frame can end up querying media values on such child
+        frames, while detaching.
</ins><span class="cx"> 
</span><del>-        Test: fast/files/local-file-drag-security.html
</del><ins>+        Test: fast/frames/crash-when-child-iframe-forces-layout-during-unload-and-sibling-frame-has-mediaquery.html
</ins><span class="cx"> 
</span><del>-        * page/DragController.cpp:
-        (WebCore::DragController::dragExited):
-        (WebCore::DragController::tryDHTMLDrag):
-        Make an old Dashboard quirk really Dashboard only.
</del><ins>+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::orientationMediaFeatureEval):
+        (WebCore::aspect_ratioMediaFeatureEval):
+        (WebCore::evalResolution):
+        (WebCore::heightMediaFeatureEval):
+        (WebCore::widthMediaFeatureEval):
+        (WebCore::MediaQueryEvaluator::eval):
</ins><span class="cx"> 
</span><del>-2014-04-24  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2013-06-18  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r164133): Selection doesn't paint when scrolling some pages
-        https://bugs.webkit.org/show_bug.cgi?id=132172
-        rdar://problem/16719473
</del><ins>+        Expose a getMediaType method in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=117667
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        Reviewed by Brady Eidson.
</ins><span class="cx"> 
</span><del>-        Tests: fast/dynamic/remove-invisible-node-inside-selection.html
-               fast/dynamic/remove-node-inside-selection.html
</del><ins>+        * WebCore.exp.in: Updated to add a symbol for 
+        HitTestResult::mediaIsVideo method
+        and alphabetize the list of exposed methods.
</ins><span class="cx"> 
</span><del>-        * editing/FrameSelection.cpp:
-        (WebCore::clearRenderViewSelection): Changed to take a Node&amp; because having
-        this take a Position&amp; was unnecessary and strange, when really it just needs
-        to take a document as an argument.
-        (WebCore::DragCaretController::nodeWillBeRemoved): Updated for the above.
-        (WebCore::FrameSelection::respondToNodeModification): Added code to set the
-        m_pendingSelectionUpdate flag and call RenderView::setNeedsLayout so the
-        selection will be recomputed after it's temporarily cleared when one of
-        the selected nodes is removed.
</del><ins>+2013-06-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Remove unused bool argument from ReplacementFragment's constructor
+        https://bugs.webkit.org/show_bug.cgi?id=117752
</ins><span class="cx"> 
</span><del>-        REGRESSION (r167689): Hovering file name in a file input causes a crash
-        https://bugs.webkit.org/show_bug.cgi?id=132214
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/265586d9f154a9dff657511d09926429b8e1b53d.
</ins><span class="cx"> 
</span><del>-        The bug was caused by callDefaultEventHandlersInTheBubblingOrder unconditionally
-        accessing path.contextAt(0) even if the event path was empty.
</del><ins>+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        (WebCore::ReplaceSelectionCommand::doApply):
</ins><span class="cx"> 
</span><del>-        Fixed the bug by exiting early when the event path is empty.
</del><ins>+2013-06-18  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/events/shadow-event-path-2.html
</del><ins>+        Not all subtitle tracks are SDH
+        https://bugs.webkit.org/show_bug.cgi?id=117738
</ins><span class="cx"> 
</span><del>-        * dom/EventDispatcher.cpp:
-        (WebCore::callDefaultEventHandlersInTheBubblingOrder):
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-04-25  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        No new tests, existing tests updated.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r167828): http/tests/media/hls/video-controls-live-stream.html fails
</del><ins>+        * html/track/InbandTextTrack.cpp:
+        (WebCore::InbandTextTrack::isSDH): New.
</ins><span class="cx"> 
</span><del>-        * English.lproj/mediaControlsLocalizedStrings.js:
-        Add 'Live Broadcast' to the localized strings list.
</del><ins>+        * html/track/InbandTextTrack.h: Add isSDH override.
+        * html/track/TextTrack.h:
</ins><span class="cx"> 
</span><del>-2014-04-25  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        * page/CaptionUserPreferencesMac.mm:
+        (WebCore::trackDisplayName): Only add &quot;SDH&quot; label if a track claims to be SDH.
</ins><span class="cx"> 
</span><del>-        Add a selection overlay.
-        &lt;rdar://problem/16727797&gt; and https://bugs.webkit.org/show_bug.cgi?id=132200
</del><ins>+        * platform/graphics/InbandTextTrackPrivate.h:
+        (WebCore::InbandTextTrackPrivate::isSDH): New.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.h:
+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.mm:
+        (WebCore::InbandTextTrackPrivateAVFObjC::isSDH): Return true if track has both &quot;transcribes
+            spoken dialog for accessibility&quot; and &quot;describes music and sound for accessibility&quot; 
+            characteristics.
</ins><span class="cx"> 
</span><del>-        No new tests (WK2 feature in development).
</del><ins>+2013-06-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        Simplify FormKeyGenerator::willDeleteForm
+        https://bugs.webkit.org/show_bug.cgi?id=117751
</ins><span class="cx"> 
</span><del>-        Add a SelectionRectGathterer class.
-        It creates a Notifier (given a RenderView) then accepts Rects from the RenderView.
-        When the Notifier is destroyed, the appropriate EditorClient is notified of the gathered rects.
-        * editing/SelectionRectGatherer.cpp: Added.
-        (WebCore::SelectionRectGatherer::SelectionRectGatherer):
-        (WebCore::SelectionRectGatherer::addRect):
-        (WebCore::SelectionRectGatherer::addRects):
-        (WebCore::SelectionRectGatherer::Notifier::Notifier):
-        (WebCore::SelectionRectGatherer::Notifier::~Notifier):
-        (WebCore::SelectionRectGatherer::clearAndCreateNotifier):
-        * editing/SelectionRectGatherer.h: Added.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * page/EditorClient.h:
-        (WebCore::EditorClient::selectionRectsDidChange):
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/c6399efb9da863eb1d1fc98b17ef925998b985ac
</ins><span class="cx"> 
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::RenderView):
-        (WebCore::RenderView::setSelection): Clear the gatherer’s rects then create a Notifier.
-        (WebCore::RenderView::setSubtreeSelection): Give all the selection rects to be painted to
-          the SelectionRectGatherer.
-        * rendering/RenderView.h:
</del><ins>+        * html/FormController.cpp:
+        (WebCore::FormKeyGenerator::willDeleteForm):
</ins><span class="cx"> 
</span><del>-2014-04-08  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-06-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Support &quot;Live&quot; streams in media controls.
-        https://bugs.webkit.org/show_bug.cgi?id=131390
</del><ins>+        REGRESSION(r147602): Search text field doesn't render selection when it has some :focus rules
+        https://bugs.webkit.org/show_bug.cgi?id=117747
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        Test: http/tests/media/hls/video-controls-live-stream.html
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/7ff656c8239ce3b125246abcc8b149a603fcff28
</ins><span class="cx"> 
</span><del>-        Support &quot;Live&quot; streams by adding an isLive property to our media controls.
</del><ins>+        r147612 added setNeedsLayout(true, MarkOnlyThis) for
+        TextControlInnerTextElement renderer. It's ok for input[type=text]
+        because RenderTextControlSingleLine also has needsLayout flag, and it
+        has only the inner text renderer as a child.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.css:
-        (audio::-webkit-media-controls-status-display):
-        (video:-webkit-full-screen::-webkit-media-controls-status-display):
-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller): isLive defaults to false.
-        (Controller.prototype.setIsLive): Set the isLive property and conditionally reconfigure the controls.
-        (Controller.prototype.configureInlineControls): Don't add the timeline if we are live.
-        (Controller.prototype.configureFullScreenControls): Ditto.
-        (Controller.prototype.updateStatusDisplay): Added.
-        (Controller.prototype.handleLoadStart): Call updateStatusDisplay().
-        (Controller.prototype.handleError): Ditto.
-        (Controller.prototype.handleAbort): Ditto.
-        (Controller.prototype.handleSuspend): Ditto.
-        (Controller.prototype.handleStalled): Ditto.
-        (Controller.prototype.handleWaiting): Ditto.
-        (Controller.prototype.updateDuration): Ditto.
-        (Controller.prototype.updateReadyState): Ditto.
</del><ins>+        As for input[type=search], it doesn't work. Renderer structure for
+        input[type=search] is:
</ins><span class="cx"> 
</span><del>-2014-04-25  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        RenderTextControlSingleLine
+        └Renderer for TextControlInnerContainer
+          └Renderer for TextControlInnerElement
+            └Renderer for TextControlInnerTextElement
</ins><span class="cx"> 
</span><del>-        Allow a platform-specific size enumeration to be passed into popup-menu display
-        https://bugs.webkit.org/show_bug.cgi?id=132195
</del><ins>+        After r147612, there is a case that only RenderTextControlSingleLine
+        and TextControlInnerTextElement renderer have needsLayout flag, and
+        others don't.  It won't trigger layout for
+        TextControlInnerTextElement renderer.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham. With some in-person review comments from Sam Weinig.
</del><ins>+        We should set needsLayout flags of TextControlInnerContainer renderer
+        and TextControlInnerElement renderer by MarkContainingBlockChain.
</ins><span class="cx"> 
</span><del>-        Platforms like OS X use a set of predefined sizes for built-in controls
-        used for &lt;select&gt;: normal, small and mini. Expose that information to
-        the PopupMenuClient via the PopupMenuStyle, allowing it to be passed
-        into the platform code in WebKitSystemInterface.
</del><ins>+        Manual Tests: search-select-all-with-focus-style.html
+        (I tried but couldn't make a test that works in DRT)
</ins><span class="cx"> 
</span><del>-        * platform/PopupMenuStyle.h: Add a menu size enum.
-        (WebCore::PopupMenuStyle::PopupMenuStyle):
-        (WebCore::PopupMenuStyle::menuSize):
-        * platform/mac/WebCoreSystemInterface.h: Pass in NSControlSize as a parameter
-        to WKPopupMenu.
-        * platform/mac/WebCoreSystemInterface.mm: Ditto.
-        * rendering/RenderMenuList.cpp:
-        (RenderMenuList::menuStyle): Ask the RenderTheme to calculate the size
-        of the menu button, so that it can be added to the PopupMenuStyle.
-        * rendering/RenderTheme.h: New method to retrieve the menu size.
-        (WebCore::RenderTheme::popupMenuSize): Convert an NSControlSize into a PopupMenuSize.
-        * rendering/RenderThemeMac.h: Override the base function, and add a
-        controlSizeForCell helper.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::controlSizeForCell): Used by this new
-        code and the old setControlSizeForCell to calculate the NSControlSize
-        that would be used for the button.
-        (WebCore::RenderThemeMac::setControlSize): Call the new helper.
-        (WebCore::RenderThemeMac::popupMenuSize): Return the value from the helper.
</del><ins>+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::styleDidChange):
</ins><span class="cx"> 
</span><del>-2014-04-25  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
</del><ins>+2013-06-18  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION(r167799): ASSERTION in parseGridTemplateShorthand in fast/css-grid-layout/grid-template-shorthand-get-set.html
-        https://bugs.webkit.org/show_bug.cgi?id=132194
</del><ins>+        Attempted build fix for non-Mac.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::nonSyntheticItalicFontData):
</ins><span class="cx"> 
</span><del>-        Properly resolving the grid-template shorthand for the corresponding longhand
-        properties.
</del><ins>+2013-06-18  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, grid-template-shorthand-get-set.html already covers this case.
</del><ins>+        Synthesized vertical italics on rotated glyphs are transformed incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=117726
</ins><span class="cx"> 
</span><del>-        * css/StyleProperties.cpp:
-        (WebCore::StyleProperties::getPropertyValue):
-        * css/StylePropertyShorthand.cpp:
-        (WebCore::shorthandForProperty):
-        (WebCore::matchingShorthandsForLonghand):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::applyProperty):
</del><ins>+        Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-2014-04-25  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        If a font does not have italic glyphs, and is in a vertical flow, then
+        the synthesis of italics was skewing in the wrong direction. While here,
+        ensure that no CJK text will get italics in vertical layout.
</ins><span class="cx"> 
</span><del>-        Column rules not respecting scroll offsets.
-        https://bugs.webkit.org/show_bug.cgi?id=109683
</del><ins>+        This is a topic under discussion in the CSS Working Group. The resolution
+        at the June 2013 face-to-face was that:
+        - italics in Japanese (and Chinese) text are rare in vertical layout
+        - most people wanted Latin text to italicize in the direction of the line flow
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        The final behaviour was left undefined, but we consider the change here
+        to be sufficient for now. In all cases, the best solution is to avoid
+        synthesized italics by specifying a font that includes such forms.
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/scrolling-column-rules.html
</del><ins>+        Tests: fast/text/international/synthesized-italic-vertical-latin.html
+               fast/text/international/synthesized-italic-vertical.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paintColumnRules):
-        Make paintColumnRules virtual so that it works with both column implementations.
</del><ins>+        * platform/graphics/FontGlyphs.cpp:
+        (WebCore::glyphDataAndPageForCJKCharacterWithoutSyntheticItalic): New function
+            that makes a new glyph data pair that is marked as NOT using a synthesized italic.
+        (WebCore::FontGlyphs::glyphDataAndPageForCharacter): If this is a CJK character and
+            has a synthesized oblique, then run it through the function above to make a new glyph data pair.
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::nonSyntheticItalicFontData): Creates/returns a new SimpleFontData that will
+            not synthesize italics.
+        * platform/graphics/SimpleFontData.h: New method nonSyntheticItalicFontData.
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs): This is the actual bug fix. If you are in a vertical flow, the
+            skew direction should be downwards, not leftwards.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBlock::paintObject):
-        Changed to call paintColumnRules with the adjusted scroll offset and to do it after
-        bailing on the root background only check.
</del><ins>+2013-06-18  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.h:
-        paintColumnRules is now virtual.
</del><ins>+        Unreviewed, rolling out r151549.
+        http://trac.webkit.org/changeset/151549
+        https://bugs.webkit.org/show_bug.cgi?id=117741
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::paintColumnRules):
-        (WebCore::RenderBlockFlow::paintBoxDecorations): Deleted.
-        * rendering/RenderBlockFlow.h:
-        Got rid of paintBoxDecorations override since it failed when hasBoxDecorations was false
-        anyway. Override paintColumnRules instead to paint at the right time.
</del><ins>+        broke selection in the web inspector source after scrolling
+        (Requested by smfr on #webkit).
</ins><span class="cx"> 
</span><del>-2014-04-23  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderLayerModelObject.cpp:
+        * rendering/RenderLayerModelObject.h:
</ins><span class="cx"> 
</span><del>-        Crash applying editing commands from iframe onload event
</del><ins>+2013-06-18  Santosh Mahto  &lt;santosh.ma@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=132103&gt;
-        &lt;rdar://problem/15696351&gt;
</del><ins>+        &lt;video&gt; element delays document load event for ~ 3 seconds
+        https://bugs.webkit.org/show_bug.cgi?id=90272
</ins><span class="cx"> 
</span><del>-        This patch merges the Chromium bug workaround from
-        &lt;http://src.chromium.org/viewvc/blink?revision=162080&amp;view=revision&gt;,
-        which prevents reentrancy in CompositeEditCommand::apply().
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Test: media/media-preload-no-delay-loadevent.html
</ins><span class="cx"> 
</span><del>-        Test: editing/apply-style-iframe-crash.html
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::prepareForLoad):
+        No need to delay document load event here  when preload=&quot;none&quot;
</ins><span class="cx"> 
</span><del>-        * editing/CompositeEditCommand.cpp:
-        (WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
-        (WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
-        (WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
-        (WebCore::CompositeEditCommand::apply):
-        If this is a recursive call, return early.
</del><ins>+2013-06-18  Diego Pino Garcia  &lt;dpino@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-25  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        [GTK] Remove comment about possibility of handling ObjCPolymorphic (it's used by ObjC bindings only)
+        https://bugs.webkit.org/show_bug.cgi?id=117546
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] fast/multicol/hit-test-* layout tests all fail
-        https://bugs.webkit.org/show_bug.cgi?id=132081
</del><ins>+        Reviewed by Xan Lopez.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        According to the WebKit IDL spec the modifier ObjCPolymorphic only
+        applies to the Objective-C bindings generator
</ins><span class="cx"> 
</span><del>-        Added a bunch of tests in fast/multicol/newmulticol/compare-with-old-impl/hit-test-*.html
</del><ins>+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (IsPolymorphic): Remove comment. Search parameter 'type' in array, instead of
+        concatening a series of 'or' conditionals.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.h:
-        Make offsetForContents public, since I need to call it from RenderMultiColumnSet.
</del><ins>+2013-06-18  Víctor Manuel Jáquez Leal  &lt;vjaquez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::populate):
-        Stop an ASSERT in the new columns code on the hit tests by making sure layout state is
-        disabled when moving children around.
</del><ins>+        Fix after r151673
+        https://bugs.webkit.org/show_bug.cgi?id=116042
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::positionForPoint):
-        Refactor this function to call a helper function instead, translateRegionPointToFlowThread.
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderMultiColumnSet::translateRegionPointToFlowThread):
-        This function is logical (unlike the mistaken physical function I first implemented in
-        positionForPoint).
</del><ins>+        Removed a spurious semicolon in the video sink caps definition.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderMultiColumnSet::updateHitTestResult):
-        * rendering/RenderMultiColumnSet.h:
-        Overridden to fill in the correct local coordinate when the HTML document is inside a paginated
-        RenderView. Note that column spans don't actually work, but once we move over to a 
-        non-column based pagination API, that will become irrelevant.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-04-25  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
</ins><span class="cx"> 
</span><del>-        Mark some things with WTF_MAKE_FAST_ALLOCATED.
-        &lt;https://webkit.org/b/132198&gt;
</del><ins>+2013-06-18  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Use FastMalloc for more things.
</del><ins>+        [WebSpeech] Speech Recognition requires convertValue support in JSDictionary
+        https://bugs.webkit.org/show_bug.cgi?id=117731
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Reviewed by Christophe Dumez.
</ins><span class="cx"> 
</span><del>-        * bindings/js/ScriptController.h:
-        * dom/DocumentOrderedMap.h:
-        * inspector/InspectorCSSAgent.h:
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMDebuggerAgent.h:
-        * inspector/InspectorDOMStorageAgent.h:
-        * inspector/InspectorDatabaseAgent.h:
-        * inspector/InspectorLayerTreeAgent.h:
-        * inspector/InspectorPageAgent.h:
-        * inspector/InspectorResourceAgent.h:
-        * inspector/InspectorTimelineAgent.h:
-        * inspector/InspectorWorkerAgent.h:
-        * inspector/PageRuntimeAgent.h:
-        * loader/HistoryController.h:
-        * page/DeviceClient.h:
-        * page/DeviceController.h:
-        * page/EventHandler.h:
-        * page/Page.h:
-        * page/scrolling/ScrollingStateNode.h:
-        * platform/graphics/FontGenericFamilies.h:
-        * platform/graphics/FontPlatformData.h:
</del><ins>+        Build fails after enabling ENABLE_SCRIPTED_SPEECH feature. This patch
+        resolves the issue.
</ins><span class="cx"> 
</span><del>-2014-04-25  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        No new tests. No change in behaviour.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Rename objectShouldPaintInFlowRegion to something more clear
-        https://bugs.webkit.org/show_bug.cgi?id=132050
</del><ins>+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue):
+        * bindings/js/JSDictionary.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-06-18  Mary Wu  &lt;mary.wu@torchmobile.com.cn&gt;
</ins><span class="cx"> 
</span><del>-        The objectShouldPaintInFlowRegion is no longer used only by the painting process
-        but also for hit-testing, so it was renamed to something more generic (objectShouldFragmentInFlowRegion).
</del><ins>+        [BlackBerry] only notify download client when download error
+        https://bugs.webkit.org/show_bug.cgi?id=117687
</ins><span class="cx"> 
</span><del>-        No new tests required, it's just a method rename.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::selectionGaps):
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::positionForPoint):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::objectShouldFragmentInFlowRegion):
-        (WebCore::RenderFlowThread::objectShouldPaintInFlowRegion): Deleted.
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::ensureOverflowForBox):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
</del><ins>+        When met network error in downloading, we notify the error to download
+        client through download stream, we shouldn't notify page client the error.
+        RIM JIRA 419985
</ins><span class="cx"> 
</span><del>-2014-04-25  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::shouldNotifyClientFailed):
</ins><span class="cx"> 
</span><del>-        iOS build fix after http://trac.webkit.org/changeset/167803
-        Unreviewed.
</del><ins>+2013-06-18  Mario Sanchez Prada  &lt;mario.prada@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/Frame.cpp:
-        (WebCore::Frame::checkOverflowScroll):
-        * rendering/RenderBlock.cpp:
-        (WebCore::positionForPointRespectingEditingBoundaries):
</del><ins>+        Shader compiler not properly configured for GLES on cairo based ports
+        https://bugs.webkit.org/show_bug.cgi?id=117705
</ins><span class="cx"> 
</span><del>-2014-04-24  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Add support for offsetLeft and offsetTop.
-        https://bugs.webkit.org/show_bug.cgi?id=132080
</del><ins>+        Configure the shader compiler with SH_ESSL_OUTPUT for GLESv2
+        compliant platforms, and with SH_GLSL_OUTPUT otherwise.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/client-spanners-complex.html and offset-top-left.html
</del><ins>+2013-06-18  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
-        Patch the offsetLeft/Top loop to handle calling into RenderMultiColumnFlowThread
-        in order to adjust the coordinates for the new multicolumn layout.
</del><ins>+        touching any idl rebuilds all derived sources
+        https://bugs.webkit.org/show_bug.cgi?id=117708
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::mapFromFlowToRegion):
-        Modified to use a helper that can be shared by offsetLeft/Top code. This code
-        ran for client rects, and I'm moving/refactoring it for more sharing.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderMultiColumnFlowThread::physicalTranslationOffsetFromFlowToRegion):
-        (WebCore::RenderMultiColumnFlowThread::physicalTranslationFromFlowToRegion):
-        * rendering/RenderMultiColumnFlowThread.h:
-        New functions that beef up what was in mapFromFlowToRegion and fix some bugs
-        with the translation code.
</del><ins>+        Fix preprocess-idls.pl script to update the following files only
+        if they have changed:
+        DerivedSources/WebCore/supplemental_dependency.tmp
+        DerivedSources/WebCore/DOMWindowConstructors.idl
+        DerivedSources/WebCore/WorkerContextConstructors.idl
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::columnTranslationForOffset):
-        Patched to factor in the flow thread portion rect of the specific multicolumn set.
</del><ins>+        This avoids triggering uselessly bindings generation for all IDL
+        files whenever an IDL file is touched.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isRenderMultiColumnFlowThread):
-        Added for toRenderMultiColumnFlowThread capability.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-04-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * bindings/scripts/preprocess-idls.pl:
+        (WriteFileIfChanged):
+        (GeneratePartialInterface):
</ins><span class="cx"> 
</span><del>-        ScrollingCoordinator is unaware of topContentInset
-        https://bugs.webkit.org/show_bug.cgi?id=132158
-        &lt;rdar://problem/16706152&gt;
</del><ins>+2013-06-18  Víctor Manuel Jáquez Leal  &lt;vjaquez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        [GStreamer] [texmap] upload a video buffer into the video texture
+        https://bugs.webkit.org/show_bug.cgi?id=116042
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/fast/scrolling/scroll-select-bottom-test.html
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        The calculation of non-fast-scrollable regions does not currently take
-        the topContentOffset into account. Consequently, the logic that decides
-        whether to stay on the scrolling thread, or drop down to an individual
-        page element, can make the wrong choice. This is especially true for
-        small scrollable regions (such as &lt;select&gt; elements), where the
-        topContentInset may be quite close to the size of the scrollable
-         element itself.
</del><ins>+        This patch prepares more quickly the texture when the video frame is
+        already in the GPU memory.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingCoordinator.cpp:
-        (WebCore::ScrollingCoordinator::computeNonFastScrollableRegion): Also
-        include the topContentInset value in our calculation.
</del><ins>+        It is done using a new buffer's metadata available in GStreamer 1.2,
+        and its purpose is to upload buffers into a OpenGL texture.
</ins><span class="cx"> 
</span><del>-2014-04-25  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
</del><ins>+        If the decoder provides buffers with this metadata, the buffer will be
+        uploaded into the texture used for the video display and it will be
+        rendered, avoiding a expensive mem copies. This is particularly useful
+        for Full HD videos, where all the processing and display will be done
+        in the GPU.
</ins><span class="cx"> 
</span><del>-        REGRESSION(r167799): Breaks debug build
-        https://bugs.webkit.org/show_bug.cgi?id=132194
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
+        (WebCore::MediaPlayerPrivateGStreamerBase::updateTexture):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkitVideoSinkProposeAllocation):
</ins><span class="cx"> 
</span><del>-        Fix the debug bots after r167799
</del><ins>+2013-06-17  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no new functionality.
</del><ins>+        [curl] Set the http response status text
+        https://bugs.webkit.org/show_bug.cgi?id=117307
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseGridTemplateShorthand):
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-04-25  Miyoung Shin  &lt;myid.shin@samsung.com&gt;
</del><ins>+        No new tests, covered by existing ones.
</ins><span class="cx"> 
</span><del>-        Web process is crashed during dispatching touchEvent created by JS.
-        https://bugs.webkit.org/show_bug.cgi?id=113225
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::headerCallback):
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+2013-06-14  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        TouchEvent created by JS should have the necessary attributes
-        of touches, targetTouches and changedTouches.
-        It should be verified weather there are touchLists before dispatching touch event.
</del><ins>+        AX: Correct accessibility role when -webkit-box:display is used.
+        https://bugs.webkit.org/show_bug.cgi?id=117706
</ins><span class="cx"> 
</span><del>-        Test: fast/events/touch/create-touch-event-without-touchList.html
</del><ins>+        Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        * dom/EventDispatcher.cpp:
-        (WebCore::EventDispatcher::dispatchEvent):
-        (WebCore::EventPath::updateTouchLists):
-        (WebCore::addRelatedNodeResolversForTouchList): Deleted.
</del><ins>+        accessibility/box-styled-lists.html
</ins><span class="cx"> 
</span><del>-2014-04-25  Philippe Normand  &lt;pnormand@igalia.com&gt;
</del><ins>+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): If HTML token is
+        of the list element type, treat it as a ListItemRole accessibility role, regardless
+        of what specific renderer is being used.
</ins><span class="cx"> 
</span><del>-        [GTK] File webkitRelativePath attribute was removed in r163483
-        https://bugs.webkit.org/show_bug.cgi?id=132193
</del><ins>+2013-06-17  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+        Add some UNUSED_PARAMs to RenderBlock.cpp so that it builds properly if CSS_EXCLUSIONS is disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=117722.
</ins><span class="cx"> 
</span><del>-        Add the removed getter as deprecated API to keep backwards compatibility.
</del><ins>+        Rubberstamped by Jon Lee.
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/WebKitDOMDeprecated.cpp:
-        (webkit_dom_file_get_webkit_relative_path):
-        * bindings/gobject/WebKitDOMDeprecated.h:
-        * bindings/gobject/WebKitDOMDeprecated.symbols:
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
</ins><span class="cx"> 
</span><del>-2014-04-25  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+2013-06-17  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Overflow selection doesn't work properly
-        https://bugs.webkit.org/show_bug.cgi?id=130715
</del><ins>+        PageBanners appear over HTML5 video when media element is in full screen mode
+        https://bugs.webkit.org/show_bug.cgi?id=117721
+        -and corresponding-
+        &lt;rdar://problem/13686998&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        When hit-testing, painting block selection gaps and searching for the node at a specific point inside a flow thread,
-        the region range of the box being checked must be validated in order to not return false positives. Otherwise, hit-testing
-        at the top of region B could hit elements that overflow the bottom of region A.
</del><ins>+        Update the scrolling tree when a header/footer has been removed.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerForHeader):
+        (WebCore::RenderLayerCompositor::updateLayerForFooter):
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/selection-in-overflow-hit-testing.html
-               fast/regions/selection-in-overflow.html
-               fast/regions/selection-in-text-after-overflow-hit-testing.html
</del><ins>+2013-06-17  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::visiblePositionRangeForLine):
-        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
-        * dom/Document.cpp:
-        (WebCore::Document::caretRangeFromPoint):
-        * editing/FrameSelection.cpp:
-        (WebCore::FrameSelection::contains):
-        * editing/VisibleUnits.cpp:
-        (WebCore::previousLinePosition):
-        (WebCore::nextLinePosition):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectClosestWordFromHitTestResult):
-        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
-        (WebCore::EventHandler::handleMousePressEventTripleClick):
-        (WebCore::EventHandler::handleMousePressEventSingleClick):
-        (WebCore::selectionExtentRespectingEditingBoundary):
-        (WebCore::EventHandler::updateSelectionForMouseDrag):
-        (WebCore::EventHandler::handleMouseReleaseEvent):
-        * page/Frame.cpp:
-        (WebCore::Frame::visiblePositionForPoint):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::selectionGaps):
-        (WebCore::RenderBlock::nodeAtPoint):
-        (WebCore::positionForPointRespectingEditingBoundaries):
-        (WebCore::RenderBlock::positionForPointWithInlineChildren):
-        (WebCore::isChildHitTestCandidate):
-        (WebCore::RenderBlock::positionForPoint):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::positionForPointWithInlineChildren):
-        (WebCore::RenderBlockFlow::positionForPoint):
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::positionForPoint):
-        * rendering/RenderBox.h:
-        * rendering/RenderFileUploadControl.cpp:
-        (WebCore::RenderFileUploadControl::positionForPoint):
-        * rendering/RenderFileUploadControl.h:
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::positionForPoint):
-        * rendering/RenderInline.h:
-        * rendering/RenderLineBreak.cpp:
-        (WebCore::RenderLineBreak::positionForPoint):
-        * rendering/RenderLineBreak.h:
-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::positionForPoint):
-        * rendering/RenderMultiColumnSet.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::positionForPoint):
-        * rendering/RenderObject.h:
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::positionForPoint):
-        * rendering/RenderRegion.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::positionForPoint):
-        * rendering/RenderReplaced.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::positionForPoint):
-        * rendering/RenderText.h:
-        * rendering/svg/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::positionForPoint):
-        * rendering/svg/RenderSVGInlineText.h:
-        * rendering/svg/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::positionForPoint):
-        * rendering/svg/RenderSVGText.h:
</del><ins>+        Modify Windows makefiles to copy some bin output into Program Files.
+        https://bugs.webkit.org/show_bug.cgi?id=117714.
+        &lt;rdar://problem/14179054&gt;
</ins><span class="cx"> 
</span><del>-2014-04-25  Philippe Normand  &lt;pnormand@igalia.com&gt;
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        [GTK] Iframe seamless support was removed in r163427
-        https://bugs.webkit.org/show_bug.cgi?id=132192
</del><ins>+        * WebCore.vcxproj/WebCore.make:
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+2013-06-17  Max Vujovic  &lt;mvujovic@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Add the removed get and set methods as deprecated API to keep
-        backwards compatibility.
</del><ins>+        Crash in loadPendingShaders
+        https://bugs.webkit.org/show_bug.cgi?id=117665
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/WebKitDOMDeprecated.cpp:
-        (webkit_dom_processing_instruction_set_data):
-        (webkit_dom_html_iframe_element_get_seamless):
-        (webkit_dom_html_iframe_element_set_seamless):
-        * bindings/gobject/WebKitDOMDeprecated.h:
-        * bindings/gobject/WebKitDOMDeprecated.symbols:
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-04-25  Philippe Normand  &lt;pnormand@igalia.com&gt;
</del><ins>+        Speculative fix because the crash reports do not contain a test case.
</ins><span class="cx"> 
</span><del>-        [GTK] HTMLInputElement webkitdirectory property was removed in r163483
-        https://bugs.webkit.org/show_bug.cgi?id=132191
</del><ins>+        Rearrange the conditions to check m_state.hasPendingShaders() first. Additionally, check if
+        m_state.style() is non-null.
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+        No new tests. We don't know how to reproduce this crash yet.
</ins><span class="cx"> 
</span><del>-        Add the removed get and set methods as deprecated API to keep
-        backwards compatibility.
</del><ins>+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::loadPendingShaders):
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/WebKitDOMDeprecated.cpp:
-        (webkit_dom_html_input_element_get_webkitdirectory):
-        (webkit_dom_html_input_element_set_webkitdirectory):
-        * bindings/gobject/WebKitDOMDeprecated.h:
-        * bindings/gobject/WebKitDOMDeprecated.symbols:
</del><ins>+2013-06-17  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-25  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
</del><ins>+        REGRESSION: Important controls are missing from &lt;video&gt; element UI, when compared to QuickTime
+        https://bugs.webkit.org/show_bug.cgi?id=20599
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Implementation of the grid-template shorthand.
-        https://bugs.webkit.org/show_bug.cgi?id=128980
</del><ins>+        Add a &quot;Download Video&quot;/&quot;Download Audio&quot; context menu item to download media
+        elements.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        This shorthand sets the values for the grid-template-columns,
-        grid-template-rows and grid-template-areas, so the implementation
-        tries to reuse as much available parsing functions as possible.
</del><ins>+        No new tests. media/context-menu-action.html,
+        which has been disabled by bug 116651, is used to test context menus.
</ins><span class="cx"> 
</span><del>-        The &quot;parsingGridTrackList&quot; was refactored to return a CSSValue and
-        let the &quot;parseValue&quot; function to assign the property value. The
-        &quot;forwardSlash&quot; operator is now valid when the track-list clause is
-        part of a shorthand. The &quot;parseValue&quot; function checkouts that only
-        additional clauses are allowed when processing shorthands; the
-        grid-columns-rows-get-set.html tests was modified to verify this.
</del><ins>+        * English.lproj/Localizable.strings: Updated to
+        include localizable strings for &quot;Download Video&quot; and &quot;Download Audio&quot;.
</ins><span class="cx"> 
</span><del>-        The &quot;parseGridTemplateAreas&quot; was refactored too, in order to
-        process single areas's rows. This is very useful for the
-        gris-template secondary syntax, which mixes areas and rows values.
</del><ins>+        * page/ContextMenuController.cpp: Updated to 
+        include and handle a &quot;Download Video/Audio&quot; context menu item.
</ins><span class="cx"> 
</span><del>-        Finally, the &quot;parseGirdLineNames&quot; function was modified as well by
-        defining an new argument to concatenate head/tail custom-ident
-        elements and ensure the identList is at the heading index, since
-        it's now possible the parseList was rewound.
</del><ins>+        * platform/ContextMenuItem.h:
</ins><span class="cx"> 
</span><del>-        The implementation of the grid-template shorthand tries first to
-        match the &lt;grid-template-columns&gt; / &lt;grid-template-rows&gt; syntax,
-        failing back to the secondary syntax if needed.  This approach
-        requires to rewind the parseList but it produces a clearer code.
</del><ins>+        * platform/LocalizedStrings.cpp: 
+        * platform/LocalizedStrings.h:
+        * platform/efl/LocalizedStringsEfl.cpp:
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        * platform/qt/LocalizedStringsQt.cpp: 
+        Updated to include localizable strings for &quot;Download Video&quot; and &quot;Download Audio&quot;.
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/grid-template-shorthand-get-set.html
</del><ins>+2013-06-17  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseGridTemplateRowsAndAreas):
-        (WebCore::CSSParser::parseGridTemplateShorthand):
-        (WebCore::CSSParser::parseGridLineNames):
-        (WebCore::CSSParser::parseGridTrackList):
-        (WebCore::CSSParser::parseGridTemplateAreasRow):
-        (WebCore::CSSParser::parseGridTemplateAreas):
-        * css/CSSParser.h:
-        * css/CSSParserValues.h:
-        (WebCore::CSSParserValueList::setCurrentIndex):
-        * css/CSSPropertyNames.in:
-        * css/StylePropertyShorthand.cpp:
-        (WebCore::webkitGridTemplateShorthand):
-        * css/StylePropertyShorthand.h:
</del><ins>+        [CSS Shapes] Consider bottom borders when calculating the position of the overflow
+        https://bugs.webkit.org/show_bug.cgi?id=117663
</ins><span class="cx"> 
</span><del>-2014-04-25  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        Remove two unused SVGDocument functions.
-        &lt;https://webkit.org/b/132178&gt;
</del><ins>+        When you have a shape and the content overflows from the shape we need to push the overflow below the content box,
+        not below the border box. We didn't consider the bottom borders of the content box, now I fixed it too and the overflow
+        just starts after the content box. I added a new helper function called pushShapeContentOverflowBelowTheContentBox. Now
+        both the shape in flow thread and the shape overflow use the same function. I added a new test and modified the existing
+        tests to cover all the affected cases.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        Test: fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions-block-content.html
+        Existing overflow tests also modified to test the behavior:
+              fast/exclusions/shape-inside/shape-inside-empty-expected.html
+              fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions-block-content-expected.html
+              fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions-block-content.html
+              fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions-expected.html
+              fast/exclusions/shape-inside/shape-inside-overflow-fixed-dimensions.html
+              fast/regions/shape-inside/shape-inside-on-regions-block-content-overflow-multiple-shapes-expected.html
+              fast/regions/shape-inside/shape-inside-on-regions-block-content-overflow-multiple-shapes.html
</ins><span class="cx"> 
</span><del>-        * svg/SVGDocument.cpp:
-        (WebCore::SVGDocument::dispatchZoomEvent): Deleted.
-        (WebCore::SVGDocument::dispatchScrollEvent): Deleted.
-        * svg/SVGDocument.h:
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::pushShapeContentOverflowBelowTheContentBox):
+        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLine):
+        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLineInFlowThread):
</ins><span class="cx"> 
</span><del>-2014-04-25  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+2013-06-17  Igor Oliveira  &lt;igor.o@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Incomplete body painting when using blend modes
-        https://bugs.webkit.org/show_bug.cgi?id=131889
</del><ins>+        [CSS Regions] ::before and ::after pseudo-elements are not displayed for regions
+        https://bugs.webkit.org/show_bug.cgi?id=80163
</ins><span class="cx"> 
</span><del>-        The incomplete painting was caused by the transparency layer created for
-        the root renderer. We can safely skip creating this transparency layer at
-        the root level, as there is nothing else being painted behind this layer that
-        could be used erroneously as a backdrop.
</del><ins>+        When the implementation of the before/after was moved to the DOM, before/after generated
+        content stoppped to work with css regions. The problem happens when:
+        1. RenderRegion can not have children and when the PseudoElement::attach tries to create a renderer for the
+        generated content, it fails.
+        2. RenderRegion::canHaveGeneratedChildren should not be false because regions can have generated content.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Test: css3/compositing/blend-mode-with-body.html
</del><ins>+        Tests: fast/regions/region-dynamic-after-before.html
+               fast/regions/region-generated-content-before-after.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.h:
-        Changing RenderLayer::paintsWithTransparency so that it will not
-        return true when the root renderer needs to isolate blending.
</del><ins>+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * rendering/RenderRegion.h:
</ins><span class="cx"> 
</span><del>-2014-04-25  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2013-06-17  Michael Brüning  &lt;michael.bruning@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        ASSERTION FAILED: &quot;!m_isolatedWorld-&gt;isNormal() || m_wrapper || !m_jsFunction&quot; in svg/custom/use-instanceRoot-event-listeners.xhtml
-        https://bugs.webkit.org/show_bug.cgi?id=132148
</del><ins>+        [Mac] Remove unmaintained GStreamer specific video code.
+        https://bugs.webkit.org/show_bug.cgi?id=117694
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        Changed how JSCustomMarkFunction generation works. Instead of leaving out
-        the generated visitChildren function, just generate a call to visitAdditionalChildren.
-        This eliminates the need to repeat boilerplate.
</del><ins>+        No new tests, no behaviour change.
</ins><span class="cx"> 
</span><del>-        The fix for the above bug was to correct mistaken logic where JSSVGElementInstance
-        had a visitChildren that did not properly mark event listeners because it explicitly
-        did not call through to the base class visitChildren. The new arrangement makes that
-        mistake impossible.
</del><ins>+        * platform/mac/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController setupVideoOverlay:]):
+        (-[WebVideoFullscreenController windowDidLoad]):
+        (-[WebVideoFullscreenController setMediaElement:]):
+        (-[WebVideoFullscreenController windowDidExitFullscreen]):
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::visitAdditionalChildren): Use this instead of visitChildren.
-        * bindings/js/JSAudioTrackCustom.cpp:
-        (WebCore::JSAudioTrack::visitAdditionalChildren): Ditto.
-        * bindings/js/JSAudioTrackListCustom.cpp:
-        (WebCore::JSAudioTrackList::visitAdditionalChildren): Ditto.
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::JSCSSRule::visitAdditionalChildren): Ditto.
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::visitAdditionalChildren): Ditto.
-        * bindings/js/JSCanvasRenderingContextCustom.cpp:
-        (WebCore::JSCanvasRenderingContext::visitAdditionalChildren): Ditto.
-        * bindings/js/JSCryptoKeyPairCustom.cpp:
-        (WebCore::JSCryptoKeyPair::visitAdditionalChildren): Ditto.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::visitAdditionalChildren): Ditto.
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::visitAdditionalChildren): Ditto.
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::visitAdditionalChildren): Ditto.
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::visitAdditionalChildren): Ditto.
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::JSNodeFilter::visitAdditionalChildren): Ditto.
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        (WebCore::JSNodeIterator::visitAdditionalChildren): Ditto.
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::visitAdditionalChildren): Ditto.
-        * bindings/js/JSSharedWorkerCustom.cpp:
-        (WebCore::JSSharedWorker::visitAdditionalChildren): Ditto.
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::JSStyleSheet::visitAdditionalChildren): Ditto.
-        * bindings/js/JSTextTrackCueCustom.cpp:
-        (WebCore::JSTextTrackCue::visitAdditionalChildren): Ditto.
-        * bindings/js/JSTextTrackCustom.cpp:
-        (WebCore::JSTextTrack::visitAdditionalChildren): Ditto.
-        * bindings/js/JSTextTrackListCustom.cpp:
-        (WebCore::JSTextTrackList::visitAdditionalChildren): Ditto.
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        (WebCore::JSTreeWalker::visitAdditionalChildren): Ditto.
-        * bindings/js/JSVideoTrackCustom.cpp:
-        (WebCore::JSVideoTrack::visitAdditionalChildren): Ditto.
-        * bindings/js/JSVideoTrackListCustom.cpp:
-        (WebCore::JSVideoTrackList::visitAdditionalChildren): Ditto.
-        * bindings/js/JSWebGLRenderingContextCustom.cpp:
-        (WebCore::JSWebGLRenderingContext::visitAdditionalChildren): Ditto.
-        * bindings/js/JSWorkerGlobalScopeCustom.cpp:
-        (WebCore::JSWorkerGlobalScope::visitAdditionalChildren): Ditto.
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::visitAdditionalChildren): Ditto.
-        * bindings/js/JSXPathResultCustom.cpp:
-        (WebCore::JSXPathResult::visitAdditionalChildren): Ditto.
</del><ins>+2013-06-17  Michael Brüning  &lt;michael.bruning@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::visitChildren): Rewrote to use modern for loops.
</del><ins>+        [Qt] Remove Qt specific QTKIT flagged code.
+        https://bugs.webkit.org/show_bug.cgi?id=117635
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateHeader): Generate declaration of visitAdditionalChildren.
-        (GenerateImplementation): Generate call to visitAdditionalChildren.
</del><ins>+        Reviewed by Simon Hausmann.
</ins><span class="cx"> 
</span><del>-2014-04-24  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Due to disabling QTKIT for Qt in r151546, the
+        code the flags that are not taken into account
+        anymore and the code that has been rendered
+        unreachable by this are removed.
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Enable optimization to mmap downloaded resources once they become file-backed.
-        &lt;https://webkit.org/b/132171&gt;
-        &lt;rdar://problem/16720733&gt;
</del><ins>+        No new tests, no behavioural change.
</ins><span class="cx"> 
</span><del>-        Add a missing export for the USE(CFNETWORK) + WebKit2 combo.
-
-        Reviewed by Antti Koivisto.
-
</del><ins>+        * Target.pri:
</ins><span class="cx">         * WebCore.exp.in:
</span><ins>+        * page/Settings.cpp:
+        * page/Settings.h:
+        * platform/KURL.h:
+        * platform/SharedBuffer.h:
+        * platform/cf/KURLCFNet.cpp:
+        (WebCore::KURL::fileSystemPath):
+        * platform/cf/SharedBufferCF.cpp:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/IntSize.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::installedMediaEngines):
+        * platform/graphics/cg/FloatSizeCG.cpp:
+        * platform/graphics/cg/IntRectCG.cpp:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivateQTKit::preferredRenderingMode):
+        (WebCore::MediaPlayerPrivateQTKit::paint):
+        (-[WebCoreMovieObserver layerHostChanged:]):
+        * platform/mac/SharedBufferMac.mm:
+        (+[WebCoreSharedBufferData initialize]):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
</ins><span class="cx"> 
</span><del>-2014-04-24  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2013-06-17  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        FrameLoader::checkCompleted can hit the &quot;ref'ing while destroyed&quot; assertion
-        https://bugs.webkit.org/show_bug.cgi?id=132163
-        rdar://problem/16720640
</del><ins>+        REGRESSSION(r151632) : Build error on ASSERT(WTF_USE_GRAMMAR_CHECKING)
+        https://bugs.webkit.org/show_bug.cgi?id=117692
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+        Reviewed by Jocelyn Turcotte.
</ins><span class="cx"> 
</span><del>-        Couldn't find a way to test this yet. Would be nice to have a test.
</del><ins>+        Ifdef the feature-depending code and fix the assertions to check runtime conditions.
</ins><span class="cx"> 
</span><del>-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::checkCompleted): Move protector until after we check
-        if the frame is already complete. That can happen in practice when this is
-        called from within the frame's destructor. All the code that runs before the
-        protector simply checks state and does not require protection.
</del><ins>+        * editing/Editor.cpp:
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markBadGrammar):
+        * editing/TextCheckingHelper.cpp:
+        (WebCore::findBadGrammars):
+        (WebCore::TextCheckingHelper::findFirstGrammarDetail):
+        (WebCore::TextCheckingHelper::findFirstBadGrammar):
+        (WebCore::TextCheckingHelper::isUngrammatical):
+        (WebCore::TextCheckingHelper::markAllBadGrammar):
+        (WebCore::checkTextOfParagraph):
+        * editing/TextCheckingHelper.h:
</ins><span class="cx"> 
</span><del>-2014-04-24  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+2013-06-17  Grzegorz Czajkowski  &lt;g.czajkowski@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Mark Supplement instead of RefCountedSupplement in NavigatorContentUtils 
-        https://bugs.webkit.org/show_bug.cgi?id=132151
</del><ins>+        Unreviewed, rolling out r151632.
+        http://trac.webkit.org/changeset/151632
+        https://bugs.webkit.org/show_bug.cgi?id=117585
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Debug build error ASSERT(WTF_USE_GRAMMAR_CHECKING) for non MAC
+        platforms
</ins><span class="cx"> 
</span><del>-        Though Original goal was to make it sharable across navigator instances, the NavigatorContentUtils
-        has used RefCountedSupplement&lt;Page&gt; instead of RefCountedSupplement&lt;Navigator&gt;. This patch makes it
-        use Supplement&lt;Page&gt; because there is no scenario which needs to be shared across navigator instances.
</del><ins>+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        (WebCore::ContextMenuController::createAndAppendSpellingAndGrammarSubMenu):
+        (WebCore::ContextMenuController::populate):
+        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        * platform/LocalizedStrings.h:
+        * platform/efl/LocalizedStringsEfl.cpp:
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        * platform/qt/LocalizedStringsQt.cpp:
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
</ins><span class="cx"> 
</span><del>-        Blink merge from https://src.chromium.org/viewvc/blink?view=rev&amp;revision=171403.
</del><ins>+2013-06-17  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior changes.
</del><ins>+        Unreviewed. Fix make distcheck.
</ins><span class="cx"> 
</span><del>-        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
-        (WebCore::NavigatorContentUtils::from):
-        (WebCore::NavigatorContentUtils::create):
-        (WebCore::provideNavigatorContentUtilsTo):
-        * Modules/navigatorcontentutils/NavigatorContentUtils.h:
</del><ins>+        * GNUmakefile.list.am: Remove non existent files from compilation
+        and add a missing header file.
</ins><span class="cx"> 
</span><del>-2014-04-24  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-06-14  Grzegorz Czajkowski  &lt;g.czajkowski@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167700.
-        https://bugs.webkit.org/show_bug.cgi?id=132142
</del><ins>+        Context menu grammar checking items are available when GRAMMAR_CHECKING macro is off
+        https://bugs.webkit.org/show_bug.cgi?id=117585
</ins><span class="cx"> 
</span><del>-        Incorrectly reverted the change in r167547 for
-        webkit.org/b/131898 (Requested by rniwa on #webkit).
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Do not add &quot;Check Grammar With Spelling&quot; and &quot;Ignore Grammar&quot; to the context menu
+        when GRAMMAR_CHECKING is off.
+        Replace &quot;Spelling and Grammar&quot; with &quot;Spelling&quot; as the sub menu title and &quot;Show/Hide Spelling
+        and Grammar&quot; with &quot;Show/Hide Spelling&quot; when GRAMMAR_CHECKING is off.
</ins><span class="cx"> 
</span><del>-        &quot;Cursor doesn't change back to pointer when leaving the Safari
-        window&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132038
-        http://trac.webkit.org/changeset/167700
</del><ins>+        Additionally, guard grammar checking in context menu code to not necessarily
+        compile it.
</ins><span class="cx"> 
</span><del>-2014-04-24  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        No new layout tests because every port has a different way of showing
+        spelling/grammar context menu items.
</ins><span class="cx"> 
</span><del>-        Rename &quot;IMAGE_CONTROLS&quot; feature to &quot;SERVICE_CONTROLS&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132155
-
-        Reviewed by Tim Horton.
-
-        No new tests (No change in behavior).
-
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.make:
-        * WebCore.exp.in:
-        * css/CSSDefaultStyleSheets.cpp:
-        (WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        * css/CSSValueKeywords.in:
-        * dom/Node.h:
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::HTMLImageElement):
-        (WebCore::HTMLImageElement::parseAttribute):
-        (WebCore::HTMLImageElement::didAttachRenderers):
-        * html/HTMLImageElement.h:
-        * html/shadow/ImageControlsRootElement.cpp:
-        * html/shadow/ImageControlsRootElement.h:
-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        * html/shadow/mac/ImageControlsButtonElementMac.h:
-        * html/shadow/mac/ImageControlsRootElementMac.cpp:
-        * html/shadow/mac/ImageControlsRootElementMac.h:
-        * page/ContextMenuContext.cpp:
-        (WebCore::ContextMenuContext::ContextMenuContext):
-        * page/ContextMenuContext.h:
</del><span class="cx">         * page/ContextMenuController.cpp:
</span><del>-        (WebCore::ContextMenuController::maybeCreateContextMenu):
</del><ins>+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        (WebCore::ContextMenuController::createAndAppendSpellingAndGrammarSubMenu):
</ins><span class="cx">         (WebCore::ContextMenuController::populate):
</span><del>-        * page/ContextMenuController.h:
-        * page/Settings.in:
-        * platform/ThemeTypes.h:
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::canHaveChildren):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::paintBorderOnly):
-        (WebCore::RenderTheme::paintDecorations):
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::servicesRolloverButtonCell):
-        (WebCore::RenderThemeMac::paintImageControlsButton):
-        (WebCore::RenderThemeMac::imageControlsButtonSize):
</del><ins>+        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        * platform/LocalizedStrings.h:
+        * platform/efl/LocalizedStringsEfl.cpp:
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        * platform/qt/LocalizedStringsQt.cpp:
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
</ins><span class="cx"> 
</span><del>-2014-04-24  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+2013-06-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: Restore PageDebuggerAgent::enable / disable
-        https://bugs.webkit.org/show_bug.cgi?id=132156
</del><ins>+        Fix test assertion after r151624
</ins><span class="cx"> 
</span><del>-        Restore functions that were eroniously removed in r167530.
</del><ins>+        An assertion was hit in RenderObject::willBeDestroyed()
+        for fast/css/getComputedStyle/getComputedStyle-background-shorthand.html
+        because the code asserted that the RenderObject had been removed from
+        the FrameView's slowRepaintObject set before remove() was called,
+        so move the assertion to after that call.
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willBeDestroyed):
</ins><span class="cx"> 
</span><del>-        * inspector/PageDebuggerAgent.cpp:
-        (WebCore::PageDebuggerAgent::enable): Added.
-        (WebCore::PageDebuggerAgent::disable): Added.
-        * inspector/PageDebuggerAgent.h:
</del><ins>+2013-06-16  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-24  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Remove a redundant virtual call to hostWindow() in FrameView::invalidateRect()
+        https://bugs.webkit.org/show_bug.cgi?id=117685
</ins><span class="cx"> 
</span><del>-        Dropzone effects don't work in non-file documents
-        https://bugs.webkit.org/show_bug.cgi?id=131770
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        From Blink r152490 by &lt;vivek.vg@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        File documents have two quirks that were making dropzone work in these before:
-        1. An ancient hack for Dashboard allows pasteboard access from JS.
-        2. On Mac, sandbox doesn't prevent File object creation, as we already have the access.
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::invalidateRect): Avoid hostWindow() twice call.
</ins><span class="cx"> 
</span><del>-        * dom/DataTransfer.cpp:
-        (WebCore::DataTransfer::hasFileOfType):
-        (WebCore::DataTransfer::hasStringOfType):
-        * dom/DataTransfer.h:
-        Moved these functions from EventHandler to DataTransfer. We can't create a DataTransfer
-        with Files while dragging, security doesn't permit us to. But we can get the file name.
</del><ins>+2013-06-16  Kent Tamura  &lt;tkent@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        * fileapi/File.cpp:
-        (WebCore::createBlobDataForFile):
-        (WebCore::createBlobDataForFileWithName):
-        (WebCore::File::contentTypeFromFilePath):
-        (WebCore::getContentTypeFromFileName): Deleted.
-        * fileapi/File.h:
-        Exposed a function to get file type from path without creating a File first.
-        This is much cheaper than creating a File, and works even when sandbox disallows
-        read access to content, such as when dragging over a target.
</del><ins>+        Fix two assertion failures in Range::insertNode
+        https://bugs.webkit.org/show_bug.cgi?id=116511
</ins><span class="cx"> 
</span><del>-        * page/EventHandler.cpp:
-        (WebCore::hasDropZoneType):
-        (WebCore::hasFileOfType): Deleted.
-        (WebCore::hasStringOfType): Deleted.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-04-24  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        &gt; ASSERTION FAILED: childBefore == (offset ? container-&gt;childNode(offset - 1) : 0)
+        &gt; third_party/WebKit/Source/WebCore/dom/RangeBoundaryPoint.h(115) : void WebCore::RangeBoundaryPoint::set(PassRefPtr&lt;WebCore::Node&gt;, int, WebCore::Node *)
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167441.
-        https://bugs.webkit.org/show_bug.cgi?id=132152
</del><ins>+        &gt; ASSERTION FAILED: child-&gt;parentNode()
+        &gt; ../../third_party/WebKit/Source/core/dom/RangeBoundaryPoint.h(133) : void WebCore::RangeBoundaryPoint::setToBeforeChild(WebCore::Node *)
+        &gt;  1   0x87594b2 WebCore::RangeBoundaryPoint::setToBeforeChild(WebCore::Node*)
+        &gt;  2   0x87534a9 WebCore::Range::insertNode(WTF::PassRefPtr&lt;WebCore::Node&gt;, int&amp;)
</ins><span class="cx"> 
</span><del>-        Caused full screen regressions on vimeo, youtube, and others.
-        (Requested by jernoble on #webkit).
</del><ins>+        Range::insertNode calls Node::insertBefore, in which an event handler
+        can update the DOM structure so that RangeBoundaryPoint don't like. We
+        postpone event dispatching by EventQueueScope.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Also, remove old comments about Acid3. The behavior is standardized.
+        (Step 9 of http://dom.spec.whatwg.org/#dom-range-insertnode)
</ins><span class="cx"> 
</span><del>-        &quot;Fullscreen media controls are unusable in pagination mode&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131705
-        http://trac.webkit.org/changeset/167441
</del><ins>+        This patch imports http://src.chromium.org/viewvc/blink?view=revision&amp;revision=150470 .
</ins><span class="cx"> 
</span><del>-2014-04-24  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+        Test: fast/dom/Range/range-insertNode-assertion.html
</ins><span class="cx"> 
</span><del>-        Unused class forward declarations in Page
-        https://bugs.webkit.org/show_bug.cgi?id=132141
</del><ins>+        * dom/Range.cpp:
+        (WebCore::Range::insertNode):
+         - Add EventQueueScope
+         - Remove obsolete comments
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+2013-06-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no change on behavior.
</del><ins>+        Fixed backgrounds in composited layers not repainted on scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=117684
</ins><span class="cx"> 
</span><del>-        * page/Page.h:
-
-2014-04-24  Eric Carlson  &lt;eric.carlson@apple.com&gt;
-
-        [Mac] don't ask for AVAssetTrack properties before they are available
-        https://bugs.webkit.org/show_bug.cgi?id=131902
-        &lt;rdar://problem/16505076&gt;
-
-        Reviewed by Brent Fulgham.
-
-        No new tests, the behavior this changes can not be tested with a layout test.
-
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): Initialize
-            m_cachedTotalBytes.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::beginLoadingMetadata): Don't report that
-            metadata has been loaded until the track properties we need have been loaded too.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::totalBytes): Cache totalBytes instead
-            of recalculating it every time.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksDidChange): Invalidate cached
-            total bytes.
-        (WebCore::assetTrackMetadataKeyNames): Array of AVAssetTrack properties we use.
-
-2014-04-24  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-
-        Unify platformWidthForGlyph across OS X and iOS
-        https://bugs.webkit.org/show_bug.cgi?id=132036
-
-        Reviewed by Darin Adler.
-
-        This patch creates on shared SimpleFontData::platformWidthForGlyph() function for both OS X and iOS.
-
-        No new tests are necessary because there should be no behavior changes.
-
-        * platform/graphics/SimpleFontData.h: Signatures for two helper functions
-        * platform/graphics/ios/SimpleFontDataIOS.mm: Replace iOS implementation of platformWidthForGlyph() with
-        implementations of only the two helper functions
-        (WebCore::SimpleFontData::getRenderingStyle): Compute style argument to CGFontGetGlyphAdvancesForStyle()
-        (WebCore::SimpleFontData::advanceForColorBitmapFont): iOS doesn't have color bitmap fonts
-        (WebCore::SimpleFontData::platformWidthForGlyph): Deleted.
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getRenderingStyle): Compute style argument to CGFontGetGlyphAdvancesForStyle()
-        (WebCore::SimpleFontData::advanceForColorBitmapFont): Use [NSFont advancementForGlyph] to compute the advance
-        (WebCore::hasCustomTracking): Removed #if
-        (WebCore::isEmoji): Only relevant on iOS
-        (WebCore::SimpleFontData::platformWidthForGlyph): Shared implementation. Calls helper functions.
-
-2014-04-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Subpixel rendering: Clipping on text areas when shifted by one device pixel.
-        https://bugs.webkit.org/show_bug.cgi?id=132008
-
-        Reviewed by Darin Adler.
-
-        Make RenderTheme paint* functions LayoutRect aware. Textarea is device pixel snapped, while
-        other theme controls are still on integral size/positions.
-
-        Test: fast/forms/hidpi-textarea-on-subpixel-position.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::paintBorderOnly):
-        (WebCore::RenderTheme::paintDecorations):
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::paintTextField):
-        (WebCore::RenderTheme::paintTextFieldDecorations):
-        (WebCore::RenderTheme::paintTextArea):
-        (WebCore::RenderTheme::paintTextAreaDecorations):
-        * rendering/RenderThemeIOS.h:
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::paintTextFieldDecorations):
-        (WebCore::RenderThemeIOS::paintTextAreaDecorations):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintTextField):
-        (WebCore::RenderThemeMac::paintTextArea):
-
-2014-04-24  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-
-        FontCache::fontCache() never returns nullptr so it can be made to return a reference instead
-        https://bugs.webkit.org/show_bug.cgi?id=132110
-
</del><span class="cx">         Reviewed by Tim Horton.
</span><ins>+        
+        FrameView is aware that &quot;slow-repaint objects&quot; (i.e. renderers with 
+        background-attachment:fixed) require a slow-scrolling path. However,
+        it was ignorant of the fact that such objects could be painting into
+        compositing layers; it simply dirtied the main tiles, and nothing else.
+        
+        Fix by having FrameView track the slow-repaints objects explicitly, as we
+        do for position:fixed, and repaint each of them on scrolling.
</ins><span class="cx"> 
</span><del>-        Updates callers to use '.' instead of '-&gt;'.
</del><ins>+        Test: compositing/repaint/fixed-background-scroll.html
</ins><span class="cx"> 
</span><del>-        No new tests are necessary because there should be no behavior change.
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): No need to initialize m_slowRepaintObjectCount,
+        which is now an OwnPtr&lt;RenderObjectSet&gt;.
+        (WebCore::FrameView::useSlowRepaints): Use hasSlowRepaintObjects() now.
+        (WebCore::FrameView::addSlowRepaintObject): Now adds the object to a set,
+        allocating the set if necessary.
+        (WebCore::FrameView::removeSlowRepaintObject): Remove the object from the set,
+        and deallocate the set if empty.
+        (WebCore::FrameView::scrollContentsSlowPath): Call repaintSlowRepaintObjects();
+        this is the change that fixes the bug for always-composited implementations (e.g.
+        tile cache). This is a conservative change; we still invalidate the tile cache
+        as well. This could be optimized later.
+        (WebCore::FrameView::repaintSlowRepaintObjects): Repaint each object in the set.
+        Their appropriate compositing ancestor will be repainted.
+        (WebCore::FrameView::scrollPositionChangedViaPlatformWidget): Call
+        repaintSlowRepaintObjects() so that fixed backgrounds in composited layers are
+        correctly repainted; this fixes the bug for WebKit1.
+        * page/FrameView.h: Replace m_slowRepaintObjectCount with a HashSet of
+        RenderObjects.
+        (WebCore::FrameView::hasSlowRepaintObject): Takes a RenderObject* now.
+        (WebCore::FrameView::hasSlowRepaintObjects): Ditto.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange): Pass the RenderObject.
+        (WebCore::RenderObject::willBeDestroyed): Assert that this RenderObject
+        has been removed from FrameView's set of slow-repaint objects already, if
+        the document is not being destroyed.
+        (WebCore::RenderObject::willBeRemovedFromTree): Pass the RenderObject.
</ins><span class="cx"> 
</span><del>-        * css/CSSFontFaceSource.cpp:
-        (WebCore::CSSFontFaceSource::getFontData):
-        * css/CSSFontSelector.cpp:
-        (WebCore::CSSFontSelector::CSSFontSelector):
-        (WebCore::CSSFontSelector::~CSSFontSelector):
-        (WebCore::CSSFontSelector::addFontFaceRule):
-        (WebCore::fontDataForGenericFamily):
-        (WebCore::CSSFontSelector::getFallbackFontData):
-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::releaseMemory):
-        * platform/graphics/FontCache.cpp:
-        (WebCore::fontCache): Return a reference
-        * platform/graphics/FontCache.h:
-        (WebCore::FontCachePurgePreventer::FontCachePurgePreventer):
-        (WebCore::FontCachePurgePreventer::~FontCachePurgePreventer):
-        * platform/graphics/FontGlyphs.cpp:
-        (WebCore::FontGlyphs::FontGlyphs):
-        (WebCore::FontGlyphs::releaseFontData):
-        (WebCore::FontGlyphs::realizeFontDataAt):
-        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):
-        * platform/graphics/freetype/FontPlatformDataFreeType.cpp:
-        (WebCore::FontPlatformData::verticalData):
-        * platform/graphics/ios/SimpleFontDataIOS.mm:
-        (WebCore::SimpleFontData::platformCreateScaledFontData):
-        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
-        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
-        * platform/graphics/mac/FontCacheMac.mm:
-        (WebCore::invalidateFontCache):
-        (WebCore::fontCacheRegisteredFontsChangedNotificationCallback):
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::platformDestroy):
-        (WebCore::SimpleFontData::platformCreateScaledFontData):
-        * platform/graphics/win/FontCacheWin.cpp:
-        (WebCore::getCJKCodePageMasks):
-        * platform/graphics/win/SimpleFontDataWin.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
-        * platform/graphics/wince/FontCacheWinCE.cpp:
-        (WebCore::getCJKCodePageMasks):
-        * platform/graphics/wince/FontPlatformData.cpp:
-        (WebCore::FontFamilyCodePageInfo::codePages):
-        (WebCore::FixedSizeFontData::create):
-        * platform/graphics/wince/GlyphPageTreeNodeWinCE.cpp:
-        (WebCore::GlyphPage::fill):
-        * platform/graphics/wince/SimpleFontDataWinCE.cpp:
-        (WebCore::SimpleFontData::platformCreateScaledFontData):
-        (WebCore::SimpleFontData::containsCharacters):
</del><ins>+2013-06-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-24  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Painting of fixed background images is wrong in composited layers
+        https://bugs.webkit.org/show_bug.cgi?id=65793
</ins><span class="cx"> 
</span><del>-        [iOS] Manage AudioSession category according to media type
-        https://bugs.webkit.org/show_bug.cgi?id=132096
-
-        Reviewed by Jer Noble.
-
-        * WebCore.exp.in: Export setting.
-
-        * html/HTMLMediaSession.cpp:
-        (WebCore::HTMLMediaSession::HTMLMediaSession):
-        (WebCore::initializeAudioSession): Deleted.
-
-        * page/Settings.cpp:
-        * page/Settings.h:
-        (WebCore::Settings::setShouldManageAudioSession): New.
-        (WebCore::Settings::shouldManageAudioSession): Ditto.
-
-        * platform/audio/ios/AudioDestinationIOS.cpp:
-        (WebCore::AudioDestinationIOS::AudioDestinationIOS): Use a MediaSession instead of inheriting
-            from AudioListener and calling the AudioSession directly.
-        (WebCore::AudioDestinationIOS::~AudioDestinationIOS): Ditto.
-        (WebCore::AudioDestinationIOS::start): Notify session.
-        (WebCore::AudioDestinationIOS::stop): Ditto.
-        (WebCore::AudioDestinationIOS::beganAudioInterruption): Deleted.
-        (WebCore::AudioDestinationIOS::endedAudioInterruption): Deleted.
-        * platform/audio/ios/AudioDestinationIOS.h:
-        (WebCore::AudioDestinationIOS::mediaType):
-        (WebCore::AudioDestinationIOS::canReceiveRemoteControlCommands):
-        (WebCore::AudioDestinationIOS::didReceiveRemoteControlCommand):
-        (WebCore::AudioDestinationIOS::isPlaying): Deleted.
-
-        * platform/audio/ios/AudioSessionIOS.mm:
-        (WebCore::categoryName): Debug-only logging function.
-        (WebCore::AudioSession::setCategory): Don't stick with &quot;media&quot; once it is set.
-
-        * platform/audio/ios/MediaSessionManagerIOS.mm:
-        (WebCore::MediaSessionManageriOS::resetRestrictions): Set up restrictions for WebAudio.
-        (WebCore::MediaSessionManageriOS::updateNowPlayingInfo): Don't set invalid start time.
-
-        * platform/audio/mac/MediaSessionManagerMac.cpp:
-        (MediaSessionManager::updateSessionState): Manage AudioSession.active when WebAudio clients
-            come and go. Manage AudioSession.category according to the number of WebAudio and
-            HTMLMediaElement clients.
-
-2014-04-24  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        [New Multicolumn] Client rects don't work with column spans.
-        https://bugs.webkit.org/show_bug.cgi?id=132131
-
-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx">         
</span><del>-        Don't factor in the offset of the multicolumn set from the top
-        of the multicolumn block. This was added already, and it doesn't
-        need to be a part of columnTranslationForOffset.
</del><ins>+        The code that computed background image geometry for background-attachment:fixed
+        images was unaware of compositing, so often painting the image at the wrong location.
+        
+        Fix by having RenderBoxModelObject::calculateBackgroundImageGeometry() do the correct
+        math for fixed backgrounds in composited layer by offsetting the viewport rect by
+        the paint container's absolute position.
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/client-rects-spanners.html
</del><ins>+        Tests: compositing/backgrounds/fixed-background-on-descendant.html
+               compositing/backgrounds/fixed-backgrounds.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::columnTranslationForOffset):
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::getBackgroundPaintedExtent): Now returns a bool indicating
+        whether it is returning a reliable extent rect. It can return false in the case where
+        a background is fixed, since computing the correct extent would require finding
+        the appropriate composited ancestor to pass to calculateBackgroundImageGeometry().
+        This is OK since this function is used for &quot;background opaque&quot; optimizations.
+        (WebCore::RenderBox::computeBackgroundIsKnownToBeObscured): If getBackgroundPaintedExtent()
+        returns false, return false.
+        (WebCore::RenderBox::maskClipRect): We removed mask-attachment, so we never need to
+        compute the composited ancestor here and can pass null.
+        (WebCore::RenderBox::repaintLayerRectsForImage): Unwrap a comment.
+        If the changed image is related to a fixed background, geometry.hasNonLocalGeometry()
+        will be true. In that cause, just repaint the entire renderer rather than groveling
+        around for a composited ancestor.
+        * rendering/RenderBox.h: Changed name and signature of backgroundPaintedExtent.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): calculateBackgroundImageGeometry()
+        now needs to know the painting container.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Now takes a painting
+        container, that is required to correctly compute the viewport-relative offset for fixed
+        backgrounds. geometry.setHasNonLocalGeometry() is set for fixed backgrounds to indicate
+        to callers that, if they didn't pass a paint container, the destRect is not accurate.
+        The main bug fix is also here: we move the viewportRect by the absolute location of
+        paint container, which is equivalent to the composited layer offset.
+        (WebCore::RenderBoxModelObject::getGeometryForBackgroundImage): calculateBackgroundImageGeometry()
+        takes a paint container.
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::BackgroundImageGeometry):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setHasNonLocalGeometry):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::hasNonLocalGeometry):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::computeBackgroundIsKnownToBeObscured): If getBackgroundPaintedExtent()
+        can't cheaply give an accurate answer, return false.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundImage): Pass the paint container,
+        which is our own renderer.
</ins><span class="cx"> 
</span><del>-2014-04-24  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</del><ins>+2013-06-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [EFL] WebKit build fails when MEDIA_SOURCE is enabled
-        https://bugs.webkit.org/show_bug.cgi?id=132118
</del><ins>+        webkit-backface-visibility on a parent element stops background-position from updating
+        https://bugs.webkit.org/show_bug.cgi?id=116319
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
-
-        Files MediaSourceGStreamer.cpp, SourceBufferPrivateGStreamer.cpp and
-        WebKitMediaSourceGStreamer.cpp are included for EFL port build.
-
-        No new tests. No change in behaviour.
-
-        * PlatformEfl.cmake: MediaSourceGStreamer.cpp, SourceBufferPrivateGStreamer.cpp
-        and WebKitMediaSourceGStreamer.cpp are included for compilation.
-
-2014-04-24  Tamas Gergely  &lt;tgergely.u-szeged@partner.samsung.com&gt;
-
-        ASSERTION FAILED: !begin.isIndefinite() in WebCore::SVGSMILElement::resolveFirstInterval.
-        https://bugs.webkit.org/show_bug.cgi?id=131097
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        According to smil animation reference, max attribute cannot be 0.
</del><ins>+        The optimization added in r102952 was incorrect in the case where a style change
+        resulted in a positioned-movement-only layout but also required a repaint; it assumed
+        that a composited layer did not need to be repainted for a a positioned-movement-only layout.
+        
+        Fix by making RenderObject::setNeedsLayoutForPositionedMovement() check whether the
+        style change requires a repaint, and calling setLayerNeedsFullRepaint() in that situation.
</ins><span class="cx"> 
</span><del>-        Test: svg/animations/smil-animation-max-attribute-zero-crash.svg
</del><ins>+        Test: compositing/repaint/positioned-movement.html
</ins><span class="cx"> 
</span><del>-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::SVGSMILElement::maxValue):
-          changed (result &lt; 0) to (result &lt;= 0)
-
-2014-04-24  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
-
-        Remove screenColorProfile()
-        https://bugs.webkit.org/show_bug.cgi?id=132035
-
-        Reviewed by Darin Adler.
-
-        Only chromium used screenColorProfile() since r120789.
-
-        * platform/PlatformScreen.h:
-        * platform/efl/PlatformScreenEfl.cpp:
-        (WebCore::screenColorProfile): Deleted.
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::screenColorProfile): Deleted.
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::qcmsOutputDeviceProfile):
-        * platform/ios/PlatformScreenIOS.mm:
-        (WebCore::screenColorProfile): Deleted.
-        * platform/mac/PlatformScreenMac.mm:
-        (WebCore::screenColorProfile): Deleted.
-        * platform/win/PlatformScreenWin.cpp:
-        (WebCore::screenColorProfile): Deleted.
-
-2014-04-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        One more unreviewed build fix after r167755.
-
-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        (WebCore::RenderImageControlsButton::updateLogicalWidth):
-        (WebCore::RenderImageControlsButton::computeLogicalHeight):
-
-2014-04-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Unreviewed build fix after r167755.
-
-        * rendering/RenderThemeMac.h:
-
-2014-04-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Transition RenderTheme API from RenderObject* to const RenderObject&amp;
-        https://bugs.webkit.org/show_bug.cgi?id=132037
-
-        Reviewed by Andreas Kling.
-
-        Using const references provides better encapsulation and improve security.
-
-        No change in behavior.
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::boundingBoxForQuads):
-        * dom/Element.cpp:
-        (WebCore::Element::setActive):
-        (WebCore::Element::setHovered):
-        * editing/FrameSelection.cpp:
-        (WebCore::FrameSelection::focusedOrActiveStateChanged):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::disabledStateChanged):
-        (WebCore::HTMLFormControlElement::readOnlyAttributeChanged):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked):
-        (WebCore::HTMLInputElement::setIndeterminate):
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::parseAttribute):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::addVisualOverflowFromTheme):
-        (WebCore::RenderBlock::baselinePosition):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations):
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::styleDidChange):
-        * rendering/RenderFileUploadControl.cpp:
-        (WebCore::RenderFileUploadControl::paintObject):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::addRegionsVisualOverflowFromTheme):
</del><ins>+        * rendering/RenderLayer.h: RepaintStatus values do not need to be bit flags.
</ins><span class="cx">         * rendering/RenderObject.cpp:
</span><del>-        (WebCore::RenderObject::drawLineForBoxSide):
</del><ins>+        (WebCore::RenderObject::setStyle): Pass the old style to setNeedsPositionedMovementLayout().
+        (WebCore::RenderObject::styleDidChange): Ditto.
</ins><span class="cx">         * rendering/RenderObject.h:
</span><del>-        * rendering/RenderProgress.cpp:
-        (WebCore::RenderProgress::computeLogicalHeight):
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::paint):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::paintBorderOnly):
-        (WebCore::RenderTheme::paintDecorations):
-        (WebCore::RenderTheme::baselinePosition):
-        (WebCore::RenderTheme::adjustRepaintRect):
-        (WebCore::RenderTheme::stateChanged):
-        (WebCore::RenderTheme::updateControlStatesForRenderer):
-        (WebCore::RenderTheme::extractControlStatesForRenderer):
-        (WebCore::RenderTheme::isActive):
-        (WebCore::RenderTheme::isChecked):
-        (WebCore::RenderTheme::isIndeterminate):
-        (WebCore::RenderTheme::isEnabled):
-        (WebCore::RenderTheme::isFocused):
-        (WebCore::RenderTheme::isPressed):
-        (WebCore::RenderTheme::isSpinUpButtonPartPressed):
-        (WebCore::RenderTheme::isReadOnlyControl):
-        (WebCore::RenderTheme::isHovered):
-        (WebCore::RenderTheme::isSpinUpButtonPartHovered):
-        (WebCore::RenderTheme::isDefault):
-        (WebCore::RenderTheme::paintInputFieldSpeechButton):
-        (WebCore::RenderTheme::paintMeter):
-        (WebCore::RenderTheme::paintSliderTicks):
-        (WebCore::RenderTheme::progressBarRectForBounds):
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::controlSupportsTints):
-        (WebCore::RenderTheme::paintCapsLockIndicator):
-        (WebCore::RenderTheme::paintFileUploadIconDecorations):
-        (WebCore::RenderTheme::imageControlsButtonSize):
-        (WebCore::RenderTheme::paintCheckbox):
-        (WebCore::RenderTheme::paintRadio):
-        (WebCore::RenderTheme::paintButton):
-        (WebCore::RenderTheme::paintInnerSpinButton):
-        (WebCore::RenderTheme::paintCheckboxDecorations):
-        (WebCore::RenderTheme::paintRadioDecorations):
-        (WebCore::RenderTheme::paintButtonDecorations):
-        (WebCore::RenderTheme::paintTextField):
-        (WebCore::RenderTheme::paintTextFieldDecorations):
-        (WebCore::RenderTheme::paintTextArea):
-        (WebCore::RenderTheme::paintTextAreaDecorations):
-        (WebCore::RenderTheme::paintMenuList):
-        (WebCore::RenderTheme::paintMenuListDecorations):
-        (WebCore::RenderTheme::paintMenuListButtonDecorations):
-        (WebCore::RenderTheme::paintPushButtonDecorations):
-        (WebCore::RenderTheme::paintSquareButtonDecorations):
-        (WebCore::RenderTheme::paintProgressBar):
-        (WebCore::RenderTheme::paintSliderTrack):
-        (WebCore::RenderTheme::paintSliderThumb):
-        (WebCore::RenderTheme::paintSliderThumbDecorations):
-        (WebCore::RenderTheme::paintSearchField):
-        (WebCore::RenderTheme::paintSearchFieldDecorations):
-        (WebCore::RenderTheme::paintSearchFieldCancelButton):
-        (WebCore::RenderTheme::paintSearchFieldDecorationPart):
-        (WebCore::RenderTheme::paintSearchFieldResultsDecorationPart):
-        (WebCore::RenderTheme::paintSearchFieldResultsButton):
-        (WebCore::RenderTheme::paintMediaFullscreenButton):
-        (WebCore::RenderTheme::paintMediaPlayButton):
-        (WebCore::RenderTheme::paintMediaOverlayPlayButton):
-        (WebCore::RenderTheme::paintMediaMuteButton):
-        (WebCore::RenderTheme::paintMediaSeekBackButton):
-        (WebCore::RenderTheme::paintMediaSeekForwardButton):
-        (WebCore::RenderTheme::paintMediaSliderTrack):
-        (WebCore::RenderTheme::paintMediaSliderThumb):
-        (WebCore::RenderTheme::paintMediaVolumeSliderContainer):
-        (WebCore::RenderTheme::paintMediaVolumeSliderTrack):
-        (WebCore::RenderTheme::paintMediaVolumeSliderThumb):
-        (WebCore::RenderTheme::paintMediaRewindButton):
-        (WebCore::RenderTheme::paintMediaReturnToRealtimeButton):
-        (WebCore::RenderTheme::paintMediaToggleClosedCaptionsButton):
-        (WebCore::RenderTheme::paintMediaControlsBackground):
-        (WebCore::RenderTheme::paintMediaCurrentTime):
-        (WebCore::RenderTheme::paintMediaTimeRemaining):
-        (WebCore::RenderTheme::paintMediaFullScreenVolumeSliderTrack):
-        (WebCore::RenderTheme::paintMediaFullScreenVolumeSliderThumb):
-        (WebCore::RenderTheme::paintSnapshottedPluginOverlay):
-        (WebCore::RenderTheme::paintImageControlsButton):
-        * rendering/RenderThemeIOS.h:
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::addRoundedBorderClip):
-        (WebCore::RenderThemeIOS::paintCheckboxDecorations):
-        (WebCore::RenderThemeIOS::baselinePosition):
-        (WebCore::RenderThemeIOS::paintRadioDecorations):
-        (WebCore::RenderThemeIOS::paintTextFieldDecorations):
-        (WebCore::RenderThemeIOS::paintTextAreaDecorations):
-        (WebCore::RenderThemeIOS::paintMenuListButtonDecorations):
-        (WebCore::RenderThemeIOS::paintSliderTrack):
-        (WebCore::RenderThemeIOS::paintSliderThumbDecorations):
-        (WebCore::RenderThemeIOS::paintProgressBar):
-        (WebCore::RenderThemeIOS::paintSearchFieldDecorations):
-        (WebCore::RenderThemeIOS::paintButtonDecorations):
-        (WebCore::RenderThemeIOS::paintPushButtonDecorations):
-        (WebCore::RenderThemeIOS::paintFileUploadIconDecorations):
-        * rendering/RenderThemeMac.h:
-        (WebCore::RenderThemeMac::updateActiveState):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::documentViewFor):
-        (WebCore::RenderThemeMac::adjustRepaintRect):
-        (WebCore::RenderThemeMac::convertToPaintingRect):
-        (WebCore::RenderThemeMac::updateCheckedState):
-        (WebCore::RenderThemeMac::updateEnabledState):
-        (WebCore::RenderThemeMac::updateFocusedState):
-        (WebCore::RenderThemeMac::updatePressedState):
-        (WebCore::RenderThemeMac::controlSupportsTints):
-        (WebCore::RenderThemeMac::paintTextField):
-        (WebCore::RenderThemeMac::paintCapsLockIndicator):
-        (WebCore::RenderThemeMac::paintTextArea):
-        (WebCore::RenderThemeMac::paintMenuList):
-        (WebCore::RenderThemeMac::paintMeter):
-        (WebCore::RenderThemeMac::progressBarRectForBounds):
-        (WebCore::RenderThemeMac::paintProgressBar):
-        (WebCore::RenderThemeMac::paintMenuListButtonGradients):
-        (WebCore::RenderThemeMac::paintMenuListButtonDecorations):
-        (WebCore::RenderThemeMac::setPopupButtonCellState):
-        (WebCore::RenderThemeMac::paintSliderTrack):
-        (WebCore::RenderThemeMac::paintSliderThumb):
-        (WebCore::RenderThemeMac::paintSearchField):
-        (WebCore::RenderThemeMac::setSearchCellState):
-        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeMac::paintSearchFieldDecorationPart):
-        (WebCore::RenderThemeMac::paintSearchFieldResultsDecorationPart):
-        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
-        (WebCore::RenderThemeMac::paintSnapshottedPluginOverlay):
-        (WebCore::RenderThemeMac::paintImageControlsButton):
-        (WebCore::RenderThemeMac::imageControlsButtonSize):
</del><ins>+        (WebCore::RenderObject::setNeedsPositionedMovementLayout): Now takes a const RenderStyle*.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff): Remove a comment now that this bug is fixed.
+        (WebCore::RenderStyle::diffRequiresRepaint): Public wrapper for changeRequiresRepaint().
+        That function never uses contextSensitiveProperties so we can safely ignore them.
+        * rendering/style/RenderStyle.h: Expose a way to call changeRequiresRepaint().
</ins><span class="cx"> 
</span><del>-2014-04-23  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+2013-06-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] HTML Media capture attribute is a boolean since r163958
-        https://bugs.webkit.org/show_bug.cgi?id=132061
</del><ins>+        Try to fix iOS after last Pasteboard change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gustavo Noronha Silva.
</del><ins>+        * platform/ios/PasteboardIOS.mm:
+        (WebCore::Pasteboard::writeSelection): Put the new code inline here because the
+        stringSelectionForPasteboard function is currently Mac-only.
</ins><span class="cx"> 
</span><del>-        Add new methods webkit_dom_html_input_element_get_capture_enabled
-        and webkit_dom_html_input_element_set_capture_enabled using a
-        boolean and deprecate the old methods.
</del><ins>+2013-06-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/WebKitDOMDeprecated.cpp:
-        (webkit_dom_html_input_element_get_capture):
-        (webkit_dom_html_input_element_set_capture):
-        * bindings/gobject/WebKitDOMDeprecated.h:
-        * bindings/gobject/WebKitDOMDeprecated.symbols:
-        * bindings/gobject/webkitdom.symbols:
-        * bindings/scripts/CodeGeneratorGObject.pm:
-        (GetEffectiveFunctionName): Helper function to rename API methods
-        for special cases.
-        (GenerateFunction): Use GetEffectiveFunctionName().
</del><ins>+        Move Pasteboard::getStringSelection to Editor, fixing a layering violation
+        https://bugs.webkit.org/show_bug.cgi?id=117673
</ins><span class="cx"> 
</span><del>-2014-04-23  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        [MediaStream] Implement MediaStream active attribute
-        https://bugs.webkit.org/show_bug.cgi?id=131973
</del><ins>+        * editing/Editor.h: Added stringSelectionForPasteboardWithImageAltText.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::stringSelectionForPasteboard): Moved code here from the Pasteboard
+        class, since all the Pasteboard class did really was turn around and call back here.
+        (WebCore::Editor::stringSelectionForPasteboardWithImageAltText): Added. Variant of
+        the function above that includes image alt text. Separate named functions are often
+        the best pattern for something like this unless there are many different combinations.
</ins><span class="cx"> 
</span><del>-        MediaStream .active attribute are introduced which will replace
-        .ended attribute. This patch implements the newly introduced attributes.
</del><ins>+        * platform/Pasteboard.h: Remove the Mac-only Pasteboard::getStringSelectioon.
</ins><span class="cx"> 
</span><del>-        MediaStream-add-remove-tracks.html is updated to handle this scenario.
</del><ins>+        * platform/ios/PasteboardIOS.mm:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelectionForTypes):
+        Call the two new functions instead of the old Pasteboard::getStringSelection.
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/MediaStream.cpp:
-        (WebCore::MediaStream::active): Added.
-        (WebCore::MediaStream::setActive): Added.
-        (WebCore::MediaStream::addTrack): Propagates 'onactive' event when required.
-        (WebCore::MediaStream::removeTrack): Propagates 'oninactive' event when required.
-        (WebCore::MediaStream::trackDidEnd): Propagates 'oninactive' event when required.
-        (WebCore::MediaStream::streamDidEnd):
-        (WebCore::MediaStream::setStreamIsActive): Added.
-        * Modules/mediastream/MediaStream.h:
-        * Modules/mediastream/MediaStream.idl:
-        * dom/EventNames.h:
-        * platform/mediastream/MediaStreamPrivate.cpp:
-        (WebCore::MediaStreamPrivate::MediaStreamPrivate): Initialize .active attribute
-        (WebCore::MediaStreamPrivate::setEnded):
-        (WebCore::MediaStreamPrivate::setActive): Added.
-        * platform/mediastream/MediaStreamPrivate.h:
-        (WebCore::MediaStreamPrivate::active): Added.
</del><ins>+2013-06-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-23  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Support using clang instead of gcc for bindings preprocessing
+        https://bugs.webkit.org/show_bug.cgi?id=117674
</ins><span class="cx"> 
</span><del>-        [Cocoa] fix CF leaks found by code inspection
-        https://bugs.webkit.org/show_bug.cgi?id=132106
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        I couldn't build on my computer because I don't have gcc installed.
+        This is my cut at fixing it.
</ins><span class="cx"> 
</span><del>-        * page/CaptionUserPreferencesMediaAF.cpp:
-        (WebCore::trackDisplayName): Added a missing adoptCF.
</del><ins>+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (ReadPublicInterfaces): Use clang if present.
+        * bindings/scripts/preprocessor.pm:
+        (applyPreprocessor): Ditto.
</ins><span class="cx"> 
</span><del>-        * platform/Language.cpp:
-        (WebCore::displayNameForLanguageLocale): Added a missing adoptCF.
</del><ins>+2013-06-14  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/FontPlatformData.cpp:
-        (WebCore::FontPlatformData::openTypeTable): Added a missing adoptCF.
</del><ins>+        REGRESSION (r148367): Facebook and Twitter icons at macworld.com are stacked vertically, obscuring Twitter one
+        https://bugs.webkit.org/show_bug.cgi?id=117284
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/cf/InbandTextTrackPrivateAVCF.cpp:
-        (WebCore::InbandTextTrackPrivateAVCF::label): Added two missing adoptCF.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::AVFWrapper::createImageForTimeInRect): Added two missing adoptCF.
</del><ins>+        Test: fast/text/whitespace/inline-whitespace-wrapping-7.html
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::createPDFDocument): Added missing adoptCF.
</del><ins>+        We were looking for line breaks in trailing collapsed whitespace even when inside a nowrap inline.
+        It's wrong to do this as we don't know yet if we will want or need to break - that decision has to
+        be deferred until we enter a part of the line that is autowrap.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
-        (WebCore::cascadeToLastResortFontDescriptor): Added two missing adoptCF.
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::primaryFontDataIsSystemFont): Added missing adoptCF.
</del><ins>+2013-06-14  Lukasz Gajowy  &lt;l.gajowy@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::hasCustomTracking): Added missing adoptCF.
</del><ins>+        background-color is not preserved when inserting a new paragraph
+        https://bugs.webkit.org/show_bug.cgi?id=117138
</ins><span class="cx"> 
</span><del>-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Added CFRelease.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * plugins/mac/PluginPackageMac.cpp:
-        (WebCore::readPListFile): Added two missing adoptCF.
</del><ins>+        The style isn't copied because background-color isn't defined as inheritable property.
</ins><span class="cx"> 
</span><del>-2014-04-23  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Test: editing/inserting/insert-paragraph-not-preserving-background-color.html
</ins><span class="cx"> 
</span><del>-        REGRESSION (r157328): popover to check into flight ba.com dismisses instantly when focusing form
-        https://bugs.webkit.org/show_bug.cgi?id=131949
</del><ins>+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::calculateStyleBeforeInsertion):
+        Passing EditingPropertiesInEffect instead of implicit parameter OnlyEditingInheritableProperties.
</ins><span class="cx"> 
</span><del>-        Address the review comment.
</del><ins>+2013-06-14  Adam Barth  &lt;abarth@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * dom/EventDispatcher.cpp:
-        (WebCore::EventRelatedNodeResolver::findHostOfTreeScopeInTargetTreeScope):
</del><ins>+        Threaded HTML parser can ASSERT in some situations
+        https://bugs.webkit.org/show_bug.cgi?id=117662
</ins><span class="cx"> 
</span><del>-2014-04-23  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        CachedResourceLoader hoards URLs indefinitely for no good reason.
-        &lt;https://webkit.org/b/132102&gt;
-        &lt;rdar://problem/16708265&gt;
</del><ins>+        This patch merges https://chromium.googlesource.com/chromium/blink/+/3c0a112b42d72c7623f78463166dd7f04d680b4c
</ins><span class="cx"> 
</span><del>-        Since we don't care about CachedResourceLoader::m_validatedURL's after
-        the Document has finished dispatching its initial load event, clear the
-        set at that point, and don't add any new URLs to it.
</del><ins>+        ---&gt;8---
+        The parser is supposed to stop processing data when there's a pending
+        location change, but before this CL we would actually process the first
+        token from every chunk when there was a pending location change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        If the first token in a chunk was a &quot;script&quot; start tag, that would put
+        the tree builder into TextMode, which can only process character
+        tokens. If the next chunk starts with another start tag token, the tree
+        builder would be sad and hit an ASSERT.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::dispatchWindowLoadEvent):
-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::CachedResourceLoader::requestResource):
-        (WebCore::CachedResourceLoader::documentDidFinishLoadEvent):
-        * loader/cache/CachedResourceLoader.h:
</del><ins>+        This CL reorders a couple lines in HTMLDocumentParser so that we check
+        for pending location changes before processing any tokens. This change
+        stops us from processing the first token from each chunk while there is
+        a pending location change.
</ins><span class="cx"> 
</span><del>-2014-04-23  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        This issue can reproduce on any platform, but it reproduced often on
+        Android because mobile markup often elides spaces between consecutive
+        script tags. If there are space characters between the script tags,
+        then those space characters will be the first ones processes in the
+        chunk, which doesn't trigger the ASSERT.
+        ---8&lt;---
</ins><span class="cx"> 
</span><del>-        Canvas cache of clean URLs can grow without bounds.
-        &lt;https://webkit.org/b/132091&gt;
-        &lt;rdar://problem/16695665&gt;
</del><ins>+        Since we landed this patch in Blink, we've been able to reproduce this
+        issue on desktops as well. I spoke with rniwa in #webkit and he said
+        that WebKit doesn't have any current plans to enable the threaded
+        parser but that it was probably worth merging this patch anyway.
</ins><span class="cx"> 
</span><del>-        Remove a silly &quot;optimization&quot; that kept a cache of clean URLs
-        that can be drawn into a canvas without tainting it, all to avoid
-        the &quot;expensive&quot; checks to determine whether it would taint.
</del><ins>+        Test: http/tests/navigation/pending-location-change-assert.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::processParsedChunkFromBackgroundParser):
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext.cpp:
-        (WebCore::CanvasRenderingContext::wouldTaintOrigin):
-        * html/canvas/CanvasRenderingContext.h:
</del><ins>+2013-06-14  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-23  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Introduce USE(WINGDI) for the Windows port
+        https://bugs.webkit.org/show_bug.cgi?id=116138
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Fix a few mistakes affecting the initial layout and the initial unobscured rect
-        https://bugs.webkit.org/show_bug.cgi?id=132093
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Using USE(WINGDI) instead of OS(WINCE) will allow us to
+        compile the GDI based Windows port on WinNT too.
</ins><span class="cx"> 
</span><del>-        Change the minimum layout size to float point values to account for size defined on retina displays.
-        The minimum layout size supports half-pixels, the value is rounded later when computing the layout size
-        in document coordinates.
</del><ins>+        * config.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/FontPlatformData.h:
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore):
+        (GlyphBuffer):
+        * platform/graphics/Gradient.h:
+        (Gradient):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore):
+        (GraphicsContext):
+        * platform/graphics/ImageBufferData.h:
+        * platform/graphics/NativeImagePtr.h:
+        (WebCore):
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::snapshot):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/ViewportConfiguration.cpp:
-        (WebCore::ViewportConfiguration::ViewportConfiguration):
-        Setting the initial content size is incorrect. The layout size computation already take into account
-        empty size for the first layout.
</del><ins>+2013-06-13  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Setting the content size upfront make the first computation incorrect when the viewport arguments specify
-        the initial scale.
</del><ins>+        Report the memory cost of HTMLMediaElements to GC.
+        https://bugs.webkit.org/show_bug.cgi?id=117608
</ins><span class="cx"> 
</span><del>-        (WebCore::ViewportConfiguration::setMinimumLayoutSize):
-        * page/ViewportConfiguration.h:
-        (WebCore::ViewportConfiguration::minimumLayoutSize):
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-04-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Report the extra memory cost of a HTMLMediaElement to the VM, in order to
+        encourage GC to occur after a media element is removed from the DOM.
</ins><span class="cx"> 
</span><del>-        [Mac, iOS] Stop buffering media when on an inactive tab. 
-        https://bugs.webkit.org/show_bug.cgi?id=132077
</del><ins>+        Because we cannot know for sure the memory cost of our underlying media
+        framework objects, use the worst case scenario for the media memory cost:
+        the buffered percentage of movie * the total data length of the movie.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
-
-        * html/HTMLMediaElement.cpp: Rename 'm_isDisplaySleepDisablingSuspended'
-        to 'm_elementIsHidden'.
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        (WebCore::HTMLMediaElement::visibilityStatusChanged): Notify the
-        media session that the element is (or is not) hidden.
-        (WebCore::HTMLMediaElement::setShouldBufferData): Added.
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_reportedExtraMemoryCost.
+        (WebCore::HTMLMediaElement::removedFrom): Report the extra memory cost.
</ins><span class="cx">         * html/HTMLMediaElement.h:
</span><del>-        * platform/audio/MediaSession.cpp:
-        (WebCore::MediaSession::clientWillBeginPlayback): Tell media to
-        buffer if not hidden or playing.
-        (WebCore::MediaSession::clientWillPausePlayback): Ditto.
-        (WebCore::MediaSession::visibilityChanged): Added. Client API, just relays call
-        to updateClientDataBuffering.
-        (WebCore::MediaSession::updateClientDataBuffering): Tell client it should only
-        buffer data if it's currently playing, or not hidden.
-        * platform/audio/MediaSession.h:
</del><ins>+        * html/TimeRanges.cpp:
+        (TimeRanges::totalDuration): Added convenience function.
+        * html/TimeRanges.h:
</ins><span class="cx">         * platform/graphics/MediaPlayer.cpp:
</span><del>-        (WebCore::MediaPlayer::setShouldBufferData): Added: Just relays to
-        MediaPlayerPrivate object.
</del><ins>+        (WebCore::MediaPlayer::extraMemoryCost): Pass to MediaPlayerPrivate.
</ins><span class="cx">         * platform/graphics/MediaPlayer.h:
</span><span class="cx">         * platform/graphics/MediaPlayerPrivate.h:
</span><del>-        (WebCore::MediaPlayerPrivateInterface::setShouldBufferData):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setShouldBufferData): Added.
-        Detach the player item from the player if we don't want to continue
-        buffering or other background tasks.
</del><ins>+        (WebCore::MediaPlayerPrivateInterface::extraMemoryCost): Default to 0.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::extraMemoryCost): Return the percentage
+            loaded * total data length.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
</ins><span class="cx"> 
</span><del>-2014-04-23  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-06-13  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Eliminate internals.setMockScrollbarsEnabled()
-        https://bugs.webkit.org/show_bug.cgi?id=132085
</del><ins>+        Add support for AVFoundation-backed HTMLMediaElements in the WebVideoFullScreenController.
+        https://bugs.webkit.org/show_bug.cgi?id=117597
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        This was essentially unused, and also didnt work.
</del><ins>+        Check for media elements with AVFoundation media types and create a AVPlayerLayer
+        rather than a QTMovieLayer.
</ins><span class="cx"> 
</span><del>-        * testing/InternalSettings.cpp:
-        (WebCore::InternalSettings::Backup::restoreTo):
-        (WebCore::InternalSettings::setMockScrollbarsEnabled): Deleted.
-        * testing/InternalSettings.h:
-        * testing/InternalSettings.idl:
</del><ins>+        * platform/mac/WebVideoFullscreenController.h:
+        * platform/mac/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController setupVideoOverlay:]): Take a CALayer rather than a
+            QTMovieLayer. Move the code which connects the layer with it's media source into
+            setMediaElement.
+        (-[WebVideoFullscreenController windowDidLoad]): Give the window's contentView a generic
+            CALayer instaead of a QTMovieLayer.
+        (-[WebVideoFullscreenController setMediaElement:]): Test whether the incoming media 
+            element is backed by a QTMovie or an AVPlayer, and create the appropriate layer.
+        (-[WebVideoFullscreenController windowDidExitFullscreen]): Remove the observer of
+            AVPlayer's rate property.
+        (-[WebVideoFullscreenController observeValueForKeyPath:ofObject:change:context:]):
+            If the keyPath is &quot;rate&quot;, call rateChanged.
</ins><span class="cx"> 
</span><del>-2014-04-23  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+2013-06-14  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Don't migrate the WKView.h header from WebCore to WebKit
-        https://bugs.webkit.org/show_bug.cgi?id=132086
</del><ins>+        WKPageFindStringMatches ignores the kWKFindOptionsBackwards option.
+        https://bugs.webkit.org/show_bug.cgi?id=117647
+        &lt;rdar://problem/13881024&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        Reviewed by Darin Adler.
+        
+        The API returns the matched ranges in the DOM order regardless of the
+        find direction, but the index of the first match after the user selection
+        should take the find direction into account.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        Add WAKViewInternal.h.
</del><ins>+        Extended existing test in TestWebKitAPI.
</ins><span class="cx"> 
</span><del>-        * platform/WAKViewInternal.h: Added.
</del><ins>+        * page/Page.cpp:
+        (WebCore::Page::findStringMatchingRanges): Added handling of the Backwards case.
+        * page/Page.h: Fixed incorrect name of the enum.
</ins><span class="cx"> 
</span><del>-        * platform/ios/wak/WAKClipView.m:
-        Import WAKViewInternal.h instead of WAKViewPrivate.h.
</del><ins>+2013-06-14  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/wak/WAKScrollView.mm:
-        Import WAKViewInternal.h instead of WAKViewPrivate.h.
</del><ins>+        REGRESSION (r150651): Web Audio doesn't work at all (silence or squawks) on Mountain Lion
+        https://bugs.webkit.org/show_bug.cgi?id=117652
</ins><span class="cx"> 
</span><del>-        * platform/ios/wak/WAKView.h:
-        Move ivars to a class extension in WAKViewInternal.h and remove WKView.h import.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        * platform/ios/wak/WAKView.mm:
-        Import WAKViewInternal.h instead of WAKViewPrivate.h.
</del><ins>+        r150651 disabled setting the buffer size to a large value, but in so doing, also
+        disabled setting the buffer size to a small value for Web Audio. Narrow the Mountain
+        Lion protection to just the &lt;video&gt; element case.
+        
+        * platform/audio/mac/AudioSessionManagerMac.cpp:
+        (AudioSessionManager::updateSessionState):
</ins><span class="cx"> 
</span><del>-        * platform/ios/wak/WAKViewPrivate.h:
-        Import WKViewPrivate.h.
</del><ins>+2013-06-14  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-23  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        Function names on Object.prototype should be common identifiers
+        https://bugs.webkit.org/show_bug.cgi?id=117614
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] fast/multicol/fixed-column-percent-logical-height-orthogonal-writing-mode.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=132078
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Use the added common identifiers.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::skipContainingBlockForPercentHeightCalculation):
-        Add a parameter to test for orthogonal writing modes. If we're perpendicular,
-        then we should not skip the flow thread, since we resolve relative to the column width,
-        and that is always set.
</del><ins>+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::finishCreation):
+        (WebCore::JSDOMWindowBase::updateDocument):
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBox::computePercentageLogicalHeight):
-        Patched to pass in whether or not the box and the ancestor block are perpendicular.
</del><ins>+2013-06-14  Arpita Bahuguna  &lt;a.bah@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.h:
-        Patched the signature of skipContainingBlockForPercentHeightCalculation
</del><ins>+        Editing: wrong text position when you click enter on the text behind the image
+        https://bugs.webkit.org/show_bug.cgi?id=115023
</ins><span class="cx"> 
</span><del>-2014-04-23  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        [OS X] Make checking if a font is the system font more robust
-        https://bugs.webkit.org/show_bug.cgi?id=132030
</del><ins>+        When trying to break a line after an image followed by some text, contrary
+        to the expected behavior the text doesn't move to a new line, instead, the
+        caret position just shifts to the end of line.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        As per the existing implementation for inserting a paragraph separator,
+        the insertion position obtained corresponds to the point after the image
+        element.
+        Since the insertion position doesn't resolve to being offset in the
+        following text node (0 offset), no splitting of text occurs and the block
+        to be inserted is placed after the containing (start) block (thereby
+        causing the caret position to shift).
</ins><span class="cx"> 
</span><del>-        Instead of inspecting a font's name to determine if it is a system font,
-        on OS X we can ask the system directly.
-
-        This patch also moves a platform-specific check into platform-specific
-        code, so that other platforms don't check for OS X-specific behavior.
-
-        Covered by existing tests.
-
-        * platform/graphics/Font.cpp:
-        (WebCore::Font::hasValidAverageCharWidth):
-        * platform/graphics/Font.h:
-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::primaryFontDataIsSystemFont):
-
-2014-04-23  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        [New Multicolumn] Assertion failure in huge-column-count.html
-        https://bugs.webkit.org/show_bug.cgi?id=132071
-
-        Reviewed by Dean Jackson.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::regionAtBlockOffset):
-        Back out this change, since it wasn't general enough.
-
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
-        The real issue was that this loop needed to consider the actual box
-        rather than starting from the parent. This was a non-issue for normal
-        regions (which cannot have nested flow threads), but for columns, you 
-        have to consider the fact that the box could itself be a flow thread.
-
-2014-04-23  Andreas Kling  &lt;akling@apple.com&gt;
-
-        [iOS] Memory pressure notification should fire on main thread.
-        &lt;https://webkit.org/b/132074&gt;
-
-        Rejig the memory pressure notification to fire on the main queue
-        directly instead of rerouting it manually.
-
-        Reviewed by Mark Rowe.
-
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::install):
-
-2014-04-23  Commit Queue  &lt;commit-queue@webkit.org&gt;
-
-        Unreviewed, rolling out r167720.
-        https://bugs.webkit.org/show_bug.cgi?id=132075
-
-        broke eight newmulticol tests (Requested by thorton on
-        #webkit).
-
-        Reverted changeset:
-
-        &quot;[New Multicolumn] Assertion failure in huge-column-
-        count.html&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132071
-        http://trac.webkit.org/changeset/167720
-
-2014-04-23  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        [New Multicolumn] Assertion failure in huge-column-count.html
-        https://bugs.webkit.org/show_bug.cgi?id=132071
-
-        Reviewed by Dean Jackson.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::regionAtBlockOffset):
-        Remove the code that returned 0 here, since we're going to patch a lower-level
-        function to catch all cases.
-
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
-        Don't allow in-flow RenderFlowThreads to ever have a region range. The sets
-        are what should have ranges... the flow thread needs to just be ignored.
-
-2014-04-23  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        [New Multicolumn] Crasher when clearing out a flow thread in multicolumn layout.
-        https://bugs.webkit.org/show_bug.cgi?id=132069
-
-        Reviewed by Dean Jackson.
-
-        This is imported from a patch Morten did for Blink, but I had to change it a fair
-        bit. deleteLines() is used to handle simple line box layout instead of just calling
-        deleteLineBoxTree.
</del><ins>+        If the computed insertionPosition points to an element that shall be
+        ignored for editing purposes (i.e. cannot have a VisiblePosition inside
+        it), and the position lies either at the start or at the end of such
+        an element, we should move our Position either upstream or
+        downstream (respectively) so as to obtain a valid position which can
+        be used further for splitting of the text.
</ins><span class="cx">         
</span><del>-        I also had to disable the layout state to stop asserts on repaint when the children
-        get moved. Not sure why Blink didn't hit this, but it's simple enough to add a
-        LayoutStateDisabler to stop the assert.
</del><ins>+        Test: editing/inserting/insert-paragraph-after-non-editable-node-before-text.html
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/inline-children-crash.html
</del><ins>+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        Moving the insertionPosition either upstream or downstream, if the point
+        lies either at the start or at the end of the anchor node.
+        The ensuing position, if a text node, can then be used for splitting of
+        the text correctly.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::evacuateAndDestroy):
</del><ins>+2013-06-14  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-23  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        [BlackBerry] Remove implementation of ContextMenu classes
+        https://bugs.webkit.org/show_bug.cgi?id=114860
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] IOSurfacePool should force CA to actually garbage collect surfaces.
-        &lt;https://webkit.org/b/132065&gt;
-        &lt;rdar://problem/16110687&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Add a platformGarbageCollectNow() helper function to IOSurfacePool that
-        triggers a sweep of the IOSurfaces. Call this from collectionTimerFired()
-        and discardAllSurfaces().
</del><ins>+        This code is not being used so we can safely remove it.
</ins><span class="cx"> 
</span><del>-        This lets us drop all otherwise-unused 420f surfaces on memory pressure.
</del><ins>+        * PlatformBlackBerry.cmake:
+        * platform/blackberry/ContextMenuBlackBerry.cpp: Removed.
+        * platform/blackberry/ContextMenuItemBlackBerry.cpp: Removed.
+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+2013-06-14  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/cg/IOSurfacePool.cpp:
-        (WebCore::IOSurfacePool::collectionTimerFired):
-        (WebCore::IOSurfacePool::discardAllSurfaces):
-        * platform/graphics/cg/IOSurfacePool.h:
-        * platform/graphics/cocoa/IOSurfacePoolCocoa.mm: Added.
-        (WebCore::IOSurfacePool::platformGarbageCollectNow):
</del><ins>+        [Windows] Provide simple &lt;meter&gt; drawing logic for testing.
+        https://bugs.webkit.org/show_bug.cgi?id=117645.
</ins><span class="cx"> 
</span><del>-2014-04-23  Morten Stenshorne  &lt;mstensho@opera.com&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        REGRESSION (Safari 6 - ToT): Incorrectly assumes that RenderStyle data can be shared
-        https://bugs.webkit.org/show_bug.cgi?id=113058
</del><ins>+        accessbility/meter-element.html
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        * rendering/RenderThemeSafari.cpp: Simple test implementation
+        (WebCore::RenderThemeSafari::adjustMeterStyle): Added.
+        (WebCore::RenderThemeSafari::supportsMeter): Added.
+        (WebCore::RenderThemeSafari::meterSizeForBounds): Added.
+        (WebCore::RenderThemeSafari::paintMeter): Added.
+        * rendering/RenderThemeSafari.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::progressBarTheme): Added.
+        (WebCore::RenderThemeWin::getClassicThemeData): Support meters.
+        (WebCore::RenderThemeWin::getThemeData): Support meter theme.
+        (WebCore::RenderThemeWin::adjustMeterStyle): Added.
+        (WebCore::RenderThemeWin::supportsMeter): Added.
+        (WebCore::RenderThemeWin::meterSizeForBounds): Added.
+        (WebCore::RenderThemeWin::paintMeter): Added.
+        * rendering/RenderThemeWin.h:
</ins><span class="cx"> 
</span><del>-        Before sharing CSS properties with an element in the cache, we need to
-        check that the new element is suitable for this, just like we check
-        elements before inserting them into the cache.
</del><ins>+2013-06-14  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/css/identical-logical-height-decl.html
</del><ins>+        Potential use-after-free with an event fired at a HTMLMediaElement which is currently being deleted
+        https://bugs.webkit.org/show_bug.cgi?id=117466
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::applyMatchedProperties):
-
-2014-04-23  Commit Queue  &lt;commit-queue@webkit.org&gt;
-
-        Unreviewed, rolling out r167713.
-        https://bugs.webkit.org/show_bug.cgi?id=132070
-
-        broke hundreds of tests (Requested by thorton on #webkit).
-
-        Reverted changeset:
-
-        &quot;[OS X] Make checking if a font is the system font more
-        robust&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132030
-        http://trac.webkit.org/changeset/167713
-
-2014-04-22  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        [New Multicolumn] Nested columns not working at all.
-        https://bugs.webkit.org/show_bug.cgi?id=131805
-
-        Reviewed by Dean Jackson.
-
-        Add support for nested pagination contexts, allowing for an arbitrary level
-        of nesting of multicolumn layouts. There were a number of things that had to
-        be patched in order for this to work.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::regionAtBlockOffset):
-        Make sure RenderMultiColumnFlowThreads just return null for regions at any
-        block offset. Individual region sets will be created as you cross ancestor
-        regions eventually, so this is just getting in the way.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::enclosingPaginationLayerInSubtree):
-        Add a new helper method for obtaining an enclosingPaginationLayer when
-        constrained by some root. This function ensures you don't accidentally
-        cross your subtree root when looking for enclosing pagination layers.
-
-        (WebCore::RenderLayer::collectFragments):
-        Patch collectFragments to know how to recur to collect ancestor fragments
-        in order to apply nested splitting as you cross pagination boundaries.
-
-        (WebCore::RenderLayer::updatePaintingInfoForFragments):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayer.h:
-        (WebCore::LayerFragment::LayerFragment):
-        (WebCore::LayerFragment::setRects):
-        (WebCore::LayerFragment::moveBy):
-        (WebCore::LayerFragment::intersect):
-        Improve the LayerFragment so that it caches transformed bounding boxes as
-        well. This is needed to fix intersectsDamageRect so that it doesn't grab
-        the wrong bounding box when checking inline layers that are paginated.
-
-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
-        Ignore inserted flow threads inside an ancestor flow thread, since we only
-        care about what the sets do.
</del><ins>+        Reviewed by Oliver Hunt.
</ins><span class="cx">         
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::insertedIntoTree):
-        Make sure that nested flow thread layers return themselves when a child
-        is inserted directly under them.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/f4200a0093b3d9376f703961615359ec7fb712b4
+        
+        If an event is created using as target an HTMLMediaElement which is
+        currently being deleted it becomes a heap-use-after free situation.
</ins><span class="cx"> 
</span><del>-2014-04-22  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        The GenericEventQueue instance is already owned by the HTMLMediaElement,
+        and there already is an underlying mechanism to set the target of the
+        event to NULL, if their target is owner of the queue.
</ins><span class="cx"> 
</span><del>-        [OS X] Make checking if a font is the system font more robust
-        https://bugs.webkit.org/show_bug.cgi?id=132030
</del><ins>+        In order to avoid creating this reference in the first place, we enqueue
+        the event with a NULL target to defer the refcount increment until the
+        timer for dispatching the event happens (which won't happen at all if
+        garbage collection is already destroying the objects).
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Test: media/track/media-element-enqueue-event-crash.html
</ins><span class="cx"> 
</span><del>-        Instead of inspecting a font's name to determine if it is a system font,
-        on OS X we can ask the system directly.
</del><ins>+        * dom/GenericEventQueue.cpp:
+        (WebCore::GenericEventQueue::enqueueEvent): Don't ASSERT if the event has no target.
</ins><span class="cx"> 
</span><del>-        This patch also moves a platform-specific check into platform-specific
-        code, so that other platforms don't check for OS X-specific behavior.
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::~HTMLMediaElement): Close the event queue so it won't try to
+            dispatch any pending events.
+        (WebCore::HTMLMediaElement::scheduleEvent): Don't set the event target, it will happen just
+            prior to event dispatch.
+        (WebCore::HTMLMediaElement::stop): Close the event queue.
</ins><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+2013-06-14  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Font.cpp:
-        (WebCore::Font::hasValidAverageCharWidth):
-        * platform/graphics/Font.h:
-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::primaryFontDataIsSystemFont):
</del><ins>+        Clicking on snapshotting plug-ins does not restart them
+        https://bugs.webkit.org/show_bug.cgi?id=117620
+        &lt;rdar://problem/13821729&gt;
</ins><span class="cx"> 
</span><del>-2014-04-23  Philippe Normand  &lt;pnormand@igalia.com&gt;
</del><ins>+        Follow-up review comments from Darin Adler, with some
+        discussion on IRC.
</ins><span class="cx"> 
</span><del>-        [GTK] Focus management API was moved from HTMLDocument to Document in r166668
-        https://bugs.webkit.org/show_bug.cgi?id=132060
</del><ins>+        Sprinkle OVERRIDE on virtual functions where needed. Also
+        make sure that the Event is a MouseEvent before casting to it.
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+        * html/HTMLPlugInElement.h: Move defaultEventHandler back to protected and add OVERRIDE.
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::defaultEventHandler): Check for MouseEvent and
+        use toMouseEvent().
+        * html/HTMLPlugInImageElement.h: Sprinkle some OVERRIDEs, and move defaultEventHandler
+        to private.
</ins><span class="cx"> 
</span><del>-        Deprecate the removed methods in WebKitDOMHTMLDocument to keep API compatibility.
</del><ins>+2013-06-14  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/WebKitDOMDeprecated.cpp:
-        (webkit_dom_html_document_get_active_element):
-        (webkit_dom_html_document_has_focus):
-        * bindings/gobject/WebKitDOMDeprecated.h:
-        * bindings/gobject/WebKitDOMDeprecated.symbols:
-        * bindings/gobject/webkitdom.symbols:
</del><ins>+        Remove front-end from the WebCore Xcode project.
+        https://bugs.webkit.org/show_bug.cgi?id=117640
</ins><span class="cx"> 
</span><del>-2014-04-22  Andreas Kling  &lt;akling@apple.com&gt;
-
-        [iOS WebKit1] MemoryPressureHandler::respondToMemoryPressure called on wrong thread.
-        &lt;https://webkit.org/b/132041&gt;
-        &lt;rdar://problem/16687238&gt;
-
-        Always dispatch the memory pressure relief code on the main queue.
-        This is really only needed for iOS/WK1, but we might as well share the code.
-
-        Reviewed by Michael Saboff.
-
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::install):
-
-2014-04-23  Philippe Normand  &lt;pnormand@igalia.com&gt;
-
-        [GTK] ShadowRoot API was removed in r164131
-        https://bugs.webkit.org/show_bug.cgi?id=132059
-
-        Reviewed by Gustavo Noronha Silva.
-
-        Add ShadowRoot removed API to WebKitDOMDeprecated to keep API/ABI compatibility.
-
-        * bindings/gobject/WebKitDOMDeprecated.cpp:
-        (webkit_dom_shadow_root_class_init):
-        (webkit_dom_shadow_root_init):
-        (webkit_dom_shadow_root_element_from_point):
-        (webkit_dom_shadow_root_get_active_element):
-        (webkit_dom_shadow_root_get_apply_author_styles):
-        (webkit_dom_shadow_root_get_element_by_id):
-        (webkit_dom_shadow_root_get_elements_by_class_name):
-        (webkit_dom_shadow_root_get_elements_by_tag_name):
-        (webkit_dom_shadow_root_get_elements_by_tag_name_ns):
-        (webkit_dom_shadow_root_get_inner_html):
-        (webkit_dom_shadow_root_get_reset_style_inheritance):
-        (webkit_dom_shadow_root_get_selection):
-        (webkit_dom_shadow_root_set_apply_author_styles):
-        (webkit_dom_shadow_root_set_inner_html):
-        (webkit_dom_shadow_root_set_reset_style_inheritance):
-        * bindings/gobject/WebKitDOMDeprecated.h:
-        * bindings/gobject/WebKitDOMDeprecated.symbols:
-
-2014-04-23  Morten Stenshorne  &lt;mstensho@opera.com&gt;
-
-        [New Multicolumn] fast/multicol/overflow-content.html displays red
-        https://bugs.webkit.org/show_bug.cgi?id=131809
-
-        Reviewed by David Hyatt.
-
-        Insert a break at end of content on our own in the multicol code, to make sure
-        that overflow is accounted for, and also to make sure that we account for all
-        content in non-final sets (i.e. those preceding spanners).
-
-        In other words, this will additionally fix balancing issues in sets preceding
-        a spanner. Added a test for that.
-
-        Tests: fast/multicol/break-in-columns-before-spanner.html
-               fast/multicol/newmulticol/compare-with-old-impl/overflow-content.html
-
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::regionInRange): Deleted.
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::distributeImplicitBreaks):
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::applyBreakAfterContent):
-        * rendering/RenderNamedFlowThread.h:
-
-2014-04-23  Morten Stenshorne  &lt;mstensho@opera.com&gt;
-
-        Overflow propagation broken in BTT and RTL writing-modes
-        https://bugs.webkit.org/show_bug.cgi?id=113781
-
-        Reviewed by David Hyatt.
-
-        Overflow rectangles are not quite physical, not quite logical. This
-        means that we cannot use clientBoxRect() directly to represent a
-        rectangle that expresses exactly no overflow. This rectangle is the
-        padding box (relative to the border box) in vertical-lr and
-        horizontal-tb, but the block-direction borders need to be flipped in
-        vertical-rl and horizontal-bt.
-
-        Tests: fast/css/overflow-btt-border-after.html
-               fast/css/overflow-rtl-border-after.html
-
-        * WebCore.exp.in:
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::computeOverflow):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::addLayoutOverflow):
-        (WebCore::RenderBox::addVisualOverflow):
-        (WebCore::RenderBox::layoutOverflowRectForPropagation):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::layoutOverflowRect):
-
-2014-04-23  Andrei Bucur  &lt;abucur@adobe.com&gt;
-
-        [CSS Regions] Improve the debugging infrastructure
-        https://bugs.webkit.org/show_bug.cgi?id=132042
-
-        Reviewed by Mihnea Ovidenie.
-
-        This patch improves the debugging code for CSS Regions.
-
-        Tests: No function change. No new tests.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::showRegionsInformation): Print brackets around the region range when dumping
-        the render tree to the console.
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::containingRegion): Convert the ASSERT to an ASSERT_WITH_SECURITY_IMPLICATION.
-
-2014-04-22  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-
-        Cursor doesn't change back to pointer when leaving the Safari window
-        https://bugs.webkit.org/show_bug.cgi?id=132038
-
-        Reviewed by Alexey Proskuryakov.
-
-        r147739 incorrectly added an early exit in EventHandler::selectCursor when hit test result didn't have
-        any node associated with it. Since we will hit this code when the cursor is outside of the WebView,
-        we still need to take the CURSOR_AUTO path as did the code before r147739.
-
-        No new test is added since this behavior can't be tested in DRT or WTR.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor):
-
-2014-04-22  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Do not paint border image when the border rect is empty.
-        https://bugs.webkit.org/show_bug.cgi?id=131988
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        http://trac.webkit.org/changeset/167351 introduced an early return when border
-        rect is empty. This patch ensures that border image is not painted either in that case.
</del><ins>+        * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-        Modified padding-margin-negative-border.html to cover border-image case.
</del><ins>+2013-06-14  Jaehun Lim  &lt;ljaehun.lim@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBorder):
</del><ins>+        CSSParser::parseImageSet() doesn't need a parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=117617
</ins><span class="cx"> 
</span><del>-2014-04-22  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        ASSERTION FAILED: scrollerImp == scrollbarPainterForScrollbar(_scrollbar) on two API tests
-        https://bugs.webkit.org/show_bug.cgi?id=132034
-        &lt;rdar://problem/16624332&gt;
-
-        Reviewed by Simon Fraser.
-
-        * platform/mac/ScrollAnimatorMac.mm:
-        (-[WebScrollbarPainterDelegate shouldUseLayerPerPartForScrollerImp:]):
-        scrollerImpWithStyle:controlSize:horizontal:replacingScrollerImp: moves the delegate
-        from the old scrollerImp to the new one, and also happens to call shouldUseLayerPerPartForScrollerImp.
-        Since scrollerImpWithStyle: has not returned yet, the scrollbarPainterForScrollbar still returns the old scrollerImp,
-        so this assertion fires. It's safe to remove this because supportsUpdateOnSecondaryThread doesn't make use of the imp.
-
-2014-04-22  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-
-        REGRESSION (r157328): popover to check into flight ba.com dismisses instantly when focusing form
-        https://bugs.webkit.org/show_bug.cgi?id=131949
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        The regression was caused by two bugs:
-        1. The event didn't stop propagating itself even when it should.
-           If the related target is same as the event origin, the event propagation should stop when the event reaches
-           the root of the related target's tree scope. Otherwise, it should stop when it reaches the related target.
</del><ins>+        parseImageSet() can get m_valueList directly.
+        And minor fixes.
</ins><span class="cx"> 
</span><del>-        2. Mouse event's related target exposed nodes inside a user-agent shadow DOM when the related target appeared
-           inside the origin.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Fixed the bugs by re-introducing path shrinkage algorithm removed in r157328 into EventPath::setRelatedTarget
-        and adding an algorithm to determine the least common ancestor of the related target and the current target
-        in moveToParentOrShadowHost. The latter algorithm doesn't match the shadow DOM specification:
-        http://www.w3.org/TR/2013/WD-shadow-dom-20130514/
-        but it's good enough in terms of the Web exposed behavior as we don't support author defined insertion points.
</del><ins>+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseContent):
+        (WebCore::CSSParser::parseFillImage):
+        (WebCore::CSSParser::parseBorderImage):
+        (WebCore::CSSParser::parseImageSet):
+        * css/CSSParser.h:
</ins><span class="cx"> 
</span><del>-        Test: fast/events/shadow-event-path.html
</del><ins>+2013-06-14  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/EventDispatcher.cpp:
-        (WebCore::EventRelatedNodeResolver::moveToParentOrShadowHost):
-        (WebCore::EventRelatedNodeResolver::findHostOfTreeScopeInTargetTreeScope): Added.
-        (WebCore::EventDispatcher::dispatchEvent):
-        (WebCore::EventPath::setRelatedTarget):
</del><ins>+        [BlackBerry] Dropdown button UX updates.
+        https://bugs.webkit.org/show_bug.cgi?id=117642.
</ins><span class="cx"> 
</span><del>-2014-04-22  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Rollout r156635 since the old behavior was intentional.
</del><ins>+        JIRA 388652
+        Internally Reviewed by Jeff Rogers.
</ins><span class="cx"> 
</span><del>-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor):
</del><ins>+        Change arrow assert.
</ins><span class="cx"> 
</span><del>-2014-04-22  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::RenderThemeBlackBerry::paintMenuList):
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167674.
-        https://bugs.webkit.org/show_bug.cgi?id=132025
</del><ins>+2013-06-14  Arvid Nilsson  &lt;anilsson@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Going a different way with this (Requested by bradee-oh on
-        #webkit).
</del><ins>+        [BlackBerry] LayerTiler fails to tile really big layers
+        https://bugs.webkit.org/show_bug.cgi?id=117211
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        &quot;Change Image Controls replacement to use selection and paste&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131992
-        http://trac.webkit.org/changeset/167674
</del><ins>+        PR 273550
</ins><span class="cx"> 
</span><del>-2014-04-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        The cause for this bug was that LayerTiler computed which tiles are
+        visible by exhaustively mapping every tile to normalized device
+        coordinates and checking if it intersected the viewport. If there was a
+        lot of tiles, it would get stuck in this loop, iterating over all
+        tiles, for a very long time. Also, the visibility information was
+        transferred to the WebKit thread using mutexes, which added unnecessary
+        mutex contention to the mix.
</ins><span class="cx"> 
</span><del>-        [Win] Support Python 2.7 in Cygwin
-        https://bugs.webkit.org/show_bug.cgi?id=132023
</del><ins>+        Fixed by doing the reverse calculation, unprojecting the visible part
+        of the layer to layer coordinate space to find which tiles are visible.
+        Instead of doing a traditional unprojection of point to line and see
+        where the line intersects the layer, this patch uses the w-coordinates
+        of triangle vertices to perform &quot;perspective correct texturing&quot; of the
+        intersection points in device space, which is equivalent to
+        unprojection since perspective correct texturing computes a 2D
+        coordinate in (normalized) layer coordinate space which is easily
+        scaled up to the layer bounds and get the visible region expressed in
+        layer coordinate space.
</ins><span class="cx"> 
</span><del>-        Reviewed by Michael Saboff.
</del><ins>+        The visible area is approximated by a rectangle, and a set of tiles
+        needing render are added to the mix, and  we have a swappable data
+        structure so visbility can be transferred to WebKit thread without
+        mutexes, but instead using atomic swap.
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make: Use proper path to Cygwin on
-        all platforms.
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-2014-04-22  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * platform/graphics/blackberry/CanvasLayerWebKitThread.cpp:
+        (CanvasLayerCompositingThreadClient):
+        (WebCore::CanvasLayerCompositingThreadClient::drawTextures):
+        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp:
+        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
+        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.h:
+        (EGLImageLayerCompositingThreadClient):
+        * platform/graphics/blackberry/LayerCompositingThread.cpp:
+        (WebCore::LayerCompositingThread::drawTextures):
+        (WebCore::LayerCompositingThread::drawSurface):
+        * platform/graphics/blackberry/LayerCompositingThread.h:
+        (LayerCompositingThread):
+        * platform/graphics/blackberry/LayerCompositingThreadClient.h:
+        (WebCore):
+        (LayerCompositingThreadClient):
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::compositeLayersRecursive):
+        * platform/graphics/blackberry/LayerTile.cpp:
+        (WebCore::LayerTile::LayerTile):
+        (WebCore::LayerTile::setContents):
+        (WebCore::LayerTile::updateContents):
+        (WebCore::LayerTile::discardContents):
+        * platform/graphics/blackberry/LayerTile.h:
+        (LayerTile):
+        (WebCore::LayerTile::contentsScale):
+        (WebCore::LayerTile::setContentsDirty):
+        * platform/graphics/blackberry/LayerTiler.cpp:
+        (LayerVisibility):
+        (WebCore::LayerVisibility::LayerVisibility):
+        (WebCore::LayerVisibility::visibleRect):
+        (WebCore::LayerVisibility::setVisibleRect):
+        (WebCore::LayerVisibility::needsRender):
+        (WebCore::LayerVisibility::tileNeedsRender):
+        (WebCore::LayerVisibility::willRenderTile):
+        (WebCore::LayerVisibility::swapTilesNeedingRender):
+        (WebCore::LayerVisibility::merge):
+        (WebCore):
+        (WebCore::LayerTiler::LayerTiler):
+        (WebCore::LayerTiler::~LayerTiler):
+        (WebCore::LayerTiler::updateTextureContentsIfNeeded):
+        (WebCore::LayerTiler::swapFrontVisibility):
+        (WebCore::LayerTiler::setFrontVisibility):
+        (WebCore::LayerTiler::layerVisibilityChanged):
+        (WebCore::LayerTiler::uploadTexturesIfNeeded):
+        (WebCore::LayerTiler::processTextureJob):
+        (WebCore::LayerTiler::addTileJob):
+        (WebCore::LayerTiler::performTileJob):
+        (WebCore::LayerTiler::drawTile):
+        (WebCore::inflateViewport):
+        (WebCore::LayerTiler::drawTextures):
+        (WebCore::LayerTiler::pruneTextures):
+        (WebCore::LayerTiler::rectForTile):
+        * platform/graphics/blackberry/LayerTiler.h:
+        (WebCore):
+        (LayerTiler):
+        (WebCore::LayerTiler::TextureJob::TextureJob):
+        (WebCore::LayerTiler::takeFrontVisibility):
+        * platform/graphics/blackberry/LayerUtilities.h:
+        (WebCore):
+        (WebCore::det):
+        (WebCore::dot):
+        (LayerClipEdge):
+        (WebCore::LayerClipEdge::LayerClipEdge):
+        (WebCore::LayerClipEdge::isPointInside):
+        (WebCore::LayerClipEdge::computeIntersection):
+        (WebCore::intersectPolygonWithRect):
+        (WebCore::computeBarycentricCoordinates):
+        (WebCore::manhattanDistanceToViewport):
+        (UnprojectionVertex):
+        (WebCore::compareManhattanDistanceToViewport):
+        (WebCore::unproject):
</ins><span class="cx"> 
</span><del>-        REGRESSION (r151839): Subframe keeps getting mousemove events with the same coordinates after hiding a hovered element.
-        &lt;https://webkit.org/b/131974&gt;
-        &lt;rdar://problem/15907469&gt;
</del><ins>+2013-06-14  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When the currently hovered element disappears as a result of style recalc,
-        we send a fake mousemove event to the page, to see if anything newly added
-        should become hovered.
</del><ins>+        [Mac] clicking caption track glyph should dismiss menu
+        https://bugs.webkit.org/show_bug.cgi?id=117621
</ins><span class="cx"> 
</span><del>-        The faking mechanism lives in EventHandler and simply synthesizes a new
-        mousemove event using the last seen mouse location.
</del><ins>+        We now correctly capture all click events while the captions track menu
+        is showing, and ensure that no other control in the media player can be
+        activated as the track list gets dismissed by clicking anywhere but on
+        itself.
</ins><span class="cx"> 
</span><del>-        The problem here is that we were sending this fake mousemove event to the
-        subframe where the hovered element lived. Since subframes aren't kept up
-        to date on recent mouse locations, this could cause some strange behavior
-        where a subframe would dispatch mousemove events with stale coordinates.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        The solution is to always dispatch fake mousemove events from the main
-        frame's event handler. This is how real event delivery happens, and hit
-        testing will then find the appropriate subframe, if any.
</del><ins>+        * html/shadow/MediaControlsApple.cpp:
+        (WebCore::MediaControlsApple::showClosedCaptionTrackList):
+        Make the controls panel non-interactive and track click events in the
+        capture phase also on the controls container itself such that we can
+        identify correctly whether a click in the &lt;video&gt; shadow tree is on
+        the track list or another element (the target could only be resolved
+        to a shadow tree node if the event is handled within the shadow tree).
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        (WebCore::MediaControlsApple::hideClosedCaptionTrackList):
+        Make the controls panel interactive again and remove the new click
+        event handler on the controls container.
</ins><span class="cx"> 
</span><del>-        Test: fast/events/ghostly-mousemoves-in-subframe.html
</del><ins>+        (WebCore::MediaControlsApple::handleClickEvent):
+        Capture any click event that targets a node anywhere outside of the track
+        list container and its subtree and hide the track list in this condition.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle):
</del><ins>+        (WebCore::MediaControlsAppleEventListener::handleEvent):
+        Call handleClickEvent() on the media controls when a click event is handled.
</ins><span class="cx"> 
</span><del>-2014-04-22  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        * html/shadow/MediaControlsApple.h:
+        New public handleClickEvent() API such that it can be called from
+        MediaControlsAppleEventListener::handleEvent().
</ins><span class="cx"> 
</span><del>-        [OS X] Glyph spacing for system fonts may be incorrect
-        https://bugs.webkit.org/show_bug.cgi?id=131967
</del><ins>+2013-06-14  Arvid Nilsson  &lt;anilsson@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed iOS build fix after r167679.
</del><ins>+        [BlackBerry] Accelerated compositing layers that intersect the image plane are incorrectly transformed
+        https://bugs.webkit.org/show_bug.cgi?id=117067
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/SimpleFontDataMac.mm:
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-2014-04-22  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        PR 273550
</ins><span class="cx"> 
</span><del>-        [OS X] Glyph spacing for system fonts may be incorrect
-        https://bugs.webkit.org/show_bug.cgi?id=131967
</del><ins>+        The BlackBerry port used to mathematically project each corner of each
+        layer bounds rectangle, which gives the wrong results when the layer
+        intersects the image plane.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r167679.
</del><ins>+        For display lists, we still got the correct appearance of the layer
+        contents, since the display list results in geometry that's transformed
+        in the vertex shader, on the GPU.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::hasCustomTracking):
</del><ins>+        However, the transformed bounds are used for drawing the debug border,
+        performing visibility calculations on the CPU and drawing of WebGL,
+        masks/reflections and filters. Using the mathematical projection of
+        points that lie behind the image plane gives the wrong results.
</ins><span class="cx"> 
</span><del>-2014-04-21  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        The most important consequence of this bug was that the wrong area of
+        the layer would be considered visible, so a tiled layer would not
+        populate the right tiles (or any tiles at all).
</ins><span class="cx"> 
</span><del>-        [OS X] Glyph spacing for system fonts may be incorrect
-        https://bugs.webkit.org/show_bug.cgi?id=131967
</del><ins>+        Fixed by implementing something along the lines of the recipe in
+        section 6.2 of http://www.w3.org/TR/css3-transforms.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        No new tests, manually testable by enabling debug border on
+        https://developer.mozilla.org/en-US/demos/detail/the-box/launch.
</ins><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp:
+        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
+        * platform/graphics/blackberry/LayerCompositingThread.cpp:
+        (WebCore::LayerCompositingThread::LayerCompositingThread):
+        (WebCore::LayerCompositingThread::setDrawTransform):
+        (WebCore):
+        (WebCore::LayerCompositingThread::textureCoordinates):
+        (WebCore::LayerCompositingThread::drawTextures):
+        * platform/graphics/blackberry/LayerCompositingThread.h:
+        (LayerCompositingThread):
+        (WebCore::LayerCompositingThread::transformedBounds):
+        (WebCore::LayerCompositingThread::ws):
+        (WebCore::LayerCompositingThread::centerW):
+        * platform/graphics/blackberry/LayerFilterRenderer.cpp:
+        (WebCore::LayerFilterRenderer::applyActions):
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::compareLayerW):
+        (WebCore::LayerRenderer::compositeLayers):
+        (WebCore::LayerRenderer::drawDebugBorder):
+        (WebCore):
+        (WebCore::LayerRenderer::updateLayersRecursive):
+        (WebCore::LayerRenderer::compositeLayersRecursive):
+        * platform/graphics/blackberry/LayerRenderer.h:
+        (WebCore):
+        (LayerRenderer):
+        * platform/graphics/blackberry/LayerRendererSurface.cpp:
+        (WebCore::LayerRendererSurface::boundingBox):
+        (WebCore::LayerRendererSurface::transformedBounds):
+        * platform/graphics/blackberry/LayerRendererSurface.h:
+        (WebCore::LayerRendererSurface::setDrawTransform):
+        (WebCore::LayerRendererSurface::setReplicaDrawTransform):
+        (LayerRendererSurface):
+        * platform/graphics/blackberry/LayerUtilities.h: Added.
+        (WebCore):
+        (LayerClipPlane):
+        (WebCore::LayerClipPlane::LayerClipPlane):
+        (WebCore::LayerClipPlane::isPointInside):
+        (WebCore::LayerClipPlane::computeIntersection):
+        (WebCore::intersect):
+        (WebCore::boundingBox):
+        (WebCore::multVecMatrix):
+        (WebCore::toVector):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::platformWidthForGlyph): Update to use CTFontGetAdvancesForGlyphs() for system fonts
-        (WebCore::hasCustomTracking):
</del><ins>+2013-06-14  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-22  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        [Qt] Map rewind and fast forward keys to match GoogleTV
+        https://bugs.webkit.org/show_bug.cgi?id=117634
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] widows/orphans cause assertion failures.
-        https://bugs.webkit.org/show_bug.cgi?id=131233
</del><ins>+        Reviewed by Jocelyn Turcotte.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Set the same keycode for media keys rewind and fast-forward as
+        GoogleTV does.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::recordSpaceShortage):
-        Fix an obvious bug where the space shortage is recorded twice (and the
-        if statement that kept it from being negative is accidentally ignored).
</del><ins>+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
</ins><span class="cx"> 
</span><del>-2014-04-22  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+2013-06-13  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Make sure columnTranslationForOffset has the same column-span-aware
-        translation that fragment collection does.
-        https://bugs.webkit.org/show_bug.cgi?id=131738
</del><ins>+        Avoid unnecessary data copies when loading subresources with DoNotBufferData option
+        https://bugs.webkit.org/show_bug.cgi?id=115804
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::collectLayerFragments):
-        Remove a FIXME that is no longer needed, since the translation offset of the 
-        column set did get patched.
</del><ins>+        When DoNotBufferData option is used to load a resource its data
+        is always copied before sending it to the CachedResource. Most
+        of the cached resources ignore the incremental data and wait
+        until all data has been received to save the ResourceBuffer,
+        that will be NULL anyway when DoNotBufferData is used.
+        CachedRawResource notifies its clients about the incremental
+        data, but it doesn't save the data when DoNotBufferData option
+        is present. In those cases we are unnecessary copying the data.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderMultiColumnSet::columnTranslationForOffset):
-        Add the exact same fix to columnTranslationForOffset that was applied to collectLayerFragments.
</del><ins>+        CachedResource::data has been split into
+        CachedResource::addDataBuffer() used for incremental data chunks
+        when buffering data, CachedResource::addData() used for
+        incremental data chunks when not buffering and
+        CachedResource::finishLoading() used to finish the loading. This
+        way we get rid of the allDataReceived boolean parameter and cached
+        resources not interested in incremenetal data chunks only have to
+        implement finishLoading() without having to check if all data have
+        been received or not.
</ins><span class="cx"> 
</span><del>-2014-04-22  Mark Lam  &lt;mark.lam@apple.com&gt;
</del><ins>+        SubresourceLoader::sendDataToResource was always called after
+        checking if loading multipart content, and then it was checked
+        again to decided whether to copy the data or not. It has been
+        removed in favor of calling directly the resource methods,
+        finishLoading for multipart content, addDataBuffer for data chunks
+        when buffering and addData for data chunks when not buffering.
</ins><span class="cx"> 
</span><del>-        WebCore::HTMLMediaElement::ensureMediaControlsInjectedScript() needs to acquire the JSLock before calling into JS.
-        &lt;https://webkit.org/b/132021&gt;
</del><ins>+        No new functionality, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mark Hahnenberg.
</del><ins>+        * html/ImageDocument.cpp:
+        (WebCore::ImageDocumentParser::appendBytes): Update to API changes.
+        (WebCore::ImageDocumentParser::finish): Ditto.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::didReceiveResponse): Call
+        finishLoading() for multipart content.
+        (WebCore::SubresourceLoader::didReceiveDataOrBuffer): Add data to
+        the resource using addDataBuffer or addData depending on whether
+        we are buffering or not.
+        (WebCore::SubresourceLoader::didFinishLoading): Call
+        finishLoading() for the cached resource instead of data.
+        * loader/SubresourceLoader.h:
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::finishLoading):
+        * loader/cache/CachedCSSStyleSheet.h:
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::finishLoading):
+        * loader/cache/CachedFont.h:
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::isValidDecodedImageSize): Helper function
+        to check if the image size is valid.
+        (WebCore::CachedImage::addIncrementalDataBuffer): Helper function
+        to add incremental data buffer.
+        (WebCore::CachedImage::addDataBuffer): Call
+        addIncrementalDataBuffer().
+        (WebCore::CachedImage::addData): Create a ResourceBuffer and call
+        addIncrementalDataBuffer().
+        (WebCore::CachedImage::finishLoading):
+        * loader/cache/CachedImage.h:
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::calculateIncrementalDataChunk):
+        Returns a pointer to the data corresponding to the current chunk
+        and its length.
+        (WebCore::CachedRawResource::addDataBuffer): Assert to make sure
+        this is only called when BufferData option is present. Use
+        calculateIncrementalDataChunk().
+        (WebCore::CachedRawResource::addData): Assert to make sure this is
+        only called when DoNotBufferData option is present.
+        (WebCore::CachedRawResource::finishLoading):
+        (WebCore::CachedRawResource::notifyClientsDataWasReceived): Helper
+        private function to notify the clients about data received.
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::addDataBuffer):
+        (WebCore::CachedResource::addData):
+        (WebCore::CachedResource::finishLoading):
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedSVGDocument.cpp:
+        (WebCore::CachedSVGDocument::finishLoading):
+        * loader/cache/CachedSVGDocument.h:
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::finishLoading):
+        * loader/cache/CachedScript.h:
+        * loader/cache/CachedShader.cpp:
+        (WebCore::CachedShader::finishLoading):
+        * loader/cache/CachedShader.h:
+        * loader/cache/CachedTextTrack.cpp:
+        (WebCore::CachedTextTrack::addDataBuffer):
+        (WebCore::CachedTextTrack::finishLoading):
+        * loader/cache/CachedTextTrack.h:
+        * loader/cache/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::finishLoading):
+        * loader/cache/CachedXSLStyleSheet.h:
</ins><span class="cx"> 
</span><del>-        Covered by existing layout test.
</del><ins>+2013-06-14  Michał Pakuła vel Rutka  &lt;m.pakula@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
</del><ins>+        [EFL] Fix build when DRAG_SUPPORT is set OFF
+        https://bugs.webkit.org/show_bug.cgi?id=117628
</ins><span class="cx"> 
</span><del>-2014-04-22  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+        Reviewed by Gyuyoung Kim.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r167652): Broke fast/regions/cssom/region-range-for-box-crash.html in debug mode
-        https://bugs.webkit.org/show_bug.cgi?id=131982
</del><ins>+        Add guard around Clipboard::declareAndWriteDragImage.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        * platform/efl/ClipboardEfl.cpp:
</ins><span class="cx"> 
</span><del>-        The problem was creating the Range from the arguments received at RenderView::setSelection(). Specifically
-        in this test endPos is 1 when the element has not children which creates an invalid Range.
</del><ins>+2013-06-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::splitSelectionBetweenSubtrees): Pass 0 as startPos and endPos to Range::create() as we are
-        not interested in the positions at this point.
</del><ins>+        Sometimes we stick in slow scrolling mode even after leaving a page
+        https://bugs.webkit.org/show_bug.cgi?id=117622
</ins><span class="cx"> 
</span><del>-2014-04-22  Brady Eidson  &lt;beidson@apple.com&gt;
-
-        Change Image Controls replacement to use selection and paste
-        &lt;rdar://problem/16302722&gt; and https://bugs.webkit.org/show_bug.cgi?id=131992
-
-        Reviewed by Tim Horton.
-
-        * WebCore.exp.in: Remove deleted symbol.
-
-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        (WebCore::ImageControlsButtonElementMac::defaultEventHandler):
-
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::showImageControlsMenu): Select the image element
-          before showing the menu.
-        (WebCore::ContextMenuController::replaceControlledImage): Deleted.
-        * page/ContextMenuController.h:
-
-2014-04-22  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        REGRESSION: Hitting asserts in new flow thread selection code.
-        https://bugs.webkit.org/show_bug.cgi?id=132019
-
-        Reviewed by Anders Carlsson.
-
-        Null checking flowThreadController is not enough. The list of threads
-        can be null even when the flowThreadController is not. That's why you
-        use hasRenderNamedFlowThreads. I patched the two bad places in the code
-        to use hasRenderNamedFlowThreads to stop the crashes.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx">         
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::selectionBounds):
-        (WebCore::RenderView::repaintSelection):
</del><ins>+        ScrollingCoordinator, and thus the scrolling state tree, is owned by Page,
+        and so persists when navigating between cached pages. We do give the ScrollingStateTree
+        a new ScrollingStateScrollingNode on navigation, however the ScrollingStateScrollingNode
+        would not have dirty flags set for, say, WheelEventHandlerCount if the document had
+        no wheel handlers. And because that dirty flag wasn't set, ScrollingTree::commitNewTreeState()
+        would fail to update m_hasWheelEventHandlers, so we'd remain in slow scrolling.
+        
+        Fix by having ScrollingStateTree remember if it's been given a new root ScrollingStateScrollingNode,
+        and making ScrollingTree::commitNewTreeState() to the right thing in that case.
+        
+        Also fix a couple of issues with the tiled scrolling indicator. First, on cached page
+        navigation, the indicator color would show the state for the old page, because
+        ScrollingCoordinatorMac::commitTreeState() checked scrollingTree()-&gt;hasWheelEventHandlers()
+        before the scrolling thread has committed the new scrolling tree.
+        
+        Second, the color change would animate, so stop that.
</ins><span class="cx"> 
</span><del>-2014-04-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Not testable, since tests can only dump the scrolling state tree.
</ins><span class="cx"> 
</span><del>-        Check (rather than assume) element is a RenderTableSection before using it
-        https://bugs.webkit.org/show_bug.cgi?id=121858
</del><ins>+        * page/scrolling/ScrollingStateTree.cpp:
+        (WebCore::ScrollingStateTree::ScrollingStateTree):
+        (WebCore::ScrollingStateTree::attachNode):
+        (WebCore::ScrollingStateTree::commit):
+        * page/scrolling/ScrollingStateTree.h:
+        (WebCore::ScrollingStateTree::hasNewRootStateNode):
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::commitNewTreeState):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::commitTreeState):
+        * platform/graphics/ca/mac/TileController.mm:
+        (-[WebTiledScrollingIndicatorLayer init]): Turn off borderColor implicit animations.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Kilzer.
</del><ins>+2013-06-13  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/table/table-insert-object-before-td-crash.html
</del><ins>+        [curl] Merge http response header values
+        https://bugs.webkit.org/show_bug.cgi?id=117342
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::addChild): Check that lastBox is a table section before
-        using the node as if it was one.
-
-2014-04-22  Alex Christensen  &lt;achristensen@webkit.org&gt;
-
-        Begin implementation of video using Media Foundation.
-        https://bugs.webkit.org/show_bug.cgi?id=131830
-
</del><span class="cx">         Reviewed by Brent Fulgham.
</span><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        Added MediaPlayerPrivateMediaFoundation files.
-        * platform/graphics/MediaPlayer.cpp:
-        Include MediaPlayerPrivateMediaFoundation inside new USE(MEDIA_FOUNDATION) flag.
-        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp: Added.
-        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h: Added.
</del><ins>+        According to the HTTP RFC some HTTP header values should be
+        merged if multiple entries for the same header exists.
</ins><span class="cx"> 
</span><del>-2014-04-22  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::isAppendableHeader):
+        (WebCore::headerCallback):
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167658.
-        https://bugs.webkit.org/show_bug.cgi?id=131993
</del><ins>+2013-06-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Caused many crashes on media tests (Requested by ap on
-        #webkit).
</del><ins>+        Should not call firePaintRelatedMilestones() for &quot;update control tints&quot; paint pass
+        https://bugs.webkit.org/show_bug.cgi?id=117624
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        &quot;[Mac] don't ask for AVAssetTrack properties before they are
-        available&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131902
-        http://trac.webkit.org/changeset/167658
</del><ins>+        When window activation changes, we do a fake paint pass that is just used to
+        invalidate controls that change their appearance in background windows. This fake
+        paint should not be recorded in the inspector, and it should not cause paint-related
+        milestones to fire.
</ins><span class="cx"> 
</span><del>-2014-04-22  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        [New Multicolumn] fast/multicol/multicol-with-child-renderLayer-for-input.html puts the textfield in the wrong place
-        https://bugs.webkit.org/show_bug.cgi?id=131808
-
-        Reviewed by Brady Eidson.
-    
-        Make sure FrameView is patched to pass in the update pagination flag when subtree layout
-        is done on textfields. It had code for the old multicolumn system but did not have a check
-        for the new multicolumn system.
-
-        Added fast/multicol/newmulticol/compare-with-old-impl/multicol-with-child-renderLayer-for-input.html
-
</del><span class="cx">         * page/FrameView.cpp:
</span><del>-        (WebCore::updateLayerPositionFlags):
</del><ins>+        (WebCore::FrameView::paintContents):
</ins><span class="cx"> 
</span><del>-2014-04-22  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-06-13  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        border-style: double rendered as solid when combined with border-radius
-        https://bugs.webkit.org/show_bug.cgi?id=131927
</del><ins>+        Clicking on snapshotting plug-ins does not restart them
+        https://bugs.webkit.org/show_bug.cgi?id=117620
+        &lt;rdar://problem/13821729&gt;
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        BorderEdge::getDoubleBorderStripeWidths() should return the calculated inner, outer border widths. 
</del><ins>+        HTMLPlugInElement has an event handler which would return
+        immediately if the element was not snapshotted, restarting
+        or playing. There is a case it missed, which was snapshotting
+        (WaitingForSnapshot to be precise). If we get a click in this
+        state then it should immediately restart.
</ins><span class="cx"> 
</span><del>-        Test: fast/borders/hidpi-double-border-with-border-radius-always-produce-solid-line.html
</del><ins>+        * html/HTMLPlugInElement.h: Move defaultEventHandler to public (we call it from the child class).
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::defaultEventHandler): If there is a click on a snapshotting
+        plug-in, then call restart.
+        * html/HTMLPlugInImageElement.h: Virtual defaultEventHandler declaration.
</ins><span class="cx"> 
</span><del>-        * rendering/BorderEdge.cpp:
-        (WebCore::BorderEdge::getDoubleBorderStripeWidths):
-        * rendering/BorderEdge.h:
</del><ins>+2013-06-13  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-22  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Use borderAndPadding[Before,After]() instead of border[Before,After]() + padding[Before,After]()
+        https://bugs.webkit.org/show_bug.cgi?id=117611
</ins><span class="cx"> 
</span><del>-        [Mac] don't ask for AVAssetTrack properties before they are available
-        https://bugs.webkit.org/show_bug.cgi?id=131902
-        &lt;rdar://problem/16505076&gt;
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        I added a new function called borderAndPaddingAfter(), since we already had borderAndPaddingBefore(). I changed
+        every separate additions to the old/new function. This change makes the code shorter and more straightforward.
</ins><span class="cx"> 
</span><del>-        No new tests, the behavior this changes can not be tested with a layout test.
</del><ins>+        Behavior hasn't changed, no new tests were needed.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): Initialize
-            m_cachedTotalBytes.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::beginLoadingMetadata): Don't report that
-            metadata has been loaded until the track properties we need have been loaded too.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::totalBytes): Cache totalBytes instead
-            of recalculating it every time.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksDidChange): Invalidate cached
-            total bytes.
-        (WebCore::assetTrackMetadataKeyNames): Array of AVAssetTrack properties we use.
</del><ins>+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::marginBeforeEstimateForChild):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::columnRectAt):
+        (WebCore::RenderBlock::relayoutForPagination):
+        (WebCore::RenderBlock::adjustRectForColumns):
+        (WebCore::RenderBlock::flipForWritingModeIncludingColumns):
+        (WebCore::RenderBlock::adjustStartEdgeForWritingModeIncludingColumns):
+        (WebCore::RenderBlock::adjustForColumns):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLineInFlowThread):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::borderAndPaddingStart):
+        (WebCore::RenderBoxModelObject::borderAndPaddingBefore):
+        (WebCore::RenderBoxModelObject::borderAndPaddingAfter):
+        (WebCore::RenderBoxModelObject::borderAndPaddingLogicalHeight):
+        * rendering/RenderMultiColumnBlock.cpp:
+        (WebCore::RenderMultiColumnBlock::layoutSpecialExcludedChild):
+        * rendering/RenderMultiColumnSet.cpp:
+        (WebCore::RenderMultiColumnSet::heightAdjustedForSetOffset):
+        (WebCore::RenderMultiColumnSet::prepareForLayout):
+        (WebCore::RenderMultiColumnSet::columnRectAt):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::computeIntrinsicPadding):
+        (WebCore::RenderTableCell::cellBaselinePosition):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::firstLineBoxBaseline):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::lineSnapAdjustment):
+        (WebCore::RootInlineBox::selectionTop):
+        (WebCore::RootInlineBox::ascentAndDescentForBox):
</ins><span class="cx"> 
</span><del>-2014-04-22  Peter Molnar  &lt;pmolnar.u-szeged@partner.samsung.com&gt;
</del><ins>+2013-06-13  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Buildfix after r167650 broke non-Cocoa builds
-        https://bugs.webkit.org/show_bug.cgi?id=131980
</del><ins>+        Move Node::shouldUseInputMethod() to Element.
+        &lt;http://webkit.org/b/117603&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleWheelEvent):
</del><ins>+        This method is only ever called on Elements, so move it off of Node.
</ins><span class="cx"> 
</span><del>-2014-04-22  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::shouldUseInputMethod):
+        * dom/Element.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.h:
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Selection highlight doesn't match DOM selection
-        https://bugs.webkit.org/show_bug.cgi?id=131511
</del><ins>+2013-06-13  Max Vujovic  &lt;mvujovic@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        [CSS Regions] Selection dragged from a region paints its background
+        https://bugs.webkit.org/show_bug.cgi?id=117607
</ins><span class="cx"> 
</span><del>-        This patch implements a subtrees approach to fix selection interaction in CSS Regions.
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        The idea is to divide the Render tree in subtrees. One subtree will be the RenderView (which is always present),
-        then for each RenderNamedFlowThread (which are children of RenderView) we will have an extra subtree.
</del><ins>+        When a RenderFlowThread is in the selection paint phase, tell its layer to paint with the
+        selection only behavior. This way, only foregrounds and not backgrounds will be painted in
+        the dragged selection.
</ins><span class="cx"> 
</span><del>-        For each subtree it determines the start and end positions according to the DOM tree. So, every subtree will
-        always have a start and end position, and the selection algorithm will be able to reach the end from the start
-        without problems (this allows us to remove the changes introduced in r155058).
</del><ins>+        Manual test: ManualTests/regions/drag-selection-painting.html
</ins><span class="cx"> 
</span><del>-        Then selection related methods in RenderView are adapted to ensure that they are called for each subtree. Making
-        the selection highlight to match DOM selection as expected.
</del><ins>+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintFlowThreadPortionInRegion):
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/selection/selecting-text-including-region.html
</del><ins>+2013-06-13  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: Add new class SelectionSubtreeRoot to build file.
-        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * rendering/RenderNamedFlowThread.h: Inherit from SelectionSubtreeRoot.
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::selectionRoot): New method to return the RenderNamedFlowThread if any or the RenderView
-        otherwise.
-        (WebCore::RenderObject::selectionStartEnd): If it's inside a RenderNamedFlowThread use specific method instead
-        of the RenderView's one.
-        * rendering/RenderObject.h: Add new method signature.
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::selectionBounds): Adapt method to subtrees approach.
-        (WebCore::RenderView::subtreeSelectionBounds): Modify previous method in order to use SelectionSubtreeRoot
-        objects.
-        (WebCore::RenderView::repaintSelection): Adapt method to subtrees approach.
-        (WebCore::RenderView::repaintSubtreeSelection): Modify previous method in order to use SelectionSubtreeRoot
-        objects.
-        (getNextOrPrevRenderObjectBasedOnDirection): Deleted method from r155058 as it is not needed anymore. Each
-        subtree will have start and end positions, so the selection algorithm will always find the end.
-        (WebCore::RenderView::setSelection): Adapt method to subtrees approach.
-        (WebCore::RenderView::splitSelectionBetweenSubtrees): Determine start and end positions for each subtree and
-        call setSubtreeSelection().
-        (WebCore::RenderView::setSubtreeSelection): Modify previous method in order to use SelectionSubtreeRoot objects.
-        * rendering/RenderView.h: Inherit from SelectionSubtreeRoot. Add signature for new helper methods receiving
-        SelectionSubtreeRoot objects.
-        * rendering/SelectionSubtreeRoot.cpp: Added.
-        (WebCore::SelectionSubtreeRoot::SelectionSubtreeRoot):
-        (WebCore::SelectionSubtreeRoot::selectionStartEndPositions):
-        * rendering/SelectionSubtreeRoot.h: Added. New class to identify root elements for the subtrees. With some basic
-        attributes and methods to store the start and end positions and offsets.
-        (WebCore::SelectionSubtreeRoot::selectionStart):
-        (WebCore::SelectionSubtreeRoot::selectionStartPos):
-        (WebCore::SelectionSubtreeRoot::selectionEnd):
-        (WebCore::SelectionSubtreeRoot::selectionEndPos):
-        (WebCore::SelectionSubtreeRoot::setSelectionStart):
-        (WebCore::SelectionSubtreeRoot::setSelectionStartPos):
-        (WebCore::SelectionSubtreeRoot::setSelectionEnd):
-        (WebCore::SelectionSubtreeRoot::setSelectionEndPos):
</del><ins>+        [CSS Shapes][CSS Regions] Respect bottom positioned shapes and content adjustment inside shapes
+        https://bugs.webkit.org/show_bug.cgi?id=117599
</ins><span class="cx"> 
</span><del>-2014-04-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        [Mac] Follow-up: After a horizontal overflow scroll with a mechanical wheel mouse, vertical scrolling no longer works
-        https://bugs.webkit.org/show_bug.cgi?id=131960
-        &lt;rdar://problem/16142100&gt;
</del><ins>+        In r150478 I added support for multiple positioned shape-insides on regions, this patch covers the cases when a shape
+        is positioned to the bottom of the region or the region contains a shape which forces the content to be adjusted inside
+        the shape (e.g. we have a triangle shape and the first line needs to be started at the first position where it fits).
+        I introduced a new helper function to update the current shape and the current line segments in the flow thread cases. With
+        this new helper function all the logic which calculates the segments for shape-inside on regions is located in one function.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix.
</del><ins>+        Tests: fast/regions/shape-inside/shape-inside-on-regions-block-content-overflow-bottom-positioned-multiple-shapes.html
+               fast/regions/shape-inside/shape-inside-on-regions-block-content-polygon-with-adjustment.html
+               fast/regions/shape-inside/shape-inside-on-regions-inline-content-overflow-bottom-positioned-multiple-shapes.html
+               fast/regions/shape-inside/shape-inside-on-regions-inline-content-polygon-with-adjustment.html
</ins><span class="cx"> 
</span><del>-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleWheelEvent): The test to clear the
-        last scrolled node was too broad. It should only follow this path
-        if both the phase and momentum phase are 'None'.
</del><ins>+        * rendering/RenderBlock.h: Add new helper's declaration
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineLayoutState::LineLayoutState): Add a member to carry adjustment for flow thread cases.
+        (WebCore::LineLayoutState::adjustedLogicalLineTop): Add new member.
+        (WebCore::LineLayoutState::setAdjustedLogicalLineTop): Add new setter for the new member.
+        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLine): Move flow thread case to its helper function.
+        (WebCore::RenderBlock::updateShapeAndSegmentsForCurrentLineInFlowThread): Added new helper for flow thread cases.
+        (WebCore::RenderBlock::adjustLogicalLineTopAndLogicalHeightIfNeeded): Save adjustment for flow thread cases.
</ins><span class="cx"> 
</span><del>-2014-04-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2013-06-13  Mihai Tica  &lt;mitica@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] After a horizontal overflow scroll with a mechanical wheel mouse, vertical scrolling no longer works
-        https://bugs.webkit.org/show_bug.cgi?id=131960
-        &lt;rdar://problem/16142100&gt;
</del><ins>+        [CSS Background Blending] Enable CSS Background blending for layers with SVGs.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        The change implies adding the blending parameter for SVGImage
+        https://bugs.webkit.org/show_bug.cgi?id=117588
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/fast/scrolling/scroll-div-no-latching.html
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleWheelEvent): When not latching, always clear m_latchedWheelEventElement and m_previousWheelScrolledElement.
</del><ins>+        Tests: css3/compositing/background-blend-mode-image-svg.html
+               css3/compositing/background-blend-mode-svg-color.html
</ins><span class="cx"> 
</span><del>-2014-04-21  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
</ins><span class="cx"> 
</span><del>-        WebProfilerAgent::disable is calling the wrong superclass method
-        https://bugs.webkit.org/show_bug.cgi?id=131968
</del><ins>+2013-06-13  Mihai Tica  &lt;mitica@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Updating the -webkit-background-blend-mode property dynamically does not trigger a redraw of the element.
</ins><span class="cx"> 
</span><del>-        * inspector/WebProfilerAgent.cpp:
-        (WebCore::WebProfilerAgent::disable):
</del><ins>+        Adding krit's fix: actual blending values should be compared, not the sets.
+        https://bugs.webkit.org/show_bug.cgi?id=117223
</ins><span class="cx"> 
</span><del>-2014-04-21  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-        Followup from http://trac.webkit.org/changeset/167624
</del><ins>+        Test: css3/compositing/background-blend-mode-image-color-dynamic.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::operator==):
</ins><span class="cx"> 
</span><del>-        Fixing incorrect use of ? : syntax.
</del><ins>+2013-06-13  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/VisibleUnits.cpp:
-        (WebCore::characterBeforePosition):
</del><ins>+        Headers and footers should be pinned to the left edge of the window when scrolling 
+        horizontally, even when zoomed
+        https://bugs.webkit.org/show_bug.cgi?id=117562
+        -and corresponding-
+        &lt;rdar://problem/14006745&gt;
</ins><span class="cx"> 
</span><del>-2014-04-21  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Move CoordinatedGraphics related codes out of CMakeLists.txt
-        https://bugs.webkit.org/show_bug.cgi?id=131931
</del><ins>+        We really want to use the width value from scrollOffsetForFixedPosition() for the 
+        banner with a scaled factor of 1. So if there is a different scale factor, re-
+        compute this value specifically for the banners. 
+        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+2013-06-13  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Move CoordinatedGraphics related files to PlatformEfl.cmake because they are not common files.
</del><ins>+        Support byte and octet types in bindings generators
+        https://bugs.webkit.org/show_bug.cgi?id=117547
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: 
-        * PlatformEfl.cmake:
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-2014-04-21  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Add support for byte and octet IDL types to the bindings
+        generator:
+        http://dev.w3.org/2006/webapi/WebIDL/#idl-byte
+        http://dev.w3.org/2006/webapi/WebIDL/#idl-octet
</ins><span class="cx"> 
</span><del>-        [MSE][Mac] AVSampleBufferDisplayLayer and AudioRenderer is overretained.
-        https://bugs.webkit.org/show_bug.cgi?id=131963
</del><ins>+        No new tests, covered by existing layout tests and by new
+        bindings tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jon Honeycutt.
</del><ins>+        No new tests, covered by bindings tests and:
+        fast/js/webidl-type-mapping.html
</ins><span class="cx"> 
</span><del>-        Adopt the results of -[[class alloc] init] rather than retaining them.
</del><ins>+        * WebCore.exp.in: Export new symbols for mac port.
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h: Add toInt8() / toUInt8()
+        methods to convert from JSValue to int8_t / uint8_t as
+        specified by Web IDL.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        (WebCore::SourceBufferPrivateAVFObjC::hasVideo):
-        (WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):
</del><ins>+        * bindings/js/JSDataViewCustom.cpp: Remove custom code for
+        getInt8, getUInt8, setInt8, setUInt8 now that byte and octet
+        types are supported by the bindings generator.
</ins><span class="cx"> 
</span><del>-2014-04-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        REGRESSION (r166784): Gradient at background of iCloud login page doesn’t go all the way to the bottom
-        https://bugs.webkit.org/show_bug.cgi?id=131924
-
-        Computing tile dimension for contain/cover requires higher precision than what LayoutUnit has. Switching to floats.
-
-        Reviewed by Simon Fraser.
-
-        Test: fast/backgrounds/hidpi-background-image-contain-cover-scale-needs-more-precision.html
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateFillTileSize):
-
-2014-04-21  Dean Jackson  &lt;dino@apple.com&gt;
-
-        Build fix for Mountain Lion.
-
-        * platform/mac/SerializedPlatformRepresentationMac.mm:
-        (WebCore::SerializedPlatformRepresentationMac::deserialize):
-
-2014-04-21  Dan Bernstein  &lt;mitz@apple.com&gt;
-
-        WebCore part of &lt;rdar://problem/16631323&gt; Page::setDefersLoading doesn’t do anything when using the Network process
-        https://bugs.webkit.org/show_bug.cgi?id=131939
-
-        Reviewed by David Kilzer.
-
-        * WebCore.exp.in: Exported WebCore::ResourceHandle::setDefersLoading.
-
-        * loader/ResourceLoadScheduler.cpp:
-        (WebCore::ResourceLoadScheduler::setDefersLoading): Added a no-op implementation.
-        * loader/ResourceLoadScheduler.h: Declared new virtual member function setDefersLoading.
-
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::setDefersLoading): Added a call to the above function.
-
-2014-04-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [Mac] Difficulty gesture scrolling vertically with trackpad after scrolling horizontally 
-        https://bugs.webkit.org/show_bug.cgi?id=131959
-        &lt;rdar://problem/16654523&gt;
-
-        Reviewed by Simon Fraser.
-
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::deltaIsPredominantlyVertical): Added.
-        (WebCore::scrolledToEdgeInDominantDirection): Only consider current mouse wheel event. We don't care about
-        overall history when deciding if we are bumping against the edge of a scrollable region. Short-circuit if
-        the element style indicates that overflow is hidden, since this means there is no scroll possible in that
-        direction.
-        (WebCore::EventHandler::platformPrepareForWheelEvents): Update for new signature.
-
-2014-04-21  Eric Carlson  &lt;eric.carlson@apple.com&gt;
-
-        [Mac] implement WebKitDataCue
-        https://bugs.webkit.org/show_bug.cgi?id=131799
-
-        Reviewed by Dean Jackson.
-
-        Tests: http/tests/media/track-in-band-hls-metadata.html
-               media/track/track-datacue-value.html
-
-        * Configurations/FeatureDefines.xcconfig: Define ENABLE_DATACUE_VALUE.
-        * DerivedSources.make: Add ENABLE_DATACUE_VALUE to HTML_FLAGS when appropriate.
-
-        * CMakeLists.txt: Add JSDataCueCustom.cpp.
-        * bindings/js/JSBindingsAllInOne.cpp:
-        * WebCore.xcodeproj/project.pbxproj: Add new files.
-
-        * bindings/js/JSDataCueCustom.cpp: Added.
-        (WebCore::JSDataCue::value): 
-        (WebCore::JSDataCue::setValue):
-        (WebCore::JSDataCueConstructor::constructJSDataCue): Custom constructor.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Drive-by fixes: don't schedule timeupdate
-            events when paused, don't call sort on an Vector that can't be sorted.
-
-        * html/track/DataCue.cpp:
-        (WebCore::DataCue::DataCue): Initialize m_type.
-        (WebCore::DataCue::~DataCue): Unprotect the JSValue if necessary.
-        (WebCore::DataCue::data): Ask the platform value for data if non-null.
-        (WebCore::DataCue::setData): Clear m_platformValue and m_value.
-        (WebCore::DataCue::isEqual): New.
-        (WebCore::DataCue::value): Return a JSValue from the platform value, or the value passed
-            to the constructor/set by script.
-        (WebCore::DataCue::setValue): Set m_value.
-        * html/track/DataCue.h:
-        * html/track/DataCue.idl:
-
-        * html/track/InbandDataTextTrack.cpp:
-        (WebCore::InbandDataTextTrack::addDataCue): Don't add the same cue more than once.
-        (WebCore::InbandDataTextTrack::updateDataCue): Update a cue's duration.
-        (WebCore::InbandDataTextTrack::removeDataCue): Remove an incomplete cue.
-        (WebCore::InbandDataTextTrack::removeCue): Remove a cue from the incomplete cue map if necessary.
-        * html/track/InbandDataTextTrack.h:
-
-        * html/track/InbandGenericTextTrack.cpp:
-        (WebCore::InbandGenericTextTrack::addGenericCue): CueMatchRules is now in TextTrackCue instead
-            of VTTCue.
-        * html/track/InbandTextTrack.h:
-
-        * html/track/InbandWebVTTTextTrack.cpp:
-        (WebCore::InbandWebVTTTextTrack::newCuesParsed): Ditto.
-
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::hasCue): Ditto.
-        * html/track/TextTrack.h:
-
-        * html/track/TextTrackCue.cpp:
-        (WebCore::TextTrackCue::isEqual): New, test base class equality.
-        * html/track/TextTrackCue.h:
-
-        * html/track/TextTrackCueGeneric.cpp:
-        (WebCore::TextTrackCueGeneric::isEqual): Call TextTrackCue::isEqual first.
-        * html/track/TextTrackCueGeneric.h:
-
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::isEqual): Call TextTrackCue::isEqual first.
-        * html/track/VTTCue.h:
-
-        * platform/SerializedPlatformRepresentation.h: Added.
-        (WebCore::SerializedPlatformRepresentation::~SerializedPlatformRepresentation):
-        (WebCore::SerializedPlatformRepresentation::SerializedPlatformRepresentation):
-
-        * platform/graphics/InbandTextTrackPrivateClient.h: Add methods for DataCue with SerializedPlatformRepresentation.
-
-        * platform/graphics/avfoundation/InbandMetadataTextTrackPrivateAVF.cpp: Added.
-        (WebCore::InbandMetadataTextTrackPrivateAVF::create):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::InbandMetadataTextTrackPrivateAVF):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::~InbandMetadataTextTrackPrivateAVF):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::addDataCue):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::updatePendingCueEndTimes):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::flushPartialCues):
-        * platform/graphics/avfoundation/InbandMetadataTextTrackPrivateAVF.h: Added.
-
-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundation::seekWithTolerance): currentTrack -&gt; currentTextTrack.
-        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundation::configureInbandTracks): Ditto.
-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
-        (WebCore::MediaPlayerPrivateAVFoundation::setCurrentTextTrack):
-        (WebCore::MediaPlayerPrivateAVFoundation::setCurrentTrack): Deleted.
-
-        Renamed currentTrack and setCurrentTrack to currentTextTrack and setCurrentTextTrack.
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::AVFWrapper::currentTextTrack):
-        (WebCore::MediaPlayerPrivateAVFoundationCF::setCurrentTextTrack):
-        (WebCore::MediaPlayerPrivateAVFoundationCF::currentTextTrack):
-        (WebCore::AVFWrapper::setCurrentTextTrack):
-        (WebCore::AVFWrapper::AVFWrapper):
-        (WebCore::AVFWrapper::processCue):
-        (WebCore::AVFWrapper::currentTrack): Deleted.
-        (WebCore::MediaPlayerPrivateAVFoundationCF::setCurrentTrack): Deleted.
-        (WebCore::MediaPlayerPrivateAVFoundationCF::currentTrack): Deleted.
-        (WebCore::AVFWrapper::setCurrentTrack): Deleted.
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
-
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::seekToTime): currentTrack -&gt; currentTextTrack
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): currentTrack -&gt; currentTextTrack.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::processMetadataTrack): New.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::processCue): m_currentTrack -&gt; m_currentTextTrack.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::flushCues): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setCurrentTextTrack): Renamed from setCurrentTextTrack.
-        (WebCore::metadataType): Map an AVFoundation metadata key space to a metadata cue type.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive): Process new metadata.
-        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setCurrentTrack): Deleted.
-
-        Create a JSValue representation from an AVMetadataItem.
-        * platform/mac/SerializedPlatformRepresentationMac.h: Added.
-        (WebCore::SerializedPlatformRepresentationMac::platformType):
-        (WebCore::SerializedPlatformRepresentationMac::nativeValue):
-        * platform/mac/SerializedPlatformRepresentationMac.mm: Added.
-        (WebCore::SerializedPlatformRepresentationMac::SerializedPlatformRepresentationMac):
-        (WebCore::SerializedPlatformRepresentationMac::~SerializedPlatformRepresentationMac):
-        (WebCore::SerializedPlatformRepresentationMac::create):
-        (WebCore::SerializedPlatformRepresentationMac::data):
-        (WebCore::SerializedPlatformRepresentationMac::deserialize):
-        (WebCore::SerializedPlatformRepresentationMac::isEqual):
-        (WebCore::toSerializedPlatformRepresentationMac):
-        (WebCore::jsValueWithValueInContext):
-        (WebCore::jsValueWithDataInContext):
-        (WebCore::jsValueWithArrayInContext):
-        (WebCore::jsValueWithDictionaryInContext):
-        (WebCore::jsValueWithAVMetadataItemInContext):
-
-2014-04-21  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        Add Element.matches, the standard name for webkitMatchesSelector
-        https://bugs.webkit.org/show_bug.cgi?id=131922
-
-        Reviewed by Andreas Kling.
-
-        This patch just renames webkitMatchesSelector() to matches().
-
</del><ins>+        * bindings/scripts/CodeGeneratorCPP.pm:
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        * bindings/scripts/CodeGeneratorJS.pm:
</ins><span class="cx">         * bindings/scripts/CodeGeneratorObjC.pm:
</span><del>-        (GenerateImplementation):
-        The Objective-C binding generator only supported ImplementedAs for getters and setters.
-        This adds support for the option so that Element.matches can be generated for Obj-C.
</del><ins>+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        * bindings/scripts/test/JS/JSTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        * bindings/scripts/test/TestObj.idl: Add tests for byte and octet types.
+        * html/canvas/DataView.idl: Remove [Custom] extended attribute for
+        getInt8, getUInt8, setInt8, setUInt8 and use newly supported byte / octet
+        types.
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::matches):
-        (WebCore::Element::webkitMatchesSelector): Deleted.
-        * dom/Element.h:
-        * dom/Element.idl:
-        * inspector/InspectorCSSAgent.cpp:
-        (WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):
</del><ins>+2013-06-13  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-21  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Revert r150339 since it causes a hang while paused in the Web Inspector in other apps.
</ins><span class="cx"> 
</span><del>-        topContentInset does not play well with fullscreen elements
-        https://bugs.webkit.org/show_bug.cgi?id=131955
-        -and corresponding-
-        &lt;rdar://problem/16651925&gt;
</del><ins>+        https://bugs.webkit.org/show_bug.cgi?id=117596
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-        Calling setNeedsLayout() is not sufficient when the topContentInset has changed 
-        dynamically. We need to perform the layout right away and update the scrollbars. 
-        This works completely when the inset changes due to entering/exiting fullscreen, 
-        but I left a FIXME behind because it is possible to change the inset dynamically 
-        just through the WK2 API and end up in a situation where everything looks right 
-        except for the scrollbars. 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::topContentInsetDidChange):
-        * page/FrameView.h:
-        * page/Page.cpp:
-        (WebCore::Page::setTopContentInset):
</del><ins>+        * platform/mac/EventLoopMac.mm:
+        (WebCore::EventLoop::cycle):
</ins><span class="cx"> 
</span><del>-2014-04-18  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+2013-06-13  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Empty RenderInline objects should not be line break objects.
</del><ins>+        [Windows] Unreviewed gardening.  Remove dangling 'strings' folder from solution.
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=131861
-        &lt;rdar://problem/15663617&gt;
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj.filters: Get rid of 'strings' that was orphaned by
+        recent file reorganization.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+2013-06-13  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/line/BreakingContextInlineHeaders.h:
-        (WebCore::BreakingContext::canBreakAtThisPosition):
-        Don't break at this position if this is an empty RenderInline.
</del><ins>+        Avoid unwanted thread hops in ScriptProcessorNode when 'onaudioprocess' listener is not set.
+        https://bugs.webkit.org/show_bug.cgi?id=117578.
</ins><span class="cx"> 
</span><del>-2014-04-21  Enrica Casucci  &lt;enrica@apple.com&gt;
-
-        [iOS WebKit2] support replacements for misspelled words.
-        https://bugs.webkit.org/show_bug.cgi?id=131827
-        &lt;rdar://problem/16319657&gt;
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Adds utility function to return the character before the current selection
-        and converts the nbsp to the space character.
</del><ins>+        ScriptProcessorNode process operation continues to dispatch AudioProcessingEvent
+        even though 'onaudioprocess' listener is not set. This results in unwanted thread hops.
+        Code is optimized to dispatch AudioProcessingEvent only if the listener is set.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * editing/VisibleUnits.cpp:
-        (WebCore::characterBeforePosition):
-        * editing/VisibleUnits.h:
</del><ins>+        No new tests, already covered by existing tests.
</ins><span class="cx"> 
</span><del>-2014-04-21  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        * Modules/webaudio/ScriptProcessorNode.cpp:
+        (WebCore::ScriptProcessorNode::ScriptProcessorNode):
+        (WebCore::ScriptProcessorNode::process):
+        (WebCore::ScriptProcessorNode::setOnaudioprocess):
+        * Modules/webaudio/ScriptProcessorNode.h:
+        (WebCore::ScriptProcessorNode::onaudioprocess):
</ins><span class="cx"> 
</span><del>-        [iOS] enable plug-in replacement
-        https://bugs.webkit.org/show_bug.cgi?id=131947
</del><ins>+2013-06-13  Max Vujovic  &lt;mvujovic@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        [CSS Regions] -webkit-background-clip: text; does not clip the background in regions
+        https://bugs.webkit.org/show_bug.cgi?id=117566
</ins><span class="cx"> 
</span><del>-        * bindings/generic/RuntimeEnabledFeatures.cpp:
-        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures): initialize m_isPluginReplacementEnabled
-            to true on iOS.
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-2014-04-21  Rik Cabanier  &lt;cabanier@adobe.com&gt;
</del><ins>+        This patch enables -webkit-background-clip: text; on regions.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Remove support for non-separable blend modes from mix-blend-mode
-        https://bugs.webkit.org/show_bug.cgi?id=131824
</del><ins>+        Test: fast/regions/webkit-background-clip-text.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintFlowThreadPortionInRegion):
+            Force black text if we're in the text clip paint phase. This makes sure the text's alpha
+            channel does not affect the final opacity of the background clipping result. Rather,
+            the text's alpha channel affects the amount of blending between the text color
+            and the background.
+        * rendering/RenderRegion.cpp:
+        (WebCore::shouldPaintRegionContentsInPhase):
+            Factor out a function to check if we should paint the region contents in a particular
+            phase. Add &quot;PaintPhaseTextClip&quot; so that we draw the contents in the text clipping phase.
+        (WebCore::RenderRegion::paintObject):
+            Call shouldPaintRegionContentsInPhase instead of doing the phase checks directly in this
+            function. Move, update, and clarify the surrounding comments.
</ins><span class="cx"> 
</span><del>-        Removed support for non-separable blend modes from the CSS parser.
</del><ins>+2013-06-13  Anton Obzhirov  &lt;a.obzhirov@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Covered by existing tests
</del><ins>+        [CSS Regions] Regions auto-height and absolute positioning bug
+        https://bugs.webkit.org/show_bug.cgi?id=111092
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::isValidKeywordPropertyAndValue):
-        * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
-        (PlatformCAFilters::setBlendingFiltersOnLayer):
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-2014-04-21  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        During last layout that should update the auto-height regions new auto-height region height
+        is calculated correctly based on the text content, but it requires extra step 
+        to reposition the render block after new logical height is set (correct logical height becomes
+        available only during last layout). 
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Column set drawing under horizontal scrollbar.
-        https://bugs.webkit.org/show_bug.cgi?id=131812.
</del><ins>+        Tests: fast/regions/autoheight-abspos-bottom-align.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::updateLogicalHeight):
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/newmulticol/compare-with-old-impl/LeftToRight-tb.html.
</del><ins>+2013-06-13  Brent Fulgham  &lt;bfulgham@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::layoutBlock):
-        (WebCore::RenderBlockFlow::checkForPaginationLogicalHeightChange):
-        * rendering/RenderBlockFlow.h:
-        Pass in relayoutChildren as a reference boolean to checkForPaginationLogicalHeightChange.
-        The new columns need to be able to set it to true if the amount of available column
-        height ever changes, so that the RenderFlowThread and the sets get a layout call.
</del><ins>+        [WinCairo] Unreviewed build correction.
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setColumnStylesFromPaginationMode):
-        Make sure that the pagination mode is set up with an auto column-fill specified. You
-        don't ever want to balance when you set a pagination mode on the RenderView.
</del><ins>+        * WebCore.vcxproj/WebCoreCairo.props: Use proper WebKit_Libraries
+        environment variable, rather than older WebKitLibraries.
</ins><span class="cx"> 
</span><del>-2014-04-21  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+2013-06-13  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Implement CSS viewport units
-        https://bugs.webkit.org/show_bug.cgi?id=131863
-        &lt;rdar://problem/16279088&gt;
</del><ins>+        Avoid duplicate isInt32() / isUInt32() checks in JSDOMBindings
+        https://bugs.webkit.org/show_bug.cgi?id=117593
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::setViewportSize):
-        * page/FrameView.h:
-        (WebCore::FrameView::viewportSize):
-        Add setViewportSize() and viewportSize().
-        If the viewport size changes, we have to do style recalc.
-        If we have an overridden viewport size, use it.
</del><ins>+        Avoid duplicate isInt32() / isUInt32() checks in JSDOMBindings by
+        calling asInt32() / asUInt32() instead of toInt32() / toUInt32()
+        when we already know the value is a int32 / uint32.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::viewportSize):
-        * rendering/RenderView.h:
-        Get the size from FrameView.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-04-21  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
-
-        Remove unused WebKitSystemInterface functions
-        https://bugs.webkit.org/show_bug.cgi?id=131938
-
-        Reviewed by Alexey Proskuryakov.
-
-        * WebCore.exp.in:
-        * platform/ios/WebCoreSystemInterfaceIOS.mm:
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-
-2014-04-21  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Move the JSString cache from DOMWrapperWorld to VM.
-        &lt;https://webkit.org/b/131940&gt;
-
-        Since there's no need for JSStrings to be world-specific, this patch
-        moves the string cache to JSC::VM. This makes jsStringWithCache()
-        a lot faster since it no longer has to jump through twenty-eleven
-        hoops to find the DOMWrapperWorld.
-
-        Reviewed by Geoff Garen.
-
-        * bindings/js/DOMWrapperWorld.cpp:
-        (WebCore::DOMWrapperWorld::clearWrappers):
-        * bindings/js/DOMWrapperWorld.h:
</del><span class="cx">         * bindings/js/JSDOMBinding.cpp:
</span><del>-        (WebCore::jsStringWithCache):
</del><span class="cx"> 
</span><del>-2014-04-21  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+2013-06-13  Yuki Sekiguchi  &lt;yuki.sekiguchi@access-company.com&gt;
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Column balancing is slow on float-multicol.html
-        https://bugs.webkit.org/show_bug.cgi?id=131801
</del><ins>+        Setting overflow:hidden on position:absolute does not repaint hidden content
+        https://bugs.webkit.org/show_bug.cgi?id=116994
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/tall-float.html
</del><ins>+        Since a container which has overflow clip of RenderBox which has self painting layer doesn't have a rect of the RenderBox as visual overflow,
+        the container should not clip request repainting rect of the RenderBox.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
-        Make RenderFlowThreads expand to encompass floats. Also from Morten's patch for
-        Blink (#361551).
</del><ins>+        Test: fast/repaint/change-overflow-and-display-of-relative.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::computeOverflow):
-        Fix a bug where the new multi-column code was adding in overflow for floats
-        when it should not. This was resulting in the creation of scrollbars when none
-        should exist. This is my own addition.
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderLayerModelObject.cpp:
+        (WebCore::RenderLayerModelObject::shouldUseClipForRepaint): If this has self painting layer, we should not clip for repaint.
+        * rendering/RenderLayerModelObject.h:
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBlockFlow::addOverhangingFloats):
-        Make RenderFlowThreads and RenderRegions ignore overhanging float additions. This
-        comes from Morten's patch for Blink (#361551).
</del><ins>+2013-06-13  Mihai Tica  &lt;mitica@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-21  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        [CSS Background Blending] Gradients don't blend with any of the layers behind.
+        First, allow the layers behind opaque gradients to be drawn, then add the blending filters
+        when working with gradients.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r160908): Safari doesn't draw rotated images properly first time
-        https://bugs.webkit.org/show_bug.cgi?id=131930
</del><ins>+        https://bugs.webkit.org/show_bug.cgi?id=117532
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-        With render tree creation sufficiently lazy, we had to put some explicit
-        calls to updateStyleIfNeeded into the ImageDocument class.
</del><ins>+        Tests: css3/compositing/background-blend-mode-gradient-color.html
+               css3/compositing/background-blend-mode-gradient-gradient.html
+               css3/compositing/background-blend-mode-gradient-image.html
+               css3/compositing/background-blend-mode-multiple-background-layers.html
</ins><span class="cx"> 
</span><del>-        * dom/DOMImplementation.cpp:
-        (WebCore::DOMImplementation::createDocument): Pass a Frame&amp;.
</del><ins>+        * platform/graphics/GeneratorGeneratedImage.cpp:
+        (WebCore::GeneratorGeneratedImage::draw):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintFillLayers):
</ins><span class="cx"> 
</span><del>-        * html/ImageDocument.cpp:
-        (WebCore::ImageDocument::imageSize): Added this helper function. This updates
-        style so we can use the renderer to compute an image size taking things like
-        orientation into account, and also passes in the zoom factor.
-        (WebCore::ImageDocument::updateDuringParsing): Moved the body of the
-        ImageDocumentParser::appendBytes function into this function. Since it's a
-        member of ImageDocument, it has better access to appropriate private members,
-        and we don't have to expose as many functions to the public. Also changed to
-        not use the frame so much. Also merged in the code that creates the document
-        instead of having it be a side effect in the cachedImage helper function; all
-        the other call sites were checking for null before calling cachedImage.
-        (WebCore::ImageDocument::finishedParsing): Moved the body of the
-        ImageDocumentParser::finish function here. Added a call to updateStyleIfNeeded
-        before using the renderer to get the image size.
-        (WebCore::ImageDocumentParser::document): Made this return a reference. It's
-        just a convenience function used in the two functions below.
-        (WebCore::ImageDocumentParser::appendBytes): Just call updateDuringParsing.
-        (WebCore::ImageDocumentParser::finish): Just call finishedParsing.
-        (WebCore::ImageDocument::ImageDocument): Take a reference for the argument,
-        use nullptr, and also initialize m_shouldShrinkImage directly instead of using
-        a shouldShrinkToFit() helper function to do it.
-        (WebCore::ImageDocument::createDocumentStructure): Removed unneeded check of
-        null for the frame, since the caller does it. Removed some unneeded
-        IGNORE_EXCEPTON and a stray semicolon. Use m_shouldShrinkImage instead of
-        calling shouldShrinkToFit since at this early point they will be identical.
-        (WebCore::ImageDocument::scale): Make non-const so we can call the new
-        imageSize helper. Use Document::view instead of Frame::view. Improved the
-        conversion to floating point so it doesn't involve a static_cast and an extra
-        conversion from int to LayoutUnit.
-        (WebCore::ImageDocument::resizeImageToFit): Ditto.
-        (WebCore::ImageDocument::imageClicked): Ditto.
-        (WebCore::ImageDocument::imageUpdated): Ditto. Also use m_shouldShrinkImage
-        ibnstead of shouldShrinkToFit.
-        (WebCore::ImageDocument::restoreImageSize): Ditto.
-        (WebCore::ImageDocument::imageFitsInWindow): Ditto.
-        (WebCore::ImageDocument::windowSizeChanged): Ditto.
-        (WebCore::ImageDocument::cachedImage): Deleted. Moved logic into updateDuringParsing.
-        (WebCore::ImageDocument::shouldShrinkToFit): Deleted. Moved logic into constructor.
-        (WebCore::ImageEventListener::handleEvent): Updated for changes above.
-        (WebCore::ImageEventListener::operator==): Simplified. No reason this has to check
-        whether both listeners are in the same document.
-        (WebCore::ImageDocumentElement::didMoveToNewDocument): Use nullptr.
</del><ins>+2013-06-13  Michael Brüning  &lt;michael.bruning@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/ImageDocument.h: Deleted some unused things, updated for changes above,
-        and made some memer functions private.
</del><ins>+        [Qt][Mac] Disable QTKit video on OS X.
+        https://bugs.webkit.org/show_bug.cgi?id=117591
</ins><span class="cx"> 
</span><del>-        * loader/FrameLoaderClient.h: Deleted the allowScriptFromSource, allowPlugins,
-        allowImage, and allowDisplayingInsecureContent functions. These were only used in
-        Chromium and are now unneeded complexity. We could bring them back if anyone wants them.
</del><ins>+        Reviewed by Tor Arne Vestbø.
</ins><span class="cx"> 
</span><del>-        * loader/MixedContentChecker.cpp:
-        (WebCore::MixedContentChecker::canDisplayInsecureContent): Removed call to
-        allowDisplayingInsecureContent, just use the setting directly.
-        (WebCore::MixedContentChecker::canRunInsecureContent): Removed call to
-        allowRunningInsecureContent, just use the setting directly.
</del><ins>+        Deployment of the same Qt binaries to different
+        Mac OS X version makes it impossible to link against
+        the correct WebKitSystemInterface version at build time.
</ins><span class="cx"> 
</span><del>-        * loader/SubframeLoader.cpp:
-        (WebCore::SubframeLoader::allowPlugins): Removed call to allowPlugins, just
-        use the arePluginsEnabled setting directly.
</del><ins>+        No new tests, no behavioural change.
</ins><span class="cx"> 
</span><del>-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::CachedResourceLoader::canRequest): Removed call to allowScriptFromSource, just
-        use the isScriptEnabled setting directly.
-        (WebCore::CachedResourceLoader::clientDefersImage): Removed call to allowImage.
</del><ins>+        * WebCore.pri:
</ins><span class="cx"> 
</span><del>-2014-04-21  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+2013-06-13  Morten Stenshorne  &lt;mstensho@opera.com&gt;
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Pagination mode messed up with non-inline axis and reversed direction.
-        https://bugs.webkit.org/show_bug.cgi?id=131811
</del><ins>+        Column balancing support in the region based multicol implementation
+        https://bugs.webkit.org/show_bug.cgi?id=116033
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Start by setting the column height to the flow thread's height divided
+        by the number of columns. Then stretch the column height until
+        contents fits without creating overflowing columns, or until the
+        maximum allowed column height is reached, whichever comes first. This
+        may require several layout iterations (but normally only a
+        couple). For each time we stretch, stretch by the least amount
+        required to make a difference to which box goes where.
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/newmulticol/compare-with-old-impl/BottomToTop-tb.html
-        
-        With block axis pagination mode, it is possible to set a column height that is not the same
-        as the available fill height for a block. The new multi-column code had the assumption that
-        the column height was the same as the amount of fill room you had available. This is not
-        the case.
-        
-        To correct the issue, I added a member variable to RenderMultiColumnSet that stores the
-        available column height as a separate variable from the computed column height. This allows
-        the pagination API to specify a different column height that is not the same as the view's
-        content height.
</del><ins>+        Also make sure that the columns get tall enough to honor orphans
+        and widows settings.
</ins><span class="cx"> 
</span><del>-        Even though it isn't involved in the solution, I also patched pageOrViewLogicalHeight on
-        RenderView to work with the new column code as well.
</del><ins>+        This change takes some tiny steps in preparing for multiple column
+        set support. There is also some minor cleanup and bugfixing; see
+        details below.
</ins><span class="cx"> 
</span><del>-        To address the layout test failures (that caused the previous rollout), I made sure to
-        initialize m_availableHeight to 0 when m_computedColumnHeight also gets reset to 0.
-        
-        The assertion is not something I could reproduce on any machine, but I can see the problem.
-        I patched Page's pageCount method to not have column code directly in Page.cpp, 
-        and to make a new pageCount() method on RenderView that Page calls
-        into. This method is now patched to handle the new column code as well as the old. I have
-        no real way of testing this method though, since I can't reproduce the assertion that the
-        bots were experiencing.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::pageCount):
-        * rendering/RenderMultiColumnSet.cpp:
</del><ins>+        Tests: fast/multicol/newmulticol/balance-images.html
+               fast/multicol/newmulticol/balance-maxheight1.html
+               fast/multicol/newmulticol/balance-maxheight2.html
+               fast/multicol/newmulticol/balance1.html
+               fast/multicol/newmulticol/balance2.html
+               fast/multicol/newmulticol/balance3.html
+               fast/multicol/newmulticol/balance4.html
+               fast/multicol/newmulticol/balance5.html
+               fast/multicol/newmulticol/balance6.html
+               fast/multicol/newmulticol/balance7.html
+               fast/multicol/newmulticol/balance8.html
+               fast/multicol/newmulticol/balance9.html
+               fast/multicol/newmulticol/cell-shrinkback.html
+               fast/multicol/newmulticol/columns-shorthand-parsing.html
+               fast/multicol/newmulticol/orphans-and-widows-balance.html
+               fast/multicol/newmulticol/single-line.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+        (WebCore::RenderBlock::setPageBreak):
+        (WebCore):
+        (WebCore::RenderBlock::updateMinimumPageHeight):
+        (WebCore::calculateMinimumPageHeight):
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        (WebCore::RenderBlock::adjustBlockChildForPagination): If no lines
+        cross the boundaries, we need to report where blocks cross
+        instead, so that the column balancer knows how much to stretch
+        columns if necessary.
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderMultiColumnBlock.cpp:
+        (WebCore::RenderMultiColumnBlock::RenderMultiColumnBlock):
+        (WebCore::RenderMultiColumnBlock::checkForPaginationLogicalHeightChange):
+        (WebCore::RenderMultiColumnBlock::relayoutForPagination):
+        (WebCore::RenderMultiColumnBlock::layoutSpecialExcludedChild):
+        * rendering/RenderMultiColumnBlock.h:
+        (WebCore::RenderMultiColumnBlock::columnHeightAvailable):
+        (WebCore::RenderMultiColumnBlock::requiresBalancing):
+        (RenderMultiColumnBlock):
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::RenderMultiColumnFlowThread::autoGenerateRegionsToBlockOffset):
+        (WebCore::RenderMultiColumnFlowThread::setPageBreak):
+        (WebCore):
+        (WebCore::RenderMultiColumnFlowThread::updateMinimumPageHeight):
+        * rendering/RenderMultiColumnFlowThread.h:
+        (RenderMultiColumnFlowThread):
+        * rendering/RenderMultiColumnSet.cpp: Get rid of
+        RenderMultiColumnSet::updateLogicalHeight() override. Make
+        RenderMultiColumnSet behave more like normal blocks, by having
+        computeLogicalHeight() calculate logical top in addition to
+        height, just like any other block.
</ins><span class="cx">         (WebCore::RenderMultiColumnSet::RenderMultiColumnSet):
</span><ins>+        (WebCore::RenderMultiColumnSet::heightAdjustedForSetOffset): This
+        method will become more meaningful once we add support for
+        multiple column sets.
+        (WebCore):
+        (WebCore::RenderMultiColumnSet::pageLogicalTopForOffset):
</ins><span class="cx">         (WebCore::RenderMultiColumnSet::setAndConstrainColumnHeight):
</span><ins>+        (WebCore::RenderMultiColumnSet::calculateBalancedHeight):
+        (WebCore::RenderMultiColumnSet::recordSpaceShortage):
+        (WebCore::RenderMultiColumnSet::updateLogicalWidth):
</ins><span class="cx">         (WebCore::RenderMultiColumnSet::prepareForLayout):
</span><span class="cx">         (WebCore::RenderMultiColumnSet::computeLogicalHeight):
</span><ins>+        (WebCore::RenderMultiColumnSet::columnCount):
+        (WebCore::RenderMultiColumnSet::columnIndexAtOffset):
+        repaintFlowThreadContent() could end up in an infinite loop
+        because columnIndexAtOffset() could return UINT_MAX
+        (subtracting 1 from unsigned 0, which columnCount() could return),
+        which an unsigned integer obviously can never become larger
+        than. Also always call columnIndexAtOffset() if we want to get the
+        column index for some offset, rather than doing it on our own
+        sometimes. To make this work also during layout, we cannot just
+        return the last column created so far if we're past it, since
+        adding new columns is exactly what we want to do at this point.
</ins><span class="cx">         * rendering/RenderMultiColumnSet.h:
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::pageOrViewLogicalHeight):
-        (WebCore::RenderView::pageCount):
-        * rendering/RenderView.h:
</del><ins>+        (RenderMultiColumnSet):
</ins><span class="cx"> 
</span><del>-2014-04-18  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+2013-06-12  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [Media] Clean up localized strings in controls
-        https://bugs.webkit.org/show_bug.cgi?id=131857
-        &lt;rdar://problem/16663005&gt;
</del><ins>+        Remove the notion of inactive plug-ins
+        https://bugs.webkit.org/show_bug.cgi?id=117570
+        &lt;rdar://problem/13484213&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        There is no need for separate localization files
-        on OS X and iOS. Move the small number of iOS-specific
-        localizations into a shared file.
</del><ins>+        Remove RenderEmbeddedObject::PluginInactive and the replacement text.
</ins><span class="cx"> 
</span><del>-        We also don't need a function to return a static table.
-        Ultimately I think we want a top-level WebKit object that
-        hold the table, but for now use a global variable
-        called UIStringTable. Since we're in an isolated world, we
-        won't clash with anything.
</del><ins>+        * English.lproj/Localizable.strings:
+        * platform/LocalizedStrings.cpp:
+        * platform/LocalizedStrings.h:
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::unavailablePluginReplacementText):
+        * rendering/RenderEmbeddedObject.h:
</ins><span class="cx"> 
</span><del>-        I noticed a few cases were we grab a localized string and
-        then instantly run a replacement on it. This should be
-        supported directly in the UIString() accessor.
</del><ins>+2013-06-12  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * English.lproj/mediaControlsLocalizedStrings.js: Add iOS strings. Just
-        use a static table.
-        (mediaControlsLocalizedStrings): Deleted.
-        * English.lproj/mediaControlsLocalizedStringsiOS.js: Removed.
-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller.prototype.extend): Fix braces.
-        (Controller.prototype.UIString): Use the string table, and allow replacement.
-        (Controller.prototype.createControls): Use new UIString replacement.
-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.updateWirelessPlaybackStatus): Use new UIString.
-        (ControllerIOS.prototype.UIString): Deleted. Use the parent class version.
-        * WebCore.xcodeproj/project.pbxproj: Remove file from Resources.
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::mediaControlsScript): No need to include the iOS
-        specific localization file.
</del><ins>+        [Mac] Change default Traditional Chinese serif font on 10.9
+        https://bugs.webkit.org/show_bug.cgi?id=117568
</ins><span class="cx"> 
</span><del>-2014-04-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        [Win] Unreviewed build fix.
</del><ins>+        Change default font on newer versions of OS X.
</ins><span class="cx"> 
</span><del>-        * inspector/TimelineRecordFactory.cpp: Add missing include.
</del><ins>+        * page/mac/SettingsMac.mm:
+        (WebCore::Settings::initializeDefaultFontFamilies): Use 'Songti TC'
+        on 10.9 and above.
</ins><span class="cx"> 
</span><del>-2014-04-21  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+2013-06-12  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Move cross-port Source/WebCore/page/ code to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=130534
</del><ins>+        [Mac] Change default Simplified Chinese serif font on 10.9
+        https://bugs.webkit.org/show_bug.cgi?id=117567
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr in cross-port code under Source/WebCore/page/ with
-        std::unique_ptr. Unnecessary OwnPtr.h and PassOwnPtr.h header inclusions are removed as well.
</del><ins>+        Change default font on newer versions of OS X.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::initSecurityContext):
-        * dom/SecurityContext.cpp:
-        (WebCore::SecurityContext::setContentSecurityPolicy):
-        * dom/SecurityContext.h:
-        * page/CaptionUserPreferences.h:
-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::CSPDirectiveList::create):
-        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
-        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
-        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
-        (WebCore::CSPDirectiveList::setCSPDirective):
-        (WebCore::ContentSecurityPolicy::didReceiveHeader):
-        * page/ContentSecurityPolicy.h:
-        * page/DOMSecurityPolicy.h:
-        * page/DOMWindow.cpp:
-        (WebCore::PostMessageTimer::fired):
-        (WebCore::DOMWindow::postMessageTimerFired):
-        * page/DOMWindow.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::EventHandler):
-        * page/EventHandler.h:
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        (WebCore::createRegExpForLabels):
-        (WebCore::Frame::searchForLabelsAboveCell):
-        (WebCore::Frame::searchForLabelsBeforeElement):
-        (WebCore::matchLabelsAgainstString):
-        (WebCore::Frame::setTiledBackingStoreEnabled):
-        * page/Frame.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::addEmbeddedObjectToUpdate):
-        (WebCore::FrameView::addSlowRepaintObject):
-        (WebCore::FrameView::addViewportConstrainedObject):
-        (WebCore::FrameView::addScrollableArea):
-        * page/FrameView.h:
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-        * page/PageConsole.h:
-        * page/PageThrottler.h:
-        * page/SecurityPolicy.cpp:
-        (WebCore::SecurityPolicy::addOriginAccessWhitelistEntry):
-        * page/animation/AnimationController.h:
-        * page/animation/CSSPropertyAnimation.cpp:
-        (WebCore::PropertyWrapperVisitedAffectedColor::PropertyWrapperVisitedAffectedColor):
-        (WebCore::CSSPropertyAnimationWrapperMap::instance):
-        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
-        * page/mac/PageMac.cpp:
-        (WebCore::Page::addSchedulePair):
-        * workers/WorkerGlobalScope.cpp:
-        (WebCore::WorkerGlobalScope::applyContentSecurityPolicyFromString):
</del><ins>+        * page/mac/SettingsMac.mm:
+        (WebCore::Settings::initializeDefaultFontFamilies): Use 'Songti SC'
+        instead of 'STSong' on newer systems.
</ins><span class="cx"> 
</span><del>-2014-04-21  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2013-06-12  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Add HashSet::takeAny
-        https://bugs.webkit.org/show_bug.cgi?id=131928
</del><ins>+        Fix crashes due to failed ImageBuffer allocation
+        https://bugs.webkit.org/show_bug.cgi?id=117541
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::takeAnyMediaCanStartListener): Use HashSet::takeAny.
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::takeAny): Deleted.
-        (WebCore::ScriptExecutionContext::~ScriptExecutionContext): Use HashSet::takeAny.
</del><ins>+        From Blink r152268 by &lt;pdr@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-21  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        A crash can happen due to a failed ImageBuffer allocation in
+        SVGImage::drawPatternForContainer(). Added a check for that failed allocation.
</ins><span class="cx"> 
</span><del>-        iOS and non-iOS RemoteCommandListener::create() functions should use std::make_unique&lt;&gt;()
-        https://bugs.webkit.org/show_bug.cgi?id=131916
</del><ins>+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::drawPatternForContainer):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-06-12  Eduardo Lima Mitev  &lt;elima@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        A follow-up to r167197. Make RemoteCommandListener ctor public and use std::make_unique&lt;&gt;()
-        in both versions of RemoteCommandListener::create() functions (iOS and non-iOS).
</del><ins>+        [atk] Replace deprecated call to atk_document_get_locale() in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=115647
</ins><span class="cx"> 
</span><del>-        * platform/RemoteCommandListener.cpp:
-        (WebCore::RemoteCommandListener::create):
-        * platform/RemoteCommandListener.h:
-        (WebCore::RemoteCommandListener::RemoteCommandListener):
-        * platform/ios/RemoteCommandListenerIOS.mm:
-        (WebCore::RemoteCommandListener::create):
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-2014-04-21  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Override the get_object_locale() method of WebkitAccessibleWrapperAtk's internal
+        AtkObject, to include custom implementations for AtkDocument and AtkText objects,
+        taking the logic as-is from AtkDocument::get_document_locale() and DumpRenderTree's
+        AccessibilityUIElementAtk::language(), respectively.
</ins><span class="cx"> 
</span><del>-        Micro-optimize the way we hand NodeLists to JSC.
-        &lt;https://webkit.org/b/131932&gt;
</del><ins>+        Apart from improving encapsulation, this avoids calling deprecated get_document_locale()
+        method.
</ins><span class="cx"> 
</span><del>-        Use HashMap::fastAdd() when returning cached node lists and collections.
-        10.9% progression on Bindings/get-elements-by-tag-name.html
</del><ins>+        No new functionality, no new tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        * accessibility/atk/WebKitAccessibleInterfaceDocument.cpp:
+        (webkitAccessibleDocumentInterfaceInit): Chains implementation of
+        AtkDocument::get_document_locale() to AtkObject::get_object_locale().
+        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
+        (webkitAccessibleGetObjectLocale): Add implementation of locale resolution for
+        objects of type AtkDocument and AtkText.
+        (webkitAccessibleClassInit): Override AtkObject::get_object_locale() method.
</ins><span class="cx"> 
</span><del>-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::addCacheWithAtomicName):
-        (WebCore::NodeListsNodeData::addCacheWithName):
-        (WebCore::NodeListsNodeData::addCacheWithQualifiedName):
-        (WebCore::NodeListsNodeData::addCachedCollection):
</del><ins>+2013-06-12  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-21  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        [GTK] Move more build targets for source code that's free of layer violations into libPlatform
+        https://bugs.webkit.org/show_bug.cgi?id=115936
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167584.
-        https://bugs.webkit.org/show_bug.cgi?id=131929
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Broke Objective-C bindings test (Requested by ap on #webkit).
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        * GNUmakefile.list.am: Move more build targets under the platform_sources and platformgtk_sources listing.
+        These build targets represent source files that are already free of platform layer violations and are as such
+        ready to be pushed down from the WebCore layer into the Platform layer.
</ins><span class="cx"> 
</span><del>-        &quot;Add Element.matches, the standard name for
-        webkitMatchesSelector&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131922
-        http://trac.webkit.org/changeset/167584
</del><ins>+2013-06-12  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-20  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        &quot;Open Video in New Window&quot; doesn't make sense in fullscreen
+        https://bugs.webkit.org/show_bug.cgi?id=117556
</ins><span class="cx"> 
</span><del>-        Compile the :root pseudo class and fix a related issue with :nth-child()
-        https://bugs.webkit.org/show_bug.cgi?id=131926
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        No new tests needed.
</ins><span class="cx"> 
</span><del>-        Add the :root pseudo class. This is another trivial selector, we just need to compare
-        the element pointer with the documentElement.
</del><ins>+        * WebCore.exp.in: Added WebKit2 hook for mediaIsInFullscreen() method.
</ins><span class="cx"> 
</span><del>-        I discovered some issues with :nth-child(n) through the layout tests for &quot;:root&quot;.
-        When the pseudo class nth-child could match anything, no code was generated. That decision
-        was taken when generating the fragments.
</del><ins>+2013-06-12  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        The specification of :nth-child() has two tests: the parent test and the counter test.
-        Since some fragments would not generate any code for :nth-child(n), they would succeed on the root,
-        which is incorrect since the root should fail the parent test.
</del><ins>+        Accessibility code assumes an area element's parent is a map element
+        https://bugs.webkit.org/show_bug.cgi?id=117496
</ins><span class="cx"> 
</span><del>-        This was fixed by moving the filtering of non-counting :nth-child() after we generate the parent
-        check.
-        We still don't generate any counter test unless required.
</del><ins>+        Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/nth-child-on-root.html
</del><ins>+        We can't make such an assumption. Scripts can insert any element between area and map elements.
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::addPseudoClassType):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsRoot):
-        * dom/Document.h:
-        (WebCore::Document::documentElementMemoryOffset):
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/b6f486284f08c52904701c93e1ec0b7d6e76af9f.
</ins><span class="cx"> 
</span><del>-2014-04-20  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        Test: accessibility/image-map-with-indirect-area-crash.html
</ins><span class="cx"> 
</span><del>-        Add Element.matches, the standard name for webkitMatchesSelector
-        https://bugs.webkit.org/show_bug.cgi?id=131922
</del><ins>+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-06-12  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        This patch just renames webkitMatchesSelector() to matches().
</del><ins>+        Whitespace between inlines with nowrap and a shrink-to-fit parent gets a line-break when it shouldn't
+        https://bugs.webkit.org/show_bug.cgi?id=117370
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorObjC.pm:
-        (GenerateImplementation):
-        The Objective-C binding generator only supported ImplementedAs for getters and setters.
-        This adds support for the option so that Element.matches can be generated for Obj-C.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::matches):
-        (WebCore::Element::webkitMatchesSelector): Deleted.
-        * dom/Element.h:
-        * dom/Element.idl:
-        * inspector/InspectorCSSAgent.cpp:
-        (WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):
</del><ins>+        Test: fast/text/whitespace/inline-whitespace-wrapping-8.html
</ins><span class="cx"> 
</span><del>-2014-04-20  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        A no-wrap inline shouldn't include trailing space when deciding whether it fits on a line. 
+        Likewise when we finish iterating through the objects on a line we should clear our linebreak
+        if the only thing that prevents us fitting on the line is our collapsed trailing whitespace.
+         
+        Removing the trailing space from this measurement means we need to watch out for potential
+        breaks between no-wrap inlines, in particular if we leave a no-wrap inline ignoring spaces
+        and enter an autowrap inline then we need to mark the beginning of the autowrap inline
+        as a potential linebreak. The test fast/text/whitespace/inline-whitespace-wrapping-5.html 
+        is an example of such a case.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: RenderLayer's size is set using enclosingRect() which can result in cruft.
-        https://bugs.webkit.org/show_bug.cgi?id=131468
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::LineWidth):
+        (WebCore::LineWidth::fitsOnLine):
+        (WebCore::LineWidth::fitsOnLineExcludingTrailingWhitespace):
+        (WebCore::LineWidth::fitsOnLineExcludingTrailingCollapsedWhitespace):
+        (WebCore::LineWidth::setTrailingWhitespaceWidth):
+        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-06-12  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Layers marked opaque may not paint edge pixels, when RenderLayer bounds are non-integral and
-        get device pixel snapped.
-        For details see this: https://trac.webkit.org/r159463
</del><ins>+        [CSS Shapes] rectangle and inset-rectangle do not properly handle rx and ry
+        https://bugs.webkit.org/show_bug.cgi?id=116745
</ins><span class="cx"> 
</span><del>-        Test: compositing/hidpi-non-simple-compositing-layer-with-fractional-size-and-background.html
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
</del><ins>+        If ry is not supplied, it now defaults to the rx value. Also, if rx
+        and ry are not supplied, they default to 0px. This also has the effect
+        that the computed style for any rectangle or inset-rectangle now
+        contains all six parameters.
</ins><span class="cx"> 
</span><del>-2014-04-19  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        If rx &gt; width/2 then it is clamped to width/2, and if ry &gt; height/2,
+        then it is clamped to height/2. This happens at layout time because
+        given mixed units and relative units, that is the only time this
+        determination can be made.
</ins><span class="cx"> 
</span><del>-        Simple layout can get confused by coordinate overflow
-        https://bugs.webkit.org/show_bug.cgi?id=131890
-        rdar://problem/15558510
</del><ins>+        Tests: fast/exclusions/shape-inside/shape-inside-rounded-rectangle-large-radius.html
+               fast/exclusions/shape-outside-floats/shape-outside-floats-rounded-rectangle-large-radius.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * css/BasicShapeFunctions.cpp:
+        (WebCore::valueForBasicShape): Remove checks for undefined, since rx
+            and ry cannot be undefined in BasicShapes anymore.
+        (WebCore::basicShapeForValue): If radii are undefined in CSS, set
+            default values in the BasicShape, per the spec.
+        * rendering/ExclusionShape.cpp:
+        (WebCore::ensureRadiiDoNotOverlap): Utility method to ensure radii
+            don't overlap.
+        (WebCore::ExclusionShape::createExclusionShape): Remove defaulting to
+            zero, clamp radii per the spec.
+        * rendering/style/BasicShapes.cpp:
+        (WebCore::BasicShapeRectangle::path): Remove defaulting.
+        (WebCore::BasicShapeRectangle::blend): Ditto.
+        (WebCore::BasicShapeInsetRectangle::path): Ditto.
+        (WebCore::BasicShapeInsetRectangle::blend): Ditto.
+        * rendering/style/BasicShapes.h:
+        (WebCore::BasicShapeRectangle::BasicShapeRectangle): Remove defaulting
+            to undefined for radii.
+        (WebCore::BasicShapeRectangle::setCornerRadiusX): Add assert to
+            prevent undefined.
+       (WebCore::BasicShapeRectangle::setCornerRadiusY): Add assert to
+            prevent undefined.
+        (WebCore::BasicShapeInsetRectangle::BasicShapeInsetRectangle): Ditto.
+        (WebCore::BasicShapeInsetRectangle::setCornerRadiusX): Add assert to
+            prevent undefined.
+       (WebCore::BasicShapeInsetRectangle::setCornerRadiusY): Add assert to
+            prevent undefined.
</ins><span class="cx"> 
</span><del>-        Test: fast/css/simple-layout-overflow.html
</del><ins>+2013-06-11  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/SimpleLineLayoutResolver.h:
-        (WebCore::SimpleLineLayout::RunResolver::rangeForRect):
-        If lastLine is smaller than firstLine, just ignore it.
</del><ins>+        [Windows] Support Title UI Element Accessibility Attribute
+        https://bugs.webkit.org/show_bug.cgi?id=117530
</ins><span class="cx"> 
</span><del>-2014-04-20  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        ScriptExecutionContext::stopActiveDOMObjects iterates a hash map that can change during iteration (for multiple reasons, including GC)
-        https://bugs.webkit.org/show_bug.cgi?id=52719
</del><ins>+        Fixes: accessibility/list-item-role.html
+               accessibility/hidden-legend.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        * accessibility/win/AccessibilityObjectWrapperWin.cpp:
+        (WebCore::AccessibilityObjectWrapper::accessibilityAttributeValue): Extend to support access
+        for the Title UI Element object.
+        * accessibility/win/AccessibilityObjectWrapperWin.h: Revise interface to use Variant output,
+        which is more in keeping with the Mac's 'id' method signature.
</ins><span class="cx"> 
</span><del>-        At least two specific ways this can happen:
</del><ins>+2013-06-12  Ralph Thomas  &lt;ralpht@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        1) XMLHttpRequest::stop can trigger a JavaScript garbage collection.
-        2) NotificationCenter::stop can delete the last references to notifications;
-           those notifications are also active DOM objects.
</del><ins>+        [CSS Shaders] Animations and transitions should use validated custom programs
+        https://bugs.webkit.org/show_bug.cgi?id=117550
</ins><span class="cx"> 
</span><del>-        Besides fixing the iteration in that function, did some other fixes for the
-        ScriptExecutionContext class, including some coding style changes. Many uses
-        of nullptr instead of 0, without listing each function separately below.
</del><ins>+        Run filters used for animations and transitions through RenderLayer::computeFilterOperations
+        in order to validate custom filter operations.
</ins><span class="cx"> 
</span><del>-        * Modules/webdatabase/DatabaseContext.cpp:
-        (WebCore::DatabaseContext::contextDestroyed): Call through to the base class
-        version of contextDestroyed rather than repeating what it does (with a large
-        comment that doesn't acknowledge the base class alread does it).
-        * Modules/webdatabase/DatabaseContext.h: Removed some unneeded includes.
-        Wrote out &quot;private&quot; explicitly for deriving from ActiveDOMObject. Made the
-        ActiveDOMObject function overrides private, and marked them override and final.
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        * dom/ActiveDOMObject.h: Updated comments. Replaced suspendIfNeededCalled with
-        assertSuspendIfNeededWasCalled, which has an empty inline version in the header.
-        Renamed m_suspendIfNeededCalled to m_suspendIfNeededWasCalled.
</del><ins>+        No new tests as no platform can run custom filters with accelerated animations yet.
</ins><span class="cx"> 
</span><del>-        * dom/ActiveDOMObject.cpp:
-        (WebCore::ActiveDOMObject::ActiveDOMObject): Pass a reference instead of a pointer.
-        (WebCore::ActiveDOMObject::~ActiveDOMObject): Ditto.
-        (WebCore::ActiveDOMObject::suspendIfNeeded): Ditto.
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
</ins><span class="cx"> 
</span><del>-        * dom/ContextDestructionObserver.cpp:
-        (WebCore::ContextDestructionObserver::observeContext): Pass a reference instead of a pointer.
</del><ins>+2013-06-12  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::MessagePort): Pass a reference instead of a pointer.
-        (WebCore::MessagePort::~MessagePort): Ditto.
-        (WebCore::MessagePort::disentangle): Ditto.
</del><ins>+        Allow for toggling fullscreen on &lt;video&gt; elements
+        https://bugs.webkit.org/show_bug.cgi?id=117220
</ins><span class="cx"> 
</span><del>-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::ScriptExecutionContext): Updated flags used
-        for assertions so they are conditional and updated their names.
-        (WebCore::takeAny): Added. Helper function that we can consider for HashSet in
-        the future; makes loop below easier to read.
-        (WebCore::checkConsistency): Added. Assertions that were done multiple places below,
-        and should not be written over and over again.
-        (WebCore::ScriptExecutionContext::~ScriptExecutionContext): Changed to use C++11
-        for loops and the takeAny function above.
-        (WebCore::ScriptExecutionContext::dispatchMessagePortEvents): Ditto.
-        (WebCore::ScriptExecutionContext::createdMessagePort): Changed to take a reference
-        for clarity and so it doesn't have to do an assert the pointer is non-null.
-        (WebCore::ScriptExecutionContext::destroyedMessagePort): Ditto.
-        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjects): Changed to use
-        C++11 for loop and reworded comment and redid assertions.
-        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects): Ditto.
-        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects): Ditto.
-        (WebCore::ScriptExecutionContext::stopActiveDOMObjects): Changed to support
-        removal of an active DOM object during the stop function. Included new comments
-        to clarify what the rules are.
-        (WebCore::ScriptExecutionContext::suspendActiveDOMObjectIfNeeded): Changed to take
-        a reference for clarity and so it doesn't have to assert a pointer is non-null.
-        (WebCore::ScriptExecutionContext::didCreateActiveDOMObject): Ditto. Also changed to
-        use RELEASE_ASSERT instead of CRASH.
-        (WebCore::ScriptExecutionContext::willDestroyActiveDOMObject): Ditto.
-        (WebCore::ScriptExecutionContext::didCreateDestructionObserver): Ditto.
-        (WebCore::ScriptExecutionContext::willDestroyDestructionObserver): Ditto.
-        (WebCore::ScriptExecutionContext::closeMessagePorts): Moved the body of this
-        function into its one call site, ScriptExecutionContext::stopActiveDOMObjects,
-        since it's simple enough when written as a C++11 for loop.
-        (WebCore::ScriptExecutionContext::hasPendingActivity): Added. This function was
-        already exported for workers, and implementing it outside this class required
-        exposing the private HashSet members; more sensible to implement it here and
-        simply make it public in WorkerGlobalScope.
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        * dom/ScriptExecutionContext.h: Removed unnecessary includes and forward declarations.
-        Removed a long-ago-fixed FIXME. Changed various functions to take references instead of
-        pointers. Added a protected hasPendingActivity function, deleted the closeMessagePorts
-        function, deleted the ActiveDOMObjectsSet typedef, made the assertion flags be
-        !ASSERT_DISABLED only, and deleted the messagePorts and activeDOMObjects functions.
</del><ins>+        This patch adds the ability for fullscreen
+        context menu item on &lt;video&gt; elements to switch between &quot;Enter Fullscreen&quot;
+        and &quot;Exit Fullscreen&quot; and behave appropriately.
</ins><span class="cx"> 
</span><del>-        * workers/WorkerGlobalScope.cpp:
-        (WebCore::WorkerGlobalScope::hasPendingActivity): Deleted. This is now implemented
-        in the base class.
</del><ins>+        No new tests. media/context-menu-action.html,
+        which has been disabled by bug 116651, is used to test context menus.
</ins><span class="cx"> 
</span><del>-        * workers/WorkerGlobalScope.h: Make hasPendingActivity function from the base class
-        public instead of declaring it in this class.
-
-2014-04-20  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [Mac] Unable to select 'Off' or 'Auto' from track menu when tracks consist of unsupported track types
-        https://bugs.webkit.org/show_bug.cgi?id=131908
-        &lt;rdar://problem/15999882&gt;
-
-        Reviewed by Eric Carlson.
-
</del><ins>+        * English.lproj/Localizable.strings: Add &quot;Exit Fullscreen&quot; string.
</ins><span class="cx">         * html/HTMLMediaElement.cpp:
</span><del>-        (WebCore::HTMLMediaElement::setSelectedTextTrack): When the user selects 'Off', make sure the currently 'showing'
-        track is switched to 'disabled'.
</del><ins>+        (WebCore::HTMLMediaElement::toggleFullscreenState): Added to appropriately enter/exit fullscreen.
+        * html/HTMLMediaElement.h:
+        * page/ContextMenuController.cpp:
+        * platform/ContextMenuItem.h:
+        * platform/LocalizedStrings.cpp:
+        * platform/LocalizedStrings.h:
+        Updated to rename variables more appropriately to reflect the toggle-ability of video fullscreen.
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::mediaIsInFullscreen): Added to check if an element
+        was a media element in fullscreen.
+        (WebCore::HitTestResult::toggleMediaFullscreenState): Added to hook into
+        HTMLMediaElement::toggleFullscreenState.
+        * rendering/HitTestResult.h:
</ins><span class="cx"> 
</span><del>-2014-04-20  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-06-12  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Speed up jsStringWithCache() through WeakGCMap inlining.
-        &lt;https://webkit.org/b/131923&gt;
</del><ins>+        Skipping {}, () and [] blocks while error recovering in CSS
+        https://bugs.webkit.org/show_bug.cgi?id=116071
</ins><span class="cx"> 
</span><del>-        Inline the common path of WeakGCMap::add() in jsStringWithCache().
-        26% progression on Bindings/id-getter.html
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::jsStringWithCache):
</del><ins>+        From Blink r150201 and r150755 by &lt;serya@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-            Move jsStringWithCache() out of line since we're now blowing up
-            its size quite a bit.
</del><ins>+        Test: fast/css/parsing-expr-error-recovery.html
</ins><span class="cx"> 
</span><del>-2014-04-20  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        The CSS parser should properly recover from invalid {}, () and []
+        blocks skipping them instead of discarding the whole declaration
+        as invalid. This merge is actually made of two different changes
+        from Blink, the original one that fixes the bug and another one
+        which refactors a bit the code making it more legible.
</ins><span class="cx"> 
</span><del>-        Fix the build after r167574
-
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
-
-2014-04-20  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        Compile the pseudo class :target
-        https://bugs.webkit.org/show_bug.cgi?id=131904
-
-        Reviewed by Andreas Kling.
-
-        The pseudo class :target is trivial, it just compare the current element with
-        Document::cssTarget().
-
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::addPseudoType):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
-        (WebCore::SelectorCompiler::getDocument):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeValueExactMatching):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsTarget):
-        * dom/Document.h:
-        (WebCore::Document::cssTargetMemoryOffset):
-
-2014-04-20  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        Rename the CSSSelector PseudoType to PseudoClassType
-        https://bugs.webkit.org/show_bug.cgi?id=131907
-
-        Reviewed by Andreas Kling.
-
-        Pseudo Elements and Page Pseudo Classes have been moved out of PseudoType in previous patches.
-        The remaining values in the PseudoType enumeration are the pseudo classes.
-
-        This patch is the final clean up, PseudoType is renamed to PseudoClassType.
-
</del><span class="cx">         * css/CSSGrammar.y.in:
</span><del>-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):
-        * css/CSSParserValues.h:
-        (WebCore::CSSParserSelector::pseudoClassType):
-        (WebCore::CSSParserSelector::pseudoType): Deleted.
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::specificityForOneSelector):
-        (WebCore::appendPseudoClassFunctionTail):
-        (WebCore::CSSSelector::selectorText):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::pseudoClassType):
-        (WebCore::CSSSelector::pseudoElementType):
-        (WebCore::CSSSelector::pagePseudoClassType):
-        (WebCore::pseudoClassIsRelativeToSiblings):
-        (WebCore::CSSSelector::isSiblingSelector):
-        (WebCore::CSSSelector::CSSSelector):
-        (WebCore::CSSSelector::pseudoType): Deleted.
-        * css/RuleSet.cpp:
-        (WebCore::RuleSet::findBestRuleSetAndAdd):
-        * css/SelectorChecker.cpp:
-        (WebCore::SelectorChecker::checkOne):
-        (WebCore::SelectorChecker::checkScrollbarPseudoClass):
-        (WebCore::SelectorChecker::determineLinkMatchType):
-        (WebCore::SelectorChecker::matchesFocusPseudoClass):
-        * css/SelectorChecker.h:
-        (WebCore::SelectorChecker::isCommonPseudoClassSelector):
-        * css/SelectorCheckerFastPath.cpp:
-        (WebCore::SelectorCheckerFastPath::commonPseudoClassSelectorMatches):
-        * css/SelectorPseudoClassAndCompatibilityElementMap.in:
-        * css/SelectorPseudoTypeMap.h:
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::styleForElement):
-        * css/makeSelectorPseudoClassAndCompatibilityElementMap.py:
-        (enumerablePseudoType):
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::addPseudoClassType):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
-        (WebCore::SelectorCompiler::addPseudoType): Deleted.
-        * inspector/InspectorCSSAgent.cpp:
-        (WebCore::computePseudoClassMask):
-        (WebCore::InspectorCSSAgent::forcePseudoState):
-        * inspector/InspectorCSSAgent.h:
-        * inspector/InspectorInstrumentation.cpp:
-        (WebCore::InspectorInstrumentation::forcePseudoStateImpl):
-        * inspector/InspectorInstrumentation.h:
-        (WebCore::InspectorInstrumentation::forcePseudoState):
</del><span class="cx"> 
</span><del>-2014-04-19  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-06-12  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Crashes in HTMLFormElement::submit.
-        https://bugs.webkit.org/show_bug.cgi?id=131910
-        &lt;rdar://problem/15661790&gt;
</del><ins>+        [BlackBerry] Remove dead WebDOM code
+        https://bugs.webkit.org/show_bug.cgi?id=113370
</ins><span class="cx"> 
</span><del>-        Based on a patch by Kent Tamura.
-
</del><span class="cx">         Reviewed by Anders Carlsson.
</span><span class="cx"> 
</span><del>-        Tests: fast/forms/form-submission-crash-2.html
-               fast/forms/form-submission-crash.html
</del><ins>+        BlackBerry PR 347565
+        Internally reviewed by Charles Wei.
</ins><span class="cx"> 
</span><del>-        Code that executes arbitrary JS needs to protect objects that it uses afterwards.
</del><ins>+        * PlatformBlackBerry.cmake:
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::prepareForSubmission):
-        (WebCore::HTMLFormElement::submit):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::submitForm):
</del><ins>+2013-06-12  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-20  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        window.find() case-insensitive search doesn't match diacritical marks
+        https://bugs.webkit.org/show_bug.cgi?id=117353
+        &lt;rdar://problem/8535227&gt;
</ins><span class="cx"> 
</span><del>-        Text bounding box computation for simple line layout is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=131912
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Currently, a case-insensitive window.find() search will return true for a word w
+        (e.g. café) with diacritical characters when w appears on the page without
+        diacritical marks (e.g. cafe). This leads to bad results, especially when
+        searching for a non-English word (e.g. qué) where the presence of an accented
+        character(s) may change the meaning of the word. Instead window.find() should
+        return false when case-insensitively matching a word with diacritical marks to
+        the same word without diacritical marks.
</ins><span class="cx"> 
</span><del>-        Top-left is currently the first line top-left which is not always correct.
</del><ins>+        Test: fast/text/find-diacritical-mark.html
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::firstRunLocation):
-        (WebCore::RenderText::firstRunOrigin): Deleted.
-        (WebCore::RenderText::firstRunX): Deleted.
-        (WebCore::RenderText::firstRunY): Deleted.
-        
-            Keep just one accessor and rename it.
-            Encapsulate the line box and simple line versions.
</del><ins>+        * editing/TextIterator.cpp:
+        (WebCore::SearchBuffer::SearchBuffer):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderText.h:
-        * rendering/RenderTextLineBoxes.cpp:
-        (WebCore::RenderTextLineBoxes::firstRunLocation):
</del><ins>+2013-06-12  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-            Line box version.
</del><ins>+        Support latest Web IDL indexed property getters
+        https://bugs.webkit.org/show_bug.cgi?id=117507
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTextLineBoxes.h:
-        * rendering/RenderTreeAsText.cpp:
-        
-            Simplify RenderText dumping.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderTreeAsText::writeRenderObject):
-        * rendering/SimpleLineLayoutFunctions.cpp:
-        (WebCore::SimpleLineLayout::computeTextBoundingBox):
-        
-            Return the correct x position.
</del><ins>+        Support latest Web IDL indexed property getters:
+        http://www.w3.org/TR/WebIDL/#dfn-support-indexed-properties
</ins><span class="cx"> 
</span><del>-        (WebCore::SimpleLineLayout::computeTextFirstRunLocation):
-        
-            Simple line version.
</del><ins>+        Drop support for outdated [IndexedGetter] and [NumericIndexedGetter]
+        IDL extended attributes. Since the new getter format specifies the
+        return type, the bindings generator is now smart enough to know if
+        the indexed getter is numeric or not on its own.
</ins><span class="cx"> 
</span><del>-        * rendering/SimpleLineLayoutFunctions.h:
-        * rendering/svg/SVGRenderTreeAsText.cpp:
-        (WebCore::writeSVGInlineText):
</del><ins>+        Based on Blink r149564 by &lt;kojih@chromium.org&gt;.
</ins><span class="cx"> 
</span><del>-2014-04-19  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: RenderLayer's clipping should snap to device pixel boundaries.
-        https://bugs.webkit.org/show_bug.cgi?id=131466
</del><ins>+        * Modules/filesystem/EntryArray.idl:
+        * Modules/filesystem/EntryArraySync.idl:
+        * Modules/gamepad/GamepadList.idl:
+        * Modules/mediasource/SourceBufferList.idl:
+        * Modules/speech/SpeechGrammarList.idl:
+        * Modules/speech/SpeechRecognitionResult.idl:
+        * Modules/speech/SpeechRecognitionResultList.idl:
+        * bindings/scripts/CodeGenerator.pm:
+        (IsNumericType):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody):
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GetIndexedGetterFunction):
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/TestEventTarget.idl:
+        * bindings/scripts/test/TestTypedArray.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSValueList.idl:
+        * css/MediaList.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSFilterValue.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSTransformValue.idl:
+        * dom/ClientRectList.idl:
+        * dom/DOMNamedFlowCollection.idl:
+        * dom/DOMStringList.idl:
+        * dom/DataTransferItemList.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/NodeList.idl:
+        * dom/PropertyNodeList.idl:
+        * dom/TouchList.idl:
+        * fileapi/FileList.idl:
+        * html/DOMSettableTokenList.idl:
+        * html/DOMTokenList.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLFormControlsCollection.idl:
+        * html/HTMLFormElement.idl:
+        * html/HTMLPropertiesCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/RadioNodeList.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * html/track/AudioTrackList.idl:
+        * html/track/TextTrackCueList.idl:
+        * html/track/TextTrackList.idl:
+        * html/track/TextTrackRegionList.idl:
+        * html/track/VideoTrackList.idl:
+        * page/PerformanceEntryList.idl:
+        * page/SpeechInputResultList.idl:
+        * plugins/DOMMimeTypeArray.idl:
+        * plugins/DOMPlugin.idl:
+        * plugins/DOMPluginArray.idl:
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-06-12  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Fractional pixel clipping can produce cruft on RenderLayers. Since RenderLayer
-        sizing and painting are snapped, painting clip rect needs to be snapped the same way.
</del><ins>+        Rename [CallWith] to [ConstructorCallWith] for IDL interfaces
+        https://bugs.webkit.org/show_bug.cgi?id=117531
</ins><span class="cx"> 
</span><del>-        Test: fast/clip/clip-when-rect-has-fractional-pixel-value.html
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::clipToRect):
</del><ins>+        Rename [CallWith] to [ConstructorCallWith] for IDL interfaces as the
+        meaning is slightly different when [CallWith] is used for IDL operations
+        or attributes. This improves IDL readability a bit and makes it more
+        directly understandable.
</ins><span class="cx"> 
</span><del>-2014-04-19  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Also removed [ConstructorCallWith] statements from interfaces with custom
+        constructors or no constructor, as this does not have any effect.
</ins><span class="cx"> 
</span><del>-        Latched scrolling may interact badly with custom programmatic scrolling
-        https://bugs.webkit.org/show_bug.cgi?id=131869
-        &lt;rdar://problem/16249557&gt;
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * Modules/filesystem/FileWriter.idl:
+        * Modules/mediasource/MediaSource.idl:
+        * Modules/mediasource/SourceBufferList.idl:
+        * Modules/mediastream/MediaStream.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/notifications/Notification.idl:
+        * Modules/speech/SpeechRecognition.idl:
+        * Modules/speech/SpeechSynthesisUtterance.idl:
+        * Modules/webaudio/OfflineAudioContext.idl:
+        * Modules/websockets/WebSocket.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDefinition):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/TestInterface.idl:
+        * dom/MessageChannel.idl:
+        * fileapi/FileReader.idl:
+        * html/MediaController.idl:
+        * html/track/TextTrackCue.idl:
+        * page/EventSource.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
+        * xml/XMLHttpRequest.idl:
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::setScrollLeft): Mark scrollable area as having
-        been scrolled programmatically.
-        (WebCore::Element::setScrollTop): Ditto.
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleWheelEvent): Check for programmatic scroll, and
-        clear latched state if the handler manually scrolled. Clear programmatic
-        scroll state at the end of event handling.
-        (WebCore::EventHandler::clearLatchedState): Refactored code.
-        * page/EventHandler.h:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::platformPrepareForWheelEvents): Check
-        if scrollable area was scrolled programmatically. If it was, do
-        not honor latching behavior.
-        * platform/ScrollableArea.cpp:
-        (WebCore::ScrollableArea::ScrollableArea): Initialize new member.
-        * platform/ScrollableArea.h:
-        (WebCore::ScrollableArea::isScrolledProgrammatically): Added.
-        (WebCore::ScrollableArea::setScrolledProgrammatically): Added.
</del><ins>+2013-06-12  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-19  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        [Qt] Set windows key-code for multimedia keys
+        https://bugs.webkit.org/show_bug.cgi?id=117535
</ins><span class="cx"> 
</span><del>-        AX: grid rows are not recognized do to lack of explicit role=&quot;row&quot;, role=&quot;gridcell&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131819
</del><ins>+        Reviewed by Jocelyn Turcotte.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Map Qt Key-events to their defined windows keycode values.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/table-with-missing-aria-role-rows.html
</del><ins>+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
</ins><span class="cx"> 
</span><del>-        If a table is using role=&quot;grid&quot;, and it has &lt;tr&gt; elements that do not have
-        role=&quot;row&quot;, we should still treat them as row elements.
</del><ins>+2013-06-12  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityARIAGrid.cpp:
-        (WebCore::AccessibilityARIAGrid::addTableCellChild):
</del><ins>+        [Soup] Use ResourceLoadPriority
+        https://bugs.webkit.org/show_bug.cgi?id=112902
</ins><span class="cx"> 
</span><del>-2014-04-19  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        AX: Malformed tables exposing incorrect col and colSpans
-        https://bugs.webkit.org/show_bug.cgi?id=131796
</del><ins>+        Use the ResourceLoadPriority from the ResourceRequest to set the
+        correnpondent priority to each SoupMessage.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        No new tests required as there is no change in functionality,
+        we're just enabling a new feature in the underlying network stack.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/table-incorrect-colspan-cell.html
</del><ins>+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::createSoupMessageForHandleAndRequest):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore):
+        (WebCore::toSoupMessagePriority): Translates ResourceLoadPriority
+        to SoupMessagePriority.
</ins><span class="cx"> 
</span><del>-        When a developer has specified malformed colspans, accessibility is reporting those values instead of the effective column information.
</del><ins>+2013-06-12  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::columnIndexRange):
</del><ins>+        Remove memoryInfoEnabled, quantizedMemoryInfoEnabled settings
+        https://bugs.webkit.org/show_bug.cgi?id=117512
</ins><span class="cx"> 
</span><del>-2014-04-19  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Make the CSS JIT compile for ARM64
-        https://bugs.webkit.org/show_bug.cgi?id=131834
</del><ins>+        * page/Settings.in: Remove the memoryInfoEnabled and the quantizedMemoryInfoEnabled settings. These are not used
+        anywhere anymore after r151199 which simplified and moved the MemoryInfo interface under window.internals.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+2013-06-12  Diego Pino Garcia  &lt;dpino@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Add the CPU specific code required to compile SelectorCompiler on ARM64.
-        The code is absolutely non-functional, it would crash immediately, but it compiles.
</del><ins>+        [GTK] Parameter 'pseudoElement' from function 'webkit_dom_dom_window_get_computed_style' should be allowed to be NULL
+        https://bugs.webkit.org/show_bug.cgi?id=117332
</ins><span class="cx"> 
</span><del>-        * cssjit/FunctionCall.h:
-        (WebCore::FunctionCall::FunctionCall):
-        (WebCore::FunctionCall::callAndBranchOnCondition):
-        * cssjit/RegisterAllocator.h:
-        What am I supposed to do with all those registers? There are so many of them :)
-        The array calleeSavedRegisters is defined for compatibility but it cannot be reached at the moment.
</del><ins>+        Reviewed by Xan Lopez.
</ins><span class="cx"> 
</span><del>-        (WebCore::RegisterAllocator::isValidRegister):
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::modulo):
-        Implement modulo by doing dividend - (divisor * int(dividend/divisor)).
</del><ins>+        Add parameter 'pseudoElement' to the list of parameters that are allowed to
+        be NULL.
</ins><span class="cx"> 
</span><del>-        * cssjit/StackAllocator.h:
-        StackAllocator will need a small redesign to handle the 16 bytes alligned stack of
-        ARM64.
-        The code has been modified to build but it is pretty useless.
</del><ins>+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GetGReturnMacro):
</ins><span class="cx"> 
</span><del>-        (WebCore::StackAllocator::allocateUninitialized):
-        (WebCore::StackAllocator::push):
-        (WebCore::StackAllocator::pop):
-        (WebCore::StackAllocator::popAndDiscard):
-        (WebCore::StackAllocator::popAndDiscardUpTo):
-        (WebCore::StackAllocator::alignStackPreFunctionCall):
-        (WebCore::StackAllocator::unalignStackPostFunctionCall):
</del><ins>+2013-06-12  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Add CSS parsing recovery to functions
+        https://bugs.webkit.org/show_bug.cgi?id=117500
</ins><span class="cx"> 
</span><del>-        [UI-side compositing] Implement blend modes
-        https://bugs.webkit.org/show_bug.cgi?id=131891
-        &lt;rdar://problem/16490085&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        From Blink r150205 by &lt;serya@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Implement blend modes with UI-side compositing.
-        
-        PlatformCALayer::setBlendMode() becomes pure virtual, and overridden in
-        PlatformCALayerMac and PlatformCALayerRemote.
-        PlatformCAFilters::setBlendingFiltersOnLayer() now takes a raw platform
-        layer, so it can be called from the UI process on a CALayer*.
-        
-        Fix an issue with GraphicsLayerCA::LayerChange flags. 1 &lt;&lt; 31 shifts
-        a signed integer, so it ended up setting all the high bits in m_uncommittedChanges,
-        causing us to push blend modes to the UI process for every layer. Fix by shifting
-        an unsigned long long (1LLU &lt;&lt; 31). This should also fix a build warning on Windows.
</del><ins>+        Add parsing recovery capabilities to functions. Errors were
+        correctly detected without this change but then the whole
+        declaration was invalidated. By using expr_recovery to handle them
+        we can recover from those errors and go on with the parsing.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * platform/graphics/ca/PlatformCAFilters.h:
-        * platform/graphics/ca/PlatformCALayer.h:
-        * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
-        (PlatformCAFilters::setBlendingFiltersOnLayer):
-        * platform/graphics/ca/mac/PlatformCALayerMac.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (PlatformCALayerMac::setFilters):
-        (PlatformCALayerMac::setBlendMode):
-        (PlatformCALayer::setBlendMode): Deleted.
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-2014-04-19  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+2013-06-11  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix AVPlayerController leak on pages with video
-        https://bugs.webkit.org/show_bug.cgi?id=131878
</del><ins>+        Unreviewed, rolling out r151378.
+        http://trac.webkit.org/changeset/151378
+        https://bugs.webkit.org/show_bug.cgi?id=117400
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Decreased IDL readability a bit.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (-[WebAVPlayerController init]):
-        Assigning to the retain property will increment the count,
-        so balance the alloc with an autorelease.
</del><ins>+        * Modules/encryptedmedia/MediaKeys.idl:
+        * Modules/mediastream/RTCIceCandidate.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/mediastream/RTCSessionDescription.idl:
+        * Modules/webaudio/OfflineAudioContext.idl:
+        * Modules/websockets/WebSocket.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDefinition):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/TestInterface.idl:
+        * bindings/scripts/test/TestNamedConstructor.idl:
+        * css/WebKitCSSMatrix.idl:
+        * html/HTMLOptionElement.idl:
+        * page/EventSource.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
</ins><span class="cx"> 
</span><del>-2014-04-19  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-06-11  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Slap ALWAYS_INLINE on Element attribute lookup things.
-        &lt;https://webkit.org/b/131892&gt;
</del><ins>+        Have to invalidate the mute button when changing the volume
+        https://bugs.webkit.org/show_bug.cgi?id=117464
</ins><span class="cx"> 
</span><del>-        Most of the &quot;inline&quot; helpers for setting/getting attributes were not
-        actually getting inlined by the compiler, so let's make that happen.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/c4c685c82908449526fd8c251cc551e729ebed08
+        but without a test since the test doesn't work in WebKit.
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::synchronizeAttribute):
-        * dom/ElementData.h:
-        (WebCore::ElementData::findAttributeByName):
-        (WebCore::ElementData::findAttributeIndexByName):
</del><ins>+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::changedVolume):
</ins><span class="cx"> 
</span><del>-2014-04-19  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2013-06-11  Max Vujovic  &lt;mvujovic@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Telephone number detection should respect its setting consistently
-        https://bugs.webkit.org/show_bug.cgi?id=131893
-        rdar://problem/16597639
</del><ins>+        [CSS Regions] Regions don't create a stacking context for their contents
+        https://bugs.webkit.org/show_bug.cgi?id=114268
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::respondToChangedSelection): Only start the timer
-        if shouldDetectTelephoneNumbers returns true.
-        (WebCore::Editor::shouldDetectTelephoneNumbers): Added. Calls both
-        isTelephoneNumberParsingEnabled and TelephoneNumberDetector::isSupported.
-        (WebCore::Editor::scanSelectionForTelephoneNumbers): Use
-        shouldDetectTelephoneNumbers.
-        (WebCore::Editor::clearDataDetectedTelephoneNumbers): Use document()
-        instead of m_frame.document().
</del><ins>+        Paint the region content (from RenderFlowThread) during the background phase instead of the
+        foreground phase.
</ins><span class="cx"> 
</span><del>-        * editing/Editor.h: Added declaration of shouldDetectTelephoneNumbers.
</del><ins>+        Let's assume there is a region and a sibling element. The sibling partially overlaps the
+        region and appears after the region in DOM order.
</ins><span class="cx"> 
</span><del>-2014-04-19  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+        Before this patch, we would paint in this order:
+        1) Region background
+        2) Sibling background
+        3) Region content
+        4) Sibling content
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Harden the layout in case there are no regions
-        https://bugs.webkit.org/show_bug.cgi?id=131517
</del><ins>+        As a result, the sibling background would incorrectly paint between the region
+        background and the region content. Instead, the sibling background should paint over the
+        region background and the region content.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+        After this patch, we paint in this order:
+        1) Region background
+        2) Region content
+        3) Sibling background
+        4) Sibling content
</ins><span class="cx"> 
</span><del>-        The patch fixes the cases when the content of a flow thread is not
-        properly invalidated when all the regions of its chain are removed.
</del><ins>+        Test: fast/regions/region-sibling-paint-order.html
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/simplified-layout-no-regions.html
-
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock):
</del><span class="cx">         * rendering/RenderRegion.cpp:
</span><del>-        (WebCore::RenderRegion::ensureOverflowForBox):
</del><ins>+        (WebCore::RenderRegion::paintObject):
</ins><span class="cx"> 
</span><del>-2014-04-19  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-06-11  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=131594
-        Subpixel rendering: WK1: Wrong repaint rect is calculated when layer has non-compositing transform.
</del><ins>+        REGRESSION: (r149232) videos on disney.com are initially scrambled on load
+        https://bugs.webkit.org/show_bug.cgi?id=117517
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        We need to snap the repaint rect for transformed object the same way when we paint them.
</del><ins>+        Set a background color on the AVPlayerLayer to avoid corruption when no
+        frames are available to display.
</ins><span class="cx"> 
</span><del>-        Test: fast/repaint/hidpi-wrong-repaint-rect-when-parent-has-noncompositing-transform.html
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeRectForRepaint):
</del><ins>+2013-06-11  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Use HTMLElementFactory to create equivalent elements in WebVTTElement
+        https://bugs.webkit.org/show_bug.cgi?id=117423
</ins><span class="cx"> 
</span><del>-        Use 'override' in GraphicsLayerCA
-        https://bugs.webkit.org/show_bug.cgi?id=131882
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/3d60bec8e5dabfe877c482797d9ef430bfde31
</ins><span class="cx"> 
</span><del>-        Add 'override' to all overridden functions. Found a few that need
-        not have been virtual. Removed &quot;allowTiledLayer&quot; stuff that was
-        never called.
</del><ins>+        This change forces the calls through the factory so that we create appropriate sub-classes based upon the passed tag name,
+        rather than just creating a concrete HTMLElement class with an inappropriate tag name.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::requiresTiledLayer):
-        (WebCore::GraphicsLayerCA::setAllowTiledLayer): Deleted.
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        (WebCore::GraphicsLayerCA::platformCALayer):
-        (WebCore::GraphicsLayerCA::hasContentsLayer): Deleted.
-        (WebCore::GraphicsLayerCA::allowTiledLayer): Deleted.
-        (WebCore::GraphicsLayerCA::isGraphicsLayerCA): Deleted.
-        (WebCore::GraphicsLayerCA::platformCALayerLayoutSublayersOfLayer): Deleted.
-        (WebCore::GraphicsLayerCA::platformCALayerRespondsToLayoutChanges): Deleted.
-        (WebCore::GraphicsLayerCA::platformCALayerContentsOrientation): Deleted.
-        (WebCore::GraphicsLayerCA::platformCALayerShowDebugBorders): Deleted.
-        (WebCore::GraphicsLayerCA::platformCALayerIncrementRepaintCount): Deleted.
-        (WebCore::GraphicsLayerCA::platformCALayerContentsOpaque): Deleted.
-        (WebCore::GraphicsLayerCA::platformCALayerDrawsContent): Deleted.
-        (WebCore::GraphicsLayerCA::platformCALayerLayerDidDisplay): Deleted.
</del><ins>+        Test: media/track/getCueAsHTMLCrash.html
</ins><span class="cx"> 
</span><del>-2014-04-18  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+        * html/track/WebVTTElement.cpp:
+        (WebCore::WebVTTElement::createEquivalentHTMLElement):
</ins><span class="cx"> 
</span><del>-        Web Inspector: Move InspectorProfilerAgent to JavaScriptCore
-        https://bugs.webkit.org/show_bug.cgi?id=131673
</del><ins>+2013-06-11  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Passes existing profiler and inspector tests.
</del><ins>+        Split SelectorDataList::executeSingleTagNameSelectorData() into the 4 kinds of traversal
+        https://bugs.webkit.org/show_bug.cgi?id=117486
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * ForwardingHeaders/inspector/agents/InspectorProfilerAgent.h: Added.
-        * WebCore.exp.in:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptProfile.cpp: Removed.
-        * bindings/js/ScriptProfile.h:
-        * bindings/js/ScriptProfiler.cpp: Removed.
-        * bindings/js/ScriptProfiler.h: Removed.
-        * inspector/InspectorAllInOne.cpp:
-        * inspector/InspectorConsoleInstrumentation.h:
-        (WebCore::InspectorInstrumentation::profilerEnabled):
-        (WebCore::InspectorInstrumentation::startProfiling):
-        (WebCore::InspectorInstrumentation::stopProfiling):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        * inspector/InspectorController.h:
-        * inspector/InspectorInstrumentation.cpp:
-        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
-        (WebCore::InspectorInstrumentation::startProfilingImpl):
-        (WebCore::InspectorInstrumentation::stopProfilingImpl):
-        (WebCore::InspectorInstrumentation::consoleTimeStampImpl): Deleted.
-        * inspector/InspectorInstrumentation.h:
-        * inspector/InspectorProfilerAgent.cpp: Removed.
-        * inspector/InspectorProfilerAgent.h: Removed.
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::startProfiling):
-        (WebCore::stopProfiling):
-        (WebCore::InspectorTimelineAgent::willCallFunction):
-        (WebCore::InspectorTimelineAgent::didCallFunction):
-        (WebCore::InspectorTimelineAgent::willEvaluateScript):
-        (WebCore::InspectorTimelineAgent::didEvaluateScript):
-        (WebCore::InspectorTimelineAgent::didDispatchXHRLoadEvent): Deleted.
-        * inspector/InstrumentingAgents.h:
-        (WebCore::InstrumentingAgents::inspectorProfilerAgent):
-        (WebCore::InstrumentingAgents::setInspectorProfilerAgent):
-        * inspector/PageDebuggerAgent.cpp:
-        (WebCore::PageDebuggerAgent::sourceMapURLForScript): Deleted.
-        * inspector/PageDebuggerAgent.h:
-        * inspector/PageProfilerAgent.cpp: Added.
-        (WebCore::PageProfilerAgent::PageProfilerAgent):
-        (WebCore::PageProfilerAgent::profilingGlobalExecState):
-        * inspector/PageProfilerAgent.h: Added.
-        (WebCore::PageProfilerAgent::~PageProfilerAgent):
-        * inspector/ScriptProfile.idl:
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::appendProfile):
-        * inspector/TimelineRecordFactory.h:
-        * inspector/WebConsoleAgent.cpp:
-        * inspector/WebProfilerAgent.cpp: Added.
-        (WebCore::WebProfilerAgent::WebProfilerAgent):
-        (WebCore::WebProfilerAgent::enable):
-        (WebCore::WebProfilerAgent::disable):
-        * inspector/WebProfilerAgent.h: Added.
-        (WebCore::WebProfilerAgent::~WebProfilerAgent):
-        * inspector/WorkerInspectorController.cpp:
-        (WebCore::WorkerInspectorController::WorkerInspectorController):
-        * inspector/WorkerProfilerAgent.cpp: Added.
-        (WebCore::WorkerProfilerAgent::WorkerProfilerAgent):
-        (WebCore::WorkerProfilerAgent::profilingGlobalExecState):
-        * inspector/WorkerProfilerAgent.h: Added.
-        (WebCore::WorkerProfilerAgent::~WorkerProfilerAgent):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        * page/PageConsole.cpp:
-        (WebCore::PageConsole::profile):
-        (WebCore::PageConsole::profileEnd):
-        (WebCore::PageConsole::time): Deleted.
-        (WebCore::PageConsole::timeEnd): Deleted.
-        (WebCore::PageConsole::timeStamp): Deleted.
-        * page/PageConsole.h:
-        * testing/Internals.cpp:
-        * testing/Internals.h:
-        * xml/XMLHttpRequest.cpp:
</del><ins>+        Since this is pretty common, split the name selector to have the constant conditions
+        outside the traversal.
</ins><span class="cx"> 
</span><del>-2014-04-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * dom/SelectorQuery.cpp:
+        (WebCore::SelectorDataList::executeSingleTagNameSelectorData):
</ins><span class="cx"> 
</span><del>-        Contents of directly composited image layers are sometimes missing
-        https://bugs.webkit.org/show_bug.cgi?id=131880
</del><ins>+2013-06-11  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
-        
-        RenderLayerBacking::updateGraphicsLayerGeometry() tested whether a
-        GraphicsLayer had a contents layer to determine whether to call code
-        that updates the contents rect. However, on Mac, we don't make a contents
-        layer until later at layer flush time. That would result in an empty
-        contentsRect being set.
-        
-        Fix by renaming GraphicsLayer::hasContentsLayer() to usesContentsLayer(),
-        and on Mac consulting the m_contentsLayerPurpose flag, which is set
-        at the appropriate time.
</del><ins>+        [Mac] Update text track menu
+        https://bugs.webkit.org/show_bug.cgi?id=117351
</ins><span class="cx"> 
</span><del>-        Test: compositing/images/update-content-rect.html
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.cpp:
-        (WebCore::positionScrollbarLayer):
-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::getDebugBorderInfo):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::usesContentsLayer):
-        (WebCore::GraphicsLayer::hasContentsLayer): Deleted.
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        (WebCore::GraphicsLayerCA::hasContentsLayer): Deleted.
-        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
-        (WebCore::GraphicsLayerTextureMapper::usesContentsLayer):
-        (WebCore::GraphicsLayerTextureMapper::hasContentsLayer): Deleted.
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::positionOverflowControlsLayers):
-        (WebCore::RenderLayerBacking::compositingLayerType):
</del><ins>+        No new tests, existing tests updated.
</ins><span class="cx"> 
</span><del>-2014-04-18  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * English.lproj/Localizable.strings: Update the menu title.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167527.
-        https://bugs.webkit.org/show_bug.cgi?id=131883
</del><ins>+        * page/CaptionUserPreferencesMac.mm: System language is no longer needed.
</ins><span class="cx"> 
</span><del>-        Broke 32-bit build (Requested by ap on #webkit).
</del><ins>+        * platform/LocalizedStrings.cpp: Ditto.
+        * platform/LocalizedStrings.h:
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+2013-06-11  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;[Mac] implement WebKitDataCue&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131799
-        http://trac.webkit.org/changeset/167527
</del><ins>+        Fix the element type in the selector checkers
+        https://bugs.webkit.org/show_bug.cgi?id=117450
</ins><span class="cx"> 
</span><del>-2014-04-18  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        [Mac] implement WebKitDataCue
-        https://bugs.webkit.org/show_bug.cgi?id=131799
</del><ins>+        * css/SelectorCheckerFastPath.cpp:
+        (WebCore::HTMLNames::checkClassValue):
+        * dom/SelectorQuery.cpp:
+        (WebCore::SelectorDataList::executeSingleClassNameSelectorData):
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2013-06-11  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: http/tests/media/track-in-band-hls-metadata.html
-               media/track/track-datacue-value.html
</del><ins>+        Clean up the initializer mess in Document
+        https://bugs.webkit.org/show_bug.cgi?id=117448
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig: Define ENABLE_DATACUE_VALUE.
-        * DerivedSources.make: Add ENABLE_DATACUE_VALUE to HTML_FLAGS when appropriate.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: Add JSDataCueCustom.cpp.
-        * bindings/js/JSBindingsAllInOne.cpp:
-        * WebCore.xcodeproj/project.pbxproj: Add new files.
</del><ins>+        Basic cleaning from
+        https://chromium.googlesource.com/chromium/blink/+/e54ba8d3b62b0245ecdf2f3ec11cd33b4035a4d7
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDataCueCustom.cpp: Added.
-        (WebCore::JSDataCue::value): 
-        (WebCore::JSDataCue::setValue):
-        (WebCore::JSDataCueConstructor::constructJSDataCue): Custom constructor.
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Drive-by fixes: don't schedule timeupdate
-            events when paused, don't call sort on an Vector that can't be sorted.
</del><ins>+2013-06-11  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/track/DataCue.cpp:
-        (WebCore::DataCue::DataCue): Initialize m_type.
-        (WebCore::DataCue::~DataCue): Unprotect the JSValue if necessary.
-        (WebCore::DataCue::data): Ask the platform value for data if non-null.
-        (WebCore::DataCue::setData): Clear m_platformValue and m_value.
-        (WebCore::DataCue::isEqual): New.
-        (WebCore::DataCue::value): Return a JSValue from the platform value, or the value passed
-            to the constructor/set by script.
-        (WebCore::DataCue::setValue): Set m_value.
-        * html/track/DataCue.h:
-        * html/track/DataCue.idl:
</del><ins>+        Set the font size for in-band captions on the display box, not the :cue.
+        https://bugs.webkit.org/show_bug.cgi?id=117515
</ins><span class="cx"> 
</span><del>-        * html/track/InbandDataTextTrack.cpp:
-        (WebCore::InbandDataTextTrack::addDataCue): Don't add the same cue more than once.
-        (WebCore::InbandDataTextTrack::updateDataCue): Update a cue's duration.
-        (WebCore::InbandDataTextTrack::removeDataCue): Remove an incomplete cue.
-        (WebCore::InbandDataTextTrack::removeCue): Remove a cue from the incomplete cue map if necessary.
-        * html/track/InbandDataTextTrack.h:
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        * html/track/InbandGenericTextTrack.cpp:
-        (WebCore::InbandGenericTextTrack::addGenericCue): CueMatchRules is now in TextTrackCue instead
-            of VTTCue.
-        * html/track/InbandTextTrack.h:
</del><ins>+        Make the in-band font size behavior match the out-of-band behavior.
</ins><span class="cx"> 
</span><del>-        * html/track/InbandWebVTTTextTrack.cpp:
-        (WebCore::InbandWebVTTTextTrack::newCuesParsed): Ditto.
-
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::hasCue): Ditto.
-        * html/track/TextTrack.h:
-
-        * html/track/TextTrackCue.cpp:
-        (WebCore::TextTrackCue::isEqual): New, test base class equality.
-        * html/track/TextTrackCue.h:
-
</del><span class="cx">         * html/track/TextTrackCueGeneric.cpp:
</span><del>-        (WebCore::TextTrackCueGeneric::isEqual): Call TextTrackCue::isEqual first.
-        * html/track/TextTrackCueGeneric.h:
</del><ins>+        (WebCore::TextTrackCueGeneric::setFontSize):
</ins><span class="cx"> 
</span><del>-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::isEqual): Call TextTrackCue::isEqual first.
-        * html/track/VTTCue.h:
</del><ins>+2013-06-11  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/SerializedPlatformRepresentation.h: Added.
-        (WebCore::SerializedPlatformRepresentation::~SerializedPlatformRepresentation):
-        (WebCore::SerializedPlatformRepresentation::SerializedPlatformRepresentation):
</del><ins>+        [Windows] Implement 'attributeValue' accessor to support testing.
+        https://bugs.webkit.org/show_bug.cgi?id=117513
</ins><span class="cx"> 
</span><del>-        * platform/graphics/InbandTextTrackPrivateClient.h: Add methods for DataCue with SerializedPlatformRepresentation.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/InbandMetadataTextTrackPrivateAVF.cpp: Added.
-        (WebCore::InbandMetadataTextTrackPrivateAVF::create):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::InbandMetadataTextTrackPrivateAVF):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::~InbandMetadataTextTrackPrivateAVF):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::addDataCue):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::updatePendingCueEndTimes):
-        (WebCore::InbandMetadataTextTrackPrivateAVF::flushPartialCues):
-        * platform/graphics/avfoundation/InbandMetadataTextTrackPrivateAVF.h: Added.
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Add new implementation file.
+        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
+        * accessibility/win/AccessibilityObjectWrapperWin.cpp: Added.
+        * accessibility/win/AccessibilityObjectWrapperWin.h: Add declaration
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundation::seekWithTolerance): currentTrack -&gt; currentTextTrack.
-        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundation::configureInbandTracks): Ditto.
-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
-        (WebCore::MediaPlayerPrivateAVFoundation::setCurrentTextTrack):
-        (WebCore::MediaPlayerPrivateAVFoundation::setCurrentTrack): Deleted.
</del><ins>+2013-05-27  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Renamed currentTrack and setCurrentTrack to currentTextTrack and setCurrentTextTrack.
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::AVFWrapper::currentTextTrack):
-        (WebCore::MediaPlayerPrivateAVFoundationCF::setCurrentTextTrack):
-        (WebCore::MediaPlayerPrivateAVFoundationCF::currentTextTrack):
-        (WebCore::AVFWrapper::setCurrentTextTrack):
-        (WebCore::AVFWrapper::AVFWrapper):
-        (WebCore::AVFWrapper::processCue):
-        (WebCore::AVFWrapper::currentTrack): Deleted.
-        (WebCore::MediaPlayerPrivateAVFoundationCF::setCurrentTrack): Deleted.
-        (WebCore::MediaPlayerPrivateAVFoundationCF::currentTrack): Deleted.
-        (WebCore::AVFWrapper::setCurrentTrack): Deleted.
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
</del><ins>+        Positioned Replaced Elements That Aren't RenderReplaced get Incorrect Width
+        https://bugs.webkit.org/show_bug.cgi?id=93735
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::seekToTime): currentTrack -&gt; currentTextTrack
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): currentTrack -&gt; currentTextTrack.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::processMetadataTrack): New.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::processCue): m_currentTrack -&gt; m_currentTextTrack.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::flushCues): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setCurrentTextTrack): Renamed from setCurrentTextTrack.
-        (WebCore::metadataType): Map an AVFoundation metadata key space to a metadata cue type.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive): Process new metadata.
-        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setCurrentTrack): Deleted.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Create a JSValue representation from an AVMetadataItem.
-        * platform/mac/SerializedPlatformRepresentationMac.h: Added.
-        (WebCore::SerializedPlatformRepresentationMac::platformType):
-        (WebCore::SerializedPlatformRepresentationMac::nativeValue):
-        * platform/mac/SerializedPlatformRepresentationMac.mm: Added.
-        (WebCore::SerializedPlatformRepresentationMac::SerializedPlatformRepresentationMac):
-        (WebCore::SerializedPlatformRepresentationMac::~SerializedPlatformRepresentationMac):
-        (WebCore::SerializedPlatformRepresentationMac::create):
-        (WebCore::SerializedPlatformRepresentationMac::data):
-        (WebCore::SerializedPlatformRepresentationMac::deserialize):
-        (WebCore::SerializedPlatformRepresentationMac::isEqual):
-        (WebCore::toSerializedPlatformRepresentationMac):
-        (WebCore::jsValueWithValueInContext):
-        (WebCore::jsValueWithDataInContext):
-        (WebCore::jsValueWithArrayInContext):
-        (WebCore::jsValueWithDictionaryInContext):
-        (WebCore::jsValueWithAVMetadataItemInContext):
</del><ins>+        Replaced elements that aren't RenderReplaced aren't |isReplaced| and don't have an 
+        intrinsic height or width. This causes them to go down the wrong height and width computation
+        path in RenderBox when they are absolute positioned. 
+        
+        The notion of |isReplaced| is entwined with the notion of being |isInline| so it isn't really 
+        possible to make them isReplaced without re-wiring a lot of code. So instead use an ad-hoc definition
+        of isReplacedElement in RenderBox to bring all replaced elements into the height and width calculation.
+        To make sure we get the right height and width in there, give non-RenderReplaced replaced renderers
+        the helpers for returning their approximation of intrinsic height and width.
</ins><span class="cx"> 
</span><del>-2014-04-18  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        Test: fast/replaced/width-and-height-of-positioned-replaced-elements.html
</ins><span class="cx"> 
</span><del>-        Harden RenderInline::inlineElementContinuation()
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::isReplacedElement):
+        (WebCore::RenderBox::computePositionedLogicalWidth):
+        (WebCore::RenderBox::computePositionedLogicalHeight):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::intrinsicSize):
+        * rendering/RenderButton.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::computeLogicalHeight):
+        * rendering/RenderListBox.h:
+        * rendering/RenderMenuList.h:
+        * rendering/RenderReplaced.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::computeLogicalHeight):
+        * rendering/RenderTextControl.h:
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=131858&gt;
</del><ins>+2013-06-11  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        There are unused variables in ApplyStyleCommand::mergeEndWithNextIfIdentical and ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds
+        https://bugs.webkit.org/show_bug.cgi?id=117475
</ins><span class="cx"> 
</span><del>-        No new tests, as there are no known cases of this happening.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::inlineElementContinuation):
-        Return nullptr if the continuation is neither a RenderInline nor a
-        RenderBlock.
</del><ins>+        Removed.
</ins><span class="cx"> 
</span><del>-2014-04-18  Stephanie Lewis  &lt;slewis@apple.com&gt;
</del><ins>+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
</ins><span class="cx"> 
</span><del>-        We shouldn’t create page throttlers for other pages than WebKit2 pages.
-        Part of &lt;rdar://problem/16473045&gt; Visibility state counters are often incorrect
-        https://bugs.webkit.org/show_bug.cgi?id=131696
</del><ins>+2013-06-11  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+        Fix typo in r151445
</ins><span class="cx"> 
</span><del>-        No new test since not web exposed.
</del><ins>+        Unreviewed build fix.
</ins><span class="cx"> 
</span><del>-        Page throttlers were being created for SVG images and other page instances that
-        were not accurately tracking the states that enable and disable page throttling.
-        Make the throttler an unique ptr and only initialize it for WebKit2.
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
</ins><span class="cx"> 
</span><del>-        This also fixes an inefficiency where we would throttle a new page on creation because 
-        we assumed it was visible even if that was not the case.
</del><ins>+2013-06-11  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute): Check page throttler exists.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::started): ditto
-        * page/Page.cpp:
-        (WebCore::Page::Page): Don’t automatically create page throttler.
-        (WebCore::Page::createPageThrottler): Create page throttler.
-        (WebCore::Page::setViewState): Check page throttler exists.
-        * page/Page.h:
-        (WebCore::Page::pageThrottler): Make the page throttler a unique ptr.
-        * page/PageThrottler.h:
-        * page/Settings.cpp: 
-        (WebCore::Settings::setHiddenPageDOMTimerThrottlingEnabled): Check page throttler exists.
</del><ins>+        Remove redundant calls to ceilToFloat in RenderBlock::computeInlinePreferredLogicalWidths
+        https://bugs.webkit.org/show_bug.cgi?id=117490
</ins><span class="cx"> 
</span><del>-2014-04-18  Stephanie Lewis  &lt;slewis@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Move DOM throttling out of the page throttler
-        &lt;rdar://problem/16473004&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=131697
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/be336b14325b2938ff6a4fb6191073a6e717a57c.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
</ins><span class="cx"> 
</span><del>-        No new tests since it's not web exposed.
</del><ins>+2013-06-03  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        DOM timer throttling is currently part of the page throttler which uses per process 
-        state and per page state to determine when to throttle.  This led us to being overly 
-        conservative when turning DOM throttling off.  It should only respond to view state changes.
</del><ins>+        Painting collapsed borders during scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=85658
</ins><span class="cx"> 
</span><del>-        Additionally since creating extra page throttlers SVG images caused bugs 
-        in tracking state we'll reserve the page throttler for WebKit2 views.  To avoid regressing 
-        WebKit1 we should move DOM timer throttling back to the page.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::Page): set DOM timer throttling.
-        (WebCore::Page::setIsVisuallyIdleInternal): ditto.
-        (WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged): ditto.
-        (WebCore::Page::setIsVisible): Update view state masks for WebKit1 to include IsVisibleOrOccluded and IsVisuallyIdle
-        * page/Page.h:
-        * page/PageThrottler.cpp:
-        (WebCore::PageThrottler::PageThrottler): remove DOM timer throttling.
-        (WebCore::PageThrottler::started): ditto.
-        (WebCore::PageThrottler::stopped): ditto.
-        (WebCore::PageThrottler::hiddenPageDOMTimerThrottlingStateChanged): Deleted.
-        * page/PageThrottler.h:
-        * page/Settings.cpp:
-        (WebCore::Settings::setHiddenPageDOMTimerThrottlingEnabled):
</del><ins>+        Test: fast/repaint/table-cell-collapsed-border-scroll.html
</ins><span class="cx"> 
</span><del>-2014-04-18  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        WHen painting collapsed borders we need to paint the borders of the row above
+        the topmost dirtied row so that we compute the correct value for the dirtied row's collapsed border.
</ins><span class="cx"> 
</span><del>-        [WebGL] Limit maximum texture sizes on older Intel hardware
-        https://bugs.webkit.org/show_bug.cgi?id=131867
</del><ins>+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paintObject):
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2013-06-11  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Both Chrome and Firefox limit the MAX_TEXTURE_SIZE on
-        older Intel hardware to be at most 4096. This does the
-        same for WebKit.
</del><ins>+        [curl] Custom HTTP method support
+        https://bugs.webkit.org/show_bug.cgi?id=117302
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Extensions3D.h: Add requiresRestrictedMaximumTextureSize() accessor.
-        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
-        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon): Record the value of GL_RENDERER
-        and test for &quot;Intel HD Graphics 3000&quot;, which is the problematic hardware.
-        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
-        (WebCore::Extensions3DOpenGLCommon::requiresRestrictedMaximumTextureSize): Getter.
-        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
-        (WebCore::GraphicsContext3D::getIntegerv): If you're asking for MAX_TEXTURE_SIZE or
-        MAX_CUBE_MAP_TEXTURE_SIZE, and you're on problematic hardware, return a clamped value
-        (4096 and 1024 respectively).
</del><ins>+        Reviewed by Kenneth Rohde Christiansen.
</ins><span class="cx"> 
</span><del>-2014-04-18  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+        No new tests, already covered by existing ones like:
+        http/tests/xmlhttprequest/workers/methods.html
+        http/tests/xmlhttprequest/workers/methods-async.html
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Add parsing support for gradients
-        https://bugs.webkit.org/show_bug.cgi?id=131444
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+2013-06-11  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Added support for shape-outside gradient values.
</del><ins>+        Web Inspector: Remove 'using namespace std'
+        https://bugs.webkit.org/show_bug.cgi?id=117498
</ins><span class="cx"> 
</span><del>-        Test: fast/shapes/shape-outside-floats/shape-outside-linear-gradient.html
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyShape::applyValue): Accept generated images as shape-outside values.
-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::checkShapeImageOrigin): Generated images get a pass, others do not.
-        (WebCore::getShapeImageAndRect): Use StyleImage::image() to get a generated image.
-        (WebCore::ShapeOutsideInfo::isEnabledFor):
-        * rendering/style/ShapeValue.h:
-        (WebCore::ShapeValue::isImageValid): Generated images are always considered valid.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-04-18  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        * inspector/InspectorAgent.cpp: Remove unneeded 'using namespace std'.
+        * inspector/InspectorFrontendClientLocal.cpp: Use explicit std:: qualifiers instead.
+        (WebCore::InspectorFrontendClientLocal::constrainedAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::constrainedAttachedWindowWidth):
+        * inspector/InspectorFrontendHost.cpp: Remove unneeded 'using namespace std'.
+        * inspector/InspectorPageAgent.cpp: Remove unneeded 'using namespace std'.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r155700): Pasting an image into content-editable regions is broken.
-        &lt;rdar://problem/16654156&gt; and https://bugs.webkit.org/show_bug.cgi?id=131844
</del><ins>+2013-06-11  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+        Support latest Web IDL named property getters
+        https://bugs.webkit.org/show_bug.cgi?id=117403
</ins><span class="cx"> 
</span><del>-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::createFragmentForImageResourceAndAddResource): Add the ArchiveResource before
-          creating the element that uses it.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-2014-04-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Add support for the latest Web IDL named property getters to the JSC
+        bindings generator:
+        http://www.w3.org/TR/WebIDL/#idl-named-properties
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Make window.scroll() and window.scrollBy() work
-        https://bugs.webkit.org/show_bug.cgi?id=131848
-        &lt;rdar://problem/16638319&gt;
</del><ins>+        Drop support for outdated [NamedGetter] IDL extended attribute.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+        Support for other kinds of named properties will be added in later
+        patches. This patch only brings named property getters.
</ins><span class="cx"> 
</span><del>-        The scrolling-related functions in DOMWindow were #ifdeffed for iOS
-        to use the hacky WK1-specific &quot;actual scroll&quot; functions, which do nothing
-        in WK2.
-        
-        Fix by adding a scroll position wrapper (contentsScrollPosition) which does
-        the right thing on WK1 and WK2, and change almost all the places that used &quot;actualScrollPosition&quot;
-        to us it (with the exception of contentsScrollOffset() in MouseRelatedEvent.cpp, which has
-        confusing scaling behavior).
</del><ins>+        This patch is based on Blink r149247 by kojih@chromium.org.
</ins><span class="cx"> 
</span><del>-        * dom/MouseRelatedEvent.cpp:
-        (WebCore::MouseRelatedEvent::MouseRelatedEvent):
-        * dom/TreeScope.cpp:
-        (WebCore::nodeFromPoint): Remove #ifdefs. 
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::scrollLeft):
-        (WebCore::HTMLBodyElement::scrollTop):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::scrollX):
-        (WebCore::DOMWindow::scrollY):
-        (WebCore::DOMWindow::scrollBy):
-        (WebCore::DOMWindow::scrollTo):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::contentsScrollPosition):
-        (WebCore::ScrollView::setContentsScrollPosition):
-        * platform/ScrollView.h:
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-04-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody):
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GetSpecialAccessorFunctionForType):
+        (GetNamedGetterFunction):
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/IDLParser.pm:
+        (applyTypedefs):
+        (parseSpecialOperation):
+        (parseSpecials):
+        (applyMemberList):
+        * bindings/scripts/test/TestEventTarget.idl:
+        * css/StyleSheetList.idl:
+        * dom/DOMNamedFlowCollection.idl:
+        * dom/DOMStringMap.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/NodeList.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLFormControlsCollection.idl:
+        * html/HTMLPropertiesCollection.idl:
+        * plugins/DOMMimeTypeArray.idl:
+        * plugins/DOMPlugin.idl:
+        * plugins/DOMPluginArray.idl:
+        * storage/Storage.idl:
</ins><span class="cx"> 
</span><del>-        Worse animation performance on pages with 3D transforms
-        https://bugs.webkit.org/show_bug.cgi?id=131838
-        &lt;rdar://problem/16428630&amp;15705876&gt;
</del><ins>+2013-06-11  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
-        
-        r155977 added logic to adjust the contentsScale of compositing layers
-        based on a root-relative transform. However, this resulted in
-        the contentsScale continually changing on layers whose transforms
-        are changed dynamically, which caused lots of expensive painting.
-        
-        Fix by bucketing the part of the scale computed from the root-relative transform
-        into buckets of 0.25 via rounding.
</del><ins>+        [BlackBerry] Test editing/execCommand/indent-paragraphs.html times out
+        https://bugs.webkit.org/show_bug.cgi?id=117235
</ins><span class="cx"> 
</span><del>-        Test: compositing/contents-scale/rounded-contents-scale.html
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::clampedContentsScaleForScale):
-        (WebCore::GraphicsLayerCA::updateContentsOpaque):
-        (WebCore::GraphicsLayerCA::updateContentsScale):
-        (WebCore::GraphicsLayerCA::updateContentsVisibility): Deleted.
-        (WebCore::GraphicsLayerCA::animatedLayerClones): Deleted.
</del><ins>+        PR 346414.
</ins><span class="cx"> 
</span><del>-2014-04-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        After r150224 ResourceHandle::start() can fail returning false so
+        that the ResourceHandle is destroyed and the error not
+        handled. Handle the errors by scheduling a InvalidURLFailure and
+        returning true when startJob fails to make sure the ResourceHandle
+        is not destroyed and the error is handled and notified to the
+        client.
</ins><span class="cx"> 
</span><del>-        Remove some includes from image-related headers, and Document.h
-        https://bugs.webkit.org/show_bug.cgi?id=131797
</del><ins>+        Fixes timeout in editing/execCommand/indent-paragraphs.html.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        * platform/network/blackberry/ResourceHandleBlackBerry.cpp:
+        (WebCore::ResourceHandle::start):
</ins><span class="cx"> 
</span><del>-        Remove some #includes from Document.h, DragImage.h, GradientImage.h,
-        Image.h, and ImageBuffer.h and deal with the fallout.
</del><ins>+2013-06-11  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.h:
-        * dom/Document.cpp:
-        (WebCore::Document::setInputCursor):
-        * dom/Document.h:
-        (WebCore::Document::inputCursor):
-        * dom/MutationObserverRegistration.cpp:
-        * html/canvas/WebGLRenderingContext.cpp:
-        * page/FrameSnapshotting.cpp:
-        * page/Page.cpp:
-        * platform/DragImage.h:
-        * platform/graphics/BitmapImage.cpp:
-        * platform/graphics/GradientImage.cpp:
-        (WebCore::GradientImage::GradientImage):
-        (WebCore::GradientImage::~GradientImage):
-        * platform/graphics/GradientImage.h:
-        * platform/graphics/Image.h:
-        * platform/graphics/ImageBuffer.cpp:
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::ImageBuffer::create):
-        (WebCore::ImageBuffer::internalSize):
-        (WebCore::ImageBuffer::logicalSize):
-        (WebCore::ImageBuffer::baseTransform):
-        (WebCore::ImageBuffer::spaceSize):
-        (WebCore::ImageBuffer::setSpaceSize):
-        * rendering/RenderThemeMac.mm:
-        * rendering/shapes/Shape.cpp:
-        * rendering/svg/RenderSVGContainer.cpp:
-        * svg/SVGURIReference.h:
</del><ins>+        Remove IntRect::pixelSnapped* and its enclosingRect since they are no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=117494
</ins><span class="cx"> 
</span><del>-2014-04-18  Gabor Rapcsanyi  &lt;rgabor@webkit.org&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Unreviewed. ARM64 buildfix after r167473.
</del><ins>+        Merge: https://chromium.googlesource.com/chromium/blink/+/9433dc00e882e2808ac1db3c1fd89090896d7b58
+               https://chromium.googlesource.com/chromium/blink/+/7beaa73aa099170cb2cad02c12c5e0a448b12c21
</ins><span class="cx"> 
</span><del>-        * platform/audio/DenormalDisabler.h: Put back the MathExtras.h include.
</del><ins>+        * inspector/InspectorLayerTreeAgent.cpp:
+        (WebCore::InspectorLayerTreeAgent::buildObjectForLayer):
+        * inspector/InspectorOverlay.cpp:
+        (WebCore::InspectorOverlay::update):
+        * platform/graphics/IntRect.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::hitTestCulledInline):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintUsingContainer):
</ins><span class="cx"> 
</span><del>-2014-04-18  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+2013-06-11  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Incorrect background paint on positioned element hover
-        https://bugs.webkit.org/show_bug.cgi?id=131617
</del><ins>+        Autoclose braces and parentheses at the end of style sheet
+        https://bugs.webkit.org/show_bug.cgi?id=117414
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        When computing the repaint rect for absolute elements flowed into regions, the Y location of the
-        region within the flow thread must no longer be added to the repaint rect's location because absolute
-        positioned elements get pushed down through the regions by their absolute top. So adding the region's
-        position in the flow thread and then adding the element's absolute top would cause us to add
-        something twice.
</del><ins>+        From Blink r150202 by &lt;serya@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/repaint/repaint-absolute-pushed-to-next-region.html
</del><ins>+        Use closing_parenthesis and closing_brace instead of the literals
+        '}' and ')'. This allows the parser to treat expressions with
+        unmatched closing braces/parenthesis as if all of them were
+        actually closed.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeRectForRepaint):
</del><ins>+        Tests: animations/keyframe-autoclose-brace.html
+               css3/autoclose-braces-and-parentheses.html
</ins><span class="cx"> 
</span><del>-2014-04-18  Philippe Normand  &lt;pnormand@igalia.com&gt;
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-        Remove NETWORK_INFO support
-        https://bugs.webkit.org/show_bug.cgi?id=131841
</del><ins>+2013-06-10  Jae Hyun Park  &lt;jae.park@company100.net&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        [CoordinatedGraphics] Typos in custom shader support
+        https://bugs.webkit.org/show_bug.cgi?id=117413
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * Modules/networkinfo/NavigatorNetworkInfoConnection.cpp: Removed.
-        * Modules/networkinfo/NavigatorNetworkInfoConnection.h: Removed.
-        * Modules/networkinfo/NavigatorNetworkInfoConnection.idl: Removed.
-        * Modules/networkinfo/NetworkInfo.cpp: Removed.
-        * Modules/networkinfo/NetworkInfo.h: Removed.
-        * Modules/networkinfo/NetworkInfoClient.h: Removed.
-        * Modules/networkinfo/NetworkInfoConnection.cpp: Removed.
-        * Modules/networkinfo/NetworkInfoConnection.h: Removed.
-        * Modules/networkinfo/NetworkInfoConnection.idl: Removed.
-        * Modules/networkinfo/NetworkInfoController.cpp: Removed.
-        * Modules/networkinfo/NetworkInfoController.h: Removed.
-        * PlatformEfl.cmake:
-        * dom/EventTargetFactory.in:
-        * platform/efl/NetworkInfoProviderEfl.cpp: Removed.
-        * platform/efl/NetworkInfoProviderEfl.h: Removed.
-        * testing/Internals.cpp:
-        (WebCore::Internals::setNetworkInformation): Deleted.
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-2014-04-17  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Wrong keyframe is passed when assigning filterValue.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167478.
-        https://bugs.webkit.org/show_bug.cgi?id=131840
</del><ins>+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
+        (WebCore::CoordinatedGraphicsScene::setLayerAnimationsIfNeeded):
</ins><span class="cx"> 
</span><del>-        Broke multicol tests (Requested by ap on #webkit).
</del><ins>+2013-06-10  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        text-transform: capitalize shouldn't upconvert
+        https://bugs.webkit.org/show_bug.cgi?id=117485
</ins><span class="cx"> 
</span><del>-        &quot;[New Multicolumn] Pagination mode messed up with non-inline
-        axis and reversed direction.&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131811
-        http://trac.webkit.org/changeset/167478
</del><ins>+        Reviewed by Adam Barth.
</ins><span class="cx"> 
</span><del>-2014-04-17  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Avoid the upconversion. Merge https://chromium.googlesource.com/chromium/blink/+/c5a221d6da2443df0639c01c40aac6040908ec79.
</ins><span class="cx"> 
</span><del>-        [iOS] Hook up screen.{availHeight, availWidth, height, width}
-        https://bugs.webkit.org/show_bug.cgi?id=131821
-        &lt;rdar://problem/16413795&gt;
</del><ins>+        * rendering/RenderText.cpp:
+        (WebCore::makeCapitalized):
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain and Tim Horton.
</del><ins>+2013-06-10  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Implement support for screen.{availHeight, availWidth, height, width} in WebKit2 for iOS.
</del><ins>+        DocType strings should be 8 bit wide
+        https://bugs.webkit.org/show_bug.cgi?id=117487
</ins><span class="cx"> 
</span><del>-        Additionally substitute &quot;screenSize&quot; for &quot;viewporScreenSize&quot; to make the code more understandable.
</del><ins>+        Reviewed by Michael Saboff.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export symbol for WebCore System Interface function
-        _wkGetAvailableScreenSize.
-        * dom/Document.cpp:
-        (WebCore::Document::processViewport): Modified to call Chrome::screenSize(); formerly it
-        called ChromeClient::viewportScreenSize().
-        * page/Chrome.cpp:
-        (WebCore::Chrome::screenSize): Added; turns around and calls ChromeClient::screenSize().
-        (WebCore::Chrome::availableScreenSize): Added; turns around and calls ChromeClient::availableScreenSize().
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::screenSize): Renamed; formerly named viewportScreenSize.
-        (WebCore::ChromeClient::availableScreenSize): Added; default implementation, which
-        returns the size of Chrome::windowRect().
-        * page/ViewportConfiguration.cpp:
-        (WebCore::ViewportConfiguration::textDocumentParameters):
-        * platform/HostWindow.h: Added declarations for availableScreenSize() and screenSize()
-        so that a caller (e.g. WebCore::screenRect()) can query for such screen information using
-        only the HostWindow interface. That is, a caller doesn't need to know about ChromeClient.
-        * platform/ios/PlatformScreenIOS.mm:
-        (WebCore::screenRect): Modified to query HostWindow::screenSize() when computing the
-        screen rectangle in WebKit2 for iOS.
-        (WebCore::screenAvailableRect): Modified to query HostWindow::availableScreenSize()
-        when computing the available screen rectangle in WebKit2 for iOS.
-        * platform/ios/WebCoreSystemInterfaceIOS.mm:
-        * platform/mac/WebCoreSystemInterface.h:
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/8da02d0ce3965c4e6bf227db856bce930393429a.
</ins><span class="cx"> 
</span><del>-2014-04-17  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertDoctype):
</ins><span class="cx"> 
</span><del>-        origin spoofing possible (HTTP Origin, postMessage event.origin) due to inappropriate URL escape sequence decoding
-        https://bugs.webkit.org/show_bug.cgi?id=131837
-        rdar://problem/15211936
</del><ins>+2013-06-10  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson and Dave Hyatt.
</del><ins>+        Make more functions const
+        https://bugs.webkit.org/show_bug.cgi?id=117455
</ins><span class="cx"> 
</span><del>-        Tests: fast/dom/DOMURL/parsing.html
-               fast/dom/HTMLAnchorElement/anchor-element-href-parsing.html
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * platform/URL.cpp:
-        (WebCore::URL::host): Removed unnecessary call to decodeURLEscapeSequences, which caused
-        problems and was not needed.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/886866f5034d7f30f8aa607b909313f99db1f3b4.
</ins><span class="cx"> 
</span><del>-2014-04-17  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        * editing/VisibleUnits.cpp:
+        (WebCore::CachedLogicallyOrderedLeafBoxes::boxIndexInLeaves):
+        * html/canvas/WebGLRenderingContext.cpp:
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPDirectiveList::evalDisabledErrorMessage):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::shouldIndentText):
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Pagination mode messed up with non-inline axis and reversed direction.
-        https://bugs.webkit.org/show_bug.cgi?id=131811
</del><ins>+2013-06-10  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        REGRESSION(r151302): Many broken webaudio/ tests on Mac port.
+        https://bugs.webkit.org/show_bug.cgi?id=117446
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/newmulticol/compare-with-old-impl/BottomToTop-tb.html
-        
-        With block axis pagination mode, it is possible to set a column height that is not the same
-        as the available fill height for a block. The new multi-column code had the assumption that
-        the column height was the same as the amount of fill room you had available. This is not
-        the case.
-        
-        To correct the issue, I added a member variable to RenderMultiColumnSet that stores the
-        available column height as a separate variable from the computed column height. This allows
-        the pagination API to specify a different column height that is not the same as the view's
-        content height.
</del><ins>+        Reviewed by Chris Rogers.
</ins><span class="cx"> 
</span><del>-        Even though it isn't involved in the solution, I also patched pageOrViewLogicalHeight on
-        RenderView to work with the new column code as well.
</del><ins>+        The new &quot;pageConsentRequiredForAudioStart()&quot; restriction was blocking playback event
+        even when page consent was given. Remvoe the restriction immediately in that case.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::RenderMultiColumnSet):
-        (WebCore::RenderMultiColumnSet::setAndConstrainColumnHeight):
-        (WebCore::RenderMultiColumnSet::computeLogicalHeight):
-        * rendering/RenderMultiColumnSet.h:
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::pageOrViewLogicalHeight):
</del><ins>+        * Modules/webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::startRendering):
</ins><span class="cx"> 
</span><del>-2014-04-17  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+2013-06-10  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Build fix.
</del><ins>+        REGRESSION(r150633): Find on page non-focused text highlight color is bright yellow.
+        &lt;rdar://problem/14098882&gt;
+        &lt;http://webkit.org/b/117371&gt;
</ins><span class="cx"> 
</span><del>-        * svg/animation/SMILTime.h:
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-04-17  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        There was a mistake in the parameter ordering which still compiled because of
+        implicit bool/unsigned conversion.
+        Changed the interface of Page::findMatchesForText() to use enums instead of bools.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167384.
</del><ins>+        No test because the color of the highlighted matches is not available through APIs.
</ins><span class="cx"> 
</span><del>-        Sounds like this isn't the right fix, and causes generation to
-        run far too often.
</del><ins>+        * page/Page.h:
+        * page/Page.cpp:
+        (WebCore::Page::findMatchesForText):
+        (WebCore::Page::markAllMatchesForText):
+        (WebCore::Page::countFindMatches):
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+2013-06-10  Bear Travis  &lt;betravis@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Fix CodeGenerator.pm to only write files if the generated
-        content has changed&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131756
-        http://trac.webkit.org/changeset/167384
</del><ins>+        [CSS Shapes][CSS Exclusions] Split CSS Exclusions and CSS Shapes code
+        https://bugs.webkit.org/show_bug.cgi?id=117162
</ins><span class="cx"> 
</span><del>-2014-04-17  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        Remove unnecessary MathExtras.h includes
-        https://bugs.webkit.org/show_bug.cgi?id=131789
</del><ins>+        With the split between the CSS Exclusions and CSS Shapes specifications,
+        some renaming is necessary. In general, this patch removes 'Exclusion' from
+        any Shapes code, while organizing the rendering shapes code into a 'shapes'
+        folder.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Renames:
+        ExclusionShape -&gt; Shape
+        Exclusion[Rectangle|Polygon] -&gt; [Rectangle|Polygon]Shape
+        Exclusion -&gt; Shape
</ins><span class="cx"> 
</span><del>-        * platform/FileSystem.h:
-        * platform/Scrollbar.h:
-        * platform/animation/AnimationUtilities.h:
-        * platform/audio/DenormalDisabler.h:
-        * platform/graphics/Font.h:
-        * platform/graphics/IntPoint.h: Included cmath instad of MathExtras.h.
-        * platform/graphics/LayoutPoint.h:
-        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
-        * rendering/svg/SVGMarkerData.h:
-        * svg/animation/SMILTime.h:
</del><ins>+        Refactoring, no new tests.
</ins><span class="cx"> 
</span><del>-2014-04-16  Huang Dongsung  &lt;luxtella@company100.net&gt;
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.pri:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::ComputedStyleExtractor::propertyValue):
+        * css/CSSPrimitiveValue.h:
+        * css/DeprecatedStyleBuilder.cpp:
+        (WebCore::ApplyPropertyShape::setValue):
+        (WebCore::ApplyPropertyShape::applyValue):
+        (WebCore::ApplyPropertyShape::createHandler):
+        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
+        * page/animation/CSSPropertyAnimation.cpp:
+        (WebCore::blendFunc):
+        (WebCore::PropertyWrapperShape::PropertyWrapperShape):
+        (WebCore::CSSPropertyAnimation::ensurePropertyMap):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/LayoutState.h:
+        (WebCore::LayoutState::LayoutState):
+        (WebCore::LayoutState::shapeInsideInfo):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::updateShapeInsideInfoAfterStyleChange):
+        (WebCore::shapeInfoRequiresRelayout):
+        (WebCore::RenderBlock::updateRegionsAndExclusionsBeforeChildLayout):
+        (WebCore::RenderBlock::computeShapeSize):
+        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::computeLogicalLocationForFloat):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::ensureShapeInsideInfo):
+        (WebCore::RenderBlock::shapeInsideInfo):
+        (WebCore::RenderBlock::setShapeInsideInfo):
+        (WebCore::RenderBlock::allowsShapeInsideInfoSharing):
+        (WebCore::RenderBlock::xPositionForFloatIncludingMargin):
+        (WebCore::RenderBlock::yPositionForFloatIncludingMargin):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutShapeInsideInfo):
+        (WebCore::LineWidth::LineWidth):
+        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::constructBidiRunsForLine):
+        (WebCore::adjustLogicalLineTop):
+        (WebCore::RenderBlock::updateLineBoundariesForShapes):
+        (WebCore::RenderBlock::adjustLogicalLineTopAndLogicalHeightIfNeeded):
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::updateShapeOutsideInfoAfterStyleChange):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::shapeOutsideInfo):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintOffset):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::pushLayoutState):
+        * rendering/shapes/PolygonShape.cpp: Renamed from Source/WebCore/rendering/ExclusionPolygon.cpp.
+        (WebCore::leftSide):
+        (WebCore::isReflexVertex):
+        (WebCore::computeXIntersection):
+        (WebCore::inwardEdgeNormal):
+        (WebCore::outwardEdgeNormal):
+        (WebCore::appendArc):
+        (WebCore::snapVerticesToLayoutUnitGrid):
+        (WebCore::computeShapePaddingBounds):
+        (WebCore::computeShapeMarginBounds):
+        (WebCore::PolygonShape::shapePaddingBounds):
+        (WebCore::PolygonShape::shapeMarginBounds):
+        (WebCore::getVertexIntersectionVertices):
+        (WebCore::appendIntervalX):
+        (WebCore::compareEdgeIntersectionX):
+        (WebCore::computeXIntersections):
+        (WebCore::computeOverlappingEdgeXProjections):
+        (WebCore::PolygonShape::getExcludedIntervals):
+        (WebCore::PolygonShape::getIncludedIntervals):
+        (WebCore::firstFitRectInPolygon):
+        (WebCore::aboveOrToTheLeft):
+        (WebCore::PolygonShape::firstIncludedIntervalLogicalTop):
+        * rendering/shapes/PolygonShape.h: Renamed from Source/WebCore/rendering/ExclusionPolygon.h.
+        (WebCore::OffsetPolygonEdge::OffsetPolygonEdge):
+        (WebCore::OffsetPolygonEdge::edgeIndex):
+        (WebCore::OffsetPolygonEdge::basis):
+        (WebCore::PolygonShape::PolygonShape):
+        * rendering/shapes/RectangleShape.cpp: Renamed from Source/WebCore/rendering/ExclusionRectangle.cpp.
+        (WebCore::ellipseXIntercept):
+        (WebCore::ellipseYIntercept):
+        (WebCore::FloatRoundedRect::paddingBounds):
+        (WebCore::FloatRoundedRect::marginBounds):
+        (WebCore::FloatRoundedRect::cornerInterceptForWidth):
+        (WebCore::RectangleShape::shapePaddingBounds):
+        (WebCore::RectangleShape::shapeMarginBounds):
+        (WebCore::RectangleShape::getExcludedIntervals):
+        (WebCore::RectangleShape::getIncludedIntervals):
+        (WebCore::RectangleShape::firstIncludedIntervalLogicalTop):
+        * rendering/shapes/RectangleShape.h: Renamed from Source/WebCore/rendering/ExclusionRectangle.h.
+        (WebCore::FloatRoundedRect::FloatRoundedRect):
+        (WebCore::FloatRoundedRect::rx):
+        (WebCore::FloatRoundedRect::ry):
+        (WebCore::RectangleShape::RectangleShape):
+        * rendering/shapes/Shape.cpp: Renamed from Source/WebCore/rendering/ExclusionShape.cpp.
+        (WebCore::createRectangleShape):
+        (WebCore::createShapeCircle):
+        (WebCore::createShapeEllipse):
+        (WebCore::createPolygonShape):
+        (WebCore::physicalRectToLogical):
+        (WebCore::physicalPointToLogical):
+        (WebCore::physicalSizeToLogical):
+        (WebCore::Shape::createShape):
+        * rendering/shapes/Shape.h: Renamed from Source/WebCore/rendering/ExclusionShape.h.
+        (WebCore::LineSegment::LineSegment):
+        (WebCore::Shape::~Shape):
+        (WebCore::Shape::shapeMargin):
+        (WebCore::Shape::shapePadding):
+        * rendering/shapes/ShapeInfo.cpp: Renamed from Source/WebCore/rendering/ExclusionShapeInfo.cpp.
+        (WebCore::::computedShape):
+        (WebCore::::computeSegmentsForLine):
+        * rendering/shapes/ShapeInfo.h: Renamed from Source/WebCore/rendering/ExclusionShapeInfo.h.
+        (WebCore::MappedInfo::ensureInfo):
+        (WebCore::MappedInfo::removeInfo):
+        (WebCore::MappedInfo::info):
+        (WebCore::MappedInfo::infoMap):
+        (WebCore::ShapeInfo::~ShapeInfo):
+        (WebCore::ShapeInfo::setShapeSize):
+        (WebCore::ShapeInfo::clearSegments):
+        (WebCore::ShapeInfo::shapeLogicalTop):
+        (WebCore::ShapeInfo::shapeLogicalBottom):
+        (WebCore::ShapeInfo::shapeLogicalLeft):
+        (WebCore::ShapeInfo::shapeLogicalRight):
+        (WebCore::ShapeInfo::shapeLogicalWidth):
+        (WebCore::ShapeInfo::shapeLogicalHeight):
+        (WebCore::ShapeInfo::logicalLineTop):
+        (WebCore::ShapeInfo::logicalLineBottom):
+        (WebCore::ShapeInfo::shapeContainingBlockHeight):
+        (WebCore::ShapeInfo::lineOverlapsShapeBounds):
+        (WebCore::ShapeInfo::lineWithinShapeBounds):
+        (WebCore::ShapeInfo::dirtyShapeSize):
+        (WebCore::ShapeInfo::shapeSizeDirty):
+        (WebCore::ShapeInfo::owner):
+        (WebCore::ShapeInfo::ShapeInfo):
+        (WebCore::ShapeInfo::logicalTopOffset):
+        (WebCore::ShapeInfo::logicalLeftOffset):
+        * rendering/shapes/ShapeInsideInfo.cpp: Renamed from Source/WebCore/rendering/ExclusionShapeInsideInfo.cpp.
+        (WebCore::LineSegmentRange::LineSegmentRange):
+        (WebCore::ShapeInsideInfo::isEnabledFor):
+        (WebCore::ShapeInsideInfo::adjustLogicalLineTop):
+        * rendering/shapes/ShapeInsideInfo.h: Renamed from Source/WebCore/rendering/ExclusionShapeInsideInfo.h.
+        (WebCore::LineSegmentIterator::LineSegmentIterator):
+        (WebCore::ShapeInsideInfo::createInfo):
+        (WebCore::ShapeInsideInfo::hasSegments):
+        (WebCore::ShapeInsideInfo::segments):
+        (WebCore::ShapeInsideInfo::segmentRanges):
+        (WebCore::ShapeInsideInfo::currentSegment):
+        (WebCore::ShapeInsideInfo::setNeedsLayout):
+        (WebCore::ShapeInsideInfo::needsLayout):
+        (WebCore::ShapeInsideInfo::ShapeInsideInfo):
+        * rendering/shapes/ShapeInterval.cpp: Renamed from Source/WebCore/rendering/ExclusionInterval.cpp.
+        (WebCore::IntervalX1Comparator::operator()):
+        (WebCore::ShapeInterval::intersect):
+        (WebCore::sortShapeIntervals):
+        (WebCore::mergeShapeIntervals):
+        (WebCore::intersectShapeIntervals):
+        (WebCore::subtractShapeIntervals):
+        * rendering/shapes/ShapeInterval.h: Renamed from Source/WebCore/rendering/ExclusionInterval.h.
+        (WebCore::ShapeInterval::ShapeInterval):
+        * rendering/shapes/ShapeOutsideInfo.cpp: Renamed from Source/WebCore/rendering/ExclusionShapeOutsideInfo.cpp.
+        (WebCore::ShapeOutsideInfo::isEnabledFor):
+        (WebCore::ShapeOutsideInfo::computeSegmentsForLine):
+        * rendering/shapes/ShapeOutsideInfo.h: Renamed from Source/WebCore/rendering/ExclusionShapeOutsideInfo.h.
+        (WebCore::ShapeOutsideInfo::shapeLogicalOffset):
+        (WebCore::ShapeOutsideInfo::leftSegmentShapeBoundingBoxDelta):
+        (WebCore::ShapeOutsideInfo::rightSegmentShapeBoundingBoxDelta):
+        (WebCore::ShapeOutsideInfo::createInfo):
+        (WebCore::ShapeOutsideInfo::ShapeOutsideInfo):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::initialShapeInside):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/ShapeValue.h: Renamed from Source/WebCore/rendering/style/ExclusionShapeValue.h.
+        (WebCore::ShapeValue::createShapeValue):
+        (WebCore::ShapeValue::createOutsideValue):
+        (WebCore::ShapeValue::createImageValue):
+        (WebCore::ShapeValue::type):
+        (WebCore::ShapeValue::shape):
+        (WebCore::ShapeValue::image):
+        (WebCore::ShapeValue::setImage):
+        (WebCore::ShapeValue::operator==):
+        (WebCore::ShapeValue::ShapeValue):
+        * rendering/style/StyleRareNonInheritedData.h:
</ins><span class="cx"> 
</span><del>-        Make RenderLayerBacking get the timingFunction of the correct animation.
-        https://bugs.webkit.org/show_bug.cgi?id=100632
</del><ins>+2013-06-10  Iago Toral Quiroga  &lt;itoral@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Use Cairo implementation of the WidgetBackingStore instead of X11 when running on Wayland
+        https://bugs.webkit.org/show_bug.cgi?id=116717
</ins><span class="cx"> 
</span><del>-        When an element has multiple animations that have different timingFunctions,
-        the progress of each animation should be calculated using its respective
-        timingFunction. But at this point, the timingFunction of the first animation is
-        only used in RenderLayerBacking::startAnimation(), regardless of how many
-        animations the element has.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        getAnimationFromStyleByName() was introduced in r89462 so that the
-        timingFunction of the correct animation searched by its name would be
-        used. This patch moves the function to KeyframeValue::timingFunction()
-        so that RenderLayerBacking reuses this method.
</del><ins>+        Refactored WidgetBackingStore to be an abstract base class and make
+        GtkWidgetBackingStoreX11 and WidgetBackingStoreCairo inherit from it.
+        GtkWidgetBackingStoreX11 renamed to WidgetBackingStoreGtkX11.
</ins><span class="cx"> 
</span><del>-        Test: animations/keyframe-multiple-timing-functions-transform.html
-
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startAnimation):
-        * rendering/style/KeyframeList.cpp:
-        (WebCore::KeyframeValue::timingFunction):
</del><ins>+        * GNUmakefile.list.am:
+        * platform/cairo/WidgetBackingStore.h:
</ins><span class="cx">         (WebCore):
</span><del>-        * rendering/style/KeyframeList.h:
</del><ins>+        (WidgetBackingStore):
+        (WebCore::WidgetBackingStore::WidgetBackingStore):
+        (WebCore::WidgetBackingStore::~WidgetBackingStore):
+        * platform/cairo/WidgetBackingStoreCairo.cpp:
+        (WebCore::WidgetBackingStoreCairo::create):
</ins><span class="cx">         (WebCore):
</span><del>-        (KeyframeValue):
</del><ins>+        (WebCore::WidgetBackingStoreCairo::WidgetBackingStoreCairo):
+        (WebCore::WidgetBackingStoreCairo::~WidgetBackingStoreCairo):
+        (WebCore::WidgetBackingStoreCairo::cairoSurface):
+        (WebCore::WidgetBackingStoreCairo::scroll):
+        * platform/cairo/WidgetBackingStoreCairo.h: Added.
+        (WebCore):
+        (WidgetBackingStoreCairo):
+        * platform/gtk/GtkWidgetBackingStoreX11.cpp:
+        (WebCore::WidgetBackingStoreGtkX11::create):
+        (WebCore):
+        (WebCore::WidgetBackingStoreGtkX11::WidgetBackingStoreGtkX11):
+        (WebCore::WidgetBackingStoreGtkX11::~WidgetBackingStoreGtkX11):
+        (WebCore::WidgetBackingStoreGtkX11::cairoSurface):
+        (WebCore::WidgetBackingStoreGtkX11::scroll):
+        * platform/gtk/GtkWidgetBackingStoreX11.h: Added.
+        (WebCore):
+        (WidgetBackingStoreGtkX11):
</ins><span class="cx"> 
</span><del>-2014-04-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-06-10  Otto Derek Cheung  &lt;otcheung@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Rollout: Add a way to cache never-changing IDL attributes in the wrapper.
-        &lt;https://webkit.org/b/131759&gt;
</del><ins>+        [BlackBerry] Store ParsedCookies as RefPtrs instead of PassRefPtrs in CookieDatabaseBackingStore
+        https://bugs.webkit.org/show_bug.cgi?id=117411
</ins><span class="cx"> 
</span><del>-        This behavior may be observable from the web, so we can't do it this way.
</del><ins>+        JIRA388672
+        BRWSR-11465
+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        * bindings/scripts/IDLAttributes.txt:
-        * bindings/scripts/test/*:
-        * dom/Element.idl:
-        * dom/Node.idl:
</del><ins>+        When we queue up ParsedCookie objects for modification, we should be storing them as a refptr instead
+        of a PassRefPtr.
</ins><span class="cx"> 
</span><del>-2014-04-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h:
</ins><span class="cx"> 
</span><del>-        Cheesy Mountain Lion build fix.
</del><ins>+2013-06-10  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/MemoryPressureHandler.h:
-        (WebCore::MemoryPressureHandler::ReliefLogger::logString):
</del><ins>+        [CSSRegions] ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in RenderGeometryMap::mapToContainer
+        https://bugs.webkit.org/show_bug.cgi?id=117395
</ins><span class="cx"> 
</span><del>-2014-04-17  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Column rules don't respect the specified stacking order.
-        https://bugs.webkit.org/show_bug.cgi?id=131804
</del><ins>+        Test: fast/regions/assert-flow-thread-compositing.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+        We should not allow RenderNamedFlowThread layers to be composited, rather their collected children should checked
+        for compositing through their associated RenderRegions.
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/newmulticol/compare_with_old_impl/column-rules-stacking.html
</del><ins>+        The assert in RenderGeometryMap::mapToContainer was hit because after https://bugs.webkit.org/show_bug.cgi?id=117270
+        the render named flow threads are hooked in RenderView layer tree - with the caveat that they are not directly involved
+        in hit testing/paint which is done through their associated regions.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::paintBoxDecorations):
-        * rendering/RenderBlockFlow.h:
-        Override paintBoxDecorations for block flows so that we can iterate over our column sets
-        and paint their rules just after painting our background and border. We can't wait until
-        the child column sets paint their backgrounds, since that is specified as being above negative
-        z-index children. We have to pretend that the column sets don't exist as
-        far as column rule painting is concerned.
</del><ins>+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Bail out if we hit a render named flow thread layer.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::paintObject): Deleted.
-        * rendering/RenderMultiColumnSet.h:
-        Turn paintObject in RenderMultiColumnSet into an override that doesn't paint anything.
</del><ins>+2013-06-10  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-17  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Refactor CALCFUNCTION rules in the CSS grammar
+        https://bugs.webkit.org/show_bug.cgi?id=117401
</ins><span class="cx"> 
</span><del>-        Hit-testing is incorrect for plugins inside iframes when there is a 
-        topContentInset
-        https://bugs.webkit.org/show_bug.cgi?id=131826
-        -and corresponding-
-        &lt;rdar://problem/16649996&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        From Blink r149862 by &lt;serya@chromium.org&gt;.
</ins><span class="cx"> 
</span><del>-        I missed one coordinate-conversion spot when getting hit-testing to work. Like 
-        headerHeight() which also manipulates the location of the root layer, 
-        topContentInset() has to be factored into all of these conversions.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::convertFromRenderer):
</del><ins>+        Reduce the number of CALCFUNCTION rules by refactoring the closing
+        parenthesis handling code.
</ins><span class="cx"> 
</span><del>-2014-04-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        No new tests required as this is a refactoring, no new functionality
+        added.
</ins><span class="cx"> 
</span><del>-        Stub out MemoryPressureHandler::ReliefLogger on older OS X'es.
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog):
-        (WebCore::MemoryPressureHandler::ReliefLogger::platformMemoryUsage):
</del><ins>+2013-06-10  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-17  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        [CSS Regions] Rename region-overflow to region-fragment
+        https://bugs.webkit.org/show_bug.cgi?id=117397
</ins><span class="cx"> 
</span><del>-        Remove CANVAS_PATH where possible
-        https://bugs.webkit.org/show_bug.cgi?id=131788
</del><ins>+        Renamed -webkit-region-overflow to -webkit-region-fragment and 
+        webkitRegionOverflow to webkitRegionFragment according to the new working draft
+        at http://www.w3.org/TR/2013/WD-css3-regions-20130528/#the-region-fragment-property
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Alexander Pavlov.
</ins><span class="cx"> 
</span><del>-        Since Firefox and Chrome ship the same interoperable subset of Path2D soon, 
-        it is time to remove CANVAS_PATH where possible.
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::clip):
-        (WebCore::CanvasRenderingContext2D::isPointInStroke):
-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/CanvasRenderingContext2D.idl:
-        * html/canvas/DOMPath.h:
-        * html/canvas/DOMPath.idl:
-
-2014-04-17  Brendan Long  &lt;b.long@cablelabs.com&gt;
-
-        [GStreamer] Store TrackPrivateBaseGStreamer's label and language as AtomicStrings
-        https://bugs.webkit.org/show_bug.cgi?id=130404
-
-        Reviewed by Philippe Normand.
-
-        No new tests, this just makes things more efficient.
-
-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
-        (WebCore::TrackPrivateBaseGStreamer::getLanguageCode):
-        (WebCore::TrackPrivateBaseGStreamer::getTag):
-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.h:
-
-2014-04-17  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Fix Cocoa build.
-
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::ReliefLogger::platformMemoryUsage):
-
-2014-04-17  Rik Cabanier  &lt;cabanier@adobe.com&gt;
-
-        [CSS Blending] Remove the -webkit- prefix for mix-blend-mode and isolation CSS properties
-        https://bugs.webkit.org/show_bug.cgi?id=131355
-
-        Reviewed by Dean Jackson.
-
-        Removed webkit prefix from mix-blend-mode and isolation. These properties
-        never shipped and their spec is now in CR.
-
-        Covered by existing tests.
-
</del><span class="cx">         * css/CSSComputedStyleDeclaration.cpp:
</span><span class="cx">         (WebCore::ComputedStyleExtractor::propertyValue):
</span><span class="cx">         * css/CSSParser.cpp:
</span><span class="cx">         (WebCore::isValidKeywordPropertyAndValue):
</span><span class="cx">         (WebCore::isKeywordPropertyID):
</span><span class="cx">         (WebCore::CSSParser::parseValue):
</span><ins>+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator RegionFragment):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
</ins><span class="cx">         * css/CSSPropertyNames.in:
</span><ins>+        * css/CSSValueKeywords.in:
</ins><span class="cx">         * css/DeprecatedStyleBuilder.cpp:
</span><span class="cx">         (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
</span><ins>+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::applyProperty):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hasNextPage):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::overflowRectForFlowThreadPortion):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::changeRequiresLayout):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
</ins><span class="cx"> 
</span><del>-2014-04-17  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2013-06-10  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Tidy up isIsolatedInline() and highestContainingIsolateWithinRoot()
-        &lt;http://webkit.org/b/131117&gt;
</del><ins>+        Replace [ConstructorRaisesException] with [RaisesException]
+        https://bugs.webkit.org/show_bug.cgi?id=117400
</ins><span class="cx"> 
</span><del>-        Reviewed by Daniel Bates.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Based on review feedback for r166650.
</del><ins>+        Replace [ConstructorRaisesException] with [RaisesException] IDL extended
+        attribute and drop [ConstructorRaisesException]. It makes little sense
+        to have 2 extended attributes with the same meaning.
</ins><span class="cx"> 
</span><del>-        * rendering/InlineIterator.h:
-        (WebCore::isIsolatedInline):
-        - Switch argument to a reference since it is never called with a
-          nullptr.
-        (WebCore::highestContainingIsolateWithinRoot):
-        - Switch first argument to a reference since it's never a
-          nullptr.
-        - Use nullptr for pointer initialization.
-        - Switch while() loop to for() loop. Pass reference to
-          isIsolatedInline().
-        (WebCore::numberOfIsolateAncestors):
-        - Switch while() loop to for() loop. Pass reference to
-          isIsolatedInline().
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::constructBidiRunsForSegment):
-        - Rename startObj to startObject.
-        - No longer need to pass the address of startObject here.
</del><ins>+        [RaisesException] can now be used on IDL operations to indicate that the
+        method may throw exceptions or on interfaces to indicate that the
+        constructor may throw exceptions.
</ins><span class="cx"> 
</span><del>-2014-04-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        From Blink r148027 by Kentaro Hara &lt;haraken@chromium.org&gt;.
</ins><span class="cx"> 
</span><del>-        Log number of bytes reclaimed at each step of memory pressure relief.
-        &lt;https://webkit.org/b/131751&gt;
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        * Modules/encryptedmedia/MediaKeys.idl:
+        * Modules/mediastream/RTCIceCandidate.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/mediastream/RTCSessionDescription.idl:
+        * Modules/webaudio/OfflineAudioContext.idl:
+        * Modules/websockets/WebSocket.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDefinition):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/TestInterface.idl:
+        * bindings/scripts/test/TestNamedConstructor.idl:
+        * css/WebKitCSSMatrix.idl:
+        * html/HTMLOptionElement.idl:
+        * page/EventSource.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
</ins><span class="cx"> 
</span><del>-        * platform/MemoryPressureHandler.h:
-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog):
-        (WebCore::MemoryPressureHandler::ReliefLogger::platformMemoryUsage):
-        (WebCore::MemoryPressureHandler::ReliefLogger::ReliefLogger):
-        (WebCore::MemoryPressureHandler::ReliefLogger::~ReliefLogger):
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandlerCocoa::ReliefLogger::platformMemoryUsage):
-        (WebCore::MemoryPressureHandlerCocoa::ReliefLogger::platformLog):
</del><ins>+2013-06-10  Mátyás Mustoha  &lt;mmatyas@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-            Add a simple RAII helper to check memory usage before and after
-            a block of code, and then dump the delta to system log.
</del><ins>+        Web Inspector: refactor statusBarItems getter in front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=110114
</ins><span class="cx"> 
</span><del>-        (WebCore::MemoryPressureHandler::releaseMemory):
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-            Use ReliefLogger to annotate the various attempts to reduce
-            our memory footprint. This will help us understand the efficiency
-            of our current strategy.
</del><ins>+        Refactored &quot;statusBarItems&quot; methods from getters into functions and
+        moved default implementation from Panel.js to View.js.
</ins><span class="cx"> 
</span><del>-2014-04-17  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        Patch created by Andrey Lushnikov.
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] columnNumberForOffset is not patched for new multicolumn code yet.
-        https://bugs.webkit.org/show_bug.cgi?id=131740
</del><ins>+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView.prototype.statusBarItems):
+        * inspector/front-end/ApplicationCacheItemsView.js:
+        (WebInspector.ApplicationCacheItemsView.prototype.statusBarItems):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype.statusBarItems):
+        * inspector/front-end/CPUProfileView.js:
+        (WebInspector.CPUProfileView.prototype.statusBarItems):
+        * inspector/front-end/CSSSelectorProfileView.js:
+        (WebInspector.CSSSelectorProfileView.prototype.statusBarItems):
+        * inspector/front-end/CanvasProfileView.js:
+        (WebInspector.CanvasProfileView.prototype.statusBarItems):
+        (WebInspector.CanvasProfileType.prototype.statusBarItems):
+        * inspector/front-end/ConsolePanel.js:
+        (WebInspector.ConsolePanel.prototype.statusBarItems):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.statusBarItems):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.statusBarItems):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.statusBarItems):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype.statusBarItems):
+        * inspector/front-end/Drawer.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.statusBarItems):
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionPanel.prototype.statusBarItems):
+        * inspector/front-end/FileSystemView.js:
+        (WebInspector.FileSystemView.prototype.statusBarItems):
+        * inspector/front-end/HeapSnapshotView.js:
+        * inspector/front-end/IndexedDBViews.js:
+        (WebInspector.IDBDataView.prototype.statusBarItems):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype.statusBarItems):
+        (WebInspector.NetworkPanel.prototype.statusBarItems):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.wasShown):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.statusBarItems):
+        (WebInspector.ProfilesPanel.prototype._updateProfileTypeSpecificUI):
+        (WebInspector.ProfilesPanel.prototype._showProfile):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.statusBarItems):
+        (WebInspector.ResourcesPanel.prototype._innerShowView):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.statusBarItems):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.statusBarItems):
+        * inspector/front-end/View.js:
+        (WebInspector.View.prototype.statusBarItems):
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
-        
-        I took the opportunity to clean this code up while adding support for the new columns.
-        columnNumberForOffset only applied for paginated RenderViews and was really about
-        pages and not columns. It also only returns an actual page number if the columns are
-        block progressed (e.g., right-to-left vertical Japanese books).
-        
-        Therefore I renamed columnNumberForOffset to pageNumberForBlockProgressionOffset and
-        moved it to RenderView.
-        
-        I also renamed the member variable of SelectionRect to be pageNumber instead of
-        columnNumber in order to make it more obvious that this isn't about columns per se
-        (since the fact that we implemented RenderView's pagination mode using columns is an
-        implementation detail).
</del><ins>+2013-06-10  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Range.cpp:
-        (WebCore::coalesceSelectionRects):
-        (WebCore::Range::collectSelectionRects):
-        * platform/ios/SelectionRect.h:
-        (WebCore::SelectionRect::pageNumber):
-        (WebCore::SelectionRect::columnNumber): Deleted.
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::collectSelectionRects):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::collectSelectionRects):
-        (WebCore::RenderObject::columnNumberForOffset): Deleted.
-        * rendering/RenderObject.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::collectSelectionRects):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::pageNumberForBlockProgressionOffset):
-        * rendering/RenderView.h:
</del><ins>+        Add special tree walking for the single tag or class CSS query selectors
+        https://bugs.webkit.org/show_bug.cgi?id=117388
</ins><span class="cx"> 
</span><del>-2014-04-16  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        [Win] A few final cleanups to the DataObject classes.
-        https://bugs.webkit.org/show_bug.cgi?id=131784
</del><ins>+        Queries for a single tag name or a single class name are the most common
+        input of querySelector.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        This patch adds a simplified tree walking in those cases, only checking that particular
+        case instead of a full selector.
</ins><span class="cx"> 
</span><del>-        * platform/win/WCDataObject.cpp:
-        (WebCore::WCDataObject::clearData): Use 'last()' method.
</del><ins>+        With the change, the balanced query selector benchmarks become 11% faster.
</ins><span class="cx"> 
</span><del>-2014-04-15  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        * css/SelectorCheckerFastPath.cpp:
+        (WebCore::HTMLNames::checkClassValue):
+        * dom/SelectorQuery.cpp:
+        (WebCore::isSingleTagNameSelector):
+        (WebCore::SelectorDataList::executeSingleTagNameSelectorData):
+        (WebCore::isSingleClassNameSelector):
+        (WebCore::SelectorDataList::executeSingleClassNameSelectorData):
+        (WebCore::SelectorDataList::execute):
+        * dom/SelectorQuery.h:
</ins><span class="cx"> 
</span><del>-        Fullscreen media controls are unusable in pagination mode
-        https://bugs.webkit.org/show_bug.cgi?id=131705
</del><ins>+2013-06-09  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><ins>+        Layout info should never be cleared before delayed scroll information updates.
+        https://bugs.webkit.org/show_bug.cgi?id=116689.
+
</ins><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        When pagination mode is enabled, the full screen media will (depending on the width of the
-        pagination columns) overflow its column, and hit testing will be clipped to the column. In extreme
-        cases, where the column width &lt; 0.5 * media element width, the media controls will be entirely
-        unclickable.
</del><ins>+        Test: fast/flexbox/clear-overflow-before-scroll-update.html
</ins><span class="cx"> 
</span><del>-        Rather than making the RenderFullScreen a child of the full screen element's parent's renderer,
-        make it a child of the RenderView, putting it outside of the columns entirely. Always create and
-        insert the fullscreenRenderer's placeholder, using it as the remembered insertion point for the
-        fullscreen element's renderer when we exit full screen.
</del><ins>+        Make sure that clearLayoutOverflow only gets called after layer()-&gt;updateScrollInfoAfterLayout().
+        Also move clearLayoutOverflow to RenderBlock so we can keep all the delayed scroll update logic in RenderBlock.
</ins><span class="cx"> 
</span><del>-        Drive-by fix: don't wrap the full screen element's renderer in webkitWillEnterFullScreenForElement();
-        it will just be re-wrapped in createRendererIfNeeded().
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo): Call clearLayoutOverflow here.
+        (WebCore::RenderBlock::layout): Only call clearLayoutOverflow here if scrolling isn't being delayed.
+        (WebCore::RenderBlock::clearLayoutOverflow): Remove clearLayoutOverflow, move into RenderBlock to keep delayed scrolling logic in the same file.
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderDeprecatedFlexibleBox.cpp: Should call updateScrollInfoAfterLayout, not layer()-&gt;updateScrollInfoAfterLayout(), so that it takes delayed scrolling logic into account.
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderGrid.cpp: Ditto
+        (WebCore::RenderGrid::layoutBlock):
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::webkitWillEnterFullScreenForElement): Don't wrap the full screen element's renderer.
-        (WebCore::Document::setFullScreenRenderer): Call setPlaceholderStyle.
-        * rendering/RenderFullScreen.cpp:
-        (WebCore::RenderFullScreenPlaceholder::willBeDestroyed): Call clearPlaceholder.
-        (WebCore::RenderFullScreen::wrapRenderer): Make fullscreenRenderer a child of the view().
-        (WebCore::RenderFullScreen::unwrapRenderer): Return the children to the parent of the placeholder().
-        (WebCore::RenderFullScreen::clearPlaceholder): Renamed from setPlaceholder().
-        (WebCore::RenderFullScreen::ensurePlaceholder): Added. 
-        (WebCore::RenderFullScreen::setPlaceholderStyle): Renamed from createPlaceholder().
-        (WebCore::RenderFullScreen::setPlaceholder): Deleted.
-        (WebCore::RenderFullScreen::createPlaceholder): Deleted.
-        * rendering/RenderFullScreen.h:
</del><ins>+2013-06-09  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Split the 3 paths of SelectorDataList::execute() into 3 separate functions
+        https://bugs.webkit.org/show_bug.cgi?id=117378
</ins><span class="cx"> 
</span><del>-        [MSE] Multiple initialization segments with same codecs in tracks fail validation.
-        https://bugs.webkit.org/show_bug.cgi?id=131768
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Additional initialization segments added to the same SourceBuffer with the same
-        codec values will fail validation. Update the validation check to add the correct
-        codec information for the initial segment, and check against the correct codecs during
-        the validation step.
</del><ins>+        Split those to have several small execute() fucntions instead of a giant one.
</ins><span class="cx"> 
</span><del>-        Additionally, after validation, if successful update the Audio, Video, and TextTracks
-        for the SourceBuffer with the updated initialization segment information.
</del><ins>+        * dom/SelectorQuery.cpp:
+        (WebCore::selectorForIdLookup):
+        (WebCore::isTreeScopeRoot):
+        (WebCore::SelectorDataList::executeFastPathForIdSelector):
+        (WebCore::SelectorDataList::executeSingleSelectorData):
+        (WebCore::SelectorDataList::executeSingleMultiSelectorData):
+        (WebCore::SelectorDataList::execute):
+        * dom/SelectorQuery.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-06-09  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: media/media-source/media-source-multiple-initialization-segments.html
</del><ins>+        Scrolling with platformWidget and delegateScrolling is incorrectly clamped
+        https://bugs.webkit.org/show_bug.cgi?id=117369
+        &lt;rdar://problem/13985064&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::appendBufferTimerFired): m_source may have been cleared
-            as a result of the append, so check it before using.
-        (WebCore::SourceBuffer::sourceBufferPrivateDidEndStream): Call streamEndedWithError
-            instead of endOfStream as the latter is safe to call within an update.
-        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment): Ditto.
-            Update the track lists if validation succeeds.
-        (WebCore::SourceBuffer::validateInitializationSegment): Switch the audio and video
-            codec checks.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Add the ability for Audio, Video, and InbandTextTracks to replace their private tracks:
-        * html/track/AudioTrack.cpp:
-        (WebCore::AudioTrack::AudioTrack): Call updateKindFromPrivate().
-        (WebCore::AudioTrack::setPrivate):
-        (WebCore::AudioTrack::updateKindFromPrivate): Split out from constructor.
-        * html/track/AudioTrack.h:
-        * html/track/InbandTextTrack.cpp:
-        (WebCore::InbandTextTrack::InbandTextTrack): Call updateKindFromPrivate().
-        (WebCore::InbandTextTrack::setPrivate):
-        (WebCore::InbandTextTrack::setMode): Split up into setModeInternal().
-        (WebCore::InbandTextTrack::setModeInternal): Broke out from setMode().
-        (WebCore::InbandTextTrack::updateKindFromPrivate): Split out from constructor.
-        * html/track/InbandTextTrack.h:
-        * html/track/TextTrack.h:
-        (WebCore::TextTrack::isInband): Added, returns false.
-        * html/track/VideoTrack.cpp:
-        (WebCore::VideoTrack::VideoTrack): Call updateKindFromPrivate().
-        (WebCore::VideoTrack::setPrivate):
-        (WebCore::VideoTrack::updateKindFromPrivate):  Split out from constructor.
-        * html/track/VideoTrack.h:
</del><ins>+        The patch http://trac.webkit.org/changeset/142526 clamps the input position
+        in the ScrollView scroll range. This was done for the path to the ScrollingCoordinator.
</ins><span class="cx"> 
</span><del>-2014-04-17  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        The problem with that change is ScrollView::setScrollPosition() can delegate the scrolling
+        to either a platformWidget, or through delegateScrolling. After r142526, the position is clamped,
+        and we do not let those external scrolling mechanims handle the out-of-bound scrolling.
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Column sets below spanners don't repaint properly.
-        https://bugs.webkit.org/show_bug.cgi?id=131778
</del><ins>+        This patch fixes the issue by moving the threaded scrolling call to ScrollView,
+        after the delegate handling code.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::setScrollPosition):
+        (WebCore::FrameView::requestScrollPositionUpdate):
</ins><span class="cx"> 
</span><del>-        Added fast/repaint/spanner-with-margins.html.
</del><ins>+2013-06-08  Igor Oliveira  &lt;igor.o@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeRectForRepaint):
-        Turn off some code that was running for in-flow RenderFlowThreads that made no sense.
-        I'm not convinced the code is right for other types of RenderFlowThreads either,
-        but will leave that to the named flow thread experts. :)
</del><ins>+        before/after generated content is not working with HTMLSummaryElement and HTMLDetailsElement.
+        https://bugs.webkit.org/show_bug.cgi?id=117374
</ins><span class="cx"> 
</span><del>-2014-04-17  Koji Ishii  &lt;kojishi@gmail.com&gt;
</del><ins>+        Allow before/after pseudo generated content be added in HTMLDetailsElement and HTMLSumamaryElement.
</ins><span class="cx"> 
</span><del>-        Catch up ruby and its tag omission rule changes in HTML5 CR Feb 2014
-        https://bugs.webkit.org/show_bug.cgi?id=131175
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Test: fast/css-generated-content/details-summary-before-after.html
</ins><span class="cx"> 
</span><del>-        Tests: html5lib/resources/ruby.dat
-               html5lib/resources/tests19.dat
</del><ins>+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::childShouldCreateRenderer):
</ins><span class="cx"> 
</span><del>-        This patch makes WebKit HTML parser to match to the tag omission rules of HTML5 CR Feb 2014:
-        http://www.w3.org/TR/2014/CR-html5-20140204/syntax.html#syntax-tag-omission
-        with the support for two new elements (rb, rtc) which were also defined in the spec:
-        http://www.w3.org/TR/2014/CR-html5-20140204/text-level-semantics.html#the-rb-element
-        http://www.w3.org/TR/2014/CR-html5-20140204/text-level-semantics.html#the-rtc-element
-        to better support use cases presented by W3C I18N WG:
-        http://www.w3.org/TR/ruby-use-cases/
</del><ins>+2013-06-08  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLTagNames.in: rb and rtc added as HTMLElement interfaces.
-        * html/parser/HTMLConstructionSite.cpp:
-        (WebCore::hasImpliedEndTag): the spec says rb and rtc have implied end tags.
-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::HTMLTreeBuilder::processStartTagForInBody): rb and rtc added. rt excludes rtc from its implied end tags.
</del><ins>+        [curl] Allow headers with empty value
+        https://bugs.webkit.org/show_bug.cgi?id=117344
</ins><span class="cx"> 
</span><del>-2014-04-17  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Try to fix EFL and GTK builds.
</del><ins>+        No new tests, already covered by:
+        http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+        http/tests/xmlhttprequest/post-blob-content-type-sync.html
</ins><span class="cx"> 
</span><del>-        * workers/WorkerGlobalScope.idl: Touch file to make it rebuild, assuming that
-        module dependencies aren't working right with CMake. Tweaked formatting quite a
-        bit while I was in here.
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
</ins><span class="cx"> 
</span><del>-2014-04-17  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+2013-06-08  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] REGRESSION: Column set styles don't update when zooming etc.
-        https://bugs.webkit.org/show_bug.cgi?id=131777
</del><ins>+        [curl] Handling of blob elements is incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=117301
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+        Reviewed by Kenneth Rohde Christiansen.
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/zoom-test.html
</del><ins>+        No new tests, covered by existing ones:
+        http/tests/fileapi/xhr-send-form-data-filename-escaping.html
+        http/tests/fileapi/xhr-send-form-data-mimetype-normalization.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::styleDidChange):
-        Put back in the code that propagates new styles to the flow thread and column sets
-        when styles change. This propagation was removed when the column span code landed.
-        This patch puts it back in but qualifies the types of objects that get styles
-        propagated to avoid accidentally propagating the wrong style to column spans.
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::getFormElementsCount): Resolve Blob elements.
</ins><span class="cx"> 
</span><del>-2014-04-17  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2013-06-07  Alexandru Chiculita  &lt;achicu@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Add separate flag for IndexedDatabase in workers since the current implementation is not threadsafe
-        https://bugs.webkit.org/show_bug.cgi?id=131785
-        rdar://problem/16003108
</del><ins>+        [CSS Regions] Layers inside the RenderFlowThread should be collected by the layer of RenderView
+        https://bugs.webkit.org/show_bug.cgi?id=117270
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig: Added INDEXED_DATABASE_IN_WORKERS.
</del><ins>+        RenderNamedFlowThreads are attached to the RenderView, but they are painted 
+        and hit-tested through their regions. The easiest way to prevent the RenderView 
+        from seeing the RenderNamedFlowThreads as its own children was to avoid collecting
+        the layers of the RenderNamedFlowThreads as children layers of the RenderView.
</ins><span class="cx"> 
</span><del>-        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp: Use the new conditional
-        instead of the old one.
-        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h: Ditto.
-        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.idl: Ditto.
</del><ins>+        However, most of the code is analyzing the layers tree starting from the root,
+        so having the RenderNamedFlowThread participate in the layer tree is needed
+        in order to enable compositing for layers inside the flow thread.
</ins><span class="cx"> 
</span><del>-2014-04-17  Dan Bernstein  &lt;mitz@apple.com&gt;
</del><ins>+        This patch makes the RenderNamedFlowThread visible to the RenderView, but
+        ignores it when iterates the children of the RenderView in paint and hit-test methods.
</ins><span class="cx"> 
</span><del>-        WebCore part of &lt;rdar://problem/16601336&gt; [Cocoa] _userInitiated is always NO in WKNavigationAction passed to -webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:
-        https://bugs.webkit.org/show_bug.cgi?id=131783
</del><ins>+        No new tests, no visible changes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
-
-        * loader/NavigationAction.cpp:
-        (WebCore::NavigationAction::NavigationAction): Initialize m_processingUserGesture to
-        ScriptController::processingUserGesture() at the time the NavigationAction is constructed.
-        * loader/NavigationAction.h:
-        Added boolean member variable m_processionUserGesture
-        (WebCore::NavigationAction::processingUserGesture): Added this getter.
-
-2014-04-17  Ion Rosca  &lt;rosca@adobe.com&gt;
-
-        [CSS Blending] Isolation descendant dependent flags are not updated correctly
-        https://bugs.webkit.org/show_bug.cgi?id=130892
-
-        Reviewed by Dean Jackson.
-
-        The isolation descendant dependent flag (m_hasUnisolatedBlendingDescendants)
-        will help us to determine if a layer should isolate blending descendants or not.
-        The m_hasUnisolatedBlendingDescendants flag should be set for layers that have blending descendant layers
-        not isolated by descendant stacking contexts.
-        An element isolatesBlending() if it has this flag set and creates stacking context.
-
-        Tests: css3/compositing/blend-mode-isolation-flags-append-non-stacking-context-blending.html
-               css3/compositing/blend-mode-isolation-flags-append-stacking-context-blending.html
-               css3/compositing/blend-mode-isolation-flags-remove-non-stacking-context-blending.html
-               css3/compositing/blend-mode-isolation-flags-remove-stacking-context-blending.html
-               css3/compositing/blend-mode-isolation-flags-turn-off-blending-no-isolation.html
-               css3/compositing/blend-mode-isolation-flags-turn-off-blending.html
-               css3/compositing/blend-mode-isolation-flags-turn-off-stacking-context.html
-               css3/compositing/blend-mode-isolation-flags-turn-on-blending.html
-               css3/compositing/blend-mode-isolation-flags-turn-on-stacking-context.html
-
</del><span class="cx">         * rendering/RenderLayer.cpp:
</span><del>-        (WebCore::RenderLayer::RenderLayer):
-        (WebCore::RenderLayer::updateBlendMode):
-        (WebCore::RenderLayer::updateAncestorChainHasBlendingDescendants):
-            When a layer has blending and it hasn't had it before, we set the isolation
-        flag for all its ancestors up to the first layer creating stacking context.
-        I removed the isComposited() check here. Isolation flags should be correct regardless
-        of compositing state. Moreover, if this method is called from styleChanged(),
-        the compositing state might not be accurate, it's going to be recalculated afterwards.  
-        (WebCore::RenderLayer::dirtyAncestorChainHasBlendingDescendants):
-            When a layer doesn't have blending, but it used to have it before, we mark
-        the isolation flag as dirty for all its ancestors up to the first layer
-        creating stacking context. The isolation flags will be recalculated by
-        RenderLayer::updateDescendantDependentFlags.
-        (WebCore::RenderLayer::updateDescendantDependentFlags):
-            Evaluates if the layer has unisolated blending descendants by traversing
-        the layer subtree.
-        (WebCore::RenderLayer::addChild):
-            When adding a subtree that has blending or has some unisolated descendants,
-        we set the flag for all the ancestors, up to the stacking context layer.
-        (WebCore::RenderLayer::removeChild):
-            When removing a subtree that had blending or had some unisolated descendants,
-        we dirty the flag so that it could be reevaluated.
-        (WebCore::RenderLayer::calculateClipRects):
-        (WebCore::RenderLayer::updateTransform):
-        * rendering/RenderLayer.h:
-            Rename m_hasBlendedElementInChildStackingContext =&gt; m_hasUnisolatedBlendingDescendants
-        and m_hasBlendedElementInChildStackingContextStatusDirty =&gt; m_hasUnisolatedBlendingDescendantsStatusDirty,
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-            Add an assert to make sure that if m_hasUnisolatedCompositedBlendingDescendants is true,
-        then m_hasUnisolatedBlendingDescendants is true as well.
</del><ins>+        (WebCore::RenderLayer::paintList):
+        (WebCore::RenderLayer::hitTestList):
+        (WebCore::RenderLayer::calculateLayerBounds):
+        (WebCore::RenderLayer::collectLayers):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeLayers):
</ins><span class="cx"> 
</span><del>-2014-04-17  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+2013-06-07  Bear Travis  &lt;betravis@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Uninline blend(Color, Color) to get AnimationUtilities out of Color.h
-        https://bugs.webkit.org/show_bug.cgi?id=131781
</del><ins>+        [CSS Exclusions][CSS Shapes] Incorrect compile flag in LayoutState.h
+        https://bugs.webkit.org/show_bug.cgi?id=117318
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Color.cpp:
-        (WebCore::blend):
-        Un-inline.
</del><ins>+        m_exclusionShapeInsideInfo should be guarded by the CSS_SHAPES flag,
+        not the CSS_EXCLUSIONS flag.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Color.h:
-        No more AnimationUtilities.
</del><ins>+        No tests required.
</ins><span class="cx"> 
</span><del>-2014-04-16  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        * rendering/LayoutState.h:
</ins><span class="cx"> 
</span><del>-        Fix the build after r167412
</del><ins>+2013-06-07  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
</del><ins>+        Get rid of outdated raises() from Web IDL
+        https://bugs.webkit.org/show_bug.cgi?id=117350
</ins><span class="cx"> 
</span><del>-2014-04-16  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Fix annoying scrolling bugs
-        https://bugs.webkit.org/show_bug.cgi?id=131722
</del><ins>+        Stop using &quot;raises()&quot; in the IDL as this is no longer part of the Web IDL
+        specification. Web IDL no longer specifies exceptions for operations. Instead
+        it is now explained in prose.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        WebKit still needs to know if the method can throw an exception (but does not
+        need the exception name) so this patch adds a WebKit specific IDL extended
+        attribute: [RaisesException]. The naming is consistent with Blink.
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        Since ScrollingStateScrollingNode::setRequestedScrollPosition() was added, we see ScrollView::updateScrollbars()
-        keep changing the scroll position to incorrect values.
</del><ins>+        This results in more standard and concise IDL. This also simplifies a lot
+        the code of the IDL parser.
</ins><span class="cx"> 
</span><del>-        On iOS, the scrollbars are handled by the native UI, the code just compute incorrect scroll position. On WebKit1,
-        the code does not run because there is a platformWidget().
-
-        Just #ifdef the whole useless code.
-
-2014-04-16  Alexandru Chiculita  &lt;achicu@adobe.com&gt;
-
-        Improve performance of the RenderLayerCompositor::OverlapMap
-        https://bugs.webkit.org/show_bug.cgi?id=115063
-
-        Reviewed by Simon Fraser.
-
-        No new tests, no new functionality or behavior.
-
-        Do not use the OverlapMap in RenderLayerCompositor::computeCompositingRequirements if the layer already
-        has a 3D transform. This way we can avoid a potential expensive lookups when we know for sure the layer
-        is already supposed to be composited. 
-
-        Also, added a bounding box of the overlap map, so that it can catch cases when the new layer is not overlapping
-        any of the previous layers. This is pretty common when having composited layers laid out in a vertical/horizontal list.
-
-
-        * rendering/RenderLayerCompositor.cpp:
-        (OverlapMapContainer):
-        (WebCore::OverlapMapContainer::add):
-        (WebCore::OverlapMapContainer::overlapsLayers):
-        (WebCore::OverlapMapContainer::unite):
-        (WebCore):
-        (WebCore::RenderLayerCompositor::OverlapMap::add):
-        (WebCore::RenderLayerCompositor::OverlapMap::overlapsLayers):
-        (WebCore::RenderLayerCompositor::OverlapMap::pushCompositingContainer):
-        (WebCore::RenderLayerCompositor::OverlapMap::popCompositingContainer):
-        (RenderLayerCompositor::OverlapMap):
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-
-2014-04-16  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
-
-        Web Replay: memoize fallback time values for document.lastModified
-        https://bugs.webkit.org/show_bug.cgi?id=131318
-
-        Reviewed by Joseph Pecoraro.
-
-        If a document's Last-Modified header can't be found or used, then 
-        document.lastModified is derived from the current system time or
-        from filesystem data, which is obviously nondeterministic.
-
-        It's better to handle this inside Document::lastModified rather than using
-        MemoizedDOMResult, because only the fallback case is nondeterministic.
-
-        Test: http/tests/inspector/replay/document-last-modified-fallback-value.html
-
-        The test is skipped for now, as it will be very flaky without the
-        functionality introduced by bugs 130728 and 129391.
-
-        * dom/Document.cpp:
-        (WebCore::Document::lastModified): Save or reuse memoized fallback value.
-        * replay/WebInputs.json: Add input DocumentLastModifiedDate.
-
-2014-04-16  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        [New Multicolumn] Selection gets confused when the mouse is in the column gaps.
-        https://bugs.webkit.org/show_bug.cgi?id=131739
-
-        Reviewed by Enrica Casucci.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::selectionGaps):
-        Make sure not to paint selection gaps. This matches the old multi-column behavior. Even though
-        selection gaps *nearly* work with the new multi-column code, I am disabling them so that we
-        can turn them on without visual regressions.
-        
-        (WebCore::isChildHitTestCandidate):
-        Don't allow in-flow RenderFlowThreads to be descended into from positionForPoint. We always want
-        to look only at the spanners and at the sets.
-
-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::nodeAtPoint):
-        * rendering/RenderMultiColumnFlowThread.h:
-        Override nodeAtPoint to disallow the RenderMultiColumnFlowThread from being considered for hit
-        testing when no DOM node is found. It's better to just let RenderBlock's positionForPoint run
-        to drill back down into the appropriate column set.
-
-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::positionForPoint):
-        Implement positionForPoint for RenderMultiColumnSets. This is a straight-up port of the
-        old multi-column code's adjustPointToColumnContents function.
-
-        * rendering/RenderMultiColumnSet.h:
-        Add override of positionForPoint.
-
-2014-04-16  Dean Jackson  &lt;dino@apple.com&gt;
-
-        MediaDocument on iOS should be full page
-        https://bugs.webkit.org/show_bug.cgi?id=131774
-
-        Reviewed by Jer Noble.
-
-        A MediaDocument on iOS has two problems. It can't rely
-        on intrinsic size, since it doesn't load the content until
-        a user gesture. Secondly, on a small screen you want the
-        media to fill the page.
-
-        Add width/height 100% for iOS documents.
-
-        Test: platform/iphone-simulator/media/media-document-controls-size.html
-
-        * html/MediaDocument.cpp:
-        (WebCore::MediaDocumentParser::createDocumentStructure):
-
-2014-04-16  Roger Fong  &lt;roger_fong@apple.com&gt;
-
-        Add a way for layout tests to determine whether or not a plugin is snapshotted.
-        https://bugs.webkit.org/show_bug.cgi?id=131650.
-        &lt;rdar://problem/16615528&gt;
-
-        Reviewed by Dean Jackson.
-
-        * testing/Internals.cpp:
-        (WebCore::Internals::isPluginSnapshotted):
-        * testing/Internals.h:
-        * testing/Internals.idl:
-
-2014-04-16  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
-
-        Vanish unnecessary includes from Shapes.{h|cpp}
-        https://bugs.webkit.org/show_bug.cgi?id=131762
-
-        Reviewed by Andreas Kling.
-
</del><span class="cx">         No new tests, no behavior change.
</span><span class="cx"> 
</span><del>-        * rendering/shapes/BoxShape.h:
-        * rendering/shapes/Shape.cpp:
-        * rendering/shapes/Shape.h:
-        * rendering/shapes/ShapeOutsideInfo.h:
-
-2014-04-16  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Revert direct caching of tagName and nodeName from r167383.
-
-        Ryosuke tells me this is not entirely safe, will need to rethink.
-
-        * dom/Element.idl:
-        * dom/Node.idl:
-
-2014-04-16  Peter Molnar  &lt;pmolnar.u-szeged@partner.samsung.com&gt;
-
-        Improve security mitigation added in webkit r94001.
-        We missed the case where attachLine was called when we already had an inline box wrapper.
-        https://bugs.webkit.org/show_bug.cgi?id=127285
-
-        Reviewed by Brent Fulgham.
-
-        Merged from Blink: https://src.chromium.org/viewvc/blink?revision=150697&amp;view=revision
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::positionLineBox):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::setInlineBoxWrapper):
-
-2014-04-16  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        Fix CodeGenerator.pm to only write files if the generated content has changed
-        https://bugs.webkit.org/show_bug.cgi?id=131756
-
-        Reviewed by Sam Weinig.
-
-        To improve build speed, don't touch generated files unless the newly
-        generated content is actually different.
-
-        * bindings/scripts/CodeGenerator.pm:
-        (UpdateFile):
-
-2014-04-16  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Add a way to cache never-changing IDL attributes in the wrapper.
-        &lt;https://webkit.org/b/131759&gt;
-
-        Some IDL attributes will always return the same value when queried
-        on an object, so let's have a way to avoid calling into C++ code
-        every time they are queried.
-
-        This patch adds a custom IDL thingy called &quot;ReturnsCacheableValue&quot;
-        which causes the code generator to emit code to cache the returned
-        value directly in the JS wrapper object.
-
-        Reviewed by Oliver Hunt.
-
-        * bindings/scripts/IDLAttributes.txt:
</del><ins>+        * Modules/battery/BatteryManager.idl:
+        * Modules/encryptedmedia/MediaKeySession.idl:
+        * Modules/encryptedmedia/MediaKeys.idl:
+        * Modules/filesystem/DirectoryEntrySync.idl:
+        * Modules/filesystem/DirectoryReaderSync.idl:
+        * Modules/filesystem/EntrySync.idl:
+        * Modules/filesystem/FileEntrySync.idl:
+        * Modules/filesystem/FileWriter.idl:
+        * Modules/filesystem/FileWriterSync.idl:
+        * Modules/filesystem/WorkerContextFileSystem.idl:
+        * Modules/indexeddb/IDBCursor.idl:
+        * Modules/indexeddb/IDBDatabase.idl:
+        * Modules/indexeddb/IDBFactory.idl:
+        * Modules/indexeddb/IDBIndex.idl:
+        * Modules/indexeddb/IDBKeyRange.idl:
+        * Modules/indexeddb/IDBObjectStore.idl:
+        * Modules/indexeddb/IDBRequest.idl:
+        * Modules/indexeddb/IDBTransaction.idl:
+        * Modules/mediasource/MediaSource.idl:
+        * Modules/mediasource/SourceBuffer.idl:
+        * Modules/mediasource/SourceBufferList.idl:
+        * Modules/mediastream/MediaStream.idl:
+        * Modules/mediastream/MediaStreamTrack.idl:
+        * Modules/mediastream/NavigatorMediaStream.idl:
+        * Modules/mediastream/RTCDTMFSender.idl:
+        * Modules/mediastream/RTCDataChannel.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/navigatorcontentutils/NavigatorContentUtils.idl:
+        * Modules/networkinfo/NetworkInfoConnection.idl:
+        * Modules/notifications/Notification.idl:
+        * Modules/notifications/NotificationCenter.idl:
+        * Modules/speech/SpeechRecognition.idl:
+        * Modules/vibration/NavigatorVibration.idl:
+        * Modules/webaudio/AudioBuffer.idl:
+        * Modules/webaudio/AudioContext.idl:
+        * Modules/webaudio/AudioNode.idl:
+        * Modules/webdatabase/DOMWindowWebDatabase.idl:
+        * Modules/webdatabase/DatabaseSync.idl:
+        * Modules/webdatabase/WorkerContextWebDatabase.idl:
+        * Modules/websockets/WebSocket.idl:
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GenerateFunction):
+        (GenerateFunctions):
</ins><span class="cx">         * bindings/scripts/CodeGeneratorJS.pm:
</span><span class="cx">         (GenerateImplementation):
</span><del>-
-            Add ReturnsCacheableValue custom attribute.
-
</del><ins>+        (GenerateParametersCheck):
+        (GenerateImplementationFunctionCall):
+        (GenerateConstructorDefinition):
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/IDLParser.pm:
+        (parseOperationRest):
+        * bindings/scripts/test/TestEventTarget.idl:
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/TestSupplemental.idl:
+        * bindings/scripts/test/TestTypedefs.idl:
+        * css/CSSHostRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSSupportsRule.idl:
+        * css/FontLoader.idl:
+        * css/MediaList.idl:
+        * css/WebKitCSSMatrix.idl:
+        * dom/CharacterData.idl:
+        * dom/DOMImplementation.idl:
+        * dom/DataTransferItemList.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/DocumentType.idl:
</ins><span class="cx">         * dom/Element.idl:
</span><ins>+        * dom/EventTarget.idl:
+        * dom/MessagePort.idl:
+        * dom/MutationObserver.idl:
+        * dom/NamedNodeMap.idl:
</ins><span class="cx">         * dom/Node.idl:
</span><ins>+        * dom/NodeIterator.idl:
+        * dom/Range.idl:
+        * dom/ShadowRoot.idl:
+        * dom/Text.idl:
+        * dom/WebKitNamedFlow.idl:
+        * fileapi/FileReader.idl:
+        * fileapi/FileReaderSync.idl:
+        * html/DOMTokenList.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLDialogElement.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/HTMLVideoElement.idl:
+        * html/MediaController.idl:
+        * html/TimeRanges.idl:
+        * html/canvas/CanvasGradient.idl:
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/DOMPath.idl:
+        * html/canvas/DataView.idl:
+        * html/canvas/OESVertexArrayObject.idl:
+        * html/canvas/WebGLDebugShaders.idl:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/track/AudioTrackList.idl:
+        * html/track/TextTrack.idl:
+        * html/track/TextTrackCue.idl:
+        * html/track/TextTrackList.idl:
+        * html/track/VideoTrackList.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/Crypto.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/EventSource.idl:
+        * page/History.idl:
+        * page/Performance.idl:
+        * storage/Storage.idl:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimationElement.idl:
+        * svg/SVGColor.idl:
+        * svg/SVGDocument.idl:
+        * svg/SVGLength.idl:
+        * svg/SVGLengthList.idl:
+        * svg/SVGLocatable.idl:
+        * svg/SVGMatrix.idl:
+        * svg/SVGNumberList.idl:
+        * svg/SVGPaint.idl:
+        * svg/SVGPathSegList.idl:
+        * svg/SVGPointList.idl:
+        * svg/SVGStringList.idl:
+        * svg/SVGTextContentElement.idl:
+        * svg/SVGTransformList.idl:
+        * testing/InternalSettings.idl:
+        * testing/Internals.idl:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/Worker.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestUpload.idl:
+        * xml/XMLSerializer.idl:
+        * xml/XPathEvaluator.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathResult.idl:
</ins><span class="cx"> 
</span><del>-            Annotate some attributes that return fully cacheable values.
</del><ins>+2013-06-07  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/test/*:
</del><ins>+        REGRESSION (r151088): Crash navigating away from non-loaded main resources with non-loaded scripts.
+        &lt;rdar://problem/14052886&gt; and https://bugs.webkit.org/show_bug.cgi?id=117278
</ins><span class="cx"> 
</span><del>-            Rebaseline.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-04-16  Noel Gordon  &lt;noel.gordon@gmail.com&gt;
</del><ins>+        Test: http/tests/navigation/slow-loading-page-with-slow-script.php
</ins><span class="cx"> 
</span><del>-        Progressive JPEG outputScanlines() calls should handle failure
-        https://bugs.webkit.org/show_bug.cgi?id=116701
</del><ins>+        * html/parser/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::isPendingScriptReady): The script runner might be told about a script
+          after it has already been detached (the main resource load has finished/failed/cancelled).
+          Don't dereference a null document in that case.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+2013-06-07  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        outputScanlines() can fail and delete |this|. Copy the decoder pointer
-        member and use that copy to detect and handle the failure case.
</del><ins>+        Compile WebCoreTestShimLibrary.cpp on iOS, but exclude the Carbon bits
+        https://bugs.webkit.org/show_bug.cgi?id=117360
</ins><span class="cx"> 
</span><del>-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::JPEGImageReader::decode):
</del><ins>+        Reviewed by Mark Rowe.
</ins><span class="cx"> 
</span><del>-2014-04-16  Robert Sipka  &lt;sipka@inf.u-szeged.hu&gt;
</del><ins>+        In r150114 we tried to make the WebCoreTestShim target build on iOS by
+        excluding its only source file from the build. While this allowed the
+        target to build, it prevented the target's product (WebCoreTestShim.dylib)
+        from being created. This causes xcodebuild to fail if you ask it to
+        install the target.
</ins><span class="cx"> 
</span><del>-        [curl] Add WEB_TIMING support
-        https://bugs.webkit.org/show_bug.cgi?id=127555
</del><ins>+        Fix this by building the target's product on iOS. Just use the
+        preprocessor to exclude the bits that won't build on iOS.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        * Configurations/WebCoreTestShim.xcconfig:
+        * testing/WebCoreTestShimLibrary.cpp:
</ins><span class="cx"> 
</span><del>-        Access timing information related to navigation.
</del><ins>+2013-06-07  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::milisecondsSinceRequest):
-        (WebCore::calculateWebTimingInformations):
-        (WebCore::sockoptfunction):
-        (WebCore::headerCallback):
-        (WebCore::ResourceHandleManager::downloadTimerCallback):
-        (WebCore::ResourceHandleManager::dispatchSynchronousJob):
-        (WebCore::ResourceHandleManager::initializeHandle):
</del><ins>+        REGRESSION: Lines jump up and down while typing Chinese or Japanese
+        https://bugs.webkit.org/show_bug.cgi?id=115931
</ins><span class="cx"> 
</span><del>-2014-04-16  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Cleanup header includes in ShapeOutsideInfo.h
-        https://bugs.webkit.org/show_bug.cgi?id=131750
</del><ins>+        The bug was caused by Font::width caching the width of text even when the font fallbacks existed when fallbackFonts
+        argument was null; because of this, a later call to Font::width was returning the width without filling up
+        fallbackFonts even if it was not null this time.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        Fixed the bug by adding a local fallback fonts hash set, and checking the emptiness of this variable in Font::width.
+        Also added pass fallbackFonts around in various places to make use of the cached font fallbacks.
</ins><span class="cx"> 
</span><del>-        Make the build faster by removing unnecessary header includes.
</del><ins>+        No new tests. Unfortunately I haven't been able to make a reliable reduction for this bug.
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+        * platform/graphics/Font.cpp:
+        (WebCore::Font::width):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::measureHyphenWidth):
+        (WebCore::setLogicalWidthForTextRun):
+        (WebCore::textWidth):
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
+        * rendering/RenderText.cpp:
+        (WebCore::maxWordFragmentWidth):
+        (WebCore::RenderText::computePreferredLogicalWidths):
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/ShapeOutsideInfo.h:
</del><ins>+2013-06-07  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        [regression] build failure WebKitFontFamilyNames.h missing
+        https://bugs.webkit.org/show_bug.cgi?id=117178
</ins><span class="cx"> 
</span><del>-        Fix the iOS build.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cg/BitmapImageCG.cpp:
-        (WebCore::BitmapImage::draw):
</del><ins>+        * GNUmakefile.am: Make libPlatform and other sources depend on the generated platform sources. This should prevent
+        build failures in source code that's depending on the generated platform sources.
</ins><span class="cx"> 
</span><del>-2014-04-16  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-06-07  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        DataTransfer should cache its FileList
-        https://bugs.webkit.org/show_bug.cgi?id=131694
</del><ins>+        MathML line fraction needs to parse number values
+        https://bugs.webkit.org/show_bug.cgi?id=117305
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Test: fast/events/data-transfer-files-attribute-identity.html
</del><ins>+        The line fraction thickness was not handling arbitrary thickness numbers.
+        The accessibility code was not handling default values for line thickness, so
+        it made sense to have AX rely on the RenderFraction object to retrive the thickness.
</ins><span class="cx"> 
</span><del>-        * bindings/js/SerializedScriptValue.cpp: (WebCore::CloneDeserializer::readTerminal):
-        Switched to a new FileList constructor, CloneDeserializer doesn't really need to modify
-        the FileList with append().
</del><ins>+        Modified existing tests to cover new behavior.
</ins><span class="cx"> 
</span><del>-        * dom/DataTransfer.h:
-        * dom/DataTransfer.cpp:
-        (WebCore::DataTransfer::types): Added a FIXME.
-        (WebCore::DataTransfer::files): Changed to reuse a cached FileList. It's currently
-        easy, because we don't support DataTransferItemList. Once we do, making any changes
-        through it will also require updating the FileList in a way that doesn't replace
-        File objects for unchanged files.
</del><ins>+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mathLineThickness):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::updateFromElement):
+        * rendering/mathml/RenderMathMLFraction.h:
+        (WebCore::RenderMathMLFraction::lineThickness):
+        (WebCore::toRenderMathMLFraction):
</ins><span class="cx"> 
</span><del>-        * fileapi/FileList.h:
-        (WebCore::FileList::create):
-        (WebCore::FileList::isEmpty):
-        (WebCore::FileList::FileList):
-        (WebCore::FileList::append):
-        (WebCore::FileList::clear):
-        Made non-const functions private, because neither DataTransfer nor FileInputType
-        expect the list to be modified without their knowledge. Added a new Vector based
-        constructor so that a FileList could be created without the use of append().
</del><ins>+2013-06-07  Claudio Saavedra  &lt;csaavedra@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/FileInputType.cpp: (WebCore::FileInputType::createFileList): Simplified
-        the code a little bit. FileInputType still needs to modify the list for clear(),
-        but doesn't need to add to it dynamically - unlike with DataTransfer, it's expected
-        to create a new FileList when it's modified.
</del><ins>+        [rendering] Use foreground color to render the overtype caret
+        https://bugs.webkit.org/show_bug.cgi?id=117347
</ins><span class="cx"> 
</span><del>-2014-04-15  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [Win] Eliminate use of deleteAllValues in Windows Files
-        https://bugs.webkit.org/show_bug.cgi?id=131631
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Update to use std::unique_ptr for object lifetime. Get rid of
-        deleteAllValues now that it is no loner needed. Use ranged for
-        loops where possible.
</del><ins>+        Currently, the overtype caret is rendered using the colors of
+        a normal selection, which is confusing. This patch enables RenderObject
+        to differentiate between a normal and a overtype caret selection,
+        in order to use a different color for the latter.
</ins><span class="cx"> 
</span><del>-        * platform/win/WCDataObject.cpp:
-        (WebCore::WCEnumFormatEtc::WCEnumFormatEtc):
-        (WebCore::WCDataObject::~WCDataObject):
-        (WebCore::WCDataObject::GetData):
-        (WebCore::WCDataObject::QueryGetData):
-        (WebCore::WCDataObject::SetData):
-        (WebCore::WCDataObject::clearData):
-        * platform/win/WCDataObject.h:
</del><ins>+        Also, let RenderView update the selection if this is unchanged
+        when going from a overtype caret to one character selection and
+        viceversa.
</ins><span class="cx"> 
</span><del>-2014-04-16  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionBackgroundColor):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection):
+        * rendering/RenderView.h:
</ins><span class="cx"> 
</span><del>-        AX: Accessing a table cell with an invalid column header crashes
-        https://bugs.webkit.org/show_bug.cgi?id=131719
</del><ins>+2013-06-07  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Get rid of outdated getter / setter raises from Web IDL
+        https://bugs.webkit.org/show_bug.cgi?id=117346
</ins><span class="cx"> 
</span><del>-        If no tableCell is available as a column/row header, then do not continue processing.
-
-        Test: accessibility/table-missing-column-header-crash.html
-
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::columnHeaders):
-        (WebCore::AccessibilityTableCell::rowHeaders):
-
-2014-04-16  Brendan Long  &lt;b.long@cablelabs.com&gt;
-
-        [GTK] Fix unused parameter warnings
-        https://bugs.webkit.org/show_bug.cgi?id=131721
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * bindings/js/JSMediaStreamCapabilitiesCustom.cpp:
-        (WebCore::toJS): Remove unused 'exec' parameter.
</del><ins>+        Stop using &quot;getter / setter raises&quot; in the IDL as this is no longer part of
+        the Web IDL specification. Web IDL no longer specifies exceptions for
+        attribute getters or setters. Instead, it is now explained in prose.
</ins><span class="cx"> 
</span><del>-2014-04-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        WebKit still needs to know if the getter / setter can throw an exception
+        (but does not need the exception name) so this patch adds 2 WebKit specific
+        IDL extended attributes: [GetterRaisesException] / [SetterRaisesException].
+        The naming is consistent with Blink.
</ins><span class="cx"> 
</span><del>-        Convert the boolean param of Image::startAnimation() to an enum
-        https://bugs.webkit.org/show_bug.cgi?id=131742
</del><ins>+        This results in more standard and concise IDL. This also simplifies a lot
+        the code of the IDL parser.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Note that this patch does not remove &quot;raises()&quot; from the IDL methods yet.
+        This should be replaced by [RaisesException] IDL extended attribute in a
+        later patch.
</ins><span class="cx"> 
</span><del>-        Use an enum to make the code more readable.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::startAnimation):
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::drawTiled):
-        * platform/graphics/Image.h:
-        (WebCore::Image::startAnimation):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::startAnimation):
-        * svg/graphics/SVGImage.h:
</del><ins>+        * Modules/indexeddb/IDBRequest.idl:
+        * Modules/mediasource/MediaSource.idl:
+        * Modules/mediasource/SourceBuffer.idl:
+        * Modules/mediastream/RTCDataChannel.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/mediastream/RTCSessionDescription.idl:
+        * Modules/mediastream/RTCStatsResponse.idl:
+        * Modules/webaudio/AnalyserNode.idl:
+        * Modules/webaudio/AudioBufferSourceNode.idl:
+        * Modules/webaudio/AudioNode.idl:
+        * Modules/webdatabase/SQLResultSet.idl:
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GenerateProperty):
+        (GenerateFunctions):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/IDLParser.pm:
+        (parseAttributeRest):
+        (parseAttributeRestOld):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/TestTypedefs.idl:
+        * css/CSSCharsetRule.idl:
+        * css/CSSRule.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSValue.idl:
+        * css/MediaList.idl:
+        * dom/Attr.idl:
+        * dom/CharacterData.idl:
+        * dom/Document.idl:
+        * dom/Node.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/Range.idl:
+        * dom/ShadowRoot.idl:
+        * dom/TreeWalker.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLMarqueeElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLMeterElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLProgressElement.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/MediaController.idl:
+        * html/track/TextTrackCue.idl:
+        * html/track/TextTrackRegion.idl:
+        * page/DOMWindow.idl:
+        * storage/Storage.idl:
+        * svg/SVGAltGlyphElement.idl:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimatedBoolean.idl:
+        * svg/SVGAnimatedEnumeration.idl:
+        * svg/SVGAnimatedInteger.idl:
+        * svg/SVGAnimatedNumber.idl:
+        * svg/SVGAnimatedString.idl:
+        * svg/SVGElement.idl:
+        * svg/SVGGlyphRefElement.idl:
+        * svg/SVGLangSpace.idl:
+        * svg/SVGLength.idl:
+        * svg/SVGPreserveAspectRatio.idl:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGScriptElement.idl:
+        * svg/SVGStyleElement.idl:
+        * svg/SVGViewSpec.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XPathResult.idl:
</ins><span class="cx"> 
</span><del>-2014-04-16  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+2013-06-07  Kangil Han  &lt;kangil.han@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Make sure to skip the RenderMultiColumnFlowThread when resolving percentage heights inside columns against
-        containing blocks. The flow thread's auto height should not interfere if a fixed height is specified on
-        an ancestor.
</del><ins>+        Remove unused header includes in Document
+        https://bugs.webkit.org/show_bug.cgi?id=117339
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=131741
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Minor code cleanup.
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/percent-height.html.
</del><ins>+        * dom/Document.cpp:
+        * dom/Document.h:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::skipContainingBlockForPercentHeightCalculation):
-        Add an isInFlowRenderFlowThread check so that we skip those blocks and don't consider them at all
-        when resolving percentage heights.
</del><ins>+2013-06-07  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-16  Daewoong Jang  &lt;daewoong.jang@navercorp.com&gt;
</del><ins>+        Unnecessary use of Layout types in GraphicsLayer::paintGraphicsLayerContents
+        https://bugs.webkit.org/show_bug.cgi?id=117340
</ins><span class="cx"> 
</span><del>-        [WinCairo][cURL] Build fix for WinCairo build with USE(CURL).
-        https://bugs.webkit.org/show_bug.cgi?id=131614
-
-        Reviewed by Brent Fulgham.
-
-        Build fix, no new tests needed.
-
-        * platform/network/curl/CurlCacheEntry.cpp:
-        (WebCore::CurlCacheEntry::loadResponseHeaders):
-        * platform/network/curl/CurlCacheManager.cpp:
-        (WebCore::CurlCacheManager::loadIndex):
-        * platform/network/soup/ResourceError.h:
-        * platform/network/soup/SocketStreamHandle.h:
-
-2014-04-16  Martin Hodovan  &lt;mhodovan@inf.u-szeged.hu&gt;
-
-        ASSERTION FAILED: x2 &gt;= x1 in WebCore::RenderObject::drawLineForBoxSide
-        https://bugs.webkit.org/show_bug.cgi?id=127835
-
-        In some cases when a negative margin and a positive padding are applied
-        together to the right and/or left side of the box, the logical width of
-        the borders can be set to a negative value, making the assertion fire.
-        The fix checks if the width or height of the box is negative, and if so,
-        it will not display the borders and shadows of the box.
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Test: fast/css/padding-margin-negative-border.html
</del><ins>+        There is no reason to use Layout types when copying from Int types to Int types.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBorder):
</del><ins>+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents):
</ins><span class="cx"> 
</span><del>-2014-04-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-06-07  Grzegorz Czajkowski  &lt;g.czajkowski@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        [MSE] Seeks into buffered ranges will never complete.
-        https://bugs.webkit.org/show_bug.cgi?id=131717
</del><ins>+        [EFL][GTK] TextCheckerEnchant uses deprecated enchant_dict_add_to_personal
+        https://bugs.webkit.org/show_bug.cgi?id=117335
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Christophe Dumez.
</ins><span class="cx"> 
</span><del>-        Test: media/media-source/media-source-seek-complete.html
</del><ins>+        enchant_dict_add_to_personal has been deprecated at r22321 in Enchant repository.
</ins><span class="cx"> 
</span><del>-        Run the SourceBuffer Monitoring step after initiating a seek.
</del><ins>+        No behavior change, no new tests needed.
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::sourceBufferPrivateSeekToTime):
</del><ins>+        * platform/text/enchant/TextCheckerEnchant.cpp:
+        (WebCore::TextCheckerEnchant::learnWord):
+        Use enchant_dict_add instead of enchant_dict_add_to_personal.
</ins><span class="cx"> 
</span><del>-2014-04-15  Hyowon Kim  &lt;hw1008.kim@samsung.com&gt;
</del><ins>+2013-06-07  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [EFL] Fix problems with the pixel dump.
-        https://bugs.webkit.org/show_bug.cgi?id=131265
</del><ins>+        Frame flattening: crash when child iframe is removed during beforeload.
+        https://bugs.webkit.org/show_bug.cgi?id=116220
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Painting and compositing paths of WebKit-EFL were totally modified from r166768.
-        However pixel dump codes still call deprecated functions like ewk_view_paint(),
-        which causes that nothing is drawn.
</del><ins>+        FrameView can get destroyed in updateWidget(). Normally, it is protected by layout()
+        but with frame flattening on, it can also be called asynchronously through the
+        post layout timer.
</ins><span class="cx"> 
</span><del>-        This patch adds new member functions to AcceleratedCompositingContext to support pixel dump.
-        One of new functions is AcceleratedCompositingContext::extractImageData(),
-        which replaces deprecated function calls. Besides the extractImageData() is invoked by
-        ewk_view_screenshot_contents_get() in order to take the visible content displayed on the EFL webview.
</del><ins>+        Test: fast/frames/flattening/crash-remove-iframe-during-object-beforeload.html
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cairo/CairoUtilities.cpp:
-        (WebCore::flipImageSurfaceVertically): Flip pixel data of given cairo_surface_t vertically up/down.
-        Whereas Cairo uses the top-left corner as being 0,0 of the coordinate system,
-        OpenGL uses the bottom-left corner being 0,0.
-        So we need to vertically flip resultant images taken by glReadPixels().
-        * platform/graphics/cairo/CairoUtilities.h:
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
</ins><span class="cx"> 
</span><del>-2014-04-15  Hyowon Kim  &lt;hw1008.kim@samsung.com&gt;
</del><ins>+2013-06-06  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Make page overlay functionality working on coordinated graphics.
-        https://bugs.webkit.org/show_bug.cgi?id=131425
</del><ins>+        Make CachedResource virtual methods overridden in derived classes private
+        https://bugs.webkit.org/show_bug.cgi?id=117289
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Page overlay functionality did not work on coordinated graphics since r166975.
-        This patch removes deprecated code related to the PageOverlay GraphicsLayer management.
-        and makes CoordinatedLayerTreeHost use PageOverlayController.
</del><ins>+        And mark them as OVERRIDE too. Also mark all CachedResource
+        derived classes as FINAL.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
-        (WebCore::CompositingCoordinator::setRootCompositingLayer):
-        (WebCore::CompositingCoordinator::flushPendingLayerChanges):
-        * platform/graphics/texmap/coordinated/CompositingCoordinator.h:
</del><ins>+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::cachedResourcesForFrame):
+        * loader/cache/CachedCSSStyleSheet.h:
+        * loader/cache/CachedFont.h:
+        * loader/cache/CachedImage.h:
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedSVGDocument.h:
+        * loader/cache/CachedScript.h:
+        * loader/cache/CachedShader.h:
+        * loader/cache/CachedTextTrack.h:
+        * loader/cache/CachedXSLStyleSheet.h:
</ins><span class="cx"> 
</span><del>-2014-04-10  Roger Fong  &lt;roger_fong@apple.com&gt;
</del><ins>+2013-06-07  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Snapshotted plugins may need to be restarted if style properties are changed after initial load of plugin.
-        https://bugs.webkit.org/show_bug.cgi?id=131553.
-        &lt;rdar://problem/15443375&gt;
</del><ins>+        [CSSRegions] getBoundingClientRect wrong for inline content nodes
+        https://bugs.webkit.org/show_bug.cgi?id=117290
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Horton.
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        Test: plugins/snapshotting/set-plugin-size-to-tiny.html
</del><ins>+        getBoundingClientRect returned incorrect values for inline content that
+        was directly flowed inside regions because its mapLocalToContainer was not
+        properly patched as its RenderBox counterpart. This patch adds mapLocalToContainer
+        method in RenderFlowThread so that is properly called for all the elements inside the
+        flow thread.
</ins><span class="cx"> 
</span><del>-        When updating embedded objects during our post layout checks, check for certain style changes
-        that may result in the plugin needing to be restarted.
</del><ins>+        Also, modified offsetFromContainer so that if the container is the flow thread,
+        offsetDependsOnPoint is set to true which further sets RenderGeometryMapStep::m_isNonUniform
+        to true for each step added in pushMappingToContainer methods.
</ins><span class="cx"> 
</span><del>-        * html/HTMLPlugInImageElement.h: 
-        Add m_plugInDimensionsSpecified field to keep track of whether or not dimensions on the plugin’s renderer have been specified.
-        * html/HTMLPlugInImageElement.cpp:
-        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
-        Initialize m_plugInDimensionsSpecified.
-        (WebCore::isSmallerThanTinySizingThreshold):
-        Refactoring, move check for whether or not plugin is smaller than the tiny plugin size threshold to this method.
-        (WebCore::HTMLPlugInImageElement::isTopLevelFullPage): 
-        Refactoring, move check for whether or not plugin is top level full page to this method.
-        (WebCore::HTMLPlugInImageElement::checkSnapshotStatus): 
-        Use refactored checks here as well to determine whether or not we need to restart the snapshotted plugin.
-        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Use refactored checks.
-        If plugin dimensions were specified, set m_plugInDimensionsSpecified to true.
</del><ins>+        Test: fast/regions/flowed-inline-content-bounding-client-rect.html
</ins><span class="cx"> 
</span><del>-2014-04-15  Andreas Kling  &lt;akling@apple.com&gt;
-
-        [iOS WebKit2] Listen for system memory pressure notifications.
-        &lt;https://webkit.org/b/131653&gt;
-        &lt;rdar://problem/16208123&gt;
-
-        Reviewed by Antti Koivisto.
-
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::install):
-
-            Use the right invocation to summon the memory pressure handler.
-
-        (WebCore::MemoryPressureHandler::install):
-        (WebCore::MemoryPressureHandler::uninstall):
-        (WebCore::MemoryPressureHandler::holdOff):
-        (WebCore::MemoryPressureHandler::respondToMemoryPressure):
-
-            Make stubbed out functions !PLATFORM(COCOA)
-
-2014-04-14  Morten Stenshorne  &lt;mstensho@opera.com&gt;
-
-        [New Multicolumn] Add support for column-span:all
-        https://bugs.webkit.org/show_bug.cgi?id=129330
-
-        Reviewed by Dave Hyatt.
-
-        Column spanners are implemented as siblings of RenderMultiColumnSet
-        objects (i.e. the regions for the column rows). This means that they
-        are pulled out from the flow thread tree where they would otherwise
-        live. This causes some complexity, most of which is contained within
-        the multicol code.
-
-        A placeholder is put in the flow thread tree where the spanner's
-        renderer would otherwise live. This is needed in order make sure that
-        we interrupt line layout before after the spanner. We also need this
-        to be able to switch from one multicol set to the next.
-
-        Some extra logic is required when dynamically inserting and removing
-        flow thread descendants now, because we need to figure out if the
-        renderer added should trigger creation of new multi column sets. If
-        a spanner is inserted in the middle of a multi column set, we need to
-        detect this, split the set and put the spanner in the middle.
-
-        Wrote a bunch of tests. A few of the tests were copied from existing
-        (old-impl) tests and put in a separate directory. That directory can
-        be wiped when we turn on the new multicol implementation by default.
-
-        Tests: fast/multicol/newmulticol/adjacent-spanners.html
-               fast/multicol/newmulticol/block-becomes-spanner.html
-               fast/multicol/newmulticol/change-spanner-display.html
-               fast/multicol/newmulticol/change-spanner-parent-display.html
-               fast/multicol/newmulticol/compare-with-old-impl/anonymous-block-split-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/before-child-anonymous-column-block.html
-               fast/multicol/newmulticol/compare-with-old-impl/clone-before-after-content-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/clone-block-children-inline-mismatch-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/clone-flexbox.html
-               fast/multicol/newmulticol/compare-with-old-impl/clone-summary.html
-               fast/multicol/newmulticol/compare-with-old-impl/column-span-inside-multicol-webkit-box.html
-               fast/multicol/newmulticol/compare-with-old-impl/continuation-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/double-merge-anonymous-block-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/empty-anonymous-block-split-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/float-not-removed-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/list-multi-column-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/positioned-child-not-removed-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/positioned-objects-not-removed-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/recursive-split-flow-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/removal-of-multicol-span-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/remove-child-split-flow-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/runin-continuation-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/span-as-immediate-child-complex-splitting.html
-               fast/multicol/newmulticol/compare-with-old-impl/span-as-nested-inline-block-child.html
-               fast/multicol/newmulticol/compare-with-old-impl/split-flow-anonymous-wrapper-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/split-inline-wrong-post-block-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/table-multi-column-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/textbox-not-removed-crash.html
-               fast/multicol/newmulticol/compare-with-old-impl/update-after-content-before-child-crash.html
-               fast/multicol/newmulticol/insert-row-content1.html
-               fast/multicol/newmulticol/insert-row-content2.html
-               fast/multicol/newmulticol/insert-row-content3.html
-               fast/multicol/newmulticol/insert-row-content4.html
-               fast/multicol/newmulticol/insert-row-content5.html
-               fast/multicol/newmulticol/insert-row-content6.html
-               fast/multicol/newmulticol/insert-row-content7.html
-               fast/multicol/newmulticol/insert-row-content8.html
-               fast/multicol/newmulticol/insert-row-content9.html
-               fast/multicol/newmulticol/insert-spanner-child1.html
-               fast/multicol/newmulticol/insert-spanner-child2.html
-               fast/multicol/newmulticol/insert-spanner-child3.html
-               fast/multicol/newmulticol/insert-spanner1.html
-               fast/multicol/newmulticol/insert-spanner2.html
-               fast/multicol/newmulticol/insert-spanner3.html
-               fast/multicol/newmulticol/insert-spanner4.html
-               fast/multicol/newmulticol/insert-spanner5.html
-               fast/multicol/newmulticol/insert-spanner6.html
-               fast/multicol/newmulticol/insert-spanner7.html
-               fast/multicol/newmulticol/insert-spanner8.html
-               fast/multicol/newmulticol/multicol-with-spanner-becomes-regular-block.html
-               fast/multicol/newmulticol/remove-row-content1.html
-               fast/multicol/newmulticol/remove-row-content2.html
-               fast/multicol/newmulticol/remove-row-content3.html
-               fast/multicol/newmulticol/remove-row-content4.html
-               fast/multicol/newmulticol/remove-row-content5.html
-               fast/multicol/newmulticol/remove-row-content6.html
-               fast/multicol/newmulticol/remove-row-content7.html
-               fast/multicol/newmulticol/remove-row-content8.html
-               fast/multicol/newmulticol/remove-row-content9.html
-               fast/multicol/newmulticol/remove-spanner1.html
-               fast/multicol/newmulticol/remove-spanner2.html
-               fast/multicol/newmulticol/remove-spanner3.html
-               fast/multicol/newmulticol/remove-spanner4.html
-               fast/multicol/newmulticol/remove-spanner5.html
-               fast/multicol/newmulticol/remove-spanner6.html
-               fast/multicol/newmulticol/sole-spanner.html
-               fast/multicol/newmulticol/span-between-text.html
-               fast/multicol/newmulticol/spanner-becomes-regular-block.html
-               fast/multicol/newmulticol/spanner-first.html
-               fast/multicol/newmulticol/spanner-img.html
-               fast/multicol/newmulticol/spanner-inline-block.html
-               fast/multicol/newmulticol/spanner-last.html
-               fast/multicol/newmulticol/spanner-nested-dynamic.html
-               fast/multicol/newmulticol/spanner-nested.html
-               fast/multicol/newmulticol/spanner-pseudo-after1.html
-               fast/multicol/newmulticol/spanner-pseudo-after2.html
-               fast/multicol/newmulticol/spanner-pseudo-after3.html
-               fast/multicol/newmulticol/spanner-pseudo-after4.html
-               fast/multicol/newmulticol/spanner-pseudo-before-after1.html
-               fast/multicol/newmulticol/spanner-pseudo-before-after2.html
-               fast/multicol/newmulticol/spanner-pseudo-before-after3.html
-               fast/multicol/newmulticol/spanner-pseudo-before-after4.html
-               fast/multicol/newmulticol/spanner-pseudo-before1.html
-               fast/multicol/newmulticol/spanner-pseudo-before2.html
-               fast/multicol/newmulticol/spanner-pseudo-before3.html
-               fast/multicol/newmulticol/spanner-pseudo-before4.html
-               fast/multicol/newmulticol/spanner-table.html
-               fast/multicol/newmulticol/spanner-with-margin.html
-               fast/multicol/newmulticol/spanner1.html
-               fast/multicol/newmulticol/spanner2.html
-               fast/multicol/newmulticol/spanner3.html
-               fast/multicol/newmulticol/spanner4.html
-               fast/multicol/newmulticol/spanner5.html
-               fast/multicol/newmulticol/spanner6.html
-               fast/multicol/newmulticol/spanner7.html
-               fast/multicol/newmulticol/spanner8.html
-               fast/multicol/newmulticol/spanner9.html
-               fast/multicol/newmulticol/trailing-margin-with-spanner.html
-               fast/multicol/newmulticol/trailing-margin-with-spanner2.html
-
-        * CMakeLists.txt:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
-        Disable the old anonymous multicol container and spanner anonymous
-        block generation machinery when the new multicol implementation is
-        enabled.
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::createMultiColumnFlowThread):
-        (WebCore::RenderBlockFlow::destroyMultiColumnFlowThread):
-        (WebCore::RenderBlockFlow::layoutBlockChild): Need to notify the
-        flow thread when a descendant's final position is known. Spanner
-        placeholders need to know where to terminate the column set that
-        it follows.
-        (WebCore::RenderBlockFlow::styleDidChange): Remove old code that
-        isn't needed anymore. The renderers in question (flow thread and
-        column sets) set display:block on themselves already. This code
-        caused problems for spanners, which got all their style wiped.
-        (WebCore::RenderBlockFlow::setMultiColumnFlowThread): If setting
-        the flow thread to nullptr, there's no need to create the &quot;rare
-        data&quot; structure.
-        (WebCore::RenderBlockFlow::relayoutForPagination):
-        (WebCore::RenderBlockFlow::layoutSpecialExcludedChild):
-        (WebCore::RenderBlockFlow::addChild): beforeChild is retrieved via
-        the DOM. If it is a spanner, we need to locate the placeholder
-        here, because that's the correct location to insert siblings,
-        DOM-wise.
-        (WebCore::RenderBlockFlow::removeChild): The multicol flow thread
-        needs to know when children disappear.
-        (WebCore::RenderBlockFlow::checkForPaginationLogicalHeightChange):
-        Don't modify the height back and forth when calculating the
-        multicol container's final height, as that messes up balancing.
-        (WebCore::RenderBlockFlow::insertedIntoTree): Deleted.
-        (WebCore::RenderBlockFlow::willBeDestroyed): Deleted.
-        (WebCore::RenderBlockFlow::styleWillChange): Deleted.
-        (WebCore::RenderBlockFlow::lineAtIndex): Deleted.
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::insertedIntoTree): Set up an element's
-        layer before notifying the flow thread. The multicol flow thread
-        may decide to move the element (if it's a spanner), which may
-        involve re-insertion of layers.  Calling
-        RenderObject::insertedIntoTree() last instead of first also better
-        matches the order we used to have prior to the introduction of
-        RenderElement, FWIW.
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::pushMappingToContainer):
+        (WebCore::RenderBox::offsetFromContainer):
</ins><span class="cx">         * rendering/RenderFlowThread.cpp:
</span><del>-        (WebCore::RenderFlowThread::layout):
-        (WebCore::RenderFlowThread::removeRegionFromThread): Deleted.
-        (WebCore::RenderFlowThread::invalidateRegions): Deleted.
</del><ins>+        (WebCore::RenderFlowThread::mapLocalToContainer):
</ins><span class="cx">         * rendering/RenderFlowThread.h:
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::RenderMultiColumnFlowThread):
-        (WebCore::RenderMultiColumnFlowThread::removeFlowChildInfo): When
-        a flow thread descendant is inserted, the multicol flow thread
-        needs to be notified.
-        (WebCore::RenderMultiColumnFlowThread::firstMultiColumnSet):
-        (WebCore::RenderMultiColumnFlowThread::lastMultiColumnSet):
-        (WebCore::RenderMultiColumnFlowThread::firstColumnSetOrSpanner):
-        (WebCore::RenderMultiColumnFlowThread::nextColumnSetOrSpannerSiblingOf):
-        (WebCore::RenderMultiColumnFlowThread::previousColumnSetOrSpannerSiblingOf):
-        (WebCore::RenderMultiColumnFlowThread::layout):
-        (WebCore::RenderMultiColumnFlowThread::findSetRendering):
-        (WebCore::RenderMultiColumnFlowThread::populate):
-        (WebCore::RenderMultiColumnFlowThread::evacuateAndDestroy):
-        (WebCore::RenderMultiColumnFlowThread::addRegionToThread):
-        (WebCore::RenderMultiColumnFlowThread::willBeRemovedFromTree):
-        Need to detach column sets here, since they have pointers to their
-        flow thread.
-        (WebCore::RenderMultiColumnFlowThread::resolveMovedChild):
-        (WebCore::isValidColumnSpanner):
-        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
-        (WebCore::RenderMultiColumnFlowThread::flowThreadRelativeWillBeRemoved):
-        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantBoxLaidOut):
-        (WebCore::RenderMultiColumnFlowThread::autoGenerateRegionsToBlockOffset):
-        Nothing to be done here for the time being. Column sets are now
-        created during box creation. We are going to need to add some code
-        here again once multicol properly supports nested fragmentation
-        contexts (and you get adjacent column rows because of that).
-        (WebCore::RenderMultiColumnFlowThread::regionAtBlockOffset):
-        During layout, don't trust the region interval tree, as that one
-        depends on the resulting layout.
-        (WebCore::RenderMultiColumnFlowThread::setRegionRangeForBox): With
-        a convenience method to get the last column set, and column sets
-        now being created during normal box creation, this young method
-        needs an overhaul.
-        (WebCore::RenderMultiColumnFlowThread::setRegionRangeForBox):
-        (WebCore::RenderMultiColumnFlowThread::isPageLogicalHeightKnown):
-        * rendering/RenderMultiColumnFlowThread.h:
-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::nextSiblingMultiColumnSet):
-        (WebCore::RenderMultiColumnSet::previousSiblingMultiColumnSet):
-        (WebCore::RenderMultiColumnSet::firstRendererInFlowThread):
-        (WebCore::RenderMultiColumnSet::lastRendererInFlowThread):
-        (WebCore::precedesRenderer):
-        (WebCore::RenderMultiColumnSet::containsRendererInFlowThread):
-        (WebCore::RenderMultiColumnSet::setLogicalTopInFlowThread):
-        (WebCore::RenderMultiColumnSet::setLogicalBottomInFlowThread):
-        (WebCore::RenderMultiColumnSet::pageLogicalTopForOffset):
-        (WebCore::RenderMultiColumnSet::distributeImplicitBreaks):
-        (WebCore::RenderMultiColumnSet::calculateBalancedHeight):
-        (WebCore::RenderMultiColumnSet::addForcedBreak):
-        (WebCore::RenderMultiColumnSet::recalculateColumnHeight):
-        Previously only needed if columns were to be balanced, now it's
-        also needed when not balancing.
-        (WebCore::RenderMultiColumnSet::recordSpaceShortage): Some layout
-        elements actually have 0 height. Skip them, since they're not
-        taking us anywhere.
-        (WebCore::RenderMultiColumnSet::updateLogicalWidth):
-        (WebCore::RenderMultiColumnSet::requiresBalancing): Column sets
-        now have individual balancing needs. If they precede a spanner,
-        they must always be balanced. For the last column set, see if
-        height is unspecified or column-fill is 'balance' (like before).
-        (WebCore::RenderMultiColumnSet::prepareForLayout):
-        (WebCore::RenderMultiColumnSet::beginFlow):
-        (WebCore::RenderMultiColumnSet::endFlow):
-        (WebCore::RenderMultiColumnSet::layout):
-        (WebCore::RenderMultiColumnSet::calculateMaxColumnHeight):
-        (WebCore::RenderMultiColumnSet::columnRectAt):
-        (WebCore::RenderMultiColumnSet::flowThreadPortionOverflowRect):
-        (WebCore::RenderMultiColumnSet::paintColumnRules):
-        (WebCore::RenderMultiColumnSet::initialBlockOffsetForPainting):
-        (WebCore::RenderMultiColumnSet::collectLayerFragments):
-        (WebCore::RenderMultiColumnSet::columnTranslationForOffset):
-        (WebCore::RenderMultiColumnSet::setAndConstrainColumnHeight): Deleted.
-        (WebCore::RenderMultiColumnSet::findRunWithTallestColumns): Deleted.
-        (WebCore::RenderMultiColumnSet::clearForcedBreaks): Deleted.
-        (WebCore::RenderMultiColumnSet::repaintFlowThreadContent): Deleted.
-        * rendering/RenderMultiColumnSet.h:
-        * rendering/RenderMultiColumnSpannerPlaceholder.cpp: Added.
-        (WebCore::RenderMultiColumnSpannerPlaceholder::createAnonymous):
-        (WebCore::RenderMultiColumnSpannerPlaceholder::RenderMultiColumnSpannerPlaceholder):
-        (WebCore::RenderMultiColumnSpannerPlaceholder::renderName):
-        * rendering/RenderMultiColumnSpannerPlaceholder.h: Added.
</del><ins>+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer):
</ins><span class="cx">         * rendering/RenderObject.cpp:
</span><del>-        (WebCore::RenderObject::insertedIntoTree): Need to notify the
-        multicol flow thread when descendants are inserted. That may
-        trigger insertion of column sets, or, in the case of spanners,
-        they need to be moved out from the flow thread.
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isRenderMultiColumnSpannerPlaceholder):
-        (WebCore::RenderObject::isAnonymousBlock): Exclude column sets
-        here, so that they don't get involved in anonymous block merging
-        and other kinds of fun.
-        * rendering/RenderRegion.h:
-        * rendering/RenderRegionSet.h:
</del><ins>+        (WebCore::RenderObject::offsetFromContainer):
</ins><span class="cx"> 
</span><del>-2014-04-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-06-06  Kangil Han  &lt;kangil.han@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        LayerTreeAsTextBehavior should be in the WebCore namespace
-        https://bugs.webkit.org/show_bug.cgi?id=131683
</del><ins>+        Minor code cleanup to remove unused header includes
+        https://bugs.webkit.org/show_bug.cgi?id=117283
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Move LayerTreeAsTextBehavior and the bit flags into the WebCore namespace.
</del><ins>+        * loader/cache/CachedResourceClient.h:
+        * rendering/RenderBlock.cpp:
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBoxModelObject.cpp:
+        * rendering/RenderObject.cpp:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayer.cpp:
-        (showGraphicsLayerTree):
-        * platform/graphics/GraphicsLayer.h:
</del><ins>+2013-06-06  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-15  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Restrict WebAudio from playing when disallowed by page.
+        https://bugs.webkit.org/show_bug.cgi?id=117310
</ins><span class="cx"> 
</span><del>-        ViewportConfiguration handles userZoom incorrectly
-        https://bugs.webkit.org/show_bug.cgi?id=131657
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Add a new behavior restriction which would mute WebAudio
+        when media playback is disallowed by the page.
</ins><span class="cx"> 
</span><del>-        * page/ViewportConfiguration.cpp:
-        (WebCore::viewportArgumentUserZoomIsSet):
-        (WebCore::ViewportConfiguration::updateConfiguration):
-        The other viewport values must be strictly positive, userZoom is always either zero, one or minus one.
-        As a result, the value zero was never set.
</del><ins>+        * Modules/webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::constructCommon): Set the RequirePageConsentForAudioStartRestriction
+            restriction for the Mac port
+        (WebCore::AudioContext::document): Cast the execution context to a document.
+        (WebCore::AudioContext::lazyInitialize): Call startRendering() instead of
+            m_destinationNode-&gt;startRendering() directly.
+        (WebCore::AudioContext::startRendering): If media loading is disabled, add
+            a mediaCanStart listener.
+        (WebCore::AudioContext::mediaCanStart): Remove the RequirePageConsentForAudioStartRestriction.
+        * Modules/webaudio/AudioContext.h:
+        (WebCore::AudioContext::pageConsentRequiredForAudioStart): Added; simple wrapper.
+        * Modules/webaudio/AudioDestinationNode.cpp:
+        (WebCore::AudioDestinationNode::render): Mute output if pageConsentRequiredForAudioStart().
</ins><span class="cx"> 
</span><del>-2014-04-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-06-03  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Pages often blank on first load if page loaded by typing the URL
-        https://bugs.webkit.org/show_bug.cgi?id=131665
</del><ins>+        Upstream iOS WebAudio behavior restrictions.
+        https://bugs.webkit.org/show_bug.cgi?id=117151
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        The document overlay-related code in RemoteLayerTreeDrawingArea::setRootCompositingLayer()
-        was triggering a compositing layer flush when called with a null rootLayer, which happens
-        for pages going into the page cache. This would trigger a layer flush that would clobber
-        the root layer for the visible page, resulting in missing content.
-        
-        Also, rebuildCompositingLayerTree() is called recursively and the m_documentOverlayRootLayer
-        was being added to (and then removed from) every single compositing layers.
-        
-        Fix both these by changing to a pull model, where RenderLayerCompositor requests
-        the overlay layer via ChromeClient, and gets it at the end of every flush,
-        adding to the children of the root layer.
</del><ins>+    2012-06-25  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::documentOverlayLayerForFrame):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::flushPendingLayerChanges): Put visibleRect
-        into a variable for ease of debugging.
-        (WebCore::RenderLayerCompositor::updateCompositingLayers): Asser
-        that we're not in the page cache (this would have caught the bug).
-        (WebCore::RenderLayerCompositor::appendOverlayLayers):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::setDocumentOverlayRootLayer): Deleted.
-        * rendering/RenderLayerCompositor.h:
</del><ins>+            &lt;rdar://problem/11041007&gt; WebAudio should restrict playback to user interaction on iOS
</ins><span class="cx"> 
</span><del>-2014-04-15  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            Added a bevahior restrictions field in AudioContext that behaviors similarly to
+            the one in HTMLMediaElement. Restrictions are lifted when JavaScript calls noteOn,
+            noteGrainOn or startRendering from a user gesture event.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167199 and r167251.
-        https://bugs.webkit.org/show_bug.cgi?id=131678
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Caused a DYEBench regression and does not seem to improve perf
-        on relevant websites (Requested by rniwa on #webkit).
</del><ins>+            No new tests, testing framework doesn't support web audio.
</ins><span class="cx"> 
</span><del>-        Reverted changesets:
</del><ins>+            * Modules/webaudio/AudioBufferSourceNode.cpp:
+            (WebCore::AudioBufferSourceNode::startGrain):
+            * Modules/webaudio/AudioContext.cpp:
+            (WebCore::AudioContext::AudioContext):
+            (WebCore::AudioContext::constructCommon):
+            (WebCore::AudioContext::lazyInitialize):
+            (WebCore::AudioContext::startRendering):
+            * Modules/webaudio/AudioContext.h:
+            (WebCore::AudioContext::userGestureRequiredForAudioStart):
+            (WebCore::AudioContext::addBehaviorRestriction):
+            (WebCore::AudioContext::removeBehaviorRestriction):
+            * Modules/webaudio/AudioDestinationNode.cpp:
+            (WebCore::AudioDestinationNode::render):
+            * Modules/webaudio/AudioScheduledSourceNode.cpp:
+            (WebCore::AudioScheduledSourceNode::start):
</ins><span class="cx"> 
</span><del>-        &quot;Rewrite Function.bind as a builtin&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131083
-        http://trac.webkit.org/changeset/167199
</del><ins>+2013-06-06  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Update test result&quot;
-        http://trac.webkit.org/changeset/167251
</del><ins>+        Expose HTMLCanvasElement supportsContext
+        https://bugs.webkit.org/show_bug.cgi?id=70117
</ins><span class="cx"> 
</span><del>-2014-04-15  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
-
-        Remove unnecessary null checking in NavigatorContentUtils
-        https://bugs.webkit.org/show_bug.cgi?id=131652
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Some functions have checked if document is null. However, document is always not
-        null when frame is existed.
</del><ins>+        Adds the supportsContext function for &lt;canvas&gt; elements as speced here:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-canvas-supportscontext
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior changes.
</del><ins>+        Test: fast/canvas/webgl/canvas-supports-context.html
</ins><span class="cx"> 
</span><del>-        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
-        (WebCore::NavigatorContentUtils::registerProtocolHandler):
-        (WebCore::NavigatorContentUtils::isProtocolHandlerRegistered):
-        (WebCore::NavigatorContentUtils::unregisterProtocolHandler):
</del><ins>+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::get3DContextAttributes): Added.
+        Refactored function from JSHTMLCanvasElement::getContext that parses attributes.
+        (WebCore::JSHTMLCanvasElement::getContext): Updated to use refactored function.
+        (WebCore::JSHTMLCanvasElement::supportsContext): Added.
+        Exposes JS function supportsContext.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): Updated to use refactored functions.
+        (WebCore::HTMLCanvasElement::supportsContext): Added.
+        Implements supportsContext function based on contextId parameter (i.e. '2d').
+        * html/HTMLCanvasElement.h: Added refactored functions from HTMLCanvasElement::getContext.
+        * html/HTMLCanvasElement.idl:
</ins><span class="cx"> 
</span><del>-2014-04-15  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-06-06  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167298.
-        https://bugs.webkit.org/show_bug.cgi?id=131670
</del><ins>+        [CSS Shapes] Rename updateLineBoundariesForExclusions to updateShapeAndSegmentsForCurrentLine
+        https://bugs.webkit.org/show_bug.cgi?id=117308
</ins><span class="cx"> 
</span><del>-        Broke CSS filters (17 test crashes) (Requested by ap on
-        #webkit).
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        We have a standalone specification for CSS Shapes now: http://dev.w3.org/csswg/css-shapes/
+        this change renames updateLineBoundariesForExclusions to updateShapeAndSegmentsForCurrentLine.
</ins><span class="cx"> 
</span><del>-        &quot;[iOS WK2] Pages often blank on first load if page loaded by
-        typing the URL&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131665
-        http://trac.webkit.org/changeset/167298
</del><ins>+        No behavior change, no new tests needed.
</ins><span class="cx"> 
</span><del>-2014-04-14  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::updateLineBoundariesForShapes):
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):
</ins><span class="cx"> 
</span><del>-        Unreviewed. Attempt to fix Windows build after r167277.
</del><ins>+2013-06-06  Diego Pino Garcia  &lt;dpino@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::willPaintContents):
</del><ins>+        [GTK] Parameter 'refChild' from function 'webkit_dom_node_insert_before' should be allowed to be NULL
+        https://bugs.webkit.org/show_bug.cgi?id=117303
</ins><span class="cx"> 
</span><del>-2014-04-14  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Reviewed by Xan Lopez.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167261.
-        https://bugs.webkit.org/show_bug.cgi?id=131667
</del><ins>+        Add parameter 'refChild' to the list of parameters that are allowed to
+        be NULL.
</ins><span class="cx"> 
</span><del>-        broke many navigation tests (Requested by ap on #webkit).
</del><ins>+        * bindings/scripts/CodeGeneratorGObject.pm:
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+2013-06-06  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Web Replay: memoize fallback time values for
-        document.lastModified&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131318
-        http://trac.webkit.org/changeset/167261
</del><ins>+        Fix formatting in BasicShapes.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=117309
</ins><span class="cx"> 
</span><del>-2014-04-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Pages often blank on first load if page loaded by typing the URL
-        https://bugs.webkit.org/show_bug.cgi?id=131665
</del><ins>+        I reformatted the code in BasicShapes.cpp (bug 116734) to fix the
+        style issues, and I got some of the formatting wrong, which makes the
+        code much harder to read. This patch fixes that formatting.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        No new tests, formatting clean up.
</ins><span class="cx"> 
</span><del>-        The document overlay-related code in RemoteLayerTreeDrawingArea::setRootCompositingLayer()
-        was triggering a compositing layer flush when called with a null rootLayer, which happens
-        for pages going into the page cache. This would trigger a layer flush that would clobber
-        the root layer for the visible page, resulting in missing content.
-        
-        Also, rebuildCompositingLayerTree() is called recursively and the m_documentOverlayRootLayer
-        was being added to (and then removed from) every single compositing layers.
-        
-        Fix both these by changing to a pull model, where RenderLayerCompositor requests
-        the overlay layer via ChromeClient, and gets it at the end of every flush,
-        adding to the children of the root layer.
</del><ins>+        * rendering/style/BasicShapes.cpp:
+        (WebCore::BasicShapeRectangle::path): Fix formatting.
+        (WebCore::BasicShapeInsetRectangle::path): Fix formatting.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::documentOverlayLayerForFrame):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::flushPendingLayerChanges): Put visibleRect
-        into a variable for ease of debugging.
-        (WebCore::RenderLayerCompositor::updateCompositingLayers): Asser
-        that we're not in the page cache (this would have caught the bug).
-        (WebCore::RenderLayerCompositor::appendOverlayLayers):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::setDocumentOverlayRootLayer): Deleted.
-        * rendering/RenderLayerCompositor.h:
</del><ins>+2013-06-06  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-14  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        Clean up AddIncludesForType in JSC bindings generators
+        https://bugs.webkit.org/show_bug.cgi?id=117297
</ins><span class="cx"> 
</span><del>-        Assertion failure under FEImage::determineAbsolutePaintRect()
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=131660&gt;
-        &lt;rdar://problem/15669294&gt;
</del><ins>+        Clean up AddIncludesForType in JSC bindings generators:
+        - Add JSC specific SkipIncludeHeader() subroutine and move
+        exceptions there.
+        - Remove special case for SerializedScriptValue by improving
+        the condition for callbacks: &quot;JS&quot; prefix is now only added to
+        headers in callbacks if they are wrapper types. Non-wrapper
+        types such as SerializedScriptValue do not have a JS*.h
+        header.
</ins><span class="cx"> 
</span><del>-        This patch merges Chromium r149536 (see
-        &lt;https://chromiumcodereview.appspot.com/14701012&gt;), which moves
-        m_absoluteTransform out of SVGFilter and into the base Filter class, so
-        that it isn't necessary to cast a Filter to SVGFilter to get the
-        absolute transform.
</del><ins>+        No new tests, code clean up.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        * bindings/scripts/CodeGenerator.pm:
+        (SkipIncludeHeader):
+        - Reuse IsPrimitiveType() to avoid code duplication.
+        - Remove special case for String as this is not a valid IDL type
+        and it is not currently used.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (SkipIncludeHeader):
+        (AddIncludesForType):
</ins><span class="cx"> 
</span><del>-        Test: svg/filters/feImage-filter-assertion.html
</del><ins>+2013-06-06  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/Filter.h:
-        (WebCore::Filter::Filter):
-        Changed to take the absolute transform.
-        (WebCore::Filter::absoluteTransform):
-        Moved from SVGFilter.
-        (WebCore::Filter::mapAbsolutePointToLocalPoint):
-        Ditto.
</del><ins>+        :hover style not applied on hover if its display property is different from original style's
+        https://bugs.webkit.org/show_bug.cgi?id=7555
</ins><span class="cx"> 
</span><del>-        * rendering/FilterEffectRenderer.cpp:
-        (WebCore::FilterEffectRenderer::FilterEffectRenderer):
-        Pass a default AffineTransform() to the Filter base class.
</del><ins>+        Properly apply the :hover pseudo-class when reattaching is required (e.g. when changing the display type)
</ins><span class="cx"> 
</span><del>-        * svg/graphics/filters/SVGFEImage.cpp:
-        (WebCore::FEImage::determineAbsolutePaintRect):
-        Use the Filter without casting it to SVGFilter.
-        (WebCore::FEImage::platformApplySoftware):
-        Ditto.
</del><ins>+        A new AttachContext class was created to be passed along as an optional parameter to the attach/detach/reattach methods.
+        This new parameter is used to:
+            - prevent the element from being removed from the list of hovered/active elements upon detach when a reattach is in progress
+            - prevent the style from being incorrectly computed (due to the previous point)
+            - prevent the style from being computed twice (the attach() method used to recompute it)
</ins><span class="cx"> 
</span><del>-        * svg/graphics/filters/SVGFilter.cpp:
-        (WebCore::SVGFilter::SVGFilter):
-        Pass the transform to the base class, and remove initialization of a
-        removed member var.
</del><ins>+        Special care was required to the case when display:none is specified in the :hover class. Enabling the :hover style
+        was leaving the element without a renderer, which was causing it to remain stuck in the :hover state (subsequent mouseMove
+        events were not able to reset the element to its normal style due to the fact that it had no renderer).
</ins><span class="cx"> 
</span><del>-        * svg/graphics/filters/SVGFilter.h:
-        Member var moved to Filter.h.
</del><ins>+        The DragController::startDrag method was updated to properly handle the case when dragImage is NULL 
+        (for instance by setting display:none inside the -webkit-drag pseudo-class).
</ins><span class="cx"> 
</span><del>-2014-04-14  Darin Adler  &lt;darin@apple.com&gt;
-
-        REGRESSION (r158617): Find on Page can get stuck in a loop when the search string occurs in an &lt;input&gt; in a &lt;fieldset&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=126322
-
-        Reviewed by Ryosuke Niwa.
-
-        One additional tweak to the fix for the bug above.
-        Fixes crash in editing/editability/ignored-content.html test.
-
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::canContainRangeEndPoint): Call through to
-        HTMLElement::canContainRangeEndPoint, bypassing HTMLPlugInElement override
-        that always returns false. Without this change, this function was always
-        returning false.
-
-2014-04-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Crash in TileController::tileRevalidationTimerFired
-        https://bugs.webkit.org/show_bug.cgi?id=131656
-        &lt;rdar://problem/16583166&gt;
-
-        Reviewed by Sam Weinig.
-
-        It's possible for the TileController revalidation timer to fire after
-        the GraphicsLayer has been destroyed, so the PlatformCALayer no longer
-        has an owningGraphicsLayer.
-        
-        Bail from the timer callback if owningGraphicsLayer() is null.
-        
-        Also some drive-by 0 -&gt; nullptr changes.
-
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::willBeDestroyed):
-        * platform/graphics/ca/PlatformCALayer.cpp:
-        (WebCore::PlatformCALayer::~PlatformCALayer):
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::tileRevalidationTimerFired):
-
-2014-04-14  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        [CSS Shapes] Remove some leftover shape-inside code
-        https://bugs.webkit.org/show_bug.cgi?id=131641
-
-        Reviewed by Dean Jackson.
-
-        I discovered that some code had been leftover from the shape-inside
-        removal. This removes that leftover code.
-
-        No new tests, no behavior change.
-
-        * platform/text/BidiResolver.h:
-        * rendering/BidiRun.cpp:
-        (WebCore::BidiRun::BidiRun):
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::createLineBoxes):
-        (WebCore::RenderBlockFlow::constructLine):
-        (WebCore::computeExpansionForJustifiedText):
-        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
-
-2014-04-14  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [MSE][Mac] video.currentTime is sometimes negative.
-        https://bugs.webkit.org/show_bug.cgi?id=131644
-
-        Reviewed by Eric Carlson.
-
-        AVSampleBufferRenderSynchronizer will occasionally return slightly negative values
-        when beginning playback. Clamp the return value to 0.
-
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::currentTimeDouble):
-
-2014-04-14  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        [CSSExclusions] Remove FIXME referencing closed bug
-        https://bugs.webkit.org/show_bug.cgi?id=131645
-
-        Reviewed by Dean Jackson.
-
-        This is silly, but the comment is really confusing as it's entirely
-        wrong now.
-
-        No new tests, no behavior change.
-
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeRequiresRepaint):
-
-2014-04-14  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Build fixage.
-
-        * page/FrameView.cpp:
-
-2014-04-14  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
-
-        Assertion failure !node || node-&gt;isElementNode() in
-        WebCore::RenderBlock::inlineElementContinuation
-  
-        https://bugs.webkit.org/show_bug.cgi?id=108829
-        &lt;rdar://problem/13666405&gt;
-  
-        I can't reproduce this assertion failure, but there seems to be an
-        invalid assumption in RenderBlock::inlineElementContinuation() that
-        anything with the &quot;isInline()&quot; bit set is a RenderInline.
-        
-        No new test because the test case in the bug does not repro for me.
-
-        Reviewed by Brent Fulgham.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::inlineElementContinuation):
-        Dave Hyatt says that this function should only return RenderInline
-        objects (not non-RenderInline inline objects), so update the checks
-        from isInline() to isRenderInline() before casting with
-        toRenderInline().
-
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::inlineElementContinuation):
-        Ditto.
-
-2014-04-14  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Do more things under memory pressure on non-iOS platforms.
-        &lt;https://webkit.org/b/131625&gt;
-
</del><span class="cx">         Reviewed by Antti Koivisto.
</span><span class="cx"> 
</span><del>-        Rename hasReceivedMemoryPressure() to isUnderMemoryPressure() and
-        make it use std::atomic&lt;bool&gt; instead of OSAtomic primitives.
</del><ins>+        Tests: fast/regions/hover-display-block-inline.html
+               fast/regions/hover-display-block-none.html
</ins><span class="cx"> 
</span><del>-        Unmask most of the PLATFORM(IOS) blocks so all platforms can take
-        advantage of optimizations done while under pressure. Note that
-        isUnderMemoryPressure() will still always return false on platforms
-        other than iOS/WK1, but this will change soon.
</del><ins>+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::attach):
+        (WebCore::ContainerNode::detach):
+        * dom/ContainerNode.h:
+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        (WebCore::Document::updateHoverActiveState):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::setHovered):
+        (WebCore::Element::createRendererIfNeeded):
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        (WebCore::Element::recalcStyle):
+        * dom/Element.h:
+        * dom/Node.cpp:
+        (WebCore::Node::AttachDetachContext::AttachDetachContext):
+        (WebCore::Node::AttachDetachContext::~AttachDetachContext):
+        (WebCore::Node::attach):
+        (WebCore::Node::detach):
+        * dom/Node.h:
+        (WebCore::Node::reattach):
+        (WebCore::Node::reattachIfAttached):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/PseudoElement.cpp:
+        (WebCore::PseudoElement::attach):
+        * dom/PseudoElement.h:
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::attach):
+        * dom/ShadowRoot.h:
+        * dom/Text.cpp:
+        (WebCore::Text::attach):
+        * dom/Text.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::attach):
+        * html/HTMLCanvasElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::attach):
+        * html/HTMLFrameElement.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::attach):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::attach):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        (WebCore::HTMLInputElement::detach):
+        * html/HTMLInputElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::attach):
+        * html/HTMLLIElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::attach):
+        * html/HTMLMediaElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::attach):
+        (WebCore::HTMLOptGroupElement::detach):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::attach):
+        (WebCore::HTMLOptionElement::detach):
+        * html/HTMLOptionElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::detach):
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::attach):
+        (WebCore::HTMLPlugInImageElement::detach):
+        * html/HTMLPlugInImageElement.h:
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::attach):
+        * html/HTMLProgressElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::attach):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::attach):
+        * html/HTMLVideoElement.h:
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocument::detach):
+        * html/PluginDocument.h:
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::attach):
+        (WebCore::InsertionPoint::detach):
+        * html/shadow/InsertionPoint.h:
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::detach):
+        * html/shadow/SliderThumbElement.h:
+        * html/shadow/SpinButtonElement.cpp:
+        (WebCore::SpinButtonElement::detach):
+        * html/shadow/SpinButtonElement.h:
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::detach):
+        (WebCore::InputFieldSpeechButtonElement::attach):
+        (WebCore::InputFieldSpeechButtonElement::detach):
+        * html/shadow/TextControlInnerElements.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * loader/PlaceholderDocument.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::attach):
+        * svg/SVGImageElement.h:
</ins><span class="cx"> 
</span><del>-        * history/PageCache.cpp:
-        (WebCore::PageCache::canCache):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::willPaintContents):
-        (WebCore::FrameView::didPaintContents):
-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::MemoryPressureHandler):
-        * platform/MemoryPressureHandler.h:
-        (WebCore::MemoryPressureHandler::isUnderMemoryPressure):
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::setReceivedMemoryPressure):
-        (WebCore::MemoryPressureHandler::clearMemoryPressure):
-        (WebCore::MemoryPressureHandler::respondToMemoryPressureIfNeeded):
-        (WebCore::MemoryPressureHandler::hasReceivedMemoryPressure): Deleted.
-        * platform/graphics/FontCache.cpp:
-        (WebCore::FontCache::purgeInactiveFontDataIfNeeded):
-        * platform/ios/LegacyTileCache.mm:
-        (WebCore::LegacyTileCache::createTilesInActiveGrid):
-        * platform/ios/LegacyTileGrid.mm:
-        (WebCore::LegacyTileGrid::shouldUseMinimalTileCoverage):
-        * platform/ios/LegacyTileLayerPool.mm:
-        (WebCore::LegacyTileLayerPool::addLayer):
-        * platform/ios/TileControllerMemoryHandlerIOS.cpp:
-        (WebCore::TileControllerMemoryHandler::tileControllerGainedUnparentedTiles):
</del><ins>+2013-06-06  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-14  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        ENABLE(PAN_SCROLLING) AutoscrollController::updateAutoscrollRenderer calls hitTestResultAtPoint with `true` for HitTestRequestType
+        https://bugs.webkit.org/show_bug.cgi?id=116896
</ins><span class="cx"> 
</span><del>-        RenderLayerCompositor's m_layerForOverhangAreas should be offset by the 
-        topContentInset
-        https://bugs.webkit.org/show_bug.cgi?id=131632
-        -and corresponding-
-        &lt;rdar://problem/16609602&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Update hitTestResultAtPoint call to new API.
</ins><span class="cx"> 
</span><del>-        Offset m_layerForOverhangAreas by the topContentInset. 
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
</del><ins>+        * page/AutoscrollController.cpp:
+        (WebCore::AutoscrollController::updateAutoscrollRenderer):
</ins><span class="cx"> 
</span><del>-2014-04-14  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-06-06  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Eliminate CachedFrame::m_mousePressNode
-        https://bugs.webkit.org/show_bug.cgi?id=131626
</del><ins>+        ResourceLoader::resourceData() should not return a PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=117288
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        I couldn't find any observable effect of this change.
</del><ins>+        Change ResourceLoader::resourceData() to return a raw pointer
+        instead of a PassRefPtr since we don't want to transfer the
+        ownership of the resource data. Also pass a raw pointer to
+        CachedResource::data() so that the cached resource can decide
+        whether to take a reference of the data or not, for example,
+        CachedRawResource only takes a reference when buffering policy is
+        BufferData.
</ins><span class="cx"> 
</span><del>-        * history/CachedFrame.cpp:
-        (WebCore::CachedFrameBase::CachedFrameBase):
-        (WebCore::CachedFrameBase::restore):
-        (WebCore::CachedFrame::clear):
-        * history/CachedFrame.h:
-        (WebCore::CachedFrame::documentLoader):
-        (WebCore::CachedFrame::mousePressNode): Deleted.
-        Eliminated m_mousePressNode, accessor, and code that reached out to EventHandler.
</del><ins>+        * html/ImageDocument.cpp:
+        (WebCore::ImageDocumentParser::appendBytes):
+        (WebCore::ImageDocumentParser::finish):
+        * loader/ResourceLoader.cpp:
+        * loader/ResourceLoader.h:
+        (WebCore::ResourceLoader::resourceData):
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::sendDataToResource):
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::data):
+        * loader/cache/CachedCSSStyleSheet.h:
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::data):
+        * loader/cache/CachedFont.h:
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::data):
+        * loader/cache/CachedImage.h:
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::data):
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::data):
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedSVGDocument.cpp:
+        (WebCore::CachedSVGDocument::data):
+        * loader/cache/CachedSVGDocument.h:
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::data):
+        * loader/cache/CachedScript.h:
+        * loader/cache/CachedShader.cpp:
+        (WebCore::CachedShader::data):
+        * loader/cache/CachedShader.h:
+        * loader/cache/CachedTextTrack.cpp:
+        (WebCore::CachedTextTrack::data):
+        * loader/cache/CachedTextTrack.h:
+        * loader/cache/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::data):
+        * loader/cache/CachedXSLStyleSheet.h:
</ins><span class="cx"> 
</span><del>-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::mousePressNode): Deleted.
-        (WebCore::EventHandler::setMousePressNode): Deleted.
-        * page/EventHandler.h:
-        (WebCore::EventHandler::setMousePressed): Deleted. This function was already unused.
</del><ins>+2013-06-06  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        AX: iOS ignores ARIA progressbar elements
+        https://bugs.webkit.org/show_bug.cgi?id=116727
</ins><span class="cx"> 
</span><del>-        Run filter animations in the UI process with UI-side compositing
-        https://bugs.webkit.org/show_bug.cgi?id=131199
-        &lt;rdar://problem/16479487&gt;
</del><ins>+        Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Make this an accessible element on iOS.
</ins><span class="cx"> 
</span><del>-        Add FilterOperation::clone() which is used during decoding.
-        Export some things.
</del><ins>+        Test: platform/iphone-simulator/accessibility/progressbar.html
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/filters/FilterOperation.h:
</del><ins>+        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+        (-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):
+        (-[WebAccessibilityObjectWrapper _accessibilityMinValue]):
+        (-[WebAccessibilityObjectWrapper _accessibilityMaxValue]):
</ins><span class="cx"> 
</span><del>-2014-04-14  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-06-06  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Use after free in WebCore::CachedResourceHandleBase::~CachedResourceHandleBase / WebCore::removeDetachedChildrenInContainer
-        https://bugs.webkit.org/show_bug.cgi?id=131169
</del><ins>+        Remove unused HashValueForClassAndName() from JSC bindings generator
+        https://bugs.webkit.org/show_bug.cgi?id=117292
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Invalidate the WebCoreAVFResourceLoader owned by MediaPlayerPrivateAVFoundationObjC
-        in its destructor, to prevent a private function being called in response to the
-        WebCoreAVFResourceLoader being stopped.
</del><ins>+        Remove HashValueForClassAndName() subroutine from JSC bindings generator
+        as it is dead code.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC):
-        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
-        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
-        (WebCore::WebCoreAVFResourceLoader::invalidate):
</del><ins>+        No new tests, code clean up.
</ins><span class="cx"> 
</span><del>-2014-04-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * bindings/scripts/CodeGeneratorJS.pm:
</ins><span class="cx"> 
</span><del>-        [WK2 iOS] Scrolling to anchor links is broken
-        https://bugs.webkit.org/show_bug.cgi?id=131618
-        &lt;rdar://problem/16599144&gt;
</del><ins>+2013-06-06  Gwang Yoon Hwang  &lt;ryumiel@company100.net&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Cannot set a new timer inside of timer callback in RunLoopTimerGtk &amp; RunLoopTimerEFL
+        https://bugs.webkit.org/show_bug.cgi?id=117224
</ins><span class="cx"> 
</span><del>-        Have ScrollingTreeScrollingNode pass RequestedScrollPosition updates
-        to the scrolling tree, so that the scrolling tree can have custom behavior
-        for them if necessary.
</del><ins>+        Reviewed by Christophe Dumez.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingTree.h:
-        (WebCore::ScrollingTree::scrollingTreeNodeRequestsScroll):
-        * page/scrolling/ScrollingTreeScrollingNode.cpp:
-        (WebCore::ScrollingTreeScrollingNode::updateAfterChildren):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
</del><ins>+        RunLoopTimer should clear its isActive flag before invoking timer
+        callback.
</ins><span class="cx"> 
</span><del>-2014-04-14  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+        * platform/efl/RunLoopEfl.cpp:
+        (WebCore::RunLoop::TimerBase::timerFired):
+        * platform/gtk/RunLoopGtk.cpp:
+        (WebCore::RunLoop::TimerBase::timerFiredCallback):
</ins><span class="cx"> 
</span><del>-        Web Replay: memoize fallback time values for document.lastModified
-        https://bugs.webkit.org/show_bug.cgi?id=131318
</del><ins>+2013-06-06  Diego Pino Garcia  &lt;dpino@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        [GTK] Parameters 'inResult' and 'resolver' from function 'webkit_dom_document_evaluate' should be allowed to be NULL
+        https://bugs.webkit.org/show_bug.cgi?id=117129
</ins><span class="cx"> 
</span><del>-        If a document's Last-Modified header can't be found or used, then 
-        document.lastModified is derived from the current system time or
-        from filesystem data, which is obviously nondeterministic.
</del><ins>+        Reviewed by Xan Lopez.
</ins><span class="cx"> 
</span><del>-        It's better to handle this inside Document::lastModified rather than using
-        MemoizedDOMResult, because only the fallback case is nondeterministic.
-
-        Test: http/tests/inspector/replay/document-last-modified-fallback-value.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::lastModified): Save or reuse memoized fallback value.
-        * replay/WebInputs.json: Add input DocumentLastModifiedDate.
-
-2014-04-12  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Keep secondary tile grid for zoomed-out scale
-        https://bugs.webkit.org/show_bug.cgi?id=131586
-
-        Reviewed by Darin Adler.
-
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateContentsScale):
</del><ins>+        At this moment there was a temporary fix that allowed parameter
+        'inResult' to be NULL (see: webk.it/42115). However, there was no fix
+        for parameter 'resolver'.
</ins><span class="cx">         
</span><del>-            Don't repaint tiled backing with setNeedsDisplay, it invalidates itself correctly in setContentsScale.
-            Update custom child layers when tiled backing scale changes.
</del><ins>+        This patch refactors the code of the previous fix, moving the code for
+        determine whether a parameter can be NULL or not to GetGReturnMacro.
+        The solution is quite general and will alow to add other parameters in
+        the future if needed. 
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::TileController):
-        (WebCore::TileController::setNeedsDisplay):
-        
-            Drop the whole zoomed-out grid on full repaint.
</del><ins>+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GetGReturnMacro): Pass functionName, as in some cases the code
+        generated depends on the paramName and the functionName
+        (ParamCanBeNull): Checks if a parameter is allowed to be NULL 
+        (GenerateFunction):
</ins><span class="cx"> 
</span><del>-        (WebCore::TileController::setNeedsDisplayInRect):
-            
-            Drop changed zoomed-out tiles. A more sophisticated strategy is possible.
</del><ins>+2013-06-06  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::TileController::setContentsScale):
-        
-            Swap the zoomed-out grid in and out as needed.
-            Repaint the active grid after scale change so the client does not have to.
</del><ins>+        SVG objects are misplaced when SVG root has CSS transform.
+        https://bugs.webkit.org/show_bug.cgi?id=117252
</ins><span class="cx"> 
</span><del>-        (WebCore::TileController::contentsScale):
-        
-            Get the content scale from the tile grid so it is not kept in two places.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        (WebCore::TileController::zoomedOutContentsScale):
-        (WebCore::TileController::setZoomedOutContentsScale):
-        
-            Drop the zoomed-out grid if it no longer matches the zoomed-out scale.
</del><ins>+        Update layer transforms for SVG if needed.
</ins><span class="cx"> 
</span><del>-        (WebCore::TileController::tileRevalidationTimerFired):
-        (WebCore::TileController::retainedTileBackingStoreMemory):
-        (WebCore::TileController::containerLayers):
-        
-            Return both zoomed-out tiles and the active tiles. Active tiles are on top.
</del><ins>+        SVG root, similarly to RenderBlock needs to call RenderLayer
+        to get transforms updated after layout, in order to
+        position the transformed objects properly.
</ins><span class="cx"> 
</span><del>-        (WebCore::TileController::numberOfUnparentedTiles):
-        (WebCore::TileController::removeUnparentedTilesNow):
-        * platform/graphics/ca/mac/TileGrid.h:
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::dropTilesInRect):
-        
-            Add a function for dropping tiles.
</del><ins>+        Test: fast/transforms/transform-svg.html
</ins><span class="cx"> 
</span><del>-        (WebCore::TileGrid::revalidateTiles):
</del><ins>+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
</ins><span class="cx"> 
</span><del>-2014-04-14  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+2013-06-06  Jae Hyun Park  &lt;jae.park@company100.net&gt;
</ins><span class="cx"> 
</span><del>-        Update test result
</del><ins>+        Coordinated Graphics : Refactor CoordinatedSurface to manage the lifecycle of GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=108899
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
-        (WebCore::JSTestNondeterministicConstructor::finishCreation):
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-2014-04-14  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        This is a preparation patch for Threaded Coordinated Graphics.
</ins><span class="cx"> 
</span><del>-        Optimize Canvas fill and drawImage with SourceIn, DestinationIn, SourceOut, and DestinationAtop using transparencyLayer.
-        https://bugs.webkit.org/show_bug.cgi?id=79659
</del><ins>+        This patch changes CoordinatedSurface to be responsible for the
+        lifecycle of GraphicsContext used in Coordinated Graphics System.
+        CoordinatedImageBacking and UpdateAtlas do not ask for the ownership
+        of GraphicsContext anymore. Instead, those classes use client pattern to
+        ask the CoordiantedSurface to paint to the GraphicsContext.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        This refactoring is needed to implement CoordinatedSurface for Threaded
+        Coordinated Graphics.
</ins><span class="cx"> 
</span><del>-        Optimize fill() and fillRect() operations in Canvas on composited contexts by
-        10 to 20 times on CG.
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Replacing the ImageBuffer code by transparency layers allows the
-        graphics library to optimize the drawing.
</del><ins>+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::paintToSurface):
+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
+        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
+        (WebCore::ImageBackingSurfaceClient::ImageBackingSurfaceClient):
+        (WebCore::CoordinatedImageBacking::update):
+        * platform/graphics/texmap/coordinated/CoordinatedSurface.h:
+        (WebCore::CoordinatedSurface::Client::~Client):
+        * platform/graphics/texmap/coordinated/CoordinatedTile.cpp:
+        (WebCore::CoordinatedTile::updateBackBuffer):
+        (WebCore::CoordinatedTile::paintToSurfaceContext):
+        * platform/graphics/texmap/coordinated/CoordinatedTile.h:
+        * platform/graphics/texmap/coordinated/UpdateAtlas.cpp:
+        (WebCore::UpdateAtlasSurfaceClient::UpdateAtlasSurfaceClient):
+        (WebCore::UpdateAtlas::paintOnAvailableBuffer):
+        * platform/graphics/texmap/coordinated/UpdateAtlas.h:
</ins><span class="cx"> 
</span><del>-        Doing the same for drawImage() would give performance regressions.
</del><ins>+2013-06-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        An inline function will create a transparency layer for CG. Cairo graphics
-        does not composite correctly when a transparency layer gets created. 
-        The inline function is just a NOOP for Cairo.
</del><ins>+        Revert the second half of r151257. WebGLRenderingContext::create can return null.
</ins><span class="cx"> 
</span><del>-        This fixes bug 131303 as well.
</del><ins>+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
</ins><span class="cx"> 
</span><del>-        Added performance tests with r167124 already.
</del><ins>+2013-06-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::fillInternal):
-        (WebCore::CanvasRenderingContext2D::strokeInternal):
-        (WebCore::CanvasRenderingContext2D::beginCompositeLayer):
-        (WebCore::CanvasRenderingContext2D::endCompositeLayer):
-        (WebCore::CanvasRenderingContext2D::fillRect):
-        (WebCore::CanvasRenderingContext2D::strokeRect):
-        (WebCore::CanvasRenderingContext2D::drawTextInternal):
-        (WebCore::CanvasRenderingContext2D::fullCanvasCompositedFill): Deleted.
-        * html/canvas/CanvasRenderingContext2D.h:
</del><ins>+        Remove unnecessary null check in HTMLCanvasElement.cpp.
</ins><span class="cx"> 
</span><del>-2014-04-14  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Rubber-stamped by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Lots of compositing test failures after r167152
-        https://bugs.webkit.org/show_bug.cgi?id=131574
</del><ins>+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-06-05  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::dumpChildren):
-        (WebCore::GraphicsLayer::dumpProperties):
-        Make child-dumping recursive so that we can easily skip layers up to any depth.
</del><ins>+        [curl] Add implementation for HTTP PUT method.
+        https://bugs.webkit.org/show_bug.cgi?id=117256
</ins><span class="cx"> 
</span><del>-2014-04-14  Peter Molnar  &lt;pmolnar.u-szeged@partner.samsung.com&gt;
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Fix incorrect indentations in CodeGeneratorJS.pm introduced in r165521
-        https://bugs.webkit.org/show_bug.cgi?id=131613
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::getFormSize):
+        (WebCore::setupFormData):
+        (WebCore::ResourceHandleManager::setupPUT):
+        (WebCore::ResourceHandleManager::setupPOST):
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        Fixed 5-space indentation.
-        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
-        Updated the tests accordingly.
</del><ins>+2013-06-05  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-2014-04-14  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+        [curl] Normalize mime type information
+        https://bugs.webkit.org/show_bug.cgi?id=117194
</ins><span class="cx"> 
</span><del>-        [JSC] CSSStyleDeclaration report incorrect descriptor
-        https://bugs.webkit.org/show_bug.cgi?id=89697
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        * platform/MIMETypeRegistry.cpp: Enable MIME type normalization for curl.
</ins><span class="cx"> 
</span><del>-        Change descriptor of CSSStyleDeclaration properties in order to have
-        writable and enumerable attributes set to true. Configurable is kept to
-        false since the property is not deleteable.
</del><ins>+2013-06-05  Xueqing Huang  &lt;huangxueqing@baidu.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/CSSStyleDeclaration/cssstyledeclaration-properties-descriptor.html
</del><ins>+        Move OleGetClipboard to Pasteboard::createForCopyAndPaste.
+        https://bugs.webkit.org/show_bug.cgi?id=117064
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::getOwnPropertySlotDelegate): Only set
-        DontDelete attribute when creating the descriptor for
-        CSSStyleDeclaration properties.
-
-2014-04-14  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        [JSC] Improve the call site of string comparison in some hot path
-        https://bugs.webkit.org/show_bug.cgi?id=131605
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::NodeListCacheMapEntryHash::equal):
-        We should use the right comparison operation depending on the Hash Traits.
</del><ins>+        No behavior change, no new tests.
</ins><span class="cx"> 
</span><del>-2014-04-14  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * platform/win/EditorWin.cpp:
+        (WebCore::Editor::newGeneralClipboard): Editor should not create IDataObject explicitly then set it to Pasteboard.
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::createForCopyAndPaste): Construct a Pasteboard and create IDataObject by &quot;OleGetClipboard&quot;.
</ins><span class="cx"> 
</span><del>-        Merge MemoryPressureHandler{Mac,IOS}.mm
-        &lt;https://webkit.org/b/131603&gt;
</del><ins>+2013-06-05  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Join the iOS and Mac platform implementations of MemoryPressureHandler
-        under the shared Cocoa banner. Each platform still has its own quirky
-        behavior, but this puts them in the same file so we can start sharing.
</del><ins>+        WebSQL forces 16-bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=116935
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm: Renamed from Source/WebCore/platform/mac/MemoryPressureHandlerMac.mm.
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
-        (WebCore::MemoryPressureHandler::install):
-        (WebCore::MemoryPressureHandler::uninstall):
-        (WebCore::MemoryPressureHandler::holdOff):
-        (WebCore::MemoryPressureHandler::respondToMemoryPressure):
-        (WebCore::respondToMemoryPressureCallback):
-        (WebCore::MemoryPressureHandler::installMemoryReleaseBlock):
-        (WebCore::MemoryPressureHandler::setReceivedMemoryPressure):
-        (WebCore::MemoryPressureHandler::hasReceivedMemoryPressure):
-        (WebCore::MemoryPressureHandler::clearMemoryPressure):
-        (WebCore::MemoryPressureHandler::shouldWaitForMemoryClearMessage):
-        (WebCore::MemoryPressureHandler::respondToMemoryPressureIfNeeded):
-        * platform/ios/MemoryPressureHandlerIOS.mm: Removed.
</del><ins>+        Merge chromium 49c9632ac135f6f06e623a7a81d9da1f6bb7196f.
+        https://chromium.googlesource.com/chromium/blink/+/49c9632ac135f6f06e623a7a81d9da1f6bb7196f
</ins><span class="cx"> 
</span><del>-2014-04-14  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        * platform/sql/SQLiteStatement.cpp:
+        (WebCore::SQLiteStatement::getColumnValue):
</ins><span class="cx"> 
</span><del>-        CSS JIT: compile the :nth-child() pseudo class
-        https://bugs.webkit.org/show_bug.cgi?id=131602
</del><ins>+2013-06-05  Bear Travis  &lt;betravis@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        [CSS Exclusions][CSS Shapes] Split CSS Exclusions &amp; Shapes compile &amp; runtime flags
+        https://bugs.webkit.org/show_bug.cgi?id=117172
</ins><span class="cx"> 
</span><del>-        Tests: fast/selectors/nth-child-bounds.html
-               fast/selectors/nth-child-with-backtracking.html
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        Compile the :nth-child() pseudo class function + some related clean up.
</del><ins>+        This patch adds a new compile and runtime flag for the CSS Shapes feature, which
+        has split off from the previous CSS Exclusions and Shapes specification. The
+        specifications are available here:
+        http://dev.w3.org/csswg/css-exclusions/
+        http://dev.w3.org/csswg/css-shapes/
</ins><span class="cx"> 
</span><del>-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::nthA):
-        (WebCore::CSSSelector::nthB):
-        Expose the parsed value of an+b filters. Those values are used to compile
-        the selector.
</del><ins>+        The changes introduce a new CSS_SHAPES compile flag, and a new cssShapesEnabled
+        runtime flag. In general, the code changes are simple renames.
</ins><span class="cx"> 
</span><del>-        (WebCore::CSSSelector::RareData::parseNth):
-        While working on the patch, I discovered some severe issues with the parsing of large
-        values of a and/or b. The problem comes from the way the CSS parser handle the values:
-        the values are parsed as a double then converted to an AtomicString for CSSSelector.
</del><ins>+        Refactoring, no new tests.
</ins><span class="cx"> 
</span><del>-        There are many problems related to large values but we never got bug reports because
-        they are very uncommon. Fixing those problem would require changing the parser.
-
-        Here, CSSSelector::RareData::parseNth() is hardened a little bit to avoid absurd values
-        of a and b.
-
-        * css/CSSSelector.h:
-        * cssjit/RegisterAllocator.h:
-        It looks like I forgot RDX in the list of register. Add it now since it is required
-        for SelectorCodeGenerator::modulo().
-
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::addPseudoType):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::modulo):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::moduloIsZero):
-        There is no modulo() operation exposed on the macro assemblers. This is a basic
-        implementation on top of idiv for x86_64.
-
-        Since idiv works exclusively with RAX and RDX, most of the code is about getting
-        those registers efficiently.
-
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
-        (WebCore::SelectorCompiler::setElementChildIndex):
-        (WebCore::SelectorCompiler::setElementChildIndexAndUpdateStyle):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild):
-        This is pretty much a straightforward implementation of :nth-child().
-        The first part counts the number of previous elements.
-        The second part updates the tree if this is style resolution.
-        The last part compares the number of previous siblings to an+b to find if the filter matches.
-
-        The only part that diverges from SelectorChecker is how childIndex is used. Instead of testing it
-        at every iteration, only the first iteration handle the cache.
-
-        * dom/ElementRareData.h:
-        (WebCore::ElementRareData::childIndexMemoryOffset):
-        * dom/Node.h:
-        (WebCore::Node::rareDataMemoryOffset):
-        (WebCore::Node::flagHasRareData):
-        * rendering/style/RenderStyle.h:
-
-2014-04-14  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        Support setting a background color on page overlays
-        https://bugs.webkit.org/show_bug.cgi?id=131600
-
-        Reviewed by Darin Adler.
-
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::setDocumentOverlayRootLayer):
-        Mark the compositing tree as needing a rebuild when we get a new document-relative
-        overlay layer; otherwise we were depending on something else coming along and
-        requiring a rebuild, which didn't always happen.
-
-2014-04-14  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
-
-        [CSS Regions] Hit testing doesn't work in video
-        https://bugs.webkit.org/show_bug.cgi?id=131485
-
-        Reviewed by Andrei Bucur.
-
-        When hit testing flow thread layer through the region layer,
-        we have to pass the depth sorting information and take that
-        into account for the situation in which an ancestor of the region
-        has preserve-3d transform style.
-
-        Test: fast/regions/hit-test-region-preserve3d-container.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::hitTestFlowThreadIfRegionForFragments):
-        * rendering/RenderLayer.h:
-
-2014-04-13  Darin Adler  &lt;darin@apple.com&gt;
-
-        userVisibleString should not try to &quot;encode&quot; host names
-        https://bugs.webkit.org/show_bug.cgi?id=131587
-        rdar://problem/14686849
-
-        Reviewed by Alexey Proskuryakov.
-
-        * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.
-
-        * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
-        Objective-C++ header compile in plain C++ files, which we never need to do.
-        Added missing argument name, baseURL, and changed mysterious CFIndex arguments
-        to the correct type, CFURLComponentType.
-
-        * platform/mac/WebCoreNSURLExtras.mm:
-        (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
-        more lookalike characters from the Mozilla list referenced here.
-        (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
-        (WebCore::dataForURLComponentType): Ditto.
-        (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
-        needed; no encoding here.
-
-2014-04-13  Darin Adler  &lt;darin@apple.com&gt;
-
-        REGRESSION (r158617): Find on Page can get stuck in a loop when the search string occurs in an &lt;input&gt; in a &lt;fieldset&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=126322
-
-        Reviewed by Ryosuke Niwa.
-
-        * dom/Element.cpp:
-        (WebCore::Element::canContainRangeEndPoint): Now returns false when the role of the element
-        is &quot;img&quot;. This is the same rule that's hard-coded in isRenderReplacedElement for the same
-        reason. Need more test coverage to make sure this role feature works consistently.
-
-        * dom/Element.h: Made canContainRangeEndPoint no longer inline since it's not just a
-        return statement any more.
-
-        * dom/Position.cpp:
-        (WebCore::Position::isCandidate): Took out code that calls isRendererReplacedElement
-        that was added in r158617; not needed now that we updated canContainRangeEndPoint.
-
-        * dom/Range.cpp:
-        (WebCore::Range::firstNode): Removed code here that called isRendererReplacedElement.
-        This was the wrong level to be adding editing logic, and there's a FIXME here to that
-        effect, which we are now deleting. This was the change that broke Find.
-
-        * editing/TextIterator.cpp: Added a comment about the redundancy between the
-        isRendererReplacedElement and editingIgnoresContent functions.
-
-        * html/HTMLHRElement.cpp:
-        (WebCore::HTMLHRElement::canContainRangeEndPoint): Call through to base class instead
-        of just returning true when we have child nodes. Lets Element::canContainRangeEndPoint
-        do its thing.
-        * html/HTMLHRElement.h: Ditto.
-
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::canContainRangeEndPoint): Call through to base class instead
-        of just returning true when we have fallback content. Lets Element::canContainRangeEndPoint
-        do its thing.
-        * html/HTMLObjectElement.h: Ditto.
-
-        * testing/Internals.cpp:
-        (WebCore::Internals::countMatchesForText): Set the limit to 1000 instead of infinite.
-
-2014-04-12  Darin Adler  &lt;darin@apple.com&gt;
-
-        Use unique_ptr for FillLayer::m_next
-        https://bugs.webkit.org/show_bug.cgi?id=75222
-
-        Reviewed by Dan Bernstein.
-
</del><ins>+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setCSSShapesEnabled):
+        (WebCore::RuntimeEnabledFeatures::cssShapesEnabled):
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::ComputedStyleExtractor::propertyValue):
+        * css/CSSParser.cpp:
+        (WebCore::isSimpleLengthPropertyID):
+        (WebCore::CSSParser::parseValue):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
</ins><span class="cx">         * css/DeprecatedStyleBuilder.cpp:
</span><del>-        (WebCore::ApplyPropertyFillLayer::applyInheritValue):
-        Renamed currChild to just child and prevChild to previousChild.
-        Changed code to pass ownership of the new FillLayer immediately.
-        Changed some loops to be for loops.
-        (WebCore::ApplyPropertyFillLayer::applyInitialValue): Ditto.
-        (WebCore::ApplyPropertyFillLayer::applyValue): Ditto.
-
</del><ins>+        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::applyProperty):
+        (WebCore::StyleResolver::loadPendingImages):
+        * page/animation/CSSPropertyAnimation.cpp:
+        (WebCore::CSSPropertyAnimation::ensurePropertyMap):
+        * rendering/BidiRun.h:
+        (WebCore::BidiRun::BidiRun):
+        * rendering/ExclusionShapeInfo.cpp:
+        * rendering/ExclusionShapeInfo.h:
+        * rendering/ExclusionShapeInsideInfo.cpp:
+        * rendering/ExclusionShapeInsideInfo.h:
+        * rendering/ExclusionShapeOutsideInfo.cpp:
+        * rendering/ExclusionShapeOutsideInfo.h:
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/LayoutState.h:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::exclusionInfoRequiresRelayout):
+        (WebCore::RenderBlock::updateRegionsAndExclusionsBeforeChildLayout):
+        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::computeLogicalLocationForFloat):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::::collectIfNeeded):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::xPositionForFloatIncludingMargin):
+        (WebCore::RenderBlock::yPositionForFloatIncludingMargin):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::FloatIntervalSearchAdapter):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::LineWidth):
+        (WebCore::LineWidth::updateAvailableWidth):
+        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::computeExpansionForJustifiedText):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForSegment):
+        (WebCore::constructBidiRunsForLine):
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
</ins><span class="cx">         * rendering/RenderBox.cpp:
</span><del>-        (WebCore::RenderBox::backgroundHasOpaqueTopLayer): Use reference
-        instead of pointer.
-        (WebCore::RenderBox::paintFillLayers): Ditto.
</del><ins>+        (WebCore::RenderBox::willBeDestroyed):
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBox.h:
</ins><span class="cx">         * rendering/RenderBoxModelObject.cpp:
</span><del>-        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Ditto.
-
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::FillLayer): Removed m_next initializer since it is now an
-        OwnPtr and initializes automatically. In a couple other places, changed m_next
-        initializer to use make_unique.
-        (WebCore::FillLayer::~FillLayer): Wrote loop for deletion of m_next.
-        (WebCore::FillLayer::operator=): Removed unneeded explicit deletion of m_next.
-        (WebCore::FillLayer::cullEmptyLayers): Ditto.
-        (WebCore::clipMax): Marked inline.
-        (WebCore::FillLayer::computeClipMax): Rewrote to use a loop instead of recursion.
-        (WebCore::FillLayer::containsImage): Ditto.
-        (WebCore::FillLayer::imagesAreLoaded): Ditto.
-        (WebCore::FillLayer::hasOpaqueImage): Rewrote to use &amp;&amp; instead of multiple if.
-        (WebCore::FillLayer::hasImage): Rewrote to use a loop instead of recursion.
-        (WebCore::FillLayer::hasFixedImage): Ditto.
-
-        * rendering/style/FillLayer.h: Changed m_next to be a unique_ptr.
-
-2014-04-13  Andy Estes  &lt;aestes@apple.com&gt;
-
-        [QuickLook] Move file system-related code into WebKit
-        https://bugs.webkit.org/show_bug.cgi?id=131597
-
-        Reviewed by Dan Bernstein.
-
-        QuickLookHandle should not be responsible for saving a copy of the
-        original document to disk as it might be running in a process that
-        either can't write to disk or can only write into a sandboxed
-        container. To account for this, we need to separate the concern of
-        quick look conversion from that of original document saving so that
-        each activity can run in the appropriate process.
-
-        Created a new interface between WebCore and WebKit by adding a client
-        (QuickLookHandleClient) to QuickLookHandle which is notified of incoming
-        bytes. A new function on FrameLoaderClient tells WebKit when a new
-        QuickLookHandle is created, giving WebKit the opportunity to register a
-        handle client. Moved the existing file system-related code as well as
-        code only needed by WebKit1 in QuickLookHandle into a new WebKit1
-        QuickLookHandleClient subclass.
-
-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj: Made QuickLookHandleClient.h Private.
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::didCreateQuickLookHandle): Added.
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::didCreateQuickLookHandle): Called FrameLoaderClient::didCreateQuickLookHandle().
-        * loader/ResourceLoader.h:
-        * platform/network/ResourceHandle.h: Made m_quickLook a unique_ptr.
-        (WebCore::ResourceHandle::setQuickLookHandle): Changed to take a unique_ptr.
-        * platform/network/ResourceHandleClient.h:
-        (WebCore::ResourceHandleClient::didCreateQuickLookHandle): Added.
-        * platform/network/ios/QuickLook.h: Added m_client, gave m_converter a stronger type, and made m_nsResponse a RetainPtr.
-        (WebCore::QuickLookHandle::setClient): Added.
-        (WebCore::QuickLookHandle::firstRequestURL): Added.
-        (WebCore::QuickLookHandle::converter): Added.
-        * platform/network/ios/QuickLook.mm:
-        (WebCore::registerQLPreviewConverterIfNeeded):
-        (WebCore::createTemporaryFileForQuickLook): Made non-static.
-        (WebCore::emptyClient): Returned a shared empty QuickLookHandleClient.
-        (WebCore::QuickLookHandle::QuickLookHandle): Removed file system and WebKit1-only code.
-        (WebCore::QuickLookHandle::create): Changed to return a unique_ptr.
-        (WebCore::QuickLookHandle::nsResponse):
-        (WebCore::QuickLookHandle::didReceiveDataArray): Removed file system code and called QuickLookHandleClient::didReceiveDataArray() instead.
-        (WebCore::QuickLookHandle::didReceiveData): Removed file system code and called QuickLookHandleClient::didReceiveData() instead.
-        (WebCore::QuickLookHandle::didFinishLoading): Removed file system code and called QuickLookHandleClient::didFinishLoading() instead.
-        (WebCore::QuickLookHandle::didFail): Removed file system and WebKit1-only code, calling QuickLookHandleClient::didFail() instead.
-        (WebCore::QuickLookHandle::~QuickLookHandle): Removed file system and WebKit1-only code. Cleared our reference to m_client.
-        (WebCore::QuickLookHandle::previewFileName): Retrieved from m_converter.
-        (WebCore::QuickLookHandle::previewRequestURL): Ditto.
-        * platform/network/ios/QuickLookHandleClient.h: Added.
-        (WebCore::QuickLookHandleClient::~QuickLookHandleClient):
-        (WebCore::QuickLookHandleClient::didReceiveDataArray):
-        (WebCore::QuickLookHandleClient::didReceiveData):
-        (WebCore::QuickLookHandleClient::didFinishLoading):
-        (WebCore::QuickLookHandleClient::didFail):
-
-2014-04-10  Pratik Solanki  &lt;psolanki@apple.com&gt;
-
-        Move early return out of dispatch_async() block so we can return from willSendRequest quickly
-        https://bugs.webkit.org/show_bug.cgi?id=131478
-        &lt;rdar://problem/16575535&gt;
-
-        Reviewed by Alexey Proskuryakov.
-
-        Do a quick check to see if we need to synthesize the redirect response on the dispatch queue
-        and return from willSendRequest callback quickly instead of always doing an effectively synchronous
-        call to the main thread. We can't call synthesizeRedirectResponseIfNecessary on the dispatch
-        queue since that accesses the ResourceRequest.
-
-        No new tests because no change in functionality.
-
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
-        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::setupRequest): Save the
-        request scheme to use later for early return from willSendRequest.
-        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::willSendRequest):
-
-2014-04-08  Oliver Hunt  &lt;oliver@apple.com&gt;
-
-        Rewrite Function.bind as a builtin
-        https://bugs.webkit.org/show_bug.cgi?id=131083
-
-        Reviewed by Geoffrey Garen.
-
-        Switch WebCore to use the helper functions when defining the
-        prototype properties on DOM constructors, and update bindings
-        tests accordingly.
-
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::finishCreation):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateConstructorHelperMethods):
-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        (WebCore::JSTestActiveDOMObjectConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
-        (WebCore::JSTestCustomNamedGetterConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
-        (WebCore::JSTestEventConstructorConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
-        (WebCore::JSTestEventTargetConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestException.cpp:
-        (WebCore::JSTestExceptionConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
-        (WebCore::JSTestGenerateIsReachableConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::JSTestInterfaceConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
-        (WebCore::JSTestMediaQueryListListenerConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
-        (WebCore::JSTestNamedConstructorConstructor::finishCreation):
-        (WebCore::JSTestNamedConstructorNamedConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestNode.cpp:
-        (WebCore::JSTestNodeConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::JSTestObjConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
-        (WebCore::JSTestOverloadedConstructorsConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
-        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::JSTestTypedefsConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSattribute.cpp:
-        (WebCore::JSattributeConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSreadonly.cpp:
-        (WebCore::JSreadonlyConstructor::finishCreation):
-
-2014-04-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        [iOS WK2] Hook up scrolling tree nodes when coming out of the page cache
-        https://bugs.webkit.org/show_bug.cgi?id=131577
-
-        Reviewed by Tim Horton.
-
-        The call to scrollingCoordinator-&gt;frameViewRootLayerDidChange() was inside
-        a #if !PLATFORM(IOS) block, but now that we use the ScrollingCoordinator
-        for WK2 we want to call this.
-
-        * loader/HistoryController.cpp:
-        (WebCore::HistoryController::restoreScrollPositionAndViewState):
-
-2014-04-13  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Unreviewed build fix after r167196.
-
-        * platform/RemoteCommandListener.cpp:
-        (WebCore::RemoteCommandListener::create): Fall back to using the new operator
-        for allocating RemoteCommandListener object. Using std::make_unique() requires
-        for the operator to be public, which doesn't work well with the static create()
-        method.
-
-2014-04-13  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Remove unnecessary uses of std::move() in return statements
-        https://bugs.webkit.org/show_bug.cgi?id=131457
-
-        Reviewed by Darin Adler.
-
-        Don't use std::move() in return statements unless necessary as it inhibits
-        named return value optimizations as performed by compilers.
-
-        * Modules/battery/BatteryManager.cpp:
-        (WebCore::BatteryManager::create):
-        * html/FormController.cpp:
-        (WebCore::FormController::createSavedFormStateMap):
-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::create):
-        * platform/RemoteCommandListener.cpp:
-        (WebCore::RemoteCommandListener::create):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayer::create):
-        * platform/ios/RemoteCommandListenerIOS.mm:
-        (WebCore::RemoteCommandListener::create):
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
</del><ins>+        (WebCore::RenderBoxModelObject::paintOffset):
</ins><span class="cx">         * rendering/RenderLayer.cpp:
</span><del>-        (WebCore::RenderLayer::setupFilters):
-        * rendering/style/CounterDirectives.cpp:
-        (WebCore::clone):
</del><ins>+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::hasPaintOffset):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::pushLayoutState):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::changeRequiresLayout):
+        * rendering/style/RenderStyle.h:
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup):
+        (WebCore::InternalSettings::Backup::restoreTo):
+        (WebCore::InternalSettings::setCSSShapesEnabled):
</ins><span class="cx"> 
</span><del>-2014-04-13  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-06-05  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167168 and r167194.
-        https://bugs.webkit.org/show_bug.cgi?id=131589
</del><ins>+        Don't throttle timers if a page is doing something that might be interesting
+        https://bugs.webkit.org/show_bug.cgi?id=117273
</ins><span class="cx"> 
</span><del>-        Caused massive ASSERTION failures on the GTK Debug bot
-        (Requested by philn on #webkit).
</del><ins>+        Reviewed by Gavin Barraclough.
</ins><span class="cx"> 
</span><del>-        Reverted changesets:
</del><ins>+        Make the decision about whether or not to throttle timers be
+        determined by the PageThrottler
</ins><span class="cx"> 
</span><del>-        &quot;[GTK] Add HighDPI support for non-accelerated compositing
-        contents&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131562
-        http://trac.webkit.org/changeset/167168
</del><ins>+        * page/Page.cpp:
+        (WebCore::Page::throttleTimers):
+        (WebCore::Page::unthrottleTimers):
+        (WebCore::Page::setVisibilityState):
+        (WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged):
+        * page/Page.h:
+        * page/PageThrottler.cpp:
+        (WebCore::PageThrottler::throttlePage):
+        (WebCore::PageThrottler::unthrottlePage):
</ins><span class="cx"> 
</span><del>-        &quot;Unreviewed. Fix GTK+ build with recent cairo and GTK+ after
-        r167168.&quot;
-        http://trac.webkit.org/changeset/167194
</del><ins>+2013-06-05  Mark Salisbury  &lt;mark.salisbury@hp.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-13  Youenn Fablet  &lt;youenn.fablet@crf.canon.fr&gt;
</del><ins>+        [WinCE,WinCairo] RenderThemeWin.cpp needs to include FrameSelection.h.
+        https://bugs.webkit.org/show_bug.cgi?id=116583
</ins><span class="cx"> 
</span><del>-        [GStreamer] No CORS support for media elements
-        https://bugs.webkit.org/show_bug.cgi?id=99037
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        * rendering/RenderThemeWin.cpp:
</ins><span class="cx"> 
</span><del>-        Added CORS access control check to media sources when crossorigin attribute is set.
</del><ins>+2013-06-05  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Added getter to CORS access control check status (used to compute whether the stream is tainted or not).
-        Related test is http/tests/security/video-cross-origin-readback.html.
</del><ins>+        [curl] Restrict allowed protocols
+        https://bugs.webkit.org/show_bug.cgi?id=117257
</ins><span class="cx"> 
</span><del>-        Disabled access to cross-origin streams that fail CORS check when crossorigin attribute is set.
-        Related test is http/tests/security/video-cross-origin-accessfailure.html.
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Tests: http/tests/security/video-cross-origin-accessfailure.html
-               http/tests/security/video-cross-origin-accesssameorigin.html
</del><ins>+        curl supports various protocols (like: HTTP,...,POP3,IMAP...) and by
+        default all of the are enabled for a single curl handle. Furthermore
+        all of the protocols are allowed during Location header follow.
+        This could pose a security risk for example: a malicious server responds
+        with a crafted Location header pointing to an imap/../(etc) url and the
+        curl backend will follow it and will give the result for the WebCore.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::didPassCORSAccessCheck): Return whether media is cross-origin (tainted) or not by querying the gstreamer source layer.
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Added MediaPlayerPrivateGStreamer::didPassCORSAccessCheck declaration.
-        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
-        (webKitWebSrcStart): Passed CORS mode parameter to the streaming client. In case of CORS check failure, stop the resource loading.
-        (webKitSrcPassedCORSAccessCheck): Return whether CORS access control check was done and successful.
-        (StreamingClient::handleResponseReceived): Take a parameter to assign the CORS access control check result.
-        (CachedResourceStreamingClient::CachedResourceStreamingClient): Updated setting of the ResourceLoaderOptions according CORS mode.
-        (CachedResourceStreamingClient::responseReceived): Check CORS and pass result to handleResponseReceived.
-        (ResourceHandleStreamingClient::didReceiveResponse): No CORS check.
-        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.h: Added webKitSrcPassedCORSAccessCheck declaration.
</del><ins>+        This patch will restrict the allowed protocols to: HTTP(S), FTP(S), FILE
</ins><span class="cx"> 
</span><del>-2014-04-12  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
</ins><span class="cx"> 
</span><del>-        REGRESSION (r166860): ASSERTION FAILED: !isCalculated() on fast/css/image-set-value-not-removed-crash.html
-        https://bugs.webkit.org/show_bug.cgi?id=131480
</del><ins>+2013-06-05  Bear Travis  &lt;betravis@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        [css exclusions] Clean up ExclusionShapeInsideInfo dynamic removal code
+        https://bugs.webkit.org/show_bug.cgi?id=116236
</ins><span class="cx"> 
</span><del>-        Fixes intermittent assertion failure in fast/css/image-set-value-not-removed-crash.html.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::valueForImageSliceSide): Added. Helper used below in valueForNinePieceImageSlice.
-        Handles calculated values by returning 0; incorrect but predictable.
-        (WebCore::valueForNinePieceImageSlice): Updated to call valueForImageSliceSide.
-        (WebCore::positionOffsetValue): Use nullptr.
-        (WebCore::ComputedStyleExtractor::propertyValue): Updated to call positionOffsetValue
-        by its new name. Removed &quot;get&quot; from the name.
-        (WebCore::positionOffsetValue): Renamed from getPositionOffsetValue.
</del><ins>+        Instead of keeping the ExclusionShapeInsideInfo around after it has
+        become stale, we can immediately remove it and just mark descendants
+        for relayout. This patch removes most of the code added by
+        https://bugs.webkit.org/show_bug.cgi?id=111029
+        in favor of this simpler approach.
</ins><span class="cx"> 
</span><del>-        * platform/Length.h: Made isCalculated public.
</del><ins>+        This patch does not introduce new functionality.
</ins><span class="cx"> 
</span><del>-2014-04-12  Andy Estes  &lt;aestes@apple.com&gt;
</del><ins>+        * rendering/ExclusionShapeInsideInfo.h:
+        (WebCore::ExclusionShapeInsideInfo::ExclusionShapeInsideInfo):
+        (ExclusionShapeInsideInfo): Remove needsRemoval code.
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState): Ditto.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateExclusionShapeInsideInfoAfterStyleChange): Remove
+        needsRemoval code and mark descendants for layout.
+        (WebCore):
+        (WebCore::RenderBlock::markShapeInsideDescendantsForLayout): Method to mark
+        descendants of a shape inside with inline content for layout.
+        (WebCore::exclusionInfoRequiresRelayout): Remove needsRemoval code.
+        (WebCore::RenderBlock::updateRegionsAndExclusionsAfterChildLayout): Ditto.
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::exclusionShapeInsideInfo): Ditto.
+        (RenderBlock):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutExclusionShapeInsideInfo): Ditto.
</ins><span class="cx"> 
</span><del>-        Fix the iOS build after r167183.
</del><ins>+2013-06-05  Arunprasad Rajkumar  &lt;arurajku@cisco.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandle.h:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::schedule):
-        (WebCore::ResourceHandle::unschedule):
</del><ins>+        Avoid multiple copies of inline script &amp; style strings
+        https://bugs.webkit.org/show_bug.cgi?id=117202
</ins><span class="cx"> 
</span><del>-2014-04-12  Andy Estes  &lt;aestes@apple.com&gt;
-
-        [iOS] Move QuickLookHandle from ResourceLoader to WebResourceLoader
-        https://bugs.webkit.org/show_bug.cgi?id=131580
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        There's no need to bloat WebKit1's ResourceLoader with a pointer that
-        only WebKit2's WebResourceLoader cares about.
</del><ins>+        Merge from https://chromiumcodereview.appspot.com/16005007.
</ins><span class="cx"> 
</span><del>-        * loader/ResourceLoader.h:
-        (WebCore::ResourceLoader::quickLookHandle): Deleted.
-        (WebCore::ResourceLoader::setQuickLookHandle): Deleted.
</del><ins>+        No new tests needed.
</ins><span class="cx"> 
</span><del>-2014-04-12  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        The HTML parser breaks up large text nodes into small chunks to avoid some
+        O(n^2) editing algorithms. This fix skips that workaround for &lt;script&gt; and
+        &lt;style&gt; elements, which aren't likely to need editing. As a result, &lt;script&gt;
+        ends up with a single text node, containing a contiguous String, which is the
+        source code of that inline script block.
</ins><span class="cx"> 
</span><del>-        AX: Cleanup AccessibilityObject::getAttribute
-        https://bugs.webkit.org/show_bug.cgi?id=131555
</del><ins>+        Prior this fix, we could end up with two copies of large inline scripts: one
+        monolithic string retained by JSC and a number of shards retained by the DOM.
+        After this fix, both the DOM and JSC use the same monolithic string, removing a
+        copy.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * dom/Text.cpp:
+        (WebCore::Text::createWithLengthLimit):
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::shouldUseLengthLimit):
+        (WebCore::HTMLConstructionSite::insertTextNode):
</ins><span class="cx"> 
</span><del>-        No new functionality.
</del><ins>+2013-06-05  Kondapally Kalyan  &lt;kalyan.kondapally@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::getAttribute):
</del><ins>+        [EFL] Build fix with EGL and GLES2 backend.
+        https://bugs.webkit.org/show_bug.cgi?id=117246
</ins><span class="cx"> 
</span><del>-2014-04-12  Youenn Fablet  &lt;youenn.fablet@crf.canon.fr&gt;
</del><ins>+        Reviewed by Kenneth Rohde Christiansen.
</ins><span class="cx"> 
</span><del>-        [SOUP] Libsoup internal credential setting should be controlled by loader decision
-        https://bugs.webkit.org/show_bug.cgi?id=130963
</del><ins>+        r150958 added support for EGLTransportSurfaceClient.
+        This patch adds the missing changes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * platform/graphics/surfaces/efl/GLTransportSurface.cpp:
+        (WebCore::GLTransportSurfaceClient::createTransportSurfaceClient):
+        (WebCore::GLTransportSurfaceClient::GLTransportSurfaceClient):
+        * platform/graphics/surfaces/efl/GLTransportSurface.h:
+        * platform/graphics/surfaces/efl/GraphicsSurfaceCommon.cpp:
+        (WebCore::GraphicsSurfacePrivate::initializeClient):
+        * platform/graphics/surfaces/egl/EGLXSurface.cpp:
+        (WebCore::EGLXTransportSurfaceClient::EGLXTransportSurfaceClient):
+        * platform/graphics/surfaces/egl/EGLXSurface.h:
+        * platform/graphics/surfaces/glx/GLXSurface.cpp:
+        (WebCore::GLXTransportSurfaceClient::GLXTransportSurfaceClient):
+        * platform/graphics/surfaces/glx/GLXSurface.h:
+        * platform/graphics/surfaces/glx/X11Helper.cpp:
+        (WebCore::X11Helper::createOffScreenWindow):
+        (WebCore::X11Helper::createPixmap):
+        * platform/graphics/surfaces/glx/X11Helper.h:
</ins><span class="cx"> 
</span><del>-        Disabled libsoup internal authentication manager for messages for which no credential is available and no stored credentials should be used.
-        Updated synchronous loader to return whether using credentials or not according StoredCredential loader option parameter.
-        Unskipped test http/tests/xmlhttprequest/cross-origin-no-authorization.html covers the patch.
</del><ins>+2013-06-05  Jae Hyun Park  &lt;jae.park@company100.net&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandleInternal.h:
-        (WebCore::ResourceHandleInternal::ResourceHandleInternal): Added m_useAuthenticationManager boolean to control whether disable authentication manager or not.
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader): Added m_storedCredentials member.
-        (WebCore::WebCoreSynchronousLoader::shouldUseCredentialStorage): Return true if stored credentials are allowed.
-        (WebCore::applyAuthenticationToRequest): Set m_useAuthenticationManager value to disable authentication manager if cannot use stored credentials and ResourceHandleInternal has no username and password.
-        (WebCore::createSoupMessageForHandleAndRequest): Disable authentication mananger according m_useAuthenticationManager value.
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Added StoredCredentials loader option to the sync loader constructor.
</del><ins>+        [GTK] Support using GLContext from multiple threads
+        https://bugs.webkit.org/show_bug.cgi?id=117238
</ins><span class="cx"> 
</span><del>-2014-04-11  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Some small loader refinements and refactoring
-        https://bugs.webkit.org/show_bug.cgi?id=131541
</del><ins>+        Current implementation assumes that GLContext is only used in the main thread.
+        However, to support using GLContext from multiple threads, we need to change it
+        to thread local. Therefore, ASSERT(isMainThread()) is removed and GLContext is
+        changed to thread local.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        * platform/graphics/cairo/GLContext.cpp:
+        (WebCore::ThreadGlobalGLContext::setContext):
+        (WebCore::ThreadGlobalGLContext::context):
+        (WebCore::currentContext):
+        (WebCore::GLContext::sharingContext):
+        (WebCore::GLContext::~GLContext):
+        (WebCore::GLContext::makeContextCurrent):
+        (WebCore::GLContext::getCurrent):
</ins><span class="cx"> 
</span><del>-        Cut down on use of ResourceLoader::handle, which always returns null when
-        using a network process. Also streamlined conditionals and did some other
-        small refactoring.
</del><ins>+2013-06-05  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/DocumentLoader.h: Use references rather than pointers for SchedulePair.
</del><ins>+        Unreviewed build fix when CHANNEL_MESSAGING is disabled.
</ins><span class="cx"> 
</span><del>-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::didChangePriority): Use m_handle instead of handle(),
-        since we'd like to delete handle() entirely soon.
-        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge): Ditto.
-        (WebCore::ResourceLoader::schedule): Added.
-        (WebCore::ResourceLoader::unschedule): Ditto.
-        * loader/ResourceLoader.h: Rearranged header to eliminate nested conditionals.
-        Added schedule and unschedule functions for Mac.
</del><ins>+        Add #if ENABLE(CHANNEL_MESSAGING) to JSMessageChannelCustom.cpp.
</ins><span class="cx"> 
</span><del>-        * loader/mac/DocumentLoaderMac.cpp:
-        (WebCore::scheduleAll): Changed to take a reference and call ResourceLoader::schedule.
-        (WebCore::unscheduleAll): Ditto.
-        (WebCore::DocumentLoader::schedule): Ditto.
-        (WebCore::DocumentLoader::unschedule): Ditto.
</del><ins>+        * bindings/js/JSMessageChannelCustom.cpp:
</ins><span class="cx"> 
</span><del>-        * page/mac/PageMac.cpp:
-        (WebCore::Page::addSchedulePair): Pass a reference rather than a pointer to schedule.
-        (WebCore::Page::removeSchedulePair): Ditto.
</del><ins>+2013-06-05  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandle.h: Did a bit of reformatting and reorganizing of
-        conditionals.
</del><ins>+        Remove remaining custom getters for WorkerContext constructor attributes
+        https://bugs.webkit.org/show_bug.cgi?id=117247
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandleInternal.h: Removed a tiny bit of unneeded declaration.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::schedule): Updated to take a reference rather than a pointer.
-        (WebCore::ResourceHandle::unschedule): Ditto.
</del><ins>+        Remove custom getter code for remaining constructor attribute on WorkerContext
+        interface. The custom code wasn't needed as it was doing nothing more than the
+        generated one. These constructor attributes are now automatically generated.
</ins><span class="cx"> 
</span><del>-2014-04-11  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Make NodeList.length inline-cacheable by JSC.
-        &lt;https://webkit.org/b/131579&gt;
</del><ins>+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/websockets/WebSocket.idl:
+        * Modules/websockets/WorkerContextWebSocket.idl: Removed.
+        * WebCore.order:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        * dom/MessageChannel.idl:
+        * page/EventSource.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequest.idl:
</ins><span class="cx"> 
</span><del>-        For objects with custom index or name getters, we have to make sure
-        that builtin properties take precedence. We do this by scanning the
-        ancestor chain for a suitable property slot before moving on to
-        named items.
</del><ins>+2013-06-05  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        With this patch, we now mark such builtins as cacheable. This is
-        safe since the whole point of doing this before processing named
-        items is to ensure the same slot is returned consistently.
</del><ins>+        Remove ChromeClient::deviceOrPageScaleFactorChanged
+        https://bugs.webkit.org/show_bug.cgi?id=117245
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateGetOwnPropertySlotBody):
</del><ins>+        It was introduced for chromium at r147357.
+        But now, there are no ports to use this.
</ins><span class="cx"> 
</span><del>-2014-04-11  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        No new tests - no behavior change.
</ins><span class="cx"> 
</span><del>-        Lots of compositing test failures after r167152
-        https://bugs.webkit.org/show_bug.cgi?id=131574
</del><ins>+        * page/ChromeClient.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::deviceOrPageScaleFactorChanged):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-06-05  Gwang Yoon Hwang  &lt;ryumiel@company100.net&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::dumpProperties):
-        We were asking the parent's client whether the child should be dumped,
-        but really the child's client is the one who should decide.
</del><ins>+        [Coordinated Graphics] Prevent a recursive painting in CoordinatedGraphicsLayer
+        https://bugs.webkit.org/show_bug.cgi?id=117222
</ins><span class="cx"> 
</span><del>-2014-04-11  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-        ViewportConfiguration::layoutWidth() compute the width incorrectly when initial-scale+width do not fit in view
-        https://bugs.webkit.org/show_bug.cgi?id=131575
</del><ins>+        CoordinatedGraphicsLayer::flushCompositingState() will cross frame
+        boundaries if the GraphicsLayers are connected. In this case,
+        updateContentBuffers will invoke a painting of a sub-frame that causes
+        flushCompositingState recursively.
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+        To prevent this behavior this patch extracts updateContentBuffers from
+        flushCompositingState, and places it in
+        updateContentBuffersIncludeSublayers, which is another tree traveler for
+        painting.
</ins><span class="cx"> 
</span><del>-        I made a mistake when writing the new viewport code: ViewportConfiguration::layoutWidth() uses m_contentSize in one place.
-        That make no sense, contentSize depends on the layout width.
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        * page/ViewportConfiguration.cpp:
-        (WebCore::ViewportConfiguration::layoutWidth):
</del><ins>+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly):
+        (WebCore::CoordinatedGraphicsLayer::syncPendingStateChangesIncludingSubLayers):
+        (WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers):
+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
</ins><span class="cx"> 
</span><del>-2014-04-11  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-06-05  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove &quot;numeric index getter&quot; stuff from bindings code generator.
-        &lt;https://webkit.org/b/131565&gt;
</del><ins>+        Fix some inefficiencies in AnimationController's composite animation map.
+        &lt;http://webkit.org/b/117248&gt;
</ins><span class="cx"> 
</span><del>-        This was used for an earlier generation of typed arrays. Now that JSC
-        has native typed array support, we're not using this functionality and
-        can just remove it.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Clean up some small things that were showing up in a window resizing profile (0.4%)
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateGetOwnPropertySlotBody):
-        (HasComplexGetOwnProperty):
-        (InterfaceRequiresAttributesOnInstance):
-        (InstanceOverridesGetOwnPropertySlot):
-        (GenerateHeader):
-        (GenerateImplementation):
</del><ins>+        * page/animation/AnimationControllerPrivate.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::ensureCompositeAnimation):
</ins><span class="cx"> 
</span><del>-2014-04-11  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+            Renamed this ensure* to conform to the WebKit Design Patterns, 2013 edition.
+            Always do a single hash lookup instead of two.
</ins><span class="cx"> 
</span><del>-        Web Replay: consolidate decoding macros used in SerializationMethods
-        https://bugs.webkit.org/show_bug.cgi?id=131564
</del><ins>+        (WebCore::AnimationControllerPrivate::clear):
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+            Use RefPtr&lt;T&gt; for local variables, never PassRefPtr&lt;T&gt;. See WKDP, 2013 ed.
</ins><span class="cx"> 
</span><del>-        We can use EncodingTraits&lt;T&gt;::DecodedType to create a local variable
-        with the appropriate decoded type, rather than special casing.
</del><ins>+        (WebCore::AnimationControllerPrivate::updateAnimationTimerForRenderer):
+        (WebCore::AnimationControllerPrivate::isRunningAnimationOnRenderer):
+        (WebCore::AnimationControllerPrivate::isRunningAcceleratedAnimationOnRenderer):
+        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
</ins><span class="cx"> 
</span><del>-        * replay/SerializationMethods.cpp:
-        (JSC::EncodingTraits&lt;NondeterministicInputBase&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;KeypressCommand&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;PlatformKeyboardEvent&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;PlatformMouseEvent&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;PlatformWheelEvent&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;PluginData&gt;::decodeValue):
</del><ins>+            Peek into m_compositeAnimations through &quot;const CompositeAnimation*&quot; instead
+            of using RefPtrs. There's no need to hold a reference on the animation while
+            querying some const method on it.
</ins><span class="cx"> 
</span><del>-2014-04-11  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::updateAnimations):
</ins><span class="cx"> 
</span><del>-        Need WK2 API to disable rubber-banding
-        https://bugs.webkit.org/show_bug.cgi?id=131567
</del><ins>+            Poke into m_compositeAnimations through &quot;CompositeAnimation*&quot; instead of using
+            RefPtrs. There's no need to hold a reference here either, we can modify the
+            animations through a raw pointer.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-06-05  Roland Takacs  &lt;rtakacs@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Page will now store a vertical and horizontal ScrollElasticity in case the API has 
-        been called before the FrameView even exists.
</del><ins>+        Web Inspector: Clear button doesn't clean Memory graph in Overview pane.
+        https://bugs.webkit.org/show_bug.cgi?id=112429
</ins><span class="cx"> 
</span><del>-        New Page functions.
-        * WebCore.exp.in:
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-        Use Page’s cached ScrollElasticity.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
</del><ins>+        There is an early return from TimelineMemoryOverview.update() when
+        record array is empty. Thats why if you click onto the clear button,
+        the canvas won't be updated.
+        Moved this &quot;return condition&quot; after the canvas size definition
+        because we need to know the canvas size for refreshing.
+        Overridden TimelineOverviewBase's reset function to clear
+        HeapSizeLabels' content.
</ins><span class="cx"> 
</span><del>-        If there is already a FrameView, then assign it the new ScrollElasticity.
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::setVerticalScrollElasticity):
-        (WebCore::Page::setHorizontalScrollElasticity):
-        * page/Page.h:
-        (WebCore::Page::verticalScrollElasticity):
-        (WebCore::Page::horizontalScrollElasticity):
</del><ins>+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineMemoryOverview.prototype.reset):
+        (WebInspector.TimelineMemoryOverview.prototype.update):
</ins><span class="cx"> 
</span><del>-2014-04-11  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+2013-06-05  Gwang Yoon Hwang  &lt;ryumiel@company100.net&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION(167145): Many media tests fail
-        https://bugs.webkit.org/show_bug.cgi?id=131569
</del><ins>+        [Coordinated Graphics] Rename client classes for CoordinatedImageBacking and UpdateAtlas.
+        https://bugs.webkit.org/show_bug.cgi?id=111948
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Add the localized strings file to the list of user agent scripts.
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::mediaControlsScript): Include the localized strings file in the script body.
</del><ins>+        This patch renames CoordinatedImageBacking::Coordinator to
+        CoordinatedImageBacking::Client, and UpdateAtlasClient to
+        UpdateAtlas::Client for naming consistency and clarification.
</ins><span class="cx"> 
</span><del>-2014-04-11  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Find-in-page indicator
-        https://bugs.webkit.org/show_bug.cgi?id=131510
-        &lt;rdar://problem/16547777&gt;
</del><ins>+        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
+        (WebCore::CoordinatedImageBacking::create):
+        (WebCore::CoordinatedImageBacking::CoordinatedImageBacking):
+        (WebCore::CoordinatedImageBacking::removeHost):
+        (WebCore::CoordinatedImageBacking::update):
+        (WebCore::CoordinatedImageBacking::clearContentsTimerFired):
+        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.h:
+        * platform/graphics/texmap/coordinated/UpdateAtlas.cpp:
+        (WebCore::UpdateAtlas::UpdateAtlas):
+        * platform/graphics/texmap/coordinated/UpdateAtlas.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser and Enrica Casucci.
</del><ins>+2013-06-05  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::findString):
-        * editing/FindOptions.h:
-        Add a find option which prevents WebCore from revealing the selection
-        after selecting a successful find match.
</del><ins>+        [Qt] Handle Return key without key text
+        https://bugs.webkit.org/show_bug.cgi?id=117239
</ins><span class="cx"> 
</span><del>-2014-04-11  Owen Taylor  &lt;otaylor@redhat.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        [GTK] Add HighDPI support for non-accelerated compositing contents
-        https://bugs.webkit.org/show_bug.cgi?id=131562
</del><ins>+        Test added to tst_qwebpage.cpp.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyTextForKeyEvent):
</ins><span class="cx"> 
</span><del>-        No new tests. This will be tested once we have the proper dependencies in the WebKit testing
-        JHBuild.
</del><ins>+2013-06-05  Gwang Yoon Hwang  &lt;ryumiel@company100.net&gt;
</ins><span class="cx"> 
</span><del>-        * platform/cairo/WidgetBackingStore.h:
-        (WebCore::WidgetBackingStore::WidgetBackingStore): Accept a device scale argument.
-        * platform/cairo/WidgetBackingStoreCairo.cpp: Use the device scale argument to make the surface the proper size and set the surface device scale.
-        * platform/cairo/WidgetBackingStoreCairo.h: Accept a device scale argument.
-        * platform/graphics/cairo/CairoUtilities.cpp: Add a new helper to set the device scale if Cairo built against is new enough.
-        * platform/graphics/cairo/CairoUtilities.h:
-        * platform/gtk/GtkVersioning.h: Add the HAVE_GTK_SCALE_FACTOR macro.
-        * platform/gtk/WidgetBackingStoreGtkX11.cpp: Use the device scale argument to make the surface the proper size and set the surface device scale.
-        * platform/gtk/WidgetBackingStoreGtkX11.h: Accept a device scale argument.
</del><ins>+        Coordinated Graphics: Unify messages related object's lifecycles into CoordinatedGraphicsState.
+        https://bugs.webkit.org/show_bug.cgi?id=111919
</ins><span class="cx"> 
</span><del>-2014-04-11  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-        Assertion failure changing select element size during focus event
-        dispatch
-        &lt;https://bugs.webkit.org/show_bug.cgi?id=131566&gt;
-        &lt;rdar://problem/16400735&gt;
</del><ins>+        CoordinatedLayerTreeHostProxy has several methods, which simply passes
+        these calls to CoordinatedGraphicsScene.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andy Estes.
</del><ins>+        This patch removes methods in CoordinatedLayerTreeHostProxy just for
+        message chaining. Instead of that, messages for creation/deletion of objects
+        (Layers, CustomFilters, UpdateAtlas, and ImageBacking) are unified into
+        CommitCoordinatedGraphicsState.
</ins><span class="cx"> 
</span><del>-        Test: fast/forms/select-change-size-during-focus.html
</del><ins>+        And this patch also removes codes for WebCoordinatedSurface in
+        CoordinatedLayerTreeHost, except for a factory method.
+        CoordinatedGraphicsArgumentCoders [en|de]codes CoordinatedSurface itself
+        using WebCoordinatedSurface.
</ins><span class="cx"> 
</span><del>-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
-        Adopt the fix from Chromium r171216; check that the renderer is still
-        of the expected type, and return early if it is not.
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-2014-04-11  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
+        (WebCore::CoordinatedGraphicsScene::syncCustomFilterPrograms):
+        (WebCore::CoordinatedGraphicsScene::syncUpdateAtlases):
+        (WebCore::CoordinatedGraphicsScene::syncImageBackings):
+        (WebCore::CoordinatedGraphicsScene::commitSceneState):
+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.h:
+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsState.h:
+        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
+        (WebCore::CoordinatedImageBacking::update):
+        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.h:
+        * platform/graphics/texmap/coordinated/UpdateAtlas.cpp:
+        (WebCore::UpdateAtlas::UpdateAtlas):
+        * platform/graphics/texmap/coordinated/UpdateAtlas.h:
</ins><span class="cx"> 
</span><del>-        Clear sibling floats while splitting inline flow
-        https://bugs.webkit.org/show_bug.cgi?id=130905
</del><ins>+2013-06-05  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Remove unnecessary null checks in SelectorChecker::checkOne().
+        &lt;http://webkit.org/b/117243&gt;
</ins><span class="cx"> 
</span><del>-        This is a port of a Blink patch by kenrb@chromium.org.
-        (https://src.chromium.org/viewvc/blink?revision=169658&amp;view=revision)
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        During RenderInline::splitFlow(), floats are cleared on an anonymous
-        containingBlock() for the inline being split. This is a problem if
-        siblings of the block contain references to the same floats, since the
-        float removal code in markSiblingsWithFloatsForLayout() will not later
-        find them.
</del><ins>+        This function was riddled with unnecessary null checks of 'element', despite ASSERT(element)
+        being the first thing it does.
</ins><span class="cx"> 
</span><del>-        This change also affects RenderBlock::splitFlow() and
-        RenderBoxModelObject::moveChildrenTo, since those are called in
-        similar situations as RenderInline::splitFlow().
</del><ins>+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOne):
</ins><span class="cx"> 
</span><del>-        Test: fast/block/float/split-inline-sibling-of-float-crash.html
</del><ins>+2013-06-05  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::removeFloatingObjects): Add call to
-            markSiblingsWithFloatsForLayout() before removing floats.
</del><ins>+        Merge [NoInterfaceObject] and [OmitConstructor] extended attributes
+        https://bugs.webkit.org/show_bug.cgi?id=115853
</ins><span class="cx"> 
</span><del>-2014-04-11  Gavin Barraclough  &lt;baraclough@apple.com&gt;
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Rollout - Rewrite Function.bind as a builtin
-        https://bugs.webkit.org/show_bug.cgi?id=131083
</del><ins>+        Remove [OmitConstructor] extended attribute as it is overlapping with
+        the standard [NoInterfaceObject] Web IDL extended attribute.
</ins><span class="cx"> 
</span><del>-        Unreviewed.
</del><ins>+        Having [NoInterfaceObject] extended attribute on an interface now
+        implies that its constructor is omitted (i.e. not generated).
</ins><span class="cx"> 
</span><del>-        Rolling out r167020 while investigating a performance regression.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::finishCreation):
</del><ins>+        * Modules/geolocation/Coordinates.idl:
+        * Modules/geolocation/Geolocation.idl:
+        * Modules/geolocation/Geoposition.idl:
+        * Modules/notifications/Notification.idl:
+        * Modules/notifications/NotificationCenter.idl:
+        * Modules/quota/StorageInfo.idl:
+        * Modules/quota/StorageQuota.idl:
+        * Modules/webdatabase/Database.idl:
+        * Modules/webdatabase/DatabaseSync.idl:
+        * Modules/webdatabase/SQLError.idl:
+        * Modules/webdatabase/SQLResultSet.idl:
+        * Modules/webdatabase/SQLResultSetRowList.idl:
+        * Modules/webdatabase/SQLTransaction.idl:
+        * Modules/webdatabase/SQLTransactionSync.idl:
</ins><span class="cx">         * bindings/scripts/CodeGeneratorJS.pm:
</span><del>-        (GenerateConstructorHelperMethods):
-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        (WebCore::JSTestActiveDOMObjectConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
-        (WebCore::JSTestCustomNamedGetterConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
-        (WebCore::JSTestEventConstructorConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
-        (WebCore::JSTestEventTargetConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestException.cpp:
-        (WebCore::JSTestExceptionConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
-        (WebCore::JSTestGenerateIsReachableConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::JSTestInterfaceConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
-        (WebCore::JSTestMediaQueryListListenerConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
-        (WebCore::JSTestNamedConstructorConstructor::finishCreation):
-        (WebCore::JSTestNamedConstructorNamedConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestNode.cpp:
-        (WebCore::JSTestNodeConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::JSTestObjConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
-        (WebCore::JSTestOverloadedConstructorsConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
-        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::JSTestTypedefsConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSattribute.cpp:
-        (WebCore::JSattributeConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSreadonly.cpp:
-        (WebCore::JSreadonlyConstructor::finishCreation):
</del><ins>+        (GenerateHeader):
+        (GenerateAttributesHashTable):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * css/CSSUnknownRule.idl:
+        * css/MediaQueryListListener.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * html/MicroDataItemValue.idl:
+        * html/ValidityState.idl:
+        * html/canvas/EXTDrawBuffers.idl:
+        * html/canvas/EXTTextureFilterAnisotropic.idl:
+        * html/canvas/OESElementIndexUint.idl:
+        * html/canvas/OESStandardDerivatives.idl:
+        * html/canvas/OESTextureFloat.idl:
+        * html/canvas/OESTextureHalfFloat.idl:
+        * html/canvas/OESVertexArrayObject.idl:
+        * html/canvas/WebGLCompressedTextureATC.idl:
+        * html/canvas/WebGLCompressedTexturePVRTC.idl:
+        * html/canvas/WebGLCompressedTextureS3TC.idl:
+        * html/canvas/WebGLContextAttributes.idl:
+        * html/canvas/WebGLDebugRendererInfo.idl:
+        * html/canvas/WebGLDebugShaders.idl:
+        * html/canvas/WebGLDepthTexture.idl:
+        * html/canvas/WebGLLoseContext.idl:
+        * inspector/JavaScriptCallFrame.idl:
+        * inspector/ScriptProfile.idl:
+        * inspector/ScriptProfileNode.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/AbstractView.idl:
+        * page/Console.idl:
+        * page/Crypto.idl:
+        * page/PerformanceEntryList.idl:
+        * page/WorkerNavigator.idl:
+        * page/make_settings.pl:
+        (generateInternalSettingsIdlFile):
+        * svg/ElementTimeControl.idl:
+        * svg/SVGAnimationElement.idl:
+        * svg/SVGExternalResourcesRequired.idl:
+        * svg/SVGFitToViewBox.idl:
+        * svg/SVGLangSpace.idl:
+        * svg/SVGLocatable.idl:
+        * svg/SVGTests.idl:
+        * svg/SVGTransformable.idl:
+        * svg/SVGURIReference.idl:
+        * testing/InternalSettings.idl:
+        * testing/Internals.idl:
+        * testing/MallocStatistics.idl:
+        * testing/MemoryInfo.idl:
+        * testing/TypeConversions.idl:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/SharedWorkerContext.idl:
+        * workers/WorkerContext.idl:
+        * xml/XPathNSResolver.idl:
</ins><span class="cx"> 
</span><del>-2014-04-11  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+2013-06-05  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        Build Fix after r167151.
</del><ins>+        [Qt] Font::shouldUseSmoothing() has fake dependency on Qt 5.1
+        https://bugs.webkit.org/show_bug.cgi?id=117195
</ins><span class="cx"> 
</span><del>-        Unreviewed.
</del><ins>+        Reviewed by Jocelyn Turcotte.
</ins><span class="cx"> 
</span><del>-        * editing/AlternativeTextController.cpp:
-        (WebCore::AlternativeTextController::applyAlternativeTextToRange):
</del><ins>+        Remove the fake dependency on Qt 5.1 so we may rebase the layout tests
+        before switching to Qt 5.1
</ins><span class="cx"> 
</span><del>-2014-04-10  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
</ins><span class="cx"> 
</span><del>-        [EME][Mac] Using KeySession.update([renew]) should trigger KeyMessage event instead of NeedKey event
-        https://bugs.webkit.org/show_bug.cgi?id=131527
</del><ins>+2013-06-05  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        [CSSRegions] Respect renderer creation constraints when element is part of named flow
+        https://bugs.webkit.org/show_bug.cgi?id=116790
</ins><span class="cx"> 
</span><del>-        Rather than triggering a needKey() event, necessatating the creation
-        of an entirely new MediaKeySession, cause a new key request to be
-        created by sending the same initData back into the AVSampleDataParser.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Also, do some drive-by clean up suggested by Darin in the review for
-        r166509.
</del><ins>+        Before adding a child to a named flow, we have to make sure that the rules for
+        creation are properly checked.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
-        (WebCore::isEqual): Support an alloc-free equality check between
-            Uint8Array and static strings.
-        (WebCore::CDMSessionMediaSourceAVFObjC::update):
</del><ins>+        Test: fast/regions/br-content-node-crash.xhtml
</ins><span class="cx"> 
</span><del>-2014-04-11  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        * rendering/RenderNamedFlowThread.cpp:
+        (WebCore::RenderNamedFlowThread::isChildAllowed):
+        Call isChildAllowed on the original parent renderer, before reparenting to
+        named flow.
+        * rendering/RenderNamedFlowThread.h:
</ins><span class="cx"> 
</span><del>-        Build fix (r167151): Do not dereference Node::document() before passing to Range::create()
-        &lt;https://webkit.org/b/131475&gt;
</del><ins>+2013-06-05  Philippe Normand  &lt;pnormand@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Fixes the following build failure:
</del><ins>+        Unreviewed, GStreamer 0.10 build fix after r151175.
</ins><span class="cx"> 
</span><del>-            WebCore/editing/AlternativeTextController.cpp:275:71: error: indirection requires pointer operand ('WebCore::Document' invalid)
-                int paragraphStartIndex = TextIterator::rangeLength(Range::create(*rootNode.document(), &amp;rootNode, 0, paragraphRangeContainingCorrection.get()-&gt;startContainer(), paragraphRangeContainingCorrection.get()-&gt;startOffset()).get());
-                                                                                  ^~~~~~~~~~~~~~~~~~~~
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
+        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
+        (WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
+        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
+        (WebCore::MediaPlayerPrivateGStreamerBase::paint):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
</ins><span class="cx"> 
</span><del>-        * editing/AlternativeTextController.cpp:
-        (WebCore::AlternativeTextController::applyAlternativeTextToRange):
-        Remove unneeded '*' operator since Node::document() returns a
-        Document&amp; and Range::create() accepts a Document&amp; for its first
-        argument.
</del><ins>+2013-06-05  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-11  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+        [CSS Regions] REGRESSION Incorrect layer clipping inside flow thread
+        https://bugs.webkit.org/show_bug.cgi?id=117074
</ins><span class="cx"> 
</span><del>-        Web Replay: memoize nondeterministic attributes of the Navigator interface
-        https://bugs.webkit.org/show_bug.cgi?id=131340
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Function RenderBox::mapLocalToContainer was adapted for elements inside flow threads to convert
+        elements coordinates to RenderView coordinates, passing through the region in which the elements
+        were flowed (https://bugs.webkit.org/show_bug.cgi?id=66641).
</ins><span class="cx"> 
</span><del>-        Most attributes of window.navigator do not change very often, but they
-        could be easily changed by the user or embedder. So, memoize attribute values.
</del><ins>+        The fix for https://bugs.webkit.org/show_bug.cgi?id=76486 modified RenderLayer::calculateClipRects and replaced
+        convertToLayerCoords with localToContainerPoint, which further calls mapLocalToContainer.
</ins><span class="cx"> 
</span><del>-        This change does not include navigator.mimeTypes and navigator.plugins,
-        which will be handled at a different level. &lt;https://webkit.org/b/131341&gt;
</del><ins>+        However, for elements inside the flow thread, which acts as a root layer for its collected children, we do not want
+        to get the offset in RenderView coordinates but rather in flow thread coordinates (and still take transforms into
+        account). This patch modifies RenderBox::mapLocalToContainer so that it stops at flow thread boundary when the passed
+        repaintContainer is the flow thread. The flow thread is the container for repaint for elements inside it, as seen from
+        RenderObject::containerForRepaint.
</ins><span class="cx"> 
</span><del>-        Test: ManualTests/inspector/replay-window-navigator-basic.html
</del><ins>+        No new tests, converted overflow-size-change-with-stacking-context and overflow-size-change-with-stacking-context-rtl
+        into ref tests so that the we do not rely on pixel tests in the future.
</ins><span class="cx"> 
</span><del>-        * page/Navigator.idl: Add Nondeterministic attribute.
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
</ins><span class="cx"> 
</span><del>-2014-04-10  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-06-05  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Videos should animate into and out of fullscreen.
-        https://bugs.webkit.org/show_bug.cgi?id=131497
</del><ins>+        Remove [NoInterfaceObject] from TreeWalker
+        https://bugs.webkit.org/show_bug.cgi?id=117225
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Use AVPlayerViewController's new enterFullScreenWithCompletionHandler: and exitFullScreenWithCompletionHandler:
-        methods to animate into and out of full screen. To do so, use the provided initialFrame and finalFrame screen
-        rects to correctly place the AVPlayerViewController's view before entering or exiting fullscreen.
</del><ins>+        Remove [NoInterfaceObject] IDL extended attribute from TreeWalker interface
+        to match Firefox's behavior and the specification:
+        http://www.w3.org/TR/DOM-Level-2-Traversal-Range/traversal.html#Traversal-TreeWalker
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
-        (-[WebVideoFullscreenController enterFullscreen:]): Pass the media element's screen rect.
-        (-[WebVideoFullscreenController exitFullscreen]): Ditto.
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (-[WebAVPlayerController playerViewController:shouldExitFullScreenWithReason:]): Renamed from shouldDismissWithReason.
-        (WebVideoFullscreenInterfaceAVKit::enterFullscreen): Use the new AVKit APIs.
-        (WebVideoFullscreenInterfaceAVKit::exitFullscreen): Ditto.
-        * WebCore.exp.in: Modify the exported symbols for enter and exitFullscreen.
</del><ins>+        No new tests, already covered by existing tests.
</ins><span class="cx"> 
</span><del>-2014-04-11  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        * dom/TreeWalker.idl:
</ins><span class="cx"> 
</span><del>-        Support document-relative and custom-frame page overlays
-        https://bugs.webkit.org/show_bug.cgi?id=131560
-        &lt;rdar://problem/16595556&gt;
</del><ins>+2013-06-05  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Move MemoryInfo under window.internals
+        https://bugs.webkit.org/show_bug.cgi?id=117197
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::setDocumentOverlayRootLayer):
-        * rendering/RenderLayerCompositor.h:
-        Add the concept of a document overlay layer, which is plugged in as the
-        last child of the root content layer. Expose it to WebKit2.
-
-2014-04-09  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-
-        Autocorrection causes ASSERT when replacing alternative string
-        https://bugs.webkit.org/show_bug.cgi?id=131475
-
</del><span class="cx">         Reviewed by Ryosuke Niwa.
</span><span class="cx"> 
</span><del>-        In AlternativeTextController::applyAlternativeTextToRange(), we attempt to create
-        a Range that crosses from outside of a shadow root to inside of one. Instead,
-        we should keep the Range entirely within the shadow root.
</del><ins>+        The MemoryInfo interface is not a subject of any specification and should not be exposed
+        to the Web. It's still used by the performance tests so it is moved under the testing
+        internals, accessible through window.internals.memoryInfo.
</ins><span class="cx"> 
</span><del>-        Test: ManualTests/autocorrection/autocorrection-accept-crash.html
</del><ins>+        The jsHeapSizeLimit attribute is removed from the MemoryInfo interface as that value was
+        only usable when using the V8 bindings which are not supported anymore. A small fast/harness
+        test is also provided to check that the MemoryInfo object is accessible through window.internals.
</ins><span class="cx"> 
</span><del>-        * editing/AlternativeTextController.cpp:
-        (WebCore::AlternativeTextController::applyAlternativeTextToRange):
</del><ins>+        Test: fast/harness/memoryinfo-object.html
</ins><span class="cx"> 
</span><del>-2014-04-11  Hans Muller  &lt;hmuller@adobe.com&gt;
-
-        [CSS Shapes] shape-outside from image doesn't load properly
-        https://bugs.webkit.org/show_bug.cgi?id=131491
-
-        Reviewed by Bem Jones-Bey.
-
-        Make RenderImage::imageChanged() call super if there's a shape-outside
-        image because the shape-outside imageChanged() logic is in RenderBox.
-
-        Test: http/tests/css/shape-image-file.html
-
-        * rendering/RenderElement.h:
-        (WebCore::RenderElement::hasShapeOutside):
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::imageChanged):
-
-2014-04-11  Brady Eidson  &lt;beidson@apple.com&gt;
-
-        Aggregate multiple &quot;respondToChangedSelection&quot; calls to one scan for telephone numbers
-        https://bugs.webkit.org/show_bug.cgi?id=131559
-
-        Reviewed by Gavin Barraclough.
-
-        No new tests (Perf-only change to an untested feature)
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::Editor):
-        (WebCore::Editor::respondToChangedSelection): Start a one shot timer for scanSelectionForTelephoneNumbers
-          instead of scanning synchronously.
-        (WebCore::Editor::scanSelectionForTelephoneNumbers):
-        * editing/Editor.h:
-
-2014-04-11  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Try to fix windows build.
-        
-        * platform/graphics/ca/GraphicsLayerCA.h:
-
-2014-04-11  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        Unreviewed follow-up for r167145
-
-        * English.lproj/mediaControlsLocalizedStringsiOS.js:
-        (mediaControlsLocalizedStringsiOS): Use smart-quote in
-        message string.
-
-2014-04-11  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        Regression: media controls and status messages are no longer localized.
-        https://bugs.webkit.org/show_bug.cgi?id=120956
-
-        Reviewed by Jer Noble.
-
-        * English.lproj/mediaControlsLocalizedStrings.js: Added.
-        (mediaControlsLocalizedStrings): Moved from mediaControlsApple.js.
-        * English.lproj/mediaControlsLocalizedStringsiOS.js: Added.
-        (mediaControlsLocalizedStringsiOS): Moved from mediaControlsiOS.js.
-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller.prototype.UIString): Get strings from external file.
-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.UIString): Ditto.
-        * WebCore.vcxproj/copyWebCoreResourceFiles.cmd: Copy to Windows bundle.
-        * WebCore.xcodeproj/project.pbxproj: Copy new files to bundle.
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::mediaControlsScript): Load the locale-specific
-        string resource when loading the media controls.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::mediaControlsScript): Ditto.
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::mediaControlsScript): Ditto.
-
-2014-04-11  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [Win] Build fix after r167138
-
-        * platform/graphics/ca/GraphicsLayerCA.h: The TileController is
-        only available on Mac/Cocoa builds.
-
-2014-04-11  Mark Lam  &lt;mark.lam@apple.com&gt;
-
-        JSMainThreadExecState::call() should clear exceptions before returning.
-        &lt;https://webkit.org/b/131530&gt;
-
-        Reviewed by Geoffrey Garen.
-
-        Test: fast/dom/regress-131530.html
-
-        Previously, JSMainThreadExecState::call() did not clear any pending
-        exceptions in the VM before returning.  On returning, the
-        JSMainThreadExecState destructor may re-enter the VM to notify
-        MutationObservers.  This may result in a crash because the VM expects
-        exceptions to be cleared at entry.
-
-        We now change JSMainThreadExecState::call() to return the exception
-        (if present) via an argument, and clear it from the VM before returning.
-
-        As part of this change, I updated various parts of the code base to use the
-        new API as needed.
-
-        * bindings/js/JSCallbackData.cpp:
-        (WebCore::JSCallbackData::invokeCallback):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSDOMGlobalObjectTask.cpp:
-        - Assert that there's no unhandled exception after the Microtask returns.
-          See comment for WebCore::JSMainThreadExecState::runTask below for more
-          details.
-
-        * bindings/js/JSErrorHandler.cpp:
-        (WebCore::JSErrorHandler::handleEvent):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent):
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        (WebCore::JSHTMLDocument::open):
-        - Document.open() cannot be the first function on the JS stack.  Hence,
-          there is no need to use JSMainThreadExecState to call into the VM, as
-          this is only needed to catch the event of returning from the first
-          function for the purpose of notifying MutationObservers.  Change to
-          call JSC::call() directly.
-
-        * bindings/js/JSMainThreadExecState.cpp:
-        (WebCore::functionCallHandlerFromAnyThread):
-        * bindings/js/JSMainThreadExecState.h:
-        (WebCore::JSMainThreadExecState::call):
-        (WebCore::JSMainThreadExecState::evaluate):
-        - Remove the explicitly acquisition of the JSLock here because we now
-          acquire the JSLock as part of the JSMainThreadExecState instance.
-        (WebCore::JSMainThreadExecState::runTask):
-        - Added an assert to verify that the task does not return with an
-          unhandled exception.  Currently, the only Microtask in use is for the
-          Promise implementation, which will eat the exception before returning.
-          This assertion is added here to verify that this contract does not
-          inadvertantly change in the future.
-        (WebCore::JSMainThreadExecState::JSMainThreadExecState):
-        - Now acquires the JSLock as well since by definition, we're only
-          instantiating the JSMainThreadExecState because we're about to enter
-          the VM.
-
-        * bindings/js/JSMutationCallback.cpp:
-        (WebCore::JSMutationCallback::call):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        - acceptNode() is only used in the TreeWalker and NodeIterator APIs which
-          cannot be the first function on the JS stack.  Hence, we should call
-          JSC::call() directly instead of going through JSMainThreadExecState.
-
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::executeFunctionInContext):
-        * bindings/objc/WebScriptObject.mm:
-        (WebCore::addExceptionToConsole):
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-
-2014-04-11  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
-
-        Web Replay: CodeGeneratorJS should guard includes of replay-related headers
-        https://bugs.webkit.org/show_bug.cgi?id=131407
-
-        Reviewed by Timothy Hatcher.
-
-        This patch adds guards to headers that are only required by generated replay code
-        that is itself guarded. Other ports probably haven't added the headers to their
-        build files, so we don't want to emit the unused header includes.
-
-        This patch also converts generated uses of DEFINE_STATIC_LOCAL to NeverDestroyed&lt;T&gt;.
-        Finally, a new bindings test was added to document changes to generated replay code.
-
-        Test: Source/WebCore/bindings/scripts/test/TestNondeterministic.idl
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        (GenerateImplementationFunctionCall):
-
-        * bindings/scripts/test/GObject/WebKitDOMTestNondeterministic.cpp: Added.
-        * bindings/scripts/test/GObject/WebKitDOMTestNondeterministic.h: Added.
-        * bindings/scripts/test/GObject/WebKitDOMTestNondeterministic.symbols: Added.
-        * bindings/scripts/test/GObject/WebKitDOMTestNondeterministicPrivate.h: Added.
-        * bindings/scripts/test/JS/JSTestNondeterministic.cpp: Added.
-        * bindings/scripts/test/JS/JSTestNondeterministic.h: Added.
-        * bindings/scripts/test/ObjC/DOMTestNondeterministic.h: Added.
-        * bindings/scripts/test/ObjC/DOMTestNondeterministic.mm: Added.
-        * bindings/scripts/test/ObjC/DOMTestNondeterministicInternal.h: Added.
-        * bindings/scripts/test/TestNondeterministic.idl: Added.
-
-2014-04-11  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Pipe initial scale factor to TileController
-        https://bugs.webkit.org/show_bug.cgi?id=131521
-
-        Reviewed by Tim Horton.
-
-        * WebCore.exp.in:
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::setZoomedOutPageScaleFactor):
-        * page/Page.h:
-        (WebCore::Page::zoomedOutPageScaleFactor):
-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::GraphicsLayerClient::zoomedOutPageScaleFactor):
-        * platform/graphics/TiledBacking.h:
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateContentsScale):
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::TileController):
-        (WebCore::TileController::setContentsScale):
-        (WebCore::TileController::setZoomedOutContentsScale):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::zoomedOutPageScaleFactor):
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::zoomedOutPageScaleFactor):
-        * rendering/RenderLayerCompositor.h:
-
-2014-04-10  Chris Fleizach  &lt;cfleizach@apple.com&gt;
-
-        Heap-use-after-free in WebCore::SpeechSynthesisUtterance::startTime
-        https://bugs.webkit.org/show_bug.cgi?id=131482
-
-        Reviewed by David Kilzer.
-
-        Hold onto the utterance until it has time to fire, in case other references have been removed.
-
-        Merged from Blink r171077 by &lt;dmazzoni@chromium.org&gt;
-
-        Test: platform/mac/fast/speechsynthesis/speech-synthesis-gc-utterance-crash.html
-
-        * Modules/speech/SpeechSynthesis.cpp:
-        (WebCore::SpeechSynthesis::handleSpeakingCompleted):
-
-2014-04-11  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Avoid Vector copies in RenderGrid::placeItemsOnGrid()
-        https://bugs.webkit.org/show_bug.cgi?id=131452
-
-        Reviewed by Sergio Villar Senin.
-
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid): Take in a const reference to the
-        Vector object. Make the for-loop that iterates through it range-based.
-        (WebCore::RenderGrid::placeAutoMajorAxisItemsOnGrid): Ditto.
-        * rendering/RenderGrid.h:
-
-2014-04-11  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
-
-        Web Inspector: Remove shared PageScriptDebugServer, create per-Page
-        https://bugs.webkit.org/show_bug.cgi?id=131523
-
-        Reviewed by Timothy Hatcher.
-
-        Having a shared PageScriptDebugServer was causing issues when we called
-        JSC::Debugger::clearBreakpoints() closing one inspector while another
-        is open for another WebCore::Page in the same process. Having the same
-        JSC::Debugger underlying multiple InspectorDebuggerAgent instances
-        means that when clearBreakpoints is called, the real JSC breakpoints
-        underlying other InspectorDebuggerAgent's get removed. When those
-        InspectorDebuggerAgents attempt to remove their breakpoints they
-        encounter unexpected issues.
-
-        This entirely rebuilds PageScriptDebugServer to be per-Page instead
-        of shared across all pages. So take this opportunity to move the
-        file from WebCore/bindings/js to WebCore/inspector.
-
</del><span class="cx">         * CMakeLists.txt:
</span><ins>+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UseJSC.cmake:
+        * WebCore.exp.in:
+        * WebCore.order:
</ins><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj.filters:
</span><ins>+        * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
+        * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * bindings/js/JSBindingsAllInOne.cpp:
-        * bindings/js/PageScriptDebugServer.h: Removed.
-        * inspector/InspectorAllInOne.cpp:
-        Move PageScriptDebugServer.
</del><ins>+        * bindings/gobject/GNUmakefile.am: Remove the GObject bindings targets for MemoryInfo.
+        * bindings/js/JSBindingsAllInOne.cpp: Remove the JSMemoryInfo.h and MemoryInfo.h inclusion.
+        * bindings/js/JSMemoryInfoCustom.cpp: Removed.
+        * bindings/js/ScriptGCEvent.cpp: Remove the ENABLE(INSPECTOR) guards.
+        (WebCore::ScriptGCEvent::getHeapSize): Remove the jsHeapSizeLimit assignment.
+        * bindings/js/ScriptGCEvent.h: Remove the ENABLE(INSPECTOR) guards.
+        (WebCore::HeapInfo::HeapInfo): Remove the jsHeapSizeLimit member.
+        * page/Console.cpp: Remove the Console::memory method.
+        * page/Console.h: Ditto.
+        * page/Console.idl: Remove the window.console.memory attribute.
+        * page/MemoryInfo.cpp: Removed.
+        * page/Performance.cpp: Remove the Performance::memory method.
+        * page/Performance.h: Ditto.
+        * page/Performance.idl: Remove the window.performance.memory attribute.
+        * testing/Internals.cpp:
+        (WebCore::Internals::memoryInfo): Return a MemoryInfo object upon invoking.
+        * testing/Internals.h: Declare the Internals::memoryInfo method.
+        * testing/Internals.idl: Expose the window.internals.memoryInfo operation.
+        * testing/MemoryInfo.h: Renamed from Source/WebCore/page/MemoryInfo.h.
+        (WebCore::MemoryInfo::create): Return a new RefPtr-wrapped MemoryInfo object.
+        (WebCore::MemoryInfo::usedJSHeapSize): Return the value of the equally-named HeapInfo member.
+        (WebCore::MemoryInfo::totalJSHeapSize): Ditto.
+        (WebCore::MemoryInfo::MemoryInfo): Acquire the current heap info upon construction.
+        * testing/MemoryInfo.idl: Renamed from Source/WebCore/page/MemoryInfo.idl.
+        The jsHeapSizeLimit attribute is removed.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorController.h:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        Set the ScriptDebugServer directly on some other agents that
-        were previously using the global debug server.
</del><ins>+2013-06-04  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorProfilerAgent.h:
-        (WebCore::InspectorProfilerAgent::scriptDebugServer):
-        * inspector/InspectorProfilerAgent.cpp:
-        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
-        (WebCore::InspectorProfilerAgent::setScriptDebugServer):
-        (WebCore::InspectorProfilerAgent::start):
-        (WebCore::InspectorProfilerAgent::willDestroyFrontendAndBackend): Deleted.
-        * inspector/InspectorTimelineAgent.h:
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::start):
-        (WebCore::InspectorTimelineAgent::stop):
-        (WebCore::InspectorTimelineAgent::setPageScriptDebugServer):
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        Refactor these two agents to take in a script debug server.
-        The server is expected to be set during initialization and
-        to always be valid (like debug server on RuntimeAgent).
</del><ins>+        [curl] Headers should be parsed as utf8 if possible
+        https://bugs.webkit.org/show_bug.cgi?id=117196
</ins><span class="cx"> 
</span><del>-        * inspector/PageDebuggerAgent.h:
-        * inspector/PageDebuggerAgent.cpp:
-        (WebCore::PageDebuggerAgent::PageDebuggerAgent):
-        (WebCore::PageDebuggerAgent::startListeningScriptDebugServer):
-        (WebCore::PageDebuggerAgent::stopListeningScriptDebugServer):
-        (WebCore::PageDebuggerAgent::scriptDebugServer):
-        Have PageDebuggerAgent hold the PageScriptDebugServer.
-        Update for the simplified interfaces.
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        * inspector/PageScriptDebugServer.h: Added.
-        * inspector/PageScriptDebugServer.cpp: Renamed from Source/WebCore/bindings/js/PageScriptDebugServer.cpp.
-        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
-        (WebCore::PageScriptDebugServer::addListener):
-        (WebCore::PageScriptDebugServer::removeListener):
-        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
-        (WebCore::PageScriptDebugServer::didPause):
-        (WebCore::PageScriptDebugServer::didContinue):
-        (WebCore::PageScriptDebugServer::runEventLoopWhilePaused):
-        (WebCore::PageScriptDebugServer::runEventLoopWhilePausedInternal):
-        (WebCore::PageScriptDebugServer::isContentScript):
-        (WebCore::PageScriptDebugServer::reportException):
-        (WebCore::PageScriptDebugServer::setJavaScriptPaused):
-        Model after JSGlobalObjectScriptDebugServer, the PageScriptDebugServer
-        holds a reference to a Page.
</del><ins>+        Testcase already present: http/tests/download/literal-utf-8.html
</ins><span class="cx"> 
</span><del>-2014-04-11  Bear Travis  &lt;betravis@adobe.com&gt;
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::headerCallback): Parse the header as an utf8 string if possible.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] inset args and radial args should serialize to the simplest form
-        https://bugs.webkit.org/show_bug.cgi?id=129825
</del><ins>+2013-06-04  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Prevent throttling while resources are being loaded
+        https://bugs.webkit.org/show_bug.cgi?id=117218
</ins><span class="cx"> 
</span><del>-        Modify inset serialization to omit components where possible. The insets simplify
-        according to the margin shorthand, while the corner radii simplify according to
-        the border-radius shorthand.
</del><ins>+        Reviewed by Gavin Barraclough.
</ins><span class="cx"> 
</span><del>-        Modifying existing parsing tests.
</del><ins>+        Make use of the page activity assertion infrastructure to delay
+        throttling while we are waiting on resource loads.
</ins><span class="cx"> 
</span><del>-        * css/CSSBasicShapes.cpp:
-        (WebCore::buildInsetRadii): Add the necessary radii, omitting components where possible.
-        (WebCore::buildInsetString): Omit components where possible.
</del><ins>+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::started):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::init):
+        (WebCore::SubresourceLoader::checkForHTTPStatusCodeError):
+        (WebCore::SubresourceLoader::didFinishLoading):
+        (WebCore::SubresourceLoader::didFail):
+        (WebCore::SubresourceLoader::willCancel):
+        * loader/SubresourceLoader.h:
</ins><span class="cx"> 
</span><del>-2014-04-11  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</del><ins>+2013-06-04  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;playbackTime&quot; parameter is not present in AudioProcessingEvent Interface as per W3C spec
-        https://bugs.webkit.org/show_bug.cgi?id=105518
</del><ins>+        Remove [NoInterfaceObject] from XPathExpression and NodeIterator
+        https://bugs.webkit.org/show_bug.cgi?id=117204
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Attribute &quot;playbackTime&quot; in AudioProcessingEvent implemented to pass playback time of
-        audiobuffer associated with ScriptProcessorNode of the context.

-        Reference: https://codereview.chromium.org/210973002
</del><ins>+        Remove [NoInterfaceObject] from XPathExpression and NodeIterator to match
+        their respective specifications:
+        - http://www.w3.org/TR/DOM-Level-3-XPath/xpath.html#XPathExpression
+        - http://www.w3.org/TR/DOM-Level-2-Traversal-Range/traversal.html#Traversal-NodeIterator
</ins><span class="cx"> 
</span><del>-        Spec: http://www.w3.org/TR/webaudio/#AudioProcessingEvent
</del><ins>+        No new tests, already covered by:
+        fast/js/global-constructors-attributes.html
</ins><span class="cx"> 
</span><del>-        Test: webaudio/audioprocessingevent.html
</del><ins>+        * dom/NodeIterator.idl:
+        * xml/XPathExpression.idl:
</ins><span class="cx"> 
</span><del>-        * Modules/webaudio/AudioProcessingEvent.cpp:
-        (WebCore::AudioProcessingEvent::create):
-        (WebCore::AudioProcessingEvent::AudioProcessingEvent):
-        * Modules/webaudio/AudioProcessingEvent.h:
-        (WebCore::AudioProcessingEvent::playbackTime):
-        * Modules/webaudio/AudioProcessingEvent.idl:
-        * Modules/webaudio/ScriptProcessorNode.cpp:
-        (WebCore::ScriptProcessorNode::fireProcessEvent):
</del><ins>+2013-06-04  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-11  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        AX: MathML multiscripts not exposed in Accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=115069
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: WK1: Trail of cruft in redraw during animations.
-        https://bugs.webkit.org/show_bug.cgi?id=131525
</del><ins>+        Unreviewed, build fix.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Remove an accessibility iOS method that was erroneously added.
</ins><span class="cx"> 
</span><del>-        Use enclosing rect instead of snapping to make sure the repaint rect always
-        covers the dirty area when painting is requested in a non-compositing RenderView.
-        This only applies to WK1 as WK2 has compositing RenderView and the repainting 
-        is managed by RenderLayerBacking.
</del><ins>+        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
</ins><span class="cx"> 
</span><del>-        This is a temporary solution until after ScrollView/FrameView/RenderView
-        is transitioned to device pixels. (tracked here: webkit.org/b/131526).
</del><ins>+2013-06-04  Greg Hughes  &lt;ghughes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/repaint/hidpi-block-width-change-leaves-cruft.html
</del><ins>+        Add &quot;VisibleOnly&quot; key to search predicate
+        https://bugs.webkit.org/show_bug.cgi?id=115491
</ins><span class="cx"> 
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::repaintViewRectangle):
</del><ins>+        Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-2014-04-10  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Added support for accessibility clients to use the search predicate to find only visible elements
</ins><span class="cx"> 
</span><del>-        WebGL: need error checking after texture uploads
-        https://bugs.webkit.org/show_bug.cgi?id=62902
-        rdar://problem/9640309
</del><ins>+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isAccessibilityObjectSearchMatch):
+        (WebCore::AccessibilityObject::isOnscreen):
+        (WebCore):
+        * accessibility/AccessibilityObject.h:
+        (AccessibilitySearchCriteria):
+        (WebCore::AccessibilitySearchCriteria::AccessibilitySearchCriteria):
+        (AccessibilityObject):
+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+2013-06-04  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        A followup to Darin's r167109. We need to also check for errors
-        in the texImage2D case.
</del><ins>+        Unreviewed. Rollout of r151146. Broke some tests.
</ins><span class="cx"> 
</span><del>-        This is difficult to reproducibly test because it would require
-        attempting to exhaust GPU memory.
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::forceLayoutForPagination):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::layout):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clearLayoutOverflow):
+        * rendering/RenderBox.h:
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::layoutBlock):
</ins><span class="cx"> 
</span><del>-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::compressedTexImage2D): Check for errors by calling
-        moveErrorsToSyntheticErrorList twice, once before and once after. If an error
-        occurred, explicitly mark the texture as invalid.
-        (WebCore::WebGLRenderingContext::texImage2DBase): Ditto.
-        * html/canvas/WebGLTexture.cpp:
-        (WebCore::WebGLTexture::markInvalid): If the LevelInfo exists for this
-        mipmap level, then set the valid flag to false. There is a chance that
-        a previous call to texImage2D succeeded for this level, but it's probably
-        better to assume that is now invalid.
-        * html/canvas/WebGLTexture.h: New markInvalid method.
</del><ins>+2013-06-04  Noam Rosenthal  &lt;noam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-10  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Refactor the code that decides whether to enable WebGL from settings to helper functions
+        https://bugs.webkit.org/show_bug.cgi?id=117181
</ins><span class="cx"> 
</span><del>-        WebGL: need error checking after texture and buffer uploads in some cases
-        https://bugs.webkit.org/show_bug.cgi?id=62902
-        rdar://problem/9640309
</del><ins>+        This removes some #ifdef crud out of the getContext() function.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
-
-        Not clear how to write a test for this.
-
-        * html/canvas/WebGLBuffer.cpp:
-        (WebCore::WebGLBuffer::disassociateBufferData): Added.
-        * html/canvas/WebGLBuffer.h: Added disassociateBufferData.
-
-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::bufferData): Check for errors by calling
-        moveErrorsToSyntheticErrorList twice, once before and once after. If an error
-        occurred, call the WebGLBuffer so it doesn't think it has data.
-        (WebCore::WebGLRenderingContext::bufferSubData): Ditto.
-
-        * platform/graphics/GraphicsContext3D.h: Added moveErrorsToSyntheticErrorList.
-
-        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
-        (WebCore::GraphicsContext3D::moveErrorsToSyntheticErrorList): Added. Calls
-        glError and moves any errors to the synthetic error list.
-        (WebCore::GraphicsContext3D::getError): Added call to moveErrorsToSyntheticErrorList
-        to preserve error ordering.
-        (WebCore::GraphicsContext3D::synthesizeGLError): Ditto.
-
-2014-04-10  Enrica Casucci  &lt;enrica@apple.com&gt;
-
-        iOS build fix to deal with CoreText changes.
-        
</del><span class="cx">         Reviewed by Benjamin Poulain.
</span><del>-        
-        This is a temporary fix until CT fixes the issue.
</del><span class="cx"> 
</span><del>-        * rendering/RenderThemeIOS.mm:
</del><ins>+        * html/HTMLCanvasElement.cpp:
+        (WebCore::requiresAcceleratedCompositingForWebGL):
+        (WebCore::shouldEnableWebGL):
+        (WebCore::HTMLCanvasElement::getContext):
</ins><span class="cx"> 
</span><del>-2014-04-10  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-06-04  Thiago Santos  &lt;thiago.sousa.santos@collabora.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167073.
-        https://bugs.webkit.org/show_bug.cgi?id=131516
</del><ins>+        Prevent race when pad caps is set on gstreamer player
+        https://bugs.webkit.org/show_bug.cgi?id=115355
</ins><span class="cx"> 
</span><del>-        This patch caused crashes in video tests. (Requested by
-        mrobinson on #webkit).
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Prevent race when pad caps is set on gstreamer player and
+        Also protect internal paint buffer with a mutex.
</ins><span class="cx"> 
</span><del>-        &quot;[GStreamer] No CORS support for media elements&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=99037
-        http://trac.webkit.org/changeset/167073
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
+        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
+        (WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
+        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
+        (WebCore::MediaPlayerPrivateGStreamerBase::paint):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
+        (MediaPlayerPrivateGStreamerBase):
</ins><span class="cx"> 
</span><del>-2014-04-10  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+2013-06-04  Jocelyn Turcotte  &lt;jocelyn.turcotte@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        Radio buttons are using the wrong sizes and margins
-        https://bugs.webkit.org/show_bug.cgi?id=131503
</del><ins>+        [Qt] Fix a crash in QtPixmapRuntime.
+        https://bugs.webkit.org/show_bug.cgi?id=117193
+        https://bugreports.qt-project.org/browse/QTBUG-30736
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Reviewed by Allan Sandfeld Jensen.
</ins><span class="cx"> 
</span><del>-        This is a regression that I caused recently when I combined radio button and 
-        checkbox code. 
-        * platform/mac/ThemeMac.mm:
-        (WebCore::paintToggleButton):
</del><ins>+        The crash could only be reproduced in release builds on Windows.
+        JSClassCreate calculates the size of JSClassDefinition.staticValues
+        and staticFunctions by iterating until an entry with a null name is found.
</ins><span class="cx"> 
</span><del>-2014-04-08  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapRuntime::getClassRef):
</ins><span class="cx"> 
</span><del>-        Assertion failure in WebCore::FlexBoxIterator::next()
-        &lt;https://bugs.webkit.org/show_bug.cgi?id=117176&gt;
-        &lt;rdar://problem/14054549&gt;
</del><ins>+2013-06-04  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Code added in r115687 began removing anonymous wrappers when children
-        become inline. However, there are some objects, like
-        RenderDeprecatedFlexBox, whose children should always be blocks.
</del><ins>+        Automatically generate WorkerContext constructor attributes
+        https://bugs.webkit.org/show_bug.cgi?id=117183
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::canCollapseAnonymousBlockChild):
-        Made public.
</del><ins>+        Add [GlobalContext=WindowOnly|WorkerOnly|WindowAndWorker] IDL extended attribute
+        to indicate to the bindings generator on which global context the constructor
+        attribute should be generated for interfaces without [NoInterfaceObject]:
+        - WindowOnly: only on the global Window object (default if ommitted)
+        - WorkerOnly: only on the worker context
+        - WindowAndWorker: On both the global Window object and the worker context
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::removeAnonymousWrappersForInlinesIfNecessary):
-        Return early if we can't collapse anonymous block children.
</del><ins>+        This covers all the current use cases.
</ins><span class="cx"> 
</span><del>-2014-04-07  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        The JSC bindings generator now automatically generates the Constructor attributes
+        on the WorkerContext for non-callback interfaces which do not have the
+        [NoInterfaceObject] extended attribute but have [GlobalContext=WorkerOnly|WindowAndWorker]
+        extended attribute.
</ins><span class="cx"> 
</span><del>-        Assertion failure, !node || node-&gt;isElementNode(), in
-        WebCore::RenderBlock::clone()
-        &lt;https://bugs.webkit.org/show_bug.cgi?id=110489&gt;
-        &lt;rdar://problem/13666425&gt;
</del><ins>+        No new tests, already covered by:
+        fast/js/global-constructors-attributes.html
+        fast/js/global-constructors-attributes-worker.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        * CMakeLists.txt:
+        * DerivedSources.make: Pass new --workerContextConstructorsFile argument to preprocess-idls.pl.
+        * DerivedSources.pri: Ditto.
+        * GNUmakefile.am: Ditto.
+        * PlatformBlackBerry.cmake: Ditto.
+        * UseJSC.cmake: Ditto.
+        * bindings/scripts/IDLAttributes.txt: Add [GlobalContext=WindowOnly|WorkerOnly|WindowAndWorker]
+        IDL extended attribute.
+        * bindings/scripts/preprocess-idls.pl: Add support for [GlobalContext] extended attribute and
+        generate a partial interface for WorkerContext global constructors that are automatically
+        generated.
+        * dom/MessageEvent.idl: Add [GlobalContext=WindowAndWorker].
+        * fileapi/Blob.idl: Add [GlobalContext=WindowAndWorker].
+        * fileapi/FileReader.idl: Add [GlobalContext=WindowAndWorker].
+        * fileapi/FileReaderSync.idl: Add [GlobalContext=WorkerOnly] and remove [NoInterfaceObject]
+        as the interface should only be visible in worker environment as per the spec.
+        * html/DOMURL.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/ArrayBuffer.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/DataView.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Float32Array.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Float64Array.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Int16Array.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Int32Array.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Int8Array.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Uint16Array.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Uint32Array.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Uint8Array.idl: Add [GlobalContext=WindowAndWorker].
+        * html/canvas/Uint8ClampedArray.idl: Add [GlobalContext=WindowAndWorker].
+        * workers/WorkerContext.idl: Remove several Constructor attributes which are now automatically
+        generated.
+        * workers/WorkerLocation.idl: Add [GlobalContext=WorkerOnly] and remove [NoInterfaceObject]
+        as the interface should only be visible in worker environment as per the spec.
</ins><span class="cx"> 
</span><del>-        We're ending up in RenderBlock::splitBlocks() with |this| ==
-        |fromBlock|.  We then try to climb the ancestor block chain from
-        this-&gt;parent() to |fromBlock|, but this-&gt;parent() is already above
-        |fromBlock|, so we end up climbing up to the RenderView and trying to
-        clone it, causing the assertion failure.
</del><ins>+2013-06-04  Kangil Han  &lt;kangil.han@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Adopt Chromium's mitigation for this from
-        &lt;https://codereview.chromium.org/13852041&gt;. This is not intended as a
-        fix for the underlying issue.
</del><ins>+        Use ASSERT_DISABLED option for assertion purpose code in InlineBox
+        https://bugs.webkit.org/show_bug.cgi?id=117146
</ins><span class="cx"> 
</span><del>-        Also, fix another issue that occurs with this fuzzed test case that's
-        not handled by the Chromium fix.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::splitBlocks):
-        Ensure while we're in the loop that |curr| is a descendant of
-        |fromBlock|. From the Chromium patch:
</del><ins>+        We can distinguish assertion code with debug purpose by using ASSERT_DISABLED option.
</ins><span class="cx"> 
</span><del>-            We need to check in every iteration of the loop because
-            moveChildrenTo could have moved |curr|. This is a mitigation and
-            not really a fix against a class of tree craziness.
</del><ins>+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::~InlineBox):
+        (WebCore::InlineBox::destroy):
+        (WebCore::InlineBox::operator delete):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
</ins><span class="cx"> 
</span><del>-        Finally, before moving children from |fromBlock| to |toBlock|, ensure
-        that the children are children of |fromBlock|. If we never entered the
-        loop, they will be siblings of |fromBlock|, not children.
</del><ins>+2013-06-04  Kent Tamura  &lt;tkent@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-10  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        Fix an assertion failure in Range::textNodeSplit by Text::splitText
+        https://bugs.webkit.org/show_bug.cgi?id=116509
</ins><span class="cx"> 
</span><del>-        Build fix after http://trac.webkit.org/changeset/167085.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Range::textNodeSplit is called in Text::splitText, and it assumes the
+        next sibling node is still a Text node. A DOM mutation event handler can
+        break this assumption.
</ins><span class="cx"> 
</span><del>-        * plugins/PluginData.h:
</del><ins>+        We had better postpone DOM mutation events dispatched in Node::insertBefore
+        until exiting splitText to avoid inconsistent Range state.
</ins><span class="cx"> 
</span><del>-2014-04-10  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        This imports http://src.chromium.org/viewvc/blink?view=revision&amp;revision=150493 .
</ins><span class="cx"> 
</span><del>-        Web Inspector: Breakpoint in gutter has clipped / broken border image.
-        https://bugs.webkit.org/show_bug.cgi?id=131500
</del><ins>+        Test: fast/dom/Range/split-text-in-range.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        * dom/Text.cpp:
+        (WebCore::Text::splitText): Add EventQueueScope.
</ins><span class="cx"> 
</span><del>-        Typo in r166925.
</del><ins>+2013-06-03  Kangil Han  &lt;kangil.han@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/borders/border-image-slice-missing-right.html
</del><ins>+        Remove unused arithmetic operation in RenderListItem
+        https://bugs.webkit.org/show_bug.cgi?id=117175
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintNinePieceImage):
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-04-10  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        Variable 'markerLogicalLeft' is reassigned a value before the old one has been used.
</ins><span class="cx"> 
</span><del>-        Web Inspector: AXI: expose aria-busy state of current and ancestor nodes
-        https://bugs.webkit.org/show_bug.cgi?id=130826
</del><ins>+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+2013-06-03  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
</del><ins>+        Unreviewed. Some AppleWin VS2010 house cleaning.
</ins><span class="cx"> 
</span><del>-        Expose if node is contained by any &quot;busy&quot; ancestor nodes, too.
</del><ins>+        * WebCore.vcxproj/build-generated-files.sh:
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
</del><ins>+2013-06-03  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-10  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        clearLayoutOverflow should never be called before calling layer()-&gt;updateScrollInfoAfterLayout().
+        https://bugs.webkit.org/show_bug.cgi?id=116689.
</ins><span class="cx"> 
</span><del>-        Web Inspector: Remove unused ruler in overlay code
-        https://bugs.webkit.org/show_bug.cgi?id=131507
</del><ins>+        Reviewed by Ojan Vafai.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Make sure that clearLayoutOverflow only gets called after layer()-&gt;updateScrollInfoAfterLayout().
+        Also move clearLayoutOverflow to RenderBlock so we can keep all the delayed scroll update logic together.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::highlightConfigFromInspectorObject):
-        * inspector/InspectorOverlay.cpp:
-        (WebCore::buildObjectForHighlight):
-        * inspector/InspectorOverlay.h:
-        (WebCore::Highlight::Highlight):
-        (WebCore::Highlight::setDataFromConfig):
-        * inspector/InspectorOverlayPage.js:
-        (_drawFragmentHighlight):
-        (_drawRegionNumber): Deleted.
-        (quadToPath): Deleted.
-        (drawOutlinedQuad): Deleted.
-        (pathCommand): Deleted.
-        (drawPath): Deleted.
-        (drawOutlinedQuadWithClip): Deleted.
-        (quadEquals): Deleted.
-        (drawGutter): Deleted.
-        (drawNodeHighlight): Deleted.
-        (drawQuadHighlight): Deleted.
-        (setPlatform): Deleted.
-        (dispatch): Deleted.
-        (log): Deleted.
</del><ins>+        Test: fast/flexbox/clear-overflow-before-scroll-update.html
</ins><span class="cx"> 
</span><del>-2014-04-10  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layout): Remove call to clearLayoutOverflow.
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo): Add call to clearLayoutOverflow.
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout): Ditto.
+        (WebCore::RenderBlock::clearLayoutOverflow): ASSERT(!gDelayUpdateScrollInfo) and move from RenderBox to RenderBlock to keep delayed scroll update logic together.
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::layoutOverflowRect): Remove from layoutOverflowRect.
+        (RenderBox): 
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock): This should call updateScrollInfoAfterLayout() intead of directly calling layer()-&gt;updateScrollInfoAfterLayout().
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::layoutBlock): Ditto.
</ins><span class="cx"> 
</span><del>-        Web Replay: memoize plugin data for navigator.mimeTypes and navigator.plugins
-        https://bugs.webkit.org/show_bug.cgi?id=131341
</del><ins>+2013-05-31  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Take the normal NSView code path when drawing into an inclusive layer
+        https://bugs.webkit.org/show_bug.cgi?id=117094
+        &lt;rdar://problem/13812355&gt;
</ins><span class="cx"> 
</span><del>-        Information about plugins and mime types is nondeterministic and can change
-        at any time, whether by system events, browser settings changes, or
-        triggered by script. To avoid interposing on all those code paths, just
-        memoize the plugin data used by DOMPluginArray and DOMMimeTypeArray.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        This is less efficient than controlling mutations to the underlying PluginData
-        of a Page, but that can be done later if better plugin support is desired.
-        The point of this change is to make analytics trackers deterministic across
-        enabling/disabling of plugins.
</del><ins>+        For now, take the normal code path when drawing into an inclusive layer.
</ins><span class="cx"> 
</span><del>-        Test: LayoutTests/inspector/window-navigator-plugins-memoized.hml
</del><ins>+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint):
</ins><span class="cx"> 
</span><del>-        * plugins/DOMMimeTypeArray.cpp:
-        (WebCore::DOMMimeTypeArray::getPluginData):
-        * plugins/DOMPluginArray.cpp:
-        (WebCore::DOMPluginArray::pluginData): Save or restore memoized plugin
-        data during capture and replay, respectively.
</del><ins>+2013-05-31  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        * plugins/PluginData.h:
-        (WebCore::PluginData::PluginData): Add a constructor that uses the
-        provided plugin data rather than fetching live plugin data. This is
-        marked protected so it's only used by a subclass specifically for
-        deserialization.
</del><ins>+        [BlackBerry] Update Button UX.
+        https://bugs.webkit.org/show_bug.cgi?id=116992
</ins><span class="cx"> 
</span><del>-        * replay/SerializationMethods.cpp: Add encoder specializations.
-        (JSC::EncodingTraits&lt;MimeClassInfo&gt;::encodeValue):
-        (JSC::EncodingTraits&lt;MimeClassInfo&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;PluginInfo&gt;::encodeValue):
-        (JSC::EncodingTraits&lt;PluginInfo&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;PluginData&gt;::encodeValue):
-        (JSC::DeserializedPluginData::DeserializedPluginData): Add a custom
-        subclass of PluginData that can be initialized from deserialized data.
-        (JSC::EncodingTraits&lt;PluginData&gt;::decodeValue):
-        * replay/SerializationMethods.h:
-        * replay/WebInputs.json: Add new input FetchPluginData.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-2014-04-10  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        BlackBerry PR 342298.
+        Internally Review by Jeff Rogers.
</ins><span class="cx"> 
</span><del>-        Remove &quot;System Font&quot; from character width calculations
-        https://bugs.webkit.org/show_bug.cgi?id=131411
</del><ins>+        * css/themeBlackBerry.css:
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+2013-05-31  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Covered by existing tests
</del><ins>+        DerivedSources.make: any rules that use $(FEATURE_DEFINES) should be rebuilt when FeatureDefines.xcconfig changes
+        &lt;http://webkit.org/b/117081&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Font.cpp:
-        (WebCore::Font::hasValidAverageCharWidth):
</del><ins>+        Reviewed by Mark Rowe.
</ins><span class="cx"> 
</span><del>-2014-04-10  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        * DerivedSources.make: Add $(PLATFORM_FEATURE_DEFINES)
+        dependency for all rules that use $(FEATURE_DEFINES) to generate
+        files.
+        (PLATFORM_FEATURE_DEFINES): Set this variable to
+        Configurations/FeatureDefines.xcconfig if not already set on
+        Mac OS X.
</ins><span class="cx"> 
</span><del>-        Invalid cast in WebCore::RenderLayer::setupClipPath
-        https://bugs.webkit.org/show_bug.cgi?id=131368
</del><ins>+2013-05-31  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Text Field UX updates.
+        https://bugs.webkit.org/show_bug.cgi?id=116996
</ins><span class="cx"> 
</span><del>-        Only attempt to clip to a box shape if the renderer being clipped is
-        actually a box.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Test: css3/masking/clip-path-box-shape-on-inline-crash.html
</del><ins>+        BlackBerry PR 342333.
+        Internally Reviewed by Jeff Rogers.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::setupClipPath): Add isBox() check.
</del><ins>+        Update disabled text field font color.
</ins><span class="cx"> 
</span><del>-2014-04-10  Owen Taylor  &lt;otaylor@redhat.com&gt;
</del><ins>+        * css/themeBlackBerry.css:
</ins><span class="cx"> 
</span><del>-        [GTK] Remove a comment that was incorrectly cut-and-pasted from WidgetBackingStoreCairo
-        https://bugs.webkit.org/show_bug.cgi?id=131499
</del><ins>+2013-05-31  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        Update CheckedInt.h to latest version from Mozilla
+        https://bugs.webkit.org/show_bug.cgi?id=117009
</ins><span class="cx"> 
</span><del>-        * platform/gtk/WidgetBackingStoreGtkX11.cpp: Remove a comment that was incorrectly copy and pasted
-        from the Cairo implementation.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-04-09  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Mozilla have updated their version of CheckedInt and suggested
+        we sync. Here are the improvements:
</ins><span class="cx"> 
</span><del>-        Eliminate DragSession structure
-        https://bugs.webkit.org/show_bug.cgi?id=131465
</del><ins>+        - CheckedInt now consistently rejects unsupported types. Before, you
+        could sometimes construct a CheckedInt from an unsupported type (like,
+        float) or multiply a CheckedInt by a float, and have it not caught! See
+        https://bugzilla.mozilla.org/show_bug.cgi?id=869194
+         - Fixed a possibility of undefined behavior in unary operator-. See bug
+        https://bugzilla.mozilla.org/show_bug.cgi?id=849666
+         - CheckedInt now supports the &quot;long long&quot; and &quot;unsigned long long&quot;
+        types. We don't like &quot;long long&quot; (and neither does the Google C++ style
+        guide!) but we had to do that because libogg exposes typedefs to those
+        types. See Bug https://bugzilla.mozilla.org/show_bug.cgi?id=869685
+         - CheckedInt also now supports &quot;signed char&quot; in addition to &quot;char&quot; ---
+        they are not the same type! See Bug https://bugzilla.mozilla.org/show_bug.cgi?id=847521
+         - Fixed and simplified usage of CheckedInt outside of Mozilla. You'll
+        like this one! See Bug https://bugzilla.mozilla.org/show_bug.cgi?id=849667
+         - Fixed compilation with the Intel C++ compiler. See bug https://bugzilla.mozilla.org/show_bug.cgi?id=784309
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        * html/canvas/CheckedInt.h: Updated.
</ins><span class="cx"> 
</span><del>-        DragSession is really just a transient response to NSDragDestination delegate methods.
-        The &quot;session&quot; name was quite misleading, and thankfully, we don't need a class for this
-        bag of data at all.
</del><ins>+2013-05-31  Andre Moreira Magalhaes   &lt;andre.magalhaes@collabora.co.uk&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * page/DragController.cpp:
-        (WebCore::DragController::DragController):
-        (WebCore::DragController::dragEntered):
-        (WebCore::DragController::dragUpdated):
-        (WebCore::DragController::dragEnteredOrUpdated):
-        (WebCore::DragController::tryDocumentDrag):
-        * page/DragController.h:
-        (WebCore::DragController::mouseIsOverFileInput):
-        (WebCore::DragController::numberOfItemsToBeAccepted):
-        * page/DragSession.h: Removed.
</del><ins>+        Make sure gstreamer source element is thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=115352
</ins><span class="cx"> 
</span><del>-2014-04-10  Youenn Fablet  &lt;youenn.fablet@crf.canon.fr&gt;
-
-        [GStreamer] No CORS support for media elements
-        https://bugs.webkit.org/show_bug.cgi?id=99037
-
</del><span class="cx">         Reviewed by Philippe Normand.
</span><span class="cx"> 
</span><del>-        Added CORS access control check to media sources when crossorigin attribute is set.
</del><ins>+        GStreamer source element may be created by any gstreamer element on any thread by calling
+        gst_element_make_from_uri with the URIs handled by the source element.
+        This patch makes sure the gstreamer source element is thread-safe to avoid issues with it
+        being created outside the main thread.
</ins><span class="cx"> 
</span><del>-        Added getter to CORS access control check status (used to compute whether the stream is tainted or not).
-        Related test is http/tests/security/video-cross-origin-readback.html.
-
-        Disabled access to cross-origin streams that fail CORS check when crossorigin attribute is set.
-        Related test is http/tests/security/video-cross-origin-accessfailure.html.
-
-        Tests: http/tests/security/video-cross-origin-accessfailure.html
-               http/tests/security/video-cross-origin-accesssameorigin.html
-
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::didPassCORSAccessCheck): Return whether media is cross-origin (tainted) or not by querying the gstreamer source layer.
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Added MediaPlayerPrivateGStreamer::didPassCORSAccessCheck declaration.
</del><span class="cx">         * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
</span><del>-        (webKitWebSrcStart): Passed CORS mode parameter to the streaming client. In case of CORS check failure, stop the resource loading.
-        (webKitSrcPassedCORSAccessCheck): Return whether CORS access control check was done and successful.
-        (StreamingClient::handleResponseReceived): Take a parameter to assign the CORS access control check result.
-        (CachedResourceStreamingClient::CachedResourceStreamingClient): Updated setting of the ResourceLoaderOptions according CORS mode.
-        (CachedResourceStreamingClient::responseReceived): Check CORS and pass result to handleResponseReceived.
-        (ResourceHandleStreamingClient::didReceiveResponse): No CORS check.
-        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.h: Added webKitSrcPassedCORSAccessCheck declaration.
</del><ins>+        (_WebKitWebSrcPrivate):
+        (webkit_web_src_init):
+        (webKitWebSrcFinalize):
+        (webKitWebSrcSetProperty):
+        (webKitWebSrcGetProperty):
+        (webKitWebSrcStop):
+        (webKitWebSrcStart):
+        (webKitWebSrcChangeState):
+        (webKitWebSrcQueryWithParent):
+        (webKitWebSrcGetUri):
+        (webKitWebSrcSetUri):
+        (webKitWebSrcNeedDataMainCb):
+        (webKitWebSrcEnoughDataMainCb):
+        (webKitWebSrcSeekMainCb):
+        (webKitWebSrcSeekDataCb):
+        (webKitWebSrcSetMediaPlayer):
+        (StreamingClient::StreamingClient):
+        (StreamingClient::~StreamingClient):
+        (StreamingClient::didReceiveResponse):
+        (StreamingClient::didReceiveData):
+        (StreamingClient::didFinishLoading):
+        (StreamingClient::wasBlocked):
+        (StreamingClient::cannotShowURL):
</ins><span class="cx"> 
</span><del>-2014-04-10  Eva Balazsfalvi  &lt;evab.u-szeged@partner.samsung.com&gt;
</del><ins>+2013-05-31  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Move UseJSC.cmake back to CMakeLists.txt
-        https://bugs.webkit.org/show_bug.cgi?id=130834
</del><ins>+        Build fix when CSSParser debugging is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=117075
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        No new tests required.
</del><ins>+        Build fails when enabling parser debugging by setting YYDEBUG to
+        1 because of a missing include.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * UseJSC.cmake: Removed.
</del><ins>+        * css/CSSGrammar.y.includes:
</ins><span class="cx"> 
</span><del>-2014-04-09  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-05-31  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r167046.
-        https://bugs.webkit.org/show_bug.cgi?id=131479
</del><ins>+        [Soup] [Gstreamer] ASSERT in StreamingClient::getOrCreateReadBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=116686
</ins><span class="cx"> 
</span><del>-        Caused 300+ failures on Mavericks WK1 tester (Requested by ap
-        on #webkit).
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        We were using g_input_stream_read_async() to handle redirections
+        because of Gnome bug #691489.
</ins><span class="cx"> 
</span><del>-        &quot;Remove &quot;System Font&quot; from whitelisted DRT fonts and char
-        width calculations&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=131411
-        http://trac.webkit.org/changeset/167046
</del><ins>+        This produces an unexpected read attempt which triggers an assert
+        in StreamingClient::getOrCreateReadBuffer().
</ins><span class="cx"> 
</span><del>-2014-04-09  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+        Now that the Gnome bug is fixed we can replace read_async() with
+        skip_async().
</ins><span class="cx"> 
</span><del>-        Fix build failure.
-        https://bugs.webkit.org/show_bug.cgi?id=131473
</del><ins>+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::ensureReadBuffer):
+        (WebCore::redirectSkipCallback):
+        (WebCore::sendRequestCallback):
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+2013-05-30  Eugene Klyuchnikov  &lt;eustas@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Fix build failure.
</del><ins>+        selectionStart/selectionEnd return &quot;obsolete&quot; values when requested during &quot;input&quot; event
+        https://bugs.webkit.org/show_bug.cgi?id=110742
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (mediaSelectionOptions):
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-04-09  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        This patch defers firing &quot;webkitEditableContentChanged&quot; until new
+        selection is applied to control. This makes selection during &quot;input&quot;
+        more consistent and reliable.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after http://trac.webkit.org/changeset/167045
</del><ins>+        Background: &quot;input&quot; event is fired by &quot;webkitEditableContentChanged&quot;
+        dispatcher. But &quot;input&quot; is scoped event, so under some conditions its
+        dispatching may be deferred. When &quot;input&quot; dispatching is deferred,
+        dispatcher observes updated selectionStart and selectionEnd.
+        Otherwise values repersent state before applying editing command.
</ins><span class="cx"> 
</span><del>-        The file contained an invalid character.
</del><ins>+        So, to make selectionStart/End to be more predictable and useful, we
+        need either always dispatch &quot;input&quot; before selection is updated, or
+        always dispatch &quot;input&quot; after selection is updated.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (WebVideoFullscreenInterfaceAVKit::enterFullscreen):
</del><ins>+        As it was mentioned, dispatching could be deferred by scoping. So
+        dispatching before updating selection couldn't be guaranteed.
+        Moreover, it will be hard to calculate updated selection in user
+        code. On the other side - old selection could be easily tracked.
</ins><span class="cx"> 
</span><del>-2014-04-09  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        So, it looks logically that we should guarantee dispatching &quot;input&quot;
+        after updating selection. There are no execution paths in
+        &quot;webkitEditableContentChanged&quot; dispatched that depends on current
+        selection. So it is safe to fire this event after selection is updated.
</ins><span class="cx"> 
</span><del>-        [iOS] Media controls should resize as the user zooms
-        https://bugs.webkit.org/show_bug.cgi?id=131322
</del><ins>+        Test: editing/selection/caret-after-keypress.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * editing/Editor.cpp:
+        Dispatch &quot;input&quot; event after new selection in applied.
</ins><span class="cx"> 
</span><del>-        On iOS the media controls should remain the same size
-        independent of user zoom. Have the HTMLMediaElement optionally
-        register for updates in the page scale to apply an inverse
-        scale.
</del><ins>+2013-05-30  Ruth Fong  &lt;ruth_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/MediaControlsHost.cpp: New exposed property that calls
-        back into HTMLMediaElement::mediaControlsDependOnPageScaleFactor.
-        (WebCore::MediaControlsHost::controlsDependOnPageScaleFactor):
-        (WebCore::MediaControlsHost::setControlsDependOnPageScaleFactor):
-        * Modules/mediacontrols/MediaControlsHost.h: Keep a reference to the actual
-        controls from the JavaScript side so we can talk to it later.
-        (WebCore::MediaControlsHost::controllerJSValue):
-        (WebCore::MediaControlsHost::setControllerJSValue):
-        * Modules/mediacontrols/MediaControlsHost.idl: Expose controlsDependOnPageScaleFactor.
</del><ins>+        WebKit's Enter Full Screen for &lt;video&gt; elements isn't working
+        https://bugs.webkit.org/show_bug.cgi?id=117001
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsiOS.css:
-        (audio::-webkit-media-controls-panel): Specify the transform origin so that
-        scaling will keep the controls pinned to the bottom left corner.
-        (audio::-webkit-media-controls-start-playback-button): Update to the correct size
-        and provide new artwork.
-        (audio::-webkit-media-controls-start-playback-button.failed): New artwork.
-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS): Tell the host that these controls care about the page scale.
-        (ControllerIOS.prototype.get pageScaleFactor): New getter.
-        (ControllerIOS.prototype.set pageScaleFactor): When set, update the play button and the panel.
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::ensureMediaControlsInjectedScript): Small naming cleanup.
-        (setPageScaleFactorProperty): Static helper to set a JS property value.
-        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot): Keep a reference to the controls object,
-        and make sure to set the page scale factor on the controls.
-        (WebCore::HTMLMediaElement::pageScaleFactorChanged): Implement the callback, telling
-        the controls object that it needs to relayout.
</del><ins>+        Fix workflow to allow a video to enter into full screen
+        mode from a kWKContextMenuItemTagEnterVideoFullscreen 
+        context menu item by denoting the enterFullscreenForVideo
+        call as a user gesture, so Document::requestFullScreenForElement
+        will execute correctly.
</ins><span class="cx"> 
</span><del>-2014-04-09  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        No new tests. Covered by media/context-menu-actions.html,
+        which is disabled due to bug #116651.
</ins><span class="cx"> 
</span><del>-        Try to fix iOS build.
</del><ins>+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::enterFullscreenForVideo):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileController.mm:
</del><ins>+2013-05-30  Rafael Brandao  &lt;rafael.lobo@openbossa.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-09  Andy Estes  &lt;aestes@apple.com&gt;
</del><ins>+        Fix double hash lookup in RenderTableSection::paintObject loop
+        https://bugs.webkit.org/show_bug.cgi?id=117055
</ins><span class="cx"> 
</span><del>-        REGRESSION (r165908): ~QuickLookHandle() tries to dereference a null ResourceHandle
-        https://bugs.webkit.org/show_bug.cgi?id=131467
</del><ins>+        Reviewed by Antonio Gomes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paintObject):
</ins><span class="cx"> 
</span><del>-        QuickLookHandle stored a ResourceHandle pointer in order to later
-        retrive the URL of its firstRequest(), but after r165908 we no longer
-        always have a ResourceHandle. Since firstRequest()'s URL is the only
-        thing we need from ResourceHandle, store it directly rather than a
-        ResourceHandle pointer. In the case where we create a QuickLookHandle
-        from a ResourceLoader rather than a ResourceHandle, pass the loader's
-        originalRequest(), which represents the same request as firstRequest()
-        (i.e. the request after willSendRequest() but before redirects).
</del><ins>+2013-05-31  Stephanie Lewis  &lt;slewis@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/ios/QuickLook.h:
-        * platform/network/ios/QuickLook.mm:
-        (WebCore::QuickLookHandle::QuickLookHandle):
-        (WebCore::QuickLookHandle::create):
-        (WebCore::QuickLookHandle::didFail):
-        (WebCore::QuickLookHandle::~QuickLookHandle):
</del><ins>+        Update low memory handler to use new memory pressure notifications on new OS versions.
+        &lt;rdar://problem/14027095&gt;
</ins><span class="cx"> 
</span><del>-2014-04-09  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        Reviewed by Mark Rowe.
</ins><span class="cx"> 
</span><del>-        AX: Bug in AccessibilityNodeObject::helpText
-        https://bugs.webkit.org/show_bug.cgi?id=130386
</del><ins>+        No change in functionality.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        * WebCore.exp.in:
+        * platform/mac/MemoryPressureHandlerMac.mm:
+        (WebCore::MemoryPressureHandler::install): Call new API
+        * platform/mac/WebCoreSystemInterface.h: 
+        * platform/mac/WebCoreSystemInterface.mm:
</ins><span class="cx"> 
</span><del>-        Test: accessibility/help-text.html
</del><ins>+2013-05-30  Rafael Brandao  &lt;rafael.lobo@openbossa.org&gt;
</ins><span class="cx"> 
</span><del>-        Ancestor loop was always checking attribute of original node rather than current node.
</del><ins>+        Fix double hash lookup in WebSocket::connect loop
+        https://bugs.webkit.org/show_bug.cgi?id=117052
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityNodeObject.cpp:
-        (WebCore::AccessibilityNodeObject::helpText):
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-04-09  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
</ins><span class="cx"> 
</span><del>-        Regression: AX: list heuristics sometimes determined as presentational even when explicit roles applied
-        https://bugs.webkit.org/show_bug.cgi?id=131041
</del><ins>+2013-05-30  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+        Remove some 16bits conversion.
+        https://bugs.webkit.org/show_bug.cgi?id=116935
</ins><span class="cx"> 
</span><del>-        When display:table is used on a list item, it inserts RenderObjects that can be ignored as the children
-        of the list. This allows normal list heuristics to be applied.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::computeAccessibilityIsIgnored):
</del><ins>+        Merge chromium ce35a544d09e6cb907457535340eb0e9984e57b8.
+        https://chromium.googlesource.com/chromium/blink/+/ce35a544d09e6cb907457535340eb0e9984e57b8
</ins><span class="cx"> 
</span><del>-2014-04-09  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        * html/parser/InputStreamPreprocessor.h:
+        * platform/FileSystem.cpp:
+        (WebCore::encodeForFileName):
</ins><span class="cx"> 
</span><del>-        TileGrid should be PlatformCALayerClient instead of TileController
-        https://bugs.webkit.org/show_bug.cgi?id=131456
-        
-        Switch one more place to use removeTiles.
</del><ins>+2013-05-30  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::revalidateTiles):
</del><ins>+        REGRESSION (r119759): Adobe Flash Player &quot;smaller&quot; installer relies on the incorrect firing of a load event and needs an app-specific hack for compatibility
+        https://bugs.webkit.org/show_bug.cgi?id=117042
+        &lt;rdar://problem/13916291&gt;
</ins><span class="cx"> 
</span><del>-2014-04-09  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        Reviewed by Mark Rowe.
</ins><span class="cx"> 
</span><del>-        Remove &quot;System Font&quot; from whitelisted DRT fonts and char width calculations
-        https://bugs.webkit.org/show_bug.cgi?id=131411
</del><ins>+        Ignore HTTP errors for scripts requested from within the installer. Instead of just checking for the
+        Adobe Flash installer, we use the &quot;com.solidstatenetworks.awkhost&quot; bundle identifier to determine
+        whether to apply the workaround. This could in theory fix other installers that use the same mechanism.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::shouldIgnoreHTTPStatusCodeErrors):
+        * loader/cache/CachedScript.h:
+        * platform/RuntimeApplicationChecks.cpp:
+        (WebCore::applicationIsSolidStateNetworksDownloader):
+        * platform/RuntimeApplicationChecks.h:
</ins><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+2013-05-30  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Font.cpp:
-        (WebCore::Font::hasValidAverageCharWidth):
</del><ins>+        Allow no space between &quot;background-position:&quot; dimensions
+        https://bugs.webkit.org/show_bug.cgi?id=116870
</ins><span class="cx"> 
</span><del>-2014-04-09  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Fullscreen does two view controller changes at once
-        https://bugs.webkit.org/show_bug.cgi?id=131432
</del><ins>+        From Blink r149314 by &lt;ericwilligers@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Specs allow no spaces between the dimensions of a
+        &quot;background-position:&quot; like &quot;1px+1px&quot;, we should support
+        that.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (WebVideoFullscreenInterfaceAVKit::enterFullscreen):
-        delay -presentViewController on the main run loop to allow
-        previous view controller change to complete.
</del><ins>+        Whitespaces are no longer early consumed, dramatically dropping
+        the shift/reduce conflicts to half. The productions unary_term,
+        calc_func_term, calc_func_expr and calc_func_paren_expr no longer
+        consume whitespaces.
</ins><span class="cx"> 
</span><del>-2014-04-09  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+        * css/CSSGrammar.y.in:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::realLex):
</ins><span class="cx"> 
</span><del>-        Enable fullscreen captions selection
-        https://bugs.webkit.org/show_bug.cgi?id=131069
</del><ins>+2013-05-30  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        HTMLMediaElement will not unthrottle page when playback stops for nreasons other than user-initiated pause.
+        https://bugs.webkit.org/show_bug.cgi?id=117016
</ins><span class="cx"> 
</span><del>-        Enable media selection options from fullscreen. i.e. captions.
</del><ins>+        Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Add exports for 
-        setAudioMediaSelectionOptions
-        setLegibleMediaSelectionOptions
-        selectAudioMediaOption
-        selectLegibleMediaOption
</del><ins>+        Add a new class PageActivityAssertionToken to allow HTMLMediaElement to decouple
+        knowledge of and control over the lifetime of PageThrottler. The new class will
+        have weak references to and from the PageThrottler so that holders of the token
+        will not need to care if the Page or PageThrottler has been destroyed. 
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterface.h:
-        Add setAudioMediaSelectionOptions/setLegibleMediaSelectionOptions
</del><ins>+        HTMLMediaElement will create one of these PageActivityAssertionTokens when playback
+        begins and destroy it when playback stops for any reason, or when the element is
+        destroyed.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        Add setAudioMediaSelectionOptions/setLegibleMediaSelectionOptions
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::~HTMLMediaElement):
+        (WebCore::HTMLMediaElement::playInternal):
+        (WebCore::HTMLMediaElement::pauseInternal):
+        (WebCore::HTMLMediaElement::playbackProgressTimerFired):
+        (WebCore::HTMLMediaElement::updatePlayState):
+        * html/HTMLMediaElement.h:
+        * page/Page.cpp:
+        (WebCore::createActivityToken): Added simple factory method.
+        * page/Page.h:
+        * page/PageActivityAssertionToken.cpp: 
+        (WebCore::PageActivityAssertionToken::PageActivityAssertionToken): Call addActivityToken();
+        (WebCore::PageActivityAssertionToken::~PageActivityAssertionToken): Call removeActivityToken();
+        (WebCore::PageActivityAssertionToken::invalidate): Clear m_throttler.
+        * page/PageActivityAssertionToken.h:
+        * page/PageThrottler.cpp:
+        (WebCore::PageThrottler::~PageThrottler): Invalidate all outstanding tokens.
+        (WebCore::PageThrottler::addActivityToken): Bump the activity count.
+        (WebCore::PageThrottler::removeActivityToken): Lower the activity count.
+        * page/PageThrottler.h:
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        Add setAudioMediaSelectionOptions/setLegibleMediaSelectionOptions
</del><ins>+        Add the new files to the various build systems:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-        (-[WebAVPlayerController dealloc]):
-        (-[WebAVPlayerController hasMediaSelectionOptions]):
-        (+[WebAVPlayerController keyPathsForValuesAffectingHasMediaSelectionOptions]):
-        (-[WebAVPlayerController hasAudioMediaSelectionOptions]):
-        (+[WebAVPlayerController keyPathsForValuesAffectingHasAudioMediaSelectionOptions]):
-        (-[WebAVPlayerController hasLegibleMediaSelectionOptions]):
-        (+[WebAVPlayerController keyPathsForValuesAffectingHasLegibleMediaSelectionOptions]):
-        (-[WebAVPlayerController currentAudioMediaSelectionOption]):
-        (-[WebAVPlayerController setCurrentAudioMediaSelectionOption:]):
-        (-[WebAVPlayerController currentLegibleMediaSelectionOption]):
-        (-[WebAVPlayerController setCurrentLegibleMediaSelectionOption:]):
-        (WebVideoFullscreenInterfaceAVKit::setAudioMediaSelectionOptions):
-        (WebVideoFullscreenInterfaceAVKit::setLegibleMediaSelectionOptions):
-        * platform/ios/WebVideoFullscreenModel.h:
-        Add selectAudioMediaOption/selectLegibleMediaOption
</del><ins>+2013-05-29  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.h:
-        Add selectAudioMediaOption/selectLegibleMediaOption
</del><ins>+        [Mac] Enable cache partitioning and the public suffix list on 10.8
+        &lt;rdar://problem/13679019&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        Add selectAudioMediaOption/selectLegibleMediaOption
</del><ins>+        Rubber-stamped by David Kilzer.
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::setMediaElement):
-        Send initial media selection options.
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::selectAudioMediaOption):
-        Will be implemented when audio track slection is implemented.
</del><ins>+2013-05-30  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::selectLegibleMediaOption):
-        Select corresponding text track on HTMLMediaElement.
</del><ins>+        Fix double hash lookup in DocumentEventQueue::cancelEvent().
+        &lt;http://webkit.org/b/117031&gt;
</ins><span class="cx"> 
</span><del>-2014-04-09  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        TileGrid should be PlatformCALayerClient instead of TileController
-        https://bugs.webkit.org/show_bug.cgi?id=131456
</del><ins>+        * dom/DocumentEventQueue.cpp:
+        (WebCore::DocumentEventQueue::cancelEvent):
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+2013-05-30  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The client interface is for the tiles in the grid.
</del><ins>+        Fix double hash lookup in DocumentLoader::removeSubresourceLoader().
+        &lt;http://webkit.org/b/117030&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::setContentsScale):
-        (WebCore::TileController::createTileLayer):
-        (WebCore::TileController::platformCALayerPaintContents): Deleted.
-        (WebCore::TileController::platformCALayerDeviceScaleFactor): Deleted.
-        (WebCore::TileController::platformCALayerShowDebugBorders): Deleted.
-        (WebCore::TileController::platformCALayerShowRepaintCounter): Deleted.
-        (WebCore::TileController::platformCALayerIncrementRepaintCount): Deleted.
-        * platform/graphics/ca/mac/TileGrid.h:
-        
-            Move repaint counter to TileGrid too.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::removeTiles):
-        (WebCore::TileGrid::removeAllSecondaryTiles):
-        (WebCore::TileGrid::removeTilesInCohort):
-        
-           Cleaned up tile removal.
</del><ins>+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::removeSubresourceLoader):
</ins><span class="cx"> 
</span><del>-        (WebCore::TileGrid::revalidateTiles):
-        (WebCore::TileGrid::ensureTilesForRect):
-        (WebCore::TileGrid::platformCALayerPaintContents):
-        (WebCore::TileGrid::platformCALayerDeviceScaleFactor):
-        (WebCore::TileGrid::platformCALayerShowDebugBorders):
-        (WebCore::TileGrid::platformCALayerShowRepaintCounter):
-        (WebCore::TileGrid::platformCALayerContentsOpaque):
-        (WebCore::TileGrid::platformCALayerIncrementRepaintCount):
-        (WebCore::queueTileForRemoval): Deleted.
</del><ins>+2013-05-30  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-09  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Fix double hash lookup in RenderView::repaintSelection() loop.
+        &lt;http://webkit.org/b/117029&gt;
</ins><span class="cx"> 
</span><del>-        Rename some dragging functions
-        https://bugs.webkit.org/show_bug.cgi?id=131460
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::repaintSelection):
</ins><span class="cx"> 
</span><del>-        Renamed performDrag to performDragOperation. This function is responsible for
-        accepting a drop, not for the whole drag.
</del><ins>+2013-05-30  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        The new name is not perfect either, but I think that it's better, and at least
-        it matches AppKit, like the other dragging destination functions already do.
</del><ins>+        CURL: Incorrect stripping of query from file URL
+        https://bugs.webkit.org/show_bug.cgi?id=104307
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/DragController.cpp:
-        (WebCore::DragController::performDragOperation):
-        (WebCore::DragController::performDrag): Deleted.
-        * page/DragController.h:
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-04-08  Samuel White  &lt;samuel_white@apple.com&gt;
</del><ins>+        Clear the query part of the file URL if there is any.
</ins><span class="cx"> 
</span><del>-        AX: Initial text selection point should respect element focus.
-        https://bugs.webkit.org/show_bug.cgi?id=131402
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+2013-05-30  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Support the case where we want to set the initial selection and there's already a focused element.
</del><ins>+        Separate generic font family settings to a class
+        https://bugs.webkit.org/show_bug.cgi?id=117027
</ins><span class="cx"> 
</span><del>-        No new tests, updated existing selection-initial to test this functionality.
-
-        * page/EventHandler.cpp:
-        (WebCore::setKeyboardSelection):
-        (WebCore::handleKeyboardSelectionMovement):
-
-2014-04-09  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-
-        HTMLCollection::updateNamedElementCach iterates over items twice
-        https://bugs.webkit.org/show_bug.cgi?id=131448
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Compute the length first and go through the cache interface to traverse through items.
</del><ins>+        The new class is under platform/ and can be accessed by the font code directly without platform violations.
</ins><span class="cx"> 
</span><del>-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::updateNamedElementCache):
</del><ins>+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Settings.cpp:
+        (WebCore::invalidateAfterGenericFamilyChange):
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::~Settings):
+        (WebCore::Settings::create):
+        (WebCore::Settings::standardFontFamily):
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::fixedFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::serifFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::sansSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::cursiveFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::fantasyFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        (WebCore::Settings::pictographFontFamily):
+        (WebCore::Settings::setPictographFontFamily):
+        * page/Settings.h:
+        * platform/graphics/FontGenericFamilies.cpp: Added.
+        (WebCore::setGenericFontFamilyForScript):
+        (WebCore::genericFontFamilyForScript):
+        (WebCore::FontGenericFamilies::FontGenericFamilies):
+        (WebCore::FontGenericFamilies::standardFontFamily):
+        (WebCore::FontGenericFamilies::fixedFontFamily):
+        (WebCore::FontGenericFamilies::serifFontFamily):
+        (WebCore::FontGenericFamilies::sansSerifFontFamily):
+        (WebCore::FontGenericFamilies::cursiveFontFamily):
+        (WebCore::FontGenericFamilies::fantasyFontFamily):
+        (WebCore::FontGenericFamilies::pictographFontFamily):
+        (WebCore::FontGenericFamilies::setStandardFontFamily):
+        (WebCore::FontGenericFamilies::setFixedFontFamily):
+        (WebCore::FontGenericFamilies::setSerifFontFamily):
+        (WebCore::FontGenericFamilies::setSansSerifFontFamily):
+        (WebCore::FontGenericFamilies::setCursiveFontFamily):
+        (WebCore::FontGenericFamilies::setFantasyFontFamily):
+        (WebCore::FontGenericFamilies::setPictographFontFamily):
+        * platform/graphics/FontGenericFamilies.h: Added.
+        (WebCore::UScriptCodeHashTraits::emptyValue):
+        (WebCore::UScriptCodeHashTraits::constructDeletedValue):
+        (WebCore::UScriptCodeHashTraits::isDeletedValue):
+        (WebCore::FontGenericFamilies::create):
</ins><span class="cx"> 
</span><del>-2014-04-09  Brendan Long  &lt;b.long@cablelabs.com&gt;
</del><ins>+2013-05-30  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [GStreamer] Expose MPEG-TS metadata
-        https://bugs.webkit.org/show_bug.cgi?id=122001
</del><ins>+        Avoid using CSSOM style declarations in HTML editing.
+        &lt;http://webkit.org/b/117019&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Test: media/track/in-band/track-in-band-mpegts-metadata.html
</del><ins>+        Convert the editing code to use ComputedStyleExtractor instead of instantiating CSSOM wrappers.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: Add InbandDataTextTrack.
-        * PlatformGTK.cmake: Look for gstreamer-mpegts and use it if available.
-        * WebCore.vcxproj/WebCore.vcxproj: Add InbandDataTextTrack.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Same.
-        * WebCore.xcodeproj/project.pbxproj: Same.
-        * html/track/DataCue.cpp:
-        (WebCore::DataCue::DataCue): Add a constructor using raw data.
-        * html/track/DataCue.h:
-        (WebCore::DataCue::create): Same.
-        * html/track/InbandDataTextTrack.cpp: Added, InbandTextTrack which implements addDataCue().
-        * html/track/InbandDataTextTrack.h:
-        * html/track/InbandGenericTextTrack.h: Move unimplemented methods to InbandTextTrack.
-        * html/track/InbandWebVTTTextTrack.h: Same.
-        * html/track/InbandTextTrack.h: Same, and add inBandMetadataTrackDispatchType.
-        * html/track/InbandTextTrack.cpp:
-        (WebCore::InbandTextTrack::create): Add constructor for InbandDataTextTrack.
-        (WebCore::InbandTextTrack::inBandMetadataTrackDispatchType): Added.
-        * html/track/TextTrack.h:
-        (WebCore::TextTrack::inBandMetadataTrackDispatchType): Added (empty).
-        * html/track/TextTrack.idl: Add inBandMetadataTrackDispatchType.
-        * platform/graphics/InbandTextTrackPrivate.h: Add inBandMetadataTrackDispatchType and Data format.
-        (WebCore::InbandTextTrackPrivate::inBandMetadataTrackDispatchType):
-        * platform/graphics/InbandTextTrackPrivateClient.h: Add addDataCue() method.
-        * platform/graphics/gstreamer/InbandMetadataTextTrackPrivateGStreamer.h:
-        (WebCore::InbandMetadataTextTrackPrivateGStreamer::create): Allow specifying the cue format and id.
-         (WebCore::InbandMetadataTextTrackPrivateGStreamer::InbandMetadataTextTrackPrivateGStreamer): Same.
-        (WebCore::InbandMetadataTextTrackPrivateGStreamer::setInBandMetadataTrackDispatchType): Added.
-        (WebCore::InbandMetadataTextTrackPrivateGStreamer::addDataCue): Added.
-        (WebCore::InbandMetadataTextTrackPrivateGStreamer::addGenericCue): Added.
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::handleMessage): Check for MPEG-TS sections.
-        (WebCore::MediaPlayerPrivateGStreamer::processMpegTsSection): Add MPEG-TS section metadata, and get inBandMetadataTrackDispatchType from the PMT.
-        (WebCore::MediaPlayerPrivateGStreamer::processTableOfContents): Explicitly use Generic CueFormat.
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
</del><ins>+        * css/CSSComputedStyleDeclaration.h:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
+        (WebCore::ComputedStyleExtractor::useFixedFontDefaultSize):
+        (WebCore::ComputedStyleExtractor::propertyMatches):
+        (WebCore::ComputedStyleExtractor::copyProperties):
+        (WebCore::ComputedStyleExtractor::copyPropertiesInSet):
</ins><span class="cx"> 
</span><del>-2014-04-08  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+            Moved here from CSSComputedStyleDeclaration. These methods are used by HTML editing.
</ins><span class="cx"> 
</span><del>-        AX: Make AXPress much more reliable on the Web
-        https://bugs.webkit.org/show_bug.cgi?id=131426
</del><ins>+        (WebCore::CSSComputedStyleDeclaration::copyProperties):
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+            Reimplemented to call ComputedStyleExtractor.
</ins><span class="cx"> 
</span><del>-        AXPress fails when an event handler is on a node higher in the parent chain than the focused node.
</del><ins>+        * css/CSSStyleDeclaration.h:
+        * css/PropertySetCSSStyleDeclaration.h:
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::copyProperties):
</ins><span class="cx"> 
</span><del>-        We need to make AXPress more reliable by 
-            1) Using the element that is focused as the target of the event
-            2) Search for the inner most control object when dispatching the event
</del><ins>+            Removed CSSStyleDeclaration::cssPropertyMatches(), the remaining code lives in
+            ComputedStyleExtractor::propertyMatches() and is only used by HTML editing.
</ins><span class="cx"> 
</span><del>-        Updated existing accessibility/press-works-on-control-types.html
</del><ins>+        * css/StylePropertySet.h:
+        * css/StylePropertySet.cpp:
+        (WebCore::MutableStylePropertySet::removeEquivalentProperties):
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityMenuList.cpp:
-        (WebCore::AccessibilityMenuList::press):
-        * accessibility/AccessibilityMenuList.h:
-        * accessibility/AccessibilityMenuListPopup.cpp:
-        (WebCore::AccessibilityMenuListPopup::press):
-        * accessibility/AccessibilityMenuListPopup.h:
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::press):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::performDefaultAction):
-        * accessibility/AccessibilitySearchFieldButtons.cpp:
-        (WebCore::AccessibilitySearchFieldCancelButton::press):
-        * accessibility/AccessibilitySearchFieldButtons.h:
-        * accessibility/AccessibilitySpinButton.cpp:
-        (WebCore::AccessibilitySpinButtonPart::press):
-        * accessibility/AccessibilitySpinButton.h:
</del><ins>+            Added an overload that takes a ComputedStyleExtractor.
+            This code should move into EditingStyle.cpp, material for a follow-up patch.
</ins><span class="cx"> 
</span><del>-2014-04-09  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::toIdentifier):
</ins><span class="cx"> 
</span><del>-        ContentFilterMac is broken when NE_FILTER_SOURCE is enabled.
-        &lt;rdar://problem/15978793&gt; and https://bugs.webkit.org/show_bug.cgi?id=131445
</del><ins>+            Add a file-local helper for yanking the identifier value (if any) out of a CSSPrimitiveValue.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andy Estes.
</del><ins>+        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+        (WebCore::highestEmbeddingAncestor):
+        * editing/EditingStyle.h:
+        * editing/EditingStyle.cpp:
+        (WebCore::editingStyleFromComputedStyle):
+        (WebCore::extractPropertyValue):
+        (WebCore::identifierForStyleProperty):
+        (WebCore::textColorFromStyle):
+        (WebCore::backgroundColorFromStyle):
+        (WebCore::EditingStyle::init):
+        (WebCore::EditingStyle::removeStyleAddedByNode):
+        (WebCore::EditingStyle::removeStyleConflictingWithStyleOfNode):
+        (WebCore::EditingStyle::triStateOfStyle):
+        (WebCore::EditingStyle::styleIsPresentInComputedStyleOfNode):
+        (WebCore::EditingStyle::removeStyleFromRulesAndContext):
+        (WebCore::StyleChange::StyleChange):
+        (WebCore::fontWeightIsBold):
+        (WebCore::extractPropertiesNotIn):
+        (WebCore::getPropertiesNotIn):
</ins><span class="cx"> 
</span><del>-        No new tests (Not a tested feature).
</del><ins>+            Use ComputedStyleExtractor instead of CSSComputedStyleDeclaration in all of this code.
+            Templatized a bunch of the code so we don't have to repeat ourselves for both StylePropertySet
+            and ComputedStyleExtractor inputs.
</ins><span class="cx"> 
</span><del>-        * platform/mac/ContentFilterMac.mm:
-        (WebCore::ContentFilter::needsMoreData): Only consider m_neFilterSourceStatus if m_neFilterSource exists.
-        (WebCore::ContentFilter::didBlockData): Ditto.
</del><ins>+2013-05-30  Roland Takacs  &lt;rtakacs@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+        Remove &quot;hidden&quot;=true from Inspector.json
+        https://bugs.webkit.org/show_bug.cgi?id=114116
</ins><span class="cx"> 
</span><del>-        Rewrite Function.bind as a builtin
-        https://bugs.webkit.org/show_bug.cgi?id=131083
</del><ins>+        Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Remove &quot;hidden&quot;=true because it's a Chromium concept.
+        Patch created by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-        Switch WebCore to use the helper functions when defining the
-        prototype properties on DOM constructors, and update bindings
-        tests accordingly.
</del><ins>+        * inspector/Inspector.json:
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::finishCreation):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateConstructorHelperMethods):
-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        (WebCore::JSTestActiveDOMObjectConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
-        (WebCore::JSTestCustomNamedGetterConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
-        (WebCore::JSTestEventConstructorConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
-        (WebCore::JSTestEventTargetConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestException.cpp:
-        (WebCore::JSTestExceptionConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
-        (WebCore::JSTestGenerateIsReachableConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::JSTestInterfaceConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
-        (WebCore::JSTestMediaQueryListListenerConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
-        (WebCore::JSTestNamedConstructorConstructor::finishCreation):
-        (WebCore::JSTestNamedConstructorNamedConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestNode.cpp:
-        (WebCore::JSTestNodeConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::JSTestObjConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
-        (WebCore::JSTestOverloadedConstructorsConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
-        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::JSTestTypedefsConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSattribute.cpp:
-        (WebCore::JSattributeConstructor::finishCreation):
-        * bindings/scripts/test/JS/JSreadonly.cpp:
-        (WebCore::JSreadonlyConstructor::finishCreation):
</del><ins>+2013-05-30  Kondapally Kalyan  &lt;kalyan.kondapally@intel.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-09  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        [EFL][EGL] Implement TransportSurface client.
+        https://bugs.webkit.org/show_bug.cgi?id=114122
</ins><span class="cx"> 
</span><del>-        Unreviewed iOS build fix. Replacing deprecated enum with AVPlayerViewControllerExitFullScreenReason.
</del><ins>+        Reviewed by Kenneth Rohde Christiansen.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (-[WebAVPlayerController playerViewController:shouldDismissWithReason:]):
</del><ins>+        Covered by existing WebGL tests.
</ins><span class="cx"> 
</span><del>-2014-04-09  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        This patch implements the client support for Transport
+        Surface with EGL backend using GLES2.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Monolithic elements should not affect the layout of the content outside its region
-        https://bugs.webkit.org/show_bug.cgi?id=130499
</del><ins>+        * platform/graphics/surfaces/efl/GLTransportSurface.cpp:
+        (WebCore::GLTransportSurfaceClient::createTransportSurfaceClient):
+        (WebCore::GLTransportSurfaceClient::GLTransportSurfaceClient):
+        * platform/graphics/surfaces/efl/GLTransportSurface.h:
+        (GLTransportSurfaceClient):
+        * platform/graphics/surfaces/efl/GraphicsSurfaceCommon.cpp:
+        (WebCore::GraphicsSurfacePrivate::initializeClient):
+        * platform/graphics/surfaces/egl/EGLConfigSelector.cpp:
+        (WebCore):
+        (WebCore::EGLConfigSelector::surfaceClientConfig):
+        (WebCore::EGLConfigSelector::findMatchingConfigWithVisualId):
+        * platform/graphics/surfaces/egl/EGLConfigSelector.h:
+        (WebCore):
+        (EGLConfigSelector):
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Support for retrieving valid EGLConfig on client side.
</ins><span class="cx"> 
</span><del>-        When performing layout on an element flowed into regions, its logical height must not be incremented 
-        past the region's logical bottom for monolithic elements in regions different than the last region their containing
-        block is fragmented into. This ensures that the following elements are correctly laid out 
-        from the top of the next region.
-        This change must also be applied to floats in order to prevent text from avoiding part
-        of a float that did not actually made it into the current region, but instead overflowed
-        the previous one.
</del><ins>+        * platform/graphics/surfaces/egl/EGLHelper.cpp:
+        (WebCore):
+        (WebCore::resolveDisplay):
+        (WebCore::EGLHelper::resolveEGLBindings):
+        (WebCore::EGLHelper::createEGLImage):
+        (WebCore::EGLHelper::destroyEGLImage):
+        (WebCore::EGLHelper::imageTargetTexture2DOES):
+        * platform/graphics/surfaces/egl/EGLHelper.h:
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/fragmentation-after-float-overflow-single-region.html
-               fast/regions/fragmentation-after-monolithic-overflow-self-collapsed.html
-               fast/regions/fragmentation-after-monolithic-overflow-single-region.html
-               fast/regions/fragmentation-after-monolithic-overflow.html
</del><ins>+        Helper functions to create and destroy EGLImage.
</ins><span class="cx"> 
</span><del>-        * rendering/FloatingObjects.cpp:
-        (WebCore::FloatingObjects::computePlacedFloatsTree):
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::layoutBlockChild):
-        (WebCore::RenderBlockFlow::adjustBlockChildForPagination):
-        (WebCore::RenderBlockFlow::lowestFloatLogicalBottom):
-        (WebCore::RenderBlockFlow::getClearDelta):
-        (WebCore::RenderBlockFlow::applyAfterBreak): Deleted.
-        (WebCore::RenderBlockFlow::nextFloatLogicalBottomBelow): Deleted.
-        (WebCore::RenderBlockFlow::nextFloatLogicalBottomBelowForBlock): Deleted.
-        (WebCore::RenderBlockFlow::flipFloatForWritingModeForChild): Deleted.
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::isBoxInDifferentRegionsAsFloat):
-        * rendering/RenderFlowThread.h:
</del><ins>+        * platform/graphics/surfaces/egl/EGLXSurface.cpp:
+        (WebCore::EGLXTransportSurfaceClient::EGLXTransportSurfaceClient):
+        (WebCore):
+        (WebCore::EGLXTransportSurfaceClient::~EGLXTransportSurfaceClient):
+        (WebCore::EGLXTransportSurfaceClient::destroy):
+        (WebCore::EGLXTransportSurfaceClient::prepareTexture):
+        (WebCore::EGLTextureFromPixmap::EGLTextureFromPixmap):
+        (WebCore::EGLTextureFromPixmap::~EGLTextureFromPixmap):
+        (WebCore::EGLTextureFromPixmap::destroy):
+        (WebCore::EGLTextureFromPixmap::isValid):
+        (WebCore::EGLTextureFromPixmap::bindTexImage):
+        (WebCore::EGLTextureFromPixmap::reBindTexImage):
+        * platform/graphics/surfaces/egl/EGLXSurface.h:
+        (EGLXTransportSurfaceClient):
</ins><span class="cx"> 
</span><del>-2014-04-09  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        TransportSurfaceClient implementation.
</ins><span class="cx"> 
</span><del>-        Use std::array in AffineTransform, and get rid of setMatrix
-        https://bugs.webkit.org/show_bug.cgi?id=131416
</del><ins>+        (WebCore):
+        * platform/graphics/surfaces/glx/GLXSurface.cpp:
+        (WebCore::GLXTransportSurfaceClient::GLXTransportSurfaceClient):
+        * platform/graphics/surfaces/glx/GLXSurface.h:
+        (GLXTransportSurfaceClient):
+        * platform/graphics/surfaces/glx/X11Helper.cpp:
+        (WebCore::X11Helper::createOffScreenWindow):
+        (WebCore):
+        (WebCore::X11Helper::createPixmap):
+        * platform/graphics/surfaces/glx/X11Helper.h:
+        (X11Helper):
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2013-05-30  Mike West  &lt;mkwst@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/AffineTransform.cpp:
-        (WebCore::AffineTransform::AffineTransform):
-        (WebCore::AffineTransform::multiply):
-        * platform/graphics/transforms/AffineTransform.h:
-        (WebCore::AffineTransform::setMatrix): Deleted.
</del><ins>+        Rename 'KURL::elidedString' and inspector's 'String.prototype.trimMiddle' for clarity.
+        https://bugs.webkit.org/show_bug.cgi?id=111700
</ins><span class="cx"> 
</span><del>-2014-04-09  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        [GTK] Plugin process crashes when loading totem plugin
-        https://bugs.webkit.org/show_bug.cgi?id=131357
</del><ins>+        Darin suggested that 'KURL::elidedString' is inaccurately named[1], this
+        patch is an attempt to do better. It additionally brings the Inspector's
+        'String.prototype.trimMiddle' method into line, as the two methods do
+        more or less the same thing.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        After a bit of discussion with Maciej and Daniel Bates on IRC, I've
+        settled on 'KURL::stringCenterEllipsizedToLength(unsigned)' and
+        'String.prototype.centerEllipsizedToLength(number)' respectively.
</ins><span class="cx"> 
</span><del>-        Remove netscape plugin implementation from WebCore that was only
-        used by WebKit1. This removes the conflict between the WebCore NPN
-        symbols and the ones used by the plugins.
</del><ins>+        No new tests are added, as this patch shouldn't have any visible effect
+        on the web. It's strictly an internal refactoring.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * PlatformEfl.cmake:
-        * PlatformGTK.cmake:
-        * PlatformWin.cmake:
-        * plugins/PluginViewNone.cpp:
-        * plugins/gtk/PluginPackageGtk.cpp: Removed.
-        * plugins/gtk/PluginViewGtk.cpp: Removed.
-        * plugins/gtk/gtk2xtbin.c: Removed.
-        * plugins/gtk/gtk2xtbin.h: Removed.
-        * plugins/gtk/xembed.h: Removed.
</del><ins>+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::fail):
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::executeScript):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType):
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        (WebCore::createWindow):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::responseReceived):
+        * loader/MixedContentChecker.cpp:
+        (WebCore::MixedContentChecker::logWarning):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFail):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+        (WebCore::CachedResourceLoader::requestResource):
+        (WebCore::CachedResourceLoader::loadResource):
+        (WebCore::CachedResourceLoader::printAccessDeniedMessage):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
+        (WebCore::CSPDirectiveList::allowScriptNonce):
+        (WebCore::CSPDirectiveList::allowPluginType):
+        * platform/KURL.cpp:
+        (WebCore::KURL::stringCenterEllipsizedToLength):
+        * platform/KURL.h:
+            Rename 'KURL::elidedString' to 'KURL::stringCenterEllipsizedToLength',
+            and adjust callsites accordingly.
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.Placard.prototype._update):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._buildAttributeDOM):
+        * inspector/front-end/HeapSnapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.shortenWindowURL):
+        * inspector/front-end/Linkifier.js:
+        (WebInspector.Linkifier.DefaultFormatter.prototype.formatLiveAnchor):
+        * inspector/front-end/ResourceUtils.js:
+        (WebInspector.linkifyURLAsNode):
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer.prototype._titleForFile):
+        * inspector/front-end/utilities.js:
+            Rename 'String.prototype.trimMiddle' to 'String.prototype.centerEllipsizedToLength'
+            and adjust callsites accordingly.
</ins><span class="cx"> 
</span><del>-2014-04-09  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+2013-05-30  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        fullscreen controls first show a play button instead of a pause button
-        https://bugs.webkit.org/show_bug.cgi?id=131430
</del><ins>+        Rename FontFallbackList.cpp/h to FontGlyphs.cpp/h
+        https://bugs.webkit.org/show_bug.cgi?id=117022
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        isPlaying() is false while buffering, paused() isn't; use paused() for
-        the play button.
</del><ins>+        Rename to match the class name.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::setMediaElement):
-        (WebVideoFullscreenModelMediaElement::handleEvent):
-        Use HTMLMediaElement::paused() instead of HTMLMediaElement::isPlaying()
-
-2014-04-09  Eva Balazsfalvi  &lt;evab.u-szeged@partner.samsung.com&gt;
-
-        Remove duplicated files and unnecessary conditions from UseJSC.cmake
-        https://bugs.webkit.org/show_bug.cgi?id=131438
-
-        Reviewed by Csaba Osztrogonác.
-
-        No new tests required.
-
-        * UseJSC.cmake:
-
-2014-04-09  Mario Sanchez Prada  &lt;mario.prada@samsung.com&gt;
-
-        [GTK] Layout tests accessibility/children-changed-sends-notification.html and accessibility/notification-listeners.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=131380
-
-        Reviewed by Chris Fleizach.
-
-        Don't emit signals for added objects that we know won't be exposed
-        to the accessibility hierarchy (e.g. static text).
-
-        * accessibility/atk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::attachWrapper): Add extra check and early return.
-
-2014-04-09  Mario Sanchez Prada  &lt;mario.prada@samsung.com&gt;
-
-        [AX][GTK] No new lines in some AX tests output
-        https://bugs.webkit.org/show_bug.cgi?id=131294
-
-        Reviewed by Martin Robinson.
-
-        Do not implement Hypetext or AtkText for the WebArea. Those
-        interfaces will be implemented by the containers (automatically
-        generated or not) for the different parts of the DOM and the
-        render subtree under this element anyway.
-
-        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
-        (getInterfaceMaskFromObject): Make sure we don't apply
-        WAIHypertext nor WAIText to objects with role WebAreaRole.
-
-2014-04-08  Conrad Shultz  &lt;conrad_shultz@apple.com&gt;
-
-        nil should only be used for objects
-        https://bugs.webkit.org/show_bug.cgi?id=131431
-
-        Reviewed by Chris Fleizach.
-
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-        (-[WebAccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
-        nil -&gt; NO.
-
-        * platform/mac/WebVideoFullscreenController.mm:
-        (-[WebVideoFullscreenController setMediaElement:]):
-        nil -&gt; 0; change a NULL to nullptr while we're here.
-
-2014-04-08  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
-
-        [CSSRegions] Crash when video in region exits fullscreen
-        https://bugs.webkit.org/show_bug.cgi?id=131366
-
-        Reviewed by Andrei Bucur.
-
-        After fix for https://bugs.webkit.org/show_bug.cgi?id=130392, we compute the region ranges
-        information for inline elements collected in named flows with associated region chains.
-        The algorithm for this computation, implemented in RenderFlowThread::getRegionRangeForBox,
-        walks up the render tree trying to find the top-most unsplittable box under the named flow
-        in the case where the region ranges information is not available.
-
-        As this traversal works properly only when the starting box is not detached from the render tree,
-        i changed the named flow information clearing in RenderBlock::collapseAnonymousBoxChild
-        to occur before the child to be collapsed is removed from the render tree.
-
-        Test: fast/regions/full-screen-video-in-region-crash.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::collapseAnonymousBoxChild):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
-
-2014-04-08  Chris Fleizach  &lt;cfleizach@apple.com&gt;
-
-        Unreviewed build fix for iOS (redux).
-
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper accessibilityARIAIsBusy]):
-        (-[WebAccessibilityObjectWrapper accessibilityARIALiveRegionIsAtomic]):
-
-2014-04-08  Chris Fleizach  &lt;cfleizach@apple.com&gt;

-        Unreviewed build fix for iOS.
-
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper accessibilityElementCount]):
-
-2014-04-08  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Factor tile coverage map into a class
-        https://bugs.webkit.org/show_bug.cgi?id=131417
-
-        Reviewed by Tim Horton.
-
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * platform/graphics/ca/PlatformCALayerClient.h:
-        (WebCore::PlatformCALayerClient::platformCALayerLayoutSublayersOfLayer):
-        (WebCore::PlatformCALayerClient::platformCALayerRespondsToLayoutChanges):
-        (WebCore::PlatformCALayerClient::platformCALayerAnimationStarted):
-        (WebCore::PlatformCALayerClient::platformCALayerContentsOrientation):
-        (WebCore::PlatformCALayerClient::platformCALayerShowDebugBorders):
-        (WebCore::PlatformCALayerClient::platformCALayerShowRepaintCounter):
-        (WebCore::PlatformCALayerClient::platformCALayerIncrementRepaintCount):
-        (WebCore::PlatformCALayerClient::platformCALayerLayerDidDisplay):
-        
-            Added default implementation to some of these to make clients less messy.
</del><ins>+        * platform/graphics/Font.h:
+        * platform/graphics/FontCache.cpp:
+        * platform/graphics/FontFallbackList.cpp: Removed.
+        * platform/graphics/FontFallbackList.h: Removed.
+        * platform/graphics/FontFastPath.cpp:
+        * platform/graphics/FontGlyphs.cpp: Copied from Source/WebCore/platform/graphics/FontFallbackList.cpp.
+        * platform/graphics/FontGlyphs.h: Copied from Source/WebCore/platform/graphics/FontFallbackList.h.
+        * platform/graphics/mac/FontComplexTextMac.cpp:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::~TileController):
-        (WebCore::TileController::platformCALayerPaintContents):
-        (WebCore::TileController::setTiledScrollingIndicatorPosition):
-        (WebCore::TileController::updateTileCoverageMap):
-        (WebCore::TileController::tiledScrollingIndicatorLayer):
-        * platform/graphics/ca/mac/TileCoverageMap.h: Added.
-        (WebCore::TileCoverageMap::setPosition):
-        (WebCore::TileCoverageMap::layer):
-        * platform/graphics/ca/mac/TileCoverageMap.mm: Added.
-        
-            The new class.
</del><ins>+2013-05-30  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::TileCoverageMap::TileCoverageMap):
-        (WebCore::TileCoverageMap::~TileCoverageMap):
-        (WebCore::TileCoverageMap::update):
-        (WebCore::TileCoverageMap::platformCALayerPaintContents):
-        (WebCore::TileCoverageMap::platformCALayerDeviceScaleFactor):
-        * platform/graphics/ca/mac/TileGrid.h:
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::drawTileMapContents):
</del><ins>+        Get rid of Position::computedStyle
+        https://bugs.webkit.org/show_bug.cgi?id=117024
</ins><span class="cx"> 
</span><del>-2014-04-08  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Clip outer rounded border rect on device pixel boundaries.
-        https://bugs.webkit.org/show_bug.cgi?id=131404
</del><ins>+        Removed the function.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * dom/Position.cpp:
+        * dom/Position.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::positionToComputeInlineStyleChange): We need a position
+        inside the dummy element since we'll get the containing element's style instead
+        if we had the position before the dummy element.
+        * editing/EditingStyle.cpp:
+        (WebCore::StyleChange::StyleChange):
</ins><span class="cx"> 
</span><del>-        Use device pixel snapped rectangle to clip out rounded rects, when not all sides are solid/double.
-        Snapping it to device pixel boundaries ensures that when we call drawRect(devicePixelSnappedRect) later,
-        it leaves no cruft behind.
</del><ins>+2013-05-30  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/borders/hidpi-rounded-border-on-subpixel-position.html
</del><ins>+        Remove obsolete forward declaration from InspectorFrontendHost.h
+        https://bugs.webkit.org/show_bug.cgi?id=117017
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBorder):
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-2014-04-08  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+        Remove obsolete forward declaration and fix style issue as well.
</ins><span class="cx"> 
</span><del>-        Turn MSE on by default
-        https://bugs.webkit.org/show_bug.cgi?id=131313
-        &lt;rdar://problem/16525223&gt;
</del><ins>+        No change in behavior, no new tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        * inspector/InspectorFrontendHost.h:
+        (WebCore):
+        (InspectorFrontendHost):
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * page/Settings.in: Add MEDIA_SOURCE conditional.
</del><ins>+2013-05-29  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        Expose incrementalRenderingSuppressionTimeout via WK2
+        https://bugs.webkit.org/show_bug.cgi?id=117015
+        &lt;rdar://problem/13992853&gt;
</ins><span class="cx"> 
</span><del>-        Remove an unused parameter from loadResource.
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Since the CachedResourceRequest has the charset in it, we don't need to pass it separately to loadRequest.
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::setVisualUpdatesAllowed):
+        Inform the FrameLoader that we're ready to transition the page, if
+        nothing else already has. This will be forwarded to the FrameLoaderClient,
+        and WebKit2's implementation will go ahead and un-freeze the layer tree,
+        so that the incremental rendering suppression watchdog timer actually works.
</ins><span class="cx"> 
</span><del>-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::CachedResourceLoader::requestResource):
-        (WebCore::CachedResourceLoader::loadResource):
-        * loader/cache/CachedResourceLoader.h:
</del><ins>+        (WebCore::Document::setVisualUpdatesAllowedByClient):
+        Make incremental rendering suppression extension tokens play nice with the
+        watchdog timer; allow setVisualUpdatesAllowedByClient=true to re-enable updates
+        if either the page is in the &quot;completed&quot; state or the watchdog has already fired.
</ins><span class="cx"> 
</span><del>-2014-04-08  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::forcePageTransitionIfNeeded): Added.
+        Forward to the client.
</ins><span class="cx"> 
</span><del>-        Unreviewed EFL build fix attempt since r166956
</del><ins>+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::forcePageTransitionIfNeeded): Added.
</ins><span class="cx"> 
</span><del>-        * page/efl/DragControllerEfl.cpp: Rename Clipboard to DataTransfer.
-        (WebCore::DragController::declareAndWriteDragImage):
</del><ins>+2013-05-29  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        ProgressEvent should not be cancelable
+        https://bugs.webkit.org/show_bug.cgi?id=114444
</ins><span class="cx"> 
</span><del>-        REGRESSION (r155998): Elements render at very low resolution with some 3d transforms
-        https://bugs.webkit.org/show_bug.cgi?id=131412
-        &lt;rdar://problem/16525044&gt;
-
-        Reviewed by Tim Horton.
-        
-        In r155998 we started to compute a root-relative transform in order to choose
-        a good contentsScale to avoid blurring on scaling.
-        
-        However, the code failed to update this transform when passing over
-        GraphicsLayerCAs with no uncommitted changes, which caused us to choose
-        an incorrect contentsScale sometimes, resulting in blurriness.
-        
-        Fix by updating the root-relative transform on layers with no uncommitted
-        changes.
-
-        Test: compositing/contents-scale/incremental-change.html
-
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
-
-2014-04-08  Anders Carlsson  &lt;andersca@apple.com&gt;
-
-        Don't call CGPathAddPath with invalid CGAffineTransform objects
-        https://bugs.webkit.org/show_bug.cgi?id=131413
-        &lt;rdar://problem/16399645&gt;
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+        Parameter &quot;cancelable&quot; in ProgressEvent is set to false, by default, as mentioned in the specification. The spec link is given below.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::Path::addPath):
-        Don't try to add the path if the affine transform isn't invertible.
</del><ins>+        Spec: http://www.w3.org/TR/2011/CR-progress-events-20110922/#suggested-names-for-events-using-the-progressevent-interface
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/AffineTransform.cpp:
-        (WebCore::AffineTransform::isInvertible):
-        Handle infinite and NaN determinants.
</del><ins>+        No new tests. file-reader-event-listener.html and infoOnProgressEvent-expected.txt are updated.
</ins><span class="cx"> 
</span><del>-        (WebCore::AffineTransform::inverse):
-        Handle infinite and NaN determinants.
</del><ins>+        * dom/ProgressEvent.cpp:
+        (WebCore::ProgressEvent::ProgressEvent):
+        (WebCore):
</ins><span class="cx"> 
</span><del>-2014-04-08  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+2013-05-29  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Replay: memoize nondeterministic attributes of the Screen interface
-        https://bugs.webkit.org/show_bug.cgi?id=131339
</del><ins>+        Fix paint-related milestones to not fire when the layer tree is frozen
+        https://bugs.webkit.org/show_bug.cgi?id=117012
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
-
-        The values from the screen interface are nondeterministic. Since we can't
-        change the physical screen dimensions, instead memoize values of attributes.
-
-        Test: ManualTests/inspector/replay-window-screen.html
-
-        * page/Screen.idl: Add Nondeterministic attribute.
-
-2014-04-08  Beth Dakin  &lt;bdakin@apple.com&gt;
-
-        https://bugs.webkit.org/show_bug.cgi?id=131408
-        Scrollbars layers don't dynamically update when device scale factor changes
-        -and corresponding-
-        &lt;rdar://problem/16503875&gt;
-
</del><span class="cx">         Reviewed by Tim Horton.
</span><span class="cx"> 
</span><del>-        The scrollbar layers are not children of the RenderView's layer, so they were 
-        completely skipped over by this function before. We need to start this higher up 
-        the tree in the rootGraphicsLayer(), which will typically return the 
-        m_overflowControlsHostLayer.
</del><ins>+        In the previous code, it was possible to paint some layer and schedule
+        the m_paintRelatedMilestonesTimer, but then the layer tree was put into
+        a frozen state because the page redirected. However, the paint-related
+        milestones timer would still fire. This caused woes with header/footer
+        banners.
+        
+        Fix by not firing paint-related milestones if the layer tree is frozen,
+        which we know via a new ChromeClient callback. When unfrozen, we'll
+        paint again, and fire the timer later.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::layerTreeStateIsFrozen):
</ins><span class="cx">         * rendering/RenderLayerCompositor.cpp:
</span><del>-        (WebCore::RenderLayerCompositor::deviceOrPageScaleFactorChanged):
</del><ins>+        (WebCore::RenderLayerCompositor::paintRelatedMilestonesTimerFired):
</ins><span class="cx"> 
</span><del>-2014-04-08  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2013-05-29  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        HTMLConverter::aggregatedAttributesForAncestors should cache intermediate results
-        https://bugs.webkit.org/show_bug.cgi?id=131400
</del><ins>+        Store form control list with RefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=116910
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        Instead of accumulating attributes from a character node to the highest ancestor,
-        recursively call aggregatedAttributesForElementAndItsAncestors so that aggregated
-        attributes are cached on each ancestor to eliminate the old O(n^2) behavior.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/582132773280455ead1d42b0073be37efdeaf989.
</ins><span class="cx"> 
</span><del>-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverter::aggregatedAttributesForAncestors):
-        (HTMLConverter::aggregatedAttributesForElementAndItsAncestors): Extracted from aggregatedAttributesForAncestors.
</del><ins>+        Unfortunately, the Blink change doesn't provide much insight as to what kind of crashes are fixed
+        by this code change but it cleans up the way form elements with state are registered to the form
+        controller so it seems benefitial to merge it anyway.
</ins><span class="cx"> 
</span><del>-2014-04-08  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::dispose):
+        * html/FormController.cpp:
+        (WebCore::FormController::createSavedFormStateMap):
+        (WebCore::FormController::registerFormElementWithState):
+        (WebCore::FormController::unregisterFormElementWithState):
+        (WebCore):
+        * html/FormController.h:
+        (FormController):
+        * html/HTMLFormControlElementWithState.cpp:
+        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::insertedInto):
+        (WebCore):
+        (WebCore::HTMLFormControlElementWithState::removedFrom):
+        * html/HTMLFormControlElementWithState.h:
+        (HTMLFormControlElementWithState):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::insertedInto):
</ins><span class="cx"> 
</span><del>-        Unreviewed CMake build fix after r166965.
</del><ins>+2013-05-29  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * UseJSC.cmake: Rename JSClipboardCustom.cpp to JSDataTransferCustom.cpp.
</del><ins>+        Take ComputedStyleExtractor for a spin.
+        &lt;http://webkit.org/b/116968&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Unreviewed iOS build fix.
</del><ins>+        Convert some editing and SVG code to use ComputedStyleExtractor instead of creating full
+        blown CSSComputedStyleDeclaration objects.
</ins><span class="cx"> 
</span><del>-        Return false instead of nil in a function that returns BOOL.
</del><ins>+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+        (WebCore::highestEmbeddingAncestor):
+        (WebCore::ApplyStyleCommand::computedFontSize):
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):
+        (WebCore::EditingStyle::textDirectionForSelection):
+        (WebCore::getIdentifierValue):
+        (WebCore::backgroundColorInEffect):
+        * editing/EditingStyle.h:
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::computeCSSPropertyValue):
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper accessibilityCanFuzzyHitTest]):
</del><ins>+2013-05-29  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        Add a special case for SelectorDataList::execute when there is only one selector
+        https://bugs.webkit.org/show_bug.cgi?id=116891
</ins><span class="cx"> 
</span><del>-        Non-empty ranges misdetected as empty ranges, avoiding telephone number detection.
-        &lt;rdar://problem/16553441&gt; and https://bugs.webkit.org/show_bug.cgi?id=131397 
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        In the vast majority of cases, querySelector is called with a single selector.
</ins><span class="cx"> 
</span><del>-        No new tests (Only affects a currently untested Mac-only WK2 feature)
</del><ins>+        This patch takes that input into account to improve the performance of
+        SelectorDataList::execute(). For the case of a single selector, we avoid three
+        branches executed for every node of the traversal.
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::scanSelectionForTelephoneNumbers): Fix detection of empty ranges so we don’t
-          early return erroneously.
</del><ins>+        This improves QuerySelector's time by 2.3%.
</ins><span class="cx"> 
</span><del>-2014-04-08  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+        * dom/SelectorQuery.cpp:
+        (WebCore::SelectorDataList::execute):
</ins><span class="cx"> 
</span><del>-        [SVG] Fix CSS transform handling when zoomed
-        https://bugs.webkit.org/show_bug.cgi?id=125836
</del><ins>+2013-05-29  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        -webkit-text-underline-position should not be inherited
+        https://bugs.webkit.org/show_bug.cgi?id=116363
</ins><span class="cx"> 
</span><del>-        Tests: svg/zoom/page/zoom-css-transforms-expected.svg
-               svg/zoom/page/zoom-css-transforms.svg
</del><ins>+        Reverting http://trac.webkit.org/changeset/150366
+        It was an incorrect fix referring to an old specification.
</ins><span class="cx"> 
</span><del>-        Adjusts CSS transforms when used in SVG to account for unexpected
-        translation scale. Backport from Chromium #174910.
</del><ins>+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+        (StyleRareNonInheritedData):
</ins><span class="cx"> 
</span><del>-        * svg/SVGGraphicsElement.cpp:
-        (WebCore::SVGGraphicsElement::animatedLocalTransform):
</del><ins>+2013-05-29  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+        [CMAKE] cmake errors when CMAKE_BUILD_TYPE is not specified.
+        https://bugs.webkit.org/show_bug.cgi?id=116899
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] large corner radius combined with 0 radius does not wrap properly
-        https://bugs.webkit.org/show_bug.cgi?id=129739
</del><ins>+        Reviewed by Laszlo Gombos.
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+        * CMakeLists.txt: Fixed if statement to escape when find command fails.
</ins><span class="cx"> 
</span><del>-        Corrected special case handling for shape-outside border-box values with border-radius
-        values that greater than or equal to the box's height.
</del><ins>+2013-05-28  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/shapes/shape-outside-floats/shape-outside-big-box-border-radius-001.html
-               fast/shapes/shape-outside-floats/shape-outside-big-box-border-radius-002.html
</del><ins>+        Add more accurate activity state tracking
+        https://bugs.webkit.org/show_bug.cgi?id=116893
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/BoxShape.cpp:
-        (WebCore::BoxShape::getExcludedIntervals):
</del><ins>+        Reviewed by Gavin Barraclough.
</ins><span class="cx"> 
</span><del>-2014-04-08  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Add a hysteresis to Page activity throttling.  We do this
+        through a PageThrottler class that now handles entering and
+        exiting throttling state, and adds a hysteresis to we can
+        limit the amount of on/off bouncing on the throttle.
</ins><span class="cx"> 
</span><del>-        Rename Clipboard to DataTransfer
-        https://bugs.webkit.org/show_bug.cgi?id=131371
</del><ins>+        Media elements now make use of this to disable timer throttling
+        while they are playing, and plugins use it to momentarily bounce
+        from throttled to unthrottled state.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
-
-        This is the name used in HTML5, and it's much better than the confusing Clipboard one.
-
-        Renamed related enums too, and made DataTransferAccessPolicy an enum class.
-
</del><span class="cx">         * CMakeLists.txt:
</span><del>-        * Configurations/WebCore.xcconfig:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
</del><ins>+        * GNUmakefile.list.am:
+        * Target.pri:
</ins><span class="cx">         * WebCore.exp.in:
</span><ins>+        * WebCore.vcproj/WebCore.vcproj:
</ins><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj.filters:
</span><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * bindings/js/JSBindingsAllInOne.cpp:
-        * bindings/js/JSClipboardCustom.cpp: Removed.
-        * bindings/js/JSDataTransferCustom.cpp: Copied from Source/WebCore/bindings/js/JSClipboardCustom.cpp.
-        (WebCore::JSDataTransfer::types):
-        (WebCore::JSClipboard::types): Deleted.
-        * bindings/js/JSEventCustom.cpp:
-        * dom/Clipboard.cpp: Removed.
-        * dom/Clipboard.h: Removed.
-        * dom/Clipboard.idl: Removed.
-        * dom/ClipboardAccessPolicy.h: Removed.
-        * dom/ClipboardEvent.cpp:
-        (WebCore::ClipboardEvent::ClipboardEvent):
-        * dom/ClipboardEvent.h:
-        (WebCore::ClipboardEvent::create):
-        (WebCore::ClipboardEvent::clipboard): Deleted.
-        * dom/ClipboardMac.mm: Removed.
-        * dom/DOMAllInOne.cpp:
-        * dom/DataTransfer.cpp: Copied from Source/WebCore/dom/Clipboard.cpp.
-        (WebCore::DataTransfer::DataTransfer):
-        (WebCore::DataTransfer::createForCopyAndPaste):
-        (WebCore::DataTransfer::~DataTransfer):
-        (WebCore::DataTransfer::setAccessPolicy):
-        (WebCore::DataTransfer::canReadTypes):
-        (WebCore::DataTransfer::canReadData):
-        (WebCore::DataTransfer::canWriteData):
-        (WebCore::DataTransfer::clearData):
-        (WebCore::DataTransfer::getData):
-        (WebCore::DataTransfer::setData):
-        (WebCore::DataTransfer::types):
-        (WebCore::DataTransfer::files):
-        (WebCore::DataTransfer::dropEffect):
-        (WebCore::DataTransfer::setDropEffect):
-        (WebCore::DataTransfer::effectAllowed):
-        (WebCore::DataTransfer::setEffectAllowed):
-        (WebCore::DataTransfer::setDragImage):
-        (WebCore::DataTransfer::createForDragAndDrop):
-        (WebCore::DataTransfer::canSetDragImage):
-        (WebCore::DataTransfer::updateDragImage):
-        (WebCore::DataTransfer::createDragImage):
-        (WebCore::DragImageLoader::DragImageLoader):
-        (WebCore::DragImageLoader::imageChanged):
-        (WebCore::DataTransfer::sourceOperation):
-        (WebCore::DataTransfer::destinationOperation):
-        (WebCore::DataTransfer::setSourceOperation):
-        (WebCore::DataTransfer::setDestinationOperation):
-        (WebCore::Clipboard::Clipboard): Deleted.
-        (WebCore::Clipboard::createForCopyAndPaste): Deleted.
-        (WebCore::Clipboard::~Clipboard): Deleted.
-        (WebCore::Clipboard::setAccessPolicy): Deleted.
-        (WebCore::Clipboard::canReadTypes): Deleted.
-        (WebCore::Clipboard::canReadData): Deleted.
-        (WebCore::Clipboard::canWriteData): Deleted.
-        (WebCore::Clipboard::clearData): Deleted.
-        (WebCore::Clipboard::getData): Deleted.
-        (WebCore::Clipboard::setData): Deleted.
-        (WebCore::Clipboard::types): Deleted.
-        (WebCore::Clipboard::files): Deleted.
-        (WebCore::Clipboard::dropEffect): Deleted.
-        (WebCore::Clipboard::setDropEffect): Deleted.
-        (WebCore::Clipboard::effectAllowed): Deleted.
-        (WebCore::Clipboard::setEffectAllowed): Deleted.
-        (WebCore::Clipboard::setDragImage): Deleted.
-        (WebCore::Clipboard::createForDragAndDrop): Deleted.
-        (WebCore::Clipboard::canSetDragImage): Deleted.
-        (WebCore::Clipboard::updateDragImage): Deleted.
-        (WebCore::Clipboard::createDragImage): Deleted.
-        (WebCore::Clipboard::sourceOperation): Deleted.
-        (WebCore::Clipboard::destinationOperation): Deleted.
-        (WebCore::Clipboard::setSourceOperation): Deleted.
-        (WebCore::Clipboard::setDestinationOperation): Deleted.
-        * dom/DataTransfer.h: Copied from Source/WebCore/dom/Clipboard.h.
-        * dom/DataTransfer.idl: Copied from Source/WebCore/dom/Clipboard.idl.
-        * dom/DataTransferAccessPolicy.h: Copied from Source/WebCore/dom/ClipboardAccessPolicy.h.
-        * dom/DataTransferItemList.h:
-        * dom/DataTransferMac.mm: Copied from Source/WebCore/dom/ClipboardMac.mm.
-        (WebCore::DataTransfer::createDragImage):
-        (WebCore::Clipboard::createDragImage): Deleted.
-        * dom/Event.h:
-        (WebCore::Event::clipboardData):
-        (WebCore::Event::internalDataTransfer):
-        (WebCore::Event::clipboard): Deleted.
-        * dom/Event.idl:
-        * dom/MouseEvent.cpp:
-        (WebCore::MouseEvent::create):
-        (WebCore::MouseEvent::MouseEvent):
-        (WebCore::MouseEvent::initMouseEvent):
-        * dom/MouseEvent.h:
-        (WebCore::MouseEvent::dataTransfer):
-        * dom/MouseEvent.idl:
-        * dom/WheelEvent.cpp:
-        * editing/Editor.cpp:
-        (WebCore::Editor::canDHTMLCut):
-        (WebCore::Editor::canDHTMLCopy):
-        (WebCore::Editor::canDHTMLPaste):
-        (WebCore::Editor::tryDHTMLCopy):
-        (WebCore::Editor::tryDHTMLCut):
-        (WebCore::Editor::tryDHTMLPaste):
-        (WebCore::Editor::dispatchCPPEvent):
-        (WebCore::Editor::performCutOrCopy):
-        (WebCore::Editor::selectedTextForDataTransfer):
-        (WebCore::Editor::selectedTextForClipboard): Deleted.
-        * editing/Editor.h:
-        * editing/ios/EditorIOS.mm:
-        (WebCore::Editor::stringSelectionForPasteboardWithImageAltText):
-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::takeFindStringFromSelection):
-        (WebCore::Editor::stringSelectionForPasteboardWithImageAltText):
-        * loader/EmptyClients.h:
-        * page/DragClient.h:
-        * page/DragController.cpp:
-        (WebCore::DragController::dragExited):
-        (WebCore::DragController::performDrag):
-        (WebCore::DragController::tryDHTMLDrag):
-        (WebCore::DragController::startDrag):
-        (WebCore::DragController::doImageDrag):
-        (WebCore::DragController::doSystemDrag):
-        * page/DragController.h:
-        * page/DragState.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::dispatchDragEvent):
-        (WebCore::hasFileOfType):
-        (WebCore::hasStringOfType):
-        (WebCore::hasDropZoneType):
-        (WebCore::findDropZone):
-        (WebCore::EventHandler::updateDragAndDrop):
-        (WebCore::EventHandler::cancelDragAndDrop):
-        (WebCore::EventHandler::performDragAndDrop):
-        (WebCore::EventHandler::freeDataTransfer):
-        (WebCore::EventHandler::dragSourceEndedAt):
-        (WebCore::EventHandler::dispatchDragSrcEvent):
-        (WebCore::EventHandler::handleDrag):
-        (WebCore::EventHandler::freeClipboard): Deleted.
-        * page/EventHandler.h:
-        * page/efl/EventHandlerEfl.cpp:
-        (WebCore::EventHandler::createDraggingDataTransfer):
-        (WebCore::EventHandler::createDraggingClipboard): Deleted.
-        * page/gtk/DragControllerGtk.cpp:
-        (WebCore::DragController::declareAndWriteDragImage):
-        * page/gtk/EventHandlerGtk.cpp:
-        (WebCore::EventHandler::createDraggingDataTransfer):
-        (WebCore::EventHandler::createDraggingClipboard): Deleted.
-        * page/mac/DragControllerMac.mm:
-        (WebCore::DragController::declareAndWriteDragImage):
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::createDraggingDataTransfer):
-        (WebCore::EventHandler::createDraggingClipboard): Deleted.
-        * page/win/DragControllerWin.cpp:
-        (WebCore::DragController::declareAndWriteDragImage):
-        * page/win/EventHandlerWin.cpp:
-        (WebCore::EventHandler::createDraggingataTransfer):
-        (WebCore::EventHandler::createDraggingClipboard): Deleted.
-        * platform/Pasteboard.h:
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writeSelection):
-        * platform/mac/PasteboardMac.mm:
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeRangeToDataObject):
-        (WebCore::Pasteboard::writeSelection):
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::~HTMLMediaElement):
+        (WebCore::HTMLMediaElement::pageThrottlerIfPossible):
+        (WebCore):
+        (WebCore::HTMLMediaElement::playInternal):
+        (WebCore::HTMLMediaElement::pauseInternal):
+        * html/HTMLMediaElement.h:
+        (WebCore):
+        * html/MediaController.cpp:
+        (MediaController::unpause):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::incrementActivePageCount):
+        (WebCore::ChromeClient::decrementActivePageCount):
+        (ChromeClient):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        (WebCore::Page::setThrottled):
+        * page/Page.h:
+        (WebCore):
+        (Page):
+        (WebCore::Page::pageThrottler):
+        * page/PageThrottleState.h: Added.
+        * page/PageThrottler.cpp: Added.
+        (WebCore):
+        (WebCore::PageThrottler::PageThrottler):
+        (WebCore::PageThrottler::~PageThrottler):
+        (WebCore::PageThrottler::clearPage):
+        (WebCore::PageThrottler::throttlePage):
+        (WebCore::PageThrottler::unthrottlePage):
+        (WebCore::PageThrottler::setThrottled):
+        (WebCore::PageThrottler::preventThrottling):
+        (WebCore::PageThrottler::allowThrottling):
+        (WebCore::PageThrottler::stopThrottleHysteresisTimer):
+        (WebCore::PageThrottler::reportInterestingEvent):
+        (WebCore::PageThrottler::startThrottleHysteresisTimer):
+        (WebCore::PageThrottler::throttleHysteresisTimerFired):
+        * page/PageThrottler.h: Added.
+        (WebCore):
+        (PageThrottler):
+        (WebCore::PageThrottler::create):
+        (WebCore::PageThrottler::shouldThrottleAnimations):
+        (WebCore::PageThrottler::shouldThrottleTimers):
</ins><span class="cx"> 
</span><del>-2014-04-08  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-05-29  Kent Tamura  &lt;tkent@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed iOS build fix. Pass 0 instead of nil to the options parameter of addObserver:forKeyPath:options:context.
</del><ins>+        Remove leftover files for ENABLE_PAGE_POPUP and ENABLE_CALENDAR_PICKER
+        https://bugs.webkit.org/show_bug.cgi?id=116999
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ios/TextTrackRepresentationIOS.mm:
-        (-[WebCoreTextTrackRepresentationIOSHelper setParent:]):
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-04-08  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        * Resources/pagepopups/colorSuggestionPicker.css: Removed.
+        * Resources/pagepopups/colorSuggestionPicker.js: Removed.
+        * Resources/pagepopups/pickerCommon.css: Removed.
+        * Resources/pagepopups/pickerCommon.js: Removed.
+        * Resources/pagepopups/suggestionPicker.css: Removed.
+        * Resources/pagepopups/suggestionPicker.js: Removed.
</ins><span class="cx"> 
</span><del>-        Remove exposedRect from TileController
-        https://bugs.webkit.org/show_bug.cgi?id=131378
</del><ins>+2013-05-29  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Unreviewed build fix; remove unintentional semicolon.
</ins><span class="cx"> 
</span><del>-        Having two separate visible rectangles is confusing. We should compute one on higher level.
</del><ins>+        * Modules/webaudio/AudioScheduledSourceNode.cpp:
+        (WebCore::AudioScheduledSourceNode::finish):
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::setExposedRect):
-        
-            Push exposed rect to tile controller by doing a layer flush (like the changed visible rect is normally passed).
</del><ins>+2013-05-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/TiledBacking.h:
-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        
-            Remove exposedRect and just use visibleRect.
</del><ins>+        Merge PODArea::Chunk into PODFreeListArena::FreeListChunk
+        https://bugs.webkit.org/show_bug.cgi?id=117000
</ins><span class="cx"> 
</span><del>-        (WebCore::TileController::TileController):
-        (WebCore::TileController::setTiledScrollingIndicatorPosition):
-        
-            Update the scrolling indicator position.
</del><ins>+        Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        (WebCore::TileController::updateTileCoverageMap):
-        (WebCore::TileController::setExposedRect): Deleted.
-        * platform/graphics/ca/mac/TileGrid.h:
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::tilesWouldChangeForVisibleRect):
-        (WebCore::TileGrid::revalidateTiles):
-        (WebCore::TileGrid::scaledExposedRect): Deleted.
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        
-            No need to push exposedRect anymore.
</del><ins>+        * platform/PODArena.h:
+        (WebCore::PODArena::roundUp):
+        * platform/PODFreeListArena.h:
+        (PODFreeListArena):
+        (WebCore::PODFreeListArena::FreeListChunk::FreeListChunk):
+        (FreeListChunk):
+        (WebCore::PODFreeListArena::FreeListChunk::~FreeListChunk):
+        (WebCore::PODFreeListArena::FreeListChunk::allocate):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
-        
-            Integrate exposed rect to visible rect when flushing layers.
</del><ins>+2013-05-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Move some PODArena members to PODFreeListArena
+        https://bugs.webkit.org/show_bug.cgi?id=116993
</ins><span class="cx"> 
</span><del>-        [Mac] Always do a full GC when simulating memory pressure.
-        &lt;https://webkit.org/b/129790&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        To get more consistent accounting on automated memory testers,
-        add a synchronous GC as part of the simulated memory pressure event.
</del><ins>+        This is more work towards merging the two classes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        * platform/PODArena.h:
+        (PODArena):
+        * platform/PODFreeListArena.h:
+        (PODFreeListArena):
+        (WebCore::PODFreeListArena::PODFreeListArena):
</ins><span class="cx"> 
</span><del>-        * platform/mac/MemoryPressureHandlerMac.mm:
-        (WebCore::MemoryPressureHandler::install):
</del><ins>+2013-05-29  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        [Mac] Scrubbing long movie files results in timeline snapping back to 0 during scrub.
+        https://bugs.webkit.org/show_bug.cgi?id=116986
</ins><span class="cx"> 
</span><del>-        Unreviewed iOS build fix. Pass 0 instead of nil to setRate: when pausing.
-
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformPause):
-
-2014-04-08  Mark Lam  &lt;mark.lam@apple.com&gt;
-
-        Refactor to make JSMainThreadExecState's constructor and destructor private.
-        &lt;https://webkit.org/b/131372&gt;
-
-        Reviewed by Mark Hahnenberg.
-
-        This is in preparation for subsequent patches to ensure that we don't
-        exit the VM with an exception still pending.
-
-        No new tests required.  This is only a refactor of existing behavior.
-
-        * bindings/js/JSDOMGlobalObjectTask.cpp:
-        * bindings/js/JSMainThreadExecState.h:
-        (WebCore::JSMainThreadExecState::runTask):
-
-2014-04-07  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [WK2][iOS] Consecutive videos in full screen display only black
-        https://bugs.webkit.org/show_bug.cgi?id=131316
-
</del><span class="cx">         Reviewed by Eric Carlson.
</span><span class="cx"> 
</span><del>-        Update the MediaPlayer's full screen attributes whenever the underlying engine changes,
-        not just when the engine is initially created. Also, clear the videoLayer out of the
-        fullscreen layer when destroying the videoLayer.
</del><ins>+        Keep a count of the number of in-flight seek requests, and only issue a timeupdate
+        (which triggers a &quot;seeked&quot; event) when the final seek completes.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer):
</del><ins>+        Test: media/video-seek-multiple.html
</ins><span class="cx"> 
</span><del>-2014-04-08  Morten Stenshorne  &lt;mstensho@opera.com&gt;
</del><ins>+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::seek):
+        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted):
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        (MediaPlayerPrivateAVFoundation):
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] Child top margin sometimes ignored for column balancing
-        https://bugs.webkit.org/show_bug.cgi?id=122754
</del><ins>+2013-05-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Remove unused code from PODArena
+        https://bugs.webkit.org/show_bug.cgi?id=116990
</ins><span class="cx"> 
</span><del>-        We need to set zero page logical height in LayoutState when column
-        height is unknown (when the columns haven't yet been
-        balanced). There's code that assumes that non-zero page height means
-        that page height is known. Lying about this makes the pagination code
-        believe that every top margin is adjacent to a column break, which
-        makes it eat and ignore all top margins.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        This should be cleaned up, but it's easier to wait until the old
-        multicol code has been removed.
</del><ins>+        PODArena is only used as a base class of PODFreeListArena so remove unused member functions and make all
+        members protected to make it impossible to use it without subclassing.
</ins><span class="cx"> 
</span><del>-        Tests: fast/multicol/break-in-scrollable.html
-               fast/multicol/newmulticol/leading-and-trailing-margin.html
-               fast/multicol/newmulticol/leading-margin.html
</del><ins>+        PODArena is a risky class to use since it doesn't return memory to the system unless the arena object is destroyed.
+        This was the reason why PODFreeListArea was added. An upcoming patch will merge PODArena with PODFreeListArena and
+        this is a small step towards that goal.
</ins><span class="cx"> 
</span><del>-        * rendering/LayoutState.cpp:
-        (WebCore::LayoutState::LayoutState):
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::checkForPaginationLogicalHeightChange):
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::isPageLogicalHeightKnown):
-        * rendering/RenderMultiColumnFlowThread.h:
</del><ins>+        * platform/PODArena.h:
</ins><span class="cx"> 
</span><del>-2014-04-07  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+2013-05-29  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Allow elements to register for changes in page scale
-        https://bugs.webkit.org/show_bug.cgi?id=131319
</del><ins>+        Remove custom binding for Clipboard setDragImage function
+        https://bugs.webkit.org/show_bug.cgi?id=116422
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Some parts of WebCore need to react to changes in the page
-        scale factor, such as resizing when the user zooms. A followup
-        patch will enable this for media controls - this simply lays
-        the groundwork.
</del><ins>+        * bindings/js/JSClipboardCustom.cpp: Removed setDragImage binding.
</ins><span class="cx"> 
</span><del>-        At the moment we only allow HTMLMediaElements to register, but if
-        necessary this could be expanded in the future.
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::canSetDragImage): Added a condition that this is a drag
+        and drop clipboard. That used to be checked in the setDragImage binding.
+        (WebCore::Clipboard::setDragImage): Added a version that takes an Element
+        and calls through to the existing functions (in the legacy code path), or handles
+        both the Element and HTMLImageElement not-in-document cases (in the new code path).
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp: New methods to keep a list of HTMLMediaElements that
-        are interested in updates.
-        (WebCore::Document::registerForPageScaleFactorChangedCallbacks):
-        (WebCore::Document::unregisterForPageScaleFactorChangedCallbacks):
-        (WebCore::Document::pageScaleFactorChanged):
-        * dom/Document.h:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        (WebCore::HTMLMediaElement::registerWithDocument): Add ourselves to the
-        the document's pageScale callback.
-        (WebCore::HTMLMediaElement::unregisterWithDocument): Remove ourselves from the
-        the document's pageScale callback.
-        (WebCore::HTMLMediaElement::setMediaControlsDependOnPageScaleFactor): Add/remove ourselves to/from
-        the callback if necessary.
-        (WebCore::HTMLMediaElement::pageScaleFactorChanged): The callback function. Empty for now.
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::mediaControlsDependOnPageScaleFactor): Accessor.
-        * page/Page.cpp:
-        (WebCore::Page::setPageScaleFactor): Tell all documents that the user has zoomed.
</del><ins>+        * dom/Clipboard.h: Updated for changes above.
</ins><span class="cx"> 
</span><del>-2014-04-08  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</del><ins>+        * dom/Clipboard.idl: Removed [Custom] from setDragImage.
</ins><span class="cx"> 
</span><del>-        [WinCairo] Compile error in TextureMapper.h
-        https://bugs.webkit.org/show_bug.cgi?id=131360
</del><ins>+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag): Call the new setDragImage instead of the
+        old setDragImageElement.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+2013-05-29  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        The TextureMapper class has pure virtual methods, and cannot be instantiated.
</del><ins>+        Cleanup AudioSourceNode.idl from WebKit build.
+        https://bugs.webkit.org/show_bug.cgi?id=116905.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/texmap/TextureMapper.h:
-        (WebCore::TextureMapper::platformCreateAccelerated):
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-04-08  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        AudioSourceNode.idl is not part of WebAudio Specifications anymore.
+        AudioNode is inherited directly in all the audio source nodes.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Slow paint path for inlines should snap to device pixels.
-        https://bugs.webkit.org/show_bug.cgi?id=131259
</del><ins>+        No new tests. Current test cases will cover all the scenarios.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/webaudio/AudioBufferSourceNode.h:
+        * Modules/webaudio/AudioBufferSourceNode.idl:
+        * Modules/webaudio/AudioScheduledSourceNode.cpp:
+        (WebCore::AudioScheduledSourceNode::AudioScheduledSourceNode):
+        * Modules/webaudio/AudioScheduledSourceNode.h:
+        * Modules/webaudio/AudioSourceNode.h: Removed.
+        * Modules/webaudio/AudioSourceNode.idl: Removed.
+        * Modules/webaudio/MediaElementAudioSourceNode.cpp:
+        (WebCore::MediaElementAudioSourceNode::MediaElementAudioSourceNode):
+        * Modules/webaudio/MediaElementAudioSourceNode.h:
+        (MediaElementAudioSourceNode):
+        * Modules/webaudio/MediaElementAudioSourceNode.idl:
+        * Modules/webaudio/MediaStreamAudioDestinationNode.idl:
+        * Modules/webaudio/MediaStreamAudioSourceNode.cpp:
+        (WebCore::MediaStreamAudioSourceNode::MediaStreamAudioSourceNode):
+        * Modules/webaudio/MediaStreamAudioSourceNode.h:
+        (MediaStreamAudioSourceNode):
+        * Modules/webaudio/MediaStreamAudioSourceNode.idl:
+        * Modules/webaudio/OscillatorNode.h:
+        * Modules/webaudio/OscillatorNode.idl:
+        * Target.pri:
+        * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-        InlineTextBox::paint needs to round to the same device pixel position as SimpleLineLayout does.
</del><ins>+2013-05-29  Adam Barth  &lt;abarth@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/inline/hidpi-slow-path-text-on-subpixel-position.html
</del><ins>+        Optimize RenderText::offsetNext for 8 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=116877
</ins><span class="cx"> 
</span><del>-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paint):
-        * rendering/TextPainter.h: Cleanup. No reason to have them as references here.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-04-07  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Previously, this function was always upconverting strings to 16 bits in
+        order to create a cursorMovementIterator. This patch adds a fast path
+        for ASCII and Latin-1 strings, which don't need this complicated cursor
+        movement logic.
</ins><span class="cx"> 
</span><del>-        Keep 'webkitClosedCaptionsVisible' API in sync with captions display preferences
-        https://bugs.webkit.org/show_bug.cgi?id=131344
</del><ins>+        I ran into this code because nextOffset showed up as a memory pig on a
+        memory profile of Mobile Gmail.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Test: editing/selection/move-by-character-brute-force.html
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::configureTextTrackGroup) If we decide that captions should
-        be active (due to user preferences) make sure the 'webkitClosedCaptionsVisible' state
-        is turned on.
</del><ins>+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::previousOffset):
+        (WebCore::RenderText::nextOffset):
</ins><span class="cx"> 
</span><del>-2014-04-08  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-05-29  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Paint the filter effect result image on device pixel position.
-        https://bugs.webkit.org/show_bug.cgi?id=131255
</del><ins>+        [Windows] Correct copy command (form versus forms)
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * WebCore.vcxproj/copyForwardingHeaders.cmd:
</ins><span class="cx"> 
</span><del>-        This patch moves filter effect images from integral to device pixel position. However,
-        result images are still integral based.
</del><ins>+2013-05-29  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: css3/filters/hidpi-filter-is-on-subpixel-position.html
</del><ins>+        [CSS Shapes] Fix style issues in BasicShapes
+        https://bugs.webkit.org/show_bug.cgi?id=116734
</ins><span class="cx"> 
</span><del>-        * rendering/FilterEffectRenderer.cpp:
-        (WebCore::FilterEffectRendererHelper::applyFilterEffect):
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-2014-04-08  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Fix indentation in BasicShapes.cpp, and change enums to respect the
+        style rules CamelCase instead of HAVING_UNDERSCORES.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Make border images device pixel aware.
-        https://bugs.webkit.org/show_bug.cgi?id=131209
</del><ins>+        No new tests, only style changes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * css/BasicShapeFunctions.cpp:
+        (WebCore::valueForBasicShape):
+        (WebCore::basicShapeForValue):
+        * css/CSSBasicShapes.cpp:
+        (WebCore::buildRectangleString):
+        (WebCore::CSSBasicShapeRectangle::equals):
+        (WebCore::CSSBasicShapeCircle::equals):
+        (WebCore::CSSBasicShapeEllipse::equals):
+        (WebCore::CSSBasicShapePolygon::equals):
+        (WebCore::CSSBasicShapeInsetRectangle::equals):
+        * css/CSSBasicShapes.h:
+        (WebCore::CSSBasicShapeRectangle::type):
+        (WebCore::CSSBasicShapeInsetRectangle::type):
+        (WebCore::CSSBasicShapeCircle::type):
+        (WebCore::CSSBasicShapeEllipse::type):
+        (WebCore::CSSBasicShapePolygon::type):
+        * rendering/ExclusionShape.cpp:
+        (WebCore::ExclusionShape::createExclusionShape):
+        * rendering/ExclusionShapeInsideInfo.cpp:
+        (WebCore::ExclusionShapeInsideInfo::isEnabledFor):
+        * rendering/ExclusionShapeOutsideInfo.cpp:
+        (WebCore::ExclusionShapeOutsideInfo::isEnabledFor):
+        * rendering/style/BasicShapes.cpp:
+        (WebCore::BasicShape::canBlend):
+        (WebCore::BasicShapeRectangle::path):
+        (WebCore::BasicShapeCircle::path):
+        (WebCore::BasicShapeEllipse::path):
+        (WebCore::BasicShapeInsetRectangle::path):
+        * rendering/style/BasicShapes.h:
+        (WebCore::BasicShapeRectangle::type):
+        (WebCore::BasicShapeCircle::type):
+        (WebCore::BasicShapeEllipse::type):
+        (WebCore::BasicShapePolygon::type):
+        (WebCore::BasicShapeInsetRectangle::type):
</ins><span class="cx"> 
</span><del>-        Snap border-image size and position to device pixels. It works both on generated and bitmap images.
</del><ins>+2013-05-29  Otto Derek Cheung  &lt;otcheung@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/borders/hidpi-border-image-gradient-on-subpixels.html
</del><ins>+        [BlackBerry] Handle Host-Only cookies
+        https://bugs.webkit.org/show_bug.cgi?id=116969
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintNinePieceImage):
</del><ins>+        PR 338809
+        Reviewed by Rob Buis.
+        Internally Reviewed by Joe Mason.
</ins><span class="cx"> 
</span><del>-2014-04-08  Youenn Fablet  &lt;youenn.fablet@crf.canon.fr&gt;
</del><ins>+        Adding support for host-only cookies (cookies with no
+        specified domains). These cookies should only be returned
+        when the host matches the cookie domain exactly.
</ins><span class="cx"> 
</span><del>-        [SOUP] Control cookie management according ResourceRequest.allowCookies()
-        https://bugs.webkit.org/show_bug.cgi?id=131026
</del><ins>+        Tested using Opera and Browser cookie test suite. Tested
+        that host cookies are being stored in it's own map using
+        Web Inspector.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sergio Villar Senin.
</del><ins>+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::CookieManager::getRawCookies):
+        (WebCore::CookieManager::checkAndTreatCookie):
+        (WebCore::CookieManager::findOrCreateCookieMap):
+        * platform/blackberry/CookieParser.cpp:
+        (WebCore::CookieParser::CookieParser):
+        (WebCore::CookieParser::parseOneCookie):
+        * platform/blackberry/ParsedCookie.h:
+        (WebCore::ParsedCookie::isHostOnly):
+        (ParsedCookie):
</ins><span class="cx"> 
</span><del>-        Added per soup-message disabling of cookie jar manager when related ResourceRequest does not allow cookies (e.g. some cross-origin requests).
</del><ins>+2013-05-29  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Patch is covered by unskipped test http/tests/xmlhttprequest/cross-origin-cookie-storage.html.
</del><ins>+        Remove the size of DataVector in HTMLToken
+        https://bugs.webkit.org/show_bug.cgi?id=116931
</ins><span class="cx"> 
</span><del>-        * platform/network/soup/ResourceRequestSoup.cpp:
-        (WebCore::ResourceRequest::updateSoupMessageMembers): Added disabling of cookie jar manager if cookies are not allowed.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-2014-04-08  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/7977721e62c471bfa17b84d82cd5d8243a4eb9a9.
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Handle min/max height in the grid element
-        https://bugs.webkit.org/show_bug.cgi?id=131302
</del><ins>+        Shink HTMLToken by 1.5 kB
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        HTMLToken has an inline vector for buffering characters during tokenization. We
+        originally picked the inline capacity of this buffer somewhat arbitrarily. This
+        CL tunes the number based on a somewhat non-scientific browse of a number of
+        popular web sites.
</ins><span class="cx"> 
</span><del>-        Removed a FIXME in the code as we're already handling min/max
-        height in the code. Added a couple of test cases to improve the
-        test coverage.
</del><ins>+        I (abarth) instrumented content_shell to log the length of each complete DataVector. I
+        then browsed around a variety of web sites to collect data. The 99% percentile
+        of DataVector lengths was just shy of 250 characters. I rounded that up to 256
+        because powers of two are pretty. That means we'll malloc an external buffer
+        less than 1% of the time, which seems fine.
</ins><span class="cx"> 
</span><del>-        Merged from Blink r161876 by &lt;jchaffraix@chromium.org&gt;
</del><ins>+        * html/parser/HTMLToken.h:
+        (HTMLToken):
</ins><span class="cx"> 
</span><del>-        Tests: fast/css-grid-layout/flex-content-sized-columns-resize.html
-               fast/css-grid-layout/grid-element-min-max-height.html
</del><ins>+2013-05-29  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::layoutGridItems):
</del><ins>+        [Windows] Build correction after r150837
</ins><span class="cx"> 
</span><del>-2014-04-08  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        New 'forms' sub-folder of html needs to be included in
+        copy operations.
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Remove unused RenderBox::clearRenderBoxRegionInfo
-        https://bugs.webkit.org/show_bug.cgi?id=131352
</del><ins>+        * WebCore.vcproj/copyForwardingHeaders.cmd: copy html/forms.
+        * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters: Use correct
+        'obj32' folder for build output.
+        * WebCore.vcxproj/copyForwardingHeaders.cmd: copy html/forms.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+2013-05-29  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, code clean-up.
</del><ins>+        [BlackBerry] Radio Button UX updates.
+        https://bugs.webkit.org/show_bug.cgi?id=116881
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::clearRenderBoxRegionInfo): Deleted.
-        * rendering/RenderBox.h:
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-2014-04-08  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+        BlackBerry PR 342322.
+        Internally Reviewed by Jeff Rogers.
+        Change images.
</ins><span class="cx"> 
</span><del>-        Buildfix after r166917
-        https://bugs.webkit.org/show_bug.cgi?id=131351
</del><ins>+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::RenderThemeBlackBerry::paintRadio):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+2013-05-29  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityNodeObject.cpp:
-        (WebCore::accessibleNameForNode):
</del><ins>+        [BlackBerry] Datetime string is not centred in form controls.
+        https://bugs.webkit.org/show_bug.cgi?id=100760
</ins><span class="cx"> 
</span><del>-2014-04-08  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Fix assertions triggered by CSS calc changes in r166860
-        https://bugs.webkit.org/show_bug.cgi?id=131346
</del><ins>+        BlackBerry PR 343512
+        Internally Reviewed by Jeff Rogers.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        Adjust margin for inner text node of datetime form controls.
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::getBorderRadiusCornerValues): Use isPercentNotCalculated() instead of
-        type() == Percent; no behavior change.
-        (WebCore::getBorderRadiusCornerValue): Ditto.
-        (WebCore::lineHeightFromStyle): Use isPercentNotCalculated() before code
-        that calls percent(), which won't work for a calculated length.
</del><ins>+        * css/themeBlackBerry.css:
+        (input::-webkit-date-and-time-value):
</ins><span class="cx"> 
</span><del>-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyBorderRadius::applyValue): Use isNegative and isZero rather
-        than calling value() unconditionally. Should make calculated values work better.
</del><ins>+2013-05-29  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLPlugInImageElement.cpp:
-        (WebCore::is100Percent): Use isPercentNotCalculated() before code
-        that calls percent(), which won't work for a calculated length.
</del><ins>+        [Windows] Build correction after r150876
</ins><span class="cx"> 
</span><del>-        * platform/Length.cpp:
-        (WebCore::CalculationValueMap::deref): Use adoptRef here instead of calling deref
-        immediately, so the deref will happen after calling remove. This makes the code
-        work properly even if it's reentered inside the calculation value's destructor.
</del><ins>+        A clean build will now fail because the BaseMultipleFieldsDateAndTimeInputType sources have
+        been removed, but are still referenced in the project file.
</ins><span class="cx"> 
</span><del>-        * platform/Length.h:
-        (WebCore::Length::percent): Change assert to isPercentNotCalculated, since the
-        value function this calls only works for non-calculated values anyway.
-        (WebCore::Length::isPercentNotCalculated): Added.
-        (WebCore::Length::isPercent): Changed to call isPercentNotCalculated.
-        (WebCore::Length::isSpecified): Changed to call isPercent.
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Remove reference to BaseMultipleFieldsDateAndTimeInputType
+        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/TranslateTransformOperation.h:
-        (WebCore::TranslateTransformOperation::apply): Use isPercentNotCalculated()
-        instead of type() == Percent; no behavior change.
</del><ins>+2013-05-28  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn): Use isPercentNotCalculated()
-        before code that calls value() or percent(), which won't work for a calculated length.
-        (WebCore::AutoTableLayout::computeIntrinsicLogicalWidths): Ditto.
-        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth): Ditto.
-        (WebCore::AutoTableLayout::layout): Ditto.
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::layout): Ditto.
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions): Ditto.
-        * rendering/RenderTableSection.cpp:
-        (WebCore::updateLogicalHeightForCell): Ditto.
-        (WebCore::RenderTableSection::distributeExtraLogicalHeightToPercentRows): Ditto.
-        (WebCore::RenderTableSection::distributeExtraLogicalHeightToRows): Ditto.
</del><ins>+        Support the 'onended' EventListener property for AudioBufferSourceNode and OscillatorNode.
+        https://bugs.webkit.org/show_bug.cgi?id=116798
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.cpp:
-        (WebCore::requireTransformOrigin): Use modern for loop. Also marked function static,
-        since it's private to this file.
-        (WebCore::RenderStyle::applyTransform): Use isPercentNotCalculated() instead of
-        type() == Percent; no behavior change. Also use a modern for loop and auto&amp; to avoid
-        a really long type name.
-
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::computeIntrinsicRatioInformation): Use isPercentNotCalculated()
-        before code that calls percent(), which won't work for a calculated length.
-
-        * platform/Length.h:
-        (WebCore::Length::percent):
-        (WebCore::Length::isPercentNotCalculated):
-        (WebCore::Length::isPercent):
-        (WebCore::Length::isSpecified):
-        * platform/graphics/transforms/TranslateTransformOperation.h:
-        (WebCore::TranslateTransformOperation::apply):
-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn):
-        (WebCore::AutoTableLayout::computeIntrinsicLogicalWidths):
-        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
-        (WebCore::AutoTableLayout::layout):
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::layout):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::updateLogicalHeightForCell):
-        (WebCore::RenderTableSection::distributeExtraLogicalHeightToPercentRows):
-        (WebCore::RenderTableSection::distributeExtraLogicalHeightToRows):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::requireTransformOrigin):
-        (WebCore::RenderStyle::applyTransform):
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::computeIntrinsicRatioInformation):
-
-2014-04-08  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
-
-        [GTK] Remove media controls dead code
-        https://bugs.webkit.org/show_bug.cgi?id=131300
-
</del><span class="cx">         Reviewed by Eric Carlson.
</span><span class="cx"> 
</span><del>-        MediaControlsGtk.cpp is no longer used so we can remove it from
-        the repo.
</del><ins>+        Tests: webaudio/audiobuffersource-ended.html
+               webaudio/oscillator-ended.html
</ins><span class="cx"> 
</span><del>-        No new tests needed.
</del><ins>+        * Modules/webaudio/AudioScheduledSourceNode.cpp:
+        (WebCore::AudioScheduledSourceNode::AudioScheduledSourceNode):
+        (WebCore::AudioScheduledSourceNode::setOnended): Set m_hasEndedListener.
+        (WebCore::AudioScheduledSourceNode::finish): Call notifyEndedDispatch on the main thread.
+        (WebCore::AudioScheduledSourceNode::notifyEndedDispatch): Call notifyEnded().
+        (WebCore::AudioScheduledSourceNode::notifyEnded): Call the onended event listener.
+        * Modules/webaudio/AudioScheduledSourceNode.h:
+        (WebCore::AudioScheduledSourceNode::onended): Added boilerplate.
+        * Modules/webaudio/AudioBufferSourceNode.idl: Added the onerror attribute.
+        * Modules/webaudio/OscillatorNode.idl: Ditto.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Remove html/shadow/MediaControlsGtk.cpp from
-        compilation.
-        * html/shadow/MediaControlsGtk.cpp: Removed.
</del><ins>+2013-05-29  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-08  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        [CSS Shapes] Support parsing inset-rectangle shapes
+        https://bugs.webkit.org/show_bug.cgi?id=116638
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Fixed positioned elements in named flows have fragmented content
-        https://bugs.webkit.org/show_bug.cgi?id=130595
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Add parsing for inset-rectangle. It's very similar to parsing for
+        rectangle.
</ins><span class="cx"> 
</span><del>-        Fixed positioned elements that have the named flow as parent are positioned
-        and sized relative to the viewport. Because of that, when the named flow
-        has an associated region chain, the fixed positioned elements should not
-        be fragmented.
</del><ins>+        No new tests, updated existing tests to cover this.
</ins><span class="cx"> 
</span><del>-        By making a fixed positioned element with a named flow parent unsplittable
-        for fragmentation, we prevent this wrong behavior.
</del><ins>+        * css/BasicShapeFunctions.cpp:
+        (WebCore::valueForBasicShape): Add support for inset rectangles.
+        (WebCore::basicShapeForValue): Add support for inset rectangles.
+        * css/CSSBasicShapes.cpp:
+        (WebCore::buildInsetRectangleString): Create an inset-rectangle css
+            string.
+        (WebCore::CSSBasicShapeInsetRectangle::cssText): Convert inset
+            rectangle shape to a CSS string.
+        (WebCore::CSSBasicShapeInsetRectangle::equals): Compare two inset
+            rectangles.
+        (WebCore::CSSBasicShapeInsetRectangle::serializeResolvingVariables):
+            Create an inset rectangle string, with CSS variables resolved.
+        (WebCore::CSSBasicShapeInsetRectangle::hasVariableReference):
+            Determine if this inset rectangle has any CSS Variable references.
+        * css/CSSBasicShapes.h:
+        (CSSBasicShapeInsetRectangle): Add inset rectangle class. This is a
+            direct representation of the CSS property. All the methods below
+            are just simple getters and setters, along with a construtor and a
+            factory method.
+        (WebCore::CSSBasicShapeInsetRectangle::create): 
+        (WebCore::CSSBasicShapeInsetRectangle::top): 
+        (WebCore::CSSBasicShapeInsetRectangle::right):
+        (WebCore::CSSBasicShapeInsetRectangle::bottom):
+        (WebCore::CSSBasicShapeInsetRectangle::left):
+        (WebCore::CSSBasicShapeInsetRectangle::radiusX):
+        (WebCore::CSSBasicShapeInsetRectangle::radiusY):
+        (WebCore::CSSBasicShapeInsetRectangle::setTop):
+        (WebCore::CSSBasicShapeInsetRectangle::setRight):
+        (WebCore::CSSBasicShapeInsetRectangle::setBottom):
+        (WebCore::CSSBasicShapeInsetRectangle::setLeft):
+        (WebCore::CSSBasicShapeInsetRectangle::setRadiusX):
+        (WebCore::CSSBasicShapeInsetRectangle::setRadiusY):
+        (WebCore::CSSBasicShapeInsetRectangle::type):
+        (WebCore::CSSBasicShapeInsetRectangle::CSSBasicShapeInsetRectangle):
+        (WebCore):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseBasicShapeInsetRectangle): Parse the
+            inset-rectangle CSS property and create a
+            CSSBasicShapeInsetRectangle.
+        (WebCore::CSSParser::parseBasicShape): Add a call to parse
+            inset-rectangle.
+        * rendering/ExclusionShapeInsideInfo.cpp:
+        (WebCore::ExclusionShapeInsideInfo::isEnabledFor): Disable
+            inset-rectangles, since only the parsing has been implemented so
+            far.
+        * rendering/ExclusionShapeOutsideInfo.cpp:
+        (WebCore::ExclusionShapeOutsideInfo::isEnabledFor): Disable
+            inset-rectangles, since only the parsing has been implemented so
+            far.
+        * rendering/style/BasicShapes.cpp:
+        (WebCore::BasicShapeInsetRectangle::path): Calculate the Path for an
+            inset-rectangle.
+        (WebCore::BasicShapeInsetRectangle::blend): Blend two inset rectangles
+            together at a point depending on the &quot;progress&quot; and return the
+            blended rectangle.
+        * rendering/style/BasicShapes.h:
+        (BasicShapeInsetRectangle): Add higher level inset rectangle class.
+            This is used outside of the CSS representation. The methods below
+            are just simple getters and setters, along with a constructor and
+            a factory method.
+        (WebCore::BasicShapeInsetRectangle::create):
+        (WebCore::BasicShapeInsetRectangle::top):
+        (WebCore::BasicShapeInsetRectangle::right):
+        (WebCore::BasicShapeInsetRectangle::bottom):
+        (WebCore::BasicShapeInsetRectangle::left):
+        (WebCore::BasicShapeInsetRectangle::cornerRadiusX):
+        (WebCore::BasicShapeInsetRectangle::cornerRadiusY):
+        (WebCore::BasicShapeInsetRectangle::setTop):
+        (WebCore::BasicShapeInsetRectangle::setRight):
+        (WebCore::BasicShapeInsetRectangle::setBottom):
+        (WebCore::BasicShapeInsetRectangle::setLeft):
+        (WebCore::BasicShapeInsetRectangle::setCornerRadiusX):
+        (WebCore::BasicShapeInsetRectangle::setCornerRadiusY):
+        (WebCore::BasicShapeInsetRectangle::type):
+        (WebCore::BasicShapeInsetRectangle::BasicShapeInsetRectangle):
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/fixed-pos-content-fragmented.html
</del><ins>+2013-05-29  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::isUnsplittableForPagination):
</del><ins>+        Move computed style extraction out of CSSComputedStyleDeclaration.
+        &lt;http://webkit.org/b/116965&gt;
</ins><span class="cx"> 
</span><del>-2014-04-07  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Regression: AX: image labels no longer exposed to AX API in SVG test case
-        https://bugs.webkit.org/show_bug.cgi?id=131208
</del><ins>+        Make it possible to get computed CSSValues from a Node without creating a CSSOM
+        style declaration object.
</ins><span class="cx"> 
</span><del>-        Reviewed by Daniel Bates.
</del><ins>+        The bulk of the logic moves to a new class; ComputedStyleExtractor, which can be created
+        on the stack, and takes the same setup variables as CSSComputedStyleDeclaration.
</ins><span class="cx"> 
</span><del>-        accessibleNameForNode should work on any Element, not just HTML elements.
</del><ins>+        This is prep to enable futuristic optimizations in editing and elsewhere.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/svg-labelledby.html
</del><ins>+        * css/CSSComputedStyleDeclaration.h:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityNodeObject.cpp:
-        (WebCore::accessibleNameForNode):
</del><ins>+            Create a ComputedStyleExtractor to do the work!
</ins><span class="cx"> 
</span><del>-2014-04-08  Andres Gomez  &lt;agomez@igalia.com&gt;
</del><ins>+        (WebCore::ComputedStyleExtractor::currentColorOrValidColor):
+        (WebCore::ComputedStyleExtractor::valueForFilter):
+        (WebCore::ComputedStyleExtractor::ComputedStyleExtractor):
+        (WebCore::ComputedStyleExtractor::valueForShadow):
+        (WebCore::ComputedStyleExtractor::styledNode):
+        (WebCore::ComputedStyleExtractor::propertyValue):
+        (WebCore::ComputedStyleExtractor::getCSSPropertyValuesForShorthandProperties):
+        (WebCore::ComputedStyleExtractor::getCSSPropertyValuesForSidesShorthand):
+        (WebCore::ComputedStyleExtractor::getCSSPropertyValuesForGridShorthand):
+        (WebCore::ComputedStyleExtractor::getBackgroundShorthandValue):
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::ComputedStyleExtractor::adjustSVGPaintForCurrentColor):
+        (WebCore::ComputedStyleExtractor::svgPropertyValue):
</ins><span class="cx"> 
</span><del>-        [GTK] [EFL] Build fails with GCC &lt; 4.8.x
-        https://bugs.webkit.org/show_bug.cgi?id=130585
</del><ins>+            Moved all of these from CSSComputedStyleDeclaration to the new class.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        * rendering/style/RenderStyle.h:
+        * svg/SVGPaint.h:
</ins><span class="cx"> 
</span><del>-        The behavior in lower versions of GCC seem to be related to
-        http://www.open-std.org/jtc1/sc22/wg21/docs/lwg-active.html#2132.
</del><ins>+            Have these two befriend ComputedStyleExtractor.
</ins><span class="cx"> 
</span><del>-        Provided explicit casts for the failing ambiguous overloads.
</del><ins>+2013-05-29  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
-        (WebCore::AudioFileReader::createBus):
-        * platform/graphics/gstreamer/WebKitMediaSourceGStreamer.cpp:
-        (webKitMediaSrcChangeState):
-        (webKitMediaVideoSrcNeedDataCb):
-        (webKitMediaAudioSrcNeedDataCb):
-        (webKitMediaVideoSrcEnoughDataCb):
-        (webKitMediaAudioSrcEnoughDataCb):
-        (webKitMediaVideoSrcSeekDataCb):
-        (webKitMediaAudioSrcSeekDataCb):
-        * platform/gtk/GtkDragAndDropHelper.cpp:
-        (WebCore::GtkDragAndDropHelper::handleDragLeave):
-        * platform/gtk/SharedTimerGtk.cpp:
-        (WebCore::setSharedTimerFireInterval):
</del><ins>+        Another attempt to fix windows build.
+        
+        Not reviewed.
</ins><span class="cx"> 
</span><del>-2014-04-08  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+        * css/CSSFontSelector.h:
</ins><span class="cx"> 
</span><del>-        Change NavigatorContentUtils client ownership from port side to NavigatorContentUtils
-        https://bugs.webkit.org/show_bug.cgi?id=131299
</del><ins>+2013-05-29  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Try to fix window build.
+        
+        Not reviewed.
</ins><span class="cx"> 
</span><del>-        EFL and GTK ports have managed own client of NavigatorContentUtils though it is only passed to
-        NavigatorContentUtils. The NavigatorContentUtils has used the client to call port functions. So,
-        there is no reason port implementation needs to manage the ownership. To manage the client is
-        unnecessary work in current implementation.
</del><ins>+        * platform/graphics/FontCache.h:
+        (WebCore::FontDescriptionFontDataCacheKey::computeHash):
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior changes.
</del><ins>+2013-05-29  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
-        (WebCore::NavigatorContentUtils::create):
-        (WebCore::provideNavigatorContentUtilsTo):
-        * Modules/navigatorcontentutils/NavigatorContentUtils.h:
-        * Modules/navigatorcontentutils/NavigatorContentUtilsClient.h:
</del><ins>+        Fix the firing of m_paintRelatedMilestonesTimer
+        https://bugs.webkit.org/show_bug.cgi?id=116919
</ins><span class="cx"> 
</span><del>-2014-04-07  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Simplify the parsing of width arguments for Inset shapes
-        https://bugs.webkit.org/show_bug.cgi?id=131305
</del><ins>+        r150671 intended to change things so that paint-related milestones
+        only fire when painting has actually happened, so that WebKit clients
+        are notified when we actually have bits to present.
+        
+        However, it made an incorrect assumption that painting would happen
+        inside of flushCompositingState(). This is not the case; flushCompositingState()
+        will just dirty CALayers, and later on Core Animation will ask us to paint them.
+        
+        This incorrect assumption meant that we would never start the
+        m_paintRelatedMilestonesTimer, so never fire the milestones.
+        
+        Fix by starting the m_paintRelatedMilestonesTimer via the RenderLayerBacking
+        paintContents call back. At this time we know we're painting, so we can both
+        set the FrameView's last paint time, and start up the timer. We also only
+        want to start the timer if there are pending milestones.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
+        (WebCore::RenderLayerCompositor::didPaintBacking):
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
</ins><span class="cx"> 
</span><del>-        This code introduces some helper functions for setting the size arguments of inset shapes. This change
-        also modifies the code to be the same as in Blink, so it helps us to keep the shapes code similar.
</del><ins>+2013-05-29  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+        Share FontGlyphs
+        https://bugs.webkit.org/show_bug.cgi?id=116863
</ins><span class="cx"> 
</span><del>-        * css/CSSBasicShapes.h:
-        (WebCore::CSSBasicShapeInset::updateShapeSize4Values):
-        (WebCore::CSSBasicShapeInset::updateShapeSize1Value):
-        (WebCore::CSSBasicShapeInset::updateShapeSize2Values):
-        (WebCore::CSSBasicShapeInset::updateShapeSize3Values):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseBasicShapeInset):
</del><ins>+        Reviewed by Anreas Kling.
</ins><span class="cx"> 
</span><del>-2014-04-07  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        Style system generates many Font objects that are identical or similar enough to have identical FontGlyphs. 
+        We can figure out that the FontGlyphs are going to be the same and share them. This reduces memory usage.
+        It also improves performance as the glyph cache and the width cache hang from FontGlyphs and their hit rate
+        increases.
+        
+        On PLT3 this takes the number of live FontGlyphs at the end from 40k+ to &lt;1k. Width cache hit rate improves
+        from ~42% to ~55%.
</ins><span class="cx"> 
</span><del>-        fast/css3-text/css3-text-decoration/text-decoration-thickness.html fails on GTK
-        https://bugs.webkit.org/show_bug.cgi?id=129957
</del><ins>+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::CSSFontSelector):
+        
+            Add unique id we can use in cache key.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        (WebCore::CSSFontSelector::dispatchInvalidationCallbacks):
+        
+            Bump the version number on invalidation so we don't reuse cache entries after web font is loaded.
</ins><span class="cx"> 
</span><del>-        Causes existing tests to pass.
</del><ins>+        (WebCore::CSSFontSelector::resolvesFamilyFor):
+        
+            Test if FontSelector is needed for resolving a particular FontDescription.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cairo/GraphicsContextCG.cpp: Use the now-shared computeLineBoundsAndAntialiasingModeForText.
-        * platform/graphics/cairo/GraphicsContextCairo.cpp: Align the Cairo version of text underline drawing with the CG version.
-        * platform/graphics/GraphicsContext.h: Add computeLineBoundsAndAntialiasingModeForText.
-        * platform/graphics/GraphicsContext.cpp: Ditto.
</del><ins>+        * css/CSSFontSelector.h:
+        * page/Settings.cpp:
+        (WebCore::setGenericFontFamilyMap):
+        
+            Invalidate the cache if standard font settings change.
</ins><span class="cx"> 
</span><del>-2014-04-07  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        * platform/graphics/Font.cpp:
+        (FontGlyphsCacheKey):
+        (FontGlyphsCacheEntry):
+        (WebCore::operator==):
+        (WebCore::fontGlyphsCache):
+        (WebCore::invalidateFontGlyphsCache):
+        (WebCore::makeFontSelectorFlags):
+        (WebCore::makeFontGlyphsCacheKey):
+        
+            The cache key consists of
+            
+            - all families.
+            - shared key with the lower level FontData cache (FontCache), guaranteeing FontDatas would be identical.
+            - font selector specific keys.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r163194-r163227): Garbage tiles in overflow of RTL page with 
-        background image
-        https://bugs.webkit.org/show_bug.cgi?id=131323
-        -and corresponding-
-        &lt;rdar://problem/16402013&gt;
</del><ins>+            These guarantee the FontData will be identical.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        (WebCore::computeFontGlyphsCacheHash):
+        (WebCore::pruneUnreferencedFromFontGlyphsCache):
+        
+            Don't accumulate unused entries.
</ins><span class="cx"> 
</span><del>-        Returning the TiledBacking::bounds() for the 
-        FrameView::extendedBackgroundRectForPainting() in convenient for ltr pages, but it 
-        is simply incorrect in rtl. There is no easy way to map the rect into the right 
-        coordinate space, so this patch re-works the code to use computations in 
-        RenderView to get the right rect.
</del><ins>+        (WebCore::retrieveOrAddCachedFontGlyphs):
+        (WebCore::Font::update):
+        * platform/graphics/Font.h:
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (FontPlatformDataCacheKey):
+        (WebCore::computeHash):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        (WebCore::FontCache::purgeInactiveFontData):
+        (WebCore::FontCache::invalidate):
+        * platform/graphics/FontCache.h:
+        (WebCore::FontDescriptionFontDataCacheKey::FontDescriptionFontDataCacheKey):
+        (WebCore::FontDescriptionFontDataCacheKey::makeFlagKey):
+        (WebCore::FontDescriptionFontDataCacheKey::operator==):
+        (WebCore::FontDescriptionFontDataCacheKey::operator!=):
+        (WebCore::FontDescriptionFontDataCacheKey::computeHash):
+        
+            Separate part of the key for sharing.
</ins><span class="cx"> 
</span><del>-        Call RenderView::unextendedBackgroundRect() and expand and move it based on the 
-        TiledBacking’s margins.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::extendedBackgroundRectForPainting):
</del><ins>+        (FontDescriptionFontDataCacheKey):
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontGlyphs::FontGlyphs):
+        (WebCore::FontGlyphs::releaseFontData):
+        * platform/graphics/FontFallbackList.h:
+        (WebCore::FontGlyphs::create):
+        (WebCore::FontGlyphs::~FontGlyphs):
+        
+            Remove invalidate(). If FontGlyphs needs invalidation it is reconstructed.
</ins><span class="cx"> 
</span><del>-        The logic that used to be in backgroundRect() has been moved to 
-        unextendedBackgroundRect(). 
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::unextendedBackgroundRect):
-        (WebCore::RenderView::backgroundRect):
-        * rendering/RenderView.h:
</del><ins>+        * platform/graphics/FontSelector.h:
</ins><span class="cx"> 
</span><del>-2014-04-07  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+2013-05-29  Nico Weber  &lt;thakis@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] inset complex calc() args vanish in serialized computed style
-        https://bugs.webkit.org/show_bug.cgi?id=129838
</del><ins>+        Remove unused file PlatformGestureEvent.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=116894
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        We didn't pass the style parameter when setting the width members of CSSBasicShapeInset,
-        which lead to a 'should never reach asserttion' in CSSPrimitiveValue::init. This patch
-        adds the missing parameters to the call sites.
</del><ins>+        This was added in https://bugs.webkit.org/show_bug.cgi?id=49345 but
+        not removed in https://bugs.webkit.org/show_bug.cgi?id=77492 which
+        removed most of that code again.
+        
+        * platform/PlatformGestureRecognizer.cpp: Removed.
</ins><span class="cx"> 
</span><del>-        Extended existing parsing test script.
</del><ins>+2013-05-29  Víctor Manuel Jáquez Leal  &lt;vjaquez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/BasicShapeFunctions.cpp:
-        (WebCore::valueForBasicShape):
</del><ins>+        [texmap][GStreamer][GTK] Composited Video support
+        https://bugs.webkit.org/show_bug.cgi?id=86410
</ins><span class="cx"> 
</span><del>-2014-04-07  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-        [iOS] MediaDocument should allow autoplay
-        https://bugs.webkit.org/show_bug.cgi?id=131301
</del><ins>+        Enable the video accelerated compositing using the WebKit's
+        TextureMapper.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        This patch does not use hardware accelerated video decoding. It
+        provides a generic path for system memory buffers.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement): Don't add the RequireUserGestureForRateChange
-            behavior restriction when in a MediaDocument.
</del><ins>+        This new functionality is only available when the coordinated graphics
+        system is not used.
</ins><span class="cx"> 
</span><del>-2014-04-07  Hyowon Kim  &lt;hw1008.kim@samsung.com&gt;
</del><ins>+        No new tests, already covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Move to using std::unique_ptr for opengl, texmap, transforms and efl in WebCore/platform/graphics.
-        https://bugs.webkit.org/show_bug.cgi?id=131276
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
+        (WebCore):
+        (WebCore::MediaPlayerPrivateGStreamerBase::updateTexture): update the
+        texture content with the new received video buffer.
+        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint): choose to
+        use the accelerated compositing or the normal code path
+        (WebCore::MediaPlayerPrivateGStreamerBase::paint): if accelerated
+        compositing is used this method is halted.
+        (WebCore::MediaPlayerPrivateGStreamerBase::paintToTextureMapper): get
+        a texture from the pool and draws it if it is already available.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
+        (MediaPlayerPrivateGStreamerBase):
+        (WebCore::MediaPlayerPrivateGStreamerBase::platformLayer): returns itself
+        (WebCore::MediaPlayerPrivateGStreamerBase::supportsAcceleratedRendering):
+        returns true
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-05-29  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr in code under WebCore/platform/graphics/
-        opengl, texmap, transforms and efl with std::unique_ptr.
</del><ins>+        [Qt] Missing files from build after r150853
+        https://bugs.webkit.org/show_bug.cgi?id=116932
</ins><span class="cx"> 
</span><del>-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::initializeNewContext):
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/GraphicsContext3DPrivate.cpp:
-        (WebCore::GraphicsContext3DPrivate::create): Deleted.
-        * platform/graphics/GraphicsContext3DPrivate.h:
-        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-        (WebCore::GraphicsContext3D::setContextLostCallback):
-        (WebCore::GraphicsContext3D::setErrorMessageCallback):
-        * platform/graphics/efl/EvasGLContext.h:
-        * platform/graphics/efl/EvasGLSurface.h:
-        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
-        (WebCore::GraphicsContext3D::setContextLostCallback):
-        (WebCore::GraphicsContext3D::setErrorMessageCallback):
-        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
-        (WebCore::GraphicsContext3DPrivate::create):
-        (WebCore::GraphicsContext3DPrivate::setContextLostCallback):
-        * platform/graphics/efl/GraphicsContext3DPrivate.h:
-        * platform/graphics/mac/GraphicsContext3DMac.mm:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-        (WebCore::GraphicsContext3D::setContextLostCallback):
-        (WebCore::GraphicsContext3D::setErrorMessageCallback):
-        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
-        (WebCore::Extensions3DOpenGLES::setEXTContextLostCallback):
-        * platform/graphics/opengl/Extensions3DOpenGLES.h:
-        * platform/graphics/opengl/GLPlatformContext.cpp:
-        (WebCore::createOffScreenContext):
-        (WebCore::GLPlatformContext::createContext):
-        * platform/graphics/opengl/GLPlatformContext.h:
-        * platform/graphics/opengl/GLPlatformSurface.cpp:
-        (WebCore::GLPlatformSurface::createOffScreenSurface):
-        * platform/graphics/opengl/GLPlatformSurface.h:
-        * platform/graphics/surfaces/efl/GraphicsSurfaceCommon.cpp:
-        * platform/graphics/surfaces/egl/EGLSurface.cpp:
-        (WebCore::EGLOffScreenSurface::createOffScreenSurface):
-        * platform/graphics/surfaces/egl/EGLSurface.h:
-        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
-        (WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
-        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
-        * platform/graphics/texmap/TextureMapper.cpp:
-        (WebCore::TextureMapper::create):
-        (WebCore::TextureMapper::TextureMapper):
-        * platform/graphics/texmap/TextureMapper.h:
-        (WebCore::TextureMapper::platformCreateAccelerated):
-        * platform/graphics/texmap/TextureMapperGL.cpp:
-        (WebCore::TextureMapper::platformCreateAccelerated):
-        * platform/graphics/texmap/TextureMapperGL.h:
-        (WebCore::TextureMapperGL::create): Deleted.
-        * platform/graphics/texmap/TextureMapperImageBuffer.h:
-        (WebCore::TextureMapperImageBuffer::TextureMapperImageBuffer):
-        (WebCore::TextureMapperImageBuffer::create): Deleted.
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
-        (WebCore::CoordinatedGraphicsScene::purgeGLResources):
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.h:
-        * platform/graphics/transforms/TransformState.cpp:
-        (WebCore::TransformState::operator=):
-        (WebCore::TransformState::applyTransform):
-        * platform/graphics/transforms/TransformState.h:
-        * platform/graphics/win/GraphicsContext3DWin.cpp:
-        (WebCore::GraphicsContext3D::GraphicsContext3D):
-        (WebCore::GraphicsContext3D::setContextLostCallback):
-        (WebCore::GraphicsContext3D::setErrorMessageCallback):
</del><ins>+        Reviewed by Csaba Osztrogonác.
</ins><span class="cx"> 
</span><del>-2014-04-07  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        * Target.pri: Added missing include path.
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Make back-buffers purgeable when possible
-        https://bugs.webkit.org/show_bug.cgi?id=131213
-        &lt;rdar://problem/15373906&gt;
</del><ins>+2013-05-29  Mihai Maerean  &lt;mmaerean@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        [CSS Regions] Content that has overflow: scroll cannot be scrolled by dragging the scroll thumbs with the mouse
+        https://bugs.webkit.org/show_bug.cgi?id=113703
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/cg/IOSurfacePool.cpp:
-        (WebCore::IOSurfacePool::takeSurface):
-        (WebCore::IOSurfacePool::markOlderSurfacesPurgeable):
-        (WebCore::IOSurfacePool::showPoolStatistics):
-        * platform/graphics/cocoa/IOSurface.h:
-        * platform/graphics/cocoa/IOSurface.mm:
-        (IOSurface::isVolatile):
-        (IOSurface::setIsVolatile):
-        Rename purgeability functions to match the system
-        and reduce confusion between purgeable memory
-        and volatile vs. non-volatile memory.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-04-07  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        The point inside a box that's inside a region has its coordinates relative to the region, not the FlowThread
+        that is its container in the RenderObject tree.
</ins><span class="cx"> 
</span><del>-        Split CSS Selectors pseudo class and pseudo elements
-        https://bugs.webkit.org/show_bug.cgi?id=131295
</del><ins>+        Previously, the coordinates were computed relatively to the FlowThread which doesn't really have a location in
+        the page.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Tests: fast/regions/drag-scrollbars-of-content.html
+               fast/regions/hover-in-second-region.html
</ins><span class="cx"> 
</span><del>-        Split pseudo class and pseudo element to make it clearer what pseudo types
-        are possible for a given match type.
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
</ins><span class="cx"> 
</span><del>-        Pseudo Element types are separated and Pseudo Class are left in place. The Pseudo Class
-        will have to be renamed too but that will be done separately to make this change smaller.
</del><ins>+2013-05-29  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSGrammar.y.in:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::rewriteSpecifiersWithElementName):
-        (WebCore::CSSParser::rewriteSpecifiers):
-        Use a method isPseudoElementCueFunction() to abstract the #ifdef out of the parser.
</del><ins>+        Fix dumb typo in r150879.
</ins><span class="cx"> 
</span><del>-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserSelector::parsePseudoElementSelector):
</del><ins>+        * editing/htmlediting.cpp:
+        (WebCore::nextLeafNode):
</ins><span class="cx"> 
</span><del>-        (WebCore::CSSParserSelector::parsePseudoElementCueFunctionSelector):
-        Rename to specify this is for the pseudo element cue function, not the pseudo element cue.
</del><ins>+2013-05-29  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):
-        (WebCore::CSSParserSelector::parsePseudoCueFunctionSelector): Deleted.
-        * css/CSSParserValues.h:
-        (WebCore::CSSParserSelector::isPseudoElementCueFunction):
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::specificityForOneSelector):
-        (WebCore::CSSSelector::pseudoId):
-        (WebCore::CSSSelector::parsePseudoElementType):
-        (WebCore::CSSSelector::operator==):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::pseudoType):
-        (WebCore::CSSSelector::setPseudoElementType):
-        (WebCore::CSSSelector::pseudoElementType):
-        (WebCore::CSSSelector::isUnknownPseudoElement):
-        (WebCore::CSSSelector::isCustomPseudoElement):
-        (WebCore::pseudoClassIsRelativeToSiblings):
-        (WebCore::CSSSelector::isSiblingSelector):
-        * css/RuleFeature.cpp:
-        (WebCore::RuleFeatureSet::collectFeaturesFromSelector):
-        * css/RuleSet.cpp:
-        (WebCore::determinePropertyWhitelistType):
-        (WebCore::RuleSet::findBestRuleSetAndAdd):
-        * css/SelectorChecker.cpp:
-        (WebCore::SelectorChecker::matchRecursively):
-        (WebCore::SelectorChecker::checkOne):
-        (WebCore::SelectorChecker::checkScrollbarPseudoClass):
-        (WebCore::SelectorChecker::determineLinkMatchType):
-        * css/SelectorPseudoClassAndCompatibilityElementMap.in:
-        * css/SelectorPseudoElementTypeMap.in:
-        * css/SelectorPseudoTypeMap.h:
-        * css/makeSelectorPseudoClassAndCompatibilityElementMap.py:
-        * css/makeSelectorPseudoElementsMap.py:
-        (enumerablePseudoType):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::getMatchedCSSRules):
</del><ins>+        Move leaf Node traversal helpers to htmlediting.cpp
+        &lt;http://webkit.org/b/116940&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyleConstants.h:
-        All the fullscreen pseudo types are pseudo class selectors. They should not have a pseudo ID.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-04-07  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+        Move Node::previousLeafNode() and Node::nextLeafNode() to htmlediting.cpp along with their helpers.
+        Fixes an 8-year old FIXME. \o/
</ins><span class="cx"> 
</span><del>-        Web Replay: detect possible replay divergence from unexpected DOM event dispatches
-        https://bugs.webkit.org/show_bug.cgi?id=131193
</del><ins>+        * dom/Node.h:
+        * dom/Node.cpp:
+        * dom/Position.cpp:
+        (WebCore::nextRenderedEditable):
+        (WebCore::previousRenderedEditable):
+        * editing/VisibleUnits.cpp:
+        (WebCore::previousLeafWithSameEditability):
+        (WebCore::nextLeafWithSameEditability):
+        * editing/htmlediting.h:
+        * editing/htmlediting.cpp:
+        (WebCore::previousNodeConsideringAtomicNodes):
+        (WebCore::nextNodeConsideringAtomicNodes):
+        (WebCore::previousLeafNode):
+        (WebCore::nextLeafNode):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-05-29  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Add assertions to catch potential nondeterministic behavior.
</del><ins>+        [Qt] Missing files from build after r150853
+        https://bugs.webkit.org/show_bug.cgi?id=116932
</ins><span class="cx"> 
</span><del>-        The assertion added by this patch catches dispatched DOM events
-        that are triggered by nondeterministic event loop cycles. If we
-        did not capture an event loop input in the current event loop
-        cycle nor are we manually simulating an event loop input during
-        playback, then DOM events fired during the unordered cycle could
-        run JavaScript and diverge the execution.
</del><ins>+        Reviewed by Csaba Osztrogonác.
</ins><span class="cx"> 
</span><del>-        During playback, we can assert that EventLoopInputDispatcher is dispatching
-        when a DOM event is be dispatched to a document that is being replayed.
</del><ins>+        * Target.pri: Added the CFURLExtras.{cpp,h} files to the projectfile.
</ins><span class="cx"> 
</span><del>-        During capturing, event loop inputs are captured rather than
-        dispatched, so we add some accounting to track what caused a DOM
-        event. To approximate the extent of computation triggered by an
-        event loop input, we add RAII helpers to call sites where event
-        loop inputs are captured.
</del><ins>+2013-05-29  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        The assertions are disabled by default until the most common
-        sources of nondeterminism are handled and playback errors are
-        gracefully surfaced to the user. &lt;https://webkit.org/b/131279&gt;
</del><ins>+        PresentationAttributeCacheCleaner::m_hitCount is never initialized
+        https://bugs.webkit.org/show_bug.cgi?id=116946
</ins><span class="cx"> 
</span><del>-        No new tests. This patch adds extra assertions for debugging purposes.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * inspector/InspectorInstrumentation.cpp: Notify ReplayAgent of dispatched DOM event.
-        (WebCore::InspectorInstrumentation::willDispatchEventImpl):
-        (WebCore::InspectorInstrumentation::willDispatchEventOnWindowImpl):
-        * inspector/InspectorReplayAgent.cpp: Forward dispatched DOM events to ReplayController.
-        (WebCore::InspectorReplayAgent::willDispatchEvent): Added.
-        * inspector/InspectorReplayAgent.h:
-        * replay/CapturingInputCursor.cpp:
-        (WebCore::CapturingInputCursor::CapturingInputCursor):
-        (WebCore::CapturingInputCursor::setWithinEventLoopInputExtent): Added.
-        * replay/CapturingInputCursor.h:
-        * replay/EventLoopInput.cpp: Added.
-        (WebCore::EventLoopInputExtent::EventLoopInputExtent): Added.
-        (WebCore::EventLoopInputExtent::~EventLoopInputExtent): Added.
-        * replay/EventLoopInput.h:
-        * replay/EventLoopInputDispatcher.h:
-        (WebCore::EventLoopInputDispatcher::isDispatching): Add a getter.
-        * replay/ReplayController.cpp:
-        (WebCore::logDispatchedDOMEvent): Added. This is useful for understanding script-visible events.
-        (WebCore::ReplayController::willDispatchEvent): Added.
-        * replay/ReplayController.h:
-        * replay/UserInputBridge.cpp: Add extent helpers to call sites that capture inputs.
-        (WebCore::UserInputBridge::handleMousePressEvent):
-        (WebCore::UserInputBridge::handleMouseReleaseEvent):
-        (WebCore::UserInputBridge::handleMouseMoveEvent):
-        (WebCore::UserInputBridge::handleMouseMoveOnScrollbarEvent):
-        (WebCore::UserInputBridge::handleKeyEvent):
-        (WebCore::UserInputBridge::handleWheelEvent):
-        (WebCore::UserInputBridge::scrollRecursively):
-        (WebCore::UserInputBridge::logicalScrollRecursively):
-
-2014-04-07  Timothy Hatcher  &lt;timothy@apple.com&gt;
-
-        Remove copy of combine-javascript-resources.pl that isn't used anymore
-        https://bugs.webkit.org/show_bug.cgi?id=131307
-
-        Reviewed by Joseph Pecoraro.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * inspector/combine-javascript-resources.pl: Removed.
-
-2014-04-07  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
-
-        [CSS Shapes] Clean up invalid FIXME
-        https://bugs.webkit.org/show_bug.cgi?id=131304
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/70be7ddc41141ef6dec7795d37842c27dab2e194.
</ins><span class="cx"> 
</span><del>-        * page/animation/CSSPropertyAnimation.cpp:
-        (WebCore::blendFunc):
</del><ins>+        * dom/StyledElement.cpp:
+        (WebCore::PresentationAttributeCacheCleaner::PresentationAttributeCacheCleaner):
</ins><span class="cx"> 
</span><del>-2014-04-07  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+2013-05-29  Kent Tamura  &lt;tkent@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        [EFL] Turn on ENABLE_MEDIA_CONTROLS_SCRIPT
-        https://bugs.webkit.org/show_bug.cgi?id=131257
</del><ins>+        Remove ENABLE_INPUT_MULTIPLE_FIELDS_UI.
+        https://bugs.webkit.org/show_bug.cgi?id=116796
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        no new tests. just rebased exisiting tests.
</del><ins>+        This feature was used only by Chromium port.
</ins><span class="cx"> 
</span><del>-        * PlatformEfl.cmake: Added the media controls script associated files.
-        * css/mediaControlsEfl.css: Removed.
-        * css/mediaControlsEflFullscreen.css: Removed.
-        * platform/efl/DefaultTheme/CMakeLists.txt:
-        * platform/efl/DefaultTheme/default.edc:
-        * platform/efl/DefaultTheme/widget/mediacontrol/fullscreenbutton/enterfullscreenbutton.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/fullscreenbutton/exitfullscreenbutton.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/fullscreenbutton/fullscreen_button.edc: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/mutebutton/mute_button.edc: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/mutebutton/mutebutton.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/mutebutton/unmutebutton.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/playpausebutton/pausebutton.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playbutton.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playpause_button.edc: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackwardbutton.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforward_button.edc: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforwardbutton.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/togglecaptionsbutton/closedcaption.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/togglecaptionsbutton/closedcaption_disabled.png: Removed.
-        * platform/efl/DefaultTheme/widget/mediacontrol/togglecaptionsbutton/toggle_captions_button.edc: Removed.
-        * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::toEdjeGroup):
-        (WebCore::RenderThemeEfl::RenderThemeEfl):
-        (WebCore::RenderThemeEfl::adjustSliderThumbSize):
-        (WebCore::RenderThemeEfl::mediaControlsStyleSheet): Modified to load bundle style sheet.
-        (WebCore::RenderThemeEfl::mediaControlsScript): Added to load bundle scripts.
-        (WebCore::RenderThemeEfl::emitMediaButtonSignal): Deleted.
-        (WebCore::RenderThemeEfl::extraMediaControlsStyleSheet): Deleted.
-        (WebCore::RenderThemeEfl::extraFullScreenStyleSheet): Deleted.
-        (WebCore::RenderThemeEfl::formatMediaControlsCurrentTime): Deleted.
-        (WebCore::RenderThemeEfl::hasOwnDisabledStateHandlingFor): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaFullscreenButton): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaMuteButton): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaPlayButton): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaSeekBackButton): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaSeekForwardButton): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaSliderTrack): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaSliderThumb): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaVolumeSliderContainer): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaVolumeSliderTrack): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaVolumeSliderThumb): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaCurrentTime): Deleted.
-        (WebCore::RenderThemeEfl::supportsClosedCaptioning): Deleted.
-        (WebCore::RenderThemeEfl::paintMediaToggleClosedCaptionsButton): Deleted.
-        * platform/efl/RenderThemeEfl.h:
-
-2014-04-07  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        CSS JIT: change the node flags directly instead of using function calls when possible
-        https://bugs.webkit.org/show_bug.cgi?id=131292
-
-        Reviewed by Andreas Kling.
-
-        For historical reasons, changing the node flags was always done with function calls.
-        This patch changes those calls to modify the nodes directly.
-
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
-        (WebCore::SelectorCompiler::setNodeFlag):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::markParentElementIfResolvingStyle):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsFirstChild):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsLastChild):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsOnlyChild):
-        (WebCore::SelectorCompiler::markElementWithSetChildrenAffectedByLastChildRules): Deleted.
-        (WebCore::SelectorCompiler::markElementWithSetChildrenAffectedByFirstChildAndLastChildRules): Deleted.
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/html.css:
+        (input::-webkit-date-and-time-value):
</ins><span class="cx">         * dom/Element.cpp:
</span><del>-        (WebCore::Element::setChildrenAffectedByFirstChildRules): Deleted.
-        (WebCore::Element::setChildrenAffectedByDirectAdjacentRules): Deleted.
</del><span class="cx">         * dom/Element.h:
</span><del>-        * dom/Node.h:
-        (WebCore::Node::flagChildrenAffectedByFirstChildRulesFlag):
-        (WebCore::Node::flagChildrenAffectedByLastChildRulesFlag):
-        (WebCore::Node::flagChildrenAffectedByDirectAdjacentRulesFlag):
</del><ins>+        * html/BaseChooserOnlyDateAndTimeInputType.cpp:
+        * html/BaseChooserOnlyDateAndTimeInputType.h:
+        * html/BaseMultipleFieldsDateAndTimeInputType.cpp: Removed.
+        * html/BaseMultipleFieldsDateAndTimeInputType.h: Removed.
+        * html/DateInputType.cpp:
+        * html/DateInputType.h:
+        (DateInputType):
+        * html/DateTimeFieldsState.cpp: Removed.
+        * html/DateTimeFieldsState.h: Removed.
+        * html/DateTimeInputType.cpp:
+        * html/DateTimeInputType.h:
+        (DateTimeInputType):
+        * html/DateTimeLocalInputType.cpp:
+        * html/DateTimeLocalInputType.h:
+        (DateTimeLocalInputType):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/InputType.cpp:
+        * html/InputType.h:
+        (InputType):
+        * html/MonthInputType.cpp:
+        * html/MonthInputType.h:
+        (MonthInputType):
+        * html/TimeInputType.cpp:
+        * html/TimeInputType.h:
+        (TimeInputType):
+        * html/WeekInputType.cpp:
+        * html/WeekInputType.h:
+        (WeekInputType):
+        * html/shadow/ClearButtonElement.cpp: Removed.
+        * html/shadow/ClearButtonElement.h: Removed.
+        * html/shadow/DateTimeEditElement.cpp: Removed.
+        * html/shadow/DateTimeEditElement.h: Removed.
+        * html/shadow/DateTimeFieldElement.cpp: Removed.
+        * html/shadow/DateTimeFieldElement.h: Removed.
+        * html/shadow/DateTimeFieldElements.cpp: Removed.
+        * html/shadow/DateTimeFieldElements.h: Removed.
+        * html/shadow/DateTimeNumericFieldElement.cpp: Removed.
+        * html/shadow/DateTimeNumericFieldElement.h: Removed.
+        * html/shadow/DateTimeSymbolicFieldElement.cpp: Removed.
+        * html/shadow/DateTimeSymbolicFieldElement.h: Removed.
+        * html/shadow/PickerIndicatorElement.cpp: Removed.
+        * html/shadow/PickerIndicatorElement.h: Removed.
+        * page/ChromeClient.h:
+        (ChromeClient):
+        * platform/LocalizedStrings.h:
+        (WebCore):
+        * platform/text/PlatformLocale.cpp:
+        * platform/text/PlatformLocale.h:
+        (Locale):
+        * rendering/RenderDetailsMarker.cpp:
+        * rendering/RenderDetailsMarker.h:
+        * rendering/RenderObject.h:
+        (RenderObject):
</ins><span class="cx"> 
</span><del>-2014-04-07  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+2013-05-29  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Remove unused header from PlatformSpeechSynthesizer.h
-        https://bugs.webkit.org/show_bug.cgi?id=131103
</del><ins>+        Remove setFullScreenRendererSize and setFullScreenRendererBackgroundColor
+        https://bugs.webkit.org/show_bug.cgi?id=116914
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Since WebSpeech has switched to use std::unique_ptr, we do not need to include PassOwnPtr.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/508eb21a07f69ed38b9be9ff92fe75dcb907861f
</ins><span class="cx"> 
</span><del>-        No new tests. No behaviour change, just quick fix.
</del><ins>+        * dom/Document.cpp:
+        * dom/Document.h:
</ins><span class="cx"> 
</span><del>-        * platform/PlatformSpeechSynthesizer.h:
</del><ins>+2013-05-29  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-06  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        Make WidgetHierarchyUpdatesSuspensionScope use swap instead of copy
+        https://bugs.webkit.org/show_bug.cgi?id=116927
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Use RenderRegion::isValid() before using a region
-        https://bugs.webkit.org/show_bug.cgi?id=131232
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        RenderRegion method isValid() should be used to test whether a region
-        is good to use instead of a mix between isValid() and flowThread().
-        When the region is designed to fragment content from a parent flow thread,
-        the m_flowThread is not nullified anymore, thus ensuring the same treatment for all invalid
-        regions.
-        Covered by existing regions tests.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/1d577e1fd5c5716a06e4007e04fc3d9d0a88f5e4
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorOverlay.cpp:
-        (WebCore::buildObjectForElementInfo):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::layoutOverflowRectForPropagation):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::pageLogicalHeight):
-        (WebCore::RenderNamedFlowFragment::maxPageLogicalHeight):
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::getRanges):
-        (WebCore::RenderNamedFlowThread::clearRenderObjectCustomStyle):
-        (WebCore::RenderNamedFlowThread::checkRegionsWithStyling):
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::RenderRegion):
-        (WebCore::RenderRegion::positionForPoint):
-        (WebCore::RenderRegion::pageLogicalWidth):
-        (WebCore::RenderRegion::pageLogicalHeight):
-        (WebCore::RenderRegion::styleDidChange):
-        (WebCore::RenderRegion::installFlowThread):
-        (WebCore::RenderRegion::attachRegion):
-        (WebCore::RenderRegion::detachRegion):
-        (WebCore::RenderRegion::ensureOverflowForBox):
-        (WebCore::RenderRegion::renderBoxRegionInfo):
</del><ins>+        This is equivalent behavior code that is unambiguously better performance. swap is O(1) time and memory,
+        copying a hash table is at least linear with the number of elements.
</ins><span class="cx"> 
</span><del>-2014-04-06  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        * rendering/RenderWidget.cpp:
+        (WebCore::WidgetHierarchyUpdatesSuspensionScope::moveWidgets):
</ins><span class="cx"> 
</span><del>-        Fix the debug bots after r166863
</del><ins>+2013-05-29  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/PageRuleCollector.cpp:
-        (WebCore::checkPageSelectorComponents): I forgot to update one call site for PagePseudoClass.
</del><ins>+        Remove Document::nodeAbsIndex() and Document::nodeWithAbsIndex().
</ins><span class="cx"> 
</span><del>-2014-04-06  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Rubber-stamped by Antti &quot;Lucky&quot; Koivisto.
</ins><span class="cx"> 
</span><del>-        Make some bindings improvements, with smaller code size for error message generation
-        https://bugs.webkit.org/show_bug.cgi?id=131285
</del><ins>+        * dom/Document.h:
+        * dom/Document.cpp:
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-05-28  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Updated to remove old and add new functions, for use by the Internals
-        JavaScript bindings.
</del><ins>+        FocusController should operate on Elements internally.
+        &lt;http://webkit.org/b/116781&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::makeDOMBindingsTypeErrorStringInternal): Deleted.
-        (WebCore::throwTypeError): Added. Helper to avoid repeating throwVMError/createTypeError.
-        (WebCore::appendArgumentMustBe): Added. Helper for building up argument error strings.
-        (WebCore::reportDeprecatedGetterError): Added. For bindings to use.
-        (WebCore::throwArgumentMustBeEnumError): Ditto.
-        (WebCore::throwArgumentMustBeFunctionError): Ditto.
-        (WebCore::throwArgumentTypeError): Ditto.
-        (WebCore::throwArrayElementTypeError): Ditto.
-        (WebCore::throwAttributeTypeError): Ditto.
-        (WebCore::throwConstructorDocumentUnavailableError): Ditto.
-        (WebCore::throwGetterTypeError): Ditto.
-        (WebCore::throwSequenceTypeError): Ditto.
-        (WebCore::throwSetterTypeError): Ditto.
-        (WebCore::throwThisTypeError): Ditto.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.h: Added declarations for new functions. Removed forward
-        declarations for things not used in this file. Use nullptr instead of 0. Format
-        templates consistently. Use a better for loop in the jsArray function. Removed
-        unused HasMemoryCostMemberFunction, makeDOMBindingsTypeErrorString, and
-        makeDOMBindingsTypeErrorStringInternal.
</del><ins>+        Switch from Node* to Element* as much as possible inside FocusController.
+        Mostly mechanical, gets rid of some unnecessary isElementNode() checks and casts.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSNavigatorCustom.cpp: Fixed a hand-written binding that was using
-        makeDOMBindingsTypeErrorString to make a string.
</del><ins>+        * page/FocusController.h:
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedElement):
+        (WebCore::isNonFocusableShadowHost):
+        (WebCore::adjustedTabIndex):
+        (WebCore::shouldVisit):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::findFocusableElementDescendingDownIntoFrameDocument):
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
+        (WebCore::FocusController::findFocusableElementAcrossFocusScope):
+        (WebCore::FocusController::findFocusableElementRecursively):
+        (WebCore::FocusController::findFocusableElement):
+        (WebCore::FocusController::nextFocusableElement):
+        (WebCore::FocusController::previousFocusableElement):
+        (WebCore::FocusController::setActive):
</ins><span class="cx"> 
</span><del>-        * bindings/js/ScriptController.h: Updated forward declarations.
</del><ins>+2013-05-29  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation): Cut down on use of UNUSED_PARAM. Use the new functions
-        for errors, keeping the code in the generated file to a minimum.
-        (GenerateParametersCheck): Ditto.
-        (GenerateConstructorDefinition): Ditto.
</del><ins>+        [CSS Regions] Mouse over an element does not trigger :hover state for parent when the element is flowed in a region
+        https://bugs.webkit.org/show_bug.cgi?id=111749
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
-        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
-        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
-        * bindings/scripts/test/JS/JSTestException.cpp:
-        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
-        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
-        * bindings/scripts/test/JS/JSTestNode.cpp:
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
-        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        * bindings/scripts/test/JS/JSattribute.cpp:
-        * bindings/scripts/test/JS/JSreadonly.cpp:
-        Updated expected results for changes above.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-04-06  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        When searching for the hover ancestor and encountering a named flow thread,
+        the search will continue with the DOM ancestor of the top-most element
+        in the named flow thread.
</ins><span class="cx"> 
</span><del>-        Move the PseudoPageClass types out of the pseudo element/class mix
-        https://bugs.webkit.org/show_bug.cgi?id=131284
</del><ins>+        Tests: fast/regions/hover-in-region-grandparent.html
+               fast/regions/hover-in-region-parent-skip.html
+               fast/regions/hover-in-region-parent-skip-inlines-anonymous.html
+               fast/regions/hover-on-child-in-region.html
+               fast/regions/hover-on-child-in-region-in-region.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::hoverAncestor):
+        * rendering/RenderObject.h:
</ins><span class="cx"> 
</span><del>-        Some more cleanup of Selector's pseudo types. This patch moves the page pseudo
-        class types into their own enumeration (PagePseudoClassType).
</del><ins>+2013-05-28  Nate Chapin  &lt;japhet@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserSelector::parsePagePseudoSelector):
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::specificityForPage):
-        (WebCore::CSSSelector::pseudoId):
-        (WebCore::CSSSelector::selectorText):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::setPagePseudoType):
-        (WebCore::CSSSelector::pagePseudoClassType):
-        * css/PageRuleCollector.cpp:
-        (WebCore::checkPageSelectorComponents):
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
</del><ins>+        Crash in WebCore::SubresourceLoader::releaseResources when connection fails
+        https://bugs.webkit.org/show_bug.cgi?id=87743
</ins><span class="cx"> 
</span><del>-2014-04-06  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        Don't do anything complicated in SubresourceLoader::releaseResources(),
+        just clear variables. With this patch, releaseResources() will still
+        assert in debug builds if it is called twice, but it will safely execute
+        in release.
</ins><span class="cx"> 
</span><del>-        CSS JIT: add support for :last-child and :only-child
-        https://bugs.webkit.org/show_bug.cgi?id=131283
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::cleanupForError): Pull shared cleanup code out of didFail()
+            and cancel() into a helper.
+        (WebCore::ResourceLoader::cancel): Merge a couple variables into an enum, check for
+            reentrancy from within didCancel().
+        * loader/ResourceLoader.h: Replace m_calledWillCancel and m_cancelled with an enum.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::didFinishLoading): Don't call ResourceLoader::didFinishLoading(),
+            put finish() in the middle of the process.
+        (WebCore::SubresourceLoader::didFail): Don't call ResourceLoader::didFail(), put finish()
+            in the middle of the process.
+        (WebCore::SubresourceLoader::didCancel):
+        (WebCore::SubresourceLoader::notifyDone): Do the non-trivial work previous done in releaseResources(),
+            most importantly calling loadDone().
+        (WebCore::SubresourceLoader::releaseResources): Only do simple variable clearing here.
+        * loader/SubresourceLoader.h:
+        (SubresourceLoader):
+        * loader/cache/CachedResource.cpp: Split stopLoading() into cancelLoad() (which notifies clients)
+            and clearLoader() (which just nulls m_loader).
+        * loader/cache/CachedResource.h:
+        * loader/chromium/ResourceLoaderChromium.cpp:
</ins><span class="cx"> 
</span><del>-        This is the straightforward implementation of :last-child and :only-child.
</del><ins>+2013-05-28  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Both are extremely similar to :first-child. There are only minor differences:
-        -:last-child has an additional check for the flag IsParsingChildrenFinished.
-        -:only-child is like :first-child + :last-child but with combined marking.
</del><ins>+        [GTK] Build fix after r150837
+        https://bugs.webkit.org/show_bug.cgi?id=116904
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::addPseudoType):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToNextAdjacentElement):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::jumpIfNoPreviousAdjacentElement):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsFirstChild):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::jumpIfNoNextAdjacentElement):
-        (WebCore::SelectorCompiler::markElementWithSetChildrenAffectedByLastChildRules):
-        (WebCore::SelectorCompiler::setLastChildState):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsLastChild):
-        (WebCore::SelectorCompiler::markElementWithSetChildrenAffectedByFirstChildAndLastChildRules):
-        (WebCore::SelectorCompiler::setOnlyChildState):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsOnlyChild):
-        * dom/Node.h:
-        (WebCore::Node::nextSiblingMemoryOffset):
-        (WebCore::Node::flagIsParsingChildrenFinished):
-        * rendering/style/RenderStyle.h:
-        Removed the unused flags, I will add them back later as needed.
</del><ins>+        Unreviewed build fix.
</ins><span class="cx"> 
</span><del>-2014-04-06  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * GNUmakefile.am:
</ins><span class="cx"> 
</span><del>-        Rework CSS calc logic, fixing some reference count mistakes in Length
-        https://bugs.webkit.org/show_bug.cgi?id=131280
-        rdar://problem/16400823
</del><ins>+2013-05-28  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><ins>+        REGRESSION (r150169): Images from file: URLs display after a delay even though they were preloaded by JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=116906
+        &lt;rdar://problem/13991927&gt;
+
</ins><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        New unit test in TestWebKitAPI.
</del><ins>+        Writing a test for this is blocked on https://webkit.org/b/116199.
</ins><span class="cx"> 
</span><del>-        Changed the classes related to CSS &quot;calc&quot; to make the code a bit easier to read by
-        moving code out of class definitions. Also used final some more, made more things private,
-        used references instead of pointers, and other such changes. Biggest change, though, is to
-        Length, which had a broken system for managing reference counted calculated objects.
-        There were multiple bugs including a basic design mistake of not having a reference count
-        and trying to use the reference count in the object itself. Fixed and covered by the unit
-        test now; test found multiple problems in both the old and new implementations.
</del><ins>+        Some WebKit clients use JavaScript to preload images from disk so that
+        subsequent loads will display immediately from the memory cache. By not
+        caching non-HTTP sub-resources in memory, we break this common pattern.
+        This change restricts r150169 to only apply to cached main resources.
+        Sub-resources will again be cached indefinitely as they were prior to
+        r150169.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Updated exports, including symbols to make the unit test practical.
</del><ins>+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::freshnessLifetime): If this is a non-HTTP
+        main resource from a scheme that should not be cached indefinitely,
+        return 0 for the freshness lifetime. For other non-HTTP cached
+        resources, return an indefinite freshness lifetime.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj: Made CalculationValue.h a Private file so it can
-        be used in a unit test. Also let Xcode update the file type for a gperf file.
</del><ins>+2013-05-28  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSCalculationValue.cpp:
-        (WebCore::CSSCalcValue::equals): Updated since m_expression is a Ref now.
-        (WebCore::CSSCalcValue::clampToPermittedRange): Marked inline and updated for data member
-        name change.
-        (WebCore::isIntegerResult): Changed argument order to put the operator first and use
-        references instead of pointers. Also marked inline.
-        (WebCore::createBlendHalf): Added. Helper to make the other functions more readable.
-        (WebCore::createExpressionNode): Made non-member function private to this file. Also made
-        many small improvements.
-        (WebCore::CSSCalcValue::create): Updated so both of these call the same constructor.
</del><ins>+        Animations do not restart after exiting page cache
+        https://bugs.webkit.org/show_bug.cgi?id=116900
</ins><span class="cx"> 
</span><del>-        * css/CSSCalculationValue.h: Cut down CSSCalcValue class by making more things private
-        and deleting unneeded things. Also use Ref instead of RefPtr.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::getPositionOffsetValue): Use isFixed function instead of type function.
</del><ins>+        Animations are suspended as they enter the page cache, but
+        were not getting correctly resumed when exiting. The cause
+        was an error in r149576 which was checking a global flag for suspension
+        on the AnimationController and thus not trying to resume anything.
</ins><span class="cx"> 
</span><del>-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::addStops): Updated code since toCalcValue now returns PassRef
-        instead of PassRefPtr. Unfortunately the new code is a bit more verbose.
-        (WebCore::positionFromValue): Ditto.
</del><ins>+        Test: animations/resume-after-page-cache.html
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseCalculation):
</del><ins>+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::suspendAnimationsForDocument):
+        (WebCore::AnimationControllerPrivate::resumeAnimationsForDocument):
</ins><span class="cx"> 
</span><del>-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated to pass reference rather than pointer.
-        (WebCore::CSSPrimitiveValue::init): Ditto.
</del><ins>+2013-05-28  Chris Rogers  &lt;crogers@google.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSToStyleMap.h: Removed unneeded include of LengthBox.h.
</del><ins>+        Support multiple HRTFDatabases for different sample-rates
+        https://bugs.webkit.org/show_bug.cgi?id=116183
</ins><span class="cx"> 
</span><del>-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyLength::applyValue): Updated for function name change.
-        (WebCore::ApplyPropertyBorderRadius::applyValue): Removed extra parentheses.
-        (WebCore::ApplyPropertyFontSize::applyValue): Ditto. Also updated since toCalcValue returns Ref.
</del><ins>+        Reviewed by Kenneth Russell.
</ins><span class="cx"> 
</span><del>-        * css/LengthFunctions.cpp:
-        (WebCore::floatValueForLength): Updated to call value instead of getFloatValue; both are the same.
</del><ins>+        Adapted from Blink:
+        https://codereview.chromium.org/14636011/
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::addIntrinsicMargins): Updated for function name change.
-        (WebCore::createGridTrackBreadth): Ditto.
</del><ins>+        This removes the limitation which required OfflineAudioContexts to be created at native sample-rate
</ins><span class="cx"> 
</span><del>-        * platform/CalculationValue.cpp:
-        (WebCore::CalculationValue::create): Changed to return PassRef.
-        (WebCore::CalcExpressionNumber::evaluate): Moved this function out of the header, since it's
-        virtual and not really going to be inlined.
-        (WebCore::CalcExpressionNumber::operator==): Ditto.
-        (WebCore::CalculationValue::evaluate): Ditto.
-        (WebCore::CalcExpressionBinaryOperation::operator==): Ditto.
-        (WebCore::CalcExpressionLength::evaluate): Ditto.
-        (WebCore::CalcExpressionLength::operator==): Ditto.
-        (WebCore::CalcExpressionBlendLength::evaluate): Ditto.
-        (WebCore::CalcExpressionBlendLength::operator==): Ditto.
</del><ins>+        * Modules/webaudio/AudioContext.h:
+        (WebCore::AudioContext::hrtfDatabaseLoader):
+        (AudioContext):
+        * Modules/webaudio/OfflineAudioContext.cpp:
+        (WebCore::OfflineAudioContext::create):
+        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::offlineRender):
+        * Modules/webaudio/PannerNode.cpp:
+        (WebCore::PannerNode::initialize):
+        (WebCore::PannerNode::setPanningModel):
+        * platform/audio/HRTFDatabaseLoader.cpp:
+        (WebCore):
+        (WebCore::HRTFDatabaseLoader::createAndLoadAsynchronouslyIfNecessary):
+        (WebCore::HRTFDatabaseLoader::~HRTFDatabaseLoader):
+        * platform/audio/HRTFDatabaseLoader.h:
+        (HRTFDatabaseLoader):
+        (WebCore::HRTFDatabaseLoader::loaderMap):
+        * platform/audio/HRTFPanner.cpp:
+        (WebCore::HRTFPanner::HRTFPanner):
+        (WebCore::HRTFPanner::calculateDesiredAzimuthIndexAndBlend):
+        (WebCore::HRTFPanner::pan):
+        * platform/audio/HRTFPanner.h:
+        (HRTFPanner):
+        * platform/audio/Panner.cpp:
+        (WebCore::Panner::create):
+        * platform/audio/Panner.h:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        * platform/CalculationValue.h: Moved most functions out of the class bodies so the classes are
-        easier to see. Made all the == operator functions non-member ones except for the polymorphic
-        one from the base class. Changed the casting functions to work on references instead of pointers.
-        Tweaked name of some members.
</del><ins>+2013-05-28  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/Length.cpp: Reworked the CalculationValueMap (formerly CalculationValueHandleMap) to
-        use unsigned instead of int, and store reference counts in the map rather than trying to share the
-        reference count of the underlying CalculationValue object, which can lead to storage leaks where
-        handles end up in the map permanently.
-        (WebCore::calculationValues): Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL.
-        (WebCore::Length::Length): Updated some data member names.
-        (WebCore::Length::calculationValue): Updated to return a reference instead of a PassRefPtr.
-        (WebCore::Length::ref): Renamed and updated for new interface to the map.
-        (WebCore::Length::deref): Ditto.
-        (WebCore::Length::nonNanCalculatedValue): Updated to use a reference instead of a pointer.
-        (WebCore::Length::isCalculatedEqual): Updated since this is now only called if both objects are
-        known to be calculated values.
</del><ins>+        Windows build fix.
</ins><span class="cx"> 
</span><del>-        * platform/Length.h: Moved most functions out of the class definition to make the class definition
-        easier to read. Reworked the constructors and assignment operators to handle the reference counting
-        correctly. Added various FIXMEs and assertions. Removed some unused functions, made others private.
</del><ins>+        * platform/cf/KURLCFNet.cpp:
+        (WebCore::KURL::createCFURL):
</ins><span class="cx"> 
</span><del>-        * platform/LengthBox.h: Renamed some one-letter arguments to use words instead.
</del><ins>+2013-05-28  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/AutoTableLayout.cpp:
-        (WebCore::AutoTableLayout::recalcColumn): Updated for change to Length::setValue.
-        * rendering/FixedTableLayout.cpp:
-        (WebCore::FixedTableLayout::calcWidthArray): Ditto.
</del><ins>+        Freeze when loading a particular page on washingtonpost.com with NetworkProcess enabled
+        https://bugs.webkit.org/show_bug.cgi?id=116887
+        &lt;rdar://problem/12965959&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/style/FillLayer.h:
-        (WebCore::FillLayer::initialFillXPosition): Updated to not convert a double to a float at runtime.
-        (WebCore::FillLayer::initialFillYPosition): Ditto.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setWordSpacing): Removed a bogus FALLTHROUGH that was clearly wrong, but
-        harmless. Updated for changes to Length.
</del><ins>+        Test: http/tests/uri/curly-braces-escaping.html
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.h: Updated for name changes and to avoid converting doubles to floats
-        at runtime.
</del><ins>+        The issue was that WebKit used an incorrect accessor to get a string out of CFURL,
+        unlike WebCore.
</ins><span class="cx"> 
</span><del>-2014-04-06  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Centralized code for converting between CFURLs and strings in a place that WebKit
+        can use directly.
</ins><span class="cx"> 
</span><del>-        Honor System-Level User Preferences for Caption Display
-        https://bugs.webkit.org/show_bug.cgi?id=131258
</del><ins>+        * WebCore.exp.in:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        Keeping things building.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * platform/KURL.cpp: (WebCore::KURL::copyToBuffer):
+        * platform/KURL.h:
+        Updated for a new typedef name. The code was using Vector&lt;char, 512&gt; and CharBuffer
+        inconsistently, and now URLs use URLCharBuffer.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::setSelectedTextTrack): Allow preferenced change to fully dispatch
-        so we can properly deal with captions being turned off.
-        (WebCore::HTMLMediaElement::captionPreferencesChanged): Use 'webkit' variant of the
-        setWebKitClosedCaptionsVisible method so we properly adjust settings needed for the JS API call.
-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): When captions are turned off, e.g.
-        because the user turned off the preference, don't inadvertently turn them back on just bacause there
-        was an existing track that was not in a 'hidden' state.
</del><ins>+        * platform/cf/CFURLExtras.cpp: Added.
+        (WebCore::createCFURLFromBuffer):
+        (WebCore::getURLBytes):
+        * platform/cf/CFURLExtras.h: Added.
+        * platform/cf/KURLCFNet.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::createCFURL):
+        Extracted code for CFURL string manipulation that is not logcally part of KURL.
</ins><span class="cx"> 
</span><del>-2014-04-06  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+        * platform/mac/KURLMac.mm:
+        (WebCore::KURL::KURL): Use the new getURLBytes function.
+        (WebCore::KURL::operator NSURL *): Added a comment.
+        (WebCore::KURL::createCFURL): Added a comment, and updated for new names and
+        signatures.
</ins><span class="cx"> 
</span><del>-        Web Replay: add methods to encode a frame's index based on its FrameTree position
-        https://bugs.webkit.org/show_bug.cgi?id=131281
</del><ins>+        * platform/network/cf/ResourceErrorCF.cpp: (WebCore::ResourceError::platformLazyInit):
+        Added a FIXME. We are still using CFURLGetString here. The difficulty is getting
+        encodings right.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+2013-05-28  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Given a frame, its encoded index is computed by traversing the frame tree
-        and saving how many nodes have been traversed to reach a given frame.
</del><ins>+        Create a html/forms subdirectory and move FileIconLoader there
+        https://bugs.webkit.org/show_bug.cgi?id=116880
</ins><span class="cx"> 
</span><del>-        This is used to disambiguate frames when dispatching frame-specific event
-        loop inputs during replay, such as timers and resource loaders.
</del><ins>+        Reviewed by Jessie Berlin.
</ins><span class="cx"> 
</span><del>-        * replay/SerializationMethods.cpp:
-        (WebCore::frameIndexFromDocument): Added.
-        (WebCore::frameIndexFromFrame): Added.
-        (WebCore::documentFromFrameIndex): Added.
-        (WebCore::frameFromFrameIndex): Added.
-        * replay/SerializationMethods.h:
</del><ins>+        A lot (if not the majority) of files in html/ are forms related, so it makes sense to begin splitting
+        them out into a separate subdirectory, html/forms.
</ins><span class="cx"> 
</span><del>-2014-04-06  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Begin my moving FileIconLoader from platform to html/forms. It is related to HTML forms (it's only used by
+        the file upload element), and is not really a platform abstraction so it doesn't belong in platform.
</ins><span class="cx"> 
</span><del>-        iOS build fix.
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/forms/FileIconLoader.cpp: Renamed from Source/WebCore/platform/FileIconLoader.cpp.
+        * html/forms/FileIconLoader.h: Renamed from Source/WebCore/platform/FileIconLoader.h.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Move newly exported function to a right section of this file.
</del><ins>+2013-05-28  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-06  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        AX: WKView is unable to set AXFocused to YES and does not handle keyboard events as expected
+        https://bugs.webkit.org/show_bug.cgi?id=116756
</ins><span class="cx"> 
</span><del>-        Refactor post-attach and HTMLObjectElement-related code
-        https://bugs.webkit.org/show_bug.cgi?id=131282
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        If AXFocused is set to true, but the WebView is not the first responder, then the call will
+        not do anything. This change asks the Chrome to make the WebView the first responder before
+        trying to set focus within the page.
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp: Moved the post-attach callback code from here to
-        StyleResolveTree.h/cpp.
-        * dom/ContainerNode.h: Ditto.
</del><ins>+        Was not able to make a test, it requires on interplay between areas outside the web view.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle): Use Style::PostResolutionCallbackDisabler instead of
-        PostAttachCallbackDisabler.
</del><ins>+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+        (-[WebAccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
</ins><span class="cx"> 
</span><del>-        * dom/Element.h: Moved the post-attach callback code from here to StyleResolveTree.h/cpp.
</del><ins>+2013-05-28  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseAttribute): Simplified the code for typeAttr, turning
-        it into a 1-liner. Added a FIXME in codeAttr about the fact that it does not have the
-        code to trigger image loads.
</del><ins>+        Crash in DumpRenderTree at com.apple.WebCore: WebCore::RenderTextTrackCue::repositionGenericCue + 154
+        https://bugs.webkit.org/show_bug.cgi?id=116882
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::didAttachRenderers): Updated to use
-        Style::queuePostResolutionCallback and use a lambda instead of a function.
-        (WebCore::HTMLFormControlElement::didRecalcStyle): Ditto. Also added RefPtr instead
-        of just using wishful thinking to keep the object alive.
-        * html/HTMLFrameOwnerElement.cpp:
-        (WebCore::HTMLFrameOwnerElement::scheduleSetNeedsStyleRecalc): Ditto.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseAttribute):: Simplified the code for typeAttr, turning
-        it into a 1-liner. Made dataAttr call setNeedsWidgetUpdate(true) unconditionally after
-        checking carefully to see that's harmless if there is no renderer. Changed classidAttr
-        to call setNeedsWidgetUpdate(true) unconditionally and not set m_classId.
-        (WebCore::HTMLObjectElement::shouldAllowQuickTimeClassIdQuirk): Use fastGetAttribute
-        instead of classId and descendantsOfType instead of getElementsByTagName.
-        (WebCore::HTMLObjectElement::hasValidClassId): Use fastGetAttribute instead of classId.
-        (WebCore::HTMLObjectElement::renderFallbackContent): Use imageLoader instead of m_imageLoader.
</del><ins>+        Remove an inappropriate assert. No cues coming through repositionGenericCue will be WebVTT ones.
</ins><span class="cx"> 
</span><del>-        * html/HTMLObjectElement.h: Removed classId, since there is no reason to cache that
-        attribute in a data member. Rearranged header, making more private, and fixing some typos,
-        and doing a &quot;using&quot; instead of a function to disambiguate the inherited form functions.
</del><ins>+        * rendering/RenderTextTrackCue.cpp:
+        (WebCore::RenderTextTrackCue::repositionGenericCue):
</ins><span class="cx"> 
</span><del>-        * html/HTMLPlugInImageElement.cpp:
-        (WebCore::HTMLPlugInImageElement::createElementRenderer): Fixed some code that assumed the
-        first child of the shadow root is guaranteed to be an element.
-        (WebCore::HTMLPlugInImageElement::didMoveToNewDocument): Removed null check on oldDocument,
-        since m_needsDocumentActivationCallbacks can't be true if the old document was null.
-        (WebCore::is100Percent): Added helper to make function below more readable.
-        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Restructured the code a
-        bit. The part that attracted my attention was the local variable of type RenderBox, which
-        was named renderEmbeddedObject. Turns out the caller guarantees to only call this if there
-        is a renderer of type RenderEmbeddedObject, so depend on that.
</del><ins>+2013-05-28  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLPlugInImageElement.h: Trimmed includes a bit. Made more members private.
-        Marked more function members final. Made a protected imageLoader function so that
-        m_imageLoader can be private eventually. Made m_imageLoader be std::unique_ptr.
</del><ins>+        [BlackBerry] GraphicsContext: add missing definitions.
+        https://bugs.webkit.org/show_bug.cgi?id=115515
</ins><span class="cx"> 
</span><del>-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::needsPseudoElement): Fixed spelling error in the name of this function.
-        (WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded): Updated for name change.
-        (WebCore::Style::attachRenderTree): Update for new name of PostResolutionCallbackDisabler.
-        (WebCore::Style::updateBeforeOrAfterPseudoElement): Updated for name change.
-        (WebCore::Style::postResolutionCallbackQueue): Added.
-        (WebCore::Style::queuePostResolutionCallback): Added.
-        (WebCore::Style::suspendMemoryCacheClientCalls): Added. This is a side effect of the original
-        PostAttachCallbackDisabler that is now done in a cleaner way, using the callback queue, instead
-        of as a special case. It should not work for multiple documents across multiple pages instead of
-        only the outermost one.
-        (WebCore::Style::PostResolutionCallbackDisabler::PostResolutionCallbackDisabler): Added.
-        Calls suspendMemoryCacheClientCalls, but a FIXME tries to point out why that isn't so great.
-        (WebCore::Style::PostResolutionCallbackDisabler::~PostResolutionCallbackDisabler): Added.
-        (WebCore::Style::postResolutionCallbacksAreSuspended): Added.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        * style/StyleResolveTree.h: Added queuePostResolutionCallback and
-        postResolutionCallbacksAreSuspended. Also added PostResolutionCallbackDisabler, which should
-        eventually become a private implementation detail.
</del><ins>+        * platform/graphics/GraphicsContext.h:
+        (Graphics):
+        Add definition for PlatformGraphicsContext.
+        * platform/graphics/blackberry/GraphicsContextBlackBerry.cpp:
+        Include RoundedRect.h
</ins><span class="cx"> 
</span><del>-2014-04-04  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+2013-05-28  Arvid Nilsson  &lt;anilsson@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Enable WEB_REPLAY for PLATFORM(MAC)
-        https://bugs.webkit.org/show_bug.cgi?id=130700
</del><ins>+        [BlackBerry] Fix style issues in BlackBerry accelerated compositing backend
+        https://bugs.webkit.org/show_bug.cgi?id=116604
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        Switch on WEB_REPLAY feature flag for non-production builds.
</del><ins>+        PR 273550, 99638
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * replay/ReplayInputDispatchMethods.cpp: Fix the ENABLE(WEB_REPLAY) build.
-        It was broken by the bool to enum refactoring in r166684.
-        (WebCore::InitialNavigation::dispatch):
</del><ins>+        Remove the &quot;get&quot; prefix from getters in the WebKit- and compositing-
+        thread layer classes, as well as LayerRendererSurface. Clarify which
+        geometry-related getters return normalized device coordinates by adding
+        a comment.
</ins><span class="cx"> 
</span><del>-2014-04-05  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+        Also remove dead code related to LayerData::m_holePunchClipRect, which
+        was part of an eventually disabled fix for video clipping in iframes,
+        PR 99638. Since we now use AC layers for iframes, the bug is no longer
+        reproducible, and the dead code will never need to be enabled again.
</ins><span class="cx"> 
</span><del>-        Web Inspector: remove unused test hook setInspectorResourcesDataSizeLimits
-        https://bugs.webkit.org/show_bug.cgi?id=131268
</del><ins>+        No change in behavior, no new tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp:
+        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
+        * platform/graphics/blackberry/LayerCompositingThread.cpp:
+        (WebCore::LayerCompositingThread::setDrawTransform):
+        (WebCore::LayerCompositingThread::transformedHolePunchRect):
+        (WebCore::LayerCompositingThread::drawTextures):
+        (WebCore::LayerCompositingThread::drawSurface):
+        * platform/graphics/blackberry/LayerCompositingThread.h:
+        (WebCore::LayerCompositingThread::sublayers): Removed &quot;get&quot; prefix
+        (LayerCompositingThread):
+        (WebCore::LayerCompositingThread::boundingBox): Renamed from &quot;getDrawRect&quot;
+        (WebCore::LayerCompositingThread::transformedBounds): Removed &quot;get&quot; prefix
+        (WebCore::LayerCompositingThread::transformedHolePunchRect): Removed &quot;get&quot; prefix
+        * platform/graphics/blackberry/LayerData.h:
+        (LayerData): Removed unused data member &quot;m_holePunchClipRect&quot;
+        * platform/graphics/blackberry/LayerFilterRenderer.cpp:
+        (WebCore::LayerFilterRenderer::applyActions):
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::compositeLayers):
+        (WebCore::LayerRenderer::drawDebugBorder):
+        (WebCore::LayerRenderer::drawHolePunchRect):
+        (WebCore::LayerRenderer::prepareFrameRecursive):
+        (WebCore::LayerRenderer::updateLayersRecursive):
+        (WebCore::collect3DPreservingLayers):
+        (WebCore::LayerRenderer::compositeLayersRecursive):
+        * platform/graphics/blackberry/LayerRendererSurface.cpp:
+        (WebCore::LayerRendererSurface::boundingBox):
+        * platform/graphics/blackberry/LayerRendererSurface.h:
+        (WebCore::LayerRendererSurface::boundingBox): Renamed from &quot;drawRect&quot; because that sounds like a verb, and this is a getter
+        * platform/graphics/blackberry/LayerWebKitThread.h:
+        (WebCore::LayerWebKitThread::sublayers): Removed &quot;get&quot; prefix
+        * platform/graphics/blackberry/VideoLayerWebKitThread.cpp:
+        (WebCore::VideoLayerWebKitThread::setHolePunchRect):
+        (WebCore::VideoLayerWebKitThread::boundsChanged):
</ins><span class="cx"> 
</span><del>-        This was used in the old inspector frontend tests for the Network panel.
-        It's no longer used by any tests or frontend code.
</del><ins>+2013-05-28  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Remove symbols.
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setInspectorResourcesDataSizeLimits): Deleted.
-        * inspector/InspectorController.h:
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::setResourcesDataSizeLimitsFromInternals): Deleted.
-        * inspector/InspectorResourceAgent.h:
-        * inspector/NetworkResourcesData.cpp:
-        (WebCore::NetworkResourcesData::setResourcesDataSizeLimits): Deleted.
-        * inspector/NetworkResourcesData.h:
-        * testing/Internals.cpp:
-        (WebCore::Internals::setInspectorResourcesDataSizeLimits): Deleted.
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+        Made AudioNode an EventTarget
+        https://bugs.webkit.org/show_bug.cgi?id=116871
</ins><span class="cx"> 
</span><del>-2014-04-05  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Merge: https://chromium.googlesource.com/chromium/blink/+/ef37484162ddb95d677dcfdcdd778ec60590928b
</ins><span class="cx"> 
</span><del>-        REGRESSION (NetworkProcess): Subresources fail to load from AppCache
-        https://bugs.webkit.org/show_bug.cgi?id=131262
-        &lt;rdar://problem/15370653&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Tests: webaudio/audionode-expected.txt:
+               webaudio/audionode.html:
</ins><span class="cx"> 
</span><del>-        Exported ApplicationCacheHost::maybeLoadResource. Changed it to take a const
-        reference to ResourceRequest, as appropriate for WebResourceLoadScheduler.
</del><ins>+        Add the requisite boilerplate to allow AudioNode to become an EventTarget. Remove
+        all that same boilerplate from ScriptProcessorNode now that it's base class
+        is an EventTarget.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::maybeLoadResource):
-        * loader/appcache/ApplicationCacheHost.h:
</del><ins>+        * Modules/webaudio/AudioNode.cpp:
+        (WebCore::AudioNode::interfaceName): Added boilerplate.
+        (WebCore::AudioNode::scriptExecutionContext): Return the AudioContext's context.
+        (WebCore::AudioNode::processIfNecessary): Whitespace.
+        * Modules/webaudio/AudioNode.h:
+        * Modules/webaudio/AudioNode.idl: Make AudioNode an EventTarget.
+        * Modules/webaudio/ScriptProcessorNode.cpp: Remove EventTarget boilerplate.
+        * Modules/webaudio/ScriptProcessorNode.h: Ditto.
+        * Modules/webaudio/ScriptProcessorNode.idl: Ditto.
+        * dom/EventTarget.h: Mark AudioNode as an EventTarget.
+        * dom/EventTargetFactory.in: Ditto.
</ins><span class="cx"> 
</span><del>-2014-04-05  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+2013-05-28  Arvid Nilsson  &lt;anilsson@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: remove unused metrics and commands from the Timeline agent
-        https://bugs.webkit.org/show_bug.cgi?id=131184
</del><ins>+        [BlackBerry] backface-visibility: hidden doesn't work properly with masks and filters
+        https://bugs.webkit.org/show_bug.cgi?id=116616
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        This patch removes several instrumentation hooks that are not being
-        used by the frontend in any way. Most of them are not hooked up to
-        produce any data, so they just clutter up InspectorClient and the agent.
</del><ins>+        The BlackBerry::Platform::Graphics::GraphicsContext generates geometry
+        with a different winding order than the accelerated compositing backend
+        of the BlackBerry port. So, when we switched from Skia to this new
+        rendering engine, we switched from glFrontFace(GL_CCW) to
+        glFrontFace(GL_CW), and all was well when drawing display lists.
+        However, we forgot to update the winding order of geometry generated
+        within the accelerated compositing backend, which is used for masks and
+        filters, so they were getting erroneously culled out when
+        backface-visibility: hidden was applied to them. Fixed by switching the
+        winding order of all geometry generated up here, which has the added
+        benefit of enabling us to use TransformationMatrix::mapQuad instead of
+        transforming point-by-point.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Remove didBeginFrame/didCancelFrame.
-        * inspector/InspectorClient.h: Remove client methods that are never overridden.
-        (WebCore::InspectorClient::canMonitorMainThread): Deleted.
-        (WebCore::InspectorClient::supportsFrameInstrumentation): Deleted.
-        (WebCore::InspectorClient::getAllocatedObjects): Deleted.
-        (WebCore::InspectorClient::dumpUncountedAllocatedObjects): Deleted.
</del><ins>+        To further complicate matters, a right-side up transform is used when
+        drawing layers into surfaces, reversing the winding order and requiring
+        us to switch back to glFrontFace(GL_CCW) temporarily, when drawing
+        layers to surfaces, or the layers will get culled out inside the
+        surface.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorController.cpp: Remove unused instrumentation.
-        (WebCore::InspectorController::didBeginFrame): Deleted.
-        (WebCore::InspectorController::didCancelFrame): Deleted.
-        (WebCore::InspectorController::didComposite): Deleted.
-        (WebCore::InspectorController::wilComposite): Deleted.
-        * inspector/InspectorController.h:
</del><ins>+        Also fix spelling error, &quot;drawed&quot; should be &quot;drawn&quot;.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorTimelineAgent.cpp: Remove the backend's BeginFrame enum
-        value, but keep it in the protocol for when it is reimplemented. Remove
-        management of the current frame record, and simplify some code.
-        (WebCore::toProtocol):
-        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
-        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
-        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
-        (WebCore::InspectorTimelineAgent::clearRecordStack):
-        (WebCore::InspectorTimelineAgent::canMonitorMainThread): Deleted.
-        (WebCore::InspectorTimelineAgent::supportsFrameInstrumentation): Deleted.
-        (WebCore::InspectorTimelineAgent::didBeginFrame): Deleted.
-        (WebCore::InspectorTimelineAgent::didCancelFrame): Deleted.
-        (WebCore::InspectorTimelineAgent::didComposite): Deleted.
-        (WebCore::InspectorTimelineAgent::wilComposite): Deleted.
-        (WebCore::InspectorTimelineAgent::innerAddRecordToTimeline): Deleted. Undo telescoping.
-        (WebCore::usedHeapSize): Deleted.
-        (WebCore::InspectorTimelineAgent::commitFrameRecord): Deleted.
-        * inspector/InspectorTimelineAgent.h:
-        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
-        * inspector/protocol/Timeline.json:
</del><ins>+        No new tests, this is only detectable by pixel tests, which the
+        BlackBerry port currently doesn't support.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp: Remove
-        instrumentation hook for beginFrame. This is the only backend that implements it.
-        (WebCore::CompositingCoordinator::syncDisplayState):
</del><ins>+        PR 341945.
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp: Remove crufty test methods that aren't used.
-        (WebCore::Internals::emitInspectorDidBeginFrame): Deleted.
-        (WebCore::Internals::emitInspectorDidCancelFrame): Deleted.
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+        * platform/graphics/blackberry/EGLImageLayerCompositingThreadClient.cpp:
+        (WebCore::EGLImageLayerCompositingThreadClient::drawTextures):
+        * platform/graphics/blackberry/LayerCompositingThread.cpp:
+        (WebCore::LayerCompositingThread::setDrawTransform):
+        (WebCore::getTransformedRect):
+        (WebCore::LayerCompositingThread::drawTextures):
+        (WebCore::LayerCompositingThread::drawSurface):
+        * platform/graphics/blackberry/LayerCompositingThread.h:
+        (LayerCompositingThread):
+        (WebCore::LayerCompositingThread::origin):
+        * platform/graphics/blackberry/LayerFilterRenderer.cpp:
+        (WebCore):
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::compositeLayers):
+        (WebCore):
+        (WebCore::LayerRenderer::drawLayersOnSurfaces):
+        * platform/graphics/blackberry/LayerRendererSurface.cpp:
+        (WebCore::LayerRendererSurface::drawRect):
+        (WebCore::LayerRendererSurface::transformedBounds):
+        * platform/graphics/blackberry/LayerRendererSurface.h:
+        (WebCore::LayerRendererSurface::origin):
+        (LayerRendererSurface):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore):
+        (WebCore::loadBufferingImageData):
+        (WebCore::MediaPlayerPrivate::drawBufferingAnimation):
</ins><span class="cx"> 
</span><del>-2014-04-05  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-05-28  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r163914): Application cache cannot be used in main frame
-        https://bugs.webkit.org/show_bug.cgi?id=131263
-        &lt;rdar://problem/16532063&gt;
</del><ins>+        Move Node::dispatchChangeEvent() to HTMLFormControlElement.
+        &lt;http://webkit.org/b/116866&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * loader/appcache/ApplicationCacheHost.cpp: (WebCore::ApplicationCacheHost::isApplicationCacheBlockedForRequest):
-        Don't check main frame origin when loading into main frame, it's not a 3rd party
-        subframe, and the URL is unrelated to the page we are loading now.
</del><ins>+        ...and devirtualize it, since it had no overrides.
</ins><span class="cx"> 
</span><del>-        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        Removed the same incorrect check that was duplicated here. The only caller already
-        checks isApplicationCacheBlockedForRequest().
</del><ins>+        * dom/Node.h:
+        * dom/Node.cpp:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchChangeEvent):
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::setFiles):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::dispatchFormControlChangeEvent):
</ins><span class="cx"> 
</span><del>-2014-04-05  Dan Bernstein  &lt;mitz@apple.com&gt;
</del><ins>+2013-05-28  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        [Xcode] Clean up the platform/graphics group
-        https://bugs.webkit.org/show_bug.cgi?id=131271
</del><ins>+        Refactoring CSS grammar
+        https://bugs.webkit.org/show_bug.cgi?id=116679
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj: Created an opentype group and moved opentype file
-        references into it. Removed duplicate file references.
</del><ins>+        From Blink r149948 by &lt;serya@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-2014-04-05  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Added &quot;closing_parenthesis:&quot; and &quot;error_recovery:&quot; to avoid code
+        duplication in a couple of error recovery rules. Some other rules
+        were also refactored which allows to reduce the the number of
+        shift/reduce conflicts by 2.
</ins><span class="cx"> 
</span><del>-        Remove unused type casting helpers for HTMLUnknownElement...
</del><ins>+        No new tests required as this is just a refactoring, no new
+        functionality added.
</ins><span class="cx"> 
</span><del>-        ...to fix the debug build.
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-        * html/HTMLUnknownElement.h:
</del><ins>+2013-05-28  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-05  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        Invalid block doesn't make declaration invalid
+        https://bugs.webkit.org/show_bug.cgi?id=115709
</ins><span class="cx"> 
</span><del>-        Canvas strokeText and fillText with SourceIn, DestinationIn, SourceOut, DestinationAtop and Copy have errors
-        https://bugs.webkit.org/show_bug.cgi?id=66766
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Use transparency layers to draw text with certain compositing modes on
-        the canvas. This follows the Canvas specification and makes WebKit fully
-        compatible with IE. It also makes it more compatible with Firefox, even though
-        Firefox still has some bugs.
</del><ins>+        From Blink r149446 by &lt;serya@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/canvas/canvas-composite-text-alpha.html
</del><ins>+        Added a new rule &quot;declaration_recovery:&quot; which covers any kind of
+        &quot;invalid_block_list maybe_space&quot; sequence. By appending this new
+        rule to every rule reductable to &quot;declaration:&quot; we can remove some
+        redundant rules and improve error recovery of some others that
+        were only accepting exactly one error.
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawTextInternal):
</del><ins>+        One of the rules being removed was preventing invalid blocks in a
+        declaration to invalidate the whole declaration. The rule was
+        reporting the syntax error but at the same time accepting the
+        invalid block as part of a valid declaration.
</ins><span class="cx"> 
</span><del>-2014-04-05  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-        Devirtualize isHTMLUnknownElement().
-        &lt;https://webkit.org/b/131269&gt;
</del><ins>+2013-05-28  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        We were hitting isHTMLUnknownElement() pretty hard when marking
-        out-of-document Nodes. (The check is part of isHTMLAudioElement()
-        which is called by JSNodeOwner::isReachableFromOpaqueRoots().)
</del><ins>+        Move dispatching of focus-related events from Node to Element.
+        &lt;http://webkit.org/b/116864&gt;
</ins><span class="cx"> 
</span><del>-        This patch uses a Node flag for the unknown element instead.
-        I'm also adding HTMLUnknownElement.{h,idl} to the Xcode project
-        since they were suspiciously missing.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        ...and pass around pointers to Element instead of Node.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        * dom/Node.cpp:
</ins><span class="cx">         * dom/Node.h:
</span><del>-        * html/HTMLElement.h:
-        (WebCore::HTMLElement::isHTMLUnknownElement):
-        * html/HTMLUnknownElement.h:
-        (WebCore::toHTMLUnknownElement): Deleted.
</del><ins>+        * dom/Element.h:
+        * dom/Element.cpp:
+        (WebCore::Element::dispatchFocusInEvent):
+        (WebCore::Element::dispatchFocusOutEvent):
+        (WebCore::Element::dispatchFocusEvent):
+        (WebCore::Element::dispatchBlurEvent):
</ins><span class="cx"> 
</span><del>-2014-04-05  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+            Moved here from Node.
</ins><span class="cx"> 
</span><del>-        Canvas stroke and strokeRect with SourceIn, DestinationIn, SourceOut, DestinationAtop and Copy have errors
-        https://bugs.webkit.org/show_bug.cgi?id=66762
</del><ins>+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
+        * html/HTMLSelectElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        * html/HTMLTextFormControlElement.h:
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Update subclass overrides and sprinkle OVERRIDE/FINAL.
</ins><span class="cx"> 
</span><del>-        For fill operations we create a new ImageBuffer to ensure that the results are composited
-        correctly according to the Canvas spec. This patch creates a new transparency layer
-        for stroking on certain compositing operators to archive the same. This makes WebKit's
-        behavior interoperable with Firefox and IE as well. 
</del><ins>+2013-05-28  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/fast/canvas/canvas-composite-stroke-alpha.html
</del><ins>+        Remove CachedResourceRequest::initiatorElement
+        https://bugs.webkit.org/show_bug.cgi?id=116862
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::strokeInternal):
-        (WebCore::CanvasRenderingContext2D::strokeRect):
-
-2014-04-05  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
-
-        Use preallocated stack reference to store adjacentBacktrackingStart
-        https://bugs.webkit.org/show_bug.cgi?id=131237
-
-        Reviewed by Benjamin Poulain.
-
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAdjacentBacktrackingTail):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateBacktrackingTailsIfNeeded):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToPreviousAdjacent): Deleted.
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::linkFailures): Deleted.
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateDescendantBacktrackingTail): Deleted.
-        * cssjit/StackAllocator.h:
-        (WebCore::StackAllocator::allocateUninitialized):
-
-2014-04-05  Jeongeun Kim  &lt;je_julie.kim@samsung.com&gt;
-
-        bad values from HTMLImageElement x and y attributes (CSSOM-View)
-        https://bugs.webkit.org/show_bug.cgi?id=130308
-        
-        Reviewed by Simon Fraser.
-
-        According to CSSOM-View, interface HTMLImageElement,
-        The x attribute must return the x-coordinate.
-        If style is not updated when x() is called, it can’t return anything.
-        Style and layout should be done before getting value for x() and y(). 
-
-        Test: cssom/cssom-view-img-attributes-001.html
-
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::x):
-        (WebCore::HTMLImageElement::y):
-
-2014-04-05  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
-
-        [CSS Shapes] Remove CSSBoxType member from BasicShape and CSSBasicShape
-        https://bugs.webkit.org/show_bug.cgi?id=129706
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        The CSSBoxType has been moved up to ShapeValue and is no longer needed in the BasicShape classes.
</del><ins>+        The CachedResourceRequest::initiatorElement method is not used anywhere and should be removed.
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+        * loader/cache/CachedResourceRequest.cpp: Remove the initiatorElement method definition.
+        * loader/cache/CachedResourceRequest.h:
+        (CachedResourceRequest): Remove the initiatorElement method declaration.
</ins><span class="cx"> 
</span><del>-        * css/BasicShapeFunctions.cpp:
-        (WebCore::valueForBasicShape):
-        (WebCore::basicShapeForValue):
-        * rendering/style/BasicShapes.cpp:
-        (WebCore::BasicShape::canBlend):
-        * rendering/style/BasicShapes.h:
-        (WebCore::BasicShape::referenceBox): Deleted.
-        (WebCore::BasicShape::setReferenceBox): Deleted.
-        (WebCore::BasicShape::BasicShape): Deleted.
</del><ins>+2013-05-28  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-05  Mark Rowe  &lt;mrowe@apple.com&gt;
</del><ins>+        Document::setFocusedNode() should be setFocusedElement().
+        &lt;http://webkit.org/b/116857&gt;
</ins><span class="cx"> 
</span><del>-        Fix the 32-bit build after r166818.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        Only Elements can be focused, so tighten Document's idea of what's focused.
</ins><span class="cx"> 
</span><del>-2014-04-03  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+        Most of this patch is just updating call sites for the new names and removing
+        now-unnecessary isElementNode() checks and casts.
</ins><span class="cx"> 
</span><del>-        Web Inspector: hook up probe samples to TimelineAgent's records
-        https://bugs.webkit.org/show_bug.cgi?id=131127
-
-        Reviewed by Timothy Hatcher.
-
-        Hook up probe callbacks from ScriptDebugListener so that timeline records are
-        created for probe samples. The record includes the probe identifier and hit count.
-        The actual probe evaluation result is sent separately by DebuggerAgent, and
-        can be looked up in frontend models using the identifier and hit count.
-
-        * inspector/InspectorTimelineAgent.cpp: Only listen to the debug server when recording.
-        (WebCore::InspectorTimelineAgent::start):
-        (WebCore::InspectorTimelineAgent::stop):
-        (WebCore::InspectorTimelineAgent::breakpointActionProbe):
-        (WebCore::toProtocol):
-        * inspector/InspectorTimelineAgent.h:
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createProbeSampleData):
-        * inspector/TimelineRecordFactory.h:
-        * inspector/protocol/Timeline.json: Add new enum value.
-
-2014-04-04  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Streamline cached wrapper lookup for Nodes in the normal world.
-        &lt;https://webkit.org/b/131249&gt;
-
-        Inline the hot path for toJS(..., Node*) for cached wrapper lookups
-        in the normal world. (Or really, out-of-line the cold path, since
-        that was preventing the compiler from inlining this function.)
-
-        Also have JSDOMGlobalObject cache the &quot;is normal world&quot; flag from
-        the DOMWrapperWorld so we can avoid the extra load.
-
-        Reviewed by Benjamin Poulain.
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        (WebCore::JSDOMGlobalObject::worldIsNormal):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::getOutOfLineCachedWrapper):
-        * bindings/js/JSNodeCustom.h:
-        (WebCore::toJS):
-
-2014-04-04  Brady Eidson  &lt;beidson@apple.com&gt;
-
-        Show DataDetector UI on scanned phone numbers.
-        &lt;rdar://problem/16379588&gt; and https://bugs.webkit.org/show_bug.cgi?id=131247
-
-        Reviewed by Tim Horton.
-
-        Gather the ranges of the scanned telephone numbers and send them up to WK2:
</del><ins>+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isFocused):
+        (WebCore::AccessibilityRenderObject::setFocused):
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * bindings/objc/DOM.mm:
+        (-[DOMElement isFocused]):
+        * dom/Document.cpp:
+        (WebCore::Document::dispose):
+        (WebCore::Document::detach):
+        (WebCore::Document::focusedNodeRemoved):
+        (WebCore::Document::removeFocusedNodeOfSubtree):
+        (WebCore::Document::setFocusedElement):
+        (WebCore::Document::updateFocusAppearanceTimerFired):
+        (WebCore::eventTargetNodeForDocument):
+        * dom/Document.h:
+        (Document):
+        (WebCore::Document::focusedElement):
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+        (WebCore::Element::focus):
+        (WebCore::Element::blur):
+        (WebCore::Element::cancelFocusAppearanceUpdate):
+        * dom/Node.cpp:
+        (WebCore::Node::rendererIsEditable):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::focusedElement):
+        * dom/UserTypingGestureIndicator.cpp:
+        (WebCore::UserTypingGestureIndicator::UserTypingGestureIndicator):
</ins><span class="cx">         * editing/Editor.cpp:
</span><del>-        (WebCore::Editor::respondToChangedSelection):
-        (WebCore::Editor::scanSelectionForTelephoneNumbers):
-        (WebCore::Editor::scanRangeForTelephoneNumbers):
-        * editing/Editor.h:
</del><ins>+        (WebCore::Editor::setBaseWritingDirection):
+        (WebCore::Editor::setComposition):
+        (WebCore::Editor::guessesForMisspelledOrUngrammatical):
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::selectAll):
+        (WebCore::FrameSelection::focusedOrActiveStateChanged):
+        (WebCore::FrameSelection::setFocusedElementIfNeeded):
+        (WebCore::FrameSelection::currentForm):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateType):
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValueCommon):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        (WebCore::HTMLTextFormControlElement::selectionDirection):
+        * html/RadioInputType.cpp:
+        (WebCore::RadioInputType::handleKeydownEvent):
+        (WebCore::RadioInputType::isKeyboardFocusable):
+        * html/shadow/DateTimeEditElement.cpp:
+        (WebCore::DateTimeEditElement::focusedFieldIndex):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::focus):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::logicalScrollOverflow):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::sendContextMenuEventForKey):
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
+        (WebCore::FocusController::setFocusedElement):
+        (WebCore::FocusController::findFocusCandidateInContainer):
+        (WebCore::FocusController::advanceFocusDirectionallyInContainer):
+        (WebCore::FocusController::advanceFocusDirectionally):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::focusPluginElement):
+        * plugins/efl/PluginViewEfl.cpp:
+        (WebCore::PluginView::setFocus):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::platformStart):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintAreaElementFocusRing):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
+        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isFocused):
</ins><span class="cx"> 
</span><del>-        Add client method to receive scanned telephone number ranges:
-        * page/EditorClient.h:
-        (WebCore::EditorClient::selectedTelephoneNumberRangesChanged):
</del><ins>+2013-05-28  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove unneeded placeholder UI:
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintDocumentMarkers):
-        (WebCore::InlineTextBox::computeRectForReplacementMarker): Deleted.
-        (WebCore::InlineTextBox::paintCompositionUnderline): Deleted.
-        * rendering/InlineTextBox.h:
-        (WebCore::InlineTextBox::expansionBehavior): Deleted.
</del><ins>+        Web Inspector: Enable CSS logging
+        https://bugs.webkit.org/show_bug.cgi?id=113401
</ins><span class="cx"> 
</span><del>-2014-04-04  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        AX: supportsARIAExpanded should always return true for a few roles: combobox, disclosure.
-        https://bugs.webkit.org/show_bug.cgi?id=129787
</del><ins>+        From Blink r149265 by &lt;serya@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        CSS logging was disabled in r147028 to prevent message overflow in
+        the inspector console. This change restores it by modifying the
+        CSS grammar in order to reduce as much consecutive errors as
+        possible in 'declaration_list' and 'decl_list' rules.
</ins><span class="cx"> 
</span><del>-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
</del><ins>+        This way, for rules like 'x { color: ### }' only the first '#'
+        will be reported as error (instead of 3 identical errors).
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::supportsARIAExpanded):
</del><ins>+        The rule 'declaration' still produces multiple errors, because it
+        does not eat as much errors as possible. So in order not to create
+        a complex risky patch we just disable logging in the parser for
+        that rule.
</ins><span class="cx"> 
</span><del>-2014-04-04  Andreas Kling  &lt;akling@apple.com&gt;
-
-        JSGenerateToNativeObject should use fast JSNode/JSElement casts.
-        &lt;https://webkit.org/b/131245&gt;
-
-        Make JSGenerateToNativeObject spit out code using the fast new wrapper
-        casts for JSNode and JSElement.
-
-        This avoids walking the ClassInfo chain in many core functions, e.g:
-
-            - Node.insertBefore()
-            - Node.replaceChild()
-            - Node.removeChild()
-            - Node.appendChild()
-            - window.getComputedStyle()
-
-        Reviewed by Geoff Garen.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-
-2014-04-04  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
-
-        [CSS Shapes] polygon y-value calc() args serialize incorrectly
-        https://bugs.webkit.org/show_bug.cgi?id=129842
-
-        Reviewed by Bem Jones-Bey.
-
-        The code hit ASSERT(isCalculation(value)) in CSSParser::createPrimitiveNumbericValue, because
-        CSSParser::validUnit had been called on both coordinates, which set the value for m_parsedCalculation,
-        but only one of the coordinates was calculation value. I reordered calling valudUnit and
-        createPrimitiveNumbericValue to be called in the correct order on the coordinates.
-
-        I added the new test case to parsing-test-utils.js.
-
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx">         * css/CSSParser.cpp:
</span><del>-        (WebCore::CSSParser::parseBasicShapePolygon):
</del><ins>+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseSheet):
+        (WebCore::CSSParser::syntaxError):
+        (WebCore::CSSParser::isLoggingErrors):
+        (WebCore::CSSParser::rewriteSpecifiers):
+        * css/CSSParser.h:
+        (CSSParser):
</ins><span class="cx"> 
</span><del>-2014-04-04  Brian J. Burg  &lt;burg@cs.washington.edu&gt;
</del><ins>+2013-05-27  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Web Replay: capture and replay wheel events and scroll commands
-        https://bugs.webkit.org/show_bug.cgi?id=129402
</del><ins>+        Build fix for WinCE after r150730.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher and Simon Fraser.
</del><ins>+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):
</ins><span class="cx"> 
</span><del>-        To capture and replay scrolling, the scrolling coordinator will force synchronous 
-        scrolling during capture and replay. If the page is capturing or replaying,
-        ForceOnMainThread will be added to the coordinator's SynchronousScrollingReasons.
</del><ins>+2013-05-27  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        A callback was added to signal that replay session state have changed,
-        and thus the synchronous scrolling reasons should be recomputed.
</del><ins>+        Build fix for WinCE after r150772.
</ins><span class="cx"> 
</span><del>-        Automated replay reftests for scrolling are not included, because they will be
-        too flaky until more nondeterminism is handled. Specifically, resource loading,
-        initial focus/active state, and parsing are known blocking issues.
</del><ins>+        * platform/win/ClipboardWin.cpp:
+        (WebCore):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::readFilenames):
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        Test: ManualTests/inspector/replay-wheel-events.html
</del><ins>+2013-05-27  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingCoordinator.cpp: Add a new callback for replay state
-        session changes. Add ForceOnMainThread if the page's active input cursor is
-        capturing or replaying.
</del><ins>+        Fix build.
</ins><span class="cx"> 
</span><del>-        (WebCore::ScrollingCoordinator::synchronousScrollingReasons):
-        (WebCore::ScrollingCoordinator::replaySessionStateDidChange): Added.
-        * page/scrolling/ScrollingCoordinator.h:
</del><ins>+        * html/HTMLAnchorElement.cpp:
+        (WebCore::hasNonEmptyBox): Fix typo.
</ins><span class="cx"> 
</span><del>-        * platform/PlatformWheelEvent.h:
-        * platform/ScrollTypes.h: Add explicit enum storage types so these enums can
-        be forward-declared. This is necessary to generate enum encode/decode implementations.
</del><ins>+2013-05-27  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * replay/ReplayController.cpp:
-        (WebCore::ReplayController::setForceDeterministicSettings): If async scrolling
-        support is available, tell the scrolling tree to behave deterministically.
</del><ins>+        Move hasNonEmptyBoundingBox from Node to HTMLAnchorElement
+        https://bugs.webkit.org/show_bug.cgi?id=116842
</ins><span class="cx"> 
</span><del>-        * replay/ReplayInputDispatchMethods.cpp:
-        (WebCore::HandleWheelEvent::dispatch): Added.
-        (WebCore::LogicalScrollPage::dispatch): Added.
-        (WebCore::ScrollPage::dispatch): Added.
-        * replay/SerializationMethods.cpp: Introduce more specific macros for values
-        deserialized to arbitraray lvalues, scalars, RefPtr, and unique_ptr. Fix existing
-        uses of decode macros.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        (JSC::EncodingTraits&lt;NondeterministicInputBase&gt;::encodeValue): Fix macro name.
-        (JSC::EncodingTraits&lt;KeypressCommand&gt;::encodeValue): Fix macro name.
-        (JSC::EncodingTraits&lt;PlatformKeyboardEvent&gt;::encodeValue): Fix macro name.
-        (JSC::EncodingTraits&lt;PlatformMouseEvent&gt;::encodeValue): Fix macro name.
-        (JSC::PlatformWheelEventCocoa::PlatformWheelEventCocoa): Added. Encapsulate
-        and initialize data members specific to PLATFORM(COCOA).
</del><ins>+        * dom/Node.cpp: Removed hasNonEmptyBoundingBox.
+        * dom/Node.h: Ditto.
</ins><span class="cx"> 
</span><del>-        (JSC::EncodingTraits&lt;PlatformWheelEvent&gt;::encodeValue): Added.
-        (JSC::EncodingTraits&lt;PlatformWheelEvent&gt;::decodeValue): Added.
-        * replay/SerializationMethods.h:
-        * replay/UserInputBridge.cpp: Fill in bridge methods to capture inputs.
-        (WebCore::UserInputBridge::handleWheelEvent):
-        (WebCore::UserInputBridge::scrollRecursively):
-        (WebCore::UserInputBridge::logicalScrollRecursively):
-        * replay/WebInputs.json: Add inputs and new enum types.
</del><ins>+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isMouseFocusable): Fixed #if to be more readable and
+        added more-explicit clearer comments. No behavior change.
+        (WebCore::hasNonEmptyBox): Added.  Has the same code that was in
+        Node::hasNonEmptyBoundingBox with some additional comments.
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable): Call hasNonEmptyBox.
</ins><span class="cx"> 
</span><del>-2014-04-04  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</del><ins>+2013-05-27  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Upgrade to SelectorFailsAllSiblings when Child selector is failed.
-        https://bugs.webkit.org/show_bug.cgi?id=130961
</del><ins>+        Move isBlockFlowElement and related functions out of the Node class into editing code
+        https://bugs.webkit.org/show_bug.cgi?id=116846
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        When Child selector fails, we should resume matching from the closest
-        Descendant selector.
-        So upgrading SelectorFailsLocally to SelectorFailsAllSibling at least
-        to prevent unnecessary direct/indirect adjacent selectors matching.
</del><ins>+        * dom/Node.cpp: Removed isBlockFlowElement, enclosingBlockFlowElement, and
+        inSameContainingBlockFlowElement. These are all editing functions that don't
+        belong in the Node class, and mostly-deprecated ones to boot.
+        * dom/Node.h: Ditto.
</ins><span class="cx"> 
</span><del>-        * css/SelectorChecker.cpp:
-        (WebCore::SelectorChecker::matchRecursively):
</del><ins>+        * dom/Position.cpp:
+        (WebCore::inSameEnclosingBlockFlowElement): Added. This editing-specific function
+        is used only here, so put it here.
+        (WebCore::Position::rendersInDifferentPosition): Updated to call new function above.
+        (WebCore::Position::leadingWhitespacePosition): Ditto.
</ins><span class="cx"> 
</span><del>-2014-04-04  Roger Fong  &lt;roger_fong@apple.com&gt;
</del><ins>+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::insertNodeAfterPosition): Use
+        deprecatedEnclosingBlockFlowElement at its new location.
+        (WebCore::InsertLineBreakCommand::insertNodeBeforePosition): Ditto.
</ins><span class="cx"> 
</span><del>-        Keep track of filtered active attribute/uniform indices per shader program.
-        https://bugs.webkit.org/show_bug.cgi?id=131235.
</del><ins>+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApplyForSingleParagraph): use
+        isBlockFlowElement at its new location.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::enclosingInline): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition): Use deprecatedEnclosingBlockFlowElement
+        at its new location.
+        (WebCore::enclosingBlockFlowElement): Ditto. Also added FIXME.
+        * editing/VisibleSelection.cpp:
+        (WebCore::makeSearchRange): Ditto.
</ins><span class="cx"> 
</span><del>-        Tests: Covered by existing Khronos Conformance tests. 
-        Will create a test to use multiple shader programs in a follow-up patch.
</del><ins>+        * editing/htmlediting.cpp:
+        (WebCore::isBlockFlowElement): Added. Same as the Node::isBlockFlowElement
+        function, but here because this is an editing function, not suitable as a Node member.
+        (WebCore::deprecatedEnclosingBlockFlowElement): Ditto. Added &quot;deprecated&quot; to the name
+        since the Node member function had a comment saying it was deprecated. Also changed so
+        it tolerates a 0 for an argument, which made it easier for one caller.
</ins><span class="cx"> 
</span><del>-        * html/canvas/WebGLProgram.cpp:
-        (WebCore::WebGLProgram::cacheActiveAttribLocations): Use getActiveAttribImpl. We do not need to use the filtered list of attributes here.
-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::getUniformLocation): Use filtered list of uniforms for uniform count.
-        * platform/graphics/GraphicsContext3D.h: Create a map of shader programs to ActiveShaderSymbolCounts.
-        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
-        (WebCore::GraphicsContext3D::attachShader): 
-        When attaching or detaching a shader the shader program's active symbols list will change. Clear it so that it will be updated later.
-        (WebCore::GraphicsContext3D::detachShader): Ditto.
-        (WebCore::GraphicsContext3D::compileShader): No need to clear symbol counts here.
-        (WebCore::GraphicsContext3D::getActiveAttrib): getActiveAttrib should only be able to query for attributes in the filtered list.
-        (WebCore::GraphicsContext3D::getActiveUniform): getActiveUniform should only be able to query for uniforms in the filtered list.
-        (WebCore::GraphicsContext3D::getNonBuiltInActiveSymbolCount): Return the filtered symbol count for a shader program.
</del><ins>+        * editing/htmlediting.h: Added the two new functions.
</ins><span class="cx"> 
</span><del>-2014-04-04  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+2013-05-27  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Add compositing reason for isolation.
-        https://bugs.webkit.org/show_bug.cgi?id=131153
</del><ins>+        Add guard around paintForFixedRootBackground
+        https://bugs.webkit.org/show_bug.cgi?id=116754
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        There are 2 reasons involving blend modes for a layer to be composited:
-        1) the layer has blend mode and has composited descendants: CompositingReasonBlendingWithCompositedDescendants.
-        2) the layer has to isolate composited blending descendants: CompositingReasonIsolatesCompositedBlendingDescendants
</del><ins>+        paintForFixedRootBackground is only used when ACCELERATED_COMPOSITING is enabled.
</ins><span class="cx"> 
</span><del>-        Test: inspector-protocol/layers/layers-blending-compositing-reasons.html
-
-        * inspector/InspectorLayerTreeAgent.cpp:
-        (WebCore::InspectorLayerTreeAgent::reasonsForCompositingLayer):
-        * inspector/protocol/LayerTree.json:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::reasonsForCompositing):
-        (WebCore::RenderLayerCompositor::logReasonsForCompositing):
-        * rendering/RenderLayerCompositor.h: adding CompositingReasonIsolatesCompositedBlendingDescendants.
-
-2014-04-04  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        Use more const refs in ShapeOutsideInfo and some misc cleanup
-        https://bugs.webkit.org/show_bug.cgi?id=131192
-
-        Reviewed by Dirk Schulze.
-
-        Use const refs for pretty much everything that can't be null. Also
-        cleanup some code that got a bit messy when ShapeInfo was merged into
-        ShapeOutsideInfo.
-
</del><span class="cx">         No new tests, no behavior change.
</span><span class="cx"> 
</span><del>-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::ShapeOutsideInfo::shapeToRendererPoint):
-        (WebCore::ShapeOutsideInfo::shapeToRendererSize):
-        (WebCore::referenceBox):
-        (WebCore::ShapeOutsideInfo::setReferenceBoxLogicalSize):
-        (WebCore::getShapeImageAndRect):
-        (WebCore::ShapeOutsideInfo::computedShape):
-        (WebCore::ShapeOutsideInfo::logicalTopOffset):
-        (WebCore::ShapeOutsideInfo::logicalLeftOffset):
-        * rendering/shapes/ShapeOutsideInfo.h:
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-2014-04-04  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-05-27  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r166615): Pressing return doesn’t submit search term at bing.com
-        https://bugs.webkit.org/show_bug.cgi?id=131212
-        &lt;rdar://problem/16521788&gt;
</del><ins>+        Remove a leftover Pagepoup from PickerIndicatorElement.h
+        https://bugs.webkit.org/show_bug.cgi?id=116801
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Test: fast/forms/submit-while-you-submit.html
-
-        Turns out that m_shouldSubmit can actually be modified in a code path where we can't
-        directly return the result. I'm not sure if the current behavior is entirely correct
-        (we have open bugs about submitting forms multiple times), but let's restore it to
-        pre-r166615 state.
-
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::HTMLFormElement):
-        (WebCore::HTMLFormElement::prepareForSubmission):
-        (WebCore::HTMLFormElement::submit):
-        * html/HTMLFormElement.h:
-
-2014-04-04  Martin Hock  &lt;mhock@apple.com&gt;
-
-        [Mac] Change operation queue width to NSOperationQueueDefaultMaxConcurrentOperationCount.
-        https://bugs.webkit.org/show_bug.cgi?id=131231
-
-        &lt;rdar://problem/13913483&gt;
-
-        Reviewed by Brady Eidson.
-
</del><span class="cx">         No new tests, no behavior change.
</span><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::operationQueueForAsyncClients):
</del><ins>+        * html/shadow/PickerIndicatorElement.h:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-2014-04-04  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+2013-05-27  Claudio Saavedra  &lt;csaavedra@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Simplify Polygon implementation
-        https://bugs.webkit.org/show_bug.cgi?id=130975
</del><ins>+        [CSS] -webkit-var prefix is case-sensitive
+        https://bugs.webkit.org/show_bug.cgi?id=116829
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Only floats can specify shape-outside. For polygon shape-outside values, the problem
-        of finding the left and right exclusion edges reduces to finding the X axis
-        limits of the polygon edges that overlap a particular layout line. This is a much
-        simpler version of the problem that PolygonShape was originally designed for, and so
-        the implementation can also be simplified. There's more about the new algorithm in
-        http://hansmuller-webkit.blogspot.com/2014/03/a-simpler-algorithm-for-css-shapes.html.
</del><ins>+        Tests: Added case to fast/css/variables/case-sensitive.html
</ins><span class="cx"> 
</span><del>-        No new tests, since functionality was only removed.
-
-        * platform/graphics/FloatRect.h:
-        (WebCore::FloatRect::overlapsYRange):
-        (WebCore::FloatRect::overlapsXRange):
-        * rendering/shapes/PolygonShape.cpp:
-        (WebCore::OffsetPolygonEdge::xIntercept):
-        (WebCore::circleXIntercept):
-        (WebCore::OffsetPolygonEdge::clippedEdgeXRange): X axis extent of the edge clipped to a vertical interval.
-        (WebCore::clippedCircleXRange): X axis extent of a circle clipped to a vertical interval.
-        (WebCore::PolygonShape::shapeMarginLogicalBoundingBox):
-        (WebCore::PolygonShape::getExcludedIntervals):
-        (WebCore::PolygonShape::buildDisplayPaths):
-        * rendering/shapes/PolygonShape.h:
-        (WebCore::OffsetPolygonEdge::OffsetPolygonEdge):
-        (WebCore::OffsetPolygonEdge::isWithinYRange):
-        (WebCore::OffsetPolygonEdge::overlapsYRange):
-        (WebCore::PolygonShape::PolygonShape):
-        * rendering/shapes/ShapeInterval.h:
-        (WebCore::ShapeInterval::isEmpty):
-        (WebCore::ShapeInterval::unite):
-
-2014-04-04  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        [CSS Shapes] shape-margin in percentage units always computes to 0px
-        https://bugs.webkit.org/show_bug.cgi?id=130369
-
-        Reviewed by Andreas Kling.
-
-        Make shape-margin parsing accept percentages and properly compute the
-        length once the percentage is accepted.
-
-        Test: fast/shapes/shape-outside-floats/shape-outside-floats-shape-margin-percent.html
-
</del><span class="cx">         * css/CSSParser.cpp:
</span><del>-        (WebCore::CSSParser::parseValue):
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createShape):
-        (WebCore::Shape::createRasterShape):
-        (WebCore::Shape::createBoxShape):
-        * rendering/shapes/Shape.h:
-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::ShapeOutsideInfo::computedShape):
</del><ins>+        (WebCore::isEqualToCSSCaseSensitiveIdentifier): Add variant to
+        IsEqualToCSSIdentifier that respects case-sensitivity.
+        (WebCore::CSSParser::realLex): Use the above method for CSS
+        variable declarations.
</ins><span class="cx"> 
</span><del>-2014-04-04  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+2013-05-27  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Remove outside-shape CSS value
-        https://bugs.webkit.org/show_bug.cgi?id=131201
</del><ins>+        drop-shadow filter with overflow:hidden child misbehaves.
+        https://bugs.webkit.org/show_bug.cgi?id=109783
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
-
-        Outside-shape is not a valid CSS value anymore. This patch removes it.
-
-        No new tests, existing tests are removed.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::shapePropertyValue):
-        * css/CSSValueKeywords.in:
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyShape::applyValue):
-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::ShapeOutsideInfo::computedShape):
-        (WebCore::ShapeOutsideInfo::isEnabledFor):
-        * rendering/style/ShapeValue.h:
-        (WebCore::ShapeValue::createOutsideValue): Deleted.
-
-2014-04-04  Dirk Schulze  &lt;krit@webkit.org&gt;
-
-        Gradient offsets are off if compositing operator != source-over
-        https://bugs.webkit.org/show_bug.cgi?id=129791
-
-        Reviewed by Andreas Kling.
-
-        Instead of transforming the path before drawing it on the context,
-        the whole context should be transformed. This will make the gradient
-        map correctly to the context space.
-
-        Test: fast/canvas/canvas-gradient-on-compositing.html
-
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::fullCanvasCompositedFill):
-
-2014-04-04  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Subpixel rendering: Move background images to device pixel boundaries.
-        https://bugs.webkit.org/show_bug.cgi?id=131144
-
</del><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        Replace integral snapping with device pixel snapping.
-        Background image geometry calculation uses LayoutUnits and we snap to device pixels right before painting.
</del><ins>+        Applying CSS filters only to the scrollbar rect leaves rendering
+        artefacts. Filters should skip such partial repaints.
</ins><span class="cx"> 
</span><del>-        Tests: fast/backgrounds/hidpi-bitmap-background-on-subpixel-position.html
-               fast/backgrounds/hidpi-bitmap-background-origin-on-subpixel-position.html
-               fast/backgrounds/hidpi-bitmap-background-repeat-on-subpixel-position.html
-               fast/backgrounds/hidpi-generated-gradient-background-on-subpixel-position.html
</del><ins>+        Tests: Test framework uses mock theme for scrollbars. Such scrollbars do not
+        initiate partial repaints.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setContentsTilePhase):
-        (WebCore::GraphicsLayer::contentsTilePhase):
-        (WebCore::GraphicsLayer::setContentsTileSize):
-        (WebCore::GraphicsLayer::contentsTileSize):
-        * platform/graphics/texmap/TextureMapperLayer.cpp:
-        (WebCore::TextureMapperLayer::setContentsTileSize):
-        (WebCore::TextureMapperLayer::setContentsTilePhase):
-        * platform/graphics/texmap/TextureMapperLayer.h:
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
-        (WebCore::CoordinatedGraphicsLayer::setContentsTileSize):
-        (WebCore::CoordinatedGraphicsLayer::setContentsTilePhase):
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsState.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::repaintLayerRectsForImage):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        (WebCore::resolveWidthForRatio):
-        (WebCore::resolveHeightForRatio):
-        (WebCore::resolveAgainstIntrinsicWidthOrHeightAndRatio):
-        (WebCore::resolveAgainstIntrinsicRatio):
-        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions):
-        (WebCore::RenderBoxModelObject::calculateFillTileSize):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setNoRepeatX):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setNoRepeatY):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::useFixedAttachment):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::clip):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::relativePhase):
-        (WebCore::getSpace):
-        (WebCore::RenderBoxModelObject::pixelSnapBackgroundImageGeometryForPainting):
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        (WebCore::RenderBoxModelObject::getGeometryForBackgroundImage):
-        (WebCore::RenderBoxModelObject::paintNinePieceImage):
-        (WebCore::applySubPixelHeuristicForTileSize): Deleted.
-        * rendering/RenderBoxModelObject.h:
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::destOrigin):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setDestOrigin):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::destRect):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setDestRect):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::phase):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setPhase):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::tileSize):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setTileSize):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::spaceSize):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setSpaceSize):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setPhaseX):
-        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setPhaseY):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundImage):
-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::getShapeImageAndRect):
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::setupFilters):
+        (WebCore::RenderLayer::paintLayerContents):
+        * rendering/RenderLayer.h:
+        (RenderLayer):
</ins><span class="cx"> 
</span><del>-2014-04-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2013-05-27  Xueqing Huang  &lt;huangxueqing@baidu.com&gt;
</ins><span class="cx"> 
</span><del>-        [Win] Unreviewed test fix (crash in debug build).
</del><ins>+        Move Windows port off legacy clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=116258
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::AVFWrapper::legibleOutputCallback): Correct assertion. This
-        callback is scheduled for the caption queue, not the main queue.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-04-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Clipboard refactor, no new tests.
</ins><span class="cx"> 
</span><del>-        [Win] Load Media Controls js/css from bundle
-        https://bugs.webkit.org/show_bug.cgi?id=131194
</del><ins>+        * dom/Clipboard.h:
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::createDraggingClipboard): Create Clipboard instead of ClipboardWin.
+        * platform/Pasteboard.h:
+        (WebCore::Pasteboard::dataObject): Get IDataObject by Clipborad.
+        (WebCore::Pasteboard::writableDataObject): Get WCDataObject by Clipborad.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::Clipboard::createDragImage): Change parameter name loc to dragLocation.
+        (WebCore::Clipboard::declareAndWriteDragImage): Implement declareAndWriteDragImage use WCDataObject exposed by Pasteboard.
+        * platform/win/ClipboardWin.h: Removed.
+        * platform/win/EditorWin.cpp:
+        (WebCore::Editor::newGeneralClipboard): Create Clipboard instead of ClipboardWin.
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::createForCopyAndPaste): Create a Pasteboard.
+        (WebCore::Pasteboard::createPrivate): Ditto.
+        (WebCore::Pasteboard::createForDragAndDrop): Ditto.
+        (WebCore::Pasteboard::finishCreatingPasteboard): Create Pasteboard use Windows API.
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::clipboardTypeFromMIMEType): Copied from ClipboardWin.cpp.
+        (WebCore::Pasteboard::clear): Ditto.
+        (WebCore::Pasteboard::hasData): Ditto.
+        (WebCore::addMimeTypesForFormat): Ditto.
+        (WebCore::Pasteboard::types): Ditto.
+        (WebCore::Pasteboard::readString): Ditto.
+        (WebCore::Pasteboard::readFilenames): Ditto.
+        (WebCore::writeURL): Ditto.
+        (WebCore::Pasteboard::writeString): Ditto.
+        (WebCore::Pasteboard::setDragImage): Ditto.
+        (WebCore::Pasteboard::writeRangeToDataObject): Write range to WCDataObject.
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainTextToDataObject): Write PlainText to WCDataObject.
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::pathRemoveBadFSCharacters): Copied from ClipboardWin.cpp.
+        (WebCore::filesystemPathFromUrlOrTitle): Ditto.
+        (WebCore::writeFileToDataObject): Ditto.
+        (WebCore::Pasteboard::writeURLToDataObject): Write URL to WCDataObject.
+        (WebCore::Pasteboard::writeURL): Copied from ClipboardWin.cpp.
+        (WebCore::Pasteboard::writePasteboard): Copied from Pasteboard::writeClipboard.
+        (WebCore::Pasteboard::documentFragment): Copied from ClipboardWin.cpp.
+        (WebCore::Pasteboard::setExternalDataObject): Clipboard can set new IDataObject.
+        (WebCore::getCachedImage): Copied from ClipboardWin.cpp.
+        (WebCore::createGlobalImageFileDescriptor): Ditto.
+        (WebCore::createGlobalImageFileContent): Ditto.
+        (WebCore::createGlobalHDropContent): Ditto.
+        (WebCore::Pasteboard::writeImageToDataObject): Expose to make Clipboard implement declareAndWriteDragImage.
+        (WebCore::Pasteboard::writeURLToWritableDataObject): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2013-05-27  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * DerivedSources.cpp: Remove no-longer generated file.
-        * DerivedSources.make: Don't generate unneeded files.
-        * WebCore.vcxproj/WebCore.vcxproj: Don't compile unneeded files.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-        * WebCore.vcxproj/copyWebCoreResourceFiles.cmd: Copy css/js to resource
-        * rendering/RenderThemeSafari.cpp:
-        * rendering/RenderThemeSafari.h:
-        * rendering/RenderThemeWin.cpp:
-        * rendering/RenderThemeWin.h:
</del><ins>+        PDFPlugin: Main-frame PDFPlugin Accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=116563
+        &lt;rdar://problem/13458534&gt;
</ins><span class="cx"> 
</span><del>-2014-04-04  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Region's behaviour not updated when becoming valid from invalid
-        https://bugs.webkit.org/show_bug.cgi?id=131211
</del><ins>+        * WebCore.exp.in: Export AffineTransform::mapRect.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+2013-05-27  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        When a region becomes valid again from invalid, it was part of a dependency cycle and the dependency cycle was broken,
-        it needs to behave like a valid region again: if it has autoheight then it should compute its height based on the
-        named flow content, if it has region styling then it should apply the additional style to the flowed content.
</del><ins>+        Checkbox UX update.
+        https://bugs.webkit.org/show_bug.cgi?id=116838.
</ins><span class="cx"> 
</span><del>-        Added a new method, updateRegionFlags, that is used to ensure that auto-height and region-styling flags
-        are properly set in several situations. Checking the behaviour, autoheight or styling, is done only
-        if the region is valid.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/auto-size/autoheight-region-valid-from-invalid.html
-               fast/regions/region-styling/region-withstyling-valid-from-invalid.html
</del><ins>+        BlackBerry PR 342302.
+        Internally Reviewed by Jeff Rogers.
+        Remove old background and change pressed checkmark image.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::updateRegionFlags):
-        (WebCore::RenderNamedFlowFragment::styleDidChange):
-        (WebCore::RenderNamedFlowFragment::updateRegionHasAutoLogicalHeightFlag):
-        (WebCore::RenderNamedFlowFragment::checkRegionStyle):
-        (WebCore::RenderNamedFlowFragment::attachRegion):
-        (WebCore::RenderNamedFlowFragment::detachRegion):
-        * rendering/RenderNamedFlowFragment.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::addFragmentToNamedFlowThread):
</del><ins>+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::RenderThemeBlackBerry::paintCheckbox):
</ins><span class="cx"> 
</span><del>-2014-04-04  Raphael Kubo da Costa  &lt;raphael.kubo.da.costa@intel.com&gt;
</del><ins>+2013-05-27  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [GTK][CMake] Remove FindXt.cmake.
-        https://bugs.webkit.org/show_bug.cgi?id=131227
</del><ins>+        When the background is completely transparent we should be conservative and use the default scrollbar style, not the light one
+        https://bugs.webkit.org/show_bug.cgi?id=116836
+        &lt;rdar://problem/13949905&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Use FindX11.cmake's Xt variables instead of our own FindXt.cmake's ones.
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::recalculateScrollbarOverlayStyle):
+        Don't use the light style when the background is completely transparent.
</ins><span class="cx"> 
</span><del>-2014-04-03  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-05-27  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Fast-path for casting JS wrappers to JSElement.
-        &lt;https://webkit.org/b/131210&gt;
</del><ins>+        Use ICU_INCLUDE_DIRS in BlackBerry CMake files
+        https://bugs.webkit.org/show_bug.cgi?id=116210
</ins><span class="cx"> 
</span><del>-        Add an extended JSType for Element wrappers so we can avoid walking
-        the ClassInfo chain in those bindings as well.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Generalized the code to select a casting helper in the bindings
-        generator into a function (GetCastingHelperForThisObject.)
-        Updated all the jsDynamicCast call sites to go through this, in case
-        there's an optimized cast available for the desired type.
</del><ins>+        Set and use the ICU_INCLUDE_DIRS variable to avoid
+        duplicated adding of the ICU include directory.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        * PlatformBlackBerry.cmake:
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWrapper.h:
-        * bindings/js/JSElementCustom.h: Added.
-        (WebCore::jsElementCast):
-        * bindings/js/JSNodeCustom.h:
-        (WebCore::jsNodeCast):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateHeader):
-        (GetCastingHelperForThisObject):
-        (GenerateImplementation):
-        * dom/Element.idl:
</del><ins>+2013-05-27  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-03  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Tighten FontGlyphs::glyphDataAndPageForCharacter to take FontDescription
+        https://bugs.webkit.org/show_bug.cgi?id=116823
</ins><span class="cx"> 
</span><del>-        Rebaseline a bindings test.
-
-        * bindings/scripts/test/JS/JSTestNode.h:
-        (WebCore::JSTestNode::createStructure):
-
-2014-04-03  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Fast-path for casting JS wrappers to JSNode.
-        &lt;https://webkit.org/b/131196&gt;
-
-        Add a way to quickly determine that a given JSObject is a JSNode.
-        This lets us avoid walking the ClassInfo chain in the DOM bindings
-        for WebCore::Node.
-
-        Reviewed by Mark Hahnenberg and Geoff Garen.
-
-        * bindings/js/JSDOMWrapper.h:
-
-            Added a JSNodeType constant that extends beyond JSC::JSType.
-
-        * bindings/js/JSNodeCustom.h:
-        (WebCore::jsNodeCast):
-
-            Added. Fast cast from JSValue to JSNode.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateHeader):
-        (GenerateImplementation):
-
-            Generate code that uses jsNodeCast in Node interfaces.
-
-2014-04-03  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        Merge ShapeInfo &amp; ShapeOutsideInfo now that ShapeInsideInfo is no more
-        https://bugs.webkit.org/show_bug.cgi?id=131180
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Now that ShapeInsideInfo is gone, having a class hiearachy and
-        templates doesn't make any sense. As a first step to cleaning up the
-        code, this remove ShapeInfo and puts all of its functionality into
-        ShapeOutsideInfo.
</del><ins>+        FontGlyphs does not need to know about Font anymore.
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+        * platform/graphics/Font.cpp:
+        (WebCore::Font::Font):
+        (WebCore::Font::operator=):
+        * platform/graphics/Font.h:
+        (WebCore::Font::isPlatformFont):
+        (WebCore::Font::glyphDataAndPageForCharacter):
+        (Font):
+        * platform/graphics/FontCache.h:
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontGlyphs::FontGlyphs):
+        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):
+        * platform/graphics/FontFallbackList.h:
+        (WebCore):
+        (WebCore::FontGlyphs::createForPlatformFont):
+        
+            Tweaked the name.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/shapes/ShapeInfo.cpp: Removed.
-        * rendering/shapes/ShapeInfo.h: Removed.
-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::ShapeOutsideInfo::computedShapePhysicalBoundingBox):
-        (WebCore::ShapeOutsideInfo::shapeToRendererPoint):
-        (WebCore::ShapeOutsideInfo::shapeToRendererSize):
-        (WebCore::referenceBox):
-        (WebCore::ShapeOutsideInfo::setReferenceBoxLogicalSize):
-        (WebCore::checkShapeImageOrigin):
-        (WebCore::getShapeImageAndRect):
-        (WebCore::getShapeImageMarginRect):
-        (WebCore::ShapeOutsideInfo::computedShape):
-        (WebCore::borderBeforeInWritingMode):
-        (WebCore::borderAndPaddingBeforeInWritingMode):
-        (WebCore::ShapeOutsideInfo::logicalTopOffset):
-        (WebCore::borderStartWithStyleForWritingMode):
-        (WebCore::borderAndPaddingStartWithStyleForWritingMode):
-        (WebCore::ShapeOutsideInfo::logicalLeftOffset):
-        (WebCore::ShapeOutsideInfo::computeSegmentsForLine):
-        (WebCore::ShapeOutsideInfo::updateDeltasForContainingBlockLine):
-        (WebCore::ShapeOutsideInfo::shapeValue): Deleted.
-        (WebCore::ShapeOutsideInfo::styleForWritingMode): Deleted.
-        * rendering/shapes/ShapeOutsideInfo.h:
</del><ins>+        (WebCore::FontGlyphs::isForPlatformFont):
+        
+            Move knowledge about platform font to FontGlyphs as it is needed for resolving system fallback on Mac.
</ins><span class="cx"> 
</span><del>-2014-04-03  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Fix over-retain in SharedBufferCF's createCFData().
-        &lt;https://webkit.org/b/131139&gt;
-
-        Constructing the return type (RetainPtr&lt;CFDataRef&gt;) will also retain
-        the pointee, so this would end up leaking.
-
-        Reviewed by Anders Carlsson.
-
-        * platform/cf/SharedBufferCF.cpp:
-        (WebCore::SharedBuffer::createCFData):
-
-2014-04-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [Win] Turn on ENABLE_CSS_GRID_LAYOUT
-        https://bugs.webkit.org/show_bug.cgi?id=131147
-
-        Reviewed by Simon Fraser.
-
-        Covered by existing fast/css/getComputedStyle tests.
-
-        * css/CSSAllInOne.cpp: Add CSSGridLineNamesValue.cpp when building
-        with ENABLE(CSS_GRID_LAYOUT)
-
-2014-04-03  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Pixelated WebView when display is changed from hiDPI to regularDPI
-        https://bugs.webkit.org/show_bug.cgi?id=131185
-
-        Reviewed by Tim Horton.
-
-        r166309 added a short circuit in GraphicsLayerCA::updateContentsScale()
-        when the scale didn't change. This broke layers which expected to
-        unconditionally receive a setContentsScale(), namely the WebTiledBackingLayer
-        which owns the TileController. WebTiledBackingLayer overrode -setContentsScale:
-        to pass the scale down to the TileController; however, it didn't override
-        -contentsScale, and it mucked with the scale passed in.
</del><ins>+        * platform/graphics/blackberry/FontCacheBlackBerry.cpp:
+        (WebCore::FontCache::systemFallbackForCharacters):
+        * platform/graphics/freetype/FontCacheFreeType.cpp:
+        (WebCore::FontCache::systemFallbackForCharacters):
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::systemFallbackForCharacters):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::systemFallbackForCharacters):
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::systemFallbackForCharacters):
+        * platform/graphics/wince/FontCacheWinCE.cpp:
+        (WebCore::FontCache::systemFallbackForCharacters):
</ins><span class="cx">         
</span><del>-        Fix by having setting and fetching contentsScale on a WebTiledBackingLayer
-        work as expected. Also rename the TileController functions to mirror the
-        CALayer functions better.
</del><ins>+            More descriptive name and tighter interface.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateContentsScale):
-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::TileController):
-        (WebCore::TileController::contentsScale):
-        (WebCore::TileController::setContentsScale):
-        (WebCore::TileController::scale): Deleted.
-        (WebCore::TileController::setScale): Deleted.
-        * platform/graphics/ca/mac/WebTiledBackingLayer.mm:
-        (-[WebTiledBackingLayer setContentsScale:]):
-        (-[WebTiledBackingLayer contentsScale]):
</del><ins>+2013-05-27  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-03  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+        [CSSRegions] Prevent unnecessary copy of LayoutRect objects
+        https://bugs.webkit.org/show_bug.cgi?id=116828
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] LineSegment logicalLeft and logicalRight members should be floats
-        https://bugs.webkit.org/show_bug.cgi?id=116160
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling. 
</del><ins>+        Use const references for parameter passing.
+        No functional change, no new tests.
</ins><span class="cx"> 
</span><del>-        LineSegment edges should not have been changed to LayoutUnit. These are
-        used only as floats. I modified them back to floats. 
</del><ins>+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintFlowThreadPortionInRegion):
+        (WebCore::RenderFlowThread::hitTestFlowThreadPortionInRegion):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::overflowRectForFlowThreadPortion):
+        * rendering/RenderRegion.h:
</ins><span class="cx"> 
</span><del>-        No new tests are needed, no behavior change.
</del><ins>+2013-05-27  Leo Yang  &lt;leoyang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/Shape.h:
</del><ins>+        [BlackBerry] Reveal HTTP error code for XHR even if there is no response body
+        https://bugs.webkit.org/show_bug.cgi?id=116543
</ins><span class="cx"> 
</span><del>-2014-04-03  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        Reviewed by Rob Buis.
+        Reviewed internally by Joe Mason.
</ins><span class="cx"> 
</span><del>-        [CG] Canvas lineDashOffset does not handle negative numbers correctly
-        https://bugs.webkit.org/show_bug.cgi?id=80560
</del><ins>+        It's a regression introduced by r132556.
+        BlackBerry is doing friendly HTTP error handling: if there is no response body
+        for an HTTP error it will display an error message made by the port. But for a
+        XHR request, which usually does not result in displaying error messages to the
+        end user, HTTP error code should be revealed to let the JavaScript know what
+        the actual server error code is.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Covered by existing tests:
+        ManualTests/blackberry/head-xhr-nonexistant-file.html
+        LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-check-head-readystate-for-404.html
+        LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-check-get-readystate-for-404-without-body.html
</ins><span class="cx"> 
</span><del>-        CG ignores negative dash array offsets. Check if we have a negative offset, if yes
-        then calculate the length of the dash array and modulo the dash array offset with
-        the dash array length.
</del><ins>+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::shouldNotifyClientFailed):
</ins><span class="cx"> 
</span><del>-        Test: fast/canvas/canvas-negative-lineDashOffset.html
</del><ins>+2013-05-27  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::setLineDash):
</del><ins>+        Adjust date input width.
+        https://bugs.webkit.org/show_bug.cgi?id=100760.
</ins><span class="cx"> 
</span><del>-2014-04-03  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        REGRESSION: fast/css/relative-positioned-block-nested-with-inline-parent-multiple-descendant-blocks-dynamic.html broken
-        https://bugs.webkit.org/show_bug.cgi?id=131183
</del><ins>+        BlackBerry PR 343497.
+        Internally Reviewed by Jeff Rogers.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Set width to auto to fit the string length.
</ins><span class="cx"> 
</span><del>-        Revert the loop to continue rather than breaking when an invalid block is encountered.
-        This is what it used to do if it encountered a non-continuation block.
</del><ins>+        * css/themeBlackBerry.css:
+        (input[type=&quot;date&quot;], input[type=&quot;datetime&quot;], input[type=&quot;datetime-local&quot;], input[type=&quot;time&quot;], input[type=&quot;month&quot;]):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderInline.cpp:
-        (WebCore::updateStyleOfAnonymousBlockContinuations):
</del><ins>+2013-05-27  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Document::setHoveredNode() should be setHoveredElement().
+        &lt;http://webkit.org/b/116819&gt;
</ins><span class="cx"> 
</span><del>-        Harden FilterOperation type casting
-        https://bugs.webkit.org/show_bug.cgi?id=131142
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Only Elements can be hovered, teach Document about this.
</ins><span class="cx"> 
</span><del>-        DefaultFilterOperation had an error-prone behavior where it set the base class
-        OperationType to the type of some other filter class, but overrode isDefault(). 
-        This made it very easy to write incorrect code that casted incorrectly based on type().
-        
-        Fix by making adding a DEFAULT filter operation type, and storing the represented
-        type on DefaultFilterOperation().
-        
-        Also remove the OperationType argument for constructors of FilterOperations that
-        can only be of one type, to avoid possible mistakes.
-        
-        Make the type cast macros a bit more normal, and use them in a few places.
-        
-        Fixed PlatformCAFiltersMac to handle the default filter case more cleanly.
</del><ins>+        * dom/Document.h:
+        * dom/Document.cpp:
+        (WebCore::Document::dispose):
+        (WebCore::Document::detach):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::valueForFilter):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::createFilterOperations):
-        * platform/graphics/ca/PlatformCAFilters.h:
-        * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
-        (PlatformCAFilters::filterValueForOperation):
-        (PlatformCAFilters::colorMatrixValueForFilter):
-        * platform/graphics/filters/FilterOperation.cpp:
-        (WebCore::DefaultFilterOperation::operator==):
-        (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
-        (WebCore::ReferenceFilterOperation::operator==):
-        (WebCore::BlurFilterOperation::operator==):
-        (WebCore::BlurFilterOperation::blend):
-        (WebCore::DropShadowFilterOperation::operator==):
-        (WebCore::DropShadowFilterOperation::blend):
-        * platform/graphics/filters/FilterOperation.h:
-        (WebCore::FilterOperation::blend):
-        (WebCore::FilterOperation::type):
-        (WebCore::FilterOperation::isBasicColorMatrixFilterOperation):
-        (WebCore::FilterOperation::isBasicComponentTransferFilterOperation):
-        (WebCore::FilterOperation::isSameType):
-        (WebCore::DefaultFilterOperation::create):
-        (WebCore::DefaultFilterOperation::representedType):
-        (WebCore::DefaultFilterOperation::DefaultFilterOperation):
-        (WebCore::ReferenceFilterOperation::create):
-        (WebCore::BlurFilterOperation::create):
-        (WebCore::BlurFilterOperation::BlurFilterOperation):
-        (WebCore::DropShadowFilterOperation::create):
-        (WebCore::DropShadowFilterOperation::DropShadowFilterOperation):
-        (WebCore::FilterOperation::isDefault): Deleted.
-        * platform/graphics/filters/FilterOperations.cpp:
-        (WebCore::FilterOperations::outsets):
-        * rendering/FilterEffectRenderer.cpp:
-        (WebCore::FilterEffectRenderer::build):
-        * rendering/RenderLayerFilterInfo.cpp:
-        (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
</del><ins>+            m_hoverNode =&gt; m_hoveredElement.
+            Removed hoverNode() and setHoverNode() since those were only used internally.
</ins><span class="cx"> 
</span><del>-2014-04-03  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        (WebCore::Document::updateHoverActiveState):
</ins><span class="cx"> 
</span><del>-        Stop throwing away the Document's StyleResolver on a timer.
-        &lt;https://webkit.org/b/131168&gt;
-        &lt;rdar://problem/15227045&gt;
</del><ins>+            Updated for hovered things always being Elements.
</ins><span class="cx"> 
</span><del>-        This was causing some unfortunate pauses when returning to idle pages
-        after a long-ish time. There's already a mechanism in place that will
-        throw these away if the system comes under memory pressure.
</del><ins>+        (WebCore::Document::hoveredElementDidDetach):
+        * dom/Element.cpp:
+        (WebCore::Element::detach):
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            Renamed Document::hoveredNodeDetached() to hoveredElementDidDetach() and fix it up
+            following the same pattern as elementInActiveChainDidDetach().
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::styleForElement):
-        (WebCore::StyleResolver::styleForKeyframe):
-        (WebCore::StyleResolver::pseudoStyleForElement):
-        (WebCore::StyleResolver::styleForPage):
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::didAccessStyleResolver): Deleted.
-        (WebCore::Document::styleResolverThrowawayTimerFired): Deleted.
-        * dom/Document.h:
</del><ins>+2013-05-27  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        [Qt] REGRESSION(r150716): It made 15 inspector and 1 mozilla test to assert
+        https://bugs.webkit.org/show_bug.cgi?id=116822
</ins><span class="cx"> 
</span><del>-        Assertion under RenderLayerCompositor::updateScrollCoordinatedLayer on time.com on iOS
-        https://bugs.webkit.org/show_bug.cgi?id=131150
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+        The input fontDescription may have more than one family defined.
</ins><span class="cx"> 
</span><del>-        When calling updateScrollCoordinatedLayer() under styleChanged, we haven't done
-        layout yet so our composting layers haven't been hooked together. Don't try
-        to add a zero nodeID to the map in this case.
</del><ins>+        * platform/qt/RenderThemeQStyle.cpp:
+        (WebCore::RenderThemeQStyle::adjustButtonStyle):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
</del><ins>+2013-05-27  Jocelyn Turcotte  &lt;jocelyn.turcotte@digia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-03  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        [Qt][Win] Input events aren't mapped properly with windowless plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=116094
</ins><span class="cx"> 
</span><del>-        Continuations casting issue.
-        https://bugs.webkit.org/show_bug.cgi?id=130057
-        &lt;rdar://problem/16283406&gt;
</del><ins>+        Reviewed by Tor Arne Vestbø.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        The events are first sent properly but Flash then immediately repaints
+        and this causes flickering painting.
+        The issue is that Flash seems to be doing some input event tracking of
+        its own internally, using the HWND returned through NPN_GetValue(NPNVnetscapeWindow).
</ins><span class="cx"> 
</span><del>-        The code to update relative positioned anonymous block continuations should not
-        have assumed that all siblings were RenderBlocks. Make the code smarter and
-        make it bail when it hits something that isn't part of the block continuation
-        chain.
</del><ins>+        We are currently using two coordinate systems for windowless plugins on Windows with Qt:
+        - FrameView coordinates: Used for input events and ajusted with the WM_WINDOWPOSCHANGED message
+        - Drawable coordinates: Used by WM_PAINT and adjusted with NPP_SetWindow
</ins><span class="cx"> 
</span><del>-        Added fast/block/continuation-crash.html
</del><ins>+        This patch fixes the bug by mapping input events to the native window returned
+        as NPNVnetscapeWindow instead of the FrameView to ensure that those coordinates will match
+        the ones used by Flash internally.
+        With this we shouldn't be using FrameView coordinates anywhere for windowless plugins
+        on Windows with Qt.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderInline.cpp:
-        (WebCore::updateStyleOfAnonymousBlockContinuations):
</del><ins>+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient):
+          Added mapToOwnerWindow to the interface, mapping from the FrameView up to the wrapping nativeParentWidget.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::contentsToNativeWindow):
+        (WebCore::PluginView::paintIntoTransformedContext):
+        (WebCore::PluginView::handleMouseEvent):
</ins><span class="cx"> 
</span><del>-2014-04-03  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+2013-05-27  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] CRASH with calc() value args in inset round
-        https://bugs.webkit.org/show_bug.cgi?id=129816
</del><ins>+        Tighten FontGlyphs interfaces to take FontDescription instead of Font
+        https://bugs.webkit.org/show_bug.cgi?id=116818
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        The code to parse the inset rounded corners was adding the parser
-        value arguments to a temporary CSSParserValueList. Unfortunately,
-        CSSParserValueList expects to own the values it contains, and it frees
-        the values it contains when the list is destroyed. This was a problem
-        because the values are owned by the CSSParserValueList passed in to
-        parseInsetRoundedCorners, and thus the calc's argument list would get
-        double freed, resulting in a crash. This patch fixes this by using a
-        Vector to hold the pointers instead.
</del><ins>+        This gives better understanding of what the actual inputs are.
</ins><span class="cx"> 
</span><del>-        Test: fast/shapes/shape-outside-floats/shape-outside-inset-round-calc-crash.html
</del><ins>+        * WebCore.exp.in:
+        * platform/graphics/Font.h:
+        (WebCore::Font::primaryFont):
+        (WebCore::Font::fontDataAt):
+        (WebCore::Font::isFixedPitch):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::getFontData):
+        * platform/graphics/FontCache.h:
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontGlyphs::determinePitch):
+        (WebCore::FontGlyphs::realizeFontDataAt):
+        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):
+        * platform/graphics/FontFallbackList.h:
+        (WebCore::FontGlyphs::primaryFontData):
+        (WebCore::FontGlyphs::isFixedPitch):
+        (WebCore::FontGlyphs::primarySimpleFontData):
+        * platform/graphics/blackberry/FontCacheBlackBerry.cpp:
+        * platform/graphics/freetype/FontCacheFreeType.cpp:
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::similarFontPlatformData):
+        
+            Drop get* naming and make this Mac only as no other platform has it.
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseInsetRoundedCorners):
</del><ins>+        * platform/graphics/qt/FontCacheQt.cpp:
+        * platform/graphics/win/FontCacheWin.cpp:
+        * platform/graphics/wince/FontCacheWinCE.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-2014-04-03  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-05-27  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Leaving a streaming movie by going &quot;Back&quot; keeps playing the audio
-        https://bugs.webkit.org/show_bug.cgi?id=131149
</del><ins>+        Strengthen typing of detaching an Element from Document's :active chain.
+        &lt;http://webkit.org/b/116815&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        When stopping a HTMLMediaElement, call userCancelledLoad() (which clears the
-        MediaPlayer) only after calling setPausedInternal() (which pauses the MediaPlayer).
-        Previously, and in the reverse order, the MediaPlayer would never get a chance to pause
-        before being cleared. There is an underlying error with the QTKit media engine which
-        is causing it to continue playing even after its last reference is released, but this
-        does fix the symptom of playback continuing even after stopping.
</del><ins>+        Tiny cleanup now that the :active chain can only contain elements.
+        Rename Document::activeChainNodeDetached() to elementInActiveChainDidDetach().
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::stop):
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::detach):
+        * dom/Document.h:
+        * dom/Document.cpp:
+        (WebCore::Document::elementInActiveChainDidDetach):
</ins><span class="cx"> 
</span><del>-2014-04-03  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Rename, take Element*, remove silly condition that was always true.
</ins><span class="cx"> 
</span><del>-        [EME] Crash when passing a NULL initData to MediaKeys.createSession()
-        https://bugs.webkit.org/show_bug.cgi?id=131156
</del><ins>+2013-05-27  Andrei Bucur  &lt;abucur@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        [CSS Regions] Remove the offsetFromLogicalTopOfFirstPage parameter from layout functions
+        https://bugs.webkit.org/show_bug.cgi?id=116441
</ins><span class="cx"> 
</span><del>-        Update the checks at the start of createSession() to match the current spec, notably
-        bailing early if the initData parameter is NULL or empty.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * Modules/encryptedmedia/MediaKeys.cpp:
-        (WebCore::MediaKeys::createSession):
</del><ins>+        The patch changes the following things:
+        - exposes offsetFromLogicalTopOfFirstPage() to all the RenderBoxes;
+        - offsetFromLogicalTopOfFirstPage() is now safe to call from any box inside a flow thread, not only the
+        currently being laid out;
+        - removes the offsetFromLogicalTopOfFirstPage parameter from all the layout functions
+        that didn't actually required it; when the value is necessary, the offsetFromLogicalTopOfFirstPage
+        function is called instead;
+        - RenderFlowThread now handles its own logic for obtaining the offset from logical top of the first
+        region for a box, based on the layout states pushed on RenderView; it provides a better caching mechanism
+        that can be used for all the ancestor containing blocks of the current box being laid out.
</ins><span class="cx"> 
</span><del>-2014-04-03  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        The RenderBoxRegionInfo structures are cached only based on the box and the region. This means that
+        passing around a value for offsetFromLogicalTopOfFirstPage different in some cases than others was
+        risky. If there is a possibility of having a different box info result for a different offset
+        then the cache is not working correctly.
</ins><span class="cx"> 
</span><del>-        [iOS] add missing QuickTime plug-in replacement API
-        https://bugs.webkit.org/show_bug.cgi?id=131042
</del><ins>+        Tests: No function change, no tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        (WebCore::RenderBlock::getClearDelta):
+        (WebCore::RenderBlock::lineWidthForPaginatedLineChanged):
+        (WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage):
+        (WebCore::RenderBlock::logicalWidthChangedInRegions):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::availableLogicalWidthForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::startOffsetForLine):
+        (WebCore::RenderBlock::endOffsetForLine):
+        (WebCore::RenderBlock::availableLogicalWidthForContent):
+        (WebCore::RenderBlock::startOffsetForContent):
+        (WebCore::RenderBlock::endOffsetForContent):
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::borderBoxRectInRegion):
+        (WebCore::RenderBox::constrainLogicalWidthInRegionByMinMax):
+        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
+        (WebCore::RenderBox::containingBlockLogicalWidthForContentInRegion):
+        (WebCore::RenderBox::containingBlockAvailableLineWidthInRegion):
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
+        (WebCore::RenderBox::renderBoxRegionInfo):
+        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
+        (WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
+        (WebCore::computeInlineStaticDistance):
+        (WebCore::RenderBox::computePositionedLogicalWidth):
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
+        (WebCore::RenderBox::computePositionedLogicalHeight):
+        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+        (WebCore::RenderBox::offsetFromLogicalTopOfFirstPage):
+        * rendering/RenderBox.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computeMainAxisExtentForChild):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock):
+        (WebCore::RenderFlowThread::hasCachedOffsetFromLogicalTopOfFirstRegion):
+        (WebCore::RenderFlowThread::cachedOffsetFromLogicalTopOfFirstRegion):
+        (WebCore::RenderFlowThread::setOffsetFromLogicalTopOfFirstRegion):
+        (WebCore::RenderFlowThread::clearOffsetFromLogicalTopOfFirstRegion):
+        (WebCore::RenderFlowThread::currentActiveRenderBox):
+        (WebCore::RenderFlowThread::pushFlowThreadLayoutState):
+        (WebCore::RenderFlowThread::popFlowThreadLayoutState):
+        (WebCore::RenderFlowThread::offsetFromLogicalTopOfFirstRegion):
+        (WebCore::RenderFlowThread::adjustedPositionRelativeToOffsetParent):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::updateLogicalWidth):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::pushLayoutState):
+        (WebCore::RenderView::pushLayoutStateForCurrentFlowThread):
+        (WebCore::RenderView::popLayoutStateForCurrentFlowThread):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::pushLayoutState):
+        (WebCore::RenderView::popLayoutState):
</ins><span class="cx"> 
</span><del>-        Rename QuickTimePluginReplacement.cpp to QuickTimePluginReplacement.mm to make it possible
-        to use the ObjC JSC API.
-        * Modules/plugins/QuickTimePluginReplacement.cpp:
-        * Modules/plugins/QuickTimePluginReplacement.h:
-        (WebCore::QuickTimePluginReplacement::parentElement):
-        * Modules/plugins/QuickTimePluginReplacement.idl:
</del><ins>+2013-05-27  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/plugins/QuickTimePluginReplacement.js:
-        (Replacement.prototype.timedMetadataUpdates): Implement.
-        (Replacement.prototype.accessLog): Ditto.
-        (Replacement.prototype.errorLog): Ditto.
</del><ins>+        Active DOM objects stopped twice
+        https://bugs.webkit.org/show_bug.cgi?id=116524
</ins><span class="cx"> 
</span><del>-        Use the JSC ObjC API to create a JavaScript object from an array of AVMetadataItems. The
-        JSC ObjC API supports basic NSTypes, but an AVMetadataItem can also contain NSData which 
-        the existing plug-in returns as base-64 encoded data, so create wrappers for NSDictionary
-        and NSArray.
-        * Modules/plugins/QuickTimePluginReplacement.mm: Copied from Source/WebCore/Modules/plugins/QuickTimePluginReplacement.cpp.
-        (WebCore::QuickTimePluginReplacement::ensureReplacementScriptInjected): Disambiguate with &quot;JSC::&quot;
-        (WebCore::QuickTimePluginReplacement::installReplacement): Ditto.
-        (WebCore::jsValueWithDataInContext): Create JSValue* from NSData.
-        (WebCore::jsValueWithArrayInContext): Create JSValue* from NSArray.
-        (WebCore::jsValueWithDictionaryInContext): Create JSValue* from NSDictionary.
-        (WebCore::jsValueWithValueInContext): Create JSValue* from basic NSTypes plus AVMetadataItem
-            and NSData.
-        (WebCore::jsValueWithAVMetadataItemInContext): Create JSValue* from AVMetadataItem.
-        (WebCore::JSQuickTimePluginReplacement::timedMetaData): Script interface.
-        (WebCore::JSQuickTimePluginReplacement::accessLog): Ditto.
-        (WebCore::JSQuickTimePluginReplacement::errorLog): Ditto.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj: QuickTimePluginReplacement.cpp -&gt; QuickTimePluginReplacement.mm.
</del><ins>+        Only iterate over all active DOM object to stop them once.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::timedMetadata): iOS only accessor.
-        (WebCore::MediaPlayer::accessLog): Ditto.
-        (WebCore::MediaPlayer::errorLog): Ditto.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
</del><ins>+        To ensure later created active DOM objects are stopped,
+        suspendActiveDOMObjectIfNeeded now also stops active DOM objects
+        if needed. This also fixes an existing bug when active DOM
+        objects were created after stopActiveDOMObjects had been called.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::timedMetadata):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::accessLog):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::errorLog):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive):
-        (WebCore::itemKVOProperties):
-        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]):
</del><ins>+        Two existing tests creates new active DOM objects after stopActiveDOMObjects
+        has been called:
+            fast/dom/xmlhttprequest-constructor-in-detached-document.html
+            fast/dom/Window/timer-null-script-execution-context.html
</ins><span class="cx"> 
</span><del>-2014-04-03  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::stopActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendActiveDOMObjectIfNeeded):
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Include region range information when printing the render tree
-        https://bugs.webkit.org/show_bug.cgi?id=131159
</del><ins>+2013-05-27  Charles Wei  &lt;charles.wei@torchmobile.com.cn&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+        Remove redundant CachedRawResource::loader()
+        https://bugs.webkit.org/show_bug.cgi?id=116805
</ins><span class="cx"> 
</span><del>-        With this change showRenderObject() will print the region range for objects inside
-        a flow thread. The format is:
-        Rs: &lt;startRegion&gt; Re: &lt;endRegion&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Because this can be called anytime during debugging, it's necessary to disable the
-        current flow thread caching to prevent using the wrong flow thread for an object.
</del><ins>+        Just remove redundant code, no test case needed.
</ins><span class="cx"> 
</span><del>-        Tests: No new tests, no functional change.
</del><ins>+        * loader/cache/CachedRawResource.cpp:
+        * loader/cache/CachedRawResource.h:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.cpp:
-        (WebCore::CurrentRenderFlowThreadDisabler::CurrentRenderFlowThreadDisabler):
-        (WebCore::CurrentRenderFlowThreadDisabler::~CurrentRenderFlowThreadDisabler):
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::showRegionsInformation): Added.
-        (WebCore::RenderObject::showRenderObject):
-        * rendering/RenderObject.h:
</del><ins>+2013-05-27  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-03  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        WinCE build TLC: Node::active() moved to Element.
</ins><span class="cx"> 
</span><del>-        RenderSnapshottedPlugIn::paint should use iterator for traversal.
-        https://bugs.webkit.org/show_bug.cgi?id=131158
</del><ins>+        * rendering/RenderThemeWinCE.cpp:
+        (WebCore::RenderThemeWinCE::paintSearchFieldCancelButton):
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2013-05-26  Jaehun Lim  &lt;ljaehun.lim@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderSnapshottedPlugIn.cpp:
-        (WebCore::RenderSnapshottedPlugIn::paint):
</del><ins>+        CSSParser::parseImageResolution doesn't need a parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=116755
</ins><span class="cx"> 
</span><del>-2014-03-27  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
-
-        [CSS Grid Layout] &lt;string&gt; not allowed in grid-{area | row | column} syntax
-        https://bugs.webkit.org/show_bug.cgi?id=129713
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Grid positioning properties no longer accept &lt;string&gt; values for
-        named grid lines as they did in previous versions of the specs. They
-        were first replaced by &lt;ident&gt; and since the beginning of 2014 they
-        should only accept &lt;custom-ident&gt;.
</del><ins>+        parseImageResolution() can get CSSPraserValueList from m_valueList directly.
</ins><span class="cx"> 
</span><del>-        Updated the parser and the style resolver to this new syntax. Also
-        updated the tests accordingly.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/grid-container-change-named-grid-lines-recompute-child.html
-
</del><span class="cx">         * css/CSSParser.cpp:
</span><del>-        (WebCore::isValidCustomIdent): New function that checks that the
-        &lt;custom-ident&gt; is valid.
-        (WebCore::CSSParser::parseIntegerOrCustomIdentFromGridPosition):
-        (WebCore::CSSParser::parseGridPosition):
-        (WebCore::CSSParser::parseIntegerOrStringFromGridPosition):
-        Replaced by WebCore::CSSParser::parseIntegerOrCustomIdentFromGridPosition.
</del><ins>+        (WebCore::CSSParser::parseImageResolution):
</ins><span class="cx">         * css/CSSParser.h:
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::createGridPosition):
</del><span class="cx"> 
</span><del>-2014-04-03  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-05-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Crash after mutating after pseudo style
-        https://bugs.webkit.org/show_bug.cgi?id=130881
</del><ins>+        Turn TreeScope::focusedNode() into focusedElement().
+        &lt;http://webkit.org/b/116802&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Test: fast/css/pseudo-after-crash.html
</del><ins>+        For the hundredth time, only Elements can be focused!
</ins><span class="cx"> 
</span><del>-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::updateBeforeOrAfterPseudoElement):
-        
-            Invalidate the cached renderer for pseudo elements too.
-    
-        (WebCore::Style::needsPseudeElement): Deleted.
-        
-            Fix spelling.
</del><ins>+        This change mostly reverts r121079 since that made things unnecessarily complicated
+        just to tweak the behavior of ShadowRoot.activeElement, an API that we don't expose.
+        Finding a TreeScope's focused element now does a simple walk up the parent chain instead
+        of running the full Shadow DOM re-targeting algorithm.
</ins><span class="cx"> 
</span><del>-2014-04-02  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        (WebCore::TreeScope::focusedElement):
</ins><span class="cx"> 
</span><del>-        AX: AccessibilityObject::children() returns invalid results sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=130563
</del><ins>+            Simplify and return Element* instead of Node*.
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        * dom/TreeScope.h:
+        * dom/TreeScope.cpp:
+        (WebCore::focusedFrameOwnerElement):
</ins><span class="cx"> 
</span><del>-        Allow the DOM inspector to handle AX objects that do not have Node equivalents
-        (e.g. anonymous renderers).
</del><ins>+            Make this return Element* as the name already suggested.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::processAccessibilityChildren):
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/InspectorDOMAgent.h:
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::removeFocusedNodeOfSubtree):
+        * dom/Element.cpp:
+        (WebCore::Element::blur):
+        * dom/ShadowRoot.h:
+        (WebCore::ShadowRoot::activeElement):
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::activeElement):
</ins><span class="cx"> 
</span><del>-2014-04-02  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            Simplified call sites that were paranoid about getting a non-Element focused node.
</ins><span class="cx"> 
</span><del>-        Sandbox violation in NetworkProcess when uploading a bundle
-        https://bugs.webkit.org/show_bug.cgi?id=131133
</del><ins>+2013-05-26  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+        Plugins with no src but valid type should not snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=116799
+        &lt;rdar://problem/13695911&gt;
</ins><span class="cx"> 
</span><del>-        Track generated file ownership explicitly, so that each copy of FormData would know
-        whether to delete the file.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        This part is needed to prevent asserting in FormData destructor in NetworkProcess,
-        because it doesn't delete the files. Also, some cleanup.
</del><ins>+        There are a few plug-ins around that don't take any source content
+        via the src attribute, but rather just load the binary based on the
+        mime-type. In those cases we shouldn't snapshot until we have a
+        mechanism to do so.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Don't export FormData::removeGeneratedFilesIfNeeded(), WebKit2
-        doesn't need it any more.
-        * platform/network/FormData.cpp: Removed m_hasGeneratedFiles. There is no problem
-        iterating over FormDataElements to compute it, and that's more robust when FormDatas
-        are passed or stored on disk permanently.
-        Updated touched functions to use C++ iteration, and renamed &quot;e&quot; to &quot;element&quot;.
-        (WebCore::FormData::encode): Keep encoding a boolean for hasGeneratedFiles, because
-        the encoded FormData can be stored persitently, and we can't change the format.
</del><ins>+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn):
+            Add MIMEType logging, and detect the case of no src but valid type.
+        * html/HTMLPlugInImageElement.h: Add another SnapshotReason enum for
+            this special case.
</ins><span class="cx"> 
</span><del>-        * platform/network/FormData.h: (WebCore::FormDataElement::FormDataElement):
-        Added m_ownsGeneratedFile. FormData will only delete files it owns. Since files
-        are generated immediately before form submission, it's always the FormData being
-        submitted that owns the generated files.
</del><ins>+2013-05-26  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        Encapsulate FontGlyphs
+        https://bugs.webkit.org/show_bug.cgi?id=116803
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Use RenderStyle::hasFlowInto when needed
-        https://bugs.webkit.org/show_bug.cgi?id=131092
-
-        Reviewed by Andrei Bucur.
-
-        Add hasFlowInto() helper method on RenderStyle to be used
-        instead of directly checking the presence or absence of flowThread value.
-        No new functionality, no new tests.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * dom/Element.cpp:
-        (WebCore::Element::shouldMoveToFlowThread):
-        * rendering/style/RenderStyle.h:
-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::isRendererReparented):
-
-2014-04-02  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        CSS JIT: the adjacent position is never reset
-        https://bugs.webkit.org/show_bug.cgi?id=131145
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Corresponding radar: &lt;rdar://problem/16440036&gt;. The backtracking action would use a tail
-        when not needed.
</del><ins>+        FontGlyphs is unfriending Font. Give it a real class interface and some actual code.
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/multiple-adjacent-chain-without-adjacent-tail.html
</del><ins>+        * platform/graphics/Font.cpp:
+        (WebCore::Font::Font):
+        * platform/graphics/Font.h:
+        (WebCore::Font::glyphDataForCharacter):
+        (WebCore::Font::glyphDataAndPageForCharacter):
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontGlyphs::FontGlyphs):
+        (WebCore::isInRange):
+        (WebCore::shouldIgnoreRotation):
+        (WebCore::glyphDataAndPageForNonCJKCharacterWithGlyphOrientation):
+        
+            Helpers from FontFastPath.cpp.
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::updateChainStates):
</del><ins>+        (WebCore::FontGlyphs::glyphDataAndPageForCharacter):
+        
+            This is the primary interface. The code moves here from FontFastPath.cpp.
</ins><span class="cx"> 
</span><del>-2014-04-02  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * platform/graphics/FontFallbackList.h:
+        (WebCore::FontGlyphs::createForPlatformData):
+        
+            Remove setPlatformData in favor of constructor.
</ins><span class="cx"> 
</span><del>-        Speculative build fix for Windows.
</del><ins>+        (WebCore::FontGlyphs::primarySimpleFontData):
+        * platform/graphics/FontFastPath.cpp:
+        * platform/graphics/GraphicsContext.h:
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make: Make sure we generate our media control
-        scripts for Apple Windows (but not WinCairo)
</del><ins>+            Remove a stray function definition also called setPlatformFont().
</ins><span class="cx"> 
</span><del>-2014-04-02  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        * rendering/svg/SVGTextRunRenderingContext.cpp:
+        (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter):
</ins><span class="cx"> 
</span><del>-        Fix the !USE(IOSURFACE) iOS build.
</del><ins>+2013-05-26  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/MemoryPressureHandlerIOS.mm:
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
</del><ins>+        Remove a leftover CALENDAR_PICKER from LocaleNone.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=116800
</ins><span class="cx"> 
</span><del>-2014-04-02  Mark Rowe  &lt;mrowe@apple.com&gt;
</del><ins>+        Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        &lt;https://webkit.org/b/131136&gt; Remove FrameLoadRequest's m_lockHistory member since it's always false.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * platform/text/LocaleNone.cpp:
+        (LocaleNone):
</ins><span class="cx"> 
</span><del>-        * loader/FrameLoadRequest.cpp:
-        (WebCore::FrameLoadRequest::FrameLoadRequest):
-        * loader/FrameLoadRequest.h:
-        (WebCore::FrameLoadRequest::FrameLoadRequest):
-        (WebCore::FrameLoadRequest::lockHistory): Deleted.
-        (WebCore::FrameLoadRequest::setLockHistory): Deleted.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::load): Remove an if whose body was never executed.
</del><ins>+2013-05-26  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Mark Rowe  &lt;mrowe@apple.com&gt;
</del><ins>+        Rename FontFallbackList to FontGlyphs
+        https://bugs.webkit.org/show_bug.cgi?id=116797
</ins><span class="cx"> 
</span><del>-        &lt;https://webkit.org/b/131135&gt; Introduce LockHistory and LockBackForwardList enums to use in place of bools.
-
-        These arguments are often passed using literals at the call site, where the use of bools severely hinders
-        the readability of the code.
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::handleClick):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::submit):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::openURL):
-        (WebCore::HTMLFrameElementBase::setLocation):
-        * html/HTMLFrameElementBase.h:
-        * inspector/InspectorFrontendClientLocal.cpp:
-        (WebCore::InspectorFrontendClientLocal::openInNewTab):
-        * inspector/InspectorPageAgent.cpp:
-        (WebCore::InspectorPageAgent::navigate):
-        * loader/FormSubmission.cpp:
-        (WebCore::FormSubmission::FormSubmission):
-        (WebCore::FormSubmission::create):
-        * loader/FormSubmission.h:
-        (WebCore::FormSubmission::lockHistory):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::changeLocation):
-        (WebCore::FrameLoader::urlSelected):
-        (WebCore::FrameLoader::loadURLIntoChildFrame):
-        (WebCore::FrameLoader::loadFrameRequest):
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::loadWithNavigationAction):
-        (WebCore::FrameLoader::clientRedirected):
-        (WebCore::FrameLoader::loadPostRequest):
-        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy):
-        (WebCore::FrameLoader::loadDifferentDocumentItem):
-        * loader/FrameLoader.h:
-        * loader/FrameLoaderTypes.h:
-        * loader/NavigationScheduler.cpp:
-        (WebCore::ScheduledNavigation::ScheduledNavigation):
-        (WebCore::ScheduledNavigation::lockHistory):
-        (WebCore::ScheduledNavigation::lockBackForwardList):
-        (WebCore::ScheduledURLNavigation::ScheduledURLNavigation):
-        (WebCore::ScheduledRedirect::ScheduledRedirect):
-        (WebCore::ScheduledLocationChange::ScheduledLocationChange):
-        (WebCore::ScheduledRefresh::ScheduledRefresh):
-        (WebCore::ScheduledHistoryNavigation::ScheduledHistoryNavigation):
-        (WebCore::ScheduledFormSubmission::ScheduledFormSubmission):
-        (WebCore::NavigationScheduler::scheduleRedirect):
-        (WebCore::NavigationScheduler::mustLockBackForwardList):
-        (WebCore::NavigationScheduler::scheduleLocationChange):
-        (WebCore::NavigationScheduler::scheduleFormSubmission):
-        * loader/NavigationScheduler.h:
-        * loader/SubframeLoader.cpp:
-        (WebCore::SubframeLoader::requestFrame):
-        (WebCore::SubframeLoader::requestObject):
-        (WebCore::SubframeLoader::loadOrRedirectSubframe):
-        * loader/SubframeLoader.h:
-        * page/ContextMenuController.cpp:
-        (WebCore::openNewWindow):
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::setLocation):
-        (WebCore::DOMWindow::createWindow):
-        (WebCore::DOMWindow::open):
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler):
</del><ins>+        Maybe it was a fallback list once. Nowadays its purpose is to cache realized glyphs and related data.
+        
+        File renaming will be done separately.
</ins><span class="cx"> 
</span><del>-2014-04-02  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        Pool IOSurfaces to help with allocation cost
-        https://bugs.webkit.org/show_bug.cgi?id=131096
-        &lt;rdar://problem/15373942&gt;
-
-        Reviewed by Simon Fraser.
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        * platform/graphics/Font.cpp:
+        (WebCore::Font::Font):
+        (WebCore::Font::operator=):
+        (WebCore::Font::operator==):
</ins><span class="cx">         
</span><del>-        * platform/Timer.h:
-        (WebCore::TimerBase::startRepeating): Add a std::chrono startRepeating.
</del><ins>+            Refactored to early return style.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cg/IOSurfacePool.h: Added.
-        (WebCore::IOSurfacePool::CachedSurfaceDetails::CachedSurfaceDetails):
-        (WebCore::IOSurfacePool::CachedSurfaceDetails::resetLastUseTime):
-        * platform/graphics/cg/ImageBufferBackingStoreCache.cpp: Removed.
-        * platform/graphics/cg/ImageBufferBackingStoreCache.h: Removed.
-        * platform/graphics/cg/IOSurfacePool.cpp: Added.
-        (WebCore::IOSurfacePool::IOSurfacePool):
-        (WebCore::IOSurfacePool::sharedPool):
-        (WebCore::surfaceMatchesParameters):
-        (WebCore::IOSurfacePool::willAddSurface):
-        (WebCore::IOSurfacePool::didRemoveSurface):
-        (WebCore::IOSurfacePool::didUseSurfaceOfSize):
-        (WebCore::IOSurfacePool::takeSurface):
-        (WebCore::IOSurfacePool::addSurface):
-        (WebCore::IOSurfacePool::insertSurfaceIntoPool):
-        (WebCore::IOSurfacePool::setPoolSize):
-        (WebCore::IOSurfacePool::tryEvictInUseSurface):
-        (WebCore::IOSurfacePool::tryEvictOldestCachedSurface):
-        (WebCore::IOSurfacePool::evict):
-        (WebCore::IOSurfacePool::collectInUseSurfaces):
-        (WebCore::IOSurfacePool::markOlderSurfacesPurgeable):
-        (WebCore::IOSurfacePool::collectionTimerFired):
-        (WebCore::IOSurfacePool::scheduleCollectionTimer):
-        (WebCore::IOSurfacePool::discardAllSurfaces):
-        (WebCore::IOSurfacePool::showPoolStatistics):
-        Add a pool of IOSurfaces. It behaves as such:
</del><ins>+        (WebCore::Font::update):
+        (WebCore::Font::width):
+        * platform/graphics/Font.h:
+        (Font):
+        (WebCore::Font::glyphs):
+        (WebCore::Font::loadingCustomFonts):
+        (WebCore::Font::primaryFont):
+        (WebCore::Font::fontDataAt):
+        (WebCore::Font::isFixedPitch):
+        (WebCore::Font::fontSelector):
+        * platform/graphics/FontCache.h:
+        (FontCache):
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontGlyphs::FontGlyphs):
+        (WebCore::FontGlyphs::invalidate):
+        (WebCore::FontGlyphs::releaseFontData):
+        (WebCore::FontGlyphs::determinePitch):
+        (WebCore::FontGlyphs::realizeFontDataAt):
+        
+            Renamed for clarity along with m_fontList -&gt; m_realizedFontData.
</ins><span class="cx"> 
</span><del>-            - Keeps up to 64MB of surfaces.
-            - Keeps unused and in-use surfaces (but never gets more than 1/2 full with the latter)
-            - Marks surfaces purgeable after they've been unused for 2 seconds.
-            - Tries to move surfaces from the in-use pool to the unused pool every 500ms.
-            - Evicts in an LRU-ish fashion, interleaving eviction of the oldest
-              surfaces and the in-use surfaces (since in-use surfaces are not immediately
-              useful for the pool, but they are desirous because they were recently used).
-            - Throws everything away under memory pressure.
</del><ins>+        (WebCore::FontGlyphs::setPlatformFont):
+        * platform/graphics/FontFallbackList.h:
+        (FontGlyphs):
+        (WebCore::FontGlyphs::GlyphPagesStateSaver::GlyphPagesStateSaver):
+        (WebCore::FontGlyphs::GlyphPagesStateSaver::~GlyphPagesStateSaver):
+        (GlyphPagesStateSaver):
+        (WebCore::FontGlyphs::create):
+        (WebCore::FontGlyphs::~FontGlyphs):
+        (WebCore::FontGlyphs::primaryFontData):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataAndPageForCharacter):
+        * rendering/svg/SVGTextRunRenderingContext.cpp:
+        (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cocoa/IOSurface.mm:
-        (IOSurface::create):
-        Try to grab a surface from the IOSurfacePool.
</del><ins>+2013-05-26  Kent Tamura  &lt;tkent@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/MemoryPressureHandlerIOS.mm:
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
-        * platform/mac/MemoryPressureHandlerMac.mm:
-        (WebCore::MemoryPressureHandler::install):
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
-        Fix some includes, and throw away all surfaces when we're under memory pressure.
</del><ins>+        Remove ENABLE_CALENDAR_PICKER
+        https://bugs.webkit.org/show_bug.cgi?id=116795
</ins><span class="cx"> 
</span><del>-2014-04-02  Stephanie Lewis  &lt;slewis@apple.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Roll out http://trac.webkit.org/changeset/166144
-        &lt;rdar://problem/16481284&gt; PLT stops loading on news.google.com
</del><ins>+        This feature was used only by Chromium port.
</ins><span class="cx"> 
</span><del>-        Unreviewed rollout.
</del><ins>+        * Resources/pagepopups/calendarPicker.css: Removed.
+        * Resources/pagepopups/calendarPicker.js: Removed.
+        * css/html.css:
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::LocaleICU):
+        (WebCore):
+        * platform/text/LocaleICU.h:
+        (LocaleICU):
+        * platform/text/PlatformLocale.h:
+        (Locale):
+        * platform/text/mac/LocaleMac.h:
+        (LocaleMac):
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::LocaleMac::monthLabels):
+        * platform/text/win/LocaleWin.cpp:
+        (WebCore::LocaleWin::LocaleWin):
+        (WebCore::LocaleWin::monthLabels):
+        * platform/text/win/LocaleWin.h:
+        (LocaleWin):
</ins><span class="cx"> 
</span><del>-        Rollout 166144 since it prevents the PLT from completing.
</del><ins>+2013-05-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::suspendPostAttachCallbacks):
-        (WebCore::ContainerNode::resumePostAttachCallbacks):
-        (WebCore::ContainerNode::queuePostAttachCallback):
-        (WebCore::ContainerNode::postAttachCallbacksAreSuspended):
-        (WebCore::ContainerNode::dispatchPostAttachCallbacks):
-        * dom/ContainerNode.h:
-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle):
-        * dom/Element.h:
-        (WebCore::PostAttachCallbackDisabler::PostAttachCallbackDisabler):
-        (WebCore::PostAttachCallbackDisabler::~PostAttachCallbackDisabler):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseAttribute):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::focusPostAttach):
-        (WebCore::HTMLFormControlElement::didAttachRenderers):
-        (WebCore::updateFromElementCallback):
-        (WebCore::HTMLFormControlElement::didRecalcStyle):
-        * html/HTMLFrameOwnerElement.cpp:
-        (WebCore::needsStyleRecalcCallback):
-        (WebCore::HTMLFrameOwnerElement::scheduleSetNeedsStyleRecalc):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseAttribute):
-        (WebCore::HTMLObjectElement::shouldAllowQuickTimeClassIdQuirk):
-        (WebCore::HTMLObjectElement::hasValidClassId):
-        (WebCore::HTMLObjectElement::renderFallbackContent):
-        * html/HTMLObjectElement.h:
-        * html/HTMLPlugInImageElement.cpp:
-        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
-        (WebCore::HTMLPlugInImageElement::createElementRenderer):
-        (WebCore::HTMLPlugInImageElement::didAttachRenderers):
-        (WebCore::HTMLPlugInImageElement::willDetachRenderers):
-        (WebCore::HTMLPlugInImageElement::updateWidgetIfNecessary):
-        (WebCore::HTMLPlugInImageElement::didMoveToNewDocument):
-        (WebCore::HTMLPlugInImageElement::updateWidgetCallback):
-        (WebCore::HTMLPlugInImageElement::startLoadingImage):
-        (WebCore::HTMLPlugInImageElement::startLoadingImageCallback):
-        (WebCore::HTMLPlugInImageElement::createShadowIFrameSubtree):
-        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn):
-        (WebCore::HTMLPlugInImageElement::didRecalcStyle): Deleted.
-        (WebCore::HTMLPlugInImageElement::scheduleUpdateForAfterStyleResolution): Deleted.
-        (WebCore::HTMLPlugInImageElement::updateAfterStyleResolution): Deleted.
-        (WebCore::HTMLPlugInImageElement::removedFrom): Deleted.
-        (WebCore::is100Percent): Deleted.
-        (WebCore::HTMLPlugInImageElement::setNeedsImageReload): Deleted.
-        * html/HTMLPlugInImageElement.h:
-        (WebCore::HTMLPlugInImageElement::imageLoader): Deleted.
-        (WebCore::HTMLPlugInImageElement::updateImageLoaderWithNewURLSoon): Deleted.
-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::needsPseudeElement):
-        (WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded):
-        (WebCore::Style::attachRenderTree):
-        (WebCore::Style::updateBeforeOrAfterPseudoElement):
-        (WebCore::Style::needsPseudoElement): Deleted.
-        (WebCore::Style::postResolutionCallbackQueue): Deleted.
-        (WebCore::Style::queuePostResolutionCallback): Deleted.
-        (WebCore::Style::suspendMemoryCacheClientCalls): Deleted.
-        (WebCore::Style::PostResolutionCallbackDisabler::PostResolutionCallbackDisabler): Deleted.
-        (WebCore::Style::PostResolutionCallbackDisabler::~PostResolutionCallbackDisabler): Deleted.
-        (WebCore::Style::postResolutionCallbacksAreSuspended): Deleted.
-        * style/StyleResolveTree.h:
</del><ins>+        Move :active chain participation state from Node to Element.
+        &lt;http://webkit.org/b/116786&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Page should use std::unique_ptr for PointerLockController
-        https://bugs.webkit.org/show_bug.cgi?id=131098
</del><ins>+        Only Elements can be in the :active chain so move the logic there from Node.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::updateHoverActiveState):
</ins><span class="cx"> 
</span><del>-        Make Page keep a std::unique_ptr to PointerLockController. Store page 
-        references and return controller references where possible.
</del><ins>+            Add isElementNode() type checks when updating the :active chain.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::prepareForDestruction):
-        (WebCore::Document::webkitExitPointerLock):
-        (WebCore::Document::webkitPointerLockElement):
</del><ins>+        * dom/Node.h:
+        * dom/Node.cpp:
+        (WebCore::Node::detach):
</ins><span class="cx">         * dom/Element.cpp:
</span><del>-        (WebCore::Element::removedFrom):
-        (WebCore::Element::webkitRequestPointerLock):
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-        (WebCore::Page::pointerLockController):
-        * page/PointerLockController.cpp:
-        (WebCore::PointerLockController::PointerLockController):
-        (WebCore::PointerLockController::requestPointerLock):
-        (WebCore::PointerLockController::requestPointerUnlock):
-        (WebCore::PointerLockController::create): Deleted.
-        * page/PointerLockController.h:
</del><ins>+        (WebCore::Element::detach):
</ins><span class="cx"> 
</span><del>-2014-04-02  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            Move the remaining logic for detaching from the UserActionElementSet to Element.
</ins><span class="cx"> 
</span><del>-        Load Media Controls js/css from bundle
-        https://bugs.webkit.org/show_bug.cgi?id=131086
</del><ins>+        (WebCore::Element::isUserActionElementInActiveChain):
+        * dom/Element.h:
+        (WebCore::Element::inActiveChain):
</ins><span class="cx"> 
</span><del>-        Followup comments from Eric Carlson.
</del><ins>+            Move all the :active chain stuff from Node to Element.
</ins><span class="cx"> 
</span><del>-        Remove the booleans that were guarding loading the resources.
</del><ins>+        * dom/UserActionElementSet.cpp:
+        (WebCore::UserActionElementSet::didDetach):
+        * dom/UserActionElementSet.h:
+        (WebCore::UserActionElementSet::isInActiveChain):
+        (WebCore::UserActionElementSet::setInActiveChain):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeIOS.h:
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::mediaControlsStyleSheet):
-        (WebCore::RenderThemeIOS::mediaControlsScript):
-        (WebCore::RenderThemeIOS::RenderThemeIOS):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::RenderThemeMac):
-        (WebCore::RenderThemeMac::mediaControlsStyleSheet):
-        (WebCore::RenderThemeMac::mediaControlsScript):
</del><ins>+            UserActionElementSet now only takes Element* in its API.
</ins><span class="cx"> 
</span><del>-2014-04-01  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+2013-05-26  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Load Media Controls js/css from bundle
-        https://bugs.webkit.org/show_bug.cgi?id=131086
</del><ins>+        Remove FontFamily.h/.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=116788
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Anders Carlsson.
+        
+        Empty files.
</ins><span class="cx"> 
</span><del>-        Rather than embed encoded versions of the JS and CSS files
-        into C++ source, just load the files directly from the bundle.
-
-        * DerivedSources.make: Removed now unnecessary rules.
-        * WebCore.xcodeproj/project.pbxproj: Copy mediaControls files to the bundle.
-        * rendering/RenderThemeIOS.h:
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::RenderThemeIOS):
-        (WebCore::RenderThemeIOS::mediaControlsStyleSheet): Load from the bundle.
-        (WebCore::RenderThemeIOS::mediaControlsScript): Ditto.
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::RenderThemeMac):
-        (WebCore::RenderThemeMac::mediaControlsStyleSheet):
-        (WebCore::RenderThemeMac::mediaControlsScript):
-
-2014-04-02  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        Move focus management API from HTMLDocument to Document
-        https://bugs.webkit.org/show_bug.cgi?id=131079
-        &lt;rdar://problem/16220103&gt;
-
-        Reviewed by Timothy Hatcher.
-
-        Merged from Blink (patch by Christophe Dumez):
-        https://src.chromium.org/viewvc/blink?view=rev&amp;revision=165515
-
-        Move hasFocus() and attribute activeElement from interface HTMLDocument
-        to DOMDocument as per section Focus management APIs of the HTML5 standard:
-        &lt;http://www.whatwg.org/specs/web-apps/current-work/#focus-management-apis&gt; (1 April 2014).
-
-        Test: fast/dom/Document/xml-document-focus.xml
-
-        * bindings/objc/PublicDOMInterfaces.h: Moved hasFocus() and property activeElement from
-        interface DOMHTMLDocument to DOMDocument.
-        * dom/Document.cpp:
-        (WebCore::Document::activeElement): Added.
-        (WebCore::Document::hasFocus): Added.
-        * dom/Document.h:
-        * dom/Document.idl:
-        * html/HTMLDocument.cpp:
-        (WebCore::HTMLDocument::activeElement): Deleted.
-        (WebCore::HTMLDocument::hasFocus): Deleted.
-        * html/HTMLDocument.h:
-        * html/HTMLDocument.idl:
-
-2014-04-02  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        Refactor the function call generator to take the arguments by value
-        https://bugs.webkit.org/show_bug.cgi?id=131129
-
-        Reviewed by Andreas Kling.
-
-        Nothing forces the pointed address to stay alive between setOneArgument/setTwoArguments
-        and prepareAndCall.
-
-        This patch changes FunctionCall to:
-        -Keep the register by value instead of using pointers.
-        -Crash at compile time if a register is invalid.
-
-        * cssjit/FunctionCall.h:
-        (WebCore::FunctionCall::FunctionCall):
-        (WebCore::FunctionCall::setOneArgument):
-        (WebCore::FunctionCall::setTwoArguments):
-        (WebCore::FunctionCall::swapArguments):
-        (WebCore::FunctionCall::prepareAndCall):
-        * cssjit/RegisterAllocator.h:
-        (WebCore::RegisterAllocator::isValidRegister):
-
-2014-04-02  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        Remove Settings::maximumDecodedImageSize()
-        https://bugs.webkit.org/show_bug.cgi?id=131057
-        &lt;rdar://problem/15626368&gt;
-
-        Reviewed by Darin Adler.
-
-        The setting Settings::maximumDecodedImageSize() and its related logic have various
-        shortcomings, including the inability to cancel an image load when the estimated
-        decoded image size exceeds the maximum decoded image size. In the iOS port, this
-        setting is less useful given image subsampling support. For now, we remove this
-        setting and its related logic. Should it turn out that such a setting is useful
-        then we can implement it again taking care to address the shortcomings in the
-        original design.
-
-        * html/HTMLCanvasElement.cpp: For the iOS port, define MaxCanvasArea to be 4580 * 1145
-        pixels such that the maximum size of the image buffer is 20 MB (assumes 4 bytes per pixel).
-        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-        * html/HTMLCanvasElement.h:
-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createImageData):
-        (WebCore::CanvasRenderingContext2D::getImageData):
-        * loader/cache/CachedImage.cpp:
-        (WebCore::CachedImage::addIncrementalDataBuffer):
-        (WebCore::CachedImage::finishLoading):
-        * loader/cache/CachedImage.h:
-        * page/Settings.in:
-
-2014-04-02  Martin Hock  &lt;mhock@apple.com&gt;
-
-        Unify private browsing with sessions.
-        https://bugs.webkit.org/show_bug.cgi?id=130099
-
-        Reviewed by Alexey Proskuryakov.
-
-        Unless otherwise noted, the following consists solely of mechanical changes to replace querying WebCore::Settings::privateBrowsingEnabled() with Page::usesEphemeralSession().
-
-        * Modules/webdatabase/DatabaseContext.cpp:
-        (WebCore::DatabaseContext::allowDatabaseAccess):
-        * WebCore.exp.in: Remove Settings::setPrivateBrowsingEnabled, add Page::legacyPrivateBrowsingEnabled.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        * loader/HistoryController.cpp:
-        (WebCore::HistoryController::updateForStandardLoad):
-        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
-        (WebCore::HistoryController::updateForClientRedirect):
-        (WebCore::HistoryController::updateForSameDocumentNavigation):
-        (WebCore::HistoryController::pushState):
-        (WebCore::HistoryController::replaceState):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
-        (WebCore::ApplicationCacheGroup::update):
-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::isApplicationCacheEnabled):
-        * loader/icon/IconController.cpp:
-        (WebCore::IconController::continueLoadWithDecision):
-        * page/Page.cpp:
-        (WebCore::Page::Page): Initialize with defaultSessionID.
-        (WebCore::Page::legacyPrivateBrowsingEnabled): Legacy setting for private browsing.
-        (WebCore::Page::privateBrowsingStateChanged): Move implementation to setSessionID.
-        (WebCore::Page::sessionID): Simplify to just return m_sessionID.
-        (WebCore::Page::setSessionID): Also perform privateBrowsingStateChanged action.a
-        (WebCore::Page::privateBrowsingStateChanged): Deleted.
-        (WebCore::Page::checkSubframeCountConsistency): Deleted.
-        * page/Page.h:
-        * page/PageConsole.cpp:
-        (WebCore::PageConsole::addMessage):
-        (WebCore::PageConsole::messageWithTypeAndLevel):
-        * page/Settings.cpp: Remove privateBrowsingEnabled setting.
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setPrivateBrowsingEnabled): Page reflects setting using session.
-        * page/Settings.h:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::getValue):
-        * rendering/RenderSearchField.cpp:
-        (WebCore::RenderSearchField::addSearchResult):
-        * storage/Storage.cpp:
-        (WebCore::Storage::isDisabledByPrivateBrowsing):
-
-2014-04-02  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Try to fix test failures.
-
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::TileGrid):  Initialize a field.
-
-2014-04-02  Timothy Hatcher  &lt;timothy@apple.com&gt;
-
-        Remove Input domain from the Web Inspector protocol.
-
-        https://bugs.webkit.org/show_bug.cgi?id=131073
-
-        Reviewed by Joseph Pecoraro.
-
</del><span class="cx">         * CMakeLists.txt:
</span><del>-        * DerivedSources.make:
</del><ins>+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
</ins><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj.filters:
</del><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * inspector/InspectorAllInOne.cpp:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        * inspector/InspectorInputAgent.cpp: Removed.
-        * inspector/InspectorInputAgent.h: Removed.
-        * inspector/protocol/Input.json: Removed.
</del><ins>+        * platform/graphics/FontDescription.h:
+        * platform/graphics/FontFamily.cpp: Removed.
+        * platform/graphics/FontFamily.h: Removed.
</ins><span class="cx"> 
</span><del>-2014-04-02  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-05-26  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Split tile grid out from TileController
-        https://bugs.webkit.org/show_bug.cgi?id=131102
</del><ins>+        Use Vector instead of custom linked list for font families
+        https://bugs.webkit.org/show_bug.cgi?id=116783
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Add a TileGrid class that encapsulates tiles, zoom level and the related metadata.
-        This will make it possible to have multiple grids per TileController later.
</del><ins>+        Get rid of FontFamily and SharedFontFamily.
</ins><span class="cx"> 
</span><del>-2014-03-31  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [Win] Correct media controls for test harness
-        https://bugs.webkit.org/show_bug.cgi?id=131008 
-
-        Reviewed by Eric Carlson.
-
-        * rendering/RenderThemeSafari.cpp: Revise to match RenderThemeWin logic.
</del><ins>+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hasSameFont):
+        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
+        (getAttributeSetForAccessibilityObject):
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fontFamilyFromStyle):
+        * css/DeprecatedStyleBuilder.cpp:
+        (WebCore::ApplyPropertyFontFamily::applyInheritValue):
+        (WebCore::ApplyPropertyFontFamily::applyInitialValue):
+        (WebCore::ApplyPropertyFontFamily::applyValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::styleForDocument):
+        (WebCore::StyleResolver::initializeFontStyle):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::font):
+        (WebCore::CanvasRenderingContext2D::setFont):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageProperty):
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::systemFont):
+        * platform/graphics/Font.h:
+        (WebCore::Font::firstFamily):
+        (WebCore::Font::familyCount):
+        (WebCore::Font::familyAt):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::getFontData):
+        * platform/graphics/FontDescription.cpp:
+        (SameSizeAsFontDescription):
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::familyCount):
+        (WebCore::FontDescription::firstFamily):
+        (WebCore::FontDescription::familyAt):
+        (WebCore::FontDescription::families):
+        (WebCore::FontDescription::useFixedDefaultSize):
+        (WebCore::FontDescription::setOneFamily):
+        (WebCore::FontDescription::setFamilies):
+        (WebCore::FontDescription::adoptFamilies):
+        (WebCore::FontDescription::operator==):
+        * platform/graphics/FontFamily.cpp:
+        * platform/graphics/FontFamily.h:
+        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
+        (PlatformCALayerWinInternal::displayCallback):
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::systemFont):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::ThemeMac::controlFont):
+        * platform/qt/RenderThemeQStyle.cpp:
+        (WebCore::RenderThemeQStyle::adjustButtonStyle):
+        * platform/text/transcoder/FontTranscoder.cpp:
+        (WebCore::FontTranscoder::converterType):
+        * platform/win/DragImageWin.cpp:
+        (WebCore::dragLabelFont):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::styleDidChange):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::computeIntrinsicLogicalWidths):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentLogicalWidth):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::systemFont):
+        (WebCore::RenderThemeMac::setFontFromControlSize):
+        * rendering/RenderThemeSafari.cpp:
</ins><span class="cx">         (WebCore::RenderThemeSafari::systemFont):
</span><del>-        (WebCore::RenderThemeSafari::paintMenuList):
-        (WebCore::RenderThemeSafari::paintSearchFieldResultsButton):
-        (WebCore::RenderThemeSafari::mediaControlsStyleSheet):
-        (WebCore::RenderThemeSafari::mediaControlsScript):
-        (WebCore::RenderThemeSafari::paintMediaFullscreenButton): Deleted.
-        (WebCore::RenderThemeSafari::paintMediaMuteButton): Deleted.
-        (WebCore::RenderThemeSafari::paintMediaPlayButton): Deleted.
-        (WebCore::RenderThemeSafari::paintMediaSeekBackButton): Deleted.
-        (WebCore::RenderThemeSafari::paintMediaSeekForwardButton): Deleted.
-        (WebCore::RenderThemeSafari::paintMediaSliderTrack): Deleted.
-        (WebCore::RenderThemeSafari::paintMediaSliderThumb): Deleted.
-        * rendering/RenderThemeSafari.h:
</del><ins>+        (WebCore::RenderThemeSafari::setFontFromControlSize):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::fillFontDescription):
</ins><span class="cx"> 
</span><del>-2014-04-02  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</del><ins>+2013-05-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [WinCairo] Compile error.
-        https://bugs.webkit.org/show_bug.cgi?id=131110
</del><ins>+        Move &quot;active&quot; state logic from Node to Element.
+        &lt;http://webkit.org/b/116785&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Image::size() now returns a FloatSize instead of an IntSize.
</del><ins>+        Resolve another 7 year old FIXME by merging the &quot;active&quot; state logic from Node and ContainerNode
+        and moving it all to Element instead.
</ins><span class="cx"> 
</span><del>-        * platform/win/DragImageCairoWin.cpp:
-        (WebCore::createDragImageFromImage):
</del><ins>+        * dom/UserActionElementSet.h:
+        (WebCore::UserActionElementSet::isActive):
+        (WebCore::UserActionElementSet::setActive):
+        * dom/ContainerNode.cpp:
+        * dom/ContainerNode.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/Element.h:
+        (WebCore::Element::active):
+        * dom/Element.cpp:
+        (WebCore::Element::isUserActionElementActive):
+        (WebCore::Element::setActive):
</ins><span class="cx"> 
</span><del>-2014-04-02  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+            Moved here from Node/ContainerNode.
</ins><span class="cx"> 
</span><del>-        Use outermost containing isolate when constructing bidi runs
-        &lt;http://webkit.org/b/131107&gt;
-        &lt;rdar://problem/15690021&gt;
</del><ins>+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::isPressed):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::updateHoverActiveState):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isPressed):
+        (WebCore::RenderTheme::isSpinUpButtonPartPressed):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+        (WebCore::RenderThemeMac::updatePressedState):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::getMediaControlForegroundColor):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            Check that the inspected Node is an Element before asking if it's active.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by jww@chromium.org):
-        https://src.chromium.org/viewvc/blink?revision=157268&amp;view=revision
-        http://crbug.com/279277
</del><ins>+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setActive):
</ins><span class="cx"> 
</span><del>-            Update containingIsolate to go back all the way to top
-            isolate from current root, rather than stopping at the first
-            isolate it finds. This works because the current root is
-            always updated with each isolate run.
</del><ins>+            Call the right superclass.
</ins><span class="cx"> 
</span><del>-        Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
-               fast/text/international/unicode-bidi-isolate-nested-with-removes.html
</del><ins>+        * html/HTMLAnchorElement.h:
+        * html/HTMLLabelElement.h:
+        * html/shadow/MediaControlElementTypes.h:
</ins><span class="cx"> 
</span><del>-        * rendering/InlineIterator.h:
-        (WebCore::highestContainingIsolateWithinRoot):
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::constructBidiRunsForSegment):
</del><ins>+            Sprinkle OVERRIDE&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+2013-05-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        AX: Improve ARIA live region reliability by sending notifications when live regions are created/shown and hidden/destroyed
-        https://bugs.webkit.org/show_bug.cgi?id=124381
</del><ins>+        Move Node::dispatchSimulatedClick() to Element.
+        &lt;http://webkit.org/b/116784&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Re-organize some code so that when we detect a new node has been created, we can safely determine its live region status.
-        If it is a live region, we fire off a live region created notification.
</del><ins>+        Only Elements use the dispatchSimulatedClick() functionality, so move it there.
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/accessibility/live-region-creation-notification.html
</del><ins>+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/Element.h:
+        * dom/Element.cpp:
+        (WebCore::Element::dispatchSimulatedClick):
+        * dom/EventDispatcher.h:
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchSimulatedClick):
</ins><span class="cx"> 
</span><del>-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::handleLiveRegionCreated):
-        (WebCore::AXObjectCache::childrenChanged):
-        (WebCore::AXObjectCache::handleAttributeChanged):
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::childrenChanged):
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::defaultLiveRegionStatusForRole):
-        (WebCore::AccessibilityObject::liveRegionStatusIsEnabled):
-        (WebCore::AccessibilityObject::supportsARIALiveRegion):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::ariaLiveRegionStatus):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::ariaLiveRegionStatus):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/ios/AXObjectCacheIOS.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.h:
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper postLiveRegionCreatedNotification]):
-        * accessibility/mac/AXObjectCacheMac.mm:
-        (WebCore::AXObjectCache::postPlatformNotification):
</del><ins>+2013-05-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        TreeScope::rootNode() should return a ContainerNode.
+        &lt;http://webkit.org/b/116782&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION(r165704): [GTK] Inspector resources not correctly generated
-        https://bugs.webkit.org/show_bug.cgi?id=130343
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gustavo Noronha Silva.
</del><ins>+        The rootNode() of a TreeScope is always a ContainerNode, so update pointer types to reflect that.
+        This lets us take advantage of Antti's optimized traversal functions.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: Generate the web inspector JS file into the new WebInspectorUI derived sources
-        directory.
</del><ins>+        * dom/ContainerNode.h:
+        (WebCore::Node::isTreeScope):
+        * dom/Document.cpp:
+        (WebCore::Document::buildAccessKeyMap):
+        * dom/Node.cpp:
+        (WebCore::Node::containingShadowRoot):
+        * dom/Node.h:
+        * dom/TreeScope.h:
+        (WebCore::TreeScope::rootNode):
+        (TreeScope):
+        * page/FocusController.cpp:
+        (WebCore::FocusNavigationScope::rootNode):
+        (WebCore::FocusNavigationScope::owner):
+        * page/FocusController.h:
+        (FocusNavigationScope):
</ins><span class="cx"> 
</span><del>-2014-04-02  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-05-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r166642.
-        (WinCairo should really turn subpixel layout on.)
</del><ins>+        FocusController::setFocusedNode() should be setFocusedElement().
+        &lt;http://webkit.org/b/116780&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/LayoutSize.h:
-        (WebCore::flooredForPainting):
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-04-02  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Only Elements can have focus, so make the public API of FocusController take Element*.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Make GraphicsContext::drawTiledImage* functions float based.
-        https://bugs.webkit.org/show_bug.cgi?id=131062
</del><ins>+        * WebCore.exp.in:
+        * page/FocusController.h:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedElement):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Out with the setFocusedNode(), in with the setFocusedElement().
</ins><span class="cx"> 
</span><del>-        This is in preparation to support subpixel positioned/sized background images. Generated images
-        need to be able to sized on device pixels.
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+        (WebCore::Element::blur):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::focusPluginElement):
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::setFocusedNodeIfNeeded):
</ins><span class="cx"> 
</span><del>-        No change in behavior.
</del><ins>+            Tweak for FocusController taking Element* instead of Node*.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::drawImage):
-        (WebCore::GraphicsContext::drawTiledImage):
-        * platform/graphics/GraphicsContext.h:
</del><ins>+        (WebCore::FrameSelection::setFocusedElementIfNeeded):
</ins><span class="cx"> 
</span><del>-2014-04-02  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Renamed from setFocusedNodeIfNeeded().
</ins><span class="cx"> 
</span><del>-        [WinCairo] Build fix after r166496.
-        https://bugs.webkit.org/show_bug.cgi?id=131006
</del><ins>+        * editing/htmlediting.h:
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingAnchorElement):
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+            Cleaned up the loop for readability and made it return an Element.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp:
-        (WebCore::InbandTextTrackPrivateGStreamer::handleSample):
-        (WebCore::InbandTextTrackPrivateGStreamer::streamChanged):
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::changePipelineState):
-        (WebCore::MediaPlayerPrivateGStreamer::videoChanged):
-        (WebCore::MediaPlayerPrivateGStreamer::videoCapsChanged):
-        (WebCore::MediaPlayerPrivateGStreamer::audioChanged):
-        (WebCore::MediaPlayerPrivateGStreamer::textChanged):
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
-        (WebCore::MediaPlayerPrivateGStreamerBase::volumeChanged):
-        (WebCore::MediaPlayerPrivateGStreamerBase::muteChanged):
-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
-        (WebCore::TrackPrivateBaseGStreamer::activeChanged):
-        (WebCore::TrackPrivateBaseGStreamer::tagsChanged):
-        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
-        (webkitVideoSinkRender):
-        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
-        (webKitWebSrcChangeState):
-        (webKitWebSrcNeedDataCb):
-        (webKitWebSrcEnoughDataCb):
-        (webKitWebSrcSeekDataCb):
-        Added std::function&lt;void()&gt; constructors to help Visual Studio decide which version of 
-        GMainLoopSource::schedule or GMainLoopSource::scheduleAfterDelay to use.
</del><ins>+2013-05-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Move some form control things from Element to HTMLFormControlElement.
+        &lt;http://webkit.org/b/116779&gt;
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Transition class CSSImageGeneratorValue/class StyleImage (and its dependencies) from 
-        IntSize to FloatSize to enable subpixel sized (generated)images.
-        https://bugs.webkit.org/show_bug.cgi?id=130659
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser and Andreas Kling.
</del><ins>+        The following methods sit better on HTMLFormControlElement than on Element:
</ins><span class="cx"> 
</span><del>-        This is in preparation to support subpixel positioned/sized background images. Generated images
-        needs to be able to sized on device pixels.
</del><ins>+            - formControlType()
+            - wasChangedSinceLastFormControlChangeEvent()
+            - setChangedSinceLastFormControlChangeEvent()
+            - dispatchFormControlChangeEvent()
</ins><span class="cx"> 
</span><del>-        No change in behavior.
</del><ins>+        Moved them, and devirtualized as much as possible.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSCanvasValue.cpp:
-        (WebCore::CSSCanvasValue::fixedSize):
-        (WebCore::CSSCanvasValue::image):
-        * css/CSSCanvasValue.h:
-        * css/CSSCrossfadeValue.cpp:
-        (WebCore::CSSCrossfadeValue::fixedSize):
-        (WebCore::CSSCrossfadeValue::image):
-        * css/CSSCrossfadeValue.h:
-        * css/CSSFilterImageValue.cpp:
-        (WebCore::CSSFilterImageValue::fixedSize):
-        (WebCore::CSSFilterImageValue::image):
-        * css/CSSFilterImageValue.h:
-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::image):
-        (WebCore::positionFromValue):
-        (WebCore::CSSGradientValue::computeEndPoint):
-        (WebCore::endPointsFromAngle):
-        (WebCore::CSSLinearGradientValue::createGradient):
-        (WebCore::CSSRadialGradientValue::createGradient):
-        * css/CSSGradientValue.h:
-        (WebCore::CSSGradientValue::fixedSize):
-        * css/CSSImageGeneratorValue.cpp:
-        (WebCore::CSSImageGeneratorValue::cachedImageForSize):
-        (WebCore::CSSImageGeneratorValue::saveCachedImageForSize):
-        (WebCore::CSSImageGeneratorValue::evictCachedGeneratedImage):
-        (WebCore::CSSImageGeneratorValue::CachedGeneratedImage::CachedGeneratedImage):
-        (WebCore::CSSImageGeneratorValue::image):
-        (WebCore::CSSImageGeneratorValue::fixedSize):
-        * css/CSSImageGeneratorValue.h:
-        * loader/cache/CachedImage.cpp:
-        (WebCore::CachedImage::setContainerSizeForRenderer):
-        * loader/cache/CachedImage.h:
-        * platform/graphics/FloatSizeHash.h: Added.
-        (WTF::FloatHash&lt;WebCore::FloatSize&gt;::hash):
-        (WTF::FloatHash&lt;WebCore::FloatSize&gt;::equal):
-        (WTF::HashTraits&lt;WebCore::FloatSize&gt;::constructDeletedValue):
-        (WTF::HashTraits&lt;WebCore::FloatSize&gt;::isDeletedValue):
-        * platform/graphics/LayoutSize.h:
-        (WebCore::flooredForPainting):
-        * rendering/RenderImageResourceStyleImage.h:
-        * rendering/RenderListMarker.cpp:
-        (WebCore::RenderListMarker::computePreferredLogicalWidths):
-        * rendering/style/StyleCachedImage.cpp:
-        (WebCore::StyleCachedImage::imageSize):
-        (WebCore::StyleCachedImage::setContainerSizeForRenderer):
-        (WebCore::StyleCachedImage::image):
-        * rendering/style/StyleCachedImage.h:
-        * rendering/style/StyleCachedImageSet.cpp:
-        (WebCore::StyleCachedImageSet::imageSize):
-        (WebCore::StyleCachedImageSet::setContainerSizeForRenderer):
-        (WebCore::StyleCachedImageSet::image):
-        * rendering/style/StyleCachedImageSet.h:
-        * rendering/style/StyleGeneratedImage.cpp:
-        (WebCore::StyleGeneratedImage::imageSize):
-        (WebCore::StyleGeneratedImage::computeIntrinsicDimensions):
-        (WebCore::StyleGeneratedImage::image):
-        * rendering/style/StyleGeneratedImage.h:
-        * rendering/style/StyleImage.h:
-        * rendering/style/StylePendingImage.h:
-        * svg/graphics/SVGImageCache.cpp:
-        (WebCore::SVGImageCache::setContainerSizeForRenderer):
-        * svg/graphics/SVGImageCache.h:
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
</ins><span class="cx"> 
</span><del>-2014-04-02  Gergo Balogh  &lt;gbalogh.u-szeged@partner.samsung.com&gt;
</del><ins>+            Check if the old focus target is an Element before (possibly) dispatching a change event.
</ins><span class="cx"> 
</span><del>-        Warning fix for RenderLayer.
-        https://bugs.webkit.org/show_bug.cgi?id=131090
</del><ins>+        * dom/Element.cpp:
+        * dom/Element.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+            Removed some stub methods that were only used by HTMLFormControlElement subclasses.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateDescendantDependentFlags):
</del><ins>+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        (WebCore::isHTMLFormControlElement):
+        (WebCore::toHTMLFormControlElement):
</ins><span class="cx"> 
</span><del>-2014-04-02  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+            Add toHTMLFormControlElement() helper with ASSERT_WITH_SECURITY_IMPLICATION.
</ins><span class="cx"> 
</span><del>-        Operator stretching: read the Open Type MATH table
-        https://bugs.webkit.org/show_bug.cgi?id=130324
</del><ins>+        * html/HTMLTextFormControlElement.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+            Sprinkle OVERRIDE.
</ins><span class="cx"> 
</span><del>-        We parse and expose some data from the OpenType MATH table that will be
-        be relevant for at least the MathML operator stretching (bug 130322):
-        math constants, italic corrections and size variants / glyph assembly.
-        This will be tested when the MathML code uses the data.
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj: Add OpenTypeTypes.h to the Mac build.
-        * platform/graphics/opentype/OpenTypeMathData.cpp: We implement the low-level parsing of the MATH table.
-        (WebCore::OpenType::MathItalicsCorrectionInfo::getItalicCorrection):
-        (WebCore::OpenType::MathGlyphInfo::mathItalicsCorrectionInfo):
-        (WebCore::OpenType::GlyphAssembly::getAssemblyParts):
-        (WebCore::OpenType::MathGlyphConstruction::getSizeVariants):
-        (WebCore::OpenType::MathGlyphConstruction::getAssemblyParts):
-        (WebCore::OpenType::MathVariants::mathGlyphConstruction):
-        (WebCore::OpenType::MATHTable::mathConstants):
-        (WebCore::OpenType::MATHTable::mathGlyphInfo):
-        (WebCore::OpenType::MATHTable::mathVariants):
-        (WebCore::OpenTypeMathData::OpenTypeMathData): We load the MATH table.
-        (WebCore::OpenTypeMathData::getMathConstant): We add a function to get values from the MathConstant subtable.
-        (WebCore::OpenTypeMathData::getItalicCorrection): We add a function to get italic correction from the MathGlyphInfo subtable.
-        (WebCore::OpenTypeMathData::getMathVariants): We add a function to get size variants / glyph assembly from the MathVariants subtable.
-        * platform/graphics/opentype/OpenTypeMathData.h: We expose three new functions to get math data.
-        * platform/graphics/opentype/OpenTypeTypes.h: We share the coverage tables that are common to vertical and math data.
-        (WebCore::OpenType::TableWithCoverage::getCoverageIndex): We add a function to get the coverage index from a given glyph.
-        * platform/graphics/opentype/OpenTypeVerticalData.cpp: We move the coverage tables to OpenTypeTypes.h.
</del><ins>+        Move Node::supportsFocus() to Element.
+        &lt;http://webkit.org/b/116778&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Compositing requirements for blending are not computed correctly
-        https://bugs.webkit.org/show_bug.cgi?id=130664
</del><ins>+        Node never supports focus, so move supportsFocus() to Element instead.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        * dom/Element.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
</ins><span class="cx"> 
</span><del>-        Tests: css3/compositing/blend-mode-accelerated-with-multiple-stacking-contexts.html
-               css3/compositing/blend-mode-with-accelerated-sibling.html
</del><ins>+            Removed Node::supportsFocus(), it always returned false anyway.
</ins><span class="cx"> 
</span><del>-        Compositing requirements for blending: if a layer having blend mode
-        other than normal is composited for any reason, its closest stacking
-        context ancestor should be composited as well.
</del><ins>+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::RenderLayer):
-        * rendering/RenderLayer.h: added a new field,
-        m_hasUnisolatedCompositedBlendingDescendants, which is true if the layer
-        has composited blending descendants not isolated by any stacking context child;
-        added a new method: isolatesCompositedBlending(), which is true if we should
-        accelerate that layer in order to perform isolation correctly.
</del><ins>+            Check that the underlying Node is an Element before asking if it supports focus.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::CompositingState::CompositingState): m_subtreeHasBlending was renamed
-        m_hasUnisolatedCompositedBlendingDescendants in order to be more self-explanatory.
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
-        computes the isolation requirements for composited blending by
-        (re)setting RenderLayer::m_hasUnisolatedCompositedBlendingDescendants flag.
</del><ins>+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.h:
+        * html/HTMLBodyElement.h:
+        * html/HTMLElement.h:
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLMediaElement.h:
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.h:
+        * html/HTMLOutputElement.h:
+        * svg/SVGAElement.h:
+        * svg/SVGCircleElement.h:
+        * svg/SVGEllipseElement.h:
+        * svg/SVGGElement.h:
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.h:
+        * svg/SVGPathElement.h:
+        * svg/SVGPolyElement.h:
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.h:
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTextElement.h:
+        * svg/SVGUseElement.h:
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderLayerCompositor::reasonsForCompositing):
-        fixed the reason of compositing: isolation instead of blending.
</del><ins>+            OVERRIDE ALL THE THINGS!
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderLayerCompositor::requiresCompositingForIndirectReason):
-        * rendering/RenderLayerCompositor.h:
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-02  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Move Node::isFocusable() to Element.
+        &lt;http://webkit.org/b/116777&gt;
</ins><span class="cx"> 
</span><del>-        Operator stretching: expose a math data API
-        https://bugs.webkit.org/show_bug.cgi?id=130572
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Nodes cannot be focusable, so move isFocusable() from Node to Element.
</ins><span class="cx"> 
</span><del>-        We expose a new SimpleFontData API to give access to the data from the
-        OpenType MATH table. The class OpenTypeMathData will
-        be implemented in bug 130324. On Darwin platform, we also implement the
-        missing FontPlatformData::openTypeTable function which will be necessary
-        to load the OpenType MATH table. The changes are intended to be used
-        for MathML operator stretching (bug 130322) so tests are not added yet.
-
-        * CMakeLists.txt: add new OpenTypeMathData files.
-        * WebCore.vcxproj/WebCore.vcxproj: ditto.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: ditto.
-        * WebCore.xcodeproj/project.pbxproj: ditto.
-        * platform/graphics/FontPlatformData.cpp:
-        (WebCore::FontPlatformData::openTypeTable): We implement openTypeTable() on Darwin platform.
-        * platform/graphics/FontPlatformData.h: We expose openTypeTable() on Darwin platform.
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData):
-        (WebCore::SimpleFontData::mathData): Initialize and return the math data.
-        * platform/graphics/SimpleFontData.h: We expose a mathData() function to access the MATH data.
-        * platform/graphics/opentype/OpenTypeMathData.cpp: Added. This is a new class that will be used to parse the data from the OpenType MATH table.
-        (WebCore::OpenTypeMathData::OpenTypeMathData):
-        * platform/graphics/opentype/OpenTypeMathData.h: Added.
-        (WebCore::OpenTypeMathData::create):
-        (WebCore::OpenTypeMathData::hasMathData):
-
-2014-04-01  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
-
-        [CSSRegions] Displaying region's children in another region not supported
-        https://bugs.webkit.org/show_bug.cgi?id=130735
-
-        Reviewed by David Hyatt.
-
-        With http://trac.webkit.org/changeset/166353, we disabled the possibility
-        of collecting the region's children into another flow and displaying them
-        in another region.
-        I added a new test for this and also changed the plain ASSERT in Element dtor
-        to ASSERT_WITH_SECURITY_IMPLICATION to better reflect the meaning of the assertion.
-
-        Test: fast/regions/region-child-not-flowed.html
-
</del><ins>+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/Element.h:
</ins><span class="cx">         * dom/Element.cpp:
</span><del>-        (WebCore::Element::~Element):
</del><ins>+        (WebCore::Element::isFocusable):
</ins><span class="cx"> 
</span><del>-2014-04-01  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+            Moved here from Node.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Simplify the RenderFlowThread state pusher
-        https://bugs.webkit.org/show_bug.cgi?id=131035
-
-        Reviewed by David Hyatt.
-
-        The RenderFlowThread state pusher is desynchronized from the RenderView layout state pusher
-        by one renderer. This patch fixes the anomaly by correctly ordering the push and pop operations
-        between the two systems.
-
-        Tests: no functional change, no new tests.
-
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::pushFlowThreadLayoutState):
-        (WebCore::RenderFlowThread::popFlowThreadLayoutState):
-        (WebCore::RenderFlowThread::offsetFromLogicalTopOfFirstRegion):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::pushLayoutState):
-        * rendering/RenderView.h:
-
-2014-04-01  Beth Dakin  &lt;bdakin@apple.com&gt;
-
-        willReveal edge events should be hooked up for overflow:scroll
-        https://bugs.webkit.org/show_bug.cgi?id=131071
-        -and corresponding-
-        &lt;rdar://problem/16190392&gt;
-
-        Reviewed by Sam Weinig.
-
-        This patch moves the will reveal logic from FrameView to Document so that it can 
-        be shared for RenderLayers.
-
-        This is mostly just a moved function, but now the function takes an Element* that 
-        represents the target of the event if the target is not the window.
</del><span class="cx">         * dom/Document.cpp:
</span><del>-        (WebCore::Document::sendWillRevealEdgeEventsIfNeeded):
-        * dom/Document.h:
</del><ins>+        (WebCore::Document::setFocusedNode):
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::determineAccessibilityRole):
</ins><span class="cx"> 
</span><del>-        No longer implement sendWillRevealEdgeEventsIfNeeded() on FrameView or 
-        ScrollableArea at all. Call into Document instead.
</del><ins>+            Check that the underlying node is an Element before asking if it's focusable.
+
</ins><span class="cx">         * page/FrameView.cpp:
</span><del>-        (WebCore::FrameView::scrollPositionChanged):
-        (WebCore::FrameView::sendWillRevealEdgeEventsIfNeeded): Deleted.
-        * page/FrameView.h:
-        * platform/ScrollableArea.h:
-        (WebCore::ScrollableArea::sendWillRevealEdgeEventsIfNeeded): Deleted.
</del><ins>+        (WebCore::FrameView::scrollToAnchor):
</ins><span class="cx"> 
</span><del>-        Call sendWillRevealEdgeEventsIfNeeded() after sending scroll events. 
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollTo):
</del><ins>+            Renamed the 'anchorNode' variable to 'anchorElement' because reasons.
</ins><span class="cx"> 
</span><del>-2014-04-01  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        * html/HTMLAreaElement.h:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLLabelElement.h:
+        * html/HTMLOptionElement.h:
+        * svg/SVGAElement.h:
</ins><span class="cx"> 
</span><del>-        Crash in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients
</del><ins>+            Sprinkle OVERRIDE.
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
-        &lt;rdar://problem/15073043&gt;
</del><ins>+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::setMessage):
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Update a comment to refer to Element::isFocusable() instead of Node.
</ins><span class="cx"> 
</span><del>-        Test: svg/filters/first-letter-crash.html
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/FilterEffectRenderer.cpp:
-        (WebCore::FilterEffectRenderer::buildReferenceFilter):
-        Added a null check to prevent crashes for anonymous RenderObjects.
</del><ins>+        Move Node::tabIndex() to Element.
+        &lt;http://webkit.org/b/116772&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::filterNeedsRepaint):
-        Get the enclosing element, if there is one, and recalculate its style.
-        We use the enclosing element so that we recalculate style for the
-        ancestor of an anonymous RenderElement.
-        (WebCore::RenderLayer::enclosingElement):
-        Remove an assertion; we may now reach this condition if loading a
-        cached SVG document results in RenderLayer::filterNeedsRepaint() being
-        called before the object has been inserted into the render tree.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerFilterInfo.cpp:
-        (WebCore::RenderLayer::FilterInfo::notifyFinished):
-        Tell the RenderLayer that the filter needs repainting.
-        (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
-        Get the Element from the renderer rather than asking the renderer's
-        Element, which will be null for anonymous RenderObjects.
</del><ins>+        Since only Elements are keyboard-focusable, it doesn't make sense for Node to have a tabIndex().
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerFilterInfo.h:
-        Removed declaration for the old workaround function, layerElement().
</del><ins>+        * dom/Element.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
</ins><span class="cx"> 
</span><del>-2014-04-01  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+            A Node can't have a tab index, so move tabIndex() to Element.
</ins><span class="cx"> 
</span><del>-        Build break when disabled VIDEO since r166261
-        https://bugs.webkit.org/show_bug.cgi?id=131087
</del><ins>+        * page/FocusController.h:
+        * page/FocusController.cpp:
+        (WebCore::adjustedTabIndex):
+        (WebCore::FocusController::findElementWithExactTabIndex):
+        (WebCore::nextElementWithGreaterTabIndex):
+        (WebCore::previousElementWithLowerTabIndex):
+        (WebCore::FocusController::nextFocusableNode):
+        (WebCore::FocusController::previousFocusableNode):
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+            Make this code deal in Element* when doing tab index stuff. FocusController needs
+            more Node-&gt;Element cleanup, but let's do that separately.
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp: Added ENABLE(VIDEO) guards
-        (WebCore::Internals::simulateSystemSleep):
-        (WebCore::Internals::simulateSystemWake):
</del><ins>+        * html/HTMLAnchorElement.h:
+        * html/HTMLElement.h:
+        * html/HTMLFormControlElement.h:
</ins><span class="cx"> 
</span><del>-2014-04-01  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+            Sprinkle OVERRIDE.
</ins><span class="cx"> 
</span><del>-        Remove HeapProfiler from the Web Inspector protocol.
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=131070
</del><ins>+        Don't instantiate ChildNodeLists just to get a child count.
+        &lt;http://webkit.org/b/116776&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScriptHeapSnapshot.h: Removed.
-        * bindings/js/ScriptProfiler.h:
-        (WebCore::ScriptProfiler::takeHeapSnapshot): Deleted.
-        (WebCore::ScriptProfiler::isSampling): Deleted.
-        (WebCore::ScriptProfiler::hasHeapProfiler): Deleted.
-        * inspector/InspectorAllInOne.cpp:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        * inspector/InspectorHeapProfilerAgent.cpp: Removed.
-        * inspector/InspectorHeapProfilerAgent.h: Removed.
-        * inspector/InspectorInstrumentation.cpp:
-        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
-        * inspector/InspectorProfilerAgent.cpp:
-        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
-        (WebCore::InspectorProfilerAgent::getProfileHeaders):
-        (WebCore::InspectorProfilerAgent::removeProfile):
-        (WebCore::InspectorProfilerAgent::resetState): The CommandLineAPIHost call to
-        clear inspected objects should have not been here. It was only needed by the
-        HeapProfilerAgent.
-        (WebCore::InspectorProfilerAgent::resetFrontendProfiles):
-        (WebCore::InspectorProfilerAgent::collectGarbage): Deleted.
-        (WebCore::InspectorProfilerAgent::createSnapshotHeader): Deleted.
-        (WebCore::InspectorProfilerAgent::isSampling): Deleted.
-        (WebCore::InspectorProfilerAgent::hasHeapProfiler): Deleted.
-        (WebCore::InspectorProfilerAgent::getHeapSnapshot): Deleted.
-        (WebCore::InspectorProfilerAgent::takeHeapSnapshot): Deleted.
-        (WebCore::InspectorProfilerAgent::getObjectByHeapObjectId): Deleted.
-        (WebCore::InspectorProfilerAgent::getHeapObjectId): Deleted.
-        * inspector/InspectorProfilerAgent.h:
-        * inspector/InstrumentingAgents.h:
-        (WebCore::InstrumentingAgents::inspectorHeapProfilerAgent): Deleted.
-        (WebCore::InstrumentingAgents::setInspectorHeapProfilerAgent): Deleted.
-        * inspector/WebConsoleAgent.cpp:
-        (WebCore::WebConsoleAgent::addInspectedHeapObject): Deleted.
-        * inspector/WebConsoleAgent.h:
-        * inspector/WorkerInspectorController.cpp:
-        (WebCore::WorkerInspectorController::WorkerInspectorController):
-        * inspector/protocol/HeapProfiler.json: Removed.
-        * inspector/protocol/Profiler.json:
</del><ins>+        Use ContainerNode::childNodeCount() instead of Node::childNodes()-&gt;length().
</ins><span class="cx"> 
</span><del>-2014-04-01  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
</ins><span class="cx"> 
</span><del>-        [CSS Exclusions] Remove exclusions parsing support
-        https://bugs.webkit.org/show_bug.cgi?id=131046
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        PluginDocument::pluginNode() should be pluginElement() instead.
+        &lt;http://webkit.org/b/116774&gt;
</ins><span class="cx"> 
</span><del>-        CSS Exclusions specification [1] needs some evolution before the actual implementation happens.
-        We have only the parsing code in WebKit for -webkit-wrap-flow and -webkit-wrap-through.
-        This patch removes the code from the trunk for now, it doesn't make sense to keep it around.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        [1] http://www.w3.org/TR/css3-exclusions/
</del><ins>+        Make PluginDocument hand out a HTMLPlugInElement* instead of a Node*.
</ins><span class="cx"> 
</span><del>-        Removed existing parsing tests.
</del><ins>+        * dom/Document.cpp:
+        (WebCore::eventTargetNodeForDocument):
+        * html/PluginDocument.h:
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::createDocumentStructure):
+        (WebCore::PluginDocument::pluginWidget):
+        (WebCore::PluginDocument::setPluginElement):
+        (WebCore::PluginDocument::detach):
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::isValidKeywordPropertyAndValue):
-        (WebCore::isKeywordPropertyID):
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Deleted.
-        (WebCore::CSSPrimitiveValue::operator WrapFlow): Deleted.
-        (WebCore::CSSPrimitiveValue::operator WrapThrough): Deleted.
-        * css/CSSPropertyNames.in:
-        * css/CSSValueKeywords.in:
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::applyProperty):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeRequiresLayout):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/RenderStyleConstants.h:
-        * rendering/style/StyleRareNonInheritedData.cpp:
-        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
-        (WebCore::StyleRareNonInheritedData::operator==):
-        * rendering/style/StyleRareNonInheritedData.h:
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-01  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+        Remove Document::getFocusableNodes().
+        &lt;http://webkit.org/b/116773&gt;
</ins><span class="cx"> 
</span><del>-        Remove the rest of the old Canvas inspection support.
-
-        https://bugs.webkit.org/show_bug.cgi?id=131066
-
</del><span class="cx">         Reviewed by Joseph Pecoraro.
</span><span class="cx"> 
</span><del>-        * CMakeLists.txt: Removed Canvas.json.
-        * DerivedSources.make: Ditto.
-        * inspector/InjectedScriptCanvasModuleSource.js: Removed.
-        * inspector/protocol/Canvas.json: Removed.
</del><ins>+        This was added in r42191 and there are no remaining clients of the API.
</ins><span class="cx"> 
</span><del>-2014-04-01  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        * dom/Document.cpp:
+        * dom/Document.h:
+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Eliminate HTMLFormElement::m_shouldSubmit
-        https://bugs.webkit.org/show_bug.cgi?id=131055
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Move Node::focusDelegate() to Element.
+        &lt;http://webkit.org/b/116768&gt;
</ins><span class="cx"> 
</span><del>-        m_shouldSubmit was used for two purposes:
-        - as a return value in a function whose return value is ignored by all callers;
-        - to make a decision that's local to a function.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        There is no need for it to be an instance variable.
</del><ins>+        Only Element can be a focus delegate (it's currently only ever HTMLInputElement actually)
+        so move Node::focusDelegate() to Element. Sprinkled isElementNode() checks as needed.
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::HTMLFormElement):
-        (WebCore::HTMLFormElement::prepareForSubmission):
-        (WebCore::HTMLFormElement::submit):
-        * html/HTMLFormElement.h:
</del><ins>+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/Element.h:
+        * dom/Element.cpp:
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::focusDelegate):
+        * html/shadow/SliderThumbElement.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isFocused):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSliderThumb):
</ins><span class="cx"> 
</span><del>-2014-04-01  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-05-25  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove a couple of useless static strings
-        https://bugs.webkit.org/show_bug.cgi?id=131003
</del><ins>+        Path: clean up addPathForRoundedRect()
+        https://bugs.webkit.org/show_bug.cgi?id=116765
</ins><span class="cx"> 
</span><del>-        Reviewed by David Kilzer.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        There is zero value in keeping those strings alive.
</del><ins>+        Reorganize code that is a bit redundant.
</ins><span class="cx"> 
</span><del>-        * css/StyleProperties.cpp:
-        (WebCore::isInitialOrInherit):
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-04-01  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        * platform/graphics/Path.cpp:
+        (WebCore::Path::addPathForRoundedRect):
</ins><span class="cx"> 
</span><del>-        svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures.html and svg/css/font-face-crash.html frequently assert in ComplexTextController::offsetForPosition
-        https://bugs.webkit.org/show_bug.cgi?id=119747
</del><ins>+2013-05-25  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Unprefix Page Visibility API
+        https://bugs.webkit.org/show_bug.cgi?id=102340
</ins><span class="cx"> 
</span><del>-        Even though kerning and ligatures currently don't work with the
-        simple text path, messing those up is better than creating null
-        CTRun and CTLine objects.
</del><ins>+        Reviewed by Tim Horton.
+        
+        Remove prefixes from the document properties, and the visibilitychanged event.
+        
+        Rename the &quot;preview&quot; state to &quot;unloaded&quot;. The &quot;unloaded&quot; state is never
+        reached yet (see https://bugs.webkit.org/show_bug.cgi?id=116769).
+        
+        Add some comments to places where we should update the visibility state
+        when going in and out of the page cache, but cannot safely do so yet.
</ins><span class="cx"> 
</span><del>-        Rather than calling the badly-named renderingContext() function on TextRun objects
-        to determine if they are drawn with an SVG font, this patch creates a wrapper function
-        with a better name and uses that instead.
</del><ins>+        Tested by existing Page Visibility tests.
</ins><span class="cx"> 
</span><del>-        Test: svg/text/svg-font-hittest.html
-
-        * platform/graphics/Font.cpp:
-        (WebCore::isDrawnWithSVGFont): Wrapper around renderingContext()
-        (WebCore::Font::drawText): Use wrapper function
-        (WebCore::Font::drawEmphasisMarks): Use wrapper function
-        (WebCore::Font::width): Use wrapper function
-        (WebCore::Font::selectionRectForText): Use wrapper function
-        (WebCore::Font::offsetForPosition): If we are using an SVG font, use the simple path
-        instead of the complex one
-        (WebCore::Font::codePath): Use wrapper function
-        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
-        (WebCore::FontPlatformData::ctFont):
-
-2014-04-01  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        RenderQuote must destroy remaining text renderer before first letter renderer
-        https://bugs.webkit.org/show_bug.cgi?id=78023
-        &lt;rdar://problem/10830009&gt;
-
-        Reviewed by Brent Fulgham.
-
-        Merged from Blink (patch by Abhishek Arya):
-        https://src.chromium.org/viewvc/blink?view=rev&amp;revision=151270
-
-        Following the fix for &lt;https://bugs.webkit.org/show_bug.cgi?id=114586&gt;, a
-        RenderQuote may have child render objects for the first letter of its text
-        and everything following the first letter so as to support the CSS first-
-        letter property. The latter renderer is responsible for destroying the former
-        on destruction. It's sufficient to reverse the destruction of the children of
-        RenderQuote to ensure that we destroy the remaining text renderer before we
-        destroy the first letter renderer.
-
-        Test: fast/css-generated-content/quote-first-letter-crash.html
-
-        * rendering/RenderQuote.cpp:
-        (WebCore::RenderQuote::updateText):
-
-2014-04-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
-
-        Do not allow HTTP refresh headers to refresh to javascript: URLs
-        &lt;http://webkit.org/b/119051&gt;
-        &lt;rdar://problem/14536453&gt;
-
-        Reviewed by Alexey Proskuryakov.
-
-        Merged from Blink (patch by tsepez@chromium.org):
-        https://src.chromium.org/viewvc/blink?revision=153912&amp;view=revision
-        http://crbug.com/258151
-
-            This behaviour has been standard in IE since IE7.  This makes us both
-            more compatible and less vulnerable to XSS.
-
-        Tests: http/tests/security/no-javascript-location-percent-escaped.html
-               http/tests/security/no-javascript-location.html
-               http/tests/security/no-javascript-refresh-percent-escaped.php
-               http/tests/security/no-javascript-refresh-spaces.php
-               http/tests/security/no-javascript-refresh-static-percent-escaped.html
-               http/tests/security/no-javascript-refresh-static-spaces.html
-               http/tests/security/no-javascript-refresh-static.html
-               http/tests/security/no-javascript-refresh.php
-
</del><span class="cx">         * dom/Document.cpp:
</span><del>-        (WebCore::Document::processHttpEquiv):
</del><ins>+        (WebCore::Document::pageVisibilityState):
+        (WebCore::Document::visibilityState):
+        (WebCore::Document::hidden):
+        (WebCore::Document::dispatchVisibilityStateChangeEvent):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * dom/EventNames.h:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
</ins><span class="cx">         * loader/FrameLoader.cpp:
</span><del>-        (WebCore::FrameLoader::receivedFirstData):
-        - Do not fire meta http refresh for a javascript: URL protocol.
</del><ins>+        (WebCore::FrameLoader::stopLoading):
+        * page/Page.cpp:
+        (WebCore::Page::setVisibilityState):
+        * page/PageVisibilityState.cpp:
+        (WebCore::pageVisibilityStateString):
+        * page/PageVisibilityState.h:
</ins><span class="cx"> 
</span><del>-2014-04-01  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix. Remove duplicate file entries.
</del><ins>+        Move Node::isMouseFocusable() to Element.
+        &lt;http://webkit.org/b/116762&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-03-31  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Node::isMouseFocusable() would just return isFocusable(), which is never true for a non-Element
+        since Node::supportsFocus() always returns false. So move it to Element!
</ins><span class="cx"> 
</span><del>-        Enable WEB_TIMING on Mac and iOS
-        https://bugs.webkit.org/show_bug.cgi?id=128064
</del><ins>+        * dom/Node.h:
+        * dom/Node.cpp:
+        * dom/Element.h:
+        * dom/Element.cpp:
+        (WebCore::Element::isMouseFocusable):
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig, Brent Fulgham.
</del><ins>+            Moved here from Node.
</ins><span class="cx"> 
</span><del>-        Enable WEB_TIMING. Add PerformanceTiming.cpp and JSPerformanceTiming.cpp
-        to the project.
-        
-        * Configurations/FeatureDefines.xcconfig:
-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::setFocusedNodeIfNeeded):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
</ins><span class="cx"> 
</span><del>-2014-04-01  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+            Walk up the parent chain with parentOrShadowHostElement() instead of parentOrShadowHostNode().
+            Removed a misleading no-op hunk about mouse-focusable ShadowRoots, since ShadowRoots are not
+            Elements and thus cannot be mouse-focusable.
</ins><span class="cx"> 
</span><del>-        AX: AccessibilityRenderObject::ariaLiveRegionAtomic() should default to true if
-        roleValue is ApplicationAlertRole || ApplicationStatusRole
-        https://bugs.webkit.org/show_bug.cgi?id=130907
</del><ins>+        * page/TouchAdjustment.cpp:
+        (WebCore::TouchAdjustment::nodeRespondsToTapGesture):
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+            Check that the Node is an Element before asking if it's mouse-focusable.
</ins><span class="cx"> 
</span><del>-        Tests: inspector-protocol/dom/getAccessibilityPropertiesForNode_liveRegion.html:
-               platform/mac/accessibility/aria-liveregions-attributes.html:
</del><ins>+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.h:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.h:
+        * html/HTMLMediaElement.h:
+        * html/HTMLSelectElement.h:
+        * html/HTMLTextAreaElement.h:
+        * html/shadow/ClearButtonElement.h:
+        * html/shadow/TextControlInnerElements.h:
+        * svg/SVGAElement.h:
+        * svg/SVGStyledElement.h:
</ins><span class="cx"> 
</span><del>-        Updated AccessibilityRenderObject::ariaLiveRegionAtomic() to match ARIA spec.
</del><ins>+            Sprinkle OVERRIDE.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::ariaLiveRegionAtomic):
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-01  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        Move Node::isKeyboardFocusable() to Element.
+        &lt;http://webkit.org/b/116761&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed. Fixing debug builds after r166586.
-
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::addEventListener): Fix the ASSERT.
-        (WebCore::SVGElement::removeEventListener): Ditto.
-
-2014-04-01  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Prevent unnecessary copies in compareEqual template
-        https://bugs.webkit.org/show_bug.cgi?id=131014
-
</del><span class="cx">         Reviewed by Antti Koivisto.
</span><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.h:
-        (compareEqual): Casting the second parameter to a non-const, non-reference type
-        causes an extra copy of that object. Casting to the const reference type of the
-        first parameter avoids that.
</del><ins>+        Only Elements can be keyboard-focusable. Move the base isKeyboardFocusable() implementation to Element
+        and sprinkle OVERRIDE on subclass overrides.
+        FocusController gets some temporary type checks that will go away as that code moves to dealing in
+        Elements instead of Node.
</ins><span class="cx"> 
</span><del>-2014-04-01  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        * dom/Node.h:
+        * dom/Node.cpp:
+        * dom/Element.h:
+        * dom/Element.cpp:
+        (WebCore::Element::isKeyboardFocusable):
</ins><span class="cx"> 
</span><del>-        Avoid unnecessary HashSet copies when calling collectInstancesForSVGElement
-        https://bugs.webkit.org/show_bug.cgi?id=131020
</del><ins>+            Move isKeyboardFocusable() from Node to Element.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * page/FocusController.cpp:
+        (WebCore::isNonFocusableShadowHost):
+        (WebCore::isFocusableShadowHost):
+        (WebCore::shouldVisit):
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
</ins><span class="cx"> 
</span><del>-        Remove collectInstancesForSVGElement() to avoid HashSet copies when assigning a const
-        HashSet reference to a non-const HashSet reference. Instead, range-based for-loops are
-        deployed to iterate directly over the const reference to HashSet that's returned by
-        SVGElement::instancesForElement(). SVGElement::containingShadowRoot() return value
-        is checked to see if the iteration should be performed in the first place, preserving
-        the behavior of collectInstancesForSVGElement().
</del><ins>+            Check that the inspected Node is an Element before querying isKeyboardFocusable().
</ins><span class="cx"> 
</span><del>-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::addEventListener):
-        (WebCore::SVGElement::removeEventListener):
-        (WebCore::collectInstancesForSVGElement): Deleted.
</del><ins>+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.h:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFrameOwnerElement.h:
+        * html/HTMLInputElement.h:
+        * html/HTMLPlugInElement.h:
+        * html/HTMLSelectElement.h:
+        * html/HTMLTextAreaElement.h:
+        * svg/SVGAElement.h:
+        * svg/SVGStyledElement.h:
</ins><span class="cx"> 
</span><del>-2014-04-01  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+            Sprinkle OVERRIDE.
</ins><span class="cx"> 
</span><del>-        Move the attributes HashMap out of the parseAttributes function
-        https://bugs.webkit.org/show_bug.cgi?id=131019
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Begin moving &quot;focus&quot; state logic from Node to Element.
+        &lt;http://webkit.org/b/116760&gt;
</ins><span class="cx"> 
</span><del>-        * xml/parser/XMLDocumentParserLibxml2.cpp:
-        (WebCore::parseAttributes): Avoid copying the HashMap object that's being returned by
-        converting it to an xvalue through using std::move() in the return statement.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-04-01  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Only Elements can be focused, so merge the &quot;focus&quot; state logic from Node and ContainerNode
+        and move it into Element. There's a lot more iceberg under this tip, but we'll be starting
+        with setFocus(bool) and focused().
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Transition class Image (and its dependencies) from int to float to enable subpixel positioned/sized images.
-        https://bugs.webkit.org/show_bug.cgi?id=130643
</del><ins>+        * dom/Node.h:
+        * dom/ContainerNode.cpp:
+        * dom/ContainerNode.h:
+        * dom/Element.cpp:
+        (WebCore::Element::isUserActionElementFocused):
+        (WebCore::Element::setFocus):
+        * dom/Element.h:
+        (WebCore::Element::focused):
+        * dom/Node.cpp:
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Move focused() and setFocus(bool) from Node/ContainerNode to Element.
</ins><span class="cx"> 
</span><del>-        This is in preparation to support subpixel positioned/sized background images. While 1x bitmap images can't take
-        subpixel sizing on hidpi resolutions, both generated and hidpi images can.
-        This patch does not change Image behavior in general as both position and size are still snapped to integral values.  
-
-        No change in behavior.
-
-        * WebCore.exp.in:
-        * css/CSSCrossfadeValue.cpp:
-        (WebCore::CSSCrossfadeValue::fixedSize):
-        * css/CSSFilterImageValue.cpp:
-        (WebCore::CSSFilterImageValue::fixedSize):
-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::drawImageIntoBuffer):
-        * loader/cache/CachedImage.cpp:
-        (WebCore::CachedImage::imageSizeForRenderer):
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
</ins><span class="cx">         * page/EventHandler.cpp:
</span><del>-        (WebCore::EventHandler::selectCursor):
-        * platform/Cursor.cpp:
-        (WebCore::determineHotSpot):
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::size):
-        (WebCore::BitmapImage::currentFrameSize):
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/CrossfadeGeneratedImage.cpp:
-        (WebCore::CrossfadeGeneratedImage::CrossfadeGeneratedImage):
-        (WebCore::drawCrossfadeSubimage):
-        (WebCore::CrossfadeGeneratedImage::drawCrossfade):
-        * platform/graphics/CrossfadeGeneratedImage.h:
-        * platform/graphics/GeneratedImage.h:
-        * platform/graphics/Gradient.cpp:
-        (WebCore::Gradient::adjustParametersForTiledDrawing):
-        * platform/graphics/Gradient.h:
-        * platform/graphics/GradientImage.cpp:
-        (WebCore::GradientImage::drawPattern):
-        * platform/graphics/GradientImage.h:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::createCompatibleBuffer):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::adjustSourceRectForDownSampling):
-        * platform/graphics/Image.h:
-        (WebCore::Image::setContainerSize):
-        (WebCore::Image::rect):
-        (WebCore::Image::width):
-        (WebCore::Image::height):
-        * platform/graphics/ImageBuffer.cpp:
-        (WebCore::ImageBuffer::createCompatibleBuffer):
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::ImageBuffer::create):
-        * platform/graphics/IntPoint.cpp:
-        (WebCore::IntPoint::IntPoint):
-        * platform/graphics/IntPoint.h:
-        * platform/graphics/IntSize.cpp:
-        (WebCore::IntSize::IntSize):
-        * platform/graphics/IntSize.h:
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::Image::drawPattern):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        * platform/graphics/cg/ImageBufferDataCG.cpp:
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        (WebCore::PDFDocumentImage::size):
-        (WebCore::PDFDocumentImage::updateCachedImageIfNeeded):
-        (WebCore::applyRotationForPainting):
-        * platform/graphics/cg/PDFDocumentImage.h:
-        * platform/graphics/cg/PatternCG.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-        * platform/graphics/mac/GraphicsContextMac.mm:
-        * platform/graphics/mac/IconMac.mm:
-        * platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:
-        (WebCore::TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded):
-        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
-        (WebCore::CoordinatedImageBacking::update):
-        * platform/graphics/win/ImageCGWin.cpp:
-        (WebCore::BitmapImage::getHBITMAPOfSize):
-        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
-        * platform/graphics/win/ImageCairoWin.cpp:
-        (WebCore::BitmapImage::getHBITMAPOfSize):
-        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
-        * platform/mac/DragImageMac.mm:
-        (WebCore::createDragImageFromImage):
-        * platform/win/DragImageCGWin.cpp:
-        (WebCore::createDragImageFromImage):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeImage):
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::imageSizeForError):
-        (WebCore::RenderImage::paintReplaced):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::drawPlatformResizerImage):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::setContainerSize):
-        * svg/graphics/SVGImage.h:
-        * svg/graphics/SVGImageCache.cpp:
-        (WebCore::SVGImageCache::imageSizeForRenderer):
-        * svg/graphics/SVGImageCache.h:
-        * svg/graphics/SVGImageForContainer.cpp:
-        (WebCore::SVGImageForContainer::size):
-        * svg/graphics/SVGImageForContainer.h:
-        * svg/graphics/filters/SVGFEImage.cpp:
-        (WebCore::FEImage::externalRepresentation):
-        * testing/Internals.cpp:
-        (WebCore::Internals::getCurrentCursorInfo):
</del><ins>+        (WebCore::EventHandler::dispatchMouseEvent):
</ins><span class="cx"> 
</span><del>-2014-04-01  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+            Check if the inspected Node is an Element before asking if it's focused.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix when disabled ACCESSIBILITY
</del><ins>+2013-05-25  Noam Rosenthal  &lt;noam.rosenthal@nokia.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/atk/WebKitAccessibleInterfaceTableCell.cpp:
-        Separated macros not to check ATK version when disabled ACCESSIBILITY
</del><ins>+        Direct pattern compositing breaks when no-repeat is set on a large layer
+        https://bugs.webkit.org/show_bug.cgi?id=116140
</ins><span class="cx"> 
</span><del>-2014-04-01  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        [CMake][EFL] Enable CSS JIT
-        https://bugs.webkit.org/show_bug.cgi?id=131010
</del><ins>+        In some cases the directly composited background color logic overrides the layer's
+        contentsRect, which results in wrong rendering of tiled images.
+        This patch makes sure that the background image is applied after the solid color,
+        which ensures the correct contentsRect.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Test: compositing/patterns/direct-pattern-compositing-contain-no-repeat.html
</ins><span class="cx"> 
</span><del>-        Add an inclusion path for enabling CSS JIT on EFL and GTK ports.
-        This patch only enables it for EFL port.
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateDirectlyCompositedContents):
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
</del><ins>+2013-05-24  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-04-01  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        Move &quot;hover&quot; state logic from Node to Element.
+        &lt;http://webkit.org/b/116757&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Readonly attributes installed as readwrite in GObject DOM bindings
-        https://bugs.webkit.org/show_bug.cgi?id=130978
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+        Resolve a 7 year old FIXME by merging the &quot;hover&quot; state logic from Node and ContainerNode
+        and moving it all to Element instead.
</ins><span class="cx"> 
</span><del>-        Unify how we decide if an attribute is readable or writeable and improve the code.
-        This results in some attributes now being marked as read-only which didn't have
-        corresponding case statements in the set_property switch statements and also correctly
-        installs set_property support for some more POD types.
</del><ins>+        * dom/Node.cpp:
+        (WebCore::Node::detach):
+        * dom/Element.cpp:
+        (WebCore::Element::detach):
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorGObject.pm:
-        (IsPropertyReadable): Added this helper to simplify deciding if an attribute is readable.
-        (IsPropertyWriteable): Added this helper to simplify deciding if an attribute is writeable. Also
-        update the list of types to reflect the full list of types we can generate setters for.
-        (GenerateProperty): Use the IsPropertyWriteable helper instead of checking whether the attribute is read-only.
-        Also fix generation of the blurb by using $mutableString instead of $mutableStringconst which isn't used.
-        (GenerateProperties): Use grep and the new helpers to simplify the code.
-        (GetReadableProperties): Deleted.
-        (GetWriteableProperties): Deleted.
-        * bindings/scripts/test/GObject: Update results
</del><ins>+            Move Document::hoveredNodeDetached() call from Node::detach() to Element::detach().
</ins><span class="cx"> 
</span><del>-2014-03-31  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        (WebCore::Element::isUserActionElementHovered):
+        (WebCore::Element::setHovered):
+        * dom/Element.h:
+        (WebCore::Element::hovered):
</ins><span class="cx"> 
</span><del>-        [EFL][WK2] Extract the control of page background out of color_set
-        https://bugs.webkit.org/show_bug.cgi?id=127539
</del><ins>+            Moved here from Node/ContainerNode.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        * dom/UserActionElementSet.h:
+        (WebCore::UserActionElementSet::setHovered):
+        (WebCore::UserActionElementSet::setFlags):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
-        Added m_viewBackgroundColor to clear when m_setDrawsBackground is false.
-        (WebCore::CoordinatedGraphicsScene::CoordinatedGraphicsScene):
-        (WebCore::CoordinatedGraphicsScene::paintToCurrentGLContext):
-        (WebCore::CoordinatedGraphicsScene::paintToGraphicsContext):
-        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.h:
-        (WebCore::CoordinatedGraphicsScene::setViewBackgroundColor):
-        (WebCore::CoordinatedGraphicsScene::viewBackgroundColor):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):
-        Added EFL guard not to set opaque as a default for MainFrameRenderViewLayer.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::ensureRootLayer):
-        Added EFL guard to apply page scale on RenderView like IOS.
</del><ins>+            Make setHovered() take an Element* instead of a Node*. I'd like to do this will all
+            of these methods eventually, so added a setFlags() helper with the tighter type.
</ins><span class="cx"> 
</span><del>-2014-03-31  Byungseon Shin  &lt;sun.shin@lge.com&gt;
</del><ins>+        * html/HTMLLabelElement.h:
+        * html/shadow/SpinButtonElement.h:
</ins><span class="cx"> 
</span><del>-        [WebGL][OpenGLES] Enable MSAA support for WebGL Canvas
-        https://bugs.webkit.org/show_bug.cgi?id=130955
</del><ins>+            Sprinkle OVERRIDE on setHovered() overrides.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::updateHoverActiveState):
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::isHovered):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isHovered):
</ins><span class="cx"> 
</span><del>-        To avoid aliasing issues when we render content to WebGL canvas,
-         we need to implement MSAA support.
-        - Imagination OpenGLES GPU Driver already support MSAA, so we
-         need a separate code path to enable it.
</del><ins>+            Check if the inspected Node is an element before asking if it's hovered.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Extensions3D.h:
-        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
-        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon):
-        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
-        (WebCore::Extensions3DOpenGLCommon::isImagination):
-        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
-        (WebCore::GraphicsContext3D::reshapeFBOs):
</del><ins>+2013-05-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Document::formController() should return a reference.
+        &lt;http://webkit.org/b/116758&gt;
</ins><span class="cx"> 
</span><del>-        Crashes in PageConsole::addMessage
-        https://bugs.webkit.org/show_bug.cgi?id=130991
-        &lt;rdar://problem/14795232&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        The formController() is created on demand, so return a reference instead.
</ins><span class="cx"> 
</span><del>-        Test: http/tests/misc/detached-frame-console.html
</del><ins>+        * dom/Document.h:
+        * dom/Document.cpp:
+        (WebCore::Document::formController):
+        (WebCore::Document::setStateForNewFormElements):
+        * html/HTMLFormControlElementWithState.cpp:
+        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::didMoveToNewDocument):
+        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::~HTMLFormElement):
+        (WebCore::HTMLFormElement::finishParsingChildren):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::~HTMLInputElement):
+        (WebCore::HTMLInputElement::didMoveToNewDocument):
+        (WebCore::HTMLInputElement::checkedRadioButtons):
</ins><span class="cx"> 
</span><del>-        * page/DOMWindow.cpp: (WebCore::DOMWindow::printErrorMessage): Added a null check.
-        It's legitimate for this to be called for a window that is not currently displayed
-        in a frame.
</del><ins>+2013-05-25  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Reducing CSS code duplication in declaration list error recovery
+        https://bugs.webkit.org/show_bug.cgi?id=115157
</ins><span class="cx"> 
</span><del>-        [UI-side compositing] Proxy animations to the UI process
-        https://bugs.webkit.org/show_bug.cgi?id=130946
-
-        Reviewed by Tim Horton.
-        
-        To proxy CA animations, make PlatformCAAnimation a pure virtual base class
-        and subclass for Mac, Windows, and Remote (just like PlatformCALayer).
-        
-        Add coding support for TimingFunctions.
-        
-        Do some minor #include tidyup.
-        
-        Minor refactor in GraphicsLayerCA to share some animations code.
-
-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/animation/TimingFunction.h: Add setters need for encode/decode.
-        (WebCore::CubicBezierTimingFunction::setValues):
-        (WebCore::CubicBezierTimingFunction::setTimingFunctionPreset):
-        (WebCore::StepsTimingFunction::create):
-        (WebCore::StepsTimingFunction::setNumberOfSteps):
-        (WebCore::StepsTimingFunction::setStepAtStart):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::createPlatformCAAnimation):
-        (WebCore::GraphicsLayerCA::animationCanBeAccelerated): Minor refactor so we can share
-        code with GraphicsLayerCARemote.
-        (WebCore::GraphicsLayerCA::addAnimation):
-        (WebCore::GraphicsLayerCA::createBasicAnimation):
-        (WebCore::PassRefPtr&lt;PlatformCAAnimation&gt;GraphicsLayerCA::createKeyframeAnimation):
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * platform/graphics/ca/PlatformCAAnimation.h:
-        (WebCore::PlatformCAAnimation::~PlatformCAAnimation):
-        (WebCore::PlatformCAAnimation::isPlatformCAAnimationMac):
-        (WebCore::PlatformCAAnimation::isPlatformCAAnimationWin):
-        (WebCore::PlatformCAAnimation::isPlatformCAAnimationRemote):
-        (WebCore::PlatformCAAnimation::PlatformCAAnimation):
-        (WebCore::PlatformCAAnimation::setType):
-        * platform/graphics/ca/PlatformCALayer.h:
-        * platform/graphics/ca/mac/PlatformCAAnimationMac.h: Added.
-        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (PlatformCALayerMac::addAnimationForKey):
-        (PlatformCALayerMac::animationForKey):
-        * platform/graphics/ca/mac/TileController.mm:
-        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
-        * platform/graphics/ca/win/PlatformCAAnimationWin.h: Added.
-
-2014-03-31  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        CSS JIT: compile the first-child pseudo class
-        https://bugs.webkit.org/show_bug.cgi?id=130954
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        * css/ElementRuleCollector.cpp:
-        (WebCore::ElementRuleCollector::collectMatchingRules):
-        The compiler use the context's style directly when resolving style. An error introduced
-        in the rule collector would cause a crash in the compiled code which would be hard to debug.
-        Add an assertion early in the stack to catch errors where it is easier to debug them.
</del><ins>+        From Blink r148974 by &lt;serya@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::State::initForStyleResolve):
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::addPseudoType):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToPreviousAdjacentElement):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateWalkToPreviousAdjacent):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
-        Refactor those to be able to reuse the code getting a sibling element preceding the current element.
</del><ins>+        Refactor &quot;invalid_block_list error | /* empty */&quot; in a new
+        decl_list_recovery rule that allows to remove 4 redundant rules.
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::SelectorCodeGenerator::jumpIfNotResolvingStyle):
-        Extract the code checking the current mode from SelectorCodeGenerator::markParentElementIfResolvingStyle()
-        in a separate function. This will be useful for all the pseudo class with marking.
</del><ins>+        No new test required as we're just refactoring code, no new behaviour.
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::SelectorCodeGenerator::markParentElementIfResolvingStyle):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
-        (WebCore::SelectorCompiler::setFirstChildState):
-        This is the slow path for when the first-child pseudo class is on a fragment that is not
-        the rightmost.
-        The reason to use a slow path is accessing renderStyle() is not trivial and this case isn't not
-        as common. We should improve this later.
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsFirstChild):
-        This is just implementing the test for first-child plus the tree marking. Nothing fancy,
-        this is basically the same thing as SelectorChecker.
</del><ins>+2013-05-24  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::setChildrenAffectedByFirstChildRules):
-        * dom/Element.h:
-        C++ fallback to set the flag, to be improved later with the other flags.
</del><ins>+        Build fix after r150664.
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.h:
-        I accidentaly put noninheritedFlagsMemoryOffset() as private in the RenderStyle refactoring.
</del><ins>+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        Also update the flags accessor to make them easier to work with from the compiler. In particular,
-        setFirstChildStateFlags() sets both isUnique and firstChild. Currently the JIT does not need to access
-        the value so individual flags are made private.
</del><ins>+2013-05-24  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Fixing invalid block recovery in some declaration list.
+        https://bugs.webkit.org/show_bug.cgi?id=115159
</ins><span class="cx"> 
</span><del>-        Remove WEB_ANIMATIONS
-        https://bugs.webkit.org/show_bug.cgi?id=130989
-
-        Reviewed by Simon Fraser.
-
-        Remove this feature flag until we plan to implement.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2014-03-31  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Fix iOS build.
-
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::updateLayersAfterDelegatedScroll):
-
-2014-03-31  Pratik Solanki  &lt;psolanki@apple.com&gt;
-
-        Unreviewed. iOS build fix after r166532. Add missing comma.
-
-        * dom/DocumentMarker.h:
-
-2014-03-31  Brady Eidson  &lt;beidson@apple.com&gt;
-
-        Add variant of phone number parsing that use DocumentMarker in the current selection
-        &lt;rdar://problem/16379566&gt; and https://bugs.webkit.org/show_bug.cgi?id=130917
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * dom/DocumentMarker.h:
-        (WebCore::DocumentMarker::AllMarkers::AllMarkers): Add a new TelephoneNumber document marker type.
</del><ins>+        From Blink r148889 by &lt;serya@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::respondToChangedSelection):
-        (WebCore::Editor::scanSelectionForTelephoneNumbers): TextIterate over the selected range looking for numbers.
-        (WebCore::Editor::scanRangeForTelephoneNumbers): Scan the given range for a telephone number,
-          adding the DocumentMarker to any that are found.
-        (WebCore::Editor::clearDataDetectedTelephoneNumbers):
-        * editing/Editor.h:
</del><ins>+        Improves the detection of some invalid block declarations inside a
+        declaration list. This allows the parser not to completely discard
+        a whole declaration list that contains an invalid block. In
+        particular grammar failed in tests 8, 12, 13, 15, 16 and 17 in the
+        new test added by this change.
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::HTMLTreeBuilder::processCharacterBufferForInBody): Only linkify on iOS.
</del><ins>+        Test: fast/css/parsing-invalid-block-recovery.html
</ins><span class="cx"> 
</span><del>-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintTelephoneNumberMarker): Placeholder UI while the feature is developed.
-        (WebCore::InlineTextBox::paintDocumentMarkers):
-        * rendering/InlineTextBox.h:
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp:
-        (WebCore::markerTypesFrom):
</del><span class="cx"> 
</span><del>-2014-03-31  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-05-24  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Hook up scroll events for accelerated overflow:scroll
-        https://bugs.webkit.org/show_bug.cgi?id=130976
</del><ins>+        DidFirstFlushForHeaderLayer can be called too soon on pages that redirect
+        https://bugs.webkit.org/show_bug.cgi?id=116749
+        -and corresponding-
+        &lt;rdar://problem/13886753&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        When an accelerated overflow:scroll is scrolled in the UI process,
-        tell the WebProcess that the scroll happened to update RenderLayer
-        state and fire events.
-        
-        In the WebProcess, RemoteScrollingCoordinator gets a message from the
-        UI process and calls AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll().
-        Fixed that function to handle scrolling nodes other than the root, which
-        required storing a map of ScrollingNodeID-&gt;RenderLayer* on RenderLayerCompositor,
-        accessible through FrameView::scrollableAreaForScrollLayerID().
-
-        * WebCore.exp.in:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollableAreaForScrollLayerID):
-        * page/FrameView.h:
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll): Handle
-        overflow as well as main frame scrolling nodes.
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::viewportChangedViaDelegatedScrolling): Use isScrollingNode().
-        (WebCore::ScrollingTree::scrollPositionChangedViaDelegatedScrolling): When an overflow
-        scroll node was scrolled externally, we have to update layers in decendant nodes,
-        and then call scrollingTreeNodeDidScroll() which tells the ScrollingCoordinator that
-        we scrolled.
-        * page/scrolling/ScrollingTree.h: Try to reduce confusion between the roles played
-        by these various functions, some of which happen in the UI process with UI-side
-        compositing.
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h: Need some functions to be
-        callable by subclasses.
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::updateLayersAfterDelegatedScroll):
</del><ins>+        Only start m_paintRelatedMilestonesTimer if we have actually painted.
</ins><span class="cx">         * rendering/RenderLayerCompositor.cpp:
</span><del>-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer): Add
-        scrolling layers to the m_scrollingNodeToLayerMap
-        (WebCore::RenderLayerCompositor::detachScrollCoordinatedLayer): Remove
-        layer from the m_scrollingNodeToLayerMap.
-        (WebCore::RenderLayerCompositor::scrollableAreaForScrollLayerID):
-        * rendering/RenderLayerCompositor.h:
</del><ins>+        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
</ins><span class="cx"> 
</span><del>-2014-03-31  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-05-24  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rename TileCache to LegacyTileCache
-        https://bugs.webkit.org/show_bug.cgi?id=130986
</del><ins>+        Fix Windows build.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
</ins><span class="cx"> 
</span><del>-        Rename iOS WebKit1 tile cache classes to reflect its status.
-        This also frees some good type names.
</del><ins>+2013-05-24  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        TileCache -&gt; LegacyTileCache
-        TileGrid -&gt; LegacyTileGrid
-        TileGridTile -&gt; LegacyTileGridTile
-        etc.
</del><ins>+        Animated GIFs don't repaint after TiledCoreAnimationDrawingArea un-suspends painting
+        https://bugs.webkit.org/show_bug.cgi?id=116744
+        &lt;rdar://problem/13973514&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        Small adjustments to WebCore::IOSurface
-        https://bugs.webkit.org/show_bug.cgi?id=130981
-
</del><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Export some more things.
</del><ins>+        * WebCore.exp.in: Export FrameView::resumeAnimatingImages.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setIsInWindow):
+        (WebCore::FrameView::resumeAnimatingImages):
+        Factor the code to restart animated images out of frameView::setIsInWindow.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cocoa/IOSurface.h:
-        createImage() can't be const because it calls ensurePlatformContext().
</del><ins>+        * page/FrameView.h:
+        (FrameView):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cocoa/IOSurface.mm:
-        (IOSurface::createImage):
-        We should be able to create an image even if the CGContext has been cleared (or never created).
</del><ins>+2013-05-24  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (IOSurface::isInUse):
-        Rename inUse() to isInUse().
</del><ins>+        Move history property list writer to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=116746
</ins><span class="cx"> 
</span><del>-        (IOSurface::clearGraphicsContext):
-        Add clearGraphicsContext().
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2014-03-31  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Remove files from the Xcode project and remove symbols that now live in WebKit.
</ins><span class="cx"> 
</span><del>-        Allocate IOSurfaces with the same cache mode that CoreAnimation uses
-        https://bugs.webkit.org/show_bug.cgi?id=130982
-
-        Reviewed by Simon Fraser.
-
-        * platform/graphics/cocoa/IOSurface.mm:
-        (IOSurface::IOSurface):
-        CA uses kIOMapWriteCombineCache for IOSurfaces allocated on iOS.
-
-2014-03-31  Ion Rosca  &lt;rosca@adobe.com&gt;
-
-        [CSS Blending] Blend mode property is propagated to multiple GraphicLayers
-        https://bugs.webkit.org/show_bug.cgi?id=130337
-
-        Reviewed by Dean Jackson.
-
-        Resets the blend mode for graphicsLayer when it has an ancestorClippingLayer.
-
-        Test: css3/compositing/blend-mode-ancestor-clipping-layer.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateBlendMode):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateBlendMode):
-        * rendering/RenderLayerBacking.h:
-
-2014-03-31  Ion Rosca  &lt;rosca@adobe.com&gt;
-
-        [CSS Blending] showLayerTree should dump layer's blend mode and isolation properties
-        https://bugs.webkit.org/show_bug.cgi?id=130922
-
-        Reviewed by Simon Fraser.
-
-        This change only updates existing tests involving blending. No new test required,
-        as there is no new or changed functionality.
-
-        * rendering/RenderLayer.h: adding blendMode() getter.
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::write):
-        adding blendMode property and layer's isolation status (does layer isolate blending descendants or not?).
-
-2014-03-31  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        CSS JIT: clean up the functions ending when generating a checker with context
-        https://bugs.webkit.org/show_bug.cgi?id=130959
-
-        Reviewed by Andreas Kling.
-
-        This code got refactored over time and now both branches do the exact same action
-        on the stack.
-        This patch removes the stack split and move the stack cleanup in the common ending
-        just before restoring the callee saved registers.
-
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
-
-2014-03-31  Beth Dakin  &lt;bdakin@apple.com&gt;
-
-        ThemeMac should use std::array instead of IntSize* for control sizes
-        https://bugs.webkit.org/show_bug.cgi?id=130985
-
-        Reviewed by Darin Adler.
-
-        Replace uses of const IntSize* with const std::array&lt;IntSize, 3&gt;
-        * platform/mac/ThemeMac.mm:
-        (WebCore::sizeFromNSControlSize):
-        (WebCore::sizeFromFont):
-        (WebCore::controlSizeFromPixelSize):
-        (WebCore::setControlSize):
-        (WebCore::checkboxSizes):
-        (WebCore::radioSizes):
-        (WebCore::buttonSizes):
-        (WebCore::setUpButtonCell):
-        (WebCore::stepperSizes):
-
-2014-03-31  Hans Muller  &lt;hmuller@adobe.com&gt;
-
-        [CSS Shapes] Simplify RasterShape implementation
-        https://bugs.webkit.org/show_bug.cgi?id=130916
-
-        Reviewed by Dean Jackson.
-
-        Since only floats can specify shape-outside, the RasterShapeIntervals
-        class only needs to track the first and last above threshold pixel column
-        (x1 and x2 in the implementation) for each row. Removed code for dealing with
-        multiple &quot;runs&quot; per row as well as shape-inside internals.
-
-        No new tests, since functionality was only removed.
-
-        * rendering/shapes/RasterShape.cpp:
-        (WebCore::RasterShapeIntervals::computeShapeMarginIntervals):
-        (WebCore::RasterShapeIntervals::initializeBounds):
-        (WebCore::RasterShapeIntervals::buildBoundsPath):
-        (WebCore::RasterShape::getExcludedIntervals):
-        * rendering/shapes/RasterShape.h:
-        (WebCore::RasterShapeIntervals::RasterShapeIntervals):
-        (WebCore::RasterShapeIntervals::intervalAt):
-        (WebCore::RasterShape::RasterShape):
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createRasterShape):
-        * rendering/shapes/ShapeInterval.h:
-        (WebCore::ShapeInterval::unite):
-
-2014-03-31  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Always inline toJS() for NodeList.
-        &lt;https://webkit.org/b/130974&gt;
-
-        This is a pretty cheesy optimization, but it's a 3% progression on
-        Dromaeo/dom-query.html on my MBP.
-
-        Reviewed by Benjamin Poulain.
-
</del><span class="cx">         * WebCore.exp.in:
</span><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * bindings/js/JSNodeListCustom.h: Added.
-        (WebCore::toJS):
-        * dom/NodeList.idl:
</del><span class="cx"> 
</span><del>-2014-03-31  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-05-24  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Attempt to fix the 32bits debug builds
</del><ins>+        Global constructors exposed in worker environment have wrong attributes
+        https://bugs.webkit.org/show_bug.cgi?id=116708
</ins><span class="cx"> 
</span><del>-        The additional debug flags in RefCounted cause the structure to have different alignment
-        with the 64bits flags.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.cpp:
</del><ins>+        Fix JSC bindings generator so that Global constructors exposed in worker environment
+        have the following attributes:
+        { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }
</ins><span class="cx"> 
</span><del>-2014-03-29  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        This is now consistent with global constructors on DOMWindow and with the Web IDL
+        specification:
+        http://dev.w3.org/2006/webapi/WebIDL/#es-interfaces
</ins><span class="cx"> 
</span><del>-        Clarify some scrolling tree terminology
-        https://bugs.webkit.org/show_bug.cgi?id=130929
</del><ins>+        Test: fast/js/global-constructors-attributes-worker.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateAttributesHashTable):
</ins><span class="cx"> 
</span><del>-        Attempt to reduce some ambiguity in scrolling tree terminology.
-        When async scrolling occurs, there are two tasks we have to perform:
-        1. Layers need to be updated to reflect the scroll
-        2. WebCore state has to be updated.
-        The &quot;updateForViewport&quot; name didn't clearly reflect which of these
-        tasks was being performed, so rename it to updateLayersAfterViewportChange()
-        to reflect the fact that it only does the first.
-        
-        Remove the Mac implementation of updateLayersAfterViewportChange(), since
-        it was confsued about this, and was never called anyway.
</del><ins>+2013-05-24  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::viewportChangedViaDelegatedScrolling):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h:
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::updateLayersAfterViewportChange):
-        (WebCore::ScrollingTreeScrollingNodeIOS::updateForViewport): Deleted.
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::updateLayersAfterViewportChange):
-        (WebCore::ScrollingTreeScrollingNodeMac::updateForViewport): Deleted.
</del><ins>+        Remove custom code for webkitAudioContext global constructor getter
+        https://bugs.webkit.org/show_bug.cgi?id=116530
</ins><span class="cx"> 
</span><del>-2014-03-31  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Disable tile cohort retention for now
-        https://bugs.webkit.org/show_bug.cgi?id=130926
-        &lt;rdar://problem/16465413&gt;
</del><ins>+        Get rid of custom code for webkitAudioContext global constructor getter. The
+        global DOMWindow attribute is now automatically generated by leveraging support
+        for [EnabledAtRuntime] extended attribute and the existing methods in
+        RuntimeEnabledFeatures class.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setScrollingPerformanceLoggingEnabled):
-        (WebCore::Settings::setAggressiveTileRetentionEnabled): Deleted.
-        * page/Settings.h:
-        (WebCore::Settings::aggressiveTileRetentionEnabled): Deleted.
-        * page/Settings.in:
-        Use Settings.in for these simple settings.
</del><ins>+        * GNUmakefile.list.am: Remove JSDOMWindowWebAudioCustom.*.
+        * Modules/webaudio/AudioContext.idl:
+        Remove [NoInterfaceObject] extended attribute so that the global constructor is
+        automatically generated instead of automatically added. Add [EnabledAtRuntime]
+        extended attribute since this global constructor can be disabled at runtime and
+        so that we can getter rid of the [CustomGetter] for the corresponding global
+        constructor. Use [InterfaceName] extended attribute so that the interface name
+        matches the global constructor on DOMWindow (webkitAudioContext).
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::GraphicsLayerClient::shouldAggressivelyRetainTiles):
-        (WebCore::GraphicsLayerClient::shouldTemporarilyRetainTileCohorts):
-        * platform/graphics/TiledBacking.h:
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::platformCALayerShouldAggressivelyRetainTiles):
-        (WebCore::GraphicsLayerCA::platformCALayerShouldTemporarilyRetainTileCohorts):
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * platform/graphics/ca/PlatformCALayerClient.h:
-        (WebCore::PlatformCALayerClient::platformCALayerShouldAggressivelyRetainTiles):
-        (WebCore::PlatformCALayerClient::platformCALayerShouldTemporarilyRetainTileCohorts):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::shouldAggressivelyRetainTiles):
-        (WebCore::RenderLayerBacking::shouldTemporarilyRetainTileCohorts):
-        * rendering/RenderLayerBacking.h:
-        Plumb the two tile-retention settings through to TileController in a pull manner
-        instead of a push manner, as there were some cases (especially on iOS) where
-        the settings weren't always getting pushed down.
</del><ins>+        * Target.pri: Remove JSDOMWindowWebAudioCustom.*.
+        * UseJSC.cmake: Remove JSDOMWindowWebAudioCustom.*.
+        * WebCore.exp.in: Export additional symbol.
+        * WebCore.order: Export additional symbol.
+        * WebCore.vcproj/WebCore.vcproj: Remove JSDOMWindowWebAudioCustom.*.
+        * WebCore.vcxproj/WebCore.vcxproj: Remove JSDOMWindowWebAudioCustom.*.
+        * WebCore.vcxproj/WebCore.vcxproj.filters: Remove JSDOMWindowWebAudioCustom.*.
+        * WebCore.xcodeproj/project.pbxproj: Remove JSDOMWindowWebAudioCustom.*.
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setWebAudioEnabled):
+        * bindings/js/JSBindingsAllInOne.cpp: Remove JSDOMWindowWebAudioCustom.*.
+        * bindings/js/JSDOMWindowWebAudioCustom.cpp: Removed. We no longer need any custom code for
+        the WebAudio global constructor getter because we use [EnabledAtRuntime] support in the
+        bindings generator now.
+        * page/DOMWindow.idl: Remove global constructor for AudioContext as it is now automatically
+        generated.
+        * page/Settings.in: Remove webAudioEnabled setting as we use the existing setting
+        in RuntimeEnabledFeatures now.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::TileController):
-        (WebCore::TileController::tileRevalidationTimerFired):
-        (WebCore::TileController::revalidateTiles):
-        (WebCore::TileController::drawTileMapContents):
-        Aggressive tile retention wins over temporary retention. If we aren't
-        using temporary (cohort) retention, throw away the cohort as soon as it
-        is created.
</del><ins>+2013-05-24  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        [AC] Needs to be guarded by USE(ACCELERATED_COMPOSITING)
+        https://bugs.webkit.org/show_bug.cgi?id=116712
</ins><span class="cx"> 
</span><del>-        Radio buttons and checkboxes should share code
-        https://bugs.webkit.org/show_bug.cgi?id=130915
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        renderView is used when ACCELERATED_COMPOSITING is enabled.
+        So, this patch allows it to be guarded by USE(ACCELERATED_COMPOSITING).
</ins><span class="cx"> 
</span><del>-        Radio buttons and checkboxes now share a lot of code. The common term for both is 
-        toggle buttons.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Move these radio-sizing functions up in the file to be next to the checkbox sizing 
-        functions.
-        * platform/mac/ThemeMac.mm:
-        (WebCore::radioSizes):
-        (WebCore::radioMargins):
-        (WebCore::radioSize):
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::setFrameRect):
</ins><span class="cx"> 
</span><del>-        Configures a radio button or a checkbox.
-        (WebCore::configureToggleButton):
</del><ins>+2013-05-24  Thomas Deniau  &lt;deniau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Creates a radio button or a checkbox.
-        (WebCore::createToggleButtonCell):
</del><ins>+        Add more lines to the context during Dictionary lookups
+        https://bugs.webkit.org/show_bug.cgi?id=115256
</ins><span class="cx"> 
</span><del>-        Still have a shared cell for each.
-        (WebCore::sharedRadioCell):
-        (WebCore::sharedCheckboxCell):
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Does the work of the old paintRadio() and paintCheckbox().
-        (WebCore::paintToggleButton):
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-        Use sharedRadioCell() here.
-        (WebCore::ThemeMac::inflateControlPaintRect):
</del><ins>+        * WebCore.exp.in: Export a few methods in VisibleUnits needed to be able
+        to call previousLinePosition(), nextLinePosition(), startOfLine() and
+        endOfLine() in WebPageMac.mm when determining the context while looking
+        up a dictionary definition. These symbols used to be exported for iOS
+        only, export them on the desktop too.
</ins><span class="cx"> 
</span><del>-        Call paintToggleButton() for radio buttons and checkboxes.
-        (WebCore::ThemeMac::paint):
</del><ins>+2013-05-24  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        All gone.
-        (WebCore::configureCheckbox): Deleted.
-        (WebCore::createCheckboxCell): Deleted.
-        (WebCore::paintCheckbox): Deleted.
-        (WebCore::radio): Deleted.
-        (WebCore::paintRadio): Deleted.
</del><ins>+        Remove PagePopup code
+        https://bugs.webkit.org/show_bug.cgi?id=116732
</ins><span class="cx"> 
</span><del>-2014-03-31  Samuel White  &lt;samuel_white@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        AX: Need ability to get line range for text marker.
-        https://bugs.webkit.org/show_bug.cgi?id=130906
</del><ins>+        Remove all page popup code.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
-
-        Added ability to get line range from any marker on that line. This matches the functionality of existing
-        attributes such as AXParagraphTextMarkerRangeForTextMarker and AXSentenceTextMarkerRangeForTextMarker.
-
-        Test: platform/mac/accessibility/line-range-for-text-marker.html
-
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::visiblePositionRangeForRange):
-        (WebCore::AccessibilityObject::lineRangeForPosition):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-        (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
-
-2014-03-31  Anders Carlsson  &lt;andersca@apple.com&gt;
-
-        Fix iOS build.
-
</del><ins>+        * GNUmakefile.list.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContextFeatures.cpp:
+        * dom/ContextFeatures.h:
+        * loader/EmptyClients.h:
</ins><span class="cx">         * page/ChromeClient.h:
</span><del>-        (WebCore::ChromeClient::updateViewportConstrainedLayers):
</del><ins>+        * page/DOMWindowPagePopup.cpp: Removed.
+        * page/DOMWindowPagePopup.h: Removed.
+        * page/DOMWindowPagePopup.idl: Removed.
+        * page/PagePopup.h: Removed.
+        * page/PagePopupClient.cpp: Removed.
+        * page/PagePopupClient.h: Removed.
+        * page/PagePopupController.cpp: Removed.
+        * page/PagePopupController.h: Removed.
+        * page/PagePopupController.idl: Removed.
+        * page/PagePopupDriver.h: Removed.
+        * testing/Internals.cpp:
+        (WebCore::Internals::resetToConsistentState):
+        (WebCore):
+        * testing/Internals.h:
+        (WebCore):
+        (Internals):
+        * testing/Internals.idl:
+        * testing/MockPagePopupDriver.cpp: Removed.
+        * testing/MockPagePopupDriver.h: Removed.
</ins><span class="cx"> 
</span><del>-2014-03-31  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-05-24  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [MSE][Mac] Support lease-renewal.
-        https://bugs.webkit.org/show_bug.cgi?id=130919
</del><ins>+        Mac: Set the default audio buffer size to a large value for &lt;video&gt; elements.
+        https://bugs.webkit.org/show_bug.cgi?id=116342
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Eric Carlson.
</span><ins>+        Roll-in rubber stamped by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Trigger a new key request when receiving an update message containting &quot;renew&quot;.
</del><ins>+        To enable power savings by waking up the audio hardware less often, set the
+        requested buffer frame size to a large value, such as 4096. Since this results
+        in approximately 100ms worth of buffer, set the buffer size to a much lower
+        value when playing WebAudio, which is much more sensitive to latency than video
+        or audio elements.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
-        (WebCore::CDMSessionMediaSourceAVFObjC::generateKeyRequest): Drive-by fix; generate a UTF-8
-            based array.
-        (WebCore::CDMSessionMediaSourceAVFObjC::update):
</del><ins>+        Introduce a new class, AudioSessionManager, as well as a helper class,
+        AudioSessionManagerToken. Audio elements, video elements, and WebAudio destination
+        nodes will create and retain a token, and release the token in their destructor.
+        This allows the AudioSessionManager to track how many of what type of audio-
+        generating objects are in existence.
</ins><span class="cx"> 
</span><del>-2014-03-31  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        This requires implementing AudioSession for Mac platforms. Move the implementation
+        for retrieving the hardware sample rate and setting the buffer duration into
+        AudioSessionMac from AudioDestinationMac, to be shared with AudioSessionManagerMac.
</ins><span class="cx"> 
</span><del>-        Remove special handling of soft hyphens in search code
-        https://bugs.webkit.org/show_bug.cgi?id=130940
</del><ins>+        Change the AudioSession method preferredBufferLength() into preferredBufferSize(),
+        as the callers really want to specify a buffer size, not a buffer duration. On iOS,
+        where the available API requires a duration, perform the conversion from duration to
+        size on behalf of the caller.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        However, since the original version of this patch caused media test
+        failures on the Mac ML and Lion bots, only enable the buffer size
+        change for OS X &gt; ML.
</ins><span class="cx"> 
</span><del>-        ICU knows to ignore soft hyphens, so we don't need to replace them before searching.
</del><ins>+        * html/HTMLMediaElement.h:  Add a AudioSessionManagerToken member.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize the token.
+        * platform/audio/AudioSession.cpp:
+        (WebCore::AudioSession::preferredBufferSize): Renamed from preferredBufferLength.
+        (WebCore::AudioSession::setPreferredBufferSize): Renamed from setPreferredBufferLength.
+        * platform/audio/AudioSession.h:
+        * platform/audio/AudioSessionManager.cpp:
+        (AudioSessionManagerToken::create): Simple factory method.
+        (AudioSessionManagerToken::AudioSessionManagerToken): Call AudioSessionManager::incrementCount().
+        (AudioSessionManagerToken::~AudioSessionManagerToken): Call AudioSessionManager::decrementCount().
+        (AudioSessionManager::sharedManager): Simple singleton method.
+        (AudioSessionManager::AudioSessionManager): Simple constructor.
+        (AudioSessionManager::has): Return whether the type is present.
+        (AudioSessionManager::incrementCount): Increment, then call updateSessionState()
+        (AudioSessionManager::decrementCount): Decrement, then call updateSessionState()
+        (AudioSessionManager::updateSessionState): Stub, does nothing.
+        * platform/audio/AudioSessionManager.h:
+        * platform/audio/ios/AudioDestinationIOS.cpp:
+        (WebCore::AudioDestinationIOS::configure): Call setPreferredBufferSize() instead of setPreferredBufferLength()
+        * platform/audio/ios/AudioSessionIOS.mm:
+        (WebCore::AudioSession::preferredBufferSize): Renamed from preferredBufferLength.
+        (WebCore::AudioSession::setPreferredBufferSize): Renamed from setPreferredBufferLength
+        * platform/audio/mac/AudioDestinationMac.cpp:
+        (WebCore::AudioDestination::hardwareSampleRate): Call AudioSession::sampleRate().
+        (WebCore::AudioDestinationMac::AudioDestinationMac): Create the AudioSessionManagerToken.
+        (WebCore::AudioDestinationMac::configure): Do not set the buffer size (this is done in AudioSessionManagerMac).
+        * platform/audio/mac/AudioDestinationMac.h:
+        * platform/audio/mac/AudioSessionMac.cpp: Added.
+        (WebCore::defaultDevice): Added, returns the default audio device.
+        (WebCore::AudioSession::AudioSession): Simple constructor.
+        (WebCore::AudioSession::~AudioSession): Simple destructor.
+        (WebCore::AudioSession::category): Stub, unimplemented.
+        (WebCore::AudioSession::setCategory): Ditto.
+        (WebCore::AudioSession::categoryOverride): Ditto.
+        (WebCore::AudioSession::setCategoryOverride): Ditto.
+        (WebCore::AudioSession::numberOfOutputChannels): Ditto.
+        (WebCore::AudioSession::setActive): Ditto.
+        (WebCore::AudioSession::sampleRate): Use the HAL to return the default audio device sample rate.
+        (WebCore::AudioSession::preferredBufferSize): Return the current HAL setting.
+        (WebCore::AudioSession::setPreferredBufferSize): Set the buffer size.
+        * platform/audio/mac/AudioSessionManagerMac.cpp:
+        (AudioSessionManager::updateSessionState): Set the buffer size depending on what audio outputs are present.
+        * WebCore.xcodeproj/project.pbxproj: Add the new files to the project.
</ins><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+2013-05-24  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/TextIterator.cpp:
-        (WebCore::foldQuoteMark):
-        (WebCore::foldQuoteMarks):
-        (WebCore::SearchBuffer::SearchBuffer):
-        (WebCore::SearchBuffer::append):
-        (WebCore::foldQuoteMarkOrSoftHyphen): Deleted.
-        (WebCore::foldQuoteMarksAndSoftHyphens): Deleted.
</del><ins>+        Path: upstream the missing bits from the BlackBerry port
+        https://bugs.webkit.org/show_bug.cgi?id=116658
</ins><span class="cx"> 
</span><del>-2014-03-31  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Reviewed by Xan Lopez.
</ins><span class="cx"> 
</span><del>-        Preparation for using Soup on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=130615
</del><ins>+        PathBlackBerry was upstreamed a while ago (r144612) but a few bits
+        were missing from the cross-platform code.
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+        * platform/graphics/Path.cpp:
+        (WebCore::Path::addPathForRoundedRect):
+        * platform/graphics/Path.h:
+        (Graphics):
+        (Path):
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        Added Soup source files in WinCairo build.
-        * loader/soup/CachedRawResourceSoup.cpp:
-        * loader/soup/SubresourceLoaderSoup.cpp:
-        * platform/soup/SharedBufferSoup.cpp:
-        * platform/soup/URLSoup.cpp:
-        * platform/network/NetworkStorageSessionStub.cpp:
-        Only build if USE(SOUP) to prevent building when USE(CURL) is true.
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        Only include unistd.h in non-Visual Studio builds.
-        This would normally be done with a HAVE_UNISTD_H macro when compiling glib and Soup,
-        but that would need to be left undefined for Visual Studio.
</del><ins>+2013-05-24  Noam Rosenthal  &lt;noam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        WebProcess is crashing on http://achicu.github.io/css-presentation when direct pattern compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=115135
</ins><span class="cx"> 
</span><del>-        Unreviewed. Addressing reviewing comments for r166491 that I forgot
-        to address before landing.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * html/FormController.cpp:
-        (WebCore::SavedFormState::deserialize): No need to move the std::unique_ptr
-        object on the way out.
-        (WebCore::FormController::createSavedFormStateMap): FormKeyGenerator can be
-        allocated on the stack.
-        (WebCore::FormController::formStatesFromStateVector): Use auto.
</del><ins>+        Issue is invoked when there is a visibility:hidden layer with a non-compositable
+        background image (e.g. a radial gradient).
+        The layer is treated as a no-contents layer because of its visibility, however
+        updateDirectlyCompositedBackgroundImage() later mistakenly treats it as a layer
+        with direct background-image compositing.
</ins><span class="cx"> 
</span><del>-2014-03-20  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+        Fixed by returning early from updating directly composited contents for layers
+        with hidden contents.
</ins><span class="cx"> 
</span><del>-        [GTK] Use GMainLoopSource for idle and timeout sources in WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=130078
</del><ins>+        Test: compositing/patterns/direct-pattern-compositing-hidden-radial-gradient.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateDirectlyCompositedContents):
+        (WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundImage):
+        (WebCore::RenderLayerBacking::paintsChildren):
+        (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
</ins><span class="cx"> 
</span><del>-        * platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
-        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp:
-        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.h:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.h:
-        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
-        * platform/graphics/gstreamer/WebKitMediaSourceGStreamer.cpp:
-        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
-        * platform/gtk/GtkDragAndDropHelper.cpp:
-        * platform/gtk/SharedTimerGtk.cpp:
</del><ins>+2013-05-24  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+        Refactor shouldAddBorderPaddingMargin()
+        https://bugs.webkit.org/show_bug.cgi?id=98803
</ins><span class="cx"> 
</span><del>-        Wrong layout while animating content in regions
-        https://bugs.webkit.org/show_bug.cgi?id=125086
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Make this helper function less clever-stupid in its misguided sacrifice of intelligibility
+        for the sake of concision.
</ins><span class="cx"> 
</span><del>-        The region to layer and regions to layer mappings should be cleared when the region chain changes.
</del><ins>+        No new tests, refactoring.
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/layers/region-removed-during-animation.html
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::shouldAddBorderPaddingMargin):
+        (WebCore::inlineLogicalWidth):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::invalidateRegions): Clear the two maps and flag them for recomputation.
-        (WebCore::RenderFlowThread::cachedRegionForCompositedLayer): Assert that the returned region exists.
</del><ins>+2013-05-24  Xiaobo Wang  &lt;xiaobwang@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Dániel Bátyai  &lt;dbatyai.u-szeged@partner.samsung.com&gt;
</del><ins>+        [BlackBerry] DRT - crashed on GraphicsContext3D::makeContextCurrent
+        https://bugs.webkit.org/show_bug.cgi?id=116654
</ins><span class="cx"> 
</span><del>-        Remove hostThisRegister() and hostThisValue()
-        https://bugs.webkit.org/show_bug.cgi?id=130895
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        PR 331552.
+        Internally reviewed and amended by Arvid Nilsson.
</ins><span class="cx"> 
</span><del>-        Removed hostThisRegister() and hostThisValue() and instead use thisArgumentOffset() and thisValue() respectively.
</del><ins>+        No new tests, this patch is to fix DRT crashes in fast/canvas/webgl.
+        The instance of GraphicsContext3D has already been destroyed but
+        WebGLLayerWebKitThread is not aware of that. This is because compositor
+        layer of the WebGL graphics context was referenced outside the context.
+        So when destructing GraphicsContext3D the compositing layer was not
+        destructed.
+        Fix by setting m_webGLContext to 0 when destructing GrapthicsContext3D
+        after releasing the compositor layer, so that it won't be de-referenced
+        again later.
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior changes.
</del><ins>+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        * platform/graphics/blackberry/WebGLLayerWebKitThread.cpp:
+        (WebCore::WebGLLayerWebKitThread::~WebGLLayerWebKitThread):
+        (WebCore::WebGLLayerWebKitThread::webGLContextDestroyed):
+        (WebCore):
+        * platform/graphics/blackberry/WebGLLayerWebKitThread.h:
+        (WebGLLayerWebKitThread):
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSNavigatorCustom.cpp:
-        (WebCore::JSNavigator::webkitGetUserMedia):
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::callPlugin):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        * bindings/scripts/test/JS/JSFloat64Array.cpp:
-        (WebCore::jsFloat64ArrayPrototypeFunctionFoo):
-        (WebCore::jsFloat64ArrayPrototypeFunctionSet):
-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
-        (WebCore::jsTestActiveDOMObjectPrototypeFunctionPostMessage):
-        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
-        (WebCore::jsTestCustomNamedGetterPrototypeFunctionAnotherFunction):
-        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
-        (WebCore::jsTestEventTargetPrototypeFunctionItem):
-        (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
-        (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
-        (WebCore::jsTestEventTargetPrototypeFunctionDispatchEvent):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod1):
-        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
-        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod3):
-        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod1):
-        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
-        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod3):
-        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
-        (WebCore::jsTestMediaQueryListListenerPrototypeFunctionMethod):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::jsTestObjPrototypeFunctionVoidMethod):
-        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionByteMethod):
-        (WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionOctetMethod):
-        (WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionLongMethod):
-        (WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionObjMethod):
-        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithSequenceArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithEnumArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
-        (WebCore::jsTestObjPrototypeFunctionSerializedValue):
-        (WebCore::jsTestObjPrototypeFunctionOptionsObject):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithException):
-        (WebCore::jsTestObjPrototypeFunctionCustomMethod):
-        (WebCore::jsTestObjPrototypeFunctionCustomMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionAddEventListener):
-        (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateVoid):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObj):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateVoidException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObjException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContext):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg):
-        (WebCore::jsTestObjPrototypeFunctionConditionalMethod1):
-        (WebCore::jsTestObjPrototypeFunctionConditionalMethod2):
-        (WebCore::jsTestObjPrototypeFunctionConditionalMethod3):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod3):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod11):
-        (WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
-        (WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
-        (WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
-        (WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
-        (WebCore::jsTestObjPrototypeFunctionConvert1):
-        (WebCore::jsTestObjPrototypeFunctionConvert2):
-        (WebCore::jsTestObjPrototypeFunctionConvert4):
-        (WebCore::jsTestObjPrototypeFunctionConvert5):
-        (WebCore::jsTestObjPrototypeFunctionMutablePointFunction):
-        (WebCore::jsTestObjPrototypeFunctionImmutablePointFunction):
-        (WebCore::jsTestObjPrototypeFunctionOrange):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunction):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
-        (WebCore::jsTestObjPrototypeFunctionVariadicStringMethod):
-        (WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
-        (WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
-        (WebCore::jsTestObjPrototypeFunctionAny):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::jsTestTypedefsPrototypeFunctionFunc):
-        (WebCore::jsTestTypedefsPrototypeFunctionSetShadow):
-        (WebCore::jsTestTypedefsPrototypeFunctionMethodWithSequenceArg):
-        (WebCore::jsTestTypedefsPrototypeFunctionNullableArrayArg):
-        (WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):
-        (WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction):
-        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction):
-        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction2):
-        (WebCore::jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude):
-        (WebCore::jsTestTypedefsPrototypeFunctionMethodWithException):
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::callObjCFallbackObject):
-        * bridge/runtime_method.cpp:
-        (JSC::callRuntimeMethod):
</del><ins>+2013-05-24  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-31  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        Typing in Safari's unified field causes unnecessary web content repaints.
+        &lt;http://webkit.org/b/116703&gt;
</ins><span class="cx"> 
</span><del>-        Move the rest of Source/WebCore/html/ code to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=129669
</del><ins>+        Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Break out an alternate version of Page::markAllMatchesForText() that only counts the number of times
+        a string occurs in the page, but doesn't try to mark the occurrences.
+        This allows Safari to count matches for the 'Find &quot;foo&quot; on This Page' functionality in the unified
+        location bar without causing tile repaints.
</ins><span class="cx"> 
</span><del>-        Replace the remaining uses of OwnPtr, PassOwnPtr under Source/WebCore/html/ with std::unique_ptr.
</del><ins>+        * WebCore.exp.in:
+        * page/Page.h:
+        * page/Page.cpp:
+        (WebCore::Page::findMatchesForText):
+        (WebCore::Page::markAllMatchesForText):
+        (WebCore::Page::countFindMatches):
</ins><span class="cx"> 
</span><del>-        * html/FormController.cpp:
-        (WebCore::SavedFormState::SavedFormState):
-        (WebCore::SavedFormState::deserialize):
-        (WebCore::FormController::createSavedFormStateMap):
-        (WebCore::FormController::formElementsState):
-        (WebCore::FormController::takeStateForFormElement):
-        (WebCore::FormController::formStatesFromStateVector):
-        * html/FormController.h:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::mapMouseEvent):
-        * html/HTMLAreaElement.h:
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::setSurfaceSize):
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-        * html/HTMLCanvasElement.h:
-        * html/HTMLCollection.h:
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseAttribute):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::updateVisibleValidationMessage):
-        * html/HTMLFormControlElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::addToPastNamesMap):
-        * html/HTMLFormElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::imageLoader):
-        (WebCore::HTMLInputElement::resetListAttributeTargetObserver):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::hasImageLoader):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseAttribute):
-        * html/HTMLPlugInImageElement.cpp:
-        (WebCore::HTMLPlugInImageElement::startLoadingImage):
-        * html/HTMLPlugInImageElement.h:
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::didAttachRenderers):
-        (WebCore::HTMLVideoElement::parseAttribute):
-        * html/HTMLVideoElement.h:
-        * html/ValidationMessage.cpp:
-        (WebCore::ValidationMessage::ValidationMessage):
-        (WebCore::ValidationMessage::setMessage):
-        (WebCore::ValidationMessage::setMessageDOMAndStartTimer):
-        (WebCore::ValidationMessage::requestToHideMessage):
-        * html/ValidationMessage.h:
</del><ins>+            Renamed markAllMatchesForText() to findMatchesForText() and gave it a boolean parameter to control whether
+            matches should be marked or not. countFindMatches() is the new helper that doesn't mark.
</ins><span class="cx"> 
</span><del>-2014-03-31  Maurice van der Pot  &lt;griffon26@kfk4ever.com&gt;
</del><ins>+2013-05-23  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix mixed use of booleans in JPEGImageDecoder.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=122412
</del><ins>+        https://bugs.webkit.org/show_bug.cgi?id=116702
+        REGRESSION (r150399): Scrollbar missing for all overflow scroll
+        -and corresponding-
+        &lt;rdar://problem/13963712&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Trivial fix for compilation error; no new tests.
-
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        (WebCore::JPEGImageReader::decode):
-        (WebCore::fill_input_buffer):
-        Use TRUE/FALSE defined by libjpeg for libjpeg booleans
-
-2014-03-23  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Move Source/WebCore/rendering/ code to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=129664
-
-        Reviewed by Anders Carlsson.
-
-        Replace uses of OwnPtr and PassOwnPtr in code under Source/WebCore/rendering/ with std::unique_ptr.
-
-        * platform/graphics/FloatPolygon.cpp:
-        (WebCore::FloatPolygon::FloatPolygon):
-        * platform/graphics/FloatPolygon.h:
-        * rendering/ClipPathOperation.h:
-        * rendering/FlowThreadController.cpp:
-        (WebCore::FlowThreadController::ensureRenderFlowThreadWithName):
-        * rendering/FlowThreadController.h:
-        * rendering/HitTestLocation.h:
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::HitTestResult):
-        (WebCore::HitTestResult::operator=):
-        (WebCore::HitTestResult::rectBasedTestResult):
-        (WebCore::HitTestResult::mutableRectBasedTestResult):
-        * rendering/HitTestResult.h:
-        * rendering/HitTestingTransformState.cpp:
-        * rendering/ImageQualityController.h:
-        * rendering/RenderBlock.cpp:
-        (WebCore::removeBlockFromDescendantAndContainerMaps):
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
-        (WebCore::RenderBlock::addContinuationWithOutline):
-        (WebCore::RenderBlock::paintContinuationOutlines):
-        (WebCore::RenderBlock::insertIntoTrackedRendererMaps):
-        (WebCore::RenderBlock::removeFromTrackedRendererMaps):
-        (WebCore::RenderBlock::setComputedColumnCountAndWidth):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::createFloatingObjects):
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBoxRegionInfo.h:
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::styleDidChange):
-        * rendering/RenderButton.h:
-        * rendering/RenderCounter.cpp:
-        (WebCore::makeCounterNode):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::updateAllLayerToRegionMappings):
-        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock):
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderGeometryMap.cpp:
-        (WebCore::RenderGeometryMap::push):
-        (WebCore::RenderGeometryMap::pushView):
-        * rendering/RenderGeometryMap.h:
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
-        (WebCore::RenderGrid::placeItemsOnGrid):
-        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
-        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
-        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
-        (WebCore::RenderGrid::resolveGridPositionsFromStyle):
-        (WebCore::RenderGrid::resolveGridPositionAgainstOppositePosition):
-        (WebCore::RenderGrid::resolveNamedGridLinePositionAgainstOppositePosition):
-        (WebCore::RenderGrid::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
-        (WebCore::RenderGrid::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
-        * rendering/RenderGrid.h:
-        * rendering/RenderImageResource.h:
</del><ins>+        This was a silly copy-paste error.
</ins><span class="cx">         * rendering/RenderLayer.cpp:
</span><del>-        (WebCore::RenderLayer::updateDescendantsAreContiguousInStackingOrder):
-        (WebCore::RenderLayer::updateTransform):
-        (WebCore::RenderLayer::setupFilters):
-        (WebCore::RenderLayer::paintLayerContents):
-        (WebCore::RenderLayer::paintChildLayerIntoColumns):
-        (WebCore::RenderLayer::hitTestChildLayerColumns):
-        (WebCore::RenderLayer::updateClipRects):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::clearZOrderLists):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::notifyFlushBeforeDisplayRefresh):
-        (WebCore::RenderLayerCompositor::registerAllViewportConstrainedLayers):
-        * rendering/RenderLayerCompositor.h:
-        * rendering/RenderLayerFilterInfo.cpp:
-        (WebCore::RenderLayer::FilterInfo::map):
-        (WebCore::RenderLayer::FilterInfo::get):
-        * rendering/RenderLayerFilterInfo.h:
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::setRenderBoxRegionInfo):
-        (WebCore::RenderRegion::takeRenderBoxRegionInfo):
-        * rendering/RenderRegion.h:
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::styleDidChange):
-        * rendering/RenderTable.h:
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::selectionBounds):
-        (WebCore::RenderView::setSelection):
-        (WebCore::RenderView::compositor):
-        (WebCore::RenderView::flowThreadController):
-        (WebCore::RenderView::imageQualityController):
-        * rendering/RenderView.h:
-        * rendering/RootInlineBox.h:
-        (WebCore::RootInlineBox::appendFloat):
-        * rendering/TextAutosizer.h:
-        * rendering/shapes/PolygonShape.cpp:
-        (WebCore::computeShapePaddingBounds):
-        (WebCore::computeShapeMarginBounds):
-        * rendering/shapes/PolygonShape.h:
-        (WebCore::PolygonShape::PolygonShape):
-        * rendering/shapes/RasterShape.cpp:
-        (WebCore::RasterShapeIntervals::computeShapeMarginIntervals):
-        * rendering/shapes/RasterShape.h:
-        (WebCore::RasterShape::RasterShape):
-        * rendering/shapes/Shape.cpp:
-        (WebCore::createInsetShape):
-        (WebCore::createRectangleShape):
-        (WebCore::createCircleShape):
-        (WebCore::createEllipseShape):
-        (WebCore::createPolygonShape):
-        (WebCore::Shape::createShape):
-        (WebCore::Shape::createRasterShape):
-        (WebCore::Shape::createLayoutBoxShape):
-        * rendering/shapes/Shape.h:
-        * rendering/shapes/ShapeInfo.h:
-        (WebCore::ShapeInfo::markShapeAsDirty):
-        (WebCore::ShapeInfo::isShapeDirty):
-        * rendering/shapes/ShapeInsideInfo.h:
-        * rendering/style/ContentData.h:
-        * rendering/style/CounterDirectives.cpp:
-        (WebCore::clone):
-        * rendering/style/CounterDirectives.h:
-        * rendering/style/GridCoordinate.h:
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::addCachedPseudoStyle):
-        (WebCore::RenderStyle::accessCounterDirectives):
-        (WebCore::RenderStyle::accessAnimations):
-        (WebCore::RenderStyle::accessTransitions):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleRareNonInheritedData.cpp:
-        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
-        * rendering/style/StyleRareNonInheritedData.h:
-        * rendering/svg/RenderSVGResourceGradient.cpp:
-        (WebCore::RenderSVGResourceGradient::applyResource):
-        * rendering/svg/RenderSVGResourceGradient.h:
-        * rendering/svg/RenderSVGResourcePattern.cpp:
-        (WebCore::RenderSVGResourcePattern::buildPattern):
-        * rendering/svg/RenderSVGResourcePattern.h:
-        * rendering/svg/RenderSVGShape.cpp:
-        (WebCore::RenderSVGShape::updateShapeFromElement):
-        * rendering/svg/RenderSVGShape.h:
-        * rendering/svg/SVGResources.cpp:
-        (WebCore::SVGResources::setClipper):
-        (WebCore::SVGResources::setFilter):
-        (WebCore::SVGResources::setMarkerStart):
-        (WebCore::SVGResources::setMarkerMid):
-        (WebCore::SVGResources::setMarkerEnd):
-        (WebCore::SVGResources::setMasker):
-        (WebCore::SVGResources::setFill):
-        (WebCore::SVGResources::setStroke):
-        * rendering/svg/SVGResources.h:
-        * rendering/svg/SVGResourcesCache.cpp:
-        (WebCore::SVGResourcesCache::addResourcesFromRenderer):
-        (WebCore::SVGResourcesCache::removeResourcesFromRenderer):
-        * rendering/svg/SVGResourcesCache.h:
-        * rendering/svg/SVGTextMetricsBuilder.cpp:
-        (WebCore::SVGTextMetricsBuilder::initializeMeasurementWithTextRenderer):
-        * rendering/svg/SVGTextMetricsBuilder.h:
</del><ins>+        (WebCore::RenderLayer::scrollbarAnimationsAreSuppressed):
</ins><span class="cx"> 
</span><del>-2014-03-28  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+2013-05-23  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace DEPRECATED_DEFINE_STATIC_LOCAL by static NeverDestroyed&lt;T&gt; in loader
-        https://bugs.webkit.org/show_bug.cgi?id=130893
</del><ins>+        [WinCairo] Build fails to link.
+        https://bugs.webkit.org/show_bug.cgi?id=116671
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        * loader/ImageLoader.cpp:
-        (WebCore::beforeLoadEventSender):
-        (WebCore::loadEventSender):
-        (WebCore::errorEventSender):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::cacheStorage):
-        * loader/appcache/ApplicationCacheStorage.h:
-        * loader/archive/ArchiveFactory.cpp:
-        (WebCore::archiveMIMETypes):
-        * loader/cache/CachedImage.cpp:
-        (WebCore::CachedImage::brokenImage):
-        * loader/cache/CachedRawResource.cpp:
-        (WebCore::shouldIgnoreHeaderForCacheReuse):
-        * loader/cache/MemoryCache.cpp:
-        (WebCore::dummyCachedImageClient):
</del><ins>+        * page/FrameView.h: Added guard for ACCELERATED_COMPOSITING.
</ins><span class="cx"> 
</span><del>-2014-03-28  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+2013-05-23  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace DEPRECATED_DEFINE_STATIC_LOCAL by static NeverDestroyed&lt;T&gt; in css
-        https://bugs.webkit.org/show_bug.cgi?id=130409
</del><ins>+        Unreviewed. Modify WebCore for AppleWin 2010 production build.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * WebCore.vcxproj/WebCoreGenerated.make:
+        (WebCore::AXObjectCache::frameLoadingEventPlatformNotification):
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::logUnimplementedPropertyID):
-        * css/CSSDefaultStyleSheets.cpp:
-        (WebCore::screenEval):
-        (WebCore::printEval):
-        * css/CSSParser.cpp:
-        (WebCore::strictCSSParserContext):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::cssTextCache):
-        * css/CSSProperty.cpp:
-        (WebCore::borderDirections):
-        * css/CSSStyleRule.cpp:
-        (WebCore::selectorTextCache):
-        * css/CSSValuePool.cpp:
-        (WebCore::cssValuePool):
-        * css/CSSValuePool.h:
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyPageSize::getPageSizeFromName):
-        (WebCore::DeprecatedStyleBuilder::sharedStyleBuilder):
-        * css/DeprecatedStyleBuilder.h:
</del><ins>+2013-05-23  Yongjun Zhang  &lt;yongjun_zhang@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-30  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</del><ins>+        We need to clear main resource when detaching DocumentLoader from the frame.
+        https://bugs.webkit.org/show_bug.cgi?id=116680
</ins><span class="cx"> 
</span><del>-        [GTK] [TextureMapper] Weird brightness with some videos with acceletared compositing
-        https://bugs.webkit.org/show_bug.cgi?id=130665
</del><ins>+        Normally, when we detach the documentLoader in DocumentLoader::detachFromFrame, main resource is also cleared
+        in stopLoading().  There is possibility that main resource not being cleared, and this could cause crash later
+        since docLoader could still receive resource callbacks.  To avoid that, we can remove docLoader from main resource's
+        client set in detachFromFrame.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        Reviewed by Brady Eidson.
</ins><span class="cx"> 
</span><del>-        When we uploaded a video texture to the mapper we were not
-        considering that some videos could be decoded into a format
-        without alpha component. Now we check if the video has alpha and
-        if it does not, we remove the alpha flag when retrieving the
-        texture from the pool. For this, the method to get the texture
-        from the pool was modified to receive the flags, that is mapped to
-        have alpha by default in order not to break any other existing
-        code.
</del><ins>+        No new tests, this doesn't happen on OS X.
</ins><span class="cx"> 
</span><del>-        Though we have a problem with AC in WTR and that makes it
-        currently not testable, no new tests are needed because once this
-        is fixed the current test set suffices to detect a possible
-        regression in this.
</del><ins>+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::detachFromFrame):
+        (WebCore::DocumentLoader::clearMainResource):
+        * loader/cache/CachedResource.h: make hasClient accessible publicly.
+        (WebCore::CachedResource::hasClient):
+        (CachedResource):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
-        (WebCore::MediaPlayerPrivateGStreamerBase::updateTexture): Check
-        the video format and decide if the texture shall be pulled with
-        alpha support or not.
-        * platform/graphics/texmap/TextureMapper.cpp:
-        (WebCore::TextureMapper::acquireTextureFromPool): Use the flags
-        when resetting the texture.
-        * platform/graphics/texmap/TextureMapper.h:
-        (WebCore::BitmapTexture::Flag::None): Added with 0x00.
-        (WebCore::TextureMapper::acquireTextureFromPool): Added flag
-        parameter to set up the texture with the default for including
-        alpha channel.
</del><ins>+2013-05-23  Mihai Maerean  &lt;mmaerean@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-30  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        assertion failed: !node || node-&gt;isElementNode() in WebCore::RenderBlock::clone
+        https://bugs.webkit.org/show_bug.cgi?id=116614
</ins><span class="cx"> 
</span><del>-        Adopt range-based for loops to TextCheckerEnchant
-        https://bugs.webkit.org/show_bug.cgi?id=130714
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Add a test for flow threads so they don't end up being cloned in region based multi columns with columns:1 where
+        the only child has column-span:all.
</ins><span class="cx"> 
</span><del>-        * platform/text/enchant/TextCheckerEnchant.cpp:
-        (WebCore::TextCheckerEnchant::ignoreWord):
-        (WebCore::TextCheckerEnchant::learnWord):
-        (WebCore::TextCheckerEnchant::checkSpellingOfWord):
-        (WebCore::TextCheckerEnchant::getGuessesForWord):
-        (WebCore::TextCheckerEnchant::updateSpellCheckingLanguages):
-        (WebCore::TextCheckerEnchant::loadedSpellCheckingLanguages):
-        (WebCore::TextCheckerEnchant::availableSpellCheckingLanguages):
-        (WebCore::TextCheckerEnchant::freeEnchantBrokerDictionaries):
</del><ins>+        Test: fast/multicol/newmulticol/direct-child-column-span-all.html
</ins><span class="cx"> 
</span><del>-2014-03-30  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
</ins><span class="cx"> 
</span><del>-        Second attempt to fix 32bits build after r166465
</del><ins>+2013-05-23  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.h:
-        The compiler probably complain about the return value, that makes more sense.
</del><ins>+        Crash in convertMainResourceLoadToDownload when downloading file by option-return
+        https://bugs.webkit.org/show_bug.cgi?id=116451
</ins><span class="cx"> 
</span><del>-2014-03-30  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        Attempt to fix 32bits build after r166465
-
-        * rendering/style/RenderStyle.h:
-
-2014-03-30  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        Make RenderStyle's non inherited flags more JSC friendly
-        https://bugs.webkit.org/show_bug.cgi?id=130939
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Make RenderStyle::NonInheritedFlags accessible to the JIT:
-        -Make the struct public to give access to the offset.
-        -Move away from a bit field to static offsets we can use
-         with the MacroAssembler.
-        -Reorder the field to simplify bit access of the flags we need.
</del><ins>+        Handle MainResourceLoader being null here which will happen when loading a cached main resource.
</ins><span class="cx"> 
</span><del>-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyVerticalAlign::createHandler):
-        (WebCore::ApplyPropertyDisplay::applyInitialValue):
-        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::adjustRenderStyle):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::RenderStyle):
-        (WebCore::RenderStyle::copyNonInheritedFrom):
-        (WebCore::RenderStyle::hashForTextAutosizing):
-        (WebCore::RenderStyle::equalForTextAutosizing):
-        (WebCore::RenderStyle::changeRequiresLayout):
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::hasAnyPublicPseudoStyles):
-        (WebCore::RenderStyle::hasPseudoStyle):
-        (WebCore::RenderStyle::setHasPseudoStyle):
-        * rendering/style/StyleMultiColData.cpp:
-        (WebCore::StyleMultiColData::StyleMultiColData):
-        * rendering/style/StyleRareNonInheritedData.cpp:
-        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
</del><ins>+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::continueAfterContentPolicy):
</ins><span class="cx"> 
</span><del>-2014-03-30  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2013-05-23  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS] Fix build of HTMLConverter.mm after r166454
</del><ins>+        KURL::createCFURL() should return a RetainPtr&lt;CFURLRef&gt;
+        https://bugs.webkit.org/show_bug.cgi?id=116644
</ins><span class="cx"> 
</span><del>-        Fixes the following build failures:
-
-            WebCore/editing/cocoa/HTMLConverter.mm:1507:13: error: value of type 'WebCore::Element' is not contextually convertible to 'bool'
-                    if (element)
-                        ^~~~~~~
-            WebCore/editing/cocoa/HTMLConverter.mm:1508:49: error: no matching function for call to 'core'
-                        _caches-&gt;floatPropertyValueForNode(*core(element), CSSPropertyVerticalAlign, verticalAlign);
-                                                            ^~~~
-            In file included from WebCore/editing/cocoa/HTMLConverter.mm:41:
-            In file included from WebCore/page/Frame.h:42:
-            In file included from WebCore/editing/VisibleSelection.h:30:
-            In file included from WebCore/editing/VisiblePosition.h:30:
-            In file included from WebCore/dom/Position.h:31:
-            WebCore/editing/TextAffinity.h:54:27: note: candidate function not viable: no known conversion from 'WebCore::Element' to 'NSSelectionAffinity' (aka '_NSSelectionAffinity') for 1st argument
-            inline WebCore::EAffinity core(NSSelectionAffinity affinity)
-                                      ^
-            WebCore/editing/cocoa/HTMLConverter.mm:1509:81: error: reference to non-static member function must be called; did you mean to call it with no arguments?
-                    attachment.get().bounds = CGRectMake(0, (verticalAlign / 100) * element.clientHeight, element.clientWidth, element.clientHeight);
-                                                                                    ~~~~~~~~^~~~~~~~~~~~
-                                                                                                        ()
-            WebCore/editing/cocoa/HTMLConverter.mm:1509:103: error: reference to non-static member function must be called; did you mean to call it with no arguments?
-                    attachment.get().bounds = CGRectMake(0, (verticalAlign / 100) * element.clientHeight, element.clientWidth, element.clientHeight);
-                                                                                                          ~~~~~~~~^~~~~~~~~~~
-                                                                                                                             ()
-            WebCore/editing/cocoa/HTMLConverter.mm:1509:124: error: reference to non-static member function must be called; did you mean to call it with no arguments?
-                    attachment.get().bounds = CGRectMake(0, (verticalAlign / 100) * element.clientHeight, element.clientWidth, element.clientHeight);
-                                                                                                                               ~~~~~~~~^~~~~~~~~~~~
-                                                                                                                                                   ()
-            5 errors generated.
-
-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverter::_addAttachmentForElement):
-
-2014-03-30  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Make NodeList and HTMLCollection caching helpers use PassRef.
-        &lt;https://webkit.org/b/130943&gt;
-
-        Tweak the helpers in NodeListsNodeData to return PassRef instead of
-        PassRefPtr. This knocks 2 branches off of some pretty hot code on
-        Dromaeo/dom-query.
-
-        Reviewed by Antti Koivisto.
-
-        * dom/ChildNodeList.h:
-        * dom/ClassNodeList.h:
-        * dom/NameNodeList.h:
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::ensureChildNodeList):
-        (WebCore::NodeListsNodeData::ensureEmptyChildNodeList):
-        (WebCore::NodeListsNodeData::addCacheWithAtomicName):
-        (WebCore::NodeListsNodeData::addCacheWithName):
-        (WebCore::NodeListsNodeData::addCacheWithQualifiedName):
-        (WebCore::NodeListsNodeData::addCachedCollection):
-        * dom/TagNodeList.h:
-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::create):
-        * html/HTMLCollection.h:
-        * html/HTMLFormControlsCollection.cpp:
-        (WebCore::HTMLFormControlsCollection::create):
-        * html/HTMLFormControlsCollection.h:
-        * html/RadioNodeList.h:
-
-2014-03-29  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        LiveNodeLists should use ElementDescendantIterator
-        https://bugs.webkit.org/show_bug.cgi?id=130931
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><del>-        
-        Make LiveNodeList traversal use the common DOM tree iterator.
</del><span class="cx"> 
</span><del>-        * dom/ChildNodeList.cpp:
-        (WebCore::ChildNodeList::ChildNodeList):
-        (WebCore::ChildNodeList::collectionBegin):
-        (WebCore::ChildNodeList::collectionTraverseForward):
-        (WebCore::ChildNodeList::collectionTraverseBackward):
-        (WebCore::ChildNodeList::invalidateCache):
-        (WebCore::ChildNodeList::collectionFirst): Deleted.
-        
-            Iterator for ChildNodeList is still just Node*.
</del><ins>+        For consistency with the other createCFType() APIs in WebKit, KURL should
+        return a RetainPtr&lt;&gt; instead of raw +1 CFURLRef.
</ins><span class="cx"> 
</span><del>-        * dom/ChildNodeList.h:
-        * dom/CollectionIndexCache.h:
-        (WebCore::CollectionIndexCache::hasValidCache):
-        (WebCore::Iterator&gt;::CollectionIndexCache):
-        (WebCore::Iterator&gt;::nodeCount):
-        (WebCore::Iterator&gt;::computeNodeCountUpdatingListCache):
-        (WebCore::Iterator&gt;::traverseBackwardTo):
-        (WebCore::Iterator&gt;::traverseForwardTo):
-        (WebCore::Iterator&gt;::nodeAt):
-        (WebCore::Iterator&gt;::invalidate):
-        
-            Make CollectionIndexCache iterator based instead of using NodeType*. The iterator type may
-            still be a Node* though.
</del><ins>+        No leak were discovered while making this change.
</ins><span class="cx"> 
</span><del>-        (WebCore::NodeType&gt;::CollectionIndexCache): Deleted.
-        (WebCore::NodeType&gt;::nodeCount): Deleted.
-        (WebCore::NodeType&gt;::computeNodeCountUpdatingListCache): Deleted.
-        (WebCore::NodeType&gt;::nodeBeforeCached): Deleted.
-        (WebCore::NodeType&gt;::nodeAfterCached): Deleted.
-        (WebCore::NodeType&gt;::nodeAt): Deleted.
-        (WebCore::NodeType&gt;::invalidate): Deleted.
-        * dom/ElementDescendantIterator.h:
-        (WebCore::ElementDescendantIterator::operator--):
-        
-            Add backward iteration support.
</del><ins>+        * platform/KURL.h:
+        * platform/cf/KURLCFNet.cpp:
+        (WebCore):
+        (WebCore::createCFURLFromBuffer):
+        (WebCore::KURL::createCFURL):
+        (WebCore::KURL::fileSystemPath):
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+        (WebCore::AVFWrapper::createAssetForURL):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/mac/KURLMac.mm:
+        (WebCore):
+        (WebCore::KURL::operator NSURL *):
+        (WebCore::KURL::createCFURL):
+        * platform/network/cf/CookieJarCFNet.cpp:
+        (WebCore::setCookiesFromDOM):
+        (WebCore::cookiesForDOM):
+        (WebCore::cookieRequestHeaderFieldValue):
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::platformProxyIsEnabledInSystemPreferences):
+        * platform/network/cf/ProxyServerCFNet.cpp:
+        (WebCore::addProxyServersForURL):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformHTTPBody):
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::cfURLResponse):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
</ins><span class="cx"> 
</span><del>-        (WebCore::ElementDescendantIteratorAdapter::last):
-        (WebCore::ElementDescendantConstIteratorAdapter::last):
-        
-            Add a way to get the last item.
-            Provide std::iterator_traits so we can extract the type.
</del><ins>+2013-05-18  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * dom/LiveNodeList.h:
-        (WebCore::CachedLiveNodeList::collectionEnd):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::CachedLiveNodeList):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::~CachedLiveNodeList):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionBegin):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionLast):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionTraverseForward):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionTraverseBackward):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::invalidateCache):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionFirst): Deleted.
-        
-            Make LiveNodeList traversal use ElementDescendantIterator.
</del><ins>+        The ellipsis in a text overflow should not avoid floats
+        https://bugs.webkit.org/show_bug.cgi?id=115746
</ins><span class="cx"> 
</span><del>-        (WebCore::nextMatchingElement): Deleted.
-        (WebCore::previousMatchingElement): Deleted.
-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::HTMLCollection):
-        (WebCore::HTMLCollection::~HTMLCollection):
-        (WebCore::HTMLCollection::collectionBegin):
-        (WebCore::HTMLCollection::collectionTraverseForward):
-        (WebCore::HTMLCollection::collectionTraverseBackward):
-        (WebCore::HTMLCollection::invalidateCache):
-        (WebCore::HTMLCollection::collectionFirst): Deleted.
-        * html/HTMLCollection.h:
-        (WebCore::HTMLCollection::collectionEnd):
-        
-            HTMLCollection still uses Element* as iterator for now.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-2014-03-29  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        When placing an ellipsis for text overflow we shouldn't avoid any floats on the line.
+        That is to say, if there is a float in the box we overflow we should let our no-wrap text,
+        including the ellipsis, render inside the float just as we would if overflow was hidden but
+        a text-overflow rendering had not been specified.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r166434.
-        https://bugs.webkit.org/show_bug.cgi?id=130938
</del><ins>+        Test: fast/css/text-overflow-ellipsis-behind-floats.html
</ins><span class="cx"> 
</span><del>-        Caused crashes and other failures on cache tests (Requested by
-        ap on #webkit).
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+2013-05-23  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Web Replay: add page-level setting to bypass the MemoryCache&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130728
-        http://trac.webkit.org/changeset/166434
</del><ins>+        Unreviewed, rolling out r150586.
+        http://trac.webkit.org/changeset/150586
+        https://bugs.webkit.org/show_bug.cgi?id=116660
</ins><span class="cx"> 
</span><del>-2014-03-29  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Those constructors should be exposed on the WorkerContext, not
+        the DOMWindow
</ins><span class="cx"> 
</span><del>-        Preserve selection end positions in directionOfSelection
-        &lt;http://webkit.org/b/104813&gt;
-        &lt;rdar://problem/13666417&gt;
</del><ins>+        * fileapi/FileReaderSync.idl:
+        * workers/WorkerLocation.idl:
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+2013-05-23  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by kenrb@chromium.org):
-        https://src.chromium.org/viewvc/blink?revision=150621&amp;view=revision
-        http://crbug.com/164263
</del><ins>+        Remove [NoInterfaceObject] from FileReaderSync and WorkerLocation
+        https://bugs.webkit.org/show_bug.cgi?id=116660
</ins><span class="cx"> 
</span><del>-            VisibleSelection::visibleStart() and VisibleSelection::visibleEnd()
-            can both cause layouts, which has the potential to invalidate any
-            rendertree-based objects. This was causing a problem in
-            FrameSelection::directionOfSelection(), where a reference to a
-            lineBox was being held across a call to visibleEnd().
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-            This patch ensures that the any layout is completed before linebox
-            references are retrieved.
</del><ins>+        Remove [NoInterfaceObject] from FileReaderSync and WorkerLocation to match their
+        respective specifications:
+        - http://dev.w3.org/2006/webapi/FileAPI/#FileReaderSync
+        - http://dev.w3.org/html5/workers/#workerlocation
</ins><span class="cx"> 
</span><del>-        Test: editing/selection/layout-during-move-selection-crash.html
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        * editing/FrameSelection.cpp:
-        (WebCore::FrameSelection::directionOfSelection):
</del><ins>+        * fileapi/FileReaderSync.idl:
+        * workers/WorkerLocation.idl:
</ins><span class="cx"> 
</span><del>-2014-03-29  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-05-23  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Simple line layout should not round to integral position while painting.
-        https://bugs.webkit.org/show_bug.cgi?id=130934
</del><ins>+        Remove special case for MessagePortArray from bindings generator
+        https://bugs.webkit.org/show_bug.cgi?id=116653
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Remove rounding to integral position. When RenderLayer is injected and hides subpixel positions,
-        integral rounding produces different paint position.
</del><ins>+        Use MessagePort[] instead of MessagePortArray type in the IDL as MessagePortArray
+        is not defined on IDL side. This allows us to remove the special case for
+        MessagePortArray from the bindings generator.
</ins><span class="cx"> 
</span><del>-        Test: fast/flexbox/hidpi-simple-line-layout-with-flexbox-and-transition.html
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        * rendering/SimpleLineLayoutFunctions.cpp:
-        (WebCore::SimpleLineLayout::paintFlow):
</del><ins>+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::data):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (NativeToJSValue): Remove special case for MessagePortArray.
+        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.h:
+        (WebDOMTestSerializedScriptValueInterface):
+        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp:
+        (webkit_dom_test_serialized_script_value_interface_get_property):
+        (webkit_dom_test_serialized_script_value_interface_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.h:
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::jsTestSerializedScriptValueInterfacePorts):
+        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.h:
+        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.mm:
+        * bindings/scripts/test/TestSerializedScriptValueInterface.idl: Replace MessagePortArray
+        by MessagePort[].
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::ports): The method should return a Vector, not a Vector*
+        as the array on JavaScript side is not nullable.
+        * dom/MessageEvent.idl: Replace MessagePortArray by MessagePort[].
</ins><span class="cx"> 
</span><del>-2014-03-29  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-05-23  Michał Pakuła vel Rutka  &lt;m.pakula@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Make GraphicsContext::drawImageBuffer* functions float based.
-        https://bugs.webkit.org/show_bug.cgi?id=130932
</del><ins>+        [EFL] Back, Forward and Stop should be hidden in context menu
+        https://bugs.webkit.org/show_bug.cgi?id=116615
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
-        
-        This is in preparation to support device pixel based filter painting.
-        Filter calculation is still integral based.
</del><ins>+        Reviewed by Christophe Dumez.
</ins><span class="cx"> 
</span><del>-        No change in behavior.
</del><ins>+        Context menu items: Back, Forward, Stop, Reload, should be shown only when
+        they are able to perform action.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::drawImageBuffer):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/filters/FilterEffect.cpp: This will eventually be fully float based.
-        Right now, this IntRect-&gt;FloatRect change is only to ensure that we can call 
-        the float based drawImageBuffer(). 
-        (WebCore::FilterEffect::drawingRegionOfInputImage):
-        * platform/graphics/filters/FilterEffect.h:
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-2014-03-27  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::populate):
</ins><span class="cx"> 
</span><del>-        Convert yet more of HTMLConverter to C++
-        https://bugs.webkit.org/show_bug.cgi?id=130850
</del><ins>+2013-05-22  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Rolling out r150555. It borked about 30 media tests.
</ins><span class="cx"> 
</span><del>-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverterCaches::isAncestorsOfStartToBeConverted):
-        (HTMLConverter::HTMLConverter):
-        (HTMLConverter::~HTMLConverter):
-        (HTMLConverter::convert):
-        (HTMLConverter::computedAttributesForElement):
-        (HTMLConverter::attributesForElement):
-        (HTMLConverter::_newParagraphForElement):
-        (HTMLConverter::_newLineForElement):
-        (HTMLConverter::_newTabForElement):
-        (HTMLConverter::_addAttachmentForElement):
-        (HTMLConverter::_addQuoteForElement):
-        (HTMLConverter::_addValue):
-        (HTMLConverter::_processHeadElement):
-        (HTMLConverter::_enterElement):
-        (HTMLConverter::_addTableCellForElement):
-        (HTMLConverter::_processElement):
-        (HTMLConverter::_addMarkersToList):
-        (HTMLConverter::_exitElement):
-        (HTMLConverter::_processText):
-        (HTMLConverter::_traverseNode):
-        (HTMLConverter::_traverseFooterNode):
-        (WebCore::attributedStringFromRange):
-        (_childrenForNode): Deleted.
-        (HTMLConverter::_computedAttributesForElement): Deleted.
-        (HTMLConverter::_attributesForElement): Deleted.
-        (HTMLConverter::_loadFromDOMRange): Deleted.
-
-2014-03-28  Csaba Osztrogonác  &lt;ossy@webkit.org&gt;
-
-        Unreviewed buildfix after r166441 and r166443.
-
-        * CMakeLists.txt: Add platform/audio/AudioHardwareListener.cpp.
-
-2014-03-28  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
-
-        [CSS Grid Layout] The 'auto' height must be adapted to the item's margin.
-        https://bugs.webkit.org/show_bug.cgi?id=130920
-
-        Reviewed by Darin Adler.
-
-        Adding the grid-item's marginLogicalHeight to the used breadth when computing
-        content based grid-track sizes.
-
-        Test: fast/css-grid-layout/grid-item-margin-auto-columns-rows.html
-
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::logicalContentHeightForChild):
-
-2014-03-28  James Craig  &lt;jcraig@apple.com&gt;
-
-        Web Inspector: AXI: support for live regions
-        https://bugs.webkit.org/show_bug.cgi?id=130725
-
-        Reviewed by Timothy Hatcher.
-
-        Tests: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
-               inspector-protocol/dom/getAccessibilityPropertiesForNode_liveRegion.html
-
-        Initial support for @aria-live, @aria-atomic, and @aria-busy.
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/protocol/DOM.json:
-
-2014-03-28  Darin Adler  &lt;darin@apple.com&gt;
-
-        Fix recently-introduced off-by-one error in centerTruncateToBuffer
-        https://bugs.webkit.org/show_bug.cgi?id=130889
-        &lt;rdar://problem/16408694&gt;
-
-        Reviewed by Alexey Proskuryakov.
-
-        * platform/graphics/StringTruncator.cpp:
-        (WebCore::centerTruncateToBuffer): Simplified expression that computes truncatedLength.
-        Removed incorrect &quot;+ 1&quot; from computation of where to write characters.
-
-2014-03-28  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
-
-        Update the code related to SelectorPseudoTypeMap to reflect its new purpose
-        https://bugs.webkit.org/show_bug.cgi?id=130620
-
-        Reviewed by Andreas Kling.
-
-        Since r166094, SelectorPseudoTypeMap only contains PseudoClass instances and the 4 compatibility PseudoElement.
-
-        This patch rename SelectorPseudoTypeMap to SelectorPseudoClassAndCompatibilityElementMap and update the parsing
-        to split PseudoClass and PseudoElement.
-
-        * CMakeLists.txt:
-        * DerivedSources.make:
</del><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * css/CSSGrammar.y.in:
-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):
-        (WebCore::CSSParserSelector::setPseudoClassValue):
-        * css/CSSParserValues.h:
-        * css/CSSSelector.cpp:
-        (WebCore::appendPseudoClassFunctionTail):
-        (WebCore::CSSSelector::selectorText):
-        * css/SelectorPseudoClassAndCompatibilityElementMap.in: Renamed from Source/WebCore/css/SelectorPseudoTypeMap.in.
-        * css/SelectorPseudoTypeMap.h:
-        * css/makeSelectorPseudoClassAndCompatibilityElementMap.py: Renamed from Source/WebCore/css/makeSelectorPseudoTypeMap.py.
-        (enumerablePseudoType):
-        (expand_ifdef_condition):
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        * html/HTMLMediaElement.h:
+        * platform/audio/AudioSession.cpp:
+        (WebCore):
+        (WebCore::AudioSession::AudioSession):
+        (WebCore::AudioSession::preferredBufferDuration):
+        (WebCore::AudioSession::setPreferredBufferDuration):
+        * platform/audio/AudioSession.h:
+        * platform/audio/AudioSessionListener.h:
+        (AudioSessionListener):
+        * platform/audio/AudioSessionManager.cpp: Removed.
+        * platform/audio/AudioSessionManager.h: Removed.
+        * platform/audio/ios/AudioDestinationIOS.cpp:
+        (WebCore::AudioDestinationIOS::configure):
+        * platform/audio/ios/AudioSessionIOS.mm:
+        (WebCore::AudioSession::preferredBufferDuration):
+        (WebCore::AudioSession::setPreferredBufferDuration):
+        * platform/audio/mac/AudioDestinationMac.cpp:
+        (WebCore::AudioDestination::hardwareSampleRate):
+        (WebCore::AudioDestinationMac::AudioDestinationMac):
+        (WebCore::AudioDestinationMac::configure):
+        * platform/audio/mac/AudioDestinationMac.h:
+        (AudioDestinationMac):
+        * platform/audio/mac/AudioSessionMac.cpp: Removed.
+        * platform/audio/mac/AudioSessionManagerMac.cpp: Removed.
</ins><span class="cx"> 
</span><del>-2014-03-28  Stephanie Lewis  &lt;slewis@apple.com&gt;
</del><ins>+2013-05-20  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix.
</del><ins>+        Active DOM object resumption should match reason for suspending
+        https://bugs.webkit.org/show_bug.cgi?id=116476
</ins><span class="cx"> 
</span><del>-        * platform/audio/AudioHardwareListener.cpp:
-        (WebCore::AudioHardwareListener::create):
-        (WebCore::AudioHardwareListener::audioHardwareListenerIsSupported): Deleted.
-        * platform/audio/AudioHardwareListener.h:
</del><ins>+        Add a reason to the arguments for resuming active DOM object and
+        scheduled tasks and ensure that it matches the suspend reason before
+        actually resuming the objects.
</ins><span class="cx"> 
</span><del>-2014-03-28  Lukasz Bialek  &lt;l.bialek@samsung.com&gt;
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-        Refactor cut and copy functions as suggested in FIXME line
-        https://bugs.webkit.org/show_bug.cgi?id=129867
</del><ins>+        No new tests, no change in functionality.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::setJavaScriptPaused): Add matching resume reason
+        * dom/Document.cpp:
+        (WebCore::Document::resumeActiveDOMObjects): Check for matching resume reason
+        (WebCore::Document::resumeScheduledTasks): Check for matching resume reason
+        * dom/Document.h:
+        (Document):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects): Check for matching resume reason
+        * dom/ScriptExecutionContext.h:
+        (ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::reasonForSuspendingActiveDOMObjects): Expose suspend reason to subclasses
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Add matching resume reason
+        * page/Frame.cpp:
+        (WebCore::Frame::resumeActiveDOMObjectsAndAnimations): Add matching resume reason
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer): Add matching resume reason
</ins><span class="cx"> 
</span><del>-        Cut and Copy functions in Editor.cpp use lots of common code.
-        Those functions are merged into one to share code, several
-        additional conditions are added to preserve Cut and Copy
-        functionality.
</del><ins>+2013-05-22  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::cut):
-        (WebCore::Editor::copy):
-        (WebCore::Editor::performCutOrCopy):
-        * editing/Editor.h:
</del><ins>+        Don't snapshot plugins that can't be snapshotted
+        https://bugs.webkit.org/show_bug.cgi?id=116490
</ins><span class="cx"> 
</span><del>-2014-03-28  Stephanie Lewis  &lt;slewis@apple.com&gt;
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Rename pluginDidEvaluate to better represent when it’s called.
-        Part of &lt;rdar://problem/16061257&gt; PluginProcess should AppNap when no plugins on active tab.
</del><ins>+        Some plugins, such as QuickTime, don't support snapshotting. We're
+        planning on another way to capture snapshots, but in the meantime make
+        sure that they don't fail to initialise because they were told to
+        not use accelerated rendering.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        * WebCore.exp.in: Export restartSnapshottedPlugin so that it can be used from WK2.
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::restartSimilarPlugIns): Don't set the play state before restarting.
+        (WebCore::HTMLPlugInImageElement::userDidClickSnapshot): Make sure we indicated that this snapshotted plugin was clicked.
+        * html/HTMLPlugInImageElement.h: Move restartSnapshottedPlugin from protected to public.
+        * rendering/RenderSnapshottedPlugIn.cpp:
+        (WebCore::RenderSnapshottedPlugIn::handleEvent): Don't set play state here. Let the restart functions do it.
</ins><span class="cx"> 
</span><del>-        No new test because it’s just a name change.
</del><ins>+2013-05-22  Max Vujovic  &lt;mvujovic@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/PageThrottler.h:
-        (WebCore::PageThrottler::pluginDidEvaluateWhileAudioIsPlaying):
</del><ins>+        [CSS Shaders] valueForCustomFilterTransformParameter should check that renderer is a RenderBox
+        https://bugs.webkit.org/show_bug.cgi?id=116464
</ins><span class="cx"> 
</span><del>-2014-03-28  Stephanie Lewis  &lt;slewis@apple.com&gt;
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        Notification handler for telling if audio hardware is active.
-        https://bugs.webkit.org/show_bug.cgi?id=130743
</del><ins>+        If the renderer is not a RenderBox, we just use a zero size to compute the transform,
+        like in CSSComputedStyleDeclaration::computedTransform.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Test: css3/filters/custom/custom-filter-crash-inline-computed-style.html
</ins><span class="cx"> 
</span><del>-        Not web-exposed so no easy way to test.
</del><ins>+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForCustomFilterTransformParameter):
</ins><span class="cx"> 
</span><del>-        Listen to CoreAudio to see if audio hardware is active in the current process.
</del><ins>+2013-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/audio/AudioHardwareListener.cpp: Added.
-        (WebCore::AudioHardwareListener::create):
-        (WebCore::AudioHardwareListener::AudioHardwareListener):
-        * platform/audio/AudioHardwareListener.h: Added.
-        (WebCore::AudioHardwareListener::Client::~Client):
-        (WebCore::AudioHardwareListener::~AudioHardwareListener):
-        (WebCore::AudioHardwareListener::isHardwareActive):
-        * platform/audio/mac/AudioHardwareListenerMac.cpp: Added.
-        (WebCore::isAudioHardwareProcessRunning):
-        (WebCore::AudioHardwareListener::create):
-        (WebCore::AudioHardwareListenerMac::create):
-        (WebCore::AudioHardwareListenerMac::AudioHardwareListenerMac):
-        (WebCore::AudioHardwareListenerMac::~AudioHardwareListenerMac):
-        (WebCore::AudioHardwareListenerMac::setHardwareActive):
-        * platform/audio/mac/AudioHardwareListenerMac.h: Added.
</del><ins>+        Fix assertion in the getComputedStyle-background-shorthand.html test
+        https://bugs.webkit.org/show_bug.cgi?id=116639
</ins><span class="cx"> 
</span><del>-2014-03-28  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Web Inspector: AXI: expose what elements get generic &quot;clickable&quot; status
-        https://bugs.webkit.org/show_bug.cgi?id=130721
</del><ins>+        getComputedStyle-background-shorthand.html was asserting under the newly added
+        code in willBeRemovedFromTree(). The assertion was caused by too many calls to
+        FrameView::removeSlowRepaintObject(), which happened because we called it for
+        RenderTexts, which share style with their parent renderer.
+        
+        RenderText overrides styleWillChange() to do nothing, so we never
+        call add/removeSlowRepaintObject() for them. Thus we should also skip this
+        work in willBeRemovedFromTree() for RenderTexts.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willBeRemovedFromTree):
</ins><span class="cx"> 
</span><del>-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html:
-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode_mouseEventNodeId.html
</del><ins>+2013-05-22  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Expose ancestor element link to &quot;Click Listener&quot; or generic &quot;Clickable: Yes&quot; if current node has mouse handler.
</del><ins>+        Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
+        https://bugs.webkit.org/show_bug.cgi?id=116626
</ins><span class="cx"> 
</span><del>-        Update AccessibilityNodeObject::mouseButtonListener() to optionally return body element if 
-            requested so that Web Inspector can display body event delegate handlers.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityNodeObject.cpp:
-        (WebCore::AccessibilityNodeObject::mouseButtonListener):
-        * accessibility/AccessibilityNodeObject.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/protocol/DOM.json:
</del><ins>+        This is a port of a Blink bug fix by Emil Eklund.
</ins><span class="cx"> 
</span><del>-2014-03-28  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Account for saturated estimated position in RenderBlock::layoutBlockChild.
</ins><span class="cx"> 
</span><del>-        Web Inspector: Really drop all locks in nested run loop on iOS if WebThread is enabled
-        https://bugs.webkit.org/show_bug.cgi?id=130912
</del><ins>+        If the estimated top position is saturated the comparison with oldLogicalTop
+        might yield a false negative as adding and removing margins, borders etc from
+        a saturated number might yield incorrect results. If this is the case always
+        mark for layout.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Minimal test case impractical. See bug for raw fuzzer test case.
</ins><span class="cx"> 
</span><del>-        Previously we were calling DropAllLocks inside of a single line if statement,
-        so the JSLock was getting reaquired very quickly. We really want to DropAllLocks
-        for the duration of running the nested run loop on iOS if there is a WebThread.
</del><ins>+        * platform/LayoutUnit.h:
+        (WebCore::LayoutUnit::mightBeSaturated): Add helper method for checking whether
+            a number might be saturated.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChild): Check if logicalTopEstimate is likely
+            to be saturated and if so mark for layout.
</ins><span class="cx"> 
</span><del>-        * bindings/js/PageScriptDebugServer.h:
-        * bindings/js/PageScriptDebugServer.cpp:
-        (WebCore::PageScriptDebugServer::runEventLoopWhilePaused):
-        (WebCore::PageScriptDebugServer::runEventLoopWhilePausedInternal):
</del><ins>+2013-05-22  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Remove CSSPropertySourceData emptyCSSPropertySourceData
+        https://bugs.webkit.org/show_bug.cgi?id=116517
</ins><span class="cx"> 
</span><del>-        [Win] Enable Media Track testing features on Windows
-        https://bugs.webkit.org/show_bug.cgi?id=130851
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        This was added for chromium and does not seem to be used
+        anywhere anymore.
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp:
-        (WebCore::Internals::resetToConsistentState): Execute code on Windows as well.
-        (WebCore::Internals::Internals): Ditto.
-        (WebCore::Internals::captionsStyleSheetOverride): Ditto.
-        (WebCore::Internals::setCaptionsStyleSheetOverride): Ditto.
-        (WebCore::Internals::setPrimaryAudioTrackLanguageOverride): Ditto.
-        (WebCore::Internals::setCaptionDisplayMode): Ditto.
</del><ins>+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        * css/CSSPropertySourceData.cpp:
+        * css/CSSPropertySourceData.h:
</ins><span class="cx"> 
</span><del>-2014-03-28  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+2013-05-22  Csaba Osztrogonác  &lt;ossy@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Web Replay: add page-level setting to bypass the MemoryCache
-        https://bugs.webkit.org/show_bug.cgi?id=130728
</del><ins>+        Buildfix for !ENABLE(FULLSCREEN_API) platforms.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Rubber-stamped by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        When replaying a specific Page we don't want to store its cached resources in the
-        MemoryCache. This patch adds a page setting to prevent the page's resources from
-        being saved in the MemoryCache.
</del><ins>+        * rendering/RenderInline.cpp: Missing #if guard added.
+        (WebCore::RenderInline::splitInlines):
</ins><span class="cx"> 
</span><del>-        If Settings::usesMemoryCache() is false, page resources are given the special
-        SessionID bypassCacheSessionID(). The cached resource loader and memory cache
-        act as if the memory cache is disabled if the resource has this special session id.
</del><ins>+2013-05-22  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Hook up ReplayController to override the memory cache setting during capture/replay.
</del><ins>+        Fix a typo in 150469.
</ins><span class="cx"> 
</span><del>-        Test: http/tests/cache/bypass-memory-cache-after-reload.html
</del><ins>+        * editing/Editor.cpp:
+        (WebCore::dispatchEditableContentChangedEvents):
</ins><span class="cx"> 
</span><del>-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::CachedResourceLoader::requestResource):
-        (WebCore::CachedResourceLoader::revalidateResource):
-        * loader/cache/MemoryCache.cpp:
-        (WebCore::MemoryCache::add):
-        * page/Page.cpp:
-        (WebCore::Page::sessionID):
-        * page/SessionID.h:
-        (WebCore::SessionID::bypassCacheSessionID):
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        * page/Settings.h:
-        (WebCore::Settings::setUsesMemoryCache):
-        (WebCore::Settings::usesMemoryCache):
-        * replay/ReplayController.cpp:
-        (WebCore::ReplayController::setForceDeterministicSettings):
-        * replay/ReplayController.h:
-        * testing/InternalSettings.cpp:
-        (WebCore::InternalSettings::Backup::Backup):
-        (WebCore::InternalSettings::Backup::restoreTo):
-        (WebCore::InternalSettings::setUsesMemoryCache):
-        * testing/InternalSettings.h:
-        * testing/InternalSettings.idl:
</del><ins>+2013-05-22  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-28  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        REGRESSION: ASSERTION FAILED: obj-&gt;isRenderInline() || obj == this, Bad cast in WebCore::RenderBlock::createLineBoxes
+        https://bugs.webkit.org/show_bug.cgi?id=110622
</ins><span class="cx"> 
</span><del>-        In some situations, partial layouts of floating elements produce incorrect results.
-        https://bugs.webkit.org/show_bug.cgi?id=122668
-
</del><span class="cx">         Reviewed by David Hyatt.
</span><span class="cx"> 
</span><del>-        When performing partial layout of float elements and checking if other float
-        elements are encountered, incorrect results were obtained by not checking
-        the size of the existing floats vector.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/998ad358eed702b873dd54697b3fa3f952e0feb7
</ins><span class="cx"> 
</span><del>-        Test: fast/block/float/floats-in-clean-line-crash.html
</del><ins>+        Inserting an element before the fullscreened element could crash if it caused a containing inline to be split,
+        since the splitting logic doesn't expect the fullscreened element to be wrapped in a RenderFullScreen. This patch changes
+        inline splitting to be aware of RenderFullScreen.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::checkFloatsInCleanLine):
</del><ins>+        Test: fullscreen/full-screen-inline-split-crash.html
</ins><span class="cx"> 
</span><del>-2014-03-28  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
</ins><span class="cx"> 
</span><del>-        Build fix.
</del><ins>+2013-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paint):
</del><ins>+        Fix issues with focus rings on search fields
+        https://bugs.webkit.org/show_bug.cgi?id=116591
</ins><span class="cx"> 
</span><del>-2014-03-28  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
+        
+        On a future OS, the rect returned by _focusRingVisibleRect should
+        be in the coordinate system of the that NSView, not the base
+        coordinate system, so fix the code that sets and reads the global
+        focusRingClipRect variable accordingly.
</ins><span class="cx"> 
</span><del>-        [MSE] Implement support for SourceBuffer.remove()
-        https://bugs.webkit.org/show_bug.cgi?id=121562
-
-        Reviewed by Eric Carlson.
-
-        Test: media/media-source/media-source-remove.html
-
-        Add support for SourceBuffer.remove().
-
-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::SourceBuffer): Initialize new member variables.
-        (WebCore::SourceBuffer::setTimestampOffset): Update comments to match spec.
-        (WebCore::SourceBuffer::remove): Added; start removeTimer.
-        (WebCore::SourceBuffer::abortIfUpdating): Cancel removeTimer.
-        (WebCore::SourceBuffer::removedFromMediaSource): Call abortIfUpdating().
-        (WebCore::SourceBuffer::stop): Cancel removeTimer.
-        (WebCore::SourceBuffer::removeCodedFrames): Added.
-        (WebCore::SourceBuffer::removeTimerFired): Added.
-        * Modules/mediasource/SourceBuffer.h:
-        * Modules/mediasource/SourceBuffer.idl:
-
-2014-03-27  Dean Jackson  &lt;dino@apple.com&gt;
-
-        Support form controls that may need incremental redraw
-        https://bugs.webkit.org/show_bug.cgi?id=130736
-
-        Reviewed by Beth Dakin.
-
-        There are some form controls that change appearance
-        over time. Expand the ControlStates so that it can
-        hold a little more information, including a reference
-        to the native form control. This way the Theme implementation
-        can repaint the existing native control if necessary. At
-        least ThemeMac was reusing a single control for painting
-        all instances before this change.
-
-        Since ControlStates is now a class, pass it around by
-        reference.
-
-        The other major change is keeping a timer to trigger a
-        repaint in RenderBox, which happens if Theme/RenderTheme
-        update the ControlState to request one.
-
-        * WebCore.xcodeproj/project.pbxproj: Add ControlStates.h.
-        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-        * dom/Element.cpp:
-        (WebCore::Element::setActive): States now within ControlStates.
-        (WebCore::Element::setHovered): Ditto.
-        * editing/FrameSelection.cpp:
-        (WebCore::FrameSelection::focusedOrActiveStateChanged): Ditto.
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::disabledStateChanged): Ditto.
-        (WebCore::HTMLFormControlElement::readOnlyAttributeChanged): Ditto.
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setChecked): Ditto.
-        (WebCore::HTMLInputElement::setIndeterminate): Ditto.
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::parseAttribute): Ditto.
-        * platform/ControlStates.h: New file. Copied the old ControlStates enum,
-        and added accessors to hold whether or not the state is dirty, and
-        a reference to a platform control if necessary.
-        * platform/Theme.h:
-        (WebCore::Theme::selectionColor): Pass ControlStates pointer.
-        (WebCore::Theme::paint): Ditto.
-        (WebCore::Theme::inflateControlPaintRect): Ditto.
-        * platform/ThemeTypes.h: Remove ControlStates enum.
-        * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::RenderThemeEfl::applyEdjeStateFromForm): Pass ControlStates pointer.
-        (WebCore::RenderThemeEfl::paintThemePart): Ditto.
-        * platform/efl/RenderThemeEfl.h: Ditto.
-        * platform/mac/ThemeMac.h: Ditto.
</del><ins>+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
</ins><span class="cx">         * platform/mac/ThemeMac.mm:
</span><del>-        (-[WebCoreThemeView addSubview:]): New method to make sure we don't add CALayer backed
-        views to the NSView we're using for rendering.
-        (WebCore::updateStates): Use the private animated setters if necessary.
-        (WebCore::convertControlStatesToThemeDrawState): Namespacing.
-        (WebCore::configureCheckbox): Pass ControlStates pointer.
-        (WebCore::createCheckboxCell): New helper since we're creating non-static cells.
-        (WebCore::sharedCheckboxCell): The old static provider, renamed.
-        (WebCore::paintCheckbox): Check if this paint was triggered by a state change
-        or an animation. Update the ControlStates if we need to be repainted.
-        (WebCore::radio): Parameter is now ControlStates*.
-        (WebCore::paintRadio): Ditto.
-        (WebCore::setUpButtonCell): Ditto.
-        (WebCore::button): Ditto.
-        (WebCore::paintButton): Ditto.
-        (WebCore::paintStepper): Ditto.
-        (WebCore::ThemeMac::ensuredView): Ditto.
-        (WebCore::ThemeMac::inflateControlPaintRect): Ditto.
-        (WebCore::ThemeMac::paint): Ditto.
-        (WebCore::checkbox): Deleted.
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::RenderBox): Initialize timer.
-        (WebCore::RenderBox::~RenderBox): Stop any pending timers and delete the ControlState if necessary.
-        (WebCore::RenderBox::paintBoxDecorations): Create a ControlStates if needed. Paint, and start the repaint
-        timer if the ControlStates say we should.
-        (WebCore::RenderBox::repaintTimerFired): Call repaint when the timer fires.
-        * rendering/RenderBox.h: Add a timer for repainting.
-        * rendering/RenderElement.cpp:
-        (WebCore::controlStatesRendererMap): A static HashMap that associates renderers with ControlStates.
-        (WebCore::RenderElement::hasControlStatesForRenderer):
-        (WebCore::RenderElement::controlStatesForRenderer):
-        (WebCore::RenderElement::removeControlStatesForRenderer):
-        (WebCore::RenderElement::addControlStatesForRenderer):
-        * rendering/RenderElement.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::paint): Use a pointer to ControlStates.
-        (WebCore::RenderTheme::adjustRepaintRect): Ditto.
-        (WebCore::RenderTheme::stateChanged): Ditto.
-        (WebCore::RenderTheme::updateControlStatesForRenderer): New method that just updates the states part of ControlStates.
-        (WebCore::RenderTheme::extractControlStatesForRenderer): New method that calculates the state.
-        (WebCore::RenderTheme::controlStatesForRenderer): Deleted.
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::documentViewFor): Use a ControlStates pointer.
</del><ins>+        (-[WebCoreFlippedView _focusRingVisibleRect]):
</ins><span class="cx"> 
</span><del>-2014-03-28  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+2013-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Clear SVGInlineTextBox fragments when the text changes.
-        https://bugs.webkit.org/show_bug.cgi?id=130879
</del><ins>+        New Flickr doesn't get fast scrolling but should
+        https://bugs.webkit.org/show_bug.cgi?id=116514
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Darin Adler.
</span><del>-
-        Ported from Blink: https://src.chromium.org/viewvc/blink?revision=150456&amp;view=revision
-
-        This patch modifies SVGInlineTextBox::dirtyLineBoxes to clear all
-        following text boxes when invoked. Typically this method is called
-        when the underlying text string changes, and that change needs to
-        be propagated to all the boxes that use the text beyond the point
-        where the text is first modified.
</del><span class="cx">         
</span><del>-        Also cleans up final function keywords for SVGRootInlineBox.
</del><ins>+        RenderObject increments and decrements a counter of slow repaint objects on
+        FrameView when it sees style changes related to background-attachment:fixed.
+        However, it omitted to decrement the count when a renderer with a fixed background
+        was destroyed.
+        
+        This caused Flickr to never fall into fast scrolling mode, since it toggled
+        display:none on an element with a fixed background during loading, then removed
+        the fixed background.
+        
+        Did some minor cleanup of #ENABLE(FAST_MOBILE_SCROLLING) crap.
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/unicode-in-tspan-multi-svg-crash.html
</del><ins>+        Tests: platform/mac-wk2/tiled-drawing/slow-scrolling-background-toggle.html
+               platform/mac-wk2/tiled-drawing/slow-scrolling-hidden-background-toggle.html
+               platform/mac-wk2/tiled-drawing/slow-scrolling.html
</ins><span class="cx"> 
</span><del>-        * rendering/InlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
-        (WebCore::InlineTextBox::dirtyOwnLineBoxes): Calls dirtyLineBoxes()
-        * rendering/svg/SVGInlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
-        (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes):
-        * rendering/svg/SVGInlineTextBox.cpp:
-        (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes): Non-recursive part of dirtyLineBoxes()
-        (WebCore::SVGInlineTextBox::dirtyLineBoxes): Calls dirtyOwnLineBoxes() in a loop
-        * rendering/svg/SVGRootInlineBox.h:
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::shouldRepaintFixedBackgroundsOnScroll):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::willBeRemovedFromTree):
</ins><span class="cx"> 
</span><del>-2014-03-28  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-05-22  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Rebaseline bindings tests.
</del><ins>+        Need to Remove Anonymous Wrappers When All Children Become Inline
+        https://bugs.webkit.org/show_bug.cgi?id=115687
</ins><span class="cx"> 
</span><del>-2014-03-28  Michael Saboff  &lt;msaboff@apple.com&gt;
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling r166248 back in.
</del><ins>+        Remove a simple subset of anonymous wrappers, i.e. anonymous blocks without continuations,
+        when a block becoming float or positioned removes the need for them.
</ins><span class="cx"> 
</span><del>-        Turns out r166070 didn't cause a 2% performance loss in page load times
</del><ins>+        Test: fast/block/remove-anonymous-wrappers-when-element-changes-to-float-or-positioned.html
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore):
+        (WebCore::RenderObject::removeAnonymousWrappersFromLineIfNecessary):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (RenderObject):
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r166126.
-        Rollout r166126 in prepartion to roll out prerequisite r166070
</del><ins>+2013-05-22  Bruno de Oliveira Abinader  &lt;bruno.abinader@basyskom.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-26  Antonio Gomes  &lt;a1.gomes@sisa.samsung.com&gt;
</del><ins>+        [css] Update ETextDecorations enum to TextDecorations
+        https://bugs.webkit.org/show_bug.cgi?id=116581
</ins><span class="cx"> 
</span><del>-        [Bindings] constants are always typed to 'int'
-        https://bugs.webkit.org/show_bug.cgi?id=130775
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Currently, ETextDecorations enum uses a C-like coding style for its
+        enumeration values, as well as a 'E' prefix that surely had some meaning
+        in the past, but not nowadays.
</ins><span class="cx"> 
</span><del>-        Patch fixes a bug where all constant getter generated
-        methods were returning 'integer' values due to static_cast.
</del><ins>+        No behavior changes, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Compilers should be smarth enough to properly infer which
-        jsNumber class construtor to call given a literal value.
</del><ins>+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hasPlainText):
+        (WebCore::AccessibilityRenderObject::hasUnderline):
+        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
+        (getAttributeSetForAccessibilityObject):
+        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+        (AXAttributeStringSetStyle):
+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+        (AXAttributeStringSetStyle):
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::renderTextDecorationFlagsToCSSValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator TextDecoration):
+        * css/DeprecatedStyleBuilder.cpp:
+        (WebCore::ApplyPropertyTextDecoration::applyValue):
+        (WebCore::ApplyPropertyTextDecoration::createHandler):
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::fontAttributesForSelectionStart):
+        * platform/mac/HTMLConverter.mm:
+        (+[WebHTMLConverter editingAttributedStringFromRange:]):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintDecoration):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTextDecorationColors):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::operator|):
+        (WebCore::operator|=):
+        * rendering/style/StyleVisualData.h:
+        (StyleVisualData):
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paint):
+        (WebCore::positionOffsetForDecoration):
+        (WebCore::thicknessForDecoration):
+        (WebCore::findRenderObjectDefininingTextDecoration):
+        (WebCore::SVGInlineTextBox::paintDecoration):
+        (WebCore::SVGInlineTextBox::paintDecorationWithStyle):
+        * rendering/svg/SVGInlineTextBox.h:
</ins><span class="cx"> 
</span><del>-        Patch also fixes a bug where values whose representation
-        is bigger an integer maximum were overflowing. For instance,
-        NodeFilter.SHOW_ALL (0xFFFFFFFF).
</del><ins>+2013-05-22  Lori Anderson  &lt;lori@rkymtnhi.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests:
-        Binding tests updated.
-        Rebaselined fast/dom/constants.html
</del><ins>+        [GStreamer] Allow multiple log levels in media player
+        https://bugs.webkit.org/show_bug.cgi?id=116618
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::jsTestInterfaceIMPLEMENTSCONSTANT1):
-        (WebCore::jsTestInterfaceIMPLEMENTSCONSTANT2):
-        (WebCore::jsTestInterfaceSUPPLEMENTALCONSTANT1):
-        (WebCore::jsTestInterfaceSUPPLEMENTALCONSTANT2):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::jsTestObjCONDITIONAL_CONST):
-        (WebCore::jsTestObjCONST_VALUE_0):
-        (WebCore::jsTestObjCONST_VALUE_1):
-        (WebCore::jsTestObjCONST_VALUE_2):
-        (WebCore::jsTestObjCONST_VALUE_4):
-        (WebCore::jsTestObjCONST_VALUE_8):
-        (WebCore::jsTestObjCONST_VALUE_9):
-        (WebCore::jsTestObjCONST_VALUE_11):
-        (WebCore::jsTestObjCONST_VALUE_12):
-        (WebCore::jsTestObjCONST_VALUE_13):
-        (WebCore::jsTestObjCONST_VALUE_14):
-        (WebCore::jsTestObjCONST_JAVASCRIPT):
-        (WebCore::jsTestObjReadonly):
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-2014-03-28  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        No new tests, just changing logging.
</ins><span class="cx"> 
</span><del>-        A TrailingObject's endpoint might get decremented twice
-        https://bugs.webkit.org/show_bug.cgi?id=130874
</del><ins>+        * platform/graphics/gstreamer/GStreamerUtilities.h:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::load):
+        (WebCore::MediaPlayerPrivateGStreamer::pause):
+        (WebCore::MediaPlayerPrivateGStreamer::seek):
+        (WebCore::MediaPlayerPrivateGStreamer::setRate):
+        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-05-22  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        There are two places where we might shave off a trailing space from the end
-        of a line. We don't want to hit both codepaths for a single line.
</del><ins>+        The LayoutMilestones didLayout callback sometimes fires with a milestone value of 0
+        https://bugs.webkit.org/show_bug.cgi?id=116623
</ins><span class="cx"> 
</span><del>-        Fixes fast/block/update-midpoints-for-trailing-boxes-crash.html after r166245.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * rendering/line/BreakingContextInlineHeaders.h:
-        (WebCore::checkMidpoints):
-        (WebCore::BreakingContext::handleEndOfLine):
</del><ins>+        Make sure we have actually achieved some milestones before calling didLayout().
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
</ins><span class="cx"> 
</span><del>-2014-03-28  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-05-22  Mario Sanchez Prada  &lt;mario.prada@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Inline JSDOMWrapper subclasses' finishCreation().
-        &lt;https://webkit.org/b/130890&gt;
</del><ins>+        [GTK] Reimplement atk_text_get_text_*_offset for CHAR boundary
+        https://bugs.webkit.org/show_bug.cgi?id=114870
</ins><span class="cx"> 
</span><del>-        finishCreation() is really a no-op for JSDOMWrapper subclasses in
-        release builds. None of the ancestor classes do anything but assert
-        in their implementations.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Generate the function inline, reducing binary size, and removing
-        an unnecessary call from the JSFoo::create() helpers.
</del><ins>+        Re-implement this functions without using GailTextUtil nor Pango.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
+        (webkitAccessibleTextGetChar): New function.
+        (webkitAccessibleTextGetTextForOffset): Call the new function for CHAR.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateHeader):
-        (GenerateImplementation):
</del><ins>+2013-05-22  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-28  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        [Mac] Captions menu isn't internationalized, doesn't use rtl layout for rtl languages
+        https://bugs.webkit.org/show_bug.cgi?id=116605
</ins><span class="cx"> 
</span><del>-        [Mac] HLS streams will report an incorrect natural size.
-        https://bugs.webkit.org/show_bug.cgi?id=130859
-
</del><span class="cx">         Reviewed by Eric Carlson.
</span><span class="cx"> 
</span><del>-        Some HLS streams will report incorrect naturalSizes due to the asset's preferredTransform
-        property not being  available at the same time as the track's natural size. Given that
-        AVFoundation only allows one video track to be selected at a time, simply use the asset's
-        presentation size, cached in m_cachedPresentation size in all cases.
</del><ins>+        Ensure that rtl languages are properly recognized by the captions menu such that text
+        layout and alignment is natural.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::sizeChanged):
</del><ins>+        * css/mediaControls.css:
+        (::-webkit-media-controls):
+        Remove the forced &quot;direction: ltr&quot; property which was forcing all layout to be
+        left-to-right.
</ins><span class="cx"> 
</span><del>-2014-03-28  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        * css/mediaControlsQuickTime.css:
+        (video::-webkit-media-controls-closed-captions-track-list):
+        Remove the forced &quot;text-align: left&quot; property which was forcing all caption
+        titles to be left-aligned.
</ins><span class="cx"> 
</span><del>-        Remove NodeListRootType flag
-        https://bugs.webkit.org/show_bug.cgi?id=130896
</del><ins>+        (video::-webkit-media-controls-closed-captions-track-list h3):
+        Use &quot;-webkit-margin-start&quot; instead of &quot;padding-left&quot; to position the heading
+        such that it adds the margin on the left for ltr languages and on the right
+        for rtl languages.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        (video::-webkit-media-controls-closed-captions-track-list li):
+        Set &quot;position: relative&quot; such that the ::before pseudo-class can use &quot;position: absolute&quot;
+        to position itself relative to the caption title rather than the list element.
</ins><span class="cx"> 
</span><del>-        This can be handled statically (except for the RadioNodeList case) removing
-        a branch from NodeList traversal.
</del><ins>+        (video::-webkit-media-controls-closed-captions-track-list li.selected::before):
+        (video::-webkit-media-controls-closed-captions-track-list li.selected:hover::before):
+        Make the checkmarks a ::before pseudo-class rather than a background-image such that
+        we may control its positioning using the internationlization-friendly &quot;-webkit-margin-start&quot;
+        property.
</ins><span class="cx"> 
</span><del>-        * dom/ClassNodeList.h:
-        * dom/Document.cpp:
-        (WebCore::Document::registerNodeListForInvalidation):
-        (WebCore::Document::unregisterNodeListForInvalidation):
-        (WebCore::Document::registerNodeList): Deleted.
-        (WebCore::Document::unregisterNodeList): Deleted.
-        
-            Mark document invalidation registered lists with a bit.
-            Renamed for clarity.
</del><ins>+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlClosedCaptionsContainerElement::create):
+        Set the &quot;dir&quot; attribute to &quot;auto&quot; such that rtl languages are correctly handled. This
+        means that the first string displayed within the captions container, currently the
+        &quot;Subtitles&quot; &lt;h3&gt; element, defines the direction for the whole container. It is therefore
+        crucial that this string is properly localized in rtl languages as falling back to
+        english would mean the entire caption container is using ltr.
</ins><span class="cx"> 
</span><del>-        * dom/Document.h:
-        * dom/LiveNodeList.cpp:
-        (WebCore::LiveNodeList::LiveNodeList):
-        (WebCore::LiveNodeList::rootNode):
-        
-            Base class version that invokes virtual isRootedAtDocument. It is needed to support 
-            LiveNodeList::namedItem.
</del><ins>+2013-05-22  Hugo Parente Lima  &lt;hugo.lima@openbossa.org&gt;
</ins><span class="cx"> 
</span><del>-        * dom/LiveNodeList.h:
-        (WebCore::LiveNodeList::isRegisteredForInvalidationAtDocument):
-        (WebCore::LiveNodeList::setRegisteredForInvalidationAtDocument):
-        (WebCore::LiveNodeList::document):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::CachedLiveNodeList):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::~CachedLiveNodeList):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::rootNode):
-        
-            Call isRootedAtDocument on the final leaf type. Except for RadioNodeList this
-            resolves statically.
</del><ins>+        WebCore fails to compile with -Werror=maybe-uninitialized on GCC 4.8.0
+        https://bugs.webkit.org/show_bug.cgi?id=116340
</ins><span class="cx"> 
</span><del>-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::willValidateIndexCache):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::invalidateCache):
-        (WebCore::LiveNodeList::isRootedAtDocument): Deleted.
-        (WebCore::LiveNodeList::rootType): Deleted.
-        (WebCore::LiveNodeList::rootNode): Deleted.
-        * dom/NameNodeList.h:
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::adoptDocument):
-        * dom/TagNodeList.h:
-        * html/HTMLCollection.cpp:
-        (WebCore::rootTypeFromCollectionType):
-        * html/HTMLCollection.h:
-        (WebCore::HTMLCollection::isRootedAtDocument):
-        (WebCore::HTMLCollection::rootType):
-        
-            HTMLCollections still needs the flag.
</del><ins>+        Reviewed by Christophe Dumez.
</ins><span class="cx"> 
</span><del>-        * html/LabelsNodeList.cpp:
-        (WebCore::LabelsNodeList::LabelsNodeList):
-        * html/LabelsNodeList.h:
-        * html/RadioNodeList.cpp:
-        (WebCore::RadioNodeList::RadioNodeList):
-        * html/RadioNodeList.h:
</del><ins>+        No new tests, just a simple build fix.
</ins><span class="cx"> 
</span><del>-2014-03-28  Mario Sanchez Prada  &lt;mario.prada@samsung.com&gt;
</del><ins>+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::setDOMStorageItem): Init frame variable.
+        (WebCore::InspectorDOMStorageAgent::removeDOMStorageItem): Init frame variable.
</ins><span class="cx"> 
</span><del>-        [GTK] Geoclue2 providers won't work after reloading
-        https://bugs.webkit.org/show_bug.cgi?id=130898
</del><ins>+2013-05-22  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        Have IDL interface names match their global constructor
+        https://bugs.webkit.org/show_bug.cgi?id=116520
</ins><span class="cx"> 
</span><del>-        Don't reuse the Geoclue2 client proxy between different calls to
-        startPosition(), and create a new client proxy each time instead.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * platform/geoclue/GeolocationProviderGeoclue2.cpp:
-        (GeolocationProviderGeoclue::startUpdating): Don't reuse the
-        client proxy, by always calling geoclue_manager_call_get_client().
-        (GeolocationProviderGeoclue::stopUpdating): Disconnect from the
-        'location-updated' signal and dispose the client proxy.
</del><ins>+        Have IDL interface names match their global constructor name on DOMWindow.idl
+        using [InterfaceName] extended attribute. This affects in particular webkit
+        prefixed constructors. This is mandated by Web IDL specification:
+        http://dev.w3.org/2006/webapi/WebIDL/#es-interfaces
</ins><span class="cx"> 
</span><del>-2014-03-28  Diego Pino Garcia  &lt;dpino@igalia.com&gt;
</del><ins>+        As a consequence, we can now get rid of [NoInterfaceObject] extended attribute
+        for those interfaces and have their global constructors automatically generated
+        by the bindings generator.
</ins><span class="cx"> 
</span><del>-        [GTK] Too many redirects visiting www.globalforestwatch.org
-        https://bugs.webkit.org/show_bug.cgi?id=129681
</del><ins>+        No new tests, no behavior change for layout tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        * Modules/mediasource/MediaSource.idl:
+        * Modules/mediasource/SourceBuffer.idl:
+        * Modules/mediasource/SourceBufferList.idl:
+        * Modules/mediastream/MediaStream.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/speech/SpeechGrammar.idl:
+        * Modules/speech/SpeechGrammarList.idl:
+        * Modules/speech/SpeechRecognition.idl:
+        * Modules/speech/SpeechRecognitionError.idl:
+        * Modules/speech/SpeechRecognitionEvent.idl:
+        * Modules/webaudio/OfflineAudioContext.idl:
+        * Modules/webaudio/PannerNode.idl:
+        * dom/ShadowRoot.idl:
+        * page/DOMWindow.idl:
</ins><span class="cx"> 
</span><del>-        * platform/gtk/UserAgentGtk.cpp:
-        (WebCore::standardUserAgent): Append Safari version to UserAgent
-        string.
</del><ins>+2013-05-21  Mihai Tica  &lt;mitica@adobe.com&gt;
+        
+        Update the background blending implementation to match the changes done
+        in the spec. This implies that background color blending is removed and
+        the background layers won't blend with the content behind the element
+        any more.
+        https://bugs.webkit.org/show_bug.cgi?id=116212
</ins><span class="cx"> 
</span><del>-2014-03-28  Michael Saboff  &lt;msaboff@apple.com&gt;
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling r166249 back in.
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintFillLayers):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
</ins><span class="cx"> 
</span><del>-        Turns out r166070 didn't cause a 2% performance loss in page load times
</del><ins>+2013-05-21  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Use-after-free in DOMSelection::containsNode
+        https://bugs.webkit.org/show_bug.cgi?id=116468
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r166070.
-        Rollout r166070 due to 2% performance loss in page load times
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-28  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        Retain the node pointer. Also bail out early if the node was not in the document
+        since Range::compareBoundaryPoints sets ec to WRONG_DOCUMENT_ERR otherwise.
</ins><span class="cx"> 
</span><del>-        Web Inspector: Copy/paste error. EventListener block in DOM.json uses description from Node.
-        https://bugs.webkit.org/show_bug.cgi?id=130158
</del><ins>+        Test: editing/selection/contains-node-crash.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::containsNode):
+        * page/DOMSelection.h:
+        (DOMSelection):
</ins><span class="cx"> 
</span><del>-        * inspector/protocol/DOM.json: Fixed a copy/paste annoyance.
</del><ins>+2013-05-21  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-27  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        Web Inspector: InspectorFrontendHost::loadResourceSynchronously() builds ASCII-only results
+        https://bugs.webkit.org/show_bug.cgi?id=116569
</ins><span class="cx"> 
</span><del>-        Web Inspector: AXI: expose selectedChildNodeIds of list boxes, tree controls, etc., and reconcile UI with childNodeIds
-        https://bugs.webkit.org/show_bug.cgi?id=130827
</del><ins>+        Merge: https://chromium.googlesource.com/chromium/blink/+/7f1cfecfe34f4dbc6ce1ef0250b13f2058128eeb
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Timothy Hatcher.
</span><span class="cx"> 
</span><del>-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
</del><ins>+        Test: inspector/load-resource-synchronously-utf8.html
</ins><span class="cx"> 
</span><del>-        Support for selectedChildNodeIds in inspector-protocol: DOM.getAccessibilityPropertiesForNode.
</del><ins>+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::loadResourceSynchronously):
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/protocol/DOM.json:
</del><ins>+2013-05-21  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Allow session storage for third-party origins even if third-party data access is blocked.
+        https://bugs.webkit.org/show_bug.cgi?id=116532
</ins><span class="cx"> 
</span><del>-        Specify Shadow DOM Pseudo IDs in Media Element Constructors
-        https://bugs.webkit.org/show_bug.cgi?id=130882
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        In http://trac.webkit.org/changeset/149326 we relaxed our policy for
+        localStorage when third-party data blocking is enabled to create a
+        transient, session-scoped storage area for the third-party origin
+        instead of throwing an exception. Since this gives essentially the same
+        behavior as sessionStorage, we might as well also allow sessionStorage
+        for third-party origins.
</ins><span class="cx"> 
</span><del>-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlPanelElement::MediaControlPanelElement): Call setPseudoId in constructor.
-        (WebCore::MediaControlPanelEnclosureElement::MediaControlPanelEnclosureElement): Ditto.
-        (WebCore::MediaControlTimelineContainerElement::MediaControlTimelineContainerElement): Ditto.
-        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement): Ditto.
-        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement): Ditto.
-        (WebCore::MediaControlPanelMuteButtonElement::MediaControlPanelMuteButtonElement): Ditto.
-        (WebCore::MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteButtonElement): Ditto.
-        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement): Ditto.
-        (WebCore::MediaControlOverlayPlayButtonElement::MediaControlOverlayPlayButtonElement): Ditto.
-        (WebCore::MediaControlSeekForwardButtonElement::MediaControlSeekForwardButtonElement): Ditto.
-        (WebCore::MediaControlSeekBackButtonElement::MediaControlSeekBackButtonElement): Ditto.
-        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement): Ditto.
-        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement): Ditto.
-        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement): Ditto.
-        (WebCore::MediaControlClosedCaptionsContainerElement::MediaControlClosedCaptionsContainerElement): Ditto.
-        (WebCore::MediaControlClosedCaptionsTrackListElement::MediaControlClosedCaptionsTrackListElement): Ditto.
-        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Ditto.
-        (WebCore::MediaControlPanelVolumeSliderElement::MediaControlPanelVolumeSliderElement): Ditto.
-        (WebCore::MediaControlFullscreenVolumeSliderElement::MediaControlFullscreenVolumeSliderElement): Ditto.
-        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement): Ditto.
-        (WebCore::MediaControlFullscreenVolumeMinButtonElement::MediaControlFullscreenVolumeMinButtonElement): Ditto.
-        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::MediaControlFullscreenVolumeMaxButtonElement): Ditto.
-        (WebCore::MediaControlTimeRemainingDisplayElement::MediaControlTimeRemainingDisplayElement): Ditto.
-        (WebCore::MediaControlCurrentTimeDisplayElement::MediaControlCurrentTimeDisplayElement): Ditto.
-        (WebCore::MediaControlTextTrackContainerElement::MediaControlTextTrackContainerElement): Ditto.
</del><ins>+        Test: http/tests/security/cross-origin-session-storage-third-party-blocked.html
</ins><span class="cx"> 
</span><del>-2014-03-27  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        * WebCore.exp.in: Updated the symbol for
+        SecurityOrigin::canAccessStorage.
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage): Called canAccessSessionStorage()
+        rather than canAccessLocalStorage().
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canAccessStorage): Passed in an enum
+        indicating if access should be allowed from third-party origins.
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::canAccessSessionStorage): Called
+        canAccessStorage() with AlwaysAllowFromThirdParty.
+        (SecurityOrigin):
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Adjust the tile coverage on the scrollview's edges
-        https://bugs.webkit.org/show_bug.cgi?id=130884
</del><ins>+2013-05-21  Hugo Parente Lima  &lt;hugo.lima@openbossa.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        [EFL] Add missing #if guards on drag support methods
+        https://bugs.webkit.org/show_bug.cgi?id=116574
</ins><span class="cx"> 
</span><del>-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::computeCoverageRect):
-        Pull back the future rect inside the contentRect if it goes outside.
-        There is no point in retiling for rubberbanding and the extra tiles should be always be
-        on the opposite side to the edges.
</del><ins>+        Reviewed by Christophe Dumez.
</ins><span class="cx"> 
</span><del>-2014-03-27  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        * platform/efl/PasteboardEfl.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        Remove unused LocaleMac::create method
-        https://bugs.webkit.org/show_bug.cgi?id=130870
</del><ins>+2013-05-21  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Remove stub HTMLContentElement
+        https://bugs.webkit.org/show_bug.cgi?id=116580
</ins><span class="cx"> 
</span><del>-        * platform/text/mac/LocaleMac.h:
-        * platform/text/mac/LocaleMac.mm:
-        (WebCore::LocaleMac::create): Deleted.
-        (WebCore::LocaleMac::shortDateFormatter): Deleted.
-
-2014-03-27  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
-
-        Clean up unneeded &quot;mutable&quot; keyword
-        https://bugs.webkit.org/show_bug.cgi?id=130832
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        As r166350, this patch cleans up unneeded &quot;mutable&quot; keywords.
-        Additionally, m_validatedSelectionCache is removed because it is not used anywhere else.
</del><ins>+        Inherit DetailsContentElement and DetailsSummaryElement directly from InsertionPoint instead.
</ins><span class="cx"> 
</span><del>-        * css/CSSFontFaceRule.h:
-        * css/CSSStyleRule.h:
-        * editing/FrameSelection.h:
</del><ins>+        * html/HTMLDetailsElement.cpp:
+        (WebCore::DetailsContentElement::DetailsContentElement):
+        (WebCore::DetailsSummaryElement::DetailsSummaryElement):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::SummaryContentElement::SummaryContentElement):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::contentTagName):
+        * html/shadow/HTMLContentElement.h:
+        (WebCore::isHTMLContentElement):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::setResetStyleInheritance):
+        * html/shadow/InsertionPoint.h:
+        
+            Also remove some leftover selector code.
</ins><span class="cx"> 
</span><del>-2014-03-27  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        (WebCore::InsertionPoint::insertionPointType):
</ins><span class="cx"> 
</span><del>-        Add support for AirPlay picker in WK2 for iOS.
-        https://bugs.webkit.org/show_bug.cgi?id=130855
-        &lt;rdar://problem/15349859&gt;
</del><ins>+2013-05-21  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson, Joseph Pecoraro and Benjamin Poulain.
</del><ins>+        Robustify repaint of previous caret node when moving FrameSelection.
+        &lt;http://webkit.org/b/116558&gt;
</ins><span class="cx"> 
</span><del>-        Adds support in HTMLMediaSession to display the airplay picker
-        and to monitor presence of available wireless targets.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaSession.cpp:
-        (WebCore::HTMLMediaSession::showPlaybackTargetPicker):
-        (WebCore::HTMLMediaSession::hasWirelessPlaybackTargets):
-        (WebCore::HTMLMediaSession::setHasPlaybackTargetAvailabilityListeners):
-        * loader/EmptyClients.h:
-        * page/ChromeClient.h:
-        * platform/audio/MediaSessionManager.cpp:
-        (WebCore::MediaSessionManager::wirelessRoutesAvailableChanged):
-        * platform/audio/MediaSessionManager.h:
-        (WebCore::MediaSessionManager::hasWirelessTargetsAvailable):
-        (WebCore::MediaSessionManager::startMonitoringAirPlayRoutes):
-        (WebCore::MediaSessionManager::stopMonitoringAirPlayRoutes):
-        * platform/audio/ios/MediaSessionManagerIOS.h:
-        * platform/audio/ios/MediaSessionManagerIOS.mm:
-        (WebCore::MediaSessionManageriOS::hasWirelessTargetsAvailable):
-        (WebCore::MediaSessionManageriOS::startMonitoringAirPlayRoutes):
-        (WebCore::MediaSessionManageriOS::stopMonitoringAirPlayRoutes):
-        (-[WebMediaSessionHelper initWithCallback:]):
-        (-[WebMediaSessionHelper hasWirelessTargetsAvailable]):
-        (-[WebMediaSessionHelper startMonitoringAirPlayRoutes]):
-        (-[WebMediaSessionHelper stopMonitoringAirPlayRoutes]):
-        (-[WebMediaSessionHelper wirelessRoutesAvailableDidChange:]):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::wirelessVideoPlaybackDisabled):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setWirelessVideoPlaybackDisabled):
</del><ins>+        As a follow-up to r150396, also repaint the caret rects if the previous node is contenteditable.
</ins><span class="cx"> 
</span><del>-2014-03-27  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::recomputeCaretRect):
</ins><span class="cx"> 
</span><del>-        [CSS Shapes][css clip-path] rounded corner calculation for box shapes is wrong
-        https://bugs.webkit.org/show_bug.cgi?id=127982
</del><ins>+2013-05-21  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Unreviewed build fix after r150469. We need to bail out here when DOM is mutated by an event listener such that
+        the split text nodes no longer exist right next to each other.
</ins><span class="cx"> 
</span><del>-        Calculate rounded corners for box shapes as defined in the CSS Shapes
-        spec.
</del><ins>+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
</ins><span class="cx"> 
</span><del>-        Tests: css3/masking/clip-path-border-radius-border-box-000.html
-               css3/masking/clip-path-border-radius-content-box-000.html
-               css3/masking/clip-path-border-radius-content-box-001.html
-               css3/masking/clip-path-border-radius-padding-box-000.html
-               css3/masking/clip-path-border-radius-padding-box-001.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-border-box-000.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-border-box-001.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-border-box-002.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-content-box-000.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-content-box-001.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-content-box-002.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-content-box-003.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-margin-box-000.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-margin-box-001.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-margin-box-002.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-margin-box-003.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-margin-box-004.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-padding-box-000.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-padding-box-001.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-padding-box-002.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-border-radius-padding-box-003.html
</del><ins>+2013-05-21  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/RoundedRect.h:
-        (WebCore::RoundedRect::Radii::transposedRadii): Transpose radii for
-            vertical writing modes.
-        (WebCore::RoundedRect::moveBy): Add method for use with clip path.
-        (WebCore::RoundedRect::transposedRect): Transpose rect for vertical
-            writing modes.
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::marginBoxRect): Return the margin box rect for
-            the RenderBox.
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::setupClipPath): Call the new function for the
-            rounded corner calculation.
-        * rendering/shapes/ShapeInfo.cpp:
-        (WebCore::ShapeInfo&lt;RenderType&gt;::computedShape): Call the new function
-            for the rounded corner calculation.
-        * rendering/shapes/BoxShape.cpp:
-        (WebCore::adjustRadiusForMarginBoxShape): Helper function for
-            computeRoundedRectForLayoutBoxShape.
-        (WebCore::computeMarginBoxShapeRadius): Ditto.
-        (WebCore::computeMarginBoxShapeRadii): Ditto.
-        (WebCore::computeRoundedRectForBoxShape): Utility function to do the
-            rounded corner calculation.
-        * rendering/shapes/BoxShape.h: Add new function.
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::getRoundedInnerBorderFor): Add default argument
-            values.
</del><ins>+        Remove ScopeContentDistribution
+        https://bugs.webkit.org/show_bug.cgi?id=116576
</ins><span class="cx"> 
</span><del>-2014-03-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r166364.
-        https://bugs.webkit.org/show_bug.cgi?id=130872
</del><ins>+        With maximum one ShadowRoot per Element this can be smashed into ContentDistributor.
</ins><span class="cx"> 
</span><del>-        Caused a test assertion (Requested by smfr on #webkit).
</del><ins>+        * dom/ShadowRoot.cpp:
+        (WebCore):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::ContentDistributor):
+        (WebCore):
+        (WebCore::ContentDistributor::~ContentDistributor):
+        (WebCore::ContentDistributor::invalidateInsertionPointList):
+        (WebCore::ContentDistributor::ensureInsertionPointList):
+        (WebCore::ContentDistributor::distribute):
+        (WebCore::ContentDistributor::invalidate):
+        * html/shadow/ContentDistributor.h:
+        (WebCore):
+        (ContentDistributor):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::InsertionPoint):
+        (WebCore::InsertionPoint::insertedInto):
+        (WebCore::InsertionPoint::removedFrom):
+        
+            Simplify insertion point list invalidation.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        * html/shadow/InsertionPoint.h:
</ins><span class="cx"> 
</span><del>-        &quot;Operator stretching: expose a math data API&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130572
-        http://trac.webkit.org/changeset/166364
</del><ins>+2013-05-21  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-27  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        [CSS Regions][CSS Exclusions] Multiple regions with shape-insides should respect positioned shapes and overflow
+        https://bugs.webkit.org/show_bug.cgi?id=115001
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Compute a good exposed rect when scaling WKContentView
-        https://bugs.webkit.org/show_bug.cgi?id=130761
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        In r150375 I implemented the new overflow behavior for shape-inside on regions, but it covered only the simple cases
+        when you had only one region. This patch adds support for the new overflow behavior for multiple regions with multiple
+        positioned shape-insides and overflow.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ScrollView.h:
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::setScrollVelocity):
-        (WebCore::ScrollView::computeCoverageRect):
-        While scaling in, do not add margins tiles. When scaling out, add 1 margin tile size
-        all around.
</del><ins>+        Tests: fast/regions/shape-inside/shape-inside-on-regions-block-content-overflow-multiple-shapes.html
+               fast/regions/shape-inside/shape-inside-on-regions-inline-content-overflow-multiple-shapes.html
</ins><span class="cx"> 
</span><del>-2014-03-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::updateLineBoundariesForExclusions): Cover cases when content flows into the next region, update the
+        line segments for the overflow.
+        (WebCore::RenderBlock::adjustLogicalLineTopAndLogicalHeightIfNeeded): In flow thread case we don't want to adjust the height
+        in two places.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r166360.
-        https://bugs.webkit.org/show_bug.cgi?id=130869
</del><ins>+2013-05-21  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Seems to have broken PLT (Requested by ap on #webkit).
</del><ins>+        Unreviewed, rolling out r150425.
+        http://trac.webkit.org/changeset/150425
+        https://bugs.webkit.org/show_bug.cgi?id=116573
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Not the right fix for WebKit2 (Requested by rniwa on #webkit).
</ins><span class="cx"> 
</span><del>-        &quot;Connection::dispatchOneMessage() can be re-entered while
-        handling Cmd-key menu&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130767
-        http://trac.webkit.org/changeset/166360
</del><ins>+        * testing/Internals.cpp:
+        (WebCore::Internals::resetToConsistentState):
</ins><span class="cx"> 
</span><del>-2014-03-27  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-05-20  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Remove LiveNodeList::Type
-        https://bugs.webkit.org/show_bug.cgi?id=130866
</del><ins>+        dispatchEvent call can execute javascript and blow away endRoot from underneath
+        https://bugs.webkit.org/show_bug.cgi?id=116483
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Andreas Kling.
</span><del>-
-        We don't need dynamic type information anymore.
-
-        * dom/ClassNodeList.cpp:
-        (WebCore::ClassNodeList::ClassNodeList):
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::getElementsByTagName):
-        (WebCore::ContainerNode::getElementsByName):
-        (WebCore::ContainerNode::getElementsByClassName):
-        (WebCore::ContainerNode::radioNodeList):
-        * dom/LiveNodeList.cpp:
-        (WebCore::LiveNodeList::LiveNodeList):
-        * dom/LiveNodeList.h:
-        (WebCore::LiveNodeList::invalidationType):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::CachedLiveNodeList):
-        (WebCore::LiveNodeList::type): Deleted.
-        * dom/NameNodeList.cpp:
-        (WebCore::NameNodeList::NameNodeList):
-        (WebCore::NameNodeList::nodeMatches): Deleted.
-        * dom/NameNodeList.h:
-        (WebCore::NameNodeList::nodeMatches):
-        * dom/NodeRareData.h:
-        (WebCore::NodeListTypeIdentifier&lt;ClassNodeList&gt;::value):
-        (WebCore::NodeListTypeIdentifier&lt;NameNodeList&gt;::value):
-        (WebCore::NodeListTypeIdentifier&lt;TagNodeList&gt;::value):
-        (WebCore::NodeListTypeIdentifier&lt;HTMLTagNodeList&gt;::value):
-        (WebCore::NodeListTypeIdentifier&lt;RadioNodeList&gt;::value):
-        (WebCore::NodeListTypeIdentifier&lt;LabelsNodeList&gt;::value):
</del><span class="cx">         
</span><del>-            Get unique id from type for key generation purposes only.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/798cba0af9b2aff21e475e2e08ea3ca5e97dfc2c.
</ins><span class="cx"> 
</span><del>-        (WebCore::NodeListsNodeData::addCacheWithAtomicName):
-        (WebCore::NodeListsNodeData::addCacheWithName):
-        (WebCore::NodeListsNodeData::removeCacheWithAtomicName):
-        (WebCore::NodeListsNodeData::removeCacheWithName):
-        (WebCore::NodeListsNodeData::namedNodeListKey):
-        * dom/TagNodeList.cpp:
-        (WebCore::TagNodeList::TagNodeList):
-        (WebCore::HTMLTagNodeList::HTMLTagNodeList):
-        * dom/TagNodeList.h:
-        * html/LabelableElement.cpp:
-        (WebCore::LabelableElement::labels):
-        * html/LabelsNodeList.cpp:
-        (WebCore::LabelsNodeList::LabelsNodeList):
-        * html/LabelsNodeList.h:
-        * html/RadioNodeList.cpp:
-        (WebCore::RadioNodeList::RadioNodeList):
-        * html/RadioNodeList.h:
</del><ins>+        Test: editing/undo/undo-after-event-edited.html
</ins><span class="cx"> 
</span><del>-2014-03-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * editing/Editor.cpp:
+        (WebCore::dispatchEditableContentChangedEvents):
</ins><span class="cx"> 
</span><del>-        Fix crash when RenderView is cleared inside of frame flattening layout
-        https://bugs.webkit.org/show_bug.cgi?id=130864
</del><ins>+2013-05-21  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
-        
-        Navigating on http://wallstcheatsheet.com pages on iOS in WebKit1 would
-        sometimes crash when, inside the inChildFrameLayoutWithFrameFlattening clause,
-        our frame's RenderView would be null after doing a layout from the root frame,
-        possibly also when WebCore was being re-entered from another thread.
-        
-        Add a null check to fix this.
-        
-        Crash was timing-dependent and hard to test.
</del><ins>+        Remove ContentDistribution
+        https://bugs.webkit.org/show_bug.cgi?id=116527
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-
-2014-03-27  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Remove some unnecessary branches from LiveNodeList traversal
-        https://bugs.webkit.org/show_bug.cgi?id=130854
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Compile different traversal code paths for all NodeList subclasses.
</del><ins>+        Resolving distribution on traversal is simpler.
</ins><span class="cx"> 
</span><del>-        * dom/ClassNodeList.cpp:
-        (WebCore::ClassNodeList::ClassNodeList):
-        (WebCore::ClassNodeList::~ClassNodeList):
-        (WebCore::ClassNodeList::nodeMatches): Deleted.
-        * dom/ClassNodeList.h:
-        (WebCore::ClassNodeList::nodeMatches):
-        (WebCore::ClassNodeList::nodeMatchesInlined): Deleted.
</del><ins>+        * WebCore.exp.in:
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseNode):
+        (WebCore::ComposedShadowTreeWalker::traverseDistributedNodes):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
+        * html/HTMLDetailsElement.cpp:
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::distributeSelectionsTo):
+        * html/shadow/ContentDistributor.h:
+        * html/shadow/HTMLContentElement.idl:
</ins><span class="cx">         
</span><del>-            Remove separate nodeMatchesInlined functions. 
-            We now rely on exact types and marking classes final.
</del><ins>+            Remove getDistributedNodes().
</ins><span class="cx"> 
</span><del>-        * dom/LiveNodeList.cpp:
-        (WebCore::LiveNodeList::LiveNodeList):
-        (WebCore::LiveNodeList::~LiveNodeList):
-        (WebCore::LiveNodeList::namedItem):
-        (WebCore::LiveNodeList::rootNode): Deleted.
-        (WebCore::isMatchingElement): Deleted.
-        (WebCore::firstMatchingElement): Deleted.
-        (WebCore::lastMatchingElement): Deleted.
-        (WebCore::nextMatchingElement): Deleted.
-        (WebCore::previousMatchingElement): Deleted.
-        (WebCore::traverseMatchingElementsForward): Deleted.
-        (WebCore::traverseMatchingElementsBackward): Deleted.
-        (WebCore::LiveNodeList::collectionFirst): Deleted.
-        (WebCore::LiveNodeList::collectionLast): Deleted.
-        (WebCore::LiveNodeList::collectionTraverseForward): Deleted.
-        (WebCore::LiveNodeList::collectionTraverseBackward): Deleted.
-        (WebCore::LiveNodeList::length): Deleted.
-        (WebCore::LiveNodeList::item): Deleted.
-        (WebCore::LiveNodeList::memoryCost): Deleted.
-        (WebCore::LiveNodeList::invalidateCache): Deleted.
-        * dom/LiveNodeList.h:
-        (WebCore::LiveNodeList::invalidateCacheForAttribute):
-        (WebCore::CachedLiveNodeList::collectionCanTraverseBackward):
-        (WebCore::LiveNodeList::rootNode):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::CachedLiveNodeList):
</del><ins>+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::InsertionPoint):
+        (WebCore::InsertionPoint::attach):
+        (WebCore::InsertionPoint::detach):
+        (WebCore):
+        (WebCore::InsertionPoint::firstDistributed):
+        (WebCore::InsertionPoint::lastDistributed):
+        (WebCore::InsertionPoint::nextDistributedTo):
+        (WebCore::InsertionPoint::previousDistributedTo):
</ins><span class="cx">         
</span><del>-            Add CachedLiveNodeList&lt;NodeListType&gt; utility type that interfaces with CollectionIndexCache.
-            It is the base class for all concrete LiveNodeLists.
</del><ins>+            Rename for clarity.
</ins><span class="cx"> 
</span><del>-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::~CachedLiveNodeList):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionFirst):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionLast):
-        (WebCore::nextMatchingElement):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionTraverseForward):
-        (WebCore::previousMatchingElement):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::collectionTraverseBackward):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::willValidateIndexCache):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::invalidateCache):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::length):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::item):
-        (WebCore::CachedLiveNodeList&lt;NodeListType&gt;::memoryCost):
-        
-            Templated code moves to header.
</del><ins>+        * html/shadow/InsertionPoint.h:
+        (WebCore::InsertionPoint::hasDistribution):
+        (WebCore::InsertionPoint::setHasDistribution):
+        (WebCore::InsertionPoint::clearDistribution):
+        (WebCore::InsertionPoint::matchTypeFor):
+        (InsertionPoint):
</ins><span class="cx"> 
</span><del>-        (WebCore::LiveNodeList::LiveNodeList): Deleted.
-        (WebCore::LiveNodeList::~LiveNodeList): Deleted.
-        (WebCore::LiveNodeList::invalidateCache): Deleted.
-        (WebCore::LiveNodeList::collectionCanTraverseBackward): Deleted.
-        (WebCore::LiveNodeList::willValidateIndexCache): Deleted.
-        * dom/NameNodeList.cpp:
-        (WebCore::NameNodeList::NameNodeList):
-        * dom/NameNodeList.h:
-        * dom/Node.cpp:
-        (WebCore::Document::invalidateNodeListAndCollectionCaches):
-        (WebCore::NodeListsNodeData::invalidateCaches):
-        * dom/TagNodeList.cpp:
-        (WebCore::TagNodeList::TagNodeList):
-        (WebCore::HTMLTagNodeList::HTMLTagNodeList):
-        (WebCore::HTMLTagNodeList::~HTMLTagNodeList):
-        (WebCore::TagNodeList::nodeMatches): Deleted.
-        (WebCore::HTMLTagNodeList::nodeMatches): Deleted.
-        * dom/TagNodeList.h:
-        (WebCore::TagNodeList::nodeMatches):
-        (WebCore::HTMLTagNodeList::nodeMatches):
-        (WebCore::TagNodeList::create): Deleted.
-        (WebCore::HTMLTagNodeList::nodeMatchesInlined): Deleted.
-        * html/LabelsNodeList.cpp:
-        (WebCore::LabelsNodeList::LabelsNodeList):
-        * html/LabelsNodeList.h:
-        * html/RadioNodeList.cpp:
-        (WebCore::RadioNodeList::RadioNodeList):
-        * html/RadioNodeList.h:
</del><ins>+2013-05-21  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-27  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+        [GTK] [CMake] Add support for building WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=116372
</ins><span class="cx"> 
</span><del>-        Remove comment from Filter.h
-        https://bugs.webkit.org/show_bug.cgi?id=130848
</del><ins>+        Reviewed by Gustavo Noronha Silva.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * PlatformGTK.cmake: Add missing source files, include directories, and WebP properties.
</ins><span class="cx"> 
</span><del>-        Exploring the use of consts on applyScale() methods didn't yield
-        good results.
</del><ins>+2013-05-21  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no change on behavior.
</del><ins>+        REGRESSION(r101810): Media controls status text missing for live-stream videos.
+        https://bugs.webkit.org/show_bug.cgi?id=116547
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/Filter.h:
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-03-27  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Un-reverse the logic in loadedMetadata() so that the status text isn't
+        hidden (when it should be shown) for live-stream videos.
</ins><span class="cx"> 
</span><del>-        Operator stretching: expose a math data API
-        https://bugs.webkit.org/show_bug.cgi?id=130572
</del><ins>+        * html/shadow/MediaControlsApple.cpp:
+        (WebCore::MediaControlsApple::loadedMetadata):
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+2013-05-21  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        We expose a new SimpleFontData API to give access to the data from the
-        OpenType MATH table using a font cache. The class OpenTypeMathData will
-        be implemented in bug 130324. On Darwin platform, we also implement the
-        missing FontPlatformData::openTypeTable function which will be necessary
-        to load the OpenType MATH table. The changes are intended to be used
-        for MathML operator stretching (bug 130322) so tests are not added yet.
</del><ins>+        Implement overlap-avoidance for in-band text track cues.
+        https://bugs.webkit.org/show_bug.cgi?id=116540
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: add new OpenTypeMathData files.
-        * WebCore.vcxproj/WebCore.vcxproj: ditto.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: ditto.
-        * WebCore.xcodeproj/project.pbxproj: ditto.
-        * platform/graphics/FontCache.cpp: We add a FontCache::getMathData function to implement a cache for the math data.
-        We make the math and vertical data share the same key for the cache.
-        (WebCore::fontMathDataCacheInstance):
-        (WebCore::FontCache::getMathData):
-        (WebCore::fontVerticalDataCacheInstance):
-        * platform/graphics/FontCache.h: We declare FontCache::getMathData and FontFileKey on all platforms.
-        * platform/graphics/FontPlatformData.cpp:
-        (WebCore::FontPlatformData::openTypeTable): We implement openTypeTable() on Darwin platform.
-        * platform/graphics/FontPlatformData.h: We expose openTypeTable() on Darwin platform.
-        * platform/graphics/SimpleFontData.cpp: We initialize m_mathData from the font cache.
-        (WebCore::SimpleFontData::SimpleFontData):
-        * platform/graphics/SimpleFontData.h: We expose a mathData() function to access the MATH data.
-        * platform/graphics/opentype/OpenTypeMathData.cpp: Added. This is a new class that will be used to parse the data from the OpenType MATH table.
-        (WebCore::OpenTypeMathData::OpenTypeMathData):
-        * platform/graphics/opentype/OpenTypeMathData.h: Added.
-        (WebCore::OpenTypeMathData::create):
-        (WebCore::OpenTypeMathData::hasMathData):
-
-2014-03-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        Fix a crash caused by track insertion after load()
-        https://bugs.webkit.org/show_bug.cgi?id=130777
-
</del><span class="cx">         Reviewed by Eric Carlson.
</span><span class="cx"> 
</span><del>-        Test: media/track/track-insert-after-load-crash.html
</del><ins>+        In-band (or Generic) cues need special casing for certain features
+        present in in-band tracks, like paint-on and roll-up modes. To avoid
+        the problem of overlap avoidance forcing a caption meant to appear
+        below a cue to appear above it when a larger font size is selected,
+        impose an additional sort ordering for &quot;generic cues&quot;. Instead of
+        cues being ordered by the order they appear in the track, &quot;generic
+        cues&quot; further sorted by their position within the video area, such
+        that cues at the bottom of the video area appear first, and later
+        cues are pushed up to avoid them, preserving the desired apparent
+        ordering.
</ins><span class="cx"> 
</span><del>-        Based on the Blink change (patch by acolwell@chromium.org):
-        https://codereview.chromium.org/211373009/
-
</del><span class="cx">         * html/HTMLMediaElement.cpp:
</span><del>-        (WebCore::HTMLMediaElement::parseAttribute): Remove stale LoadMediaResource flag after explicit load.
</del><ins>+        (WebCore::compareCueInterval): Added; wrapper around
+            TextTrackCue::isOrderedBefore.
+        (WebCore::HTMLMediaElement::updateActiveTextTrackCues):
+            After creating the list of current cues, sort them.
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::isOrderedBefore): Added; implementation moved
+            from TextTrackCueList::add().
+        * html/track/TextTrackCue.h:
+        * html/track/TextTrackCueGeneric.cpp:
+        (WebCore::TextTrackCueGeneric::isOrderedBefore): Added override;
+            impose additional oredring on generic cues.
+        * html/track/TextTrackCueGeneric.h:
+        * html/track/TextTrackCueList.cpp:
+        (WebCore::TextTrackCueList::add): Moved ordering test into
+            isOrderedBefore().
+        * rendering/RenderTextTrackCue.cpp:
+        (WebCore::RenderTextTrackCue::repositionGenericCue):
+            Call repositionCueSnapToLinesNotSet() after positioning the cue.
</ins><span class="cx"> 
</span><del>-2014-03-27  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-05-20  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Connection::dispatchOneMessage() can be re-entered while handling Cmd-key menu
-        equivalents, ASSERT(!_data-&gt;_keyDownEventBeingResent)
-        https://bugs.webkit.org/show_bug.cgi?id=130767
-        &lt;rdar://problem/16307487&gt;
</del><ins>+        Implement overlap avoidance for cues with snap-to-lines flag not set
+        https://bugs.webkit.org/show_bug.cgi?id=84296
</ins><span class="cx"> 
</span><del>-        Added a wrapper for RunLoop::initializeMainThread that also adds modal run loop
-        mode to it on Mac.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * WebCore.exp.in:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/MainRunLoop.cpp: Added.
-        (WebCore::initializeMainRunLoop):
-        * platform/MainRunLoop.h: Added.
-        * platform/mac/MainRunLoop.mm: Added.
-        (WebCore::initializeMainRunLoop):
</del><ins>+        Test: media/track/track-cue-overlap-snap-to-lines-not-set.html
</ins><span class="cx"> 
</span><del>-2014-03-27  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+        Support overlap avoidance for the non-snap-to-lines part of the WebVTT spec.
</ins><span class="cx"> 
</span><del>-        AX: Returns const reference to static string.
-        https://bugs.webkit.org/show_bug.cgi?id=130835
</del><ins>+        * rendering/RenderTextTrackCue.cpp:
+        (WebCore::RenderTextTrackCue::isOutside): Split implementation into rectIsWithinContainer().
+        (WebCore::RenderTextTrackCue::rectIsWithinContainer): Ditto.
+        (WebCore::RenderTextTrackCue::isOverlapping): Split into overlappingObject() and overlappingObjectForRect().
+        (WebCore::RenderTextTrackCue::overlappingObject): Ditto.
+        (WebCore::RenderTextTrackCue::overlappingObjectForRect): Ditto.
+        (WebCore::RenderTextTrackCue::moveIfNecessaryToKeepWithinContainer): Added.
+        (WebCore::RenderTextTrackCue::findNonOverlappingPosition): When an overlapping object is found, move the
+            cue to just above or below that object and try again.
+        (WebCore::RenderTextTrackCue::repositionCueSnapToLinesSet): Move implementation into moveIfNecessaryToKeepWithinContainer().
+        (WebCore::RenderTextTrackCue::repositionCueSnapToLinesNotSet): Add implementanton based on above.
+        * rendering/RenderTextTrackCue.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+2013-05-21  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Avoiding some unnecessary copies by returning const reference to static string.
</del><ins>+        Remove GraphicsLayerClient::contentsVisible()
+        https://bugs.webkit.org/show_bug.cgi?id=116523
</ins><span class="cx"> 
</span><del>-        No new tests. No behaviour change.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityMediaControls.cpp:
-        (WebCore::AccessibilityMediaControl::controlTypeName):
-        (WebCore::AccessibilityMediaControlsContainer::elementTypeName):
-        * accessibility/AccessibilityMediaControls.h:
</del><ins>+        This is dead code from the BlackBerry port.
</ins><span class="cx"> 
</span><del>-2014-03-27  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        * platform/graphics/GraphicsLayerClient.h:
+        * rendering/RenderLayerBacking.cpp:
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Rename inNamedFlow flag to isNamedFlowContentNode flag
-        https://bugs.webkit.org/show_bug.cgi?id=130731
</del><ins>+2013-05-21  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        PLATFORM(*) macros used in Source/WebCore/loader/archive/ArchiveFactory.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=116453
</ins><span class="cx"> 
</span><del>-        Currently, the inNamedFlow flag in Node class tells if a node is a content node, one that has a style with flow-into.
-        Since it is used only for those nodes and not propagated through hierarchy, i want to renamed it to a more meaningful name.
-        No new functionality, no new tests.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp:
-        (WebCore::destroyRenderTreeIfNeeded):
-        * dom/Element.cpp:
-        (WebCore::Element::~Element):
-        (WebCore::Element::unregisterNamedFlowContentElement):
-        * dom/Node.h:
-        (WebCore::Node::isNamedFlowContentNode):
-        (WebCore::Node::setIsNamedFlowContentNode):
-        (WebCore::Node::clearIsNamedFlowContentNode):
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::clearContentElements):
-        (WebCore::RenderNamedFlowThread::registerNamedFlowContentElement):
-        (WebCore::RenderNamedFlowThread::unregisterNamedFlowContentElement):
-        (WebCore::nextNodeInsideContentElement):
-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::attachChildren):
-        (WebCore::Style::resolveLocal):
</del><ins>+        * loader/archive/ArchiveFactory.cpp: Remove a redundant PLATFORM(QT) macro when checking whether
+        to include the LegacyWebArchive.h header that's specific to the WebArchive support. The Qt port
+        does not enable the WebArchive feature at all (which is enabled only on AppleMac, AppleWin and iOS
+        platforms) so there's no reason to additionally condition the header include with building on
+        non-Qt platforms.
</ins><span class="cx"> 
</span><del>-2014-03-27  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+2013-05-21  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Crash when cloning a region child with a content node child
-        https://bugs.webkit.org/show_bug.cgi?id=129811
</del><ins>+        Add BlackBerry definition of NativeImagePtr
+        https://bugs.webkit.org/show_bug.cgi?id=116526
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Collecting the children of a region in another named flow will be supported
-        again in the future and it will be revisited when we will implement the content
-        keyword: http://dev.w3.org/csswg/css-regions-1/#the-flow-into-property.
-        Remove the support for now as it introduces unnecessary complexity in the code
-        and potential wrong behavior.
</del><ins>+        * platform/graphics/NativeImagePtr.h:
+        (Graphics):
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/region-content-node-child-clone-crash.html
</del><ins>+2013-05-21  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::shouldMoveToFlowThread):
-        (WebCore::Element::clearStyleDerivedDataBeforeDetachingRenderer):
-        * dom/Element.h:
-        * dom/ElementRareData.h:
-        (WebCore::ElementRareData::ElementRareData):
-        * rendering/FlowThreadController.cpp:
-        * rendering/FlowThreadController.h:
-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::moveToFlowThreadIfNeeded):
-        (WebCore::Style::createRendererIfNeeded):
</del><ins>+        [BlackBerry] FontCache::getFontDataForCharacters() returns nullptr
+        https://bugs.webkit.org/show_bug.cgi?id=116529
</ins><span class="cx"> 
</span><del>-2014-03-27  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
-
-        Remove unneeded mutable keyword in some member variables 
-        https://bugs.webkit.org/show_bug.cgi?id=130813
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Some member variables have mutable keyword though they don't used by const function.
-        This patch removes them. 
</del><ins>+        This cannot be converted to a PassRefPtr and breaks the build.
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior changes. Just clean up.
</del><ins>+        * platform/graphics/blackberry/FontCacheBlackBerry.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
</ins><span class="cx"> 
</span><del>-        * storage/StorageAreaSync.h:
-        * svg/animation/SVGSMILElement.h:
</del><ins>+2013-05-21  Iago Toral Quiroga  &lt;itoral@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        [GTK] Always use EGL to create the GL context when running on Wayland
+        https://bugs.webkit.org/show_bug.cgi?id=115721
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r166296 and r166331.
-        https://bugs.webkit.org/show_bug.cgi?id=130822
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        caused some crashes and frequent assertion failures, and the
-        fix is going to take a little while (Requested by thorton on
-        #webkit).
</del><ins>+        * platform/graphics/cairo/GLContext.cpp:
+        (WebCore::GLContext::createContextForWindow):
+        (WebCore::GLContext::createOffscreenContext): Always use EGL to create the GL context
+        instead of GLX when running on Wayland and make createOffScreenContext reuse the code
+        in createContextWindow.
</ins><span class="cx"> 
</span><del>-        Reverted changesets:
</del><ins>+2013-05-21  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;[iOS WebKit2] Flush all surfaces after painting into all of
-        them, instead of after painting into each one&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130768
-        http://trac.webkit.org/changeset/166296
</del><ins>+        Add FloatRect::normalized() for BlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=116531
</ins><span class="cx"> 
</span><del>-        &quot;Assertion failure in RemoteLayerBackingStore::flush&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130810
-        http://trac.webkit.org/changeset/166331
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-2014-03-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        This was added to FloatRectBlackBerry.cpp in r111072 when the
+        graphics platform code was upstreamed, but this change was
+        missing.
</ins><span class="cx"> 
</span><del>-        Fix failing scrolling tests by reverting to previous behavior where
-        the scrolling geometry for the main frame scrolling node was only
-        updated from frameViewLayoutUpdated() and no-where else.
</del><ins>+        * platform/graphics/FloatRect.h:
+        (FloatRect):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::updateScrollingNode):
-        * page/scrolling/AsyncScrollingCoordinator.h:
-        * page/scrolling/ScrollingCoordinator.h:
-        (WebCore::ScrollingCoordinator::updateScrollingNode):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
-        (WebCore::RenderLayerCompositor::detachScrollCoordinatedLayer): Deleted.
</del><ins>+2013-05-21  Balazs Kelemen  &lt;kbalazs@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        [GStreamer] cleanup duration query
+        https://bugs.webkit.org/show_bug.cgi?id=116228
</ins><span class="cx"> 
</span><del>-        HTMLConverter::_processText is slow because it walks up ancestor elements
-        https://bugs.webkit.org/show_bug.cgi?id=130820
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Avoid walking up the tree from each text node by caching the aggregated attributed strings for each element.
-        Also compute the attributed strings top-down to avoid calling mutableCopy in every iteration. 
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::duration):
+        We can also cache the duration here if the query succeeds.
+        (MediaPlayerPrivateGStreamer::updateStates):
+        Don't query when we are in GST_STATE_READY state because it never succeeds.
+        Do it instead when we reached a stable state.
+        (MediaPlayerPrivateGStreamer::cacheDuration): Return early if it is already
+        cached. Recaching is not necessary and now we call it a lot of times.
+        Only look into the state if the query failed.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer): Made m_mediaDuration mutable to be
+        able to cache it in duration(). Internal cached values is one of
+        the sensible uses of mutable.
</ins><span class="cx"> 
</span><del>-        This reduces the runtime of Interactive/CopyAll.html from 15s to 13s (15%).
</del><ins>+2013-05-21  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverter::_attributesForElement):
-        (HTMLConverter::attributesForElement):
-        (HTMLConverter::aggregatedAttributesForAncestors):
-        (HTMLConverter::_processText):
</del><ins>+        Build fix for !USE(ACCELERATED_COMPOSITING) after r150307.
</ins><span class="cx"> 
</span><del>-2014-03-26  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        * rendering/RenderLayerCompositor.h: Added missing #if USE(ACCELERATED_COMPOSITING).
</ins><span class="cx"> 
</span><del>-        Fix iOS build.
</del><ins>+2013-05-20  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/cocoa/HTMLConverter.mm:
-        (_font):
</del><ins>+        Simplify Shadow DOM distribution code
+        https://bugs.webkit.org/show_bug.cgi?id=116454
</ins><span class="cx"> 
</span><del>-2014-03-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Reviewed by Andreas Kling.
+        
+        Remove code supporting nested insertion points and distributing to multiple insertion points.
+    
+        * html/HTMLDetailsElement.cpp:
+        (DetailsContentElement):
+        
+            Make distribution to &lt;details&gt; and &lt;summary&gt; mutually exclusive.
</ins><span class="cx"> 
</span><del>-        Make _processText and _traverseNode in HTMLConverter more efficient
-        https://bugs.webkit.org/show_bug.cgi?id=130769
</del><ins>+        * html/shadow/ContentDistributor.cpp:
+        (WebCore):
+        (WebCore::ContentDistributor::distribute):
+        (WebCore::ContentDistributor::invalidate):
+        (WebCore::ContentDistributor::distributeSelectionsTo):
+        * html/shadow/ContentDistributor.h:
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::resolveReprojection):
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2013-05-21  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Rewrote a bunch of code in C++ and avoided creating wrappers.
-        This reduces the runtime of Interactive/CopyAll.html from ~16.5s to 15s.
</del><ins>+        [CSSRegions] Constrain auto-height region computation in a different way
+        https://bugs.webkit.org/show_bug.cgi?id=116310
</ins><span class="cx"> 
</span><del>-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverterCaches::isAncestorsOfStartToBeConverted):
-        (HTMLConverter::HTMLConverter):
-        (HTMLConverter::~HTMLConverter):
-        (HTMLConverter::_processElement):
-        (HTMLConverter::_processText):
-        (HTMLConverter::_traverseNode):
-        (HTMLConverter::_traverseFooterNode):
-        (HTMLConverterCaches::cacheAncestorsOfStartToBeConverted):
-        (HTMLConverter::_loadFromDOMRange):
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-2014-03-26  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+        After https://bugs.webkit.org/show_bug.cgi?id=74132, the region is a render block. We can use RenderBox::constrainContentBoxLogicalHeightByMinMax
+        instead of RenderBox::computeReplacedLogicalHeightRespectingMinMaxHeight to better reflect the fact that the region is not a replaced element.
+        Covered by existing regions tests, since when replaced-based the region had an intrinsic height of 0 and now, block-based, it does not have any children.
</ins><span class="cx"> 
</span><del>-        FEGaussianBlur: unify and const-ify calculateKernelSize
-        https://bugs.webkit.org/show_bug.cgi?id=130779
</del><ins>+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::addForcedRegionBreak):
</ins><span class="cx"> 
</span><del>-        Some methods can benefit of using const refs as also make sense to
-        unify the interface (i.e. parameters) in calculateKernelSize/Unscaled.
</del><ins>+2013-05-21  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        FilterEffect::filter() will now return a reference, which helps since
-        its descendants were accessing methods into the pointer without testing
-        for it.
</del><ins>+        REGRESSION(r150393): editing/inserting/typing-at-end-of-line.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=116516
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        No new tests, no changes on behavior.
</del><ins>+        The bug was caused by DRT not resetting various auto correction states.
+        Do that in Internals::resetToConsistentState.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/FEDisplacementMap.cpp:
-        (WebCore::FEDisplacementMap::platformApplySoftware):
-        * platform/graphics/filters/FEDropShadow.cpp:
-        (WebCore::FEDropShadow::determineAbsolutePaintRect):
-        (WebCore::FEDropShadow::platformApplySoftware):
-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        (WebCore::FEGaussianBlur::calculateUnscaledKernelSize):
-        (WebCore::FEGaussianBlur::calculateKernelSize):
-        (WebCore::FEGaussianBlur::determineAbsolutePaintRect):
-        (WebCore::FEGaussianBlur::platformApplySoftware):
-        * platform/graphics/filters/FEGaussianBlur.h:
-        * platform/graphics/filters/FEMorphology.cpp:
-        (WebCore::FEMorphology::determineAbsolutePaintRect):
-        (WebCore::FEMorphology::platformApplySoftware):
-        * platform/graphics/filters/FEOffset.cpp:
-        (WebCore::FEOffset::determineAbsolutePaintRect):
-        (WebCore::FEOffset::platformApplySoftware):
-        * platform/graphics/filters/FETile.cpp:
-        (WebCore::FETile::platformApplySoftware):
-        * platform/graphics/filters/FETurbulence.cpp:
-        (WebCore::FETurbulence::fillRegion):
-        * platform/graphics/filters/Filter.h:
-        (WebCore::Filter::applyHorizontalScale):
-        (WebCore::Filter::applyVerticalScale):
-        * platform/graphics/filters/FilterEffect.h:
-        (WebCore::FilterEffect::filter):
-        * platform/graphics/filters/SourceAlpha.cpp:
-        (WebCore::SourceAlpha::determineAbsolutePaintRect):
-        (WebCore::SourceAlpha::platformApplySoftware):
-        * platform/graphics/filters/SourceGraphic.cpp:
-        (WebCore::SourceGraphic::determineAbsolutePaintRect):
-        (WebCore::SourceGraphic::platformApplySoftware):
-        * rendering/svg/RenderSVGResourceFilterPrimitive.cpp:
-        (WebCore::RenderSVGResourceFilterPrimitive::determineFilterPrimitiveSubregion):
-        * svg/graphics/filters/SVGFEImage.cpp:
-        (WebCore::FEImage::determineAbsolutePaintRect):
-        (WebCore::FEImage::platformApplySoftware):
</del><ins>+        * testing/Internals.cpp:
+        (WebCore::Internals::resetToConsistentState):
</ins><span class="cx"> 
</span><del>-2014-03-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-05-20  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Make sure childContainmentLayer is parented
-        https://bugs.webkit.org/show_bug.cgi?id=130808
</del><ins>+        [GTK] Fix concatenations of string literals that are not C++11-compliant
+        https://bugs.webkit.org/show_bug.cgi?id=116449
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        m_childContainmentLayer was never parented if the page
-        created no other compositing layers, which left a dangling
-        GraphicsLayer which in turn confused UI-side compositing a little.
-        Fix by always parenting this layer.
</del><ins>+        Fix the problematic concatenations of string literals so they are compilable under the C++11 standard. This
+        is simply a matter of separating the string and the string literal that are being concatenated with a space.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):
</del><ins>+        * platform/graphics/gtk/FullscreenVideoControllerGtk.cpp:
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::sharedResourcesPath):
</ins><span class="cx"> 
</span><del>-2014-03-26  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+2013-05-20  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Replay: disable page cache during capture/replay
-        https://bugs.webkit.org/show_bug.cgi?id=130672
</del><ins>+        [GTK] Support application/x-mimearchive mimetype for MHTML archives instead of message/rfc822
+        https://bugs.webkit.org/show_bug.cgi?id=116442
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Save, set, and restore page cache settings at the correct times.
</del><ins>+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes): Like EFL and Qt, register the application/x-mimearchive mime type as a MHTML archive type
+        and stop propagating the message/rfc822 mime type as such. This also removes a couple of PLATFORM ifdefs.
</ins><span class="cx"> 
</span><del>-        No new tests. If this code fails, then the tests for network replay will fail.
</del><ins>+2013-05-20  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * replay/ReplayController.cpp:
-        (WebCore::ReplayController::setForceDeterministicSettings): Added.
-        (WebCore::ReplayController::startCapturing):
-        (WebCore::ReplayController::stopCapturing):
-        (WebCore::ReplayController::cancelPlayback):
-        (WebCore::ReplayController::replayToPosition):
-        * replay/ReplayController.h:
</del><ins>+        Minor String fixes in CSS
+        https://bugs.webkit.org/show_bug.cgi?id=116291
</ins><span class="cx"> 
</span><del>-2014-03-26  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Convert more of HTMLConverter to C++
-        https://bugs.webkit.org/show_bug.cgi?id=130811
</del><ins>+        Some trival changes to make up for a bad day :)
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        * css/CSSImageSetValue.cpp:
+        (WebCore::CSSImageSetValue::customCssText):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::customCssText):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::cssText):
+        * css/CSSInheritedValue.cpp:
+        (WebCore::CSSInheritedValue::customCssText):
+        * css/CSSInitialValue.cpp:
+        (WebCore::CSSInitialValue::customCssText):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::customCssText):
+        * css/CSSPropertySourceData.cpp:
+        (WebCore::CSSPropertySourceData::toString):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::selectorText):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::generateSelectorText):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::type):
+        * css/CSSTimingFunctionValue.cpp:
+        (WebCore::CSSLinearTimingFunctionValue::customCssText):
+        (WebCore::CSSCubicBezierTimingFunctionValue::customCssText):
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::customCssText):
+        (WebCore::CSSValueList::customSerializeResolvingVariables):
+        * css/MediaQueryExp.cpp:
+        (WebCore::MediaQueryExp::serialize):
+        * css/WebKitCSSFilterValue.cpp:
+        (WebCore::WebKitCSSFilterValue::customCssText):
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::StyleRuleKeyframes::findKeyframeIndex):
+        (WebCore::WebKitCSSKeyframesRule::cssText):
+        * css/WebKitCSSMatFunctionValue.cpp:
+        (WebCore::WebKitCSSMatFunctionValue::customCssText):
+        * css/WebKitCSSMixFunctionValue.cpp:
+        (WebCore::WebKitCSSMixFunctionValue::customCssText):
</ins><span class="cx"> 
</span><del>-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverter::HTMLConverter):
-        (HTMLConverter::~HTMLConverter):
-        (HTMLConverter::_blockLevelElementForNode):
-        (HTMLConverter::_colorForElement):
-        (HTMLConverter::_computedAttributesForElement):
-        (HTMLConverter::_attributesForElement):
-        (HTMLConverter::_fillInBlock):
-        (HTMLConverter::_enterElement):
-        (HTMLConverter::_addTableForElement):
-        (HTMLConverter::_addTableCellForElement):
-        (HTMLConverter::_processElement):
-        (HTMLConverter::_exitElement):
-        (HTMLConverter::_getFloat): Deleted.
-        (HTMLConverter::_elementIsBlockLevel): Deleted.
-        (HTMLConverter::_elementHasOwnBackgroundColor): Deleted.
-        (HTMLConverter::_colorForNode): Deleted.
</del><ins>+2013-05-20  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Null pointer deference in WebCore::AppendNodeCommand::create
+        https://bugs.webkit.org/show_bug.cgi?id=116479
</ins><span class="cx"> 
</span><del>-        Hook up -webkit-overflow-scrolling:touch for iOS WK2
-        https://bugs.webkit.org/show_bug.cgi?id=130809
-
-        Reviewed by Tim Horton.
-
-        Get -webkit-overflow-scrolling: touch working for iOS WK2.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx">         
</span><del>-        * WebCore.exp.in:
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::updateScrollingNode):
-        Send in ScrollingGeometry when we update scrolling nodes.
-        * page/scrolling/AsyncScrollingCoordinator.h:
-        * page/scrolling/ScrollingCoordinator.h:
-        (WebCore::ScrollingCoordinator::updateScrollingNode):
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h:
-        Need to get to the scrolling layer in a subclass.
-        (WebCore::ScrollingTreeScrollingNodeIOS::scrollLayer):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasAcceleratedTouchScrolling): Remove code
-        that temporarily disabled touch-scrolling.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer): When we
-        update scrolling nodes, send in the right scrolling geometry.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/5cb43002a44f67a60ecf5a7ed76de2d0bcf89eb2
</ins><span class="cx"> 
</span><del>-2014-03-26  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+        DeleteSelection::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss() make style and link elements
+        to be the direct children of the editable root. However, these style and link elements are not necessary editable
+        and WebKit crashes when they are not.
</ins><span class="cx"> 
</span><del>-        Modernize the loops in InspectorPageAgent.cpp.
</del><ins>+        Test: editing/deleting/delete-uneditable-style.html
</ins><span class="cx"> 
</span><del>-        Also moves the check for hiddenFromInspector to a lower level.
-        This hides hidden resources from more places.
</del><ins>+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=130803
</del><ins>+2013-05-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        Scrollbars still show sometimes even when WKPageSetSuppressScrollbarAnimations() 
+        is set
+        https://bugs.webkit.org/show_bug.cgi?id=116493
+        -and corresponding-
+        &lt;rdar://problem/13912871&gt;
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorPageAgent.cpp:
-        (WebCore::buildArrayForCookies):
-        (WebCore::cachedResourcesForFrame):
-        (WebCore::allResourcesURLsForFrame):
-        (WebCore::InspectorPageAgent::getCookies):
-        (WebCore::InspectorPageAgent::searchInResources):
-        (WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
-        (WebCore::InspectorPageAgent::loaderDetachedFromFrame):
-        (WebCore::InspectorPageAgent::buildObjectForFrameTree):
-
-2014-03-26  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
-
-        Add platform implementation for RTCOfferAnswerOptions and RTCOfferOptions
-        https://bugs.webkit.org/show_bug.cgi?id=130689
-
-        Reviewed by Eric Carlson.
-
-        RTCOfferAnswerOptions and RTCOfferOptions objects were being passed to platform class, causing a layer
-        violation.
-
-        * Modules/mediastream/RTCOfferAnswerOptions.cpp:
-        (WebCore::RTCOfferAnswerOptions::initialize):
-        (WebCore::RTCOfferOptions::initialize):
-        * Modules/mediastream/RTCOfferAnswerOptions.h:
-        (WebCore::RTCOfferAnswerOptions::requestIdentity):
-        (WebCore::RTCOfferAnswerOptions::privateOfferAnswerOptions):
-        (WebCore::RTCOfferAnswerOptions::RTCOfferAnswerOptions):
-        (WebCore::RTCOfferOptions::offerToReceiveVideo):
-        (WebCore::RTCOfferOptions::offerToReceiveAudio):
-        (WebCore::RTCOfferOptions::voiceActivityDetection):
-        (WebCore::RTCOfferOptions::iceRestart):
-        (WebCore::RTCOfferOptions::privateOfferOptions):
-        (WebCore::RTCOfferOptions::RTCOfferOptions):
-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::createOffer):
-        (WebCore::RTCPeerConnection::createAnswer):
-        * platform/mediastream/RTCOfferAnswerOptionsPrivate.h: Added.
-        * platform/mediastream/RTCPeerConnectionHandler.h:
-        * platform/mock/RTCPeerConnectionHandlerMock.cpp:
-        (WebCore::RTCPeerConnectionHandlerMock::createOffer):
-        (WebCore::RTCPeerConnectionHandlerMock::createAnswer):
-        * platform/mock/RTCPeerConnectionHandlerMock.h:
-
-2014-03-26  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Device scale factor should always be greater than 0.
-        https://bugs.webkit.org/show_bug.cgi?id=130798
-
-        Reviewed by David Kilzer.
-
-        Rendering context requires a device scale factor &gt; 0 so that we can map CSS pixels
-        to device pixels properly. Neither 0 nor a negative device pixel ratio are considered to be valid.
-
-        * page/Page.cpp:
-        (WebCore::Page::setDeviceScaleFactor):
-
-2014-03-26  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-
-        Skipping underlines disregard points completely inside the underline rect
-        https://bugs.webkit.org/show_bug.cgi?id=130800
-
</del><span class="cx">         Reviewed by Dean Jackson.
</span><span class="cx"> 
</span><del>-        When determining bounds for underline skipping, endpoints of glyph contours
-        that lie entirely within the rect of the underline are ignored. This patch
-        makes these points affect the skipping regions the same way that intersections
-        do.
</del><ins>+        We need to be more aggressive with our approach since AppKit may still ask the 
+        scrollbars to paint here.
</ins><span class="cx"> 
</span><del>-        Test: fast/css3-text/css3-text-decoration/text-decoration-skip/glyph-inside-underline.html
</del><ins>+        scrollbarAnimationsAreSuppressed() will allow us to find out if the setting has 
+        been set.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollbarAnimationsAreSuppressed):
+        * page/FrameView.h:
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::scrollbarAnimationsAreSuppressed):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollbarAnimationsAreSuppressed):
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollbarAnimationsAreSuppressed):
+        * rendering/RenderListBox.h:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::updateX): Refactored common code into a function
-        (WebCore::findPathIntersections): Test for endpoints which lie entirely within
-        the underline bounds
</del><ins>+        Don’t allow animations if scrollbars are suppressed.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[WebScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
</ins><span class="cx"> 
</span><del>-2014-03-26  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+        Call cancelAnimations() to prevent a just-started animation from continuing.
+        (WebCore::ScrollAnimatorMac::finishCurrentScrollAnimations):
</ins><span class="cx"> 
</span><del>-        Unreviewed. iOS build fix after r166312. Soft link CMTimeRangeGetEnd.
</del><ins>+2013-05-20  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
</del><ins>+        Avoid caret repaints if we're not showing carets anyway.
+        &lt;http://webkit.org/b/116489&gt;
</ins><span class="cx"> 
</span><del>-2014-03-26  Timothy Hatcher  &lt;timothy@apple.com&gt;
-
-        Propagate the hiddenFromInspector flag on ResourceRequest in
-        places when a new request a made or passed between processes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=130741
-
-        Reviewed by Joseph Pecoraro.
-
-        * WebCore.exp.in: Updated symbols for updateFromDelegatePreservingOldProperties.
-        * platform/network/cf/ResourceRequest.h:
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::ResourceRequest::updateFromDelegatePreservingOldProperties): Added.
-        (WebCore::ResourceRequest::updateFromDelegatePreservingOldHTTPBody): Deleted.
-        * platform/network/curl/ResourceRequest.h:
-        (WebCore::ResourceRequest::updateFromDelegatePreservingOldProperties): Added.
-        (WebCore::ResourceRequest::updateFromDelegatePreservingOldHTTPBody): Deleted.
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::updateFromDelegatePreservingOldProperties): Added.
-        (WebCore::ResourceRequest::updateFromDelegatePreservingOldHTTPBody): Deleted.
-        * platform/network/soup/ResourceRequest.h:
-        (WebCore::ResourceRequest::updateFromDelegatePreservingOldProperties): Added.
-        (WebCore::ResourceRequest::updateFromDelegatePreservingOldHTTPBody): Deleted.
-
-2014-03-26  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
-
-        [CSS Shapes] Remove no-longer-used shape-inside geometry code
-        https://bugs.webkit.org/show_bug.cgi?id=130740
-
-        Reviewed by David Hyatt.
-
-        This patch removes shape-padding support, since it can be used only with shape-inside.
-        Shape-inside support has been removed in r166301.
-
-        No new tests needed, existing tests have been removed by r166301.
-
-        * rendering/shapes/BoxShape.cpp:
-        (WebCore::BoxShape::shapePaddingLogicalBoundingBox): Deleted.
-        (WebCore::BoxShape::shapePaddingBounds): Deleted.
-        (WebCore::BoxShape::getIncludedIntervals): Deleted.
-        (WebCore::BoxShape::firstIncludedIntervalLogicalTop): Deleted.
-        * rendering/shapes/BoxShape.h:
-        * rendering/shapes/PolygonShape.cpp:
-        (WebCore::leftSide): Deleted.
-        (WebCore::isReflexVertex): Deleted.
-        (WebCore::computeShapePaddingBounds): Deleted.
-        (WebCore::PolygonShape::shapePaddingBounds): Deleted.
-        (WebCore::PolygonShape::getIncludedIntervals): Deleted.
-        (WebCore::firstFitRectInPolygon): Deleted.
-        (WebCore::aboveOrToTheLeft): Deleted.
-        (WebCore::PolygonShape::firstIncludedIntervalLogicalTop): Deleted.
-        * rendering/shapes/PolygonShape.h:
-        (WebCore::PolygonShape::PolygonShape):
-        * rendering/shapes/RasterShape.cpp:
-        (WebCore::RasterShapeIntervals::firstIncludedIntervalY): Deleted.
-        (WebCore::RasterShapeIntervals::getIncludedIntervals): Deleted.
-        (WebCore::RasterShape::paddingIntervals): Deleted.
-        (WebCore::RasterShape::getIncludedIntervals): Deleted.
-        (WebCore::RasterShape::firstIncludedIntervalLogicalTop): Deleted.
-        * rendering/shapes/RasterShape.h:
-        * rendering/shapes/RectangleShape.cpp:
-        (WebCore::ellipseYIntercept): Deleted.
-        (WebCore::RectangleShape::shapePaddingBounds): Deleted.
-        (WebCore::RectangleShape::getIncludedIntervals): Deleted.
-        (WebCore::cornerInterceptForWidth): Deleted.
-        (WebCore::RectangleShape::firstIncludedIntervalLogicalTop): Deleted.
-        * rendering/shapes/RectangleShape.h:
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createShape):
-        (WebCore::Shape::createRasterShape):
-        (WebCore::Shape::createBoxShape):
-        * rendering/shapes/Shape.h:
-        (WebCore::Shape::lineOverlapsShapePaddingBounds): Deleted.
-        (WebCore::Shape::shapePadding): Deleted.
-        * rendering/shapes/ShapeInfo.cpp:
-        (WebCore::ShapeInfo&lt;RenderType&gt;::computedShape):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeRequiresLayout):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleRareNonInheritedData.cpp:
-        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
-        (WebCore::StyleRareNonInheritedData::operator==):
-        * rendering/style/StyleRareNonInheritedData.h:
-
-2014-03-26  Jeremy Jones  &lt;jeremyj@apple.com&gt;
-
-        Implement hasLiveStreamingContent property in WebAVPlayerController
-        https://bugs.webkit.org/show_bug.cgi?id=128684
-
</del><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Add export for WebVideoFullscreenInterfaceAVKit::setSeekableRanges().
</del><ins>+        When moving the selection, check if we're inside a contenteditable element (or in caret browsing mode)
+        before repainting the caret's previous location.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterface.h:
-        Add setSeekableRanges()
</del><ins>+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::recomputeCaretRect):
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        Add setSeekableRanges()
</del><ins>+2013-05-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        Remove vestigial playerLayer property. Add seekableTimeRanges property.
</del><ins>+        position:sticky should stick for the enclosing overflow ancestor
+        https://bugs.webkit.org/show_bug.cgi?id=100054
</ins><span class="cx"> 
</span><del>-        (-[WebAVPlayerController dealloc]):
-        Release _seekableTimeRanges.
-        Remove references to _playerLayer.
</del><ins>+        Reviewed by Beth Dakin.
+        
+        Make position: -webkit-sticky be constrained by an enclosing ancestor
+        with non-visible overflow if there is one, rather than being constained
+        always by the viewport.
</ins><span class="cx"> 
</span><del>-        (-[WebAVPlayerController hasLiveStreamingContent]):
-        Implement based on duration. Live stream has an infinite duration.
</del><ins>+        Test: fast/css/sticky/sticky-top-overflow.html
</ins><span class="cx"> 
</span><del>-        (+[WebAVPlayerController keyPathsForValuesAffectingHasLiveStreamingContent]):
-        Describe dependent keys for computed property hasLiveStreamingContent.
</del><ins>+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::computeStickyPositionConstraints): Rename
+        viewportRect to constrainingRect, since it isn't just about the viewport any more.
+        Fix an issue where just adding stickyLocation to absContainerFrame.location() was
+        incorrect when the container is scrolled; we also have to take the scroll offset
+        into account, and that offset is stored in the layer tree.
+        (WebCore::RenderBoxModelObject::stickyPositionOffset):
+        Look for an enclosing layer with overflow clipping, and, if found, use it to
+        compute the sticky constraint rect.
+        * rendering/RenderLayer.h: Add a helpful IncludeSelfOrNot, and fix several member functions
+        to use it place of hard-to-read boolean arguments.
+        Add enclosingOverflowClipLayer(IncludeSelfOrNot).
+        (WebCore::RenderLayer::ancestorCompositingLayer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::enclosingOverflowClipLayer): New function, finds the enclosing
+        layer with overflow clip.
+        (WebCore::RenderLayer::enclosingCompositingLayer): Use IncludeSelfOrNot.
+        (WebCore::RenderLayer::enclosingCompositingLayerForRepaint): Ditto.
+        (WebCore::RenderLayer::enclosingFilterLayer): Ditto.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::repaintInCompositedAncestor): Use IncludeSelfOrNot.
+        (WebCore::isViewportConstrainedFixedOrStickyLayer): Renamed from isRootmostFixedOrStickyLayer
+        and moved up so we can use it in requiresCompositingForPosition().
+        (WebCore::RenderLayerCompositor::requiresCompositingForPosition): Only make sticky composited if
+        it's viewport-constrained.
+        (WebCore::RenderLayerCompositor::updateViewportConstraintStatus):
+        (WebCore::RenderLayerCompositor::computeStickyViewportConstraints): Declare StickyPositionViewportConstraints
+        one line down to just before it gets used.
</ins><span class="cx"> 
</span><del>-        (-[WebAVPlayerController skipBackwardThirtySeconds:]):
-        Seek back 30 seconds if that time is in the seekable ranges.
</del><ins>+2013-05-20  Jeff Rogers  &lt;jrogers@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-        (-[WebAVPlayerController gotoEndOfSeekableRanges:]):
-        Jump to live by going to the of the seekable ranges.
</del><ins>+        Remove DISABLE_ROUNDED_CORNER_CLIPPING
+        https://bugs.webkit.org/show_bug.cgi?id=115531
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::setSeekableRanges):
-        Convert TimeRange to CMTimeRange.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::setMediaElement):
-        Set initial seekable ranges.
</del><ins>+        BlackBerry port is no longer using this.
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::handleEvent):
-        Update seekable ranges when time changes.
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::inContainingBlockChain):
+        (WebCore::RenderLayer::clipToRect):
</ins><span class="cx"> 
</span><del>-2014-03-26  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2013-05-20  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix OS X build.
</del><ins>+        Clients should have a way to extend rendering suppression
+        https://bugs.webkit.org/show_bug.cgi?id=116463
+        &lt;rdar://problem/13738496&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Add missing export symbol.
</del><ins>+        Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-2014-03-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Fix the Windows build. Add a no-op impl for Mac non-UI-side.
-
-        * platform/graphics/ca/mac/PlatformCALayerMac.h:
-        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
-        (PlatformCALayerWin::PlatformCALayerWin):
-        * platform/graphics/ca/win/PlatformCALayerWin.h:
-
-2014-03-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        REGRESSION (r155977): matrix animations no longer animate
-        https://bugs.webkit.org/show_bug.cgi?id=130789
-        &lt;rdar://problem/15650946&gt;
-
-        Reviewed by Dean Jackson.
-        
-        r155977 erroneously removed two lines that set the end points for
-        matrix animations (used when transform lists don't match), so
-        put them back.
-        
-        Also don't repaint when updateContentsScale()
-        is called and doesn't change the contents scale.
-
-        Test: compositing/animation/matrix-animation.html
-
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateRootRelativeScale):
-        (WebCore::GraphicsLayerCA::setTransformAnimationEndpoints):
-        (WebCore::GraphicsLayerCA::updateContentsScale):
-
-2014-03-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Add a custom behavior flag to GraphicsLayer, piped down to PlatformCALayer, for scrolling layers
-        https://bugs.webkit.org/show_bug.cgi?id=130778
-
-        Reviewed by Tim Horton.
-
-        Make it possible to put a &quot;custom behavior&quot; flag on a layer so that,
-        with UI-side compositing, we know to create a specific type of
-        layer or view for that GraphicsLayer.
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::GraphicsLayer):
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::setCustomBehavior):
-        (WebCore::GraphicsLayer::customBehavior):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
-        (WebCore::GraphicsLayerCA::updateCustomBehavior):
-        (WebCore::GraphicsLayerCA::setCustomBehavior):
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * platform/graphics/ca/PlatformCALayer.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (PlatformCALayerMac::PlatformCALayerMac):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateScrollingLayers):
</del><ins>+        Export FrameView::setVisualUpdatesAllowedByClient.
</ins><span class="cx"> 
</span><del>-2014-03-26  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::setVisualUpdatesAllowed):
+        Move rendering-suppression watchdog into setVisualUpdatesAllowed(bool).
+        setVisualUpdatesAllowed(ReadyState) should not re-enable visual updates
+        if the client is itself disabling visual updates.
</ins><span class="cx"> 
</span><del>-        Unreviewed test correction.
</del><ins>+        (WebCore::Document::visualUpdatesSuppressionTimerFired):
+        If the watchdog fires and the client is still disabling visual
+        updates, we should not re-enable visual updates, but instead
+        wait for the client.
</ins><span class="cx"> 
</span><del>-        Because of the way DRT on Windows links to WebCore, having the implementaion of the update
-        method in the header caused a runtime failure due to duplicate symbols being bound to the
-        compilation unit.
</del><ins>+        (WebCore::Document::setVisualUpdatesAllowedByClient):
+        Actually re-enable visual updates if we deferred the re-enabling above
+        (when the page finishes loading, but the client had them disabled).
</ins><span class="cx"> 
</span><del>-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::setEnhancedUserInterfaceAccessibility): Moved from header.
-        * accessibility/AXObjectCache.h:
-        (WebCore::AXObjectCache::setEnhancedUserInterfaceAccessibility): Deleted.
</del><ins>+        * dom/Document.h:
+        (Document): Add setVisualUpdatesAllowedByClient.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Visual updates are allowed by default.
+        (WebCore::FrameView::setVisualUpdatesAllowedByClient):
+        Forward through to the document, but we also need to persist the state
+        here in FrameView so that it survives through navigation.
</ins><span class="cx"> 
</span><del>-2014-03-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        * page/FrameView.h:
+        (WebCore::FrameView::setVisualUpdatesAllowedByClient): Added.
+        (WebCore::FrameView::visualUpdatesAllowedByClient): Added.
+        Added storage for m_visualUpdatesAllowedByClient.
</ins><span class="cx"> 
</span><del>-        REGRESSION(r162679): Poster image visible under the video
-        https://bugs.webkit.org/show_bug.cgi?id=130783
</del><ins>+2013-05-20  Hans Muller  &lt;hmuller@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        [CSS Exclusions] Add CSS parsing support for image URI shape-inside and shape-outside values
+        https://bugs.webkit.org/show_bug.cgi?id=116349
</ins><span class="cx"> 
</span><del>-        In the listed revision, we started checking for isRenderImage()
-        instead of isImage(). RenderMedias return 'true' for the first
-        but 'false' for the second. Change the if() statement to check
-        for isRenderMedia() in addition to !isRenderImage().
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
</del><ins>+        Add support for parsing image URI values for the shape-inside and shape-outside CSS properties.
+        Extended the ExclusionShapeValue class to support tracking the property's StyleImage value.
</ins><span class="cx"> 
</span><del>-2014-03-26  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        The ExclusionShapeValue::type enums were changed from all upper case to &quot;Intercase&quot; by order
+        of the style bot.
</ins><span class="cx"> 
</span><del>-        Render tree construction is O(N^2) in number of siblings
-        https://bugs.webkit.org/show_bug.cgi?id=129065
</del><ins>+        The existing CSS parsing tests were extended to check URI values.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
-        
-        When adding a new renderer to the tree we would search for the correct render tree
-        position by traversing DOM children forward to find something that already has a renderer.
-        In common case there is no such renderer. This would be repeated for each inserted renderer
-        leading to O(n^2) in respect to child node count.
-        
-        This patch caches the computed render tree insertion position and passes it to siblings.
-        Until the cached position is reached it can be used for all new renderers.
-
-        Test: perf/sibling-renderer-On2.html
-
-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::RenderTreePosition::parent):
-        (WebCore::Style::RenderTreePosition::RenderTreePosition):
-        (WebCore::Style::RenderTreePosition::canInsert):
-        (WebCore::Style::RenderTreePosition::insert):
-        (WebCore::Style::RenderTreePosition::computeNextSibling):
-        (WebCore::Style::RenderTreePosition::invalidateNextSibling):
-        (WebCore::Style::styleForElement):
-        (WebCore::Style::elementInsideRegionNeedsRenderer):
-        (WebCore::Style::createRendererIfNeeded):
-        (WebCore::Style::createTextRendererIfNeeded):
-        (WebCore::Style::attachTextRenderer):
-        (WebCore::Style::updateTextRendererAfterContentChange):
-        (WebCore::Style::attachChildren):
-        (WebCore::Style::attachDistributedChildren):
-        (WebCore::Style::attachShadowRoot):
-        (WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded):
-        (WebCore::Style::attachRenderTree):
-        (WebCore::Style::resolveLocal):
-        (WebCore::Style::resolveTextNode):
-        (WebCore::Style::resolveShadowTree):
-        (WebCore::Style::updateBeforeOrAfterPseudoElement):
-        (WebCore::Style::resolveTree):
-
-2014-03-26  Commit Queue  &lt;commit-queue@webkit.org&gt;
-
-        Unreviewed, rolling out r166264.
-        https://bugs.webkit.org/show_bug.cgi?id=130785
-
-        Broke some window.opener tests for WK2 Mavericks (Requested by
-        brrian__ on #webkit).
-
-        Reverted changeset:
-
-        &quot;Web Replay: resource unique identifiers should be unique-per-
-        frame, not globally&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130632
-        http://trac.webkit.org/changeset/166264
-
-2014-03-26  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
-
-        [CSS Shapes] Remove shape-inside support
-        https://bugs.webkit.org/show_bug.cgi?id=130698
-
-        Reviewed by David Hyatt.
-
-        CSS Shapes Level 1 (CR) only contains shape-outside. We are focusing our efforts on finalizing
-        the implementation of shape-outside, it's worth to remove shape-inside code at this point for now.
-
-        A list of reasons for the removal:
-          - Shape-inside is only part of Shapes Level 2, which needs to be improved on some topics.
-          - Shape-inside is lack of new shapes support (e.g. inset).
-          - Deprecated shapes (r165472) are removed from the code (e.g. rectangle), which affects shape-inside. 
-          - The current shape-inside code spreads across the layout code.
-          - The current shape-inside implementation is experimental in some areas,
-            and the partially implemented code can have security implications.
-          - Removal of shape-inside opens possibilities for code complexity and performance
-            optimizations for shape-outside. (e.g. simpler geometry code)
-
-        No new tests are needed.
-
-        * CMakeLists.txt:
-        * Configurations/FeatureDefines.xcconfig:
-        * GNUmakefile.list.am:
-        * WebCore.xcodeproj/project.pbxproj:
</del><span class="cx">         * css/CSSComputedStyleDeclaration.cpp:
</span><del>-        (WebCore::ComputedStyleExtractor::propertyValue):
</del><ins>+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
</ins><span class="cx">         * css/CSSParser.cpp:
</span><del>-        (WebCore::isSimpleLengthPropertyID):
</del><span class="cx">         (WebCore::CSSParser::parseValue):
</span><del>-        (WebCore::CSSParser::parseShapeProperty):
-        * css/CSSPropertyNames.in:
</del><span class="cx">         * css/DeprecatedStyleBuilder.cpp:
</span><del>-        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
</del><ins>+        (WebCore::ApplyPropertyExclusionShape::applyValue):
</ins><span class="cx">         * css/StyleResolver.cpp:
</span><del>-        (WebCore::StyleResolver::applyProperty):
</del><span class="cx">         (WebCore::StyleResolver::loadPendingImages):
</span><del>-        * page/animation/CSSPropertyAnimation.cpp:
-        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
-        * rendering/LayoutState.cpp:
-        (WebCore::LayoutState::LayoutState):
-        * rendering/LayoutState.h:
-        (WebCore::LayoutState::LayoutState):
-        (WebCore::LayoutState::shapeInsideInfo): Deleted.
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::styleDidChange):
-        (WebCore::RenderBlock::imageChanged):
-        (WebCore::RenderBlock::preparePaginationBeforeBlockLayout):
-        (WebCore::RenderBlock::relayoutShapeDescendantIfMoved): Deleted.
-        (WebCore::RenderBlock::logicalOffsetFromShapeAncestorContainer): Deleted.
-        (WebCore::RenderBlock::updateShapeInsideInfoAfterStyleChange): Deleted.
-        (WebCore::RenderBlock::ensureShapeInsideInfo): Deleted.
-        (WebCore::RenderBlock::shapeInsideInfo): Deleted.
-        (WebCore::RenderBlock::setShapeInsideInfo): Deleted.
-        (WebCore::RenderBlock::markShapeInsideDescendantsForLayout): Deleted.
-        (WebCore::RenderBlock::layoutShapeInsideInfo): Deleted.
-        (WebCore::shapeInfoRequiresRelayout): Deleted.
-        (WebCore::RenderBlock::computeShapeSize): Deleted.
-        (WebCore::RenderBlock::updateShapesBeforeBlockLayout): Deleted.
-        (WebCore::RenderBlock::updateShapesAfterBlockLayout): Deleted.
-        (WebCore::RenderBlock::prepareShapesAndPaginationBeforeBlockLayout): Deleted.
-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::allowsShapeInsideInfoSharing): Deleted.
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::layoutBlock):
-        (WebCore::RenderBlockFlow::layoutBlockChild):
-        (WebCore::RenderBlockFlow::computeLogicalLocationForFloat):
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForLine):
-        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
-        (WebCore::constructBidiRunsForLine): Deleted.
-        (WebCore::pushShapeContentOverflowBelowTheContentBox): Deleted.
-        (WebCore::RenderBlockFlow::updateShapeAndSegmentsForCurrentLine): Deleted.
-        (WebCore::RenderBlockFlow::updateShapeAndSegmentsForCurrentLineInFlowThread): Deleted.
-        (WebCore::adjustLogicalLineTop): Deleted.
-        (WebCore::RenderBlockFlow::adjustLogicalLineTopAndLogicalHeightIfNeeded): Deleted.
-        * rendering/RenderDeprecatedFlexibleBox.cpp:
-        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::~RenderElement):
-        (WebCore::RenderElement::initializeStyle):
-        (WebCore::RenderElement::setStyle):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::layoutBlock):
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::createStyle):
-        * rendering/RenderView.h:
-        * rendering/SimpleLineLayout.cpp:
-        (WebCore::SimpleLineLayout::canUseFor):
-        * rendering/line/BreakingContextInlineHeaders.h:
-        (WebCore::BreakingContext::handleText):
-        (WebCore::BreakingContext::handleEndOfLine):
-        (WebCore::updateSegmentsForShapes): Deleted.
-        * rendering/line/LineBreaker.cpp:
-        (WebCore::LineBreaker::nextLineBreak):
-        * rendering/line/LineWidth.cpp:
-        (WebCore::LineWidth::LineWidth):
-        (WebCore::LineWidth::updateAvailableWidth):
-        (WebCore::LineWidth::wrapNextToShapeOutside):
-        (WebCore::LineWidth::fitBelowFloats):
-        (WebCore::LineWidth::updateLineSegment): Deleted.
-        (WebCore::LineWidth::updateCurrentShapeSegment): Deleted.
-        * rendering/line/LineWidth.h:
-        * rendering/shapes/ShapeInsideInfo.cpp: Removed.
-        * rendering/shapes/ShapeInsideInfo.h: Removed.
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeRequiresLayout):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleRareNonInheritedData.cpp:
-        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
-        (WebCore::StyleRareNonInheritedData::operator==):
-        * rendering/style/StyleRareNonInheritedData.h:
</del><ins>+        * rendering/style/ExclusionShapeValue.h:
+        (WebCore::ExclusionShapeValue::createImageValue):
+        (ExclusionShapeValue):
+        (WebCore::ExclusionShapeValue::image):
+        (WebCore::ExclusionShapeValue::setImage):
+        (WebCore::ExclusionShapeValue::ExclusionShapeValue):
</ins><span class="cx"> 
</span><del>-2014-03-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2013-05-20  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Avoid duplicate size checks when creating empty image
-        https://bugs.webkit.org/show_bug.cgi?id=130730
</del><ins>+        [CSSRegions] Fix offsetLeft / offsetTop for elements inside named flow
+        https://bugs.webkit.org/show_bug.cgi?id=115899
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by ch.dumez@samsung.com):
-        https://chromium.googlesource.com/chromium/blink/+/4861a71bc1f284fc97417f405ab7d08dc6947b88
-        http://crbug.com/190633011
</del><ins>+        Elements in named flows that have the body as their offsetParent, need to compute their
+        offsetLeft and offsetTop values relative to the body.
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::createEmptyImageData): Don't perform overflow calculation twice.
</del><ins>+        Tests: fast/regions/offsetLeft-offsetTop-in-multiple-regions.html
+               fast/regions/offsetLeft-offsetTop-in-region-absolute-sticky-fixed.html
+               fast/regions/offsetLeft-offsetTop-in-region-float-vert-rl.html
+               fast/regions/offsetLeft-offsetTop-in-region-float.html
+               fast/regions/offsetLeft-offsetTop-inlines-region-in-element.html
</ins><span class="cx"> 
</span><del>-2014-03-26  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore):
+        (WebCore::RenderFlowThread::adjustedPositionRelativeToOffsetParent):
+        * rendering/RenderFlowThread.h:
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] getComputedStyle() must return the specified value for positioning properties
-        https://bugs.webkit.org/show_bug.cgi?id=130010
</del><ins>+2013-05-20  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        [CSS Regions][CSS Exclusions] shape-inside on regions should respect positioned shapes and overflow
+        https://bugs.webkit.org/show_bug.cgi?id=116252
</ins><span class="cx"> 
</span><del>-        According to the specs
-        http://dev.w3.org/csswg/css-grid/#property-index and also to
-        http://lists.w3.org/Archives/Public/www-style/2014Mar/0162.html
-        the function getComputedStyle() must return the specified values
-        for positioning properties, i.e, grid-{columns|rows}-{start|end}.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        We were in some cases, adjusting the style in the StyleResolver
-        (for example with two opposing spans) something that is now done
-        in the RenderGrid because we cannot alter the original style.
</del><ins>+        Regions should respect shape-inside properties which have specified top offset. Since the content which overflows from the
+        shape should be pushed after the content box (for details check out r148975), I implemented  overflowthe behavior for simple
+        cases when you have only one region. I'm going to implement it for additional regions in a follow up patch.
</ins><span class="cx"> 
</span><del>-        The code moved to the renderer became more self explanatory and it
-        now supports named grid areas with names ending in &quot;-start&quot; and
-        &quot;-end&quot;.
</del><ins>+        Tests: fast/regions/shape-inside/shape-inside-on-regions-block-content-basic-overflow-shape-top-offset.html
+               fast/regions/shape-inside/shape-inside-on-regions-inline-content-basic-overflow-shape-top-offset.html
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/named-grid-lines-with-named-grid-areas-get-set.html
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::updateLineBoundariesForExclusions): Handle the flow thread case, push the overflowing content after the
+        content box. Respect existing shape-inside on region tests.
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange): Set the correct logical top position for the shape-inside in
+        the case of regions. Respect the region's margins and paddings.
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::adjustRenderStyle):
-        (WebCore::gridLineDefinedBeforeGridArea): Deleted.
-        (WebCore::StyleResolver::adjustNamedGridItemPosition): Deleted.
-        (WebCore::StyleResolver::adjustGridItemPosition): Deleted.
-        * css/StyleResolver.h:
-        * rendering/RenderGrid.cpp:
-        (WebCore::isColumnSide):
-        (WebCore::RenderGrid::explicitGridSizeForSide):
-        (WebCore::gridLineDefinedBeforeGridArea):
-        (WebCore::setNamedLinePositionIfDefinedBeforeArea):
-        (WebCore::RenderGrid::adjustNamedGridItemPosition):
-        (WebCore::RenderGrid::adjustGridPositionsFromStyle):
-        (WebCore::RenderGrid::resolveGridPositionsFromStyle):
-        (WebCore::RenderGrid::resolveNamedGridLinePositionFromStyle):
-        (WebCore::RenderGrid::resolveNamedGridLinePositionAgainstOppositePosition):
-        * rendering/RenderGrid.h:
-        * rendering/style/GridPosition.h:
-        (WebCore::GridPosition::setAutoPosition): New helper function.
</del><ins>+2013-05-20  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Remove custom binding for the Clipboard clearData function
+        https://bugs.webkit.org/show_bug.cgi?id=116421
</ins><span class="cx"> 
</span><del>-        Fix the iOS build.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        * bindings/js/JSClipboardCustom.cpp: Removed the clearData binding.
</ins><span class="cx"> 
</span><del>-2014-03-26  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        * dom/Clipboard.idl: Removed [Custom].
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Flush all surfaces after painting into all of them, instead of after painting into each one
-        https://bugs.webkit.org/show_bug.cgi?id=130768
-        &lt;rdar://problem/16421471&gt;
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::clearData): Renamed from clearAllData.
+        * dom/Clipboard.h: Rename clearAllData to clearData so we just use
+        overloading for the one with and without a MIME type.
+        * platform/ios/ClipboardIOS.h: Rename clearAllData to clearData.
+        * platform/ios/ClipboardIOS.mm:
+        (WebCore::ClipboardIOS::clearData): Ditto.
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::clearData). Ditto.
+        * platform/qt/ClipboardQt.h: Ditto.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::clearData): Ditto.
+        * platform/win/ClipboardWin.h: Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-20  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/cocoa/IOSurface.h:
-        Add a non-ensuring platformContext() getter.
</del><ins>+        [iOS] media/event-queue-crash.html ASSERTs in notifyChildInserted
+        https://bugs.webkit.org/show_bug.cgi?id=116444
</ins><span class="cx"> 
</span><del>-2014-03-26  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-        Web Inspector: AXI: crash when inspecting &quot;bar&quot; text node in getAccessibilityPropertiesForNode layout test
-        https://bugs.webkit.org/show_bug.cgi?id=130290
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
-
-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
-
-        Fixing regression from r165590. http://webkit.org/b/129779
-        Verify isElementNode to avoid calling toElement on document or text nodes.
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-
-2014-03-25  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
-
-        Replace DEPRECATED_DEFINE_STATIC_LOCAL by static NeverDestroyed&lt;T&gt; in editing/
-        https://bugs.webkit.org/show_bug.cgi?id=130722
-
-        Reviewed by Antti Koivisto.
-
-        * editing/AlternativeTextController.cpp:
-        (WebCore::markerTypesForAutocorrection):
-        (WebCore::markerTypesForReplacement):
-        (WebCore::markerTypesForAppliedDictationAlternative):
-        * editing/EditingStyle.cpp:
-        (WebCore::htmlElementEquivalents):
-        (WebCore::htmlAttributeEquivalents):
-        * editing/FormatBlockCommand.cpp:
-        (WebCore::isElementForFormatBlock):
-        * editing/RemoveFormatCommand.cpp:
-        (WebCore::isElementForRemoveFormatCommand):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::isProhibitedParagraphChild):
-        * editing/atk/FrameSelectionAtk.cpp:
-        (WebCore::maybeEmitTextFocusChange):
-
-2014-03-25  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Add a new type of scrolling tree node for overflow scrolling
-        https://bugs.webkit.org/show_bug.cgi?id=130763
-
-        Reviewed by Tim Horton.
-
-        Prepare for overflow scrolling via the scrolling tree by adding
-        a new scrolling node type for overflow:scroll nodes. Mostly
-        this is a new ScrollingNodeType that gets mapped to the same
-        scrolling state nodes and scrolling nodes, but iOS creates
-        state and scrolling nodes specific to overflow:scroll.
-        
-        Change the type checking on nodes to use virtual functions instead
-        of just checking the node type, to allow the macros to work with
-        the new scrolling node type.
-
-        * WebCore.exp.in:
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::ensureRootStateNodeForFrameView):
-        * page/scrolling/ScrollingCoordinator.h:
-        * page/scrolling/ScrollingStateFixedNode.h:
-        * page/scrolling/ScrollingStateNode.h:
-        (WebCore::ScrollingStateNode::isFixedNode):
-        (WebCore::ScrollingStateNode::isStickyNode):
-        (WebCore::ScrollingStateNode::isScrollingNode):
-        * page/scrolling/ScrollingStateScrollingNode.cpp:
-        (WebCore::ScrollingStateScrollingNode::create):
-        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
-        * page/scrolling/ScrollingStateScrollingNode.h:
-        * page/scrolling/ScrollingStateStickyNode.h:
-        * page/scrolling/ScrollingStateTree.cpp:
-        (WebCore::ScrollingStateTree::attachNode):
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::viewportChangedViaDelegatedScrolling):
-        (WebCore::ScrollingTree::updateTreeFromStateNode):
-        * page/scrolling/ScrollingTreeNode.h:
-        (WebCore::ScrollingTreeNode::isFixedNode):
-        (WebCore::ScrollingTreeNode::isStickyNode):
-        (WebCore::ScrollingTreeNode::isScrollingNode):
-        * page/scrolling/ScrollingTreeScrollingNode.cpp:
-        (WebCore::ScrollingTreeScrollingNode::ScrollingTreeScrollingNode):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingCoordinatorIOS.mm:
-        (WebCore::ScrollingCoordinatorIOS::createScrollingTreeNode):
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h:
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::create):
-        (WebCore::ScrollingTreeScrollingNodeIOS::ScrollingTreeScrollingNodeIOS):
-        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
-        (WebCore::ScrollingCoordinatorMac::createScrollingTreeNode):
-        * page/scrolling/mac/ScrollingTreeFixedNode.h:
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::create):
-        (WebCore::ScrollingTreeScrollingNodeMac::ScrollingTreeScrollingNodeMac):
-        * page/scrolling/mac/ScrollingTreeStickyNode.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
-
-2014-03-26  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
-
-        [ATK] Utilize new AtkValue interface coming in ATK 2.11.92
-        https://bugs.webkit.org/show_bug.cgi?id=130575
-
-        Reviewed by Mario Sanchez Prada.
-
-        ATK 2.11.92 introduces some new API and deprecates an old one.
-        Adjust current implementation to meet requirements of the new API.
-
-        No new tests. Covered by existing ones.
-
-        * accessibility/atk/AXObjectCacheAtk.cpp:
-        (WebCore::AXObjectCache::postPlatformNotification):
-        * accessibility/atk/WebKitAccessibleInterfaceValue.cpp:
-        (webkitAccessibleSetNewValue):
-        (webkitAccessibleGetIncrementValue):
-        (webkitAccessibleGetValueAndText):
-        (webkitAccessibleGetIncrement):
-        (webkitAccessibleSetValue):
-        (webkitAccessibleGetRange):
-        (webkitAccessibleValueSetCurrentValue):
-        (webkitAccessibleValueGetMinimumIncrement):
-        (webkitAccessibleValueInterfaceInit):
-
-2014-03-26  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Unreviewed. Removing the remaining Automake cruft.
-
-        * GNUmakefile.list.am: Removed.
-
-2014-03-25  Pratik Solanki  &lt;psolanki@apple.com&gt;
-
-        iOS build fix. Add missing semicolon.
-
-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverter::_addAttachmentForElement):
-
-2014-03-25  Sam Weinig  &lt;sam@webkit.org&gt;
-
-        Speculative iOS build fix.
-
-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverter::_addAttachmentForElement):
-
-2014-03-25  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [MSE] Duplicate 'seeked' events.
-        https://bugs.webkit.org/show_bug.cgi?id=130754
-
-        Reviewed by Eric Carlson.
-
-        Test: media/media-source/media-source-duplicate-seeked.html
-
-        During certain seek operations, HTMLMediaElement::finishSeek() can be called re-entrantly due to
-        the ready state changing as a result of MediaSource::monitorSourceBuffers(). Move this call to the
-        end of finishSeek() after m_seeking has been cleared.
-
</del><span class="cx">         * html/HTMLMediaElement.cpp:
</span><del>-        (WebCore::HTMLMediaElement::parseAttribute):
</del><ins>+        (WebCore::HTMLMediaElement::configureMediaControls): Only create media controls when the
+            element is in a Document.
</ins><span class="cx"> 
</span><del>-2014-03-25  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+2013-05-20  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: AXI: add support for aria-activedescendant and reconcile UI/testing with parentNode
-        https://bugs.webkit.org/show_bug.cgi?id=130712
</del><ins>+        [Mac] captions menu should behave more like a menu
+        https://bugs.webkit.org/show_bug.cgi?id=116436
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
-
-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
-
-        Support for @aria-activedescendant; code reuse changes w/ parentNode and activeDescendantNode.
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/protocol/DOM.json:
-
-2014-03-25  Sanghyup Lee  &lt;sh53.lee@samsung.com&gt;
-
-        When the mouse is upped after dragged out of shadowDOM, it should lose :active.
-        https://bugs.webkit.org/show_bug.cgi?id=130660
-
-        Reviewed by Darin Adler.
-
-        This caused a regression after r165037.
-        When we have to clear :active style of shadow DOM, we should clear host's style.
-        This patch replaces parentElement() by parentOrShadowHostElement().
-
-        * dom/Document.cpp:
-        (WebCore::Document::updateHoverActiveState):
-
-2014-03-25  Eric Carlson  &lt;eric.carlson@apple.com&gt;
-
-        [Mac] Always retry a failed MediaDocument as a PluginDocument
-        https://bugs.webkit.org/show_bug.cgi?id=130742
-
-        Reviewed by Jer Noble.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::mediaLoadingFailedFatally): If the element is in a media document,
-            tell it that loading failed so it can retry as a plug-in.
-
-2014-03-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-
-        Replace HTMLConverter::_stringForNode by propertyValueForNode
-        https://bugs.webkit.org/show_bug.cgi?id=130711
-
-        Reviewed by Sam Weinig.
-
-        Replaced all calls to HTMLConverter::_stringForNode by that to propertyValueForNode.
-
-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverter::_computedAttributesForElement):
-        (HTMLConverter::_addAttachmentForElement):
-        (HTMLConverter::_enterElement):
-        (HTMLConverter::_addTableForElement):
-        (HTMLConverter::_addTableCellForElement):
-        (HTMLConverter::_processElement):
-        (HTMLConverter::_exitElement):
-        (HTMLConverter::_processText):
-        (HTMLConverter::_traverseNode):
-        (HTMLConverter::_traverseFooterNode):
-        (HTMLConverter::_stringForNode): Deleted.
-
-2014-03-25  Pratik Solanki  &lt;psolanki@apple.com&gt;
-
-        Attempt to fix iOS build after r166261.
-
-        * WebCore.xcodeproj/project.pbxproj: Make SystemSleepListener.h a private header.
-
-2014-03-21  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [iOS] Enable caption support in full screen.
-        https://bugs.webkit.org/show_bug.cgi?id=130603
-
</del><span class="cx">         Reviewed by Eric Carlson.
</span><span class="cx"> 
</span><del>-        Add TextTrackRepresentation support to MediaPlayerPrivateAVFoundationObjC.
</del><ins>+        Let the captions menu behave more like a native Mac menu by hiding it when
+        clicking anywhere on the page and preventing the page from scrolling when
+        attempting to scroll the captions menu when it cannot scroll in the requested
+        direction.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer): Add the m_textTrackRepresenationLayer if present.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::requiresTextTrackRepresentation): True, if a m_videoFullscreenLayer is present.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setTextTrackRepresentation): Remove the old, and add the new m_textTrackRepresenationLayer.
</del><ins>+        Test: media/video-controls-captions-trackmenu-hide-on-click-outside.html
</ins><span class="cx"> 
</span><del>-        Make the text track container a stacking context for painting purposes.
-        * Modules/mediacontrols/mediaControlsiOS.css:
-        (video::-webkit-media-text-track-container):
</del><ins>+        * dom/EventListener.h:
+        Add the new MediaControlsAppleEventListenerType.
</ins><span class="cx"> 
</span><del>-2014-03-25  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        * html/shadow/MediaControlsApple.cpp:
+        (WebCore::MediaControlsApple::defaultEventHandler):
+        (WebCore::MediaControlsApple::hide):
+        (WebCore::MediaControlsApple::makeTransparent):
+        (WebCore::MediaControlsApple::changedClosedCaptionsVisibility):
+        (WebCore::MediaControlsApple::reportedError):
+        (WebCore::MediaControlsApple::toggleClosedCaptionTrackList):
+        Use the hideClosedCaptionTrackList() and showClosedCaptionTrackList()
+        methods to hide and show the captions menu instead of calling hide()
+        and show() directly on m_closedCaptionsContainer.
</ins><span class="cx"> 
</span><del>-        Web Replay: resource unique identifiers should be unique-per-frame, not globally
-        https://bugs.webkit.org/show_bug.cgi?id=130632
</del><ins>+        (WebCore::MediaControlsApple::showClosedCaptionTrackList):
+        Show the m_closedCaptionsContainer and register a &quot;mousewheel&quot; event
+        listener on it as well as a &quot;click&quot; event listener on the entire document.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        (WebCore::MediaControlsApple::hideClosedCaptionTrackList):
+        Hide the m_closedCaptionsContainer and remove the &quot;mousewheel&quot; event
+        listener on it as well as the &quot;click&quot; event listener on the entire document.
</ins><span class="cx"> 
</span><del>-        For replay purposes, we want to deterministically assign resource load identifiers
-        to resource loaders, provided that the resource loaders are created in the same
-        order.
</del><ins>+        (WebCore::MediaControlsApple::shouldClosedCaptionsContainerPreventPageScrolling):
+        New private utility to determine whether the m_closedCaptionsContainer can scroll
+        in the provided scroll direction.
</ins><span class="cx"> 
</span><del>-        To do this, we convert unique identifiers from being globally-unique to being
-        frame-unique. When a new frame is being loaded, unique identifiers for
-        subresources of that frame begin counting from 1.
</del><ins>+        (WebCore::MediaControlsApple::eventListener):
+        Obtain the event listener used for &quot;mousewheel&quot; and &quot;click&quot; event handlers.
</ins><span class="cx"> 
</span><del>-        No new tests. Identifier invariants are exercised by existing assertions and tests.
</del><ins>+        (WebCore::MediaControlsAppleEventListener::handleEvent):
+        Event handler for the &quot;mousewheel&quot; and &quot;click&quot; events. If we get a &quot;click&quot; event, we
+        toggle the captions menu visibility and if we get a &quot;mousewheel&quot; event, we call into
+        shouldClosedCaptionsContainerPreventPageScrolling() to see if we can scroll in the
+        current scroll direction, and if not prevent the event from resulting in a scroll by
+        calling preventDefault().
</ins><span class="cx"> 
</span><del>-        * loader/ProgressTracker.cpp:
-        (WebCore::ProgressTracker::ProgressTracker):
-        (WebCore::ProgressTracker::reset):
-        (WebCore::ProgressTracker::createUniqueIdentifier):
-        * loader/ProgressTracker.h:
</del><ins>+        (WebCore::MediaControlsAppleEventListener::operator==):
+        Required for the successful subclassing of EventListener.
</ins><span class="cx"> 
</span><del>-2014-03-25  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        * html/shadow/MediaControlsApple.h:
+        (MediaControlsAppleEventListener):
+        (WebCore::MediaControlsAppleEventListener::create):
+        (WebCore::MediaControlsAppleEventListener::cast):
+        (WebCore::MediaControlsAppleEventListener::MediaControlsAppleEventListener):
+        New subclass of EventListener required to provide a custom event listener for the
+        &quot;mousewheel&quot; and &quot;click&quot; events registered in showClosedCaptionTrackList() and
+        hideClosedCaptionTrackList().
</ins><span class="cx"> 
</span><del>-        [Mac] Pause the media element during system sleep.
-        https://bugs.webkit.org/show_bug.cgi?id=130718
</del><ins>+2013-05-18  Rashmi Shyamasundar  &lt;rashmi.s2@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        [Cairo] Canvas-shadow behavior is not being as expected
+        https://bugs.webkit.org/show_bug.cgi?id=108897
</ins><span class="cx"> 
</span><del>-        Test: media/video-system-sleep.html
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Relying on the platform media system to pause and restart playback during
-        system sleep can cause problems on some platforms, especially where hardware
-        decoders are concerned. Rather than implicitly pausing the media during
-        system sleep, explicitly pause the media before sleeping and resume (if
-        appropriate) upon waking.
</del><ins>+        ShadowBlur::endShadowLayer copies the image from shadowContext to cairoContext.
+        CairoContext-path should be empty for doing this copy. Otherwise, the 
+        original-image area will also get filled with the shadow.
</ins><span class="cx"> 
</span><del>-        Add a new class to be used for system sleep notifications:
-        * platform/SystemSleepListener.cpp: Added.
-        (WebCore::SystemSleepListener::create):
-        (WebCore::SystemSleepListener::SystemSleepListener):
-        * platform/SystemSleepListener.h: Added.
-        (WebCore::SystemSleepListener::Client::~Client):
-        (WebCore::SystemSleepListener::~SystemSleepListener):
-        (WebCore::SystemSleepListener::client):
</del><ins>+        Test: fast/canvas/canvas-image-shadow.html
</ins><span class="cx"> 
</span><del>-        Add a Mac-specific implementation:
-        * platform/mac/SystemSleepListenerMac.h: Added.
-        * platform/mac/SystemSleepListenerMac.mm: Added.
-        (WebCore::SystemSleepListener::create):
-        (WebCore::SystemSleepListenerMac::SystemSleepListenerMac):
-        (WebCore::SystemSleepListenerMac::~SystemSleepListenerMac):
</del><ins>+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::drawPathShadow):
</ins><span class="cx"> 
</span><del>-        Listen for system sleep notifications in MediaSessionManager:
-        * platform/audio/MediaSessionManager.cpp:
-        (WebCore::MediaSessionManager::MediaSessionManager):
-        (WebCore::MediaSessionManager::systemWillSleep):
-        (WebCore::MediaSessionManager::systemDidWake):
-        * platform/audio/MediaSessionManager.h:
</del><ins>+2013-05-20  Lamarque V. Souza  &lt;Lamarque.Souza@basyskom.com&gt;
</ins><span class="cx"> 
</span><del>-        Drive-by fix; notify the MediaSession that playback will begin
-        due to autoplay, but do not begin autoplaying if the session
-        is already interrupted:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
</del><ins>+        -webkit-text-underline-position should not be inherited
+        https://bugs.webkit.org/show_bug.cgi?id=116363
</ins><span class="cx"> 
</span><del>-        Add new files to project:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-03-25  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Specification says text-underline-position should not be inherited.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] The background of children of scrollable elements flowed into regions is not properly scrolled
-        https://bugs.webkit.org/show_bug.cgi?id=130574
</del><ins>+        No new tests, this updates existing tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty): Make
+        CSSPropertyWebkitTextUnderlinePosition return false.
+        * rendering/style/RenderStyle.h: Treat TextUnderlinePosition as
+        non-inherited.
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==): Remove m_textUnderlinePosition.
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==): Add m_textUnderlinePosition.
+        * rendering/style/StyleRareNonInheritedData.h:
+        (StyleRareNonInheritedData):
</ins><span class="cx"> 
</span><del>-        When computing the clip rect for painting the box decorations, the scrolled content offset
-        must be computed by going up the containing block tree, up to the region.
</del><ins>+2013-05-20  Lamarque V. Souza  &lt;Lamarque.Souza@basyskom.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/scrollable-region-scrollable-absolute-content-background.html
-               fast/regions/scrollable-region-scrollable-content-background.html
</del><ins>+        Add compile asserts for the size of RootInlineBox and InlineTextbox
+        https://bugs.webkit.org/show_bug.cgi?id=116337
</ins><span class="cx"> 
</span><del>-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-03-25  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Add compile asserts to ensure RootInlineBox and InlineTextbox stay small.
</ins><span class="cx"> 
</span><del>-        [iOS] Inspector View Indication Support
-        https://bugs.webkit.org/show_bug.cgi?id=130709
</del><ins>+        * rendering/InlineTextBox.cpp:
+        (SameSizeAsInlineTextBox):
+        (WebCore):
+        * rendering/RootInlineBox.cpp:
+        (SameSizeAsRootInlineBox):
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-20  Xan Lopez  &lt;xlopez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorClient.h:
-        (WebCore::InspectorClient::showInspectorIndication):
-        (WebCore::InspectorClient::hideInspectorIndication):
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setIndicating):
-        Rename indicate/hideIndication to show/hide names.
</del><ins>+        [BlackBerry] LocalizedStringsBlackBerry: add dummy text track strings
+        https://bugs.webkit.org/show_bug.cgi?id=116300
</ins><span class="cx"> 
</span><del>-2014-03-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix. Typo on checkin.
</del><ins>+        These are dummy implementations necessary to make WebKit link.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerItem): Left an unmatched open bracket.
</del><ins>+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+        (WebCore::weekFormatInLDML):
+        (WebCore):
+        (WebCore::textTrackClosedCaptionsText):
+        (WebCore::textTrackSubtitlesText):
+        (WebCore::textTrackOffText):
+        (WebCore::textTrackNoLabelText):
</ins><span class="cx"> 
</span><del>-2014-03-25  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-05-19  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Even further unreviewed build fix after r166247. Unprotect the implementation of HTMLMediaElement::shouldDisableSleep().
</del><ins>+        [Mac] Improve string use in PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116418
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-2014-03-25  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Did a Ben Poulain all over this file.
</ins><span class="cx"> 
</span><del>-        Further unreviewed build fix after r166247. Add DisplaySleepDisabler to the windows project file and
-        move the definition of DisplaySleepDisabler's constructor and destructor into the cpp file.
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::plainText): Add the newline separately to the string builder.
+        Prepending it to the string first just does more allocations for no good reason.
+        (WebCore::Pasteboard::documentFragment): Use emptyString() instead of &quot;&quot; and use
+        ASCIILiteral where appropriate.
+        (WebCore::cocoaTypeFromHTMLClipboardType): More ASCIILiteral.
+        (WebCore::Pasteboard::clear): Use early return instead of a nested if here.
+        Use emptyString() instead of &quot;&quot;.
+        (WebCore::addHTMLClipboardTypesForCocoaType): More ASCIILiteral.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * platform/DisplaySleepDisabler.cpp:
-        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
-        (WebCore::DisplaySleepDisabler::~DisplaySleepDisabler):
-        * platform/DisplaySleepDisabler.h:
</del><ins>+2013-05-19  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-25  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Remove link prerendering code
+        https://bugs.webkit.org/show_bug.cgi?id=116415
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r166247. Un-platform-protect the declaration of HTMLMediaElement::shouldDisableSleep()
-        and make WebVideoFullscreenController's _displaySleepDisabler a std::unique_ptr.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.h:
-        * platform/mac/WebVideoFullscreenController.h:
-
-2014-03-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [iOS] Pass additional options to AVFoundation during playback.
-        https://bugs.webkit.org/show_bug.cgi?id=130624
-
-        Reviewed by Eric Carlson.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::doesHaveAttribute): Return attribute value if the user
-        passes a pointer to fill in.
-        * html/HTMLMediaElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::doesHaveAttribute):
-        * platform/graphics/MediaPlayer.h:
-        (WebCore::MediaPlayerClient::doesHaveAttribute):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerItem): Pass additional
-        option if supplied by user.
-
-2014-03-25  Michael Saboff  &lt;msaboff@apple.com&gt;
-
-        Unreviewed, rolling out r166070.
-
-        Rollout r166070 due to 2% performance loss in page load times
-
-        Reverted changeset:
-
-        &quot;Change CodeGeneratorJS.pm special cases for &quot;DOMWindow&quot; to be
-        general purpose&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130553
-        http://trac.webkit.org/changeset/166070
-
-2014-03-25  Michael Saboff  &lt;msaboff@apple.com&gt;
-
-        Unreviewed, rolling out r166126.
-
-        Rollout r166126 in prepartion to roll out prerequisite r166070
-
-        Reverted changeset:
-
-        &quot;toThis() on a JSWorkerGlobalScope should return a JSProxy and
-        not undefined&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130554
-        http://trac.webkit.org/changeset/166126
-
-2014-03-25  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [iOS] Playing video does not disable display sleep.
-        https://bugs.webkit.org/show_bug.cgi?id=130729
-
-        Reviewed by Eric Carlson.
-
-        DisplaySleepDisabler was broken by r161589, which replaced the iOS implementation with
-        an empty one. Make a platform independent version with a Cocoa-platform subclass. Update
-        the APIs to non-deprecated ones.
-
-        * platform/DisplaySleepDisabler.cpp: Added.
-        (WebCore::DisplaySleepDisabler::create):
-        * platform/DisplaySleepDisabler.h: Added.
-        (WebCore::DisplaySleepDisabler::~DisplaySleepDisabler):
-        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
-        * platform/cocoa/DisplaySleepDisablerCocoa.cpp: Renamed from Source/WebCore/platform/mac/DisplaySleepDisabler.cpp.
-        (WebCore::DisplaySleepDisabler::create):
-        (WebCore::DisplaySleepDisablerCocoa::DisplaySleepDisablerCocoa):
-        (WebCore::DisplaySleepDisablerCocoa::~DisplaySleepDisablerCocoa):
-        * platform/cocoa/DisplaySleepDisablerCocoa.h: Renamed from Source/WebCore/platform/mac/DisplaySleepDisabler.h.
-
-        Update m_sleepDisabler to be a std::unique_ptr, and unprotect the definition of methods which use it.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::updateSleepDisabling):
-        (WebCore::HTMLMediaElement::shouldDisableSleep):
-        * html/HTMLMediaElement.h:
-
-        Add the new and renamed files to the project:
-        * CMakeLists.txt:
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
</ins><span class="cx">         * GNUmakefile.list.am:
</span><ins>+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><ins>+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore):
+        (Document):
+        * dom/EventNames.h:
+        (WebCore):
+        * html/HTMLLinkElement.cpp:
+        * html/HTMLLinkElement.h:
+        * html/LinkRelAttribute.cpp:
+        (WebCore::LinkRelAttribute::LinkRelAttribute):
+        * html/LinkRelAttribute.h:
+        (LinkRelAttribute):
+        * loader/LinkLoader.cpp:
+        (WebCore::LinkLoader::~LinkLoader):
+        (WebCore::LinkLoader::loadLink):
+        (WebCore::LinkLoader::released):
+        * loader/LinkLoader.h:
+        (WebCore):
+        (LinkLoader):
+        * loader/LinkLoaderClient.h:
+        (LinkLoaderClient):
+        * loader/Prerenderer.cpp: Removed.
+        * loader/Prerenderer.h: Removed.
+        * loader/PrerendererClient.cpp: Removed.
+        * loader/PrerendererClient.h: Removed.
+        * platform/PrerenderClient.h: Removed.
+        * platform/PrerenderHandle.h: Removed.
</ins><span class="cx"> 
</span><del>-2014-03-25  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+2013-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Implement ImageData constructors and WebWorkers exposure
-        https://bugs.webkit.org/show_bug.cgi?id=130668
</del><ins>+        Change the terminology used by rendering code when painting a given node and its children from &quot;paintingRoot&quot; to &quot;subtreePaintRoot&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=116417
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Sam Weinig.
+        
+        PaintInfo and RenderLayer code referred to a &quot;paintingRoot&quot;. This is only set when
+        FrameView::setNodeToDraw() has been called and is used to restrict painting to
+        some part of the subtree, but it could easily be misinterpreted, and confused with
+        the &quot;rootLayer&quot; used by RenderLayer (which is usually not the layer associated with
+        the paintingRoot).
+        
+        Change the terminology from &quot;paintingRoot&quot; to &quot;subtreePaintRoot&quot; root to make the
+        purpose of this variable more obvious.
</ins><span class="cx"> 
</span><del>-        Add new constructors for ImageData.
</del><ins>+        No behavior change.
</ins><span class="cx"> 
</span><del>-        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#pixel-manipulation
</del><ins>+        * page/FrameView.cpp: Add a comment for setNodeToDraw(); in future this should
+        be called setSubtreePaintRoot() or something. Not done in this patch to avoid
+        risk; this function is exported from WebCore.
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paint):
+        * rendering/PaintInfo.h:
+        (WebCore::PaintInfo::PaintInfo):
+        (WebCore::PaintInfo::updateSubtreePaintRootForChildren):
+        (WebCore::PaintInfo::shouldPaintWithinRoot):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintContents):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintOverlayScrollbars):
+        (WebCore::RenderLayer::paintLayerContents):
+        (WebCore::RenderLayer::paintLayerByApplyingTransform):
+        (WebCore::RenderLayer::paintBackgroundForFragments):
+        (WebCore::RenderLayer::paintForegroundForFragments):
+        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
+        (WebCore::RenderLayer::paintOutlineForFragments):
+        (WebCore::RenderLayer::paintMaskForFragments):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::LayerPaintingInfo::LayerPaintingInfo):
+        * rendering/RenderObject.cpp: Add a comment to recommend changing the name of
+        paintingRootRect() to refer to a subtree paint. Not done in this patch to avoid
+        risk; this function is exported from WebCore.
+        * rendering/RenderSnapshottedPlugIn.cpp:
+        (WebCore::RenderSnapshottedPlugIn::paint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintObject):
+        * rendering/svg/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
</ins><span class="cx"> 
</span><del>-        Test: fast/canvas/canvas-imageData.html
</del><ins>+2013-05-19  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/ImageData.cpp: 
-        (WebCore::ImageData::create):
-        * html/ImageData.h:
-        * html/ImageData.idl:
</del><ins>+        Use Element instead of Node in DragState, also redo DragState struct
+        https://bugs.webkit.org/show_bug.cgi?id=116411
</ins><span class="cx"> 
</span><del>-2014-03-25  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        InlineIterator position (unsigned int) variable can wrap around
-        https://bugs.webkit.org/show_bug.cgi?id=130540
</del><ins>+        The drag source is an element, so use RefPtr&lt;Element&gt; instead of RefPtr&lt;Node&gt;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Also, the entire drag state is about dragging, so no need for the word &quot;drag&quot; in the
+        name of its members. Also, it's a struct, so the members don't need m_ prefixes.
</ins><span class="cx"> 
</span><del>-        We trigger an ASSERT that occurs when we are ignoring spaces (to collapse them
-        into a single whitespace mark) but then encounter a line break. Because we don't ignore
-        the first space (but do ignore subsequent spaces), when we hit a newline in an RTL context
-        we want to ignore that first space as well (so as not to push the text away from the right
-        edge). We do this by decrementing the InlineIterator pointing to this first space, so all
-        the spaces get ignored. However, if that space is the first character in a Text node, the
-        decrement will try to go past the beginning of the node, and trigger an ASSERT.
</del><ins>+        * page/DragController.cpp: Removed unneeded include of Node.h since it's included by
+        Element.h, which is also included.
+        (WebCore::DragController::draggableElement): Renamed from Node to Element and changed
+        the types and names of arguments accordingly. Also made this function handle a
+        startElement of 0 so callers don't need to. Also updated for changes to DragState members.
+        (WebCore::DragController::startDrag): Updated for changes to DragState members.
+        Since dragSource can only be an element, was able to get rid of isElementNode checks.
</ins><span class="cx"> 
</span><del>-        This design is not great. At some point we should rework it to more elegantly handle
-        collapsing whitespace in both RTL and LTR writing modes.
</del><ins>+        * page/DragController.h: Fixed style of forward declarations of structs. Updated for
+        change of draggableNode to draggableElement. Also removed declarations of nonexistent
+        selectionDraggingRect and doDrag functions.
</ins><span class="cx"> 
</span><del>-        This patch adds an ASSERT earlier in this codepath to catch potential problems earlier.
-        It also pulls our sentinel value out into a separate boolean to make it more clear what is
-        going on.
</del><ins>+        * page/DragState.h: Rewrote practically this whole header. Added an include of Element
+        instead of Node since that's what we use now. Removed includes that are redundant.
+        There's no problem copying a DragState, so removed WTF_MAKE_NONCOPYABLE. There's no need
+        to allocate a DragState on the heap, so removed WTF_MAKE_FAST_ALLOCATED. The event dispatch
+        boolean is never set to a constant, so there's no need for a policy enum; it can just be
+        a boolean. Removed the &quot;m_&quot; prefixes from the struct members, since this is a struct with
+        public members and we don't use the prefix in those cases. Removed the word &quot;drag&quot; from the
+        struct member names since this entire struct is about dragging and has drag in its name.
+        Left the comments mostly intact, even though I'm not certain of their value.
</ins><span class="cx"> 
</span><del>-        Test: fast/text/whitespace-only-text-in-rtl.html
</del><ins>+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent): Updated for changes to DragState.
+        (WebCore::EventHandler::eventMayStartDrag):
+        Use innerElement instead of innerNode to call draggableElement instead of draggableNode.
+        (WebCore::EventHandler::updateDragAndDrop): Updated for changes to DragState.
+        (WebCore::EventHandler::cancelDragAndDrop): Ditto.
+        (WebCore::EventHandler::handleWheelEvent): Added FIXME.
+        (WebCore::EventHandler::dragHysteresisExceeded): Updated for changes to DragState.
+        (WebCore::EventHandler::freeClipboard): Updated for changes to DragState. Also re-added
+        code to release the clipboard object, which is needed here to avoid keeping it around in
+        memory until the next drag.
+        (WebCore::EventHandler::dragSourceEndedAt): Updated for changes to DragState.
+        (WebCore::EventHandler::updateDragStateAfterEditDragIfNeeded): Ditto.
+        (WebCore::EventHandler::dispatchDragSrcEvent): Ditto.
+        (WebCore::EventHandler::handleDrag): Updated for changes to DragState. Use innerElement
+        instead of innerNode to call draggableElement instead of draggableNode. No longer need to
+        null check innerElement because draggableElement does that. Removed unneeded else that was
+        setting m_dragSrc to zero since it's guaranteed to already be zero.
</ins><span class="cx"> 
</span><del>-        * rendering/InlineIterator.h:
-        (WebCore::InlineIterator::moveTo): Use the set***() calls
-        (WebCore::InlineIterator::setOffset): ASSERT early that our math hasn't wrapped
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::appendRunsForObject): Use new boolean value
-        * rendering/line/BreakingContextInlineHeaders.h:
-        (WebCore::BreakingContext::handleText): Guard against wraps
-        (WebCore::checkMidpoints): Use new boolean value
-        * rendering/line/TrailingObjects.cpp:
-        (WebCore::TrailingObjects::updateMidpointsForTrailingBoxes): Use new boolean value
</del><ins>+2013-05-19  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-25  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        Remove ChromeClient::webView()
+        https://bugs.webkit.org/show_bug.cgi?id=116054
</ins><span class="cx"> 
</span><del>-        [GTK] Remove the autotools build
-        https://bugs.webkit.org/show_bug.cgi?id=130717
-
-        Reviewed by Anders Carlsson.
-
-        * GNUmakefile.am: Removed.
-        * bindings/gobject/GNUmakefile.am: Removed.
-        * config.h: Removed references to autotools configure file.
-
-2014-03-24  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        Prevent 'removetrack' events from firing when all inband text tracks are removed.
-        https://bugs.webkit.org/show_bug.cgi?id=130704
-
-        Reviewed by Eric Carlson.
-
-        Test: media/track/track-remove-track.html
-
-        Based on the Blink change (patch by acolwell@chromium.org):
-        https://codereview.chromium.org/177243018/
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::prepareForLoad): Reorder steps to match W3C specification.
-        (WebCore::HTMLMediaElement::noneSupported): Forget tracks as required by specification.
-        (WebCore::HTMLMediaElement::mediaLoadingFailed): Forget tracks as required by specification.
-        (WebCore::HTMLMediaElement::removeTextTrack): Only request the 'removetracks' event if
-        requested by caller.
-        (WebCore::HTMLMediaElement::removeAllInbandTracks): Renamed to 'forgetResourceSpecificTracks'
-        (WebCore::HTMLMediaElement::noneSupported): Specify that we want the 'removetracks' event
-        fired for this use case.
-        (WebCore::HTMLMediaElement::prepareForLoad): Switch to new 'forgetResourceSpecificTracks' name.
-        * html/HTMLMediaElement.h:
-        * html/track/TextTrackList.cpp:
-        (TextTrackList::remove): Only fire the 'removetrack' event if the caller requests it.
-        * html/track/TextTrackList.h: Add default argument to fire the 'removetrack' event
-        when removing a track.
-        * html/track/TrackListBase.cpp:
-        (TrackListBase::remove): Only fire the 'removetrack' event if the caller requests it.
-        * html/track/TrackListBase.h: Add default argument to fire the 'removetrack' event.
-
-2014-03-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
-
-        Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
-        &lt;http://webkit.org/b/130713&gt;
-        &lt;rdar://problem/15661876&gt;
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Merged from Blink (patch by Ian Beer):
-        http://crbug.com/303657
-        https://src.chromium.org/viewvc/blink?view=rev&amp;revision=158938
</del><ins>+        This blatantly horrible layer violation was only used to know if a ChromeClient is an empty
+        client or not. We already have a (slightly less horrible) way to do that.
</ins><span class="cx"> 
</span><del>-        Test: fast/forms/form-submission-crash-successful-submit-button.html
</del><ins>+        * loader/EmptyClients.h:
+        * page/ChromeClient.h:
+        (ChromeClient):
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::submit):
</del><ins>+2013-05-19  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-25  Gabor Rapcsanyi  &lt;rgabor@webkit.org&gt;
</del><ins>+        Eliminate the Editor::newGeneralClipboard function
+        https://bugs.webkit.org/show_bug.cgi?id=116410
</ins><span class="cx"> 
</span><del>-        [ARM64] GNU assembler fails in TransformationMatrix::multiply
-        https://bugs.webkit.org/show_bug.cgi?id=130454
-
-        Reviewed by Zoltan Herczeg.
-
-        Change the NEON intstructions to the proper style.
-
-        * platform/graphics/transforms/TransformationMatrix.cpp:
-        (WebCore::TransformationMatrix::multiply):
-
-2014-03-20  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
-
-        [CSS Grid Layout] Vertical rectangles not considered as valid grid areas
-        https://bugs.webkit.org/show_bug.cgi?id=130513
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Grid areas sized as vertical rectangles were incorrectly
-        considered as invalid by the parser. That's because the condition
-        checking that each new row was adjacent to the previous one was
-        using the first row of the currently parsed grid area instead of
-        the last one.
</del><ins>+        This is one of the clean-ups made possible by the changes to the DOM clipboard class.
+        I had been waiting until all the platforms were moved over to it, but it turns out to be
+        easy to do this now, just with #ifdefs.
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/grid-template-areas-get-set.html
</del><ins>+        * PlatformBlackBerry.cmake: Deleted EditorBlackBerry.cpp.
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseGridTemplateAreas):
</del><ins>+        * editing/Editor.cpp:
+        (WebCore::Editor::dispatchCPPEvent): Call Clipboard::createForCopyAndPaste directly when
+        using the new version of the Clipboard class. Also some small style cleanup nearby.
</ins><span class="cx"> 
</span><del>-2014-03-25  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</del><ins>+        * editing/blackberry/EditorBlackBerry.cpp: Removed. The only function in this file was
+        newGeneralClipboard.
</ins><span class="cx"> 
</span><del>-        [GTK] Volume slider shows below the panel with videos in certain cases
-        https://bugs.webkit.org/show_bug.cgi?id=130608
</del><ins>+        * editing/mac/EditorMac.mm: Deleted newGeneralClipboard.
+        * platform/efl/ClipboardEfl.cpp: Ditto.
+        * platform/gtk/ClipboardGtk.cpp: Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+2013-05-19  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        We need to delay the moment we check if the volume slider shows up
-        or down. If the video was not visible, the offsets were 0 and it
-        was forced to be shown below the panel.
</del><ins>+        GtkSelectionData length is off by one
+        https://bugs.webkit.org/show_bug.cgi?id=113962
</ins><span class="cx"> 
</span><del>-        Test: media/video-initially-hidden-volume-slider-up.html
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller.prototype.createControls): Moved volumebox pseudo from
-        the subclass. The test checks for it and it would fail in Mac.
-        * Modules/mediacontrols/mediaControlsGtk.js:
-        (ControllerGtk.prototype.createControls): Moved volumebox pseudo
-        to the superclass.
-        (ControllerGtk.prototype.handleMuteButtonMouseOver): Check if
-        volume slider should show up or down.
-        (ControllerGtk.prototype.updateReadyState): Removed check for
-        volume slider direction.
</del><ins>+        No new tests. Since drag data is interpreted as a null-terminated string
+        this is difficult to test with a C program and we have no infrastructure
+        built for using GIR tests.
</ins><span class="cx"> 
</span><del>-2014-03-24  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * platform/gtk/PasteboardHelper.cpp:
+        (WebCore::PasteboardHelper::fillSelectionData): Instead of including the null
+        character in the paste data length, just include the string. This matches the behavior
+        of Firefox.
</ins><span class="cx"> 
</span><del>-        [Win] Enable WebVTT Regions on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=130680
</del><ins>+2013-05-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Hoist several chunks of code at the top of RenderLayer::paintLayerContents() onto new functions
+        https://bugs.webkit.org/show_bug.cgi?id=116406
</ins><span class="cx"> 
</span><del>-        * DerivedSources.cpp: Add new build components.
-        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-
-2014-03-24  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Remove some unnecessary includes from PlatformCALayerClient.h
-        https://bugs.webkit.org/show_bug.cgi?id=130703
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx">         
</span><del>-        No need for all these #includes.
</del><ins>+        RenderLayer::paintLayerContents() was getting polluted with code related to filters,
+        clipping and font subpixel quantization, and hard to follow.
+        
+        Move three hunks of code into new functions:
+        setupFontSubpixelQuantization() now contains the code related to whether we disable
+        font subpixel quantization on the context.
+        setupClipPath() now contains code related to clipping to shapes and references.
+        setupFilters() and applyFilters() contain code related to CSS filters.
+        
+        As part of this, the interaction with FilterEffectRendererHelper was simplified.
+        It was convenient for setupFilters() to return a FilterEffectRendererHelper object
+        if successful, so we use an OwnPtr&lt;FilterEffectRendererHelper&gt; now. In addition,
+        the GraphicsContext swapping was moved from FilterEffectRendererHelper code into RenderLayer
+        to make it easier to follow. FilterEffectRendererHelper no longer holds on to
+        the old GraphicsContext.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/PlatformCALayerClient.h:
</del><ins>+        No behavior change.
</ins><span class="cx"> 
</span><del>-2014-03-24  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRendererHelper::filterContext):
+        (WebCore::FilterEffectRendererHelper::beginFilterEffect):
+        (WebCore::FilterEffectRendererHelper::applyFilterEffect):
+        * rendering/FilterEffectRenderer.h:
+        (WebCore::FilterEffectRendererHelper::FilterEffectRendererHelper):
+        (WebCore::FilterEffectRendererHelper::hasStartedFilterEffect):
+        (FilterEffectRendererHelper):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::setupFontSubpixelQuantization):
+        (WebCore::RenderLayer::setupClipPath):
+        (WebCore::RenderLayer::setupFilters):
+        (WebCore::RenderLayer::applyFilters):
+        (WebCore::RenderLayer::paintLayerContents):
+        * rendering/RenderLayer.h:
</ins><span class="cx"> 
</span><del>-        [core] FEGaussianBlur: use IntSize to simplify member function interface
-        https://bugs.webkit.org/show_bug.cgi?id=130695
</del><ins>+2013-05-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Refactor RenderStyle::diff()
+        https://bugs.webkit.org/show_bug.cgi?id=116397
</ins><span class="cx"> 
</span><del>-        By returning an IntSize to store the calculated kernel size values
-        it is possible to have less function parameters. This patch also
-        streamlines a bit the code in calculateUnscaledKernelSize.
-
-        No new tests, no change in behavior.
-
-        * platform/graphics/filters/FEDropShadow.cpp:
-        (WebCore::FEDropShadow::determineAbsolutePaintRect):
-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        (WebCore::FEGaussianBlur::calculateUnscaledKernelSize):
-        (WebCore::FEGaussianBlur::calculateKernelSize):
-        (WebCore::FEGaussianBlur::determineAbsolutePaintRect):
-        (WebCore::FEGaussianBlur::platformApplySoftware):
-        * platform/graphics/filters/FEGaussianBlur.h:
-        (if): Deleted.
-        * platform/graphics/filters/FilterOperations.cpp:
-        (WebCore::outsetSizeForBlur):
-
-2014-03-24  Brian Burg  &lt;bburg@apple.com&gt;
-
-        Web Replay: capture and replay keyboard events
-        https://bugs.webkit.org/show_bug.cgi?id=130314
-
-        Reviewed by Joseph Pecoraro.
-
-        Upstream support for capturing and replaying non-IME keyboard input.
-        This works similarly to mouse events. It introduces optional fields and
-        macros to encode/decode them.
-
-        Test: ManualTests/inspector/replay-keyboard-events.html
-
-        * replay/ReplayInputDispatchMethods.cpp:
-        (WebCore::HandleKeyPress::dispatch):
-        * replay/SerializationMethods.cpp:
-        (JSC::EncodingTraits&lt;NondeterministicInputBase&gt;::encodeValue):
-        (JSC::EncodingTraits&lt;NondeterministicInputBase&gt;::decodeValue): Switch existing
-        encode/decode calls to use the shortening macros.
-        (JSC::EncodingTraits&lt;KeypressCommand&gt;::encodeValue): Added.
-        (JSC::EncodingTraits&lt;KeypressCommand&gt;::decodeValue): Added.
-        (JSC::PlatformKeyboardEventAppKit::PlatformKeyboardEventAppKit): Subclass
-        PlatformKeyboardEvent so that we can set AppKit-specific members not
-        initialized through the main constructors.
-        (JSC::EncodingTraits&lt;PlatformKeyboardEvent&gt;::encodeValue): Added.
-        (JSC::EncodingTraits&lt;PlatformKeyboardEvent&gt;::decodeValue): Added.
-        * replay/SerializationMethods.h:
-        * replay/UserInputBridge.cpp:
-        (WebCore::UserInputBridge::UserInputBridge): initialize m_state inside a guard.
-        (WebCore::UserInputBridge::handleKeyEvent): fill in the implementation.
-        * replay/WebInputs.json:
-
-2014-03-24  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
-
-        Optimizing string construction for type error in JSNavigatorCustom.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=130683
-
-        Reviewed by Eric Carlson.
-
-        * bindings/js/JSNavigatorCustom.cpp:
-        (WebCore::JSNavigator::webkitGetUserMedia):
-
-2014-03-24  Beth Dakin  &lt;bdakin@apple.com&gt;
-
-        Legacy-style scrollbars constantly redraw after scrolling
-        https://bugs.webkit.org/show_bug.cgi?id=130699
-
-        Reviewed by Simon Fraser.
-
-        The constant re-draw was happening because we were never calling [ScrollbarPainter 
-        setUsePresentationValue:NO]. This is a silly bug where were should have been 
-        looking at PlatformWheelEvent::momentumPhase() instead of 
-        PlatformWheelEvent::phase()
-
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::handleWheelEvent):
-
-2014-03-24  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        XSS Auditor doesn't block &lt;script&gt; injected before an existing &lt;script&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=130475
-
-        Merged from Blink (patch by Tom Sepez):
-        https://src.chromium.org/viewvc/blink?view=rev&amp;revision=169697
-
-        Tests: http/tests/security/xssAuditor/script-tag-expression-follows.html
-               http/tests/security/xssAuditor/script-tag-near-start.html
-
-        * html/parser/XSSAuditor.cpp:
-        (WebCore::startsHTMLCommentAt):
-        (WebCore::startsSingleLineCommentAt):
-        (WebCore::startsMultiLineCommentAt):
-        (WebCore::startsOpeningScriptTagAt):
-        (WebCore::XSSAuditor::decodedSnippetForJavaScript):
-
-2014-03-24  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        Activate WebVTT Tests Once Merging is Complete
-        https://bugs.webkit.org/show_bug.cgi?id=130420
-
-        Reviewed by Eric Carlson.
-
-        * Configurations/FeatureDefines.xcconfig: Turn on ENABLE(WEBVTT_REGIONS)
-
-2014-03-24  Anders Carlsson  &lt;andersca@apple.com&gt;
-
-        Re-fix the build.
-
-        * WebCore.exp.in:
-
-2014-03-24  Anders Carlsson  &lt;andersca@apple.com&gt;
-
-        Fix build.
-
-        * WebCore.exp.in:
-        Move a CFNetwork only symbol inside the USE(CFNETWORK) section.
-
-2014-03-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
-
-        Regression: AX: Don't expose role or notifications for invalid menus
-        https://bugs.webkit.org/show_bug.cgi?id=129814
-
-        Reviewed by Mario Sanchez Prada.
-
-        If a role=menu has no menuitem children, it should not be a menu.
-        This was a bit tricky to implement since we need to update the role after the children are created,
-        but it means we have to be a bit more aggressive about when to updateChildren, so that the role
-        is known to be valid.
-
-        Test: platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html
-
-        * accessibility/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::notificationPostTimerFired):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::updateRoleAfterChildrenCreation):
-        (WebCore::AccessibilityRenderObject::addChildren):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
-        (-[WebAccessibilityObjectWrapperBase updateObjectBackingStore]):
-
-2014-03-24  Andy Estes  &lt;aestes@apple.com&gt;
-
-        [iOS] Download support by CFURLDownloadRef under USE(CFNETWORK).
-        https://bugs.webkit.org/show_bug.cgi?id=129322
-
-        Reviewed by Anders Carlsson.
-
-        * platform/network/ResourceHandle.h:
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::releaseConnectionForDownload): Changed to
-        return a RetainPtr that adopts the connection's retain count.
-
-2014-03-24  Enrica Casucci  &lt;enrica@apple.com&gt;
-
-        Update Hindi fallback font.
-        https://bugs.webkit.org/show_bug.cgi?id=130690
-        &lt;rdar://problem/16391601&gt;
-
-        Reviewed by Sam Weinig.
-
-        Using the new available font for Hindi in the fallback list.
-
-        * platform/graphics/ios/FontCacheIOS.mm:
-        (WebCore::FontCache::systemFallbackForCharacters):
-
-2014-03-24  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        Merge Minor WebVTT Cleanups from Blink
-        https://bugs.webkit.org/show_bug.cgi?id=130681
-
-        Reviewed by Eric Carlson.
-
-        Merged from Blink (patch by philipj@opera.com):
-        https://chromium.googlesource.com/chromium/blink/+/693eb5e2933dca0eab5bbd604e9f3406fe9fd1ab
-        http://crbug.com/52593009
-        https://chromium.googlesource.com/chromium/blink/+/40b3602feab34e9be829fd742b6ad6ded322a09f
-        http://crbug.com/104243003
-
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::setMode):
-        * html/track/TextTrack.idl:
-        * html/track/TextTrackCue.h:
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::VTTCue):
-        * html/track/VTTCue.h:
-
-2014-03-24  Commit Queue  &lt;commit-queue@webkit.org&gt;
-
-        Unreviewed, rolling out r166169.
-        https://bugs.webkit.org/show_bug.cgi?id=130682
-
-        This patch broke tests on Apple Mavericks (Requested by fredw
-        on #webkit).
-
-        Reverted changeset:
-
-        &quot;Operator stretching: expose a math data API&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130572
-        http://trac.webkit.org/changeset/166169
-
-2014-03-24  Martin Hodovan  &lt;mhodovan@inf.u-szeged.hu&gt;
-
-        ENABLE(CSS_GRID_LAYOUT) guard for CSSGridLineNamesValue
-        https://bugs.webkit.org/show_bug.cgi?id=130669
-
-        Reviewed by Sergio Villar Senin.
-
-        No new tests. No new functionality.
-
-        * css/CSSGridLineNamesValue.cpp:
-        * css/CSSGridLineNamesValue.h:
-
-2014-03-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
-
-        &lt;hr&gt; should expose AXRole/AXSubrole, etc
-        https://bugs.webkit.org/show_bug.cgi?id=109015
-
-        Reviewed by Mario Sanchez Prada.
-
-        Expose the &lt;hr&gt; element to Mac and iOS through the accessibility interface.
-
-        Test: platform/mac/accessibility/hr-element.html
-
-        * English.lproj/Localizable.strings:
-        * accessibility/AccessibilityNodeObject.cpp:
-        (WebCore::AccessibilityNodeObject::isEnabled):
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::computedRoleString):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
-        * accessibility/atk/AccessibilityObjectAtk.cpp:
-        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):
-        (-[WebAccessibilityObjectWrapper accessibilityLabel]):
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-        (createAccessibilityRoleMap):
-        (-[WebAccessibilityObjectWrapper subrole]):
-        (-[WebAccessibilityObjectWrapper roleDescription]):
-        * platform/LocalizedStrings.cpp:
-        (WebCore::AXHorizontalRuleDescriptionText):
-        * platform/LocalizedStrings.h:
-
-2014-03-24  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Invalidate sibling text node style when needed instead of attaching synchronously
-        https://bugs.webkit.org/show_bug.cgi?id=130590
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx">         
</span><del>-        Make things simpler.
-
-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::invalidateWhitespaceOnlyTextSiblingsAfterAttachIfNeeded):
</del><ins>+        RenderStyle::diff() was prone to being changed incorrectly, since there was
+        a poorly documented ordering requirement: style changes that cause layout
+        have to be detected before those that cause only repainting.
</ins><span class="cx">         
</span><del>-            Just invalidate instead of calling attach directly.
-            Rename to match.
-
-        (WebCore::Style::textRendererIsNeeded):
-        (WebCore::Style::createTextRendererIfNeeded):
</del><ins>+        In addition, the existing code made it impossible to separately ask whether
+        a given style change requires a repaint, if we've already detected that it
+        requires a positioned-movement-only layout.
</ins><span class="cx">         
</span><del>-            Move all testing to textRendererIsNeeded.
-
-        (WebCore::Style::updateTextRendererAfterContentChange):
</del><ins>+        Fix by factoring the code into member functions that check for each type
+        of style change.
</ins><span class="cx">         
</span><del>-            Call resolveTextNode instead of re-implementing the same thing.
</del><ins>+        No behavior change.
</ins><span class="cx"> 
</span><del>-        (WebCore::Style::resolveLocal):
-        (WebCore::Style::resolveTextNode):
-        
-            Avoid unnecessary reattaching.
-            Rename for consistency.
</del><ins>+        * rendering/style/RenderStyle.cpp:
+        (WebCore::positionChangeIsMovementOnly):
+        (WebCore::RenderStyle::changeRequiresLayout):
+        (WebCore::RenderStyle::changeRequiresPositionedLayoutOnly):
+        (WebCore::RenderStyle::changeRequiresLayerRepaint):
+        (WebCore::RenderStyle::changeRequiresRepaint):
+        (WebCore::RenderStyle::changeRequiresRepaintIfText):
+        (WebCore::RenderStyle::changeRequiresRecompositeLayer):
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
</ins><span class="cx"> 
</span><del>-        (WebCore::Style::resolveShadowTree):
-        (WebCore::Style::resolveTree):
-        
-2014-03-24  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+2013-05-18  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix !ENABLE(VIDEO) build
-        https://bugs.webkit.org/show_bug.cgi?id=130671
</del><ins>+        Simplify the StorageArea setter functions
+        https://bugs.webkit.org/show_bug.cgi?id=116402
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Add missing ENABLE(VIDEO) guards because many functions use
-        the newly guarded functions.
</del><ins>+        Move more security checking code to Storage so more code can be shared between WebKit1 and WebKit2.
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp:
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::setDOMStorageItem):
+        (WebCore::InspectorDOMStorageAgent::removeDOMStorageItem):
+        * storage/Storage.cpp:
+        (WebCore::Storage::setItem):
+        (WebCore::Storage::removeItem):
+        (WebCore::Storage::clear):
+        * storage/StorageArea.h:
+        (StorageArea):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        (StorageAreaImpl):
</ins><span class="cx"> 
</span><del>-2014-03-24  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-05-18  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Text autosizing does not determine line count correctly for simple line layout
-        https://bugs.webkit.org/show_bug.cgi?id=130673
</del><ins>+        Simplify StorageArea getter functions
+        https://bugs.webkit.org/show_bug.cgi?id=116399
</ins><span class="cx"> 
</span><del>-        Reviewed by Daniel Bates.
-        
-        We don't count lines correctly in simple line layout case.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        * page/Frame.cpp:
-        (WebCore::Frame::textAutosizingWidth):
-        (WebCore::Frame::setTextAutosizingWidth):
-        * page/ios/FrameIOS.mm:
-        (WebCore::Frame::textAutosizingWidth): Deleted.
-        (WebCore::Frame::setTextAutosizingWidth): Deleted.
-        
-            Move to Frame.cpp to make enabling on non-iOS build easier.
</del><ins>+        Move the security and private browsing checks from StorageArea to Storage so we can share
+        more code between WebKit1 and WebKit2.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::lineCount):
</del><ins>+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::getDOMStorageItems):
+        Update to new StorageArea interface. The security checks are unnecessary here anyway because
+        InspectorDOMStorageAgent::findStorageArea will only return a StorageArea that can be accessed
+        by the frame's security origin.
</ins><span class="cx">         
</span><del>-            Handle simple line layout case.
</del><ins>+        * storage/Storage.cpp:
+        (WebCore::Storage::key):
+        (WebCore::Storage::getItem):
+        (WebCore::Storage::contains):
+        * storage/StorageArea.h:
+        (StorageArea):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::item):
+        (WebCore::StorageAreaImpl::contains):
+        * storage/StorageAreaImpl.h:
+        (StorageAreaImpl):
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBlockFlow::lineCountForTextAutosizing):
-            
-            Call lineCount() if children are inline.
-            Rename for clarity.
</del><ins>+2013-05-17  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBlockFlow::adjustComputedFontSizes):
-        (WebCore::RenderBlockFlow::immediateLineCount): Deleted.
-        * rendering/RenderBlockFlow.h:
</del><ins>+        Garbage on page background while http://canberraballoons.com.au is loading
+        https://bugs.webkit.org/show_bug.cgi?id=116384
+        &lt;rdar://problem/13930328&gt;
</ins><span class="cx"> 
</span><del>-2014-03-24  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Reviewed by Dan Bernstein.
</ins><span class="cx"> 
</span><del>-        [regression] background colors do not apply to &lt;mo&gt; elements.
-        https://bugs.webkit.org/show_bug.cgi?id=130470.
</del><ins>+        This page loads a large JPEG image as the body background.
+        ImageSource::frameHasAlphaAtIndex() always claims that JPEG images
+        are opaque, but this isn't true if the frame is only partially loaded.
+        However, this would cause FillLayer::hasOpaqueImage() to report that the
+        background image is opaque, so we'd skip painting the background color.
+        Unpainted content in an opaque layer results in garbage.
+        
+        Fix by having ImageSource::frameHasAlphaAtIndex() always return true
+        for frames that are not complete. When the image load completes, we
+        recompute metadata and correctly determine that the frame is opaque.
</ins><span class="cx"> 
</span><del>-        Test: mathml/presentation/tokenElements-background-color.html
</del><ins>+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
</ins><span class="cx"> 
</span><del>-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::paint): always call the parent painting to draw the background.
-        (WebCore::RenderMathMLOperator::paintChildren): move the special case for invisible operator here.
</del><ins>+2013-05-18  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-24  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Simplify EventLoop::cycle() on Mac.
</ins><span class="cx"> 
</span><del>-        Operator stretching: expose a math data API
-        https://bugs.webkit.org/show_bug.cgi?id=130572
</del><ins>+        https://webkit.org/b/116392
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        We expose a new SimpleFontData API to give access to the data from the
-        OpenType MATH table using a font cache. The class OpenTypeMathData will
-        be implemented in bug 130324. On Darwin platform, we also implement the
-        missing FontPlatformData::openTypeTable function which will be necessary
-        to load the OpenType MATH table. The changes are intended to be used
-        for MathML operator stretching (bug 130322) so tests are not added yet.
</del><ins>+        * platform/mac/EventLoopMac.mm:
+        (WebCore::EventLoop::cycle): Use CFRunLoopRunInMode instead.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: add new OpenTypeMathData files.
-        * GNUmakefile.list.am: ditto.
-        * WebCore.vcxproj/WebCore.vcxproj: ditto.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: ditto.
-        * WebCore.xcodeproj/project.pbxproj: ditto.
-        * platform/graphics/FontCache.cpp: We add a FontCache::getMathData function to implement a cache for the math data.
-        We make the math and vertical data share the same key for the cache.
-        (WebCore::fontMathDataCacheInstance):
-        (WebCore::FontCache::getMathData):
-        (WebCore::fontVerticalDataCacheInstance):
-        * platform/graphics/FontCache.h: We declare FontCache::getMathData and FontFileKey on all platforms.
-        * platform/graphics/FontPlatformData.cpp:
-        (WebCore::FontPlatformData::openTypeTable): We implement openTypeTable() on Darwin platform.
-        * platform/graphics/FontPlatformData.h: We expose openTypeTable() on Darwin platform.
-        * platform/graphics/SimpleFontData.cpp: We initialize m_mathData from the font cache.
-        (WebCore::SimpleFontData::SimpleFontData):
-        * platform/graphics/SimpleFontData.h: We expose a mathData() function to access the MATH data.
-        * platform/graphics/opentype/OpenTypeMathData.cpp: Added. This is a new class that will be used to parse the data from the OpenType MATH table.
-        (WebCore::OpenTypeMathData::OpenTypeMathData):
-        * platform/graphics/opentype/OpenTypeMathData.h: Added.
-        (WebCore::OpenTypeMathData::create):
-        (WebCore::OpenTypeMathData::hasMathData):
</del><ins>+2013-05-18  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-24  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+        Use CSSParserSelector::appendTagHistory() from CSS grammar.
+        &lt;http://webkit.org/b/116382&gt;
</ins><span class="cx"> 
</span><del>-        Build fixes.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Unreviewed.
</del><ins>+        CSSParserSelector already knows how to append another component to itself,
+        no need to duplicate that logic in the grammar.
</ins><span class="cx"> 
</span><del>-        * editing/ios/EditorIOS.mm:
-        (WebCore::Editor::writeSelectionToPasteboard): Convert to reference.
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-2014-03-24  Martin Hodovan  &lt;mhodovan@inf.u-szeged.hu&gt;
</del><ins>+2013-05-18  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        ENABLE(VIDEO_TRACK) guard for CSSParserSelector::parsePseudoCueFunctionSelector
-        https://bugs.webkit.org/show_bug.cgi?id=130666
</del><ins>+        [CMake] Replace *_LIBRARY_NAME with *_OUTPUT_NAME
+        https://bugs.webkit.org/show_bug.cgi?id=114554
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Reviewed by Gyuyoung Kim.
</ins><span class="cx"> 
</span><del>-        No new tests. No new functionality.
</del><ins>+        Using variables as target names is very uncommon in CMake.
+        The usual way to specify the name of the resulting binary
+        is to set the OUTPUT_NAME target property.
</ins><span class="cx"> 
</span><del>-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserSelector::parsePseudoCueFunctionSelector): Deleted.
-
-2014-03-24  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
-
-        [CSS Grid Layout] Update named &lt;grid-line&gt; syntax to the last version of the specs
-        https://bugs.webkit.org/show_bug.cgi?id=129041
-
-        Reviewed by Sergio Villar Senin.
-
-        From Blink r162555 by &lt;svillar@igalia.com&gt;
-
-        Names for grid lines are now specified as a list of whitespace separated
-        idents enclosed in parentheses instead of as a list of strings.
-
-        Updated tests to match the new &lt;grid-line&gt; syntax.
-
</del><span class="cx">         * CMakeLists.txt:
</span><del>-        * GNUmakefile.list.am:
-        * WebCore.xcodeproj/project.pbxproj: Added info of the new file for the CSSGridLineNamesValue class.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::addValuesForNamedGridLinesAtIndex): The named &lt;grid-line&gt; value is now a list.
-        * css/CSSGrammar.y.in: New syntax for named &lt;grid-line&gt;.
-        * css/CSSGridLineNamesValue.cpp: Added.
-        (WebCore::CSSGridLineNamesValue::customCSSText): String representation of the named &lt;grid-line&gt; as a list of Strings.
-        (WebCore::CSSGridLineNamesValue::CSSGridLineNamesValue): Constructor.
-        (WebCore::CSSGridLineNamesValue::cloneForCSSOM): Ref counted cloning function.
-        * css/CSSGridLineNamesValue.h: Added.
-        (WebCore::CSSGridLineNamesValue::create): Ref counted constructor.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseGridLineNames): It replaces the old parseGrdTrackNames.
-        (WebCore::CSSParser::parseGridTrackList): Using the new named &lt;grid-line&gt; syntax.
-        (WebCore::CSSParser::parseGridTrackRepeatFunction): Using the new named &lt;grid-line&gt; syntax.
-        * css/CSSParser.h:
-        * css/CSSParserValues.cpp:
-        (WebCore::destroy): Handling the case of CSSValue being CSSValueList intances.
-        (WebCore::CSSParserValue::createCSSValue): Handling the case of CSSValue being CSSValueList intances.
-        * css/CSSParserValues.h:
-        (WebCore::CSSParserValue::setFromValueList): Adds the named &lt;grid-line&gt; list to the CSSParserValueList instance.
-        * css/CSSValue.cpp:
-        (WebCore::CSSValue::equals): Handling the case of the new CSSGridLineNamesValue class.
-        (WebCore::CSSValue::cssText): Handling the case of the new CSSGridLineNamesValue class.
-        (WebCore::CSSValue::destroy): Handling the case of the new CSSGridLineNamesValue class.
-        * css/CSSValue.h:
-        (WebCore::CSSValue::isGridLineNamesValue): Type cast check for the new CSSGridLineNamesValue class.
-        * css/StyleResolver.cpp:
-        (WebCore::createGridTrackList): Using the new named &lt;grid-line&gt; syntax.
</del><span class="cx"> 
</span><del>-2014-03-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+2013-05-18  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Convert WebHTMLConverter to C++
-        https://bugs.webkit.org/show_bug.cgi?id=130655
</del><ins>+        [GTK] Move GTK port off legacy clipboard
+        https://bugs.webkit.org/show_bug.cgi?id=116221
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        - Mechanically converts the Objective-C class WebHTMLConverter, to the C++ HTMLConverter (lots of cleanup to follow).
-        - Removes unused members
-            - _standardFontFamily (never assigned to)
-            - _textSizeMultiplier (always exactly 1)
-            - _webViewTextSizeMultiplier (always exactly 0)
-            - _defaultFontSize (always exactly 12, changed to be constant)
-            - _minimumFontSize (always exactly 1, changed to be constant)
-            - _colorsForNodes (never assigned to)
-            - _indexingLimit (always exactly 0)
-            - _thumbnailLimit (always exactly 0)
-            - _flags.isIndexing (always false)
-            - _flags.isTesting (always false)
</del><ins>+        Merge clipboard methods into PasteboardGtk that now wraps a
+        DataObjectGtk.
</ins><span class="cx"> 
</span><del>-        * editing/cocoa/HTMLConverter.mm:
-        (HTMLConverter::convert):
-        (HTMLConverter::HTMLConverter):
-        (HTMLConverter::~HTMLConverter):
-        (defaultParagraphStyle):
-        (_childrenForNode):
-        (HTMLConverter::_stringForNode):
-        (HTMLConverter::_getFloat):
-        (_webKitBundle):
-        (HTMLConverter::_elementIsBlockLevel):
-        (HTMLConverter::_elementHasOwnBackgroundColor):
-        (HTMLConverter::_blockLevelElementForNode):
-        (HTMLConverter::_colorForNode):
-        (HTMLConverter::_computedAttributesForElement):
-        (HTMLConverter::_attributesForElement):
-        (HTMLConverter::_newParagraphForElement):
-        (HTMLConverter::_newLineForElement):
-        (HTMLConverter::_newTabForElement):
-        (_WebMessageDocumentClass):
-        (HTMLConverter::_addAttachmentForElement):
-        (HTMLConverter::_addQuoteForElement):
-        (HTMLConverter::_addValue):
-        (HTMLConverter::_fillInBlock):
-        (HTMLConverter::_processMetaElementWithName):
-        (HTMLConverter::_processHeadElement):
-        (HTMLConverter::_enterElement):
-        (HTMLConverter::_addTableForElement):
-        (HTMLConverter::_addTableCellForElement):
-        (HTMLConverter::_processElement):
-        (HTMLConverter::_addMarkersToList):
-        (HTMLConverter::_exitElement):
-        (HTMLConverter::_processText):
-        (HTMLConverter::_traverseNode):
-        (HTMLConverter::_traverseFooterNode):
-        (HTMLConverter::_adjustTrailingNewline):
-        (HTMLConverter::_loadFromDOMRange):
-        (fileWrapperForURL):
-        (fileWrapperForElement):
-        (WebCore::attributedStringFromRange):
-        (WebCore::editingAttributedStringFromRange):
</del><ins>+        * GNUmakefile.list.am: Remove ClipboardGtk.h.
+        * dom/Clipboard.h: Remove GTK from the list of ports using legacy
+        clipboard.
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::createDraggingClipboard): Use
+        Clipboard::createForDragAndDrop().
+        * platform/Pasteboard.h:
+        (Pasteboard):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::Editor::newGeneralClipboard): Use
+        Clipboard::createForCopyAndPaste().
+        (WebCore::Clipboard::createDragImage):
+        (WebCore::Clipboard::declareAndWriteDragImage):
+        * platform/gtk/ClipboardGtk.h: Removed.
+        * platform/gtk/DragDataGtk.cpp:
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::create): Create a new Pasteboard for a given
+        GtkClipboard or DataObjectGtk.
+        (WebCore::Pasteboard::createForCopyAndPaste): Create a Pasteboard
+        for the GDK_SELECTION_CLIPBOARD clipboard.
+        (WebCore::Pasteboard::createPrivate): Create a Pasteboard without
+        a GtkClipboard associated.
+        (WebCore::Pasteboard::createForDragAndDrop): Create a Pasteboard
+        for drag and drop operations.
+        (WebCore::selectionClipboard): Return a static Pasteboard for the
+        GDK_SELECTION_CLIPBOARD clipboard.
+        (WebCore::primaryClipboard): Return a static Pasteboard for the
+        GDK_SELECTION_PRIMARY clipboard.
+        (WebCore::Pasteboard::generalPasteboard): Return
+        selectionClipboard() or primaryClipboard() depending on whether
+        primary selection clipboard is the active one or not.
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::~Pasteboard):
+        (WebCore::Pasteboard::dataObject): Return the wrapped DataObjectGtk.
+        (WebCore::dataObjectTypeFromHTMLClipboardType): Copied from
+        ClipboardGtk.cpp.
+        (WebCore::Pasteboard::writeString): Adapted to upate the wrapped
+        DataObjectGtk and the GtkClipboard if needed.
+        (WebCore::Pasteboard::writeSelection): Ditto.
+        (WebCore::Pasteboard::writePlainText): Ditto.
+        (WebCore::Pasteboard::writeURL): Ditto.
+        (WebCore::Pasteboard::writeImage): Ditto.
+        (WebCore::Pasteboard::writePasteboard): Copy the wrapped
+        DataObjectGtk from the DataObjectGtk of the given Pasteboard and
+        upsate the GtkClipboard if needed.
+        (WebCore::Pasteboard::clear): Copied from ClipboardGtk.cpp.
+        (WebCore::Pasteboard::canSmartReplace): Check if current
+        GtkClipboard supports smart replace.
+        (WebCore::Pasteboard::setDragImage):
+        (WebCore::Pasteboard::documentFragment): Adapted to use the
+        wrapped DataObjectGtk reading from the current GtkClipboard if
+        present.
+        (WebCore::Pasteboard::plainText): Ditto.
+        (WebCore::Pasteboard::hasData): Copied from ClipboardGtk.cpp.
+        (WebCore::Pasteboard::types): Ditto.
+        (WebCore::Pasteboard::readString): Ditto.
+        (WebCore::Pasteboard::readFilenames): Ditto.
</ins><span class="cx"> 
</span><del>-2014-03-23  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+2013-05-18  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove Dead Stores from editing directory
-        https://bugs.webkit.org/show_bug.cgi?id=130634
</del><ins>+        [GTK] Parallel build fails if gtk-doc is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=116227
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Remove Dead Stores from editing directory which assigning a value to a variable
-        and never reading that value.
</del><ins>+        * GNUmakefile.am:
+        Don't overwrite noinst_DATA, modify its existing value instead.
</ins><span class="cx"> 
</span><del>-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::mergeStartWithPreviousIfIdentical):
-        * editing/markup.cpp:
-        (WebCore::createMarkupInternal):
</del><ins>+2013-05-17  Michelangelo De Simone  &lt;michelangelo@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-23  Hyowon Kim  &lt;hw1008.kim@samsung.com&gt;
</del><ins>+        CSSParser parsing of CSSPropertyFontStretch falls into CSSPropertyGeometry
+        https://bugs.webkit.org/show_bug.cgi?id=116370
</ins><span class="cx"> 
</span><del>-        Move all EFL typedefs into EflTypedefs.h.
-        https://bugs.webkit.org/show_bug.cgi?id=130511
</del><ins>+        CSSPropertyFontStretch mistakenly fell through the shader parsing logic.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        Reviewed by Alexandru Chiculita.
</ins><span class="cx"> 
</span><del>-        * platform/FileSystem.h: Remove EFL typedefs.
-        * platform/Widget.h: Ditto.
-        * platform/efl/EflScreenUtilities.h: Ditto.
-        * platform/graphics/Icon.h: Ditto.
-        * platform/graphics/Image.h: Ditto.
-        * platform/graphics/IntPoint.h: Ditto.
-        * platform/graphics/IntRect.h: Ditto.
-        * platform/network/NetworkStateNotifier.h: Ditto.
</del><ins>+        No new test possible, the feature is not implemented nor exposed.
</ins><span class="cx"> 
</span><del>-2014-03-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
</ins><span class="cx"> 
</span><del>-        Move HTMLConverter from platform/mac to editing/cocoa.
</del><ins>+2013-05-17  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rubber-stamped by Darin Adler.
</del><ins>+        Force the script debug server to continue when disabling the debugger.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * editing/cocoa: Added.
-        * editing/cocoa/HTMLConverter.h: Copied from platform/mac/HTMLConverter.h.
-        * editing/cocoa/HTMLConverter.mm: Copied from platform/mac/HTMLConverter.mm.
-        * platform/mac/HTMLConverter.h: Removed.
-        * platform/mac/HTMLConverter.mm: Removed.
</del><ins>+        There might be some cases where the debugger will stay in the nested run loop
+        which cause weird issues.
</ins><span class="cx"> 
</span><del>-2014-03-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        Speculative fix for: https://webkit.org/b/111438
</ins><span class="cx"> 
</span><del>-        Simplify the HTMLConverter interface (Part 2)
-        https://bugs.webkit.org/show_bug.cgi?id=130654
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::disable):
</ins><span class="cx"> 
</span><del>-        Switch HTMLConverter from using an Objective-C interface to C functions.
</del><ins>+2013-05-16  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * editing/ios/EditorIOS.mm:
-        (WebCore::Editor::writeSelectionToPasteboard):
-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::dataSelectionForPasteboard):
-        (WebCore::Editor::writeSelectionToPasteboard):
-        * platform/ios/PasteboardIOS.mm:
-        * platform/mac/HTMLConverter.h:
-        * platform/mac/HTMLConverter.mm:
-        (WebCore::attributedStringFromRange):
-        (WebCore::editingAttributedStringFromRange):
-        * platform/mac/PasteboardMac.mm:
</del><ins>+        [BlackBerry] Get BlackBerry port off legacy clipboard
+        https://bugs.webkit.org/show_bug.cgi?id=116287
</ins><span class="cx"> 
</span><del>-2014-03-23  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Remove code in HTMLObjectElement attribute parsing that forces style resolution and layout
-        https://bugs.webkit.org/show_bug.cgi?id=130653
</del><ins>+        * PlatformBlackBerry.cmake: Removed ClipboardBlackBerry.cpp.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        * dom/Clipboard.h: Removed BLACKBERRY from the list of platforms that
+        use the legacy clipboard.
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp: Moved the post-attach callback code from here to
-        StyleResolveTree.h/cpp.
-        * dom/ContainerNode.h: Ditto.
</del><ins>+        * editing/blackberry/EditorBlackBerry.cpp:
+        (WebCore::Editor::newGeneralClipboard): Changed to just create a copy
+        and paste clipboard.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle): Use Style::PostResolutionCallbackDisabler instead of
-        PostAttachCallbackDisabler.
</del><ins>+        * page/blackberry/EventHandlerBlackBerry.cpp: Removed a drag-related
+        function that wasn't doing any good.
</ins><span class="cx"> 
</span><del>-        * dom/Element.h: Moved the post-attach callback code from here to StyleResolveTree.h/cpp.
</del><ins>+        * platform/blackberry/ClipboardBlackBerry.cpp: Removed.
+        * platform/blackberry/ClipboardBlackBerry.h: Removed.
</ins><span class="cx"> 
</span><del>-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseAttribute): Simplified the code for typeAttr, turning
-        it into a 1-liner. Added a FIXME in codeAttr about the fact that it does not have the
-        code to trigger image loads. Changed srcAttr to call updateImageLoaderWithNewURLSoon to
-        do the image loading logic.
</del><ins>+        * platform/blackberry/PasteboardBlackBerry.cpp:
+        (WebCore::Pasteboard::createForCopyAndPaste): Added.
+        (WebCore::Pasteboard::createPrivate): Added.
+        (WebCore::Pasteboard::hasData): Added. Moved code here from ClipboardBlackBerry.cpp.
+        (WebCore::Pasteboard::clear): Ditto.
+        (WebCore::Pasteboard::readString): Ditto.
+        (WebCore::Pasteboard::writeString): Ditto.
+        (WebCore::Pasteboard::types): Ditto.
+        (WebCore::Pasteboard::readFilenames): Ditto.
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::didAttachRenderers): Updated to use
-        Style::queuePostResolutionCallback and use a lambda instead of a function.
-        (WebCore::HTMLFormControlElement::didRecalcStyle): Ditto. Also added RefPtr instead
-        of just using wishful thinking to keep the object alive.
-        * html/HTMLFrameOwnerElement.cpp:
-        (WebCore::HTMLFrameOwnerElement::scheduleSetNeedsStyleRecalc): Ditto.
</del><ins>+2013-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseAttribute):: Simplified the code for typeAttr, turning
-        it into a 1-liner. Changed dataAttr to use updateImageLoaderWithNewURLSoon(). Also made
-        it call setNeedsWidgetUpdate(true) unconditionally after checking carefully to see that's
-        harmless if there is no renderer. Changed classidAttr to call setNeedsWidgetUpdate(true)
-        unconditionally and not set m_classId.
-        (WebCore::HTMLObjectElement::shouldAllowQuickTimeClassIdQuirk): Use fastGetAttribute
-        instead of classId and descendantsOfType instead of getElementsByTagName.
-        (WebCore::HTMLObjectElement::hasValidClassId): Use fastGetAttribute instead of classId.
-        (WebCore::HTMLObjectElement::renderFallbackContent): Use imageLoader instead of m_imageLoader.
</del><ins>+        Ads on theverge.com cause repaints when hovered, even though content doesn't visibly change.
+        &lt;http://webkit.org/b/116344&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLObjectElement.h: Removed classId, since there is no reason to cache that
-        attribute in a data member. Rearranged header, making more private, and fixing some typos,
-        and doing a &quot;using&quot; instead of a function to disambiguate the inherited form functions.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * html/HTMLPlugInImageElement.cpp:
-        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement): Initialize m_needsImageReload.
-        (WebCore::HTMLPlugInImageElement::createElementRenderer): Fixed some code that assumed the
-        first child of the shadow root is guaranteed to be an element.
-        (WebCore::HTMLPlugInImageElement::didRecalcStyle): Added. Calls the new
-        scheduleUpdateForAfterStyleResolution function.
-        (WebCore::HTMLPlugInImageElement::didAttachRenderers): Moved all the logic from this
-        function into scheduleUpdateForAfterStyleResolution. Also added a call through to the base
-        class; cleaner even though it's just an assertion.
-        (WebCore::HTMLPlugInImageElement::scheduleUpdateForAfterStyleResolution): Added.
-        Schedules a call to updateAfterStyleResolution when needed.
-        (WebCore::HTMLPlugInImageElement::updateAfterStyleResolution): Added.
-        Combines updateWidgetIfNecessary and startLoadingImage, and also deals with the new
-        m_needsImageReload boolean in cases where no actual loading is done.
-        (WebCore::HTMLPlugInImageElement::removedFrom): Added. Do not delay the load event of
-        document once this element is removed, clears m_needsImageReload.
-        (WebCore::HTMLPlugInImageElement::didMoveToNewDocument): Removed null check on oldDocument,
-        since m_needsDocumentActivationCallbacks can't be true if the old document was null.
-        (WebCore::is100Percent): Added helper to make function below more readable.
-        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Restructured the code a
-        bit. The part that attracted my attention was the local variable of type RenderBox, which
-        was named renderEmbeddedObject. Turns out the caller guarantees to only call this if there
-        is a renderer of type RenderEmbeddedObject, so depend on that.
-        (WebCore::HTMLPlugInImageElement::setNeedsImageReload): Added. When called with true, sets
-        the flag and triggers a style recalculation, and lets updateAfterStyleResolution do the rest.
-        When called with false, reverses the effects and stops delaying the load event.
</del><ins>+        Teach RenderStyle::diff() to ignore differences in the outline value if both styles have non-visible outlines.
</ins><span class="cx"> 
</span><del>-        * html/HTMLPlugInImageElement.h: Trimmed includes a bit. Made more members private.
-        Marked more function members final. Made a protected imageLoader function so that
-        m_imageLoader can be private. Added new protected function updateImageLoaderWithNewURLSoon,
-        as well as other new private functions. Made m_imageLoader be std::unique_ptr instead of
-        OwnPtr, and added m_needsImageReload.
</del><ins>+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/StyleBackgroundData.cpp:
+        (WebCore::StyleBackgroundData::isEquivalentForPainting):
+        * rendering/style/StyleBackgroundData.h:
+        (StyleBackgroundData):
</ins><span class="cx"> 
</span><del>-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::needsPseudoElement): Fixed spelling error in the name of this function.
-        (WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded): Updated for name change.
-        (WebCore::Style::attachRenderTree): Update for new name of PostResolutionCallbackDisabler.
-        (WebCore::Style::updateBeforeOrAfterPseudoElement): Updated for name change.
-        (WebCore::Style::postResolutionCallbackQueue): Added.
-        (WebCore::Style::queuePostResolutionCallback): Added.
-        (WebCore::Style::suspendMemoryCacheClientCalls): Added. This is a side effect of the original
-        PostAttachCallbackDisabler that is now done in a cleaner way, using the callback queue, instead
-        of as a special case. It should not work for multiple documents across multiple pages instead of
-        only the outermost one.
-        (WebCore::Style::PostResolutionCallbackDisabler::PostResolutionCallbackDisabler): Added.
-        Calls suspendMemoryCacheClientCalls, but a FIXME tries to point out why that isn't so great.
-        (WebCore::Style::PostResolutionCallbackDisabler::~PostResolutionCallbackDisabler): Added.
-        (WebCore::Style::postResolutionCallbacksAreSuspended): Added.
</del><ins>+2013-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * style/StyleResolveTree.h: Added queuePostResolutionCallback and
-        postResolutionCallbacksAreSuspended. Also added PostResolutionCallbackDisabler, which should
-        eventually become a private implementation detail.
</del><ins>+        Plug leak in CSSSelectorList::deleteSelectors().
+        &lt;http://webkit.org/b/116371&gt;
+        &lt;rdar://problem/13930698&gt;
</ins><span class="cx"> 
</span><del>-2014-03-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Simplify the HTMLConverter interface (Part 1)
-        https://bugs.webkit.org/show_bug.cgi?id=130654
</del><ins>+        Don't forget to destroy the very last selector in the list.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::deleteSelectors):
</ins><span class="cx"> 
</span><del>-        Convert WebHTMLConverter's interface to only use class methods as the first
-        step of simplifying the interface. 
</del><ins>+2013-05-17  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/ios/EditorIOS.mm:
-        (WebCore::attributedStringForRange):
-        * editing/mac/EditorMac.mm:
-        (WebCore::attributedStringForRange):
-        * platform/mac/HTMLConverter.h:
-        * platform/mac/HTMLConverter.mm:
-        (+[WebHTMLConverter attributedStringFromRange:]):
</del><ins>+        Share code between WebKit1 and WebKit2 StorageArea subclasses
+        https://bugs.webkit.org/show_bug.cgi?id=116367
</ins><span class="cx"> 
</span><del>-2014-03-23  James Craig  &lt;jcraig@apple.com&gt;
-
-        Web Inspector: AXI: add other ARIA one-to-many relationships: owns, flowto, controls.
-        https://bugs.webkit.org/show_bug.cgi?id=130635
-
-        Reviewed by Timothy Hatcher.
-
-        Support for @aria-owns, @aria-controls, and @aria-flowto.
-
-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
-
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/protocol/DOM.json:
-
-2014-03-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Clean up #includes by geometry classes
-        https://bugs.webkit.org/show_bug.cgi?id=130645
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Pulling in &lt;wtf/Vector.h&gt; and &lt;wtf/PrintStream.h&gt; in the simple geometry
-        classes brings in a lot of additional headers. Fix by adding a new
-        GeometryUtilities file so that the basic files don't need Vector,
-        and including GeometryUtilities.h where necessary.
-        
-        Also forward declare PrintStream.h and only bring in the header
-        in implementation files.
</del><ins>+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::getDOMStorageItems):
+        Remove ec parameter.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSToStyleMap.h:
-        * html/HTMLCanvasElement.cpp:
-        * platform/cairo/WidgetBackingStoreCairo.h:
-        * platform/graphics/FloatPoint.cpp:
-        * platform/graphics/FloatPoint.h:
-        * platform/graphics/FloatRect.cpp:
-        * platform/graphics/FloatRect.h:
-        * platform/graphics/FloatSize.cpp:
-        * platform/graphics/FloatSize.h:
-        * platform/graphics/GeometryUtilities.cpp: Added.
-        (WebCore::findSlope):
-        (WebCore::findIntersection):
-        (WebCore::unionRect):
-        (WebCore::mapRect):
-        * platform/graphics/GeometryUtilities.h: Copied from Source/WebCore/platform/graphics/TextTrackRepresentation.h.
-        * platform/graphics/IntPoint.h:
-        * platform/graphics/IntRect.cpp:
-        * platform/graphics/IntRect.h:
-        * platform/graphics/IntSize.h:
-        * platform/graphics/TextTrackRepresentation.h:
-        * platform/graphics/Tile.h:
-        * platform/graphics/texmap/coordinated/UpdateAtlas.h:
-        * platform/gtk/WidgetBackingStoreGtkX11.h:
-        * rendering/RenderBoxModelObject.cpp:
-        * rendering/RenderImage.cpp:
-        * rendering/RenderObject.cpp:
</del><ins>+        * inspector/InspectorDOMStorageAgent.h:
+        Add forward declaration.
</ins><span class="cx"> 
</span><del>-2014-03-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        Storage::StorageArea returns a reference now.
</ins><span class="cx"> 
</span><del>-        Clean up #includes by geometry classes
-        https://bugs.webkit.org/show_bug.cgi?id=130645
</del><ins>+        * storage/Storage.cpp:
+        (WebCore::Storage::length):
+        Check that the storage area can be accessed by the frame, and that it's not disabled by private browsing.
+        Then call down to the (now simplified) StorageArea::length().
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        (WebCore::Storage::isDisabledByPrivateBrowsing):
+        New helper function that's based on StorageAreaImpl::disabledByPrivateBrowsingInFrame, but reordered
+        to make it easier to follow.
</ins><span class="cx"> 
</span><del>-        Pulling in &lt;wtf/Vector.h&gt; and &lt;wtf/PrintStream.h&gt; in the simple geometry
-        classes brings in a lot of additional headers. Fix by adding a new
-        GeometryUtilities file so that the basic files don't need Vector,
-        and including GeometryUtilities.h where necessary.
-        
-        Also forward declare PrintStream.h and only bring in the header
-        in implementation files.
</del><ins>+        * storage/Storage.h:
+        (WebCore::Storage::area):
+        Return a reference.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSToStyleMap.h:
-        * html/HTMLCanvasElement.cpp:
-        * platform/cairo/WidgetBackingStoreCairo.h:
-        * platform/graphics/FloatPoint.cpp:
-        * platform/graphics/FloatPoint.h:
-        * platform/graphics/FloatRect.cpp:
-        * platform/graphics/FloatRect.h:
-        * platform/graphics/FloatSize.cpp:
-        * platform/graphics/FloatSize.h:
-        * platform/graphics/GeometryUtilities.cpp: Added.
-        (WebCore::findSlope):
-        (WebCore::findIntersection):
-        (WebCore::unionRect):
-        (WebCore::mapRect):
-        * platform/graphics/GeometryUtilities.h: Copied from Source/WebCore/platform/graphics/TextTrackRepresentation.h.
-        * platform/graphics/IntPoint.h:
-        * platform/graphics/IntRect.cpp:
-        * platform/graphics/IntRect.h:
-        * platform/graphics/IntSize.h:
-        * platform/graphics/TextTrackRepresentation.h:
-        * platform/graphics/Tile.h:
-        * platform/gtk/WidgetBackingStoreGtkX11.h:
-        * rendering/RenderBoxModelObject.cpp:
-        * rendering/RenderImage.cpp:
-        * rendering/RenderObject.cpp:
</del><ins>+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::storageType):
+        Add this new virtual member funciton that's needed by Storage::isDisabledByPrivateBrowsing.
</ins><span class="cx"> 
</span><del>-2014-03-22  Chang Shu  &lt;cshu@webkit.org&gt;
</del><ins>+        (WebCore::StorageAreaImpl::length):
+        Remove unneeded code.
</ins><span class="cx"> 
</span><del>-        Replace deprecatedIsCollapsibleWhitespace with RenderStyle::isCollapsibleWhiteSpace in TextIterator.
-        https://bugs.webkit.org/show_bug.cgi?id=130612.
</del><ins>+2013-05-17  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Unreviewed, rolling out r150294.
+        http://trac.webkit.org/changeset/150294
+        https://bugs.webkit.org/show_bug.cgi?id=116369
</ins><span class="cx"> 
</span><del>-        Some layout tests are affected by this change but the new behavior should be correct.
</del><ins>+        Caused 31 tests to fail (Requested by rniwa on #webkit).
</ins><span class="cx"> 
</span><del>-        * editing/TextIterator.cpp:
-        (WebCore::TextIterator::handleTextNode):
-        (WebCore::TextIterator::handleTextBox):
</del><ins>+        * WebCore.exp.in:
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.h:
+        (InlineTextBox):
+        * rendering/RenderApplet.h:
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        (WebCore::RenderBlock::virtualContinuation):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderBoundingBox):
+        (RenderBox):
+        (WebCore::RenderBox::marginLogicalLeft):
+        (WebCore::RenderBox::marginLogicalRight):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::isBoxModelObject):
+        * rendering/RenderButton.h:
+        * rendering/RenderCombineText.h:
+        * rendering/RenderCounter.h:
+        * rendering/RenderDeprecatedFlexibleBox.h:
+        * rendering/RenderDetailsMarker.h:
+        * rendering/RenderEmbeddedObject.h:
+        (RenderEmbeddedObject):
+        (WebCore::RenderEmbeddedObject::isEmbeddedObject):
+        (WebCore::RenderEmbeddedObject::virtualChildren):
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderFlexibleBox.h:
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderFullScreen.cpp:
+        * rendering/RenderFullScreen.h:
+        * rendering/RenderGrid.h:
+        * rendering/RenderHTMLCanvas.h:
+        * rendering/RenderIFrame.h:
+        * rendering/RenderImage.h:
+        (RenderImage):
+        (WebCore::RenderImage::isRenderImage):
+        * rendering/RenderInline.h:
+        (RenderInline):
+        (WebCore::RenderInline::virtualContinuation):
+        (WebCore::RenderInline::virtualChildren):
+        (WebCore::RenderInline::isRenderInline):
+        (WebCore::RenderInline::layout):
+        (WebCore::RenderInline::requiresLayer):
+        (WebCore::RenderInline::offsetWidth):
+        (WebCore::RenderInline::offsetHeight):
+        (WebCore::RenderInline::borderBoundingBox):
+        (WebCore::RenderInline::dirtyLinesFromChangedChild):
+        * rendering/RenderLayerModelObject.h:
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::virtualChildren):
+        (WebCore::RenderMedia::canHaveChildren):
+        (WebCore::RenderMedia::isMedia):
+        (WebCore::RenderMedia::isImage):
+        (WebCore::RenderMedia::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderMediaControlElements.h:
+        * rendering/RenderMenuList.h:
+        * rendering/RenderMeter.h:
+        * rendering/RenderMultiColumnBlock.h:
+        * rendering/RenderMultiColumnFlowThread.h:
+        * rendering/RenderMultiColumnSet.h:
+        * rendering/RenderNamedFlowThread.h:
+        * rendering/RenderPart.h:
+        (RenderPart):
+        (WebCore::RenderPart::isRenderPart):
+        (WebCore::RenderPart::renderName):
+        * rendering/RenderProgress.h:
+        * rendering/RenderRegion.h:
+        (WebCore::RenderRegion::isRenderRegion):
+        * rendering/RenderRegionSet.h:
+        * rendering/RenderReplaced.h:
+        (RenderReplaced):
+        (WebCore::RenderReplaced::renderName):
+        * rendering/RenderReplica.h:
+        * rendering/RenderRuby.h:
+        * rendering/RenderRubyBase.h:
+        * rendering/RenderRubyRun.h:
+        * rendering/RenderRubyText.h:
+        * rendering/RenderScrollbarPart.h:
+        * rendering/RenderSearchField.h:
+        * rendering/RenderSlider.h:
+        * rendering/RenderSnapshottedPlugIn.h:
+        (RenderSnapshottedPlugIn):
+        * rendering/RenderTable.h:
+        (RenderTable):
+        (WebCore::RenderTable::renderName):
+        (WebCore::RenderTable::isTable):
+        (WebCore::RenderTable::avoidsFloats):
+        * rendering/RenderTableCaption.h:
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.h:
+        (RenderText):
+        (WebCore::RenderText::marginLeft):
+        (WebCore::RenderText::marginRight):
+        (WebCore::RenderText::styleWillChange):
+        (WebCore::RenderText::length):
+        (WebCore::RenderText::paint):
+        (WebCore::RenderText::layout):
+        * rendering/RenderTextControl.h:
+        (RenderTextControl):
+        (WebCore::RenderTextControl::renderName):
+        (WebCore::RenderTextControl::isTextControl):
+        (WebCore::RenderTextControl::avoidsFloats):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::isTextField):
+        * rendering/RenderTextFragment.h:
+        * rendering/RenderTextTrackCue.h:
+        * rendering/RenderVideo.h:
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.h:
+        (RenderWidget):
+        (WebCore::RenderWidget::isWidget):
+        * rendering/RenderWordBreak.h:
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+        * rendering/mathml/RenderMathMLBlock.h:
+        * rendering/svg/RenderSVGBlock.h:
+        (RenderSVGBlock):
+        * rendering/svg/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::setNeedsBoundariesUpdate):
+        (WebCore::RenderSVGContainer::virtualChildren):
+        (WebCore::RenderSVGContainer::isSVGContainer):
+        (WebCore::RenderSVGContainer::renderName):
+        (RenderSVGContainer):
+        (WebCore::RenderSVGContainer::objectBoundingBox):
+        (WebCore::RenderSVGContainer::strokeBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/svg/RenderSVGEllipse.h:
+        * rendering/svg/RenderSVGForeignObject.h:
+        * rendering/svg/RenderSVGGradientStop.h:
+        * rendering/svg/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::renderName):
+        (RenderSVGHiddenContainer):
+        (WebCore::RenderSVGHiddenContainer::isSVGHiddenContainer):
+        * rendering/svg/RenderSVGImage.h:
+        * rendering/svg/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::renderName):
+        (WebCore::RenderSVGInline::requiresLayer):
+        (WebCore::RenderSVGInline::isSVGInline):
+        (RenderSVGInline):
+        * rendering/svg/RenderSVGInlineText.h:
+        * rendering/svg/RenderSVGModelObject.h:
+        (WebCore::RenderSVGModelObject::requiresLayer):
+        (RenderSVGModelObject):
+        * rendering/svg/RenderSVGPath.h:
+        * rendering/svg/RenderSVGRect.h:
+        * rendering/svg/RenderSVGResourceClipper.h:
+        * rendering/svg/RenderSVGResourceContainer.h:
+        (RenderSVGResourceContainer):
+        (WebCore::RenderSVGResourceContainer::isSVGResourceContainer):
+        (WebCore::RenderSVGResourceContainer::toRenderSVGResourceContainer):
+        * rendering/svg/RenderSVGResourceFilter.h:
+        * rendering/svg/RenderSVGResourceFilterPrimitive.h:
+        * rendering/svg/RenderSVGResourceGradient.h:
+        (RenderSVGResourceGradient):
+        (WebCore::RenderSVGResourceGradient::resourceBoundingBox):
+        * rendering/svg/RenderSVGResourceLinearGradient.h:
+        * rendering/svg/RenderSVGResourceMarker.h:
+        * rendering/svg/RenderSVGResourceMasker.h:
+        * rendering/svg/RenderSVGResourcePattern.h:
+        * rendering/svg/RenderSVGResourceRadialGradient.h:
+        * rendering/svg/RenderSVGRoot.h:
+        * rendering/svg/RenderSVGShape.h:
+        (WebCore::RenderSVGShape::setNeedsBoundariesUpdate):
+        (WebCore::RenderSVGShape::setNeedsTransformUpdate):
+        (WebCore::RenderSVGShape::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGShape::localToParentTransform):
+        (WebCore::RenderSVGShape::localTransform):
+        (WebCore::RenderSVGShape::isSVGShape):
+        (RenderSVGShape):
+        (WebCore::RenderSVGShape::objectBoundingBox):
+        (WebCore::RenderSVGShape::strokeBoundingBox):
+        * rendering/svg/RenderSVGTSpan.h:
+        * rendering/svg/RenderSVGText.h:
+        * rendering/svg/RenderSVGTextPath.h:
+        * rendering/svg/RenderSVGTransformableContainer.h:
+        * rendering/svg/RenderSVGViewportContainer.h:
</ins><span class="cx"> 
</span><del>-2014-03-22  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+2013-05-17  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Switch HTMLConverter to use CSSPropertyIDs to refer to CSS properties
-        https://bugs.webkit.org/show_bug.cgi?id=130639
</del><ins>+        Get rid of Custom code for Audio global constructor
+        https://bugs.webkit.org/show_bug.cgi?id=116343
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
-
-        This is a ~15% speedup on PerformanceTests/Interactive/CopyAll.html.
-
-        - Removes gratuitous lookup of CSS properties that are known at compile time.
-        - Removes attempted use of non-supported CSS properties (font-effect and horizontal-align) 
-          that will alway yield the same results.
-        - Fix some obvious typos where the author thought they were testing for fontKerning or fontLigatures
-          but instead used the non-existent font-effect.
-
-        * platform/mac/HTMLConverter.mm:
-        (HTMLConverterCaches::computedStylePropertyForElement):
-        (HTMLConverterCaches::inlineStylePropertyForElement):
-        (HTMLConverterCaches::propertyValueForNode):
-        (-[WebHTMLConverter _stringForNode:property:]):
-        (HTMLConverterCaches::floatPropertyValueForNode):
-        (-[WebHTMLConverter _getFloat:forNode:property:]):
-        (HTMLConverterCaches::isBlockElement):
-        (HTMLConverterCaches::elementHasOwnBackgroundColor):
-        (HTMLConverterCaches::colorPropertyValueForNode):
-        (-[WebHTMLConverter _colorForNode:property:]):
-        (-[WebHTMLConverter _computedAttributesForElement:]):
-        (-[WebHTMLConverter _addAttachmentForElement:URL:needsParagraph:usePlaceholder:]):
-        (-[WebHTMLConverter _fillInBlock:forElement:backgroundColor:extraMargin:extraPadding:isTable:]):
-        (-[WebHTMLConverter _addTableForElement:]):
-        (-[WebHTMLConverter _addTableCellForElement:]):
-        (-[WebHTMLConverter _processElement:tag:display:depth:]):
-        (-[WebHTMLConverter _exitElement:tag:display:depth:startIndex:]):
-        (-[WebHTMLConverter _processText:]):
-        (-[WebHTMLConverter _traverseNode:depth:embedded:]):
-
-2014-03-22  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Fix debug build.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::createWrapper):
-
-2014-03-22  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
-
-        Add *final* keyword to NavigatorContentUtils class
-        https://bugs.webkit.org/show_bug.cgi?id=130636
-
-        Reviewed by Darin Adler.
-
-        NavigatorContentUtils won't be used as a base class. So, added final keyword.
-
-        No new tests, no behavior changes.
-
-        * Modules/navigatorcontentutils/NavigatorContentUtils.h:
-
-2014-03-22  Andreas Kling  &lt;akling@apple.com&gt;
-
-        CREATE_DOM_WRAPPER doesn't need the ExecState.
-        &lt;https://webkit.org/b/130648&gt;
-
-        Remove the ExecState parameter from CREATE_DOM_WRAPPER and get all
-        that we need from the global object instead.
-
-        toJS() and toJSNewlyCreated() still take an ExecState, that needs
-        to be dealt with separately since some of them have scary looking
-        currentWorld() checks.
-
-        Reviewed by Darin Adler.
-
-        * bindings/js/JSAudioContextCustom.cpp:
-        (WebCore::JSAudioContextConstructor::constructJSAudioContext):
-        * bindings/js/JSBlobCustom.cpp:
-        (WebCore::toJS):
-        (WebCore::JSBlobConstructor::constructJSBlob):
-        * bindings/js/JSCDATASectionCustom.cpp:
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSCanvasRenderingContextCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::createWrapper):
-        (WebCore::wrap):
-        (WebCore::createNewWrapper):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLTemplateElementCustom.cpp:
-        (WebCore::JSHTMLTemplateElement::content):
-        * bindings/js/JSIDBAnyCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSMediaStreamCapabilitiesCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::createWrapperInline):
-        * bindings/js/JSPerformanceEntryCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSRTCIceCandidateCustom.cpp:
-        (WebCore::JSRTCIceCandidateConstructor::constructJSRTCIceCandidate):
-        * bindings/js/JSRTCPeerConnectionCustom.cpp:
-        (WebCore::JSRTCPeerConnectionConstructor::constructJSRTCPeerConnection):
-        * bindings/js/JSRTCSessionDescriptionCustom.cpp:
-        (WebCore::JSRTCSessionDescriptionConstructor::constructJSRTCSessionDescription):
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSTextTrackCueCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSTouchCustom.cpp:
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSTouchListCustom.cpp:
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSTrackCustom.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        * dom/make_names.pl:
-        (printWrapperFunctions):
-        (printWrapperFactoryCppFile):
-        (printWrapperFactoryHeaderFile):
-
-2014-03-22  Michael Saboff  &lt;msaboff@apple.com&gt;
-
-        toThis() on a JSWorkerGlobalScope should return a JSProxy and not undefined
-        https://bugs.webkit.org/show_bug.cgi?id=130554
-
</del><span class="cx">         Reviewed by Geoffrey Garen.
</span><span class="cx"> 
</span><del>-        Fixed toThis() on WorkerGlobalScope to return a JSProxy instead of the JSGlobalObject.
-        Added cast from JSProxy-&gt;target() if the jsCast&lt;&gt;() to the native object fails
-        in toJSDedicatedWorkerGlobalScope() and toJSSharedWorkerGlobalScope().
-        The original cast is needed for access to the local side of the worker, while the JSProxy
-        cast is used on the remote side of a worker.
</del><ins>+        Remove custom code for Audio global constructor. It is no longer needed
+        now that the the bindings generator no longer require custom code for
+        named constructors and now that [EnabledAtRuntime] extended attribute is
+        supported for global constructors.
</ins><span class="cx"> 
</span><del>-        Test: fast/workers/worker-strict.html
</del><ins>+        HTMLAudioElement global constructors are now automatically generated.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSWorkerGlobalScopeBase.cpp:
-        (WebCore::toJSDedicatedWorkerGlobalScope):
-        (WebCore::toJSSharedWorkerGlobalScope):
</del><ins>+        No new tests, no behavior change for layout tests.
</ins><span class="cx"> 
</span><del>-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate): Changed to pass in the JSProxy and not
-        the WorkerGlobalScope object as the this object to script evaluation.
</del><ins>+        * bindings/js/JSDOMWindowCustom.cpp:
+        * html/HTMLAudioElement.idl:
+        * page/DOMWindow.idl:
</ins><span class="cx"> 
</span><del>-        * workers/DedicatedWorkerGlobalScope.idl:
-        * workers/SharedWorkerGlobalScope.idl:
-        * workers/WorkerGlobalScope.idl:
-        Added the new CustomProxyToJSObject attribute so we'll call to&lt;{nativeClass}&gt;() for
-        getting the object to use for global evaluation.
</del><ins>+2013-05-17  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        &lt;rdar://problem/13819878&gt; Disable SharedWorker when in multiple web process model
+        https://bugs.webkit.org/show_bug.cgi?id=116359
</ins><span class="cx"> 
</span><del>-        Some #include hygiene in Node/Element etc
-        https://bugs.webkit.org/show_bug.cgi?id=130642
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        This feature was already RuntimeEnabled. Call through layers to get the answer from
+        a platform strategy.
</ins><span class="cx"> 
</span><del>-        Clean up various #includes.
</del><ins>+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::DefaultSharedWorkerRepository::isAvailable):
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::isAvailable):
+        * workers/SharedWorkerStrategy.h:
+        (WebCore::SharedWorkerStrategy::isAvailable):
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.h:
-        * bindings/js/WebCoreTypedArrayController.h:
-        * dom/Element.h:
-        * dom/EventListenerMap.h:
-        * dom/EventTarget.h:
-        * dom/Node.h:
-        * rendering/RenderObject.h:
-        * rendering/svg/RenderSVGRoot.h:
</del><ins>+2013-05-17  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Move Storage member functions out of line
+        https://bugs.webkit.org/show_bug.cgi?id=116364
</ins><span class="cx"> 
</span><del>-        FloatRect.h on iOS should not suck in a system header
-        https://bugs.webkit.org/show_bug.cgi?id=130641
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoff Garen.
</del><ins>+        This is preparation for sharing more code between the WebKit1 and WebKit2 storage area subclasses.
+        Also remove unnecessary null checks and make m_storageArea const.
</ins><span class="cx"> 
</span><del>-        Don't pull in &lt;CoreGraphics/CGGeometry.h&gt; from FloatRect.h.
</del><ins>+        * storage/Storage.cpp:
+        (WebCore::Storage::length):
+        (WebCore::Storage::key):
+        (WebCore::Storage::getItem):
+        (WebCore::Storage::setItem):
+        (WebCore::Storage::removeItem):
+        (WebCore::Storage::clear):
+        (WebCore::Storage::contains):
+        * storage/Storage.h:
+        (WebCore::Storage::area):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/FloatRect.h:
</del><ins>+2013-05-17  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-22  Dan Bernstein  &lt;mitz@apple.com&gt;
</del><ins>+        Headers and footers will sometimes disappear and re-appear during page loads
+        https://bugs.webkit.org/show_bug.cgi?id=116336
+        -and corresponding-
+        &lt;rdar://problem/13886753&gt;
</ins><span class="cx"> 
</span><del>-        Fixed the iOS build.
-
-        Reviewed by Darin Adler.
-
-        * page/ios/FrameIOS.mm:
-        (WebCore::Frame::interpretationsForCurrentRoot):
-
-2014-03-22  Darin Adler  &lt;darin@apple.com&gt;
-
-        Remove String::deprecatedCharacters
-        https://bugs.webkit.org/show_bug.cgi?id=126854
-
-        Reviewed by Sam Weinig.
-
-        * bindings/scripts/StaticString.pm:
-        (GenerateStrings): Remove the code to generate the null m_copyData16 pointer.
-
-        * editing/TextIterator.cpp:
-        (WebCore::SearchBuffer::prependContext): Changed to use the new append function in
-        StringView.h and removed the one defined locally here.
-
-        * editing/VisibleUnits.cpp:
-        (WebCore::wordBreakIteratorForMinOffsetBoundary): Use the new append function
-        in StringView.h instead of using deprecatedCharacters.
-        (WebCore::wordBreakIteratorForMaxOffsetBoundary): Ditto.
-        Removed an append function defined locally here and use the one in StringView.h.
-
-        * editing/htmlediting.cpp:
-        (WebCore::stringWithRebalancedWhitespace): Use StringView::getCharactersWithUpconvert.
-
-        * html/parser/HTMLToken.h:
-        (WebCore::HTMLToken::appendToAttributeValue): Changed to take a StringView instead
-        of a const String&amp;.
-
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest): Use StringView and StringView::upconvertedCharacters.
-
-        * page/EventSource.cpp:
-        (WebCore::EventSource::didReceiveData): Use the new append overload from StringView.h.
-        Also added a comment about incorrect use of the decode function.
-
-        * page/ios/FrameIOS.mm:
-        (WebCore::Frame::interpretationsForCurrentRoot): Use the new StringView append function.
-        Also use simpler new-style for loops.
-
-        * platform/LinkHash.cpp:
-        (WebCore::visitedURLInline): Use the new append function and StringView::substring.
-        (WebCore::visitedLinkHash): Use upconvertedCharacters for the non-8-bit case.
-
-        * platform/URL.cpp:
-        (WebCore::findFirstOf): Chagned to take a StringView.
-        (WebCore::containsOnlyASCII): Added. Works on StringView. Could move to a WTF header in
-        the future if it's needed elsewhere.
-        (WebCore::protocolIs): Added. Works on StringView. Could put in URL.h if needed elsewhere,
-        or consider replacing the one that takes const String&amp; with just this one.
-        (WebCore::appendEncodedHostname): Changed to take a StringView and use
-        StringView::upconvertedCharacters.
-        (WebCore::findHostnamesInMailToURL): Changed to take a StringView.
-        (WebCore::findHostnameInHierarchicalURL): Ditto.
-        (WebCore::encodeHostnames): Ditto.
-        (WebCore::encodeRelativeString): Ditto.
-
-        * platform/graphics/StringTruncator.cpp:
-        (WebCore::StringTruncator::width): Use StringView::upconvertedCharacters.
-
-        * platform/graphics/harfbuzz/HarfBuzzShaper.cpp:
-        (WebCore::HarfBuzzShaper::setFontFeatures): Use indexing directly on the string instead
-        of on a UChar*.
-        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns): Use StringView::upconvertedCharacters.
-
-        * platform/text/TextCodecICU.cpp:
-        (WebCore::TextCodecICU::encode): Use a Vector&lt;UChar&gt; rather than a String to copy and
-        replace the backslashes with yen signs. Also optimize case where there are no backslashes.
-
-        * rendering/RenderListMarker.cpp:
-        (WebCore::RenderListMarker::paint): Use TextRun::setText(StringView).
-
-        * rendering/RenderText.cpp:
-        (WebCore::maxWordFragmentWidth): Pass a String to RenderBlock::constructTextRun instead of
-        calling StringBuilder::deprecatedCharacters.
-
-        * rendering/RenderText.h: Removed deprecatedCharacters function.
-
-        * rendering/line/BreakingContextInlineHeaders.h: Added now-needed header include.
-
-        * rendering/svg/SVGInlineTextBox.cpp:
-        (WebCore::SVGInlineTextBox::constructTextRun): Use StringView version of TextRun constructor.
-
-        * rendering/svg/SVGTextMetrics.cpp:
-        (WebCore::SVGTextMetrics::SVGTextMetrics): Take references instead of pointers.
-        (WebCore::SVGTextMetrics::constructTextRun): Take references instead of pointers, and don't
-        take a character pointer any more. Instead, extract the text and use the StringView version of
-        the TextRun constructor.
-        (WebCore::SVGTextMetrics::measureCharacterRange): Take references instead of pointers and
-        update for above changes.
-        * rendering/svg/SVGTextMetrics.h: Updated for changes above. Also tweaked style a bit.
-
-        * rendering/svg/SVGTextMetricsBuilder.cpp:
-        (WebCore::SVGTextMetricsBuilder::advanceSimpleText): Updated for SVGTextMetrics changes.
-        (WebCore::SVGTextMetricsBuilder::advanceComplexText): Ditto.
-        (WebCore::SVGTextMetricsBuilder::initializeMeasurementWithTextRenderer): Ditto.
-        (WebCore::SVGTextMetricsBuilder::measureTextRenderer): Change code to store a character
-        for lastCharacter rather than storing a pointer to a character. Stop using TextRun::data16.
-
-        * rendering/svg/SVGTextQuery.cpp:
-        (WebCore::SVGTextQuery::subStringLengthCallback): Updated for SVGTextMetrics changes.
-        (WebCore::SVGTextQuery::startPositionOfCharacterCallback): Ditto.
-        (WebCore::SVGTextQuery::endPositionOfCharacterCallback): Ditto.
-        (WebCore::calculateGlyphBoundaries): Ditto.
-
-        * xml/XPathFunctions.cpp:
-        (WebCore::XPath::atomicSubstring): Added.
-        (WebCore::XPath::FunId::evaluate): Tweaked a bit to use a new style for loop.
-        Use the atomicSubstring function to avoid making a temporary String just to make an AtomicString.
-        That function also uses characters8/16 rather than depreccatedCharacters.
-
-        * xml/XPathNodeSet.h: Added begin and end so this collection can be iterated with new style for loop.
-
-        * xml/parser/XMLDocumentParserLibxml2.cpp:
-        (WebCore::XMLDocumentParser::doWrite): Use StringView::upconvertedCharacters.
-        (WebCore::parseAttributes): Ditto.
-
-2014-03-22  Commit Queue  &lt;commit-queue@webkit.org&gt;
-
-        Unreviewed, rolling out r166118.
-        https://bugs.webkit.org/show_bug.cgi?id=130640
-
-        Crashing things (Requested by weinig on #webkit).
-
-        Reverted changeset:
-
-        &quot;Switch HTMLConverter to use CSSPropertyIDs to refer to CSS
-        properties&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130639
-        http://trac.webkit.org/changeset/166118
-
-2014-03-22  Sam Weinig  &lt;sam@webkit.org&gt;
-
-        Switch HTMLConverter to use CSSPropertyIDs to refer to CSS properties
-        https://bugs.webkit.org/show_bug.cgi?id=130639
-
</del><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        This is a ~15% speedup on PerformanceTests/Interactive/CopyAll.html.
</del><ins>+        This patch changes the WebCore-level API that WebKit uses to create a banner. 
+        Specifically this patch removes FrameView::setWantsLayerForHeader(), which created 
+        and returned a layer. Instead, WK2 will call Page::addHeaderWithHeight(). When the 
+        layer has been created, it will call back into WK2 via ChromeClient. This will 
+        allow WebCore to re-create the header/footer layers as needed whenever the 
+        FrameView/RenderLayerCompositor have been destroyed and recreated.
</ins><span class="cx"> 
</span><del>-        - Removes gratuitous lookup of CSS properties that are known at compile time.
-        - Removes attempted use of non-supported CSS properties (font-effect and horizontal-align) 
-          that will alway yield the same results.
-        - Fix some obvious typos where the author thought they were testing for fontKerning or fontLigatures
-          but instead used the non-existent font-effect.
</del><ins>+        Remove references to old FrameView functions. Add references to new Page 
+        functions.
+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.mm:
-        (HTMLConverterCaches::computedStylePropertyForElement):
-        (HTMLConverterCaches::inlineStylePropertyForElement):
-        (HTMLConverterCaches::propertyValueForNode):
-        (-[WebHTMLConverter _stringForNode:property:]):
-        (HTMLConverterCaches::floatPropertyValueForNode):
-        (-[WebHTMLConverter _getFloat:forNode:property:]):
-        (HTMLConverterCaches::isBlockElement):
-        (HTMLConverterCaches::elementHasOwnBackgroundColor):
-        (HTMLConverterCaches::colorPropertyValueForNode):
-        (-[WebHTMLConverter _colorForNode:property:]):
-        (-[WebHTMLConverter _computedAttributesForElement:]):
-        (-[WebHTMLConverter _addAttachmentForElement:URL:needsParagraph:usePlaceholder:]):
-        (-[WebHTMLConverter _fillInBlock:forElement:backgroundColor:extraMargin:extraPadding:isTable:]):
-        (-[WebHTMLConverter _addTableForElement:]):
-        (-[WebHTMLConverter _addTableCellForElement:]):
-        (-[WebHTMLConverter _processElement:tag:display:depth:]):
-        (-[WebHTMLConverter _exitElement:tag:display:depth:startIndex:]):
-        (-[WebHTMLConverter _processText:]):
-        (-[WebHTMLConverter _traverseNode:depth:embedded:]):
</del><ins>+        New ChromeClient functions will pass the new layers up to WK2.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::didAddHeaderLayer):
+        (WebCore::ChromeClient::didAddFooterLayer):
+        (ChromeClient):
</ins><span class="cx"> 
</span><del>-2014-03-21  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Don't flush compositing layers within FrameView::willPaintContents()
-        https://bugs.webkit.org/show_bug.cgi?id=130627
-        &lt;rdar://problem/16368869&gt;
-
-        Reviewed by Sam Weinig.
-
-        Remove the call to flushCompositingStateForThisFrame() here. We should
-        have always flushed before painting via other mechanisms in WebKit2 and WebKit2.
-        Flushing during painting is actually harmful, since we could be inside
-        a CA commit already, and creating or destroying layers via flushing is bad.
-
</del><ins>+        Remove setWantsLayerForHeader/Footer.
</ins><span class="cx">         * page/FrameView.cpp:
</span><del>-        (WebCore::FrameView::willPaintContents):
</del><ins>+        * page/FrameView.h:
+        (FrameView):
</ins><span class="cx"> 
</span><del>-2014-03-22  Martin Hodovan  &lt;mhodovan@inf.u-szeged.hu&gt;
</del><ins>+        Page now caches the header and footer height. When the FrameView/RLC have been 
+        destroyed, and the cached layer/height information on those classes has been lost, 
+        this data on Page will persist so that we can build the layers back up.
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::addHeaderWithHeight):
+        (WebCore::Page::addFooterWithHeight):
+        * page/Page.h:
+        (WebCore::Page::headerHeight):
+        (WebCore::Page::footerHeight):
</ins><span class="cx"> 
</span><del>-        ASSERTION FAILED: std::isfinite(num) in WebCore::CSSPrimitiveValue::CSSPrimitiveValue
-        https://bugs.webkit.org/show_bug.cgi?id=127361
-
-        Huge numbers represented by the 'INF' value can not be used
-        in CSS rules, so they make the assert fail. We have to make
-        sure that the parsed property value is finite, otherwise
-        the property will be dropped.
-
-        Test: fast/css/infinite-floating-value.html
-
-        * css/CSSValuePool.cpp:
-        (WebCore::CSSValuePool::createValue):
-
-2014-03-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Remove redundant friending from class Image.
-        https://bugs.webkit.org/show_bug.cgi?id=130628
-
-        Reviewed by Simon Fraser.
-
-        Those friend classes are subclasses. No need to make them friend of their parent class.
-
-        No change in functionality.
-
-        * platform/graphics/Image.h:
-
-2014-03-21  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
-
-        [iOS][WK2] Reduce the tiling coverage to the current rect and 1 tile size ahead
-        https://bugs.webkit.org/show_bug.cgi?id=130555
-
-        Reviewed by Simon Fraser.
-
-        * WebCore.exp.in:
-        * platform/ScrollView.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::computeTileCoverageRect):
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::setScrollVelocityInformation):
-        (WebCore::ScrollView::computeCoverageRect):
</del><ins>+        As soon as the root gets a backing, recreate the header and footer layers if 
+        needed.
</ins><span class="cx">         * rendering/RenderLayerCompositor.cpp:
</span><del>-        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
</del><ins>+        (WebCore::RenderLayerCompositor::updateBacking):
</ins><span class="cx"> 
</span><del>-2014-03-21  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Call into ChromeClient.
+        (WebCore::RenderLayerCompositor::updateLayerForHeader):
+        (WebCore::RenderLayerCompositor::updateLayerForFooter):
</ins><span class="cx"> 
</span><del>-        [iOS] clean up fullscreen player controller when exiting fullscreen
-        https://bugs.webkit.org/show_bug.cgi?id=130621
</del><ins>+2013-05-18  Claudio Saavedra  &lt;csaavedra@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        [CSS] Minor cleanups in CSS variables handling
+        https://bugs.webkit.org/show_bug.cgi?id=116318
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (-[WebAVVideoLayer setBounds:]): Do nothing if _avPlayerController is nil.
-        (-[WebAVVideoLayer setVideoLayerGravity:]): Ditto.
-        (WebVideoFullscreenInterfaceAVKit::exitFullscreen): Set m_playerViewController delegate
-            and player controller to nil.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-03-21  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        No new tests, only a cleanup.
</ins><span class="cx"> 
</span><del>-        [iOS] remote command callbacks must happen on the WebThread
-        https://bugs.webkit.org/show_bug.cgi?id=130618
</del><ins>+        * css/CSSParser.cpp:
+        (WebCore::CSSParserString::substring): Optimize.
+        (WebCore::CSSParser::createPrimitiveVariableNameValue):
+        Remove intermediate variable.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+2013-05-17  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/RemoteCommandListenerIOS.h:
-        (WebCore::RemoteCommandListenerIOS::createWeakPtr):
-        * platform/ios/RemoteCommandListenerIOS.mm:
-        (WebCore::RemoteCommandListenerIOS::RemoteCommandListenerIOS): Dispatch commands to the
-            main thread before making listener callbacks.
</del><ins>+        [Mac] Add DOMWindowConstructors.idl to Xcode project file
+        https://bugs.webkit.org/show_bug.cgi?id=116351
</ins><span class="cx"> 
</span><del>-2014-03-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Make &lt;img&gt; positioning subpixel aware.
-        https://bugs.webkit.org/show_bug.cgi?id=130596
</del><ins>+        * WebCore.xcodeproj/project.pbxproj: Added the file, so that Xcode includes it
+        in searches.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-17  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Change &lt;img&gt; positioning from integral to device pixel. It enables us
-        to paint hairline borders around &lt;img&gt; properly.
-        This patch changes the behavior of broken image representation from constant 1 CSS px border
-        to a dynamic 1 device px.
</del><ins>+        Remove the declaration of Element::detachAttrNodeAtIndex erroneously added in r150072.
</ins><span class="cx"> 
</span><del>-        Test: fast/images/hidpi-image-position-on-device-pixels.html
</del><ins>+        * dom/Element.h:
+        (Element):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::drawImage):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        * platform/graphics/wince/GraphicsContextWinCE.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::paintReplaced):
-        (WebCore::RenderImage::paintIntoRect):
-        * rendering/RenderImage.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::drawPlatformResizerImage):
</del><ins>+2013-05-17  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        WKKeyValueStorageManagerGetKeyValueStorageOrigins should get origins from the UI process
+        https://bugs.webkit.org/show_bug.cgi?id=116346
+        &lt;rdar://problem/13852829&gt;
</ins><span class="cx"> 
</span><del>-        Merge VTTScanner Code from Blink
-        https://bugs.webkit.org/show_bug.cgi?id=130616
-
-        Reviewed by Eric Carlson.
-
-        Merged from Blink (patch by fs@opera.com):
-        https://chromium.googlesource.com/chromium/blink/+/f1ceb058d574a1174b524c57f67350510a942071
-        http://crbug.com/75273002
-        https://chromium.googlesource.com/chromium/blink/+/3e2c67969486e86347b328c72c67cacabfe6f4a1
-        http://crbug.com/134173002
-        https://chromium.googlesource.com/chromium/blink/+/5962b7bbb001838f3fc7f24817637528b86bfd9b
-        http://crbug.com/134153002
-        https://chromium.googlesource.com/chromium/blink/+/6c81f51438013edca920a19fc6a31026fc562af2
-        http://crbug.com/137033002
-        https://chromium.googlesource.com/chromium/blink/+/fa286dca17a291da3ae8be80111e2264de6d5cfd
-        http://crbug.com/140503004
-        https://chromium.googlesource.com/chromium/blink/+/8f33b63aabcce7dd21dd15288d45c4eb37c02001
-        http://crbug.com/139343006
-        https://chromium.googlesource.com/chromium/blink/+/1872b54b908fac525f1ad9d6f15174b11e27c8af
-        http://crbug.com/143983002
-        https://chromium.googlesource.com/chromium/blink/+/e6494b3359e2077bd8772d86ab1fb709acf4c398
-        http://crbug.com/144893002

-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/track/ParsingUtilities.h: Added.
-        (skipExactly):
-        (skipUntil):
-        (skipWhile):
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::markFutureAndPastNodes):
-        (WebCore::VTTCue::settingName):
-        (WebCore::scanPercentage):
-        (WebCore::VTTCue::setCueSettings):
-        * html/track/VTTCue.h:
-        * html/track/VTTRegion.cpp:
-        (WebCore::VTTRegion::setRegionSettings):
-        (WebCore::VTTRegion::scanSettingName):
-        (WebCore::parsedEntireRun):
-        (WebCore::VTTRegion::parseSettingValue):
-        * html/track/VTTRegion.h:
-        * html/track/VTTScanner.cpp: Added.
-        (WebCore::VTTScanner::VTTScanner):
-        (WebCore::VTTScanner::scan):
-        (WebCore::VTTScanner::scanRun):
-        (WebCore::VTTScanner::skipRun):
-        (WebCore::VTTScanner::extractString):
-        (WebCore::VTTScanner::restOfInputAsString):
-        (WebCore::VTTScanner::scanDigits):
-        (WebCore::VTTScanner::scanFloat):
-        * html/track/VTTScanner.h: Added.
-        (WebCore::VTTScanner::Run::Run):
-        (WebCore::VTTScanner::Run::start):
-        (WebCore::VTTScanner::Run::end):
-        (WebCore::VTTScanner::Run::isEmpty):
-        (WebCore::VTTScanner::isAt):
-        (WebCore::VTTScanner::isAtEnd):
-        (WebCore::VTTScanner::match):
-        (WebCore::VTTScanner::position):
-        (WebCore::VTTScanner::end):
-        (WebCore::VTTScanner::LCharPredicateAdapter):
-        (WebCore::VTTScanner::Run::length):
-        (WebCore::VTTScanner::scan):
-        (WebCore::VTTScanner::skipWhile):
-        (WebCore::VTTScanner::skipUntil):
-        (WebCore::VTTScanner::collectWhile):
-        (WebCore::VTTScanner::collectUntil):
-        (WebCore::VTTScanner::seekTo):
-        (WebCore::VTTScanner::currentChar):
-        (WebCore::VTTScanner::advance):
-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTParser::parseFloatPercentageValue):
-        (WebCore::WebVTTParser::parseFloatPercentageValuePair):
-        (WebCore::WebVTTParser::collectTimingsAndSettings):
-        (WebCore::WebVTTParser::collectTimeStamp):
-        (WebCore::WebVTTTreeBuilder::constructTreeFromToken):
-        * html/track/WebVTTParser.h:
-
-2014-03-21  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
-
-        Pseudo type cleanup part 2: split pseudo elements parsing
-        https://bugs.webkit.org/show_bug.cgi?id=130370
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        With this patch, pseudo elements are handled separately. The only thing left in
-        the old path is compatibility pseudo elements and pseudo classes.
</del><ins>+        Export the UTF8Encoding symbol.
</ins><span class="cx"> 
</span><del>-        The list of special pseudo elements is now separated and is stored in SelectorPseudoElementTypeMap.in.
-        The script makeSelectorPseudoElementsMap.py takes that list to make the pseudo elements hash table.
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        The other pseudo elements are the prefixed ones, they are filtered in CSSSelector::parsePseudoElementType().
</del><ins>+2013-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        All the non-compatibility selectors are removed from SelectorPseudoTypeMap.in. CSSParserSelector::setPseudoTypeValue()
-        is updated accordingly. The next step will be to clean that part.
</del><ins>+        Apply FINAL to the RenderObject hierarchy.
+        &lt;http://webkit.org/b/115977&gt;
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::CSSComputedStyleDeclaration):
-        * css/CSSGrammar.y.in:
-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserSelector::parsePseudoElementSelector):
-        (WebCore::CSSParserSelector::parsePseudoCueFunctionSelector):
-        (WebCore::CSSParserSelector::setPseudoTypeValue):
-        * css/CSSParserValues.h:
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::parsePseudoElementType):
-        * css/CSSSelector.h:
-        * css/SelectorPseudoElementTypeMap.in: Added.
-        * css/SelectorPseudoTypeMap.h:
-        * css/SelectorPseudoTypeMap.in:
-        * css/html.css:
-        (q::before):
-        (q::after):
-        * css/makeSelectorPseudoElementsMap.py: Added.
-        (enumerablePseudoType):
-        (expand_ifdef_condition):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::getMatchedCSSRules):
</del><ins>+        Mostly from Blink r148795 by &lt;cevans@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=148795&gt;
</ins><span class="cx"> 
</span><del>-2014-03-20  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Re-landing without devirtualization tweaks.
</ins><span class="cx"> 
</span><del>-        Less inclusion of JSCInlines.h.
-        &lt;https://webkit.org/b/130545&gt;
</del><ins>+        * rendering/: Beat things with the FINAL stick.
+        * WebCore.exp.in: Export a now-needed symbol.
</ins><span class="cx"> 
</span><del>-        Stop including JSCInlines.h from JSDOMGlobalObject.h!
</del><ins>+2013-05-17  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Build fix.
</ins><span class="cx"> 
</span><del>-        * ForwardingHeaders/runtime/IdentifierInlines.h: Added.
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        * bindings/js/JSCommandLineAPIHostCustom.cpp:
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMStringMapCustom.cpp:
-        * bindings/js/JSHTMLAllCollectionCustom.cpp:
-        * bindings/js/JSHTMLFormControlsCollectionCustom.cpp:
-        * bindings/js/JSLazyEventListener.cpp:
-        * bindings/js/JSSQLResultSetRowListCustom.cpp:
-        * bindings/js/JSStorageCustom.cpp:
-        * bindings/js/ScriptGlobalObject.cpp:
-        * dom/NodeIterator.cpp:
-        * dom/TreeWalker.cpp:
-        * testing/Internals.cpp:
-        * testing/js/WebCoreTestSupport.cpp:
</del><ins>+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::willTransitionToCommitted):
+        Frame:editor() now returns a reference.
</ins><span class="cx"> 
</span><del>-2014-03-21  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+2013-05-17  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix a crash when assigning an object to document.location
-        https://bugs.webkit.org/show_bug.cgi?id=130213
</del><ins>+        Get rid of [ConstructorParameters] extended attributes
+        https://bugs.webkit.org/show_bug.cgi?id=116308
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Convert location to string before we make use the document.
-        This prevents us from attempting to navigate a frame that
-        has already been removed.
</del><ins>+        Get rid of WebKit-specific [ConstructorParameters] IDL extended attribute. Instead,
+        [CustomConstructor] arguments are now explicitly specified, similarly to [Constructor]
+        arguments and the constructor object's &quot;length&quot; property is now automatically
+        computed for custom constructors as well.
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/navigation-with-sideeffects-crash.html
</del><ins>+        This is less error-prone as the value is not hardcoded, more consistent with
+        [Constructor] extended attribute and gives more information about the custom constructor
+        in the IDL file. We also get rid of a WebKit-specific IDL attribute which is always
+        nice.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::location):
-        (WebCore::JSDocument::setLocation):
</del><ins>+        No new tests, already covered by fast/js/constructor-length.html.
</ins><span class="cx"> 
</span><del>-2014-03-21  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        * Modules/mediastream/MediaStream.idl:
+        * Modules/webaudio/AudioContext.idl:
+        * Modules/websockets/WebSocket.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorHelperMethods):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/IDLParser.pm:
+        (applyTypedefs):
+        (parseAttributeRest):
+        (copyExtendedAttributes):
+        (parseExtendedAttributeRest):
+        (applyExtendedAttributeList):
+        * bindings/scripts/test/JS/JSFloat64Array.cpp:
+        (WebCore::JSFloat64ArrayConstructor::finishCreation):
+        * bindings/scripts/test/TestTypedArray.idl:
+        * dom/MutationObserver.idl:
+        * fileapi/Blob.idl:
+        * html/DOMFormData.idl:
+        * html/canvas/ArrayBuffer.idl:
+        * html/canvas/DataView.idl:
+        * page/WebKitPoint.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
</ins><span class="cx"> 
</span><del>-        Web Replay: replay controller is improperly setting user input bridge state
-        https://bugs.webkit.org/show_bug.cgi?id=130606
</del><ins>+2013-05-17  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Text input is largely broken when there are subframes loading
+        http://bugs.webkit.org/show_bug.cgi?id=59121
+        &lt;rdar://problem/9320468&gt;
</ins><span class="cx"> 
</span><del>-        The user input bridge was being set based on the old session state,
-        rather than the new session state.
-
-        * replay/ReplayController.cpp:
-        (WebCore::ReplayController::setSessionState):
-
-2014-03-21  James Craig  &lt;jcraig@apple.com&gt;
-
-        Web Inspector: AXI: Expose Accessibility Tree children of the selected node
-        https://bugs.webkit.org/show_bug.cgi?id=130264
-
-        Reviewed by Timothy Hatcher.
-
-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
-
-        Expose the accessibility tree children (different from DOM children) of the
-        current node in the accessibility node inspector.
-
-        * inspector/InspectorDOMAgent.cpp: 
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/InspectorDOMAgent.h:
-        * inspector/protocol/DOM.json:
-
-2014-03-21  Alex Christensen  &lt;achristensen@webkit.org&gt;
-
-        [Win] Compile fixes with video not enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=130597
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * DerivedSources.make:
-        Only generate UserAgentScripts.h if needed.
-        * platform/audio/MediaSession.cpp:
-        * platform/audio/MediaSessionManager.cpp:
-        Only compile if video is enabled.
</del><ins>+        This addresses text input being abandoned when another frame in a page is navigated.
</ins><span class="cx"> 
</span><del>-2014-03-21  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+        There are still many opportunities for improvement:
+        - Track other cases where WebCore interferes may want to cancel input without
+        direct user action (e.g. deleting the whole editable element on a timer).
+        - Fix how dictionary panel and autocorrection are dismissed (they still have the
+        same issue, and get dismissed with any frame navigation).
</ins><span class="cx"> 
</span><del>-        Optimize FEGaussian blur
-        https://bugs.webkit.org/show_bug.cgi?id=50881
</del><ins>+        Test: platform/mac/editing/input/unconfirmed-text-navigation-with-page-cache.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        * loader/FrameLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willTransitionToCommitted): Make sure that we
+        do not keep an inline session in a frame that's no longer active, as WebKit2 no
+        longer takes care of this case (and more of the logic should be in WebCore anyway).
+        (WebCore::FrameLoader::commitProvisionalLoad): Added a hook that gets invoked right
+        before transitioning to committed state starts. We may want to move more code here
+        eventually, e.g. from Frame::setView.
</ins><span class="cx"> 
</span><del>-        Currently boxBlur() will calculate the filter for each channel in
-        a loop and also uses Uint8ClampedArray::set() to write the
-        resulting pixels into destination array.
</del><ins>+2013-05-17  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Using Uint8ClampedArray::set() requires lots of unnecessary type
-        conversions, not to mention other function calls. This patch
-        updates the original written by Simon Fraser to apply cleanly to current
-        trunk.
</del><ins>+        Get rid of [CustomGetter] for global named constructors
+        https://bugs.webkit.org/show_bug.cgi?id=116116
</ins><span class="cx"> 
</span><del>-        It also implements code to handle EdgeModes and finally avoids use
-        of ::set() in the newly added boxBlurAlphaOnly()
-        function. Assignment of calculated pixel values rely on pointers.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        No new tests, no change on behavior.
</del><ins>+        Improve the JSC bindings generator so that global named constructors no longer
+        require a [CustomGetter] IDL extended attribute. As a consequence, attributes
+        on the global window object can now be automatically generated for interfaces
+        that have a [NamedConstructor], namely HTMLOptionElement.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        (WebCore::boxBlurAlphaOnly): Specialized version for alpha only cases.
-        (WebCore::boxBlur):
</del><ins>+        The HTMLAudioElement global constructors are still manually defined because it
+        requires custom code at the moment to check if the media player is available.
</ins><span class="cx"> 
</span><del>-2014-03-21  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        unobscuredContentRect() should have the same signature on iOS and other platforms,
-        and should not recurse on iOS.
-        https://bugs.webkit.org/show_bug.cgi?id=130604
-        &lt;rdar://problem/16392587&gt;
</del><ins>+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/preprocess-idls.pl:
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
+        * html/HTMLOptionElement.idl:
+        * page/DOMWindow.idl:
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton and Beth Dakin.
</del><ins>+2013-05-17  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Having different signatures on different platforms is a recipe for
-        build breakage. Give the iOS unobscuredContentRect() an unused 
-        VisibleContentRectIncludesScrollbars parameter.
-        
-        Also avoid recursion via unobscuredContentRect() calling visibleContentRectInternal().
</del><ins>+        Web Inspector: SyntaxError evaluating &quot;1+1; //@ sourceURL=test&quot; in console
+        https://bugs.webkit.org/show_bug.cgi?id=116292
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::unobscuredContentRect):
-        (WebCore::ScrollView::unobscuredContentRectInternal):
-        (WebCore::ScrollView::visibleContentRectInternal):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::unobscuredContentRectIncludingScrollbars):
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::unobscuredContentRect):
</del><ins>+        Add a newline after the expression so a single line comment doesn't
+        erroneously comment out the closing brace of the with block.
</ins><span class="cx"> 
</span><del>-2014-03-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-        Handle recovery on &quot;timestamp-looking&quot; lines in the WebVTT parser
-        https://bugs.webkit.org/show_bug.cgi?id=130610
</del><ins>+        Test: inspector/console/console-eval-comment.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * inspector/InjectedScriptSource.js:
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by fs@opera.com):
-        https://chromium.googlesource.com/chromium/blink/+/b669a380efbffe25f3b154b026b57b9822ce08e2
-        http://crbug.com/75273002
</del><ins>+2013-05-17  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: media/track/track-webvtt-tc031-cue-recovery.html
-               media/track/track-webvtt-tc032-degenerate-cues.html
</del><ins>+        fast/flexbox/auto-height-with-flex.html failing only on release builds.
+        https://bugs.webkit.org/show_bug.cgi?id=116240
</ins><span class="cx"> 
</span><del>-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTParser::parse):
-        (WebCore::WebVTTParser::collectCueText):
-        (WebCore::WebVTTParser::recoverCue):
-        (WebCore::WebVTTParser::ignoreBadCue):
-        * html/track/WebVTTParser.h:
-
-2014-03-21  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Remove unused RenderView::repaintRectangleInViewAndCompositedLayers().
-        &lt;https://webkit.org/b/130605&gt;
-
-        Reviewed by Antti Koivisto.
-
-        * rendering/RenderView.cpp:
-        * rendering/RenderView.h:
-
-2014-03-21  David Hyatt  &lt;hyatt@apple.com&gt;
-
-        Crash in RenderBlock::addChildIgnoringAnonymousColumnBlocks.
-        https://bugs.webkit.org/show_bug.cgi?id=129948
-        &lt;rdar://problem/16074072&gt;
-        
-        Reviewed by Simon Fraser.
-
-        When the marker was placed for multi-column list items, it was being inserted
-        into the list item itself. Even though the add code in RenderBlock did the right
-        thing and put the marker inside the multi-column flow thread, the list item code
-        passed in a beforeChild that was computed using the incorrect parent. This resulted
-        in the flow thread being used both as the parent of the marker and the sibling of
-        the marker.
-        
-        The fix is to add some code to RenderListItem to make sure it uses the multi-column
-        flow thread if it exists both as the parent of the marker and as the basis for the
-        computation of the sibling that the marker should be placed in front of.
-
-        Added fast/multicol/multicol-li-crash.html
-
-        * rendering/RenderListItem.cpp:
-        (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
-
-2014-03-20  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Stop pulling in JSCInlines.h all over the place.
-        &lt;https://webkit.org/b/130105&gt;
-
-        JSDOMBinding.h is included by everyone and their uncle, so try to
-        cut down on the amount of JSC *Inlines.h it includes.
-
-        Reviewed by Geoff Garen.
-
-        * ForwardingHeaders/heap/SlotVisitorInlines.h: Added.
-        * ForwardingHeaders/runtime/JSCJSValueInlines.h: Added.
-        * ForwardingHeaders/runtime/JSCellInlines.h: Added.
-        * ForwardingHeaders/runtime/StructureInlines.h: Added.
-        * bindings/js/JSDOMBinding.h:
-
-2014-03-21  David Kilzer  &lt;ddkilzer@apple.com&gt;
-
-        WindowFeatures.{x|y|width|height} are not initialized
-        &lt;http://webkit.org/b/130547&gt;
-        &lt;rdar://problem/16383151&gt;
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Based on a Blink patch in CRBug 342591 by zhaoqin.
</del><ins>+        Fix the mainAxisContentExtent method so no overflow occurs, since it
+        doesn't work right on release builds.
</ins><span class="cx"> 
</span><del>-        * page/WindowFeatures.cpp:
-        (WebCore::WindowFeatures::WindowFeatures):
-        - Initialize x, y, width, height in String constructor.
-        - Move 'resizeable' variable to short-hand initialization since
-          it is true in both cases.
-        - Use String::isEmpty() instead of checking its length.
-        * page/WindowFeatures.h:
-        (WebCore::WindowFeatures::WindowFeatures): Initialize x, y,
-        width, height in no-argument constructor.
</del><ins>+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::mainAxisContentExtent):
</ins><span class="cx"> 
</span><del>-2014-03-21  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+2013-05-17  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace DEPRECATED_DEFINE_STATIC_LOCAL by static NeverDestroyed&lt;T&gt; in bridge/
-        https://bugs.webkit.org/show_bug.cgi?id=130601
</del><ins>+        Add [EnabledAtRuntime] extended attribute support for global constructors
+        https://bugs.webkit.org/show_bug.cgi?id=116147
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
-
-        * bridge/IdentifierRep.cpp:
-        (WebCore::identifierSet):
-        (WebCore::intIdentifierMap):
-        (WebCore::stringIdentifierMap):
-        * bridge/NP_jsobject.cpp:
-        (objectMap):
-        * bridge/runtime_root.cpp:
-        (JSC::Bindings::rootObjectSet): Return a reference instead of
-        a pointer.
-        (JSC::Bindings::findProtectingRootObject):
-        (JSC::Bindings::findRootObject):
-        (JSC::Bindings::RootObject::RootObject):
-        (JSC::Bindings::RootObject::invalidate):
-
-2014-03-21  Michael Saboff  &lt;msaboff@apple.com&gt;
-
-        Change CodeGeneratorJS.pm special cases for &quot;DOMWindow&quot; to be general purpose
-        https://bugs.webkit.org/show_bug.cgi?id=130553
-
</del><span class="cx">         Reviewed by Geoffrey Garen.
</span><span class="cx"> 
</span><del>-        Eliminated 'if ($interfaceName eq &quot;DOMWindow&quot;) {' sections in CodeGeneratorJS where
-        it was used to do DOMWindow specific casting to a JSObject, either a JSDOMWindow* or
-        a JSDOMWindowShell*.  Instead the code generator will use the existing 
-        JSDOMWindow* toJSDOMWindow(JSValue value) function based on a newly added attribute
-        &quot;CustomProxyToJSObject&quot;.  That attribute will emit a call to the function
-        ${className}* to${className}(JSValue).
</del><ins>+        Add [EnabledAtRuntime] extended attribute support for global constructors.
+        This patch adds [EnabledAtRuntime] extended attribute to SharedWorker and
+        WebSocket IDL interfaces so that their global constructors on the global
+        Window object can now be automatically generated.
</ins><span class="cx"> 
</span><del>-        This is being done to clean up the code generator and for a subsequent patch that
-        will use a similar custom to{className} function for workers,
-        JSDedicatedWorkerGlobalScope* toJSDedicatedWorkerGlobalScope(JSValue).
</del><ins>+        The behavior on JavaScript side is unchanged. We simply leverage
+        RuntimeEnabledFeatures class and the new [EnabledAtRuntime] IDL extended
+        attribute to generate the code for global constructors getters instead
+        of using custom code.
</ins><span class="cx"> 
</span><del>-        Changes covered by existing tests.
</del><ins>+        No new tests, no behavior change for layout tests.
</ins><span class="cx"> 
</span><ins>+        * GNUmakefile.list.am:
+        * Modules/websockets/WebSocket.cpp: Enable WebSockets at runtime by default.
+        * Modules/websockets/WebSocket.idl:
+        * Target.pri:
+        * UseJSC.cmake:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore):
+        * bindings/js/JSDOMWindowWebSocketCustom.cpp: Removed.
</ins><span class="cx">         * bindings/scripts/CodeGeneratorJS.pm:
</span><ins>+        (ToMethodName):
+        (GetRuntimeEnableFunctionName):
</ins><span class="cx">         (GenerateImplementation):
</span><span class="cx">         * bindings/scripts/IDLAttributes.txt:
</span><span class="cx">         * page/DOMWindow.idl:
</span><ins>+        * workers/SharedWorker.idl:
</ins><span class="cx"> 
</span><del>-2014-03-21  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+2013-05-17  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        AX: Replace DEPRECATED_DEFINE_STATIC_LOCAL by static NeverDestroyed
-        https://bugs.webkit.org/show_bug.cgi?id=130594
</del><ins>+        [EFL] Move EFL port off legacy clipboard
+        https://bugs.webkit.org/show_bug.cgi?id=116181
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Use static NeverDestroyed&lt;T&gt; in new code.
</del><ins>+        * dom/Clipboard.h: Switched EFL away from &quot;legacy&quot; mode for Clipboard.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityMediaControls.cpp:
-        (WebCore::AccessibilityMediaControl::controlTypeName):
-        (WebCore::AccessibilityMediaControl::title):
-        (WebCore::AccessibilityMediaControlsContainer::elementTypeName):
-        (WebCore::AccessibilityMediaTimeline::helpText):
-        (WebCore::AccessibilityMediaTimeDisplay::accessibilityDescription):
-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::actionVerb):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::inheritsPresentationalRole):
-        (WebCore::AccessibilityRenderObject::ariaLiveRegionStatus):
-        (WebCore::AccessibilityRenderObject::ariaLiveRegionRelevant):
-        (WebCore::AccessibilityRenderObject::actionVerb):
-        * accessibility/atk/AXObjectCacheAtk.cpp:
-        (WebCore::notifyChildrenSelectionChange):
</del><ins>+        * page/efl/EventHandlerEfl.cpp:
+        (WebCore::EventHandler::createDraggingClipboard): Changed to call Clipboard member function.
</ins><span class="cx"> 
</span><del>-2014-03-20  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * platform/efl/ClipboardEfl.cpp: Deleted most of the functions.
+        (WebCore::Editor::newGeneralClipboard): Changed to call Clipboard member function.
+        (WebCore::Clipboard::createDragImage): Moved from ClipboardEfl to Clipboard.
+        (WebCore::Clipboard::declareAndWriteDragImage): Moved from ClipboardEfl to Clipboard.
+        (WebCore::Clipboard::items): Ditto.
</ins><span class="cx"> 
</span><del>-        Merge WebVTT Tokenizer Updates
-        https://bugs.webkit.org/show_bug.cgi?id=130565
</del><ins>+        * platform/efl/PasteboardEfl.cpp: A lot of copyright notices for a file that
+        has no code in it other than notImplemented lines! I didn't add a new one.
+        (WebCore::Pasteboard::createForCopyAndPaste): Added.
+        (WebCore::Pasteboard::createPrivate): Added.
+        (WebCore::Pasteboard::createForDragAndDrop): Added.
+        (WebCore::Pasteboard::hasData): Added.
+        (WebCore::Pasteboard::readString): Added.
+        (WebCore::Pasteboard::writeString): Added.
+        (WebCore::Pasteboard::types): Added.
+        (WebCore::Pasteboard::readFilenames): Added.
+        (WebCore::Pasteboard::setDragImage): Added.
+        (WebCore::Pasteboard::writePasteboard): Added.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-05-17  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by fs@opera.com):
-        https://chromium.googlesource.com/chromium/blink/+/923db263aa65d6efd71c5b55708ad7eea6b23f53
-        http://crbug.com/73813002
-        https://chromium.googlesource.com/chromium/blink/+/48375b1d56b2d8850ae93a6c6fb01c69fae82c75
-        http://crbug.com/77553004
-        https://chromium.googlesource.com/chromium/blink/+/98d4fc4f5cb716a31d11907120b10538d4ba0f09
-        http://crbug.com/78833002
-        https://chromium.googlesource.com/chromium/blink/+/0e53d4f9f140e979b7f32de495551684bc7f4cd2
-        http://crbug.com/81113003
-        https://chromium.googlesource.com/chromium/blink/+/730ef1e7f9a1919964f7e74e7ccb2f343e10a148
-        http://crbug.com/97103002
-        https://chromium.googlesource.com/chromium/blink/+/c373ee914ffabeaf833939129538251d8f2f4eca
-        http://crbug.com/98763004
-        https://chromium.googlesource.com/chromium/blink/+/4ddb4d57948228fa05e49e06bd58a1179c09f212
-        http://crbug.com/118263002

-        * html/track/VTTCue.cpp:
-        (WebCore::scanPercentage):
-        (WebCore::VTTCue::setCueSettings):
-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTTreeBuilder::buildFromString):
-        (WebCore::WebVTTTreeBuilder::constructTreeFromToken):
-        * html/track/WebVTTToken.h:
-        (WebCore::WebVTTToken::WebVTTToken):
-        (WebCore::WebVTTToken::StringToken):
-        (WebCore::WebVTTToken::StartTag):
-        (WebCore::WebVTTToken::EndTag):
-        (WebCore::WebVTTToken::TimestampTag):
-        (WebCore::WebVTTToken::type):
-        (WebCore::WebVTTToken::name):
-        (WebCore::WebVTTToken::characters):
-        (WebCore::WebVTTToken::classes):
-        (WebCore::WebVTTToken::annotation):
-        * html/track/WebVTTTokenizer.cpp:
-        (WebCore::addNewClass):
-        (WebCore::emitToken):
-        (WebCore::advanceAndEmitToken):
-        (WebCore::WebVTTTokenizer::WebVTTTokenizer):
-        (WebCore::WebVTTTokenizer::nextToken):
-        * html/track/WebVTTTokenizer.h:
-        (WebCore::WebVTTTokenizer::shouldSkipNullCharacters):
</del><ins>+        Bad spacing inside MathML formulas when text-indent is specified
+        https://bugs.webkit.org/show_bug.cgi?id=106600
</ins><span class="cx"> 
</span><del>-2014-03-21  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Bug 130345 - Refine childShouldCreateRenderer for MathML elements
-        https://bugs.webkit.org/show_bug.cgi?id=130345
</del><ins>+        When MathML is used in a HTML page that modifies the CSS text-indent,
+        large gaps appear inside the mathematical expressions. Resetting it to
+        0 on the math root (as Gecko does) fixes the issue.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Tests: mathml/presentation/text-indent.html
+               mathml/presentation/text-indent-expected.html
</ins><span class="cx"> 
</span><del>-        This is a follow-up of bug 124128. We add more restrictions on foreign
-        content of MathML elements.
</del><ins>+        * css/mathml.css:
+        (math): reset text-indent to its default value.
</ins><span class="cx"> 
</span><del>-        Tests: mathml/presentation/annotation-children.html
-               mathml/presentation/foreign-element-in-token.html
</del><ins>+2013-05-17  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLElement.cpp:
-        (WebCore::MathMLElement::isPresentationMathML): fix line wrapping
-        (WebCore::MathMLElement::isPhrasingContent):
-        - move the function from MathMLSelectElement.cpp
-        - add the constraint &quot;is descendant of a map element&quot; for area.
-        (WebCore::MathMLElement::isFlowContent): new function to test flow content.
-        (WebCore::MathMLElement::childShouldCreateRenderer):
-        - remove annotation since it is now tested in MathMLTextElement
-        - refine testing of annotation-xml
-        - do not create renderer for text content in MathML. Such content is only allowed inside token elements.
-        * mathml/MathMLElement.h: Declare isPhrasingContent and isFlowContent.
-        * mathml/MathMLSelectElement.cpp: Add new function to test MathML/SVG/HTML encodings.
-        (WebCore::MathMLSelectElement::isMathMLEncoding):
-        (WebCore::MathMLSelectElement::isSVGEncoding):
-        (WebCore::MathMLSelectElement::isHTMLEncoding):
-        (WebCore::MathMLSelectElement::getSelectedSemanticsChild): use the new functions.
-        * mathml/MathMLSelectElement.h: Declare the new public functions.
-        * mathml/MathMLTextElement.cpp: remove the isPhrasingContent function.
-        (WebCore::MathMLTextElement::childShouldCreateRenderer): Just in case, use the generic StyledElement::childShouldCreateRenderer.
</del><ins>+        Fix code that expects Page::chrome() to return a pointer
+        https://bugs.webkit.org/show_bug.cgi?id=116313
</ins><span class="cx"> 
</span><del>-2014-03-21  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Stop using deprecatedCharacters in WebCore/platform/win
-        https://bugs.webkit.org/show_bug.cgi?id=130515
</del><ins>+        Page::chrome() returns a reference after r150214.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+        * platform/network/blackberry/SocketStreamHandleBlackBerry.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        * testing/Internals.cpp:
+        (WebCore::Internals::resetToConsistentState):
+        (WebCore::Internals::setEnableMockPagePopup):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/TextRun.h:
-        (WebCore::TextRun::TextRun): Add a constructor that takes a StringView.
-        Later, we might want to exclusively use the StringView version and remove
-        some of the others.
-        (WebCore::TextRun::setText): Add a version of this function that takes a StringView.
</del><ins>+2013-05-17  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/win/FontCacheWin.cpp:
-        (WebCore::FontCache::systemFallbackForCharacters): Use StringView::getCharactersWithUpconvert.
-        (WebCore::createGDIFont): Ditto.
-        (WebCore::FontCache::getTraitsInFamily): Ditto.
-        * platform/win/BString.cpp:
-        (WebCore::BString::BString): Use StringView::upconvertedCharacters.
-        * platform/win/ClipboardUtilitiesWin.cpp:
-        (WebCore::createGlobalData): Use StringView::getCharactersWithUpconvert.
-        * platform/win/FileSystemWin.cpp:
-        (WebCore::pathByAppendingComponent): Use StringBuilder and StringView::getCharactersWithUpconvert.
-        (WebCore::fileSystemRepresentation): Use StringView::upconvertedCharacters.
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::filesystemPathFromUrlOrTitle): Use StringView::getCharactersWithUpconvert.
-        (WebCore::Pasteboard::writeURLToDataObject): Ditto.
-        (WebCore::createGlobalImageFileDescriptor): Ditto.
</del><ins>+        [BlackBerry] ImageBlackBerry: add missing BlendMode parameter
+        https://bugs.webkit.org/show_bug.cgi?id=116316
</ins><span class="cx"> 
</span><del>-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenuWin::calculatePositionAndSize): Use the new TextRun constructor.
-        * platform/win/WebCoreTextRenderer.cpp:
-        (WebCore::doDrawTextAtPoint): Ditto.
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-2014-03-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        When the new BitmapImage::draw() method was added in r147110 it
+        didn't include the BlendMode parameter, which has been there since
+        r137011.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: RenderBox is positioned off by one when non-compositing transform is present.
-        https://bugs.webkit.org/show_bug.cgi?id=130430
</del><ins>+        * platform/graphics/blackberry/ImageBlackBerry.cpp:
+        (WebCore::BitmapImage::draw):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        div {
-            position: absolute;
-             top: 10.25px;
-             left: 10.25px;
-         }
</del><ins>+        Some media/track tests fail or assert on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=97132
</ins><span class="cx"> 
</span><del>-         The &lt;div&gt; with (10.25px, 10.25px) is painted to (10.5px, 10.5px) after device pixel snapping on 2x display.
-         Moving &lt;div&gt; to its own RenderLayer should not change the painting position.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-         div {
-             position: absolute;
-             top: 10.25px;
-             left: 10.25px;
-             -webkit-transform: rotate(0deg);
-         }
</del><ins>+        Rationalize the font and padding behavior of cues and cue boxes; ::cue pseudo elements cannot have padding
+        values applied via CSS (due to padding not being included in the whitelist of applicable CSS properties).
+        Also, the font values were being applied to the box at one level and the cue at another, leading to incorrect
+        layout in the snapToLines case. Padding has been removed from the cue, and the font settings are now applied
+        to the box exclusively.
</ins><span class="cx"> 
</span><del>-        When we paint the RenderLayer's content, the graphics context is translated by the rounded value of
-        renderer's offset from parent.
</del><ins>+        Additionally, a few drive-by changes were made in TextTrackCue to the return values of displayTreeInternal() &amp;
+        element(), which previously returned a PassRefPtr&lt;&gt; instead of a plain pointer.
</ins><span class="cx"> 
</span><del>-            (10.25px,10.25px) -&gt; rounded to (10.5px,10.5px).
</del><ins>+        * css/mediaControls.css:
+        (video::-webkit-media-text-track-container): Move the font size to the display selector.
+        (video::cue): Remove the display:inline and padding:2px declarations.
+        (video::-webkit-media-text-track-display): Remove the -webkit-line-content now that the ::cue has no padding.
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::TextTrackCue): The background box is now a span, rather than a forced-inline div.
+        (WebCore::TextTrackCue::displayTreeInternal): Return a plain pointer.
+        (WebCore::TextTrackCue::getDisplayTree): Ditto.
+        (WebCore::TextTrackCue::setFontSize): Set the font on the box, not the cue.
+        * html/track/TextTrackCue.h:
+        (WebCore::TextTrackCue::element): Return a plain pointer.
+        * html/track/TextTrackCueGeneric.cpp:
+        (WebCore::TextTrackCueGenericBoxElement::applyCSSProperties): The cue element is now a span, not a div.
+        * page/CaptionUserPreferencesMac.mm:
+        (WebCore::CaptionUserPreferencesMac::captionsWindowCSS): Whitespace.
+        (WebCore::CaptionUserPreferencesMac::captionsBackgroundCSS): Do not set padding on the cue.
</ins><span class="cx"> 
</span><del>-        When the translate moves the graphics context's origin over the renderer's top-left position,
-        the renderer's relative top-left coordinates end up being negative.
</del><ins>+2013-05-16  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            Graphics context translated by (10.5px,10.5px) -&gt; pushes renderer's relative top-left coords to (-0.25px,-0.25px)
</del><ins>+        Changes in text-only properties shouldn't cause repaints unless there is actually text.
+        &lt;http://webkit.org/b/116250&gt;
</ins><span class="cx"> 
</span><del>-        When we round (pixel snap) these negative coordinates, half-way values get translated to the wrong direction.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        (relative coords (-0.25px,-0.25px) -&gt; pixel snapped to (-0.5px,-0.5px) -&gt; final absolute(painting) coords (10px,10px))
</del><ins>+        Add a new StyleDifferenceRepaintIfText value to the repertoire of RenderStyle::diff().
+        This result means that the renderer only needs to repaint if one of its immediate children contains text.
</ins><span class="cx"> 
</span><del>-        This patch changes the rounding to flooring to ensure that the relative top-left position never gets negative as the result
-        of subpixel shifting.
</del><ins>+        This lets us avoid repainting the same pixels when hovering over constructs like:
</ins><span class="cx"> 
</span><del>-        Tests: compositing/hidpi-box-positioned-off-by-one-when-non-compositing-transform-is-present.html
-               fast/layers/hidpi-box-positioned-off-by-one-when-transform-is-present.html
</del><ins>+            &lt;style&gt;
+                a { text-decoration: none; }
+                a:hover { text-decoration: underline; }
+            &lt;/style&gt;
+            &lt;a href=&quot;http://is.gd/andersca&quot;&gt;
+                &lt;img src=&quot;cool-hat.jpg&quot;&gt;
+            &lt;/a&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::computedTransform):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateTransform):
-        (WebCore::RenderLayer::currentTransform):
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateTransform):
</del><ins>+        Since the change in text-decoration has no effect on the rendering of the &lt;img&gt; element,
+        we'll now be smart enough to avoid repainting it.
+
+        * rendering/style/RenderStyleConstants.h:
</ins><span class="cx">         * rendering/style/RenderStyle.cpp:
</span><del>-        * rendering/style/RenderStyle.h:
-        * svg/SVGTextElement.cpp:
-        (WebCore::SVGTextElement::animatedLocalTransform):
</del><ins>+        (WebCore::RenderStyle::diff):
</ins><span class="cx"> 
</span><del>-2014-03-21  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+            Move checking of text-only properties until the very end, and return StyleDifferenceRepaintIfText
+            in case a difference is found, giving precedence to StyleDifferenceRepaint.
</ins><span class="cx"> 
</span><del>-        Unreviewed. iOS build fix after r166046.
</del><ins>+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::hasImmediateNonWhitespaceTextChild):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+            Helper to check if a RenderObject has at least one RenderText child containing more than just
+            collapsible whitespace.
</ins><span class="cx"> 
</span><del>-2014-03-21  Laszlo Vidacs  &lt;lvidacs.u-szeged@partner.samsung.com&gt;
</del><ins>+        (WebCore::RenderObject::shouldRepaintForStyleDifference):
</ins><span class="cx"> 
</span><del>-        Fix the !ENABLE(FILTERS) build
-        https://bugs.webkit.org/show_bug.cgi?id=130394
</del><ins>+            Helper to check if a StyleDifference is either ...Repaint or ...RepaintIfText and the renderer
+            has an immediate text child.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::setStyle):
</ins><span class="cx"> 
</span><del>-        Add missing includes in rendering to fix compile errors, and include JSC headers to ImageBuffer.h to fix linker errors.
</del><ins>+            Don't repaint for StyleDifferenceRepaintIfText unless hasImmediateNonWhitespaceTextChild().
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ImageBuffer.h:
-        * rendering/svg/RenderSVGImage.cpp:
-        * rendering/svg/RenderSVGRoot.cpp:
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::clientStyleChanged):
</ins><span class="cx"> 
</span><del>-2014-03-21  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            Tweak for new StyleDifference enum value.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r166052.
-        https://bugs.webkit.org/show_bug.cgi?id=130571
</del><ins>+        * rendering/RenderText.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::isAllCollapsibleWhitespace):
</ins><span class="cx"> 
</span><del>-        It broke EFL build (Requested by KaL on #webkit).
</del><ins>+            Made this const.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+2013-05-17  Lamarque V. Souza  &lt;Lamarque.Souza@basyskom.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;[GTK] Use GMainLoopSource for idle and timeout sources in
-        WebCore&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130078
-        http://trac.webkit.org/changeset/166052
</del><ins>+        Improve -webkit-text-underline-position memory usage.
+        https://bugs.webkit.org/show_bug.cgi?id=116108
</ins><span class="cx"> 
</span><del>-2014-03-21  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Add *explicit* keyword to avoid implicit type conversion
-        https://bugs.webkit.org/show_bug.cgi?id=130568
</del><ins>+        Remove m_maxLogicalTop private variable from RootInlineBox to reduce
+        the overall memory used to render RootInlineBoxes (eight bytes per RootInlineBox
+        instance in a 64-bit machine). RootInline::maxLogicalTop() now computes
+        the maxLogicalTop value everytime it is called. In a typical page
+        computeMaxLogicalTop is called less than 10 times for each
+        InlineTextBox that uses -webkit-text-underline-position. That is a small
+        price users of -webkit-text-underline-position will pay so that
+        everybody can benefit from the memory reduction in RootInlineBox.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        No new tests, no change in behavior.
</ins><span class="cx"> 
</span><del>-        Constructors of RemoteFontFaceSource, SVGDocumentExtensions, XMLDocumentParserScope,
-        and WorkerScriptDebugServer need to use *explicit* keyword because they have an argument.
-        Besides removed a meaningless argument name.
</del><ins>+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeMaxLogicalTop): Make it const.
+        * rendering/InlineFlowBox.h:
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::RootInlineBox): Remove m_maxLogicalTop.
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection): Remove
+        computeMaxLogicalTop call and obsolete comment.
+        (WebCore):
+        (WebCore::RootInlineBox::maxLogicalTop): Compute maxLogicalTop before
+        returning its value.
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
</ins><span class="cx"> 
</span><del>-        * svg/SVGDocumentExtensions.h:
-        * xml/parser/XMLDocumentParserScope.h:
</del><ins>+2013-05-17  Alexis Menard  &lt;alexis@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-20  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        Make sure to call release() on our smart pointers when we should.
+        https://bugs.webkit.org/show_bug.cgi?id=116307
</ins><span class="cx"> 
</span><del>-        Modules: replace DEPRECATED_DEFINE_STATIC_LOCAL by static NeverDestroyed&lt;T&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=130407
-
-        Reviewed by Darin Adler.
-
-        * Modules/encryptedmedia/CDM.cpp:
-        (WebCore::installedCDMFactories):
-        * Modules/mediasource/MediaSourceRegistry.cpp:
-        (WebCore::MediaSourceRegistry::registry):
-        * Modules/mediasource/MediaSourceRegistry.h:
-        * Modules/mediastream/MediaStreamRegistry.cpp:
-        (WebCore::MediaStreamRegistry::registry):
-
-2014-03-20  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
-
-        [GTK] Use GMainLoopSource for idle and timeout sources in WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=130078
-
-        Reviewed by Philippe Normand.
-
-        * platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
-        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp:
-        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.h:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.h:
-        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
-        * platform/graphics/gstreamer/WebKitMediaSourceGStreamer.cpp:
-        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
-        * platform/gtk/GtkDragAndDropHelper.cpp:
-        * platform/gtk/SharedTimerGtk.cpp:
-
-2014-03-21  Andreas Kling  &lt;akling@apple.com&gt;
-
-        HTMLFrameOwnerElement should obey the SubframeLoadingDisabler when creating subframes
-        &lt;rdar://problem/15675780&gt;
-
-        Merge Blink r156744 by Adam Klein.
-
-        Test: fast/frames/set-iframe-src-in-pagehide-crash.html
-
-        * loader/SubframeLoader.cpp:
-        (WebCore::SubframeLoader::loadSubframe):
-
-2014-03-21  Darin Adler  &lt;darin@apple.com&gt;
-
-        Improve idiom used for string building in a few places
-        https://bugs.webkit.org/show_bug.cgi?id=130561
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        * Modules/indexeddb/IDBKeyData.cpp:
-        (WebCore::IDBKeyData::loggingString): Use a StringBuilder, and get rid of
-        an an unnecessary additional string allocation.
</del><ins>+        Call release() when we should call it. There is probably more occurence
+        of this problem on the codebase but this is a first bunch of fixes.
</ins><span class="cx"> 
</span><del>-        * Modules/websockets/ThreadableWebSocketChannel.cpp:
-        (WebCore::ThreadableWebSocketChannel::create): Use StringBuilder.
</del><ins>+        No new tests : existing ones should cover.
</ins><span class="cx"> 
</span><del>-        * html/FTPDirectoryDocument.cpp:
-        (WebCore::FTPDirectoryDocumentParser::createTDForFilename): Do a more efficient
-        string concatenation.
-        * html/ValidationMessage.cpp:
-        (WebCore::ValidationMessage::updateValidationMessage): Ditto.
</del><ins>+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForNinePieceImage):
+        (WebCore::getBorderRadiusShorthandValue):
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getCSSPropertyValuesForSidesShorthand):
+        (WebCore::CSSComputedStyleDeclaration::getCSSPropertyValuesForGridShorthand):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseBorderImage):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::collectStyleForPresentationAttribute):
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorApplicationCacheAgent.cpp:
-        (WebCore::InspectorApplicationCacheAgent::buildObjectForApplicationCacheResource):
-        Use a StringBuilder.
</del><ins>+2013-05-17  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorStyleSheet.cpp: 
-        (WebCore::InspectorStyle::shorthandValue): Use a StringBuilder.
</del><ins>+        Make PNGImageDecoder::rowAvailable auto-vectorizable
+        https://bugs.webkit.org/show_bug.cgi?id=116151
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorStyleTextEditor.cpp:
-        (WebCore::InspectorStyleTextEditor::insertProperty): Use a more efficient idiom
-        for string concatenation.
-        (WebCore::InspectorStyleTextEditor::internalReplaceProperty): Ditto.
-        * loader/FormSubmission.cpp:
-        (WebCore::appendMailtoPostFormDataToURL): Ditto.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * page/Frame.cpp:
-        (WebCore::createRegExpForLabels): Use a StringBuilder.
</del><ins>+        Changed the main loops under PNGImageDecoder::rowAvailable so that they
+        avoid branches and non-sequential table look ups.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
-        (WebCore::InbandTextTrackPrivateAVF::processCueAttributes): Use a more efficient
-        idiom for string concatenation.
</del><ins>+        Together with automatic vectorization by the compiler this provides around
+        4x speed-up with AVX or 2x speed-up on generic x64. Shaving off 12-40% on
+        PNG decoding in general.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
-        (WebCore::GraphicsContext3D::getUnmangledInfoLog): Use a StringBuilder.
</del><ins>+        * platform/graphics/Color.cpp:
+        (WebCore::premultipliedARGBFromColor):
+        * platform/graphics/Color.h:
+        (WebCore::fastDivideBy255):
+        * platform/graphics/filters/FEBlend.cpp:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::setPixelRGB):
+        (WebCore::setPixelRGBA):
+        (WebCore::setPixelRGBA_Premultiplied):
+        (WebCore::PNGImageDecoder::rowAvailable):
</ins><span class="cx"> 
</span><del>-        * platform/network/MIMEHeader.cpp:
-        (WebCore::MIMEHeader::parseHeader): Use a more efficient idiom for string
-        concatenation.
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::addHTTPHeaderField): Ditto.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::layerTreeAsText): Ditto.
</del><ins>+2013-05-17  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::secureText): Create a new string with the substring
-        function rather than with the append function.
</del><ins>+        Web Inspector: Allow &quot;//# sourceMappingURL&quot; syntax alongside &quot;//@&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=116290
</ins><span class="cx"> 
</span><del>-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::setRequestHeaderInternal): Use a more efficient idiom
-        for string concatenation.
</del><ins>+        Follow an update to the spec and support the new and old syntax.
</ins><span class="cx"> 
</span><del>-2014-03-21  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-        Add a combined decodeAndFlush to TextResourceDecoder
-        https://bugs.webkit.org/show_bug.cgi?id=130560
</del><ins>+        * inspector/ContentSearchUtils.cpp:
+        (WebCore::ContentSearchUtils::scriptCommentPattern):
+        (WebCore::ContentSearchUtils::stylesheetCommentPattern):
+        * inspector/front-end/SASSSourceMapping.js:
+        (WebInspector.SASSSourceMapping.prototype._loadAndProcessSourceMap):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-05-17  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Added new symbol for decodeAndFlush. Also re-did
-        the geometry types #if so it would sort more logically.
</del><ins>+        Remove custom code for MessageEvent.ports getter
+        https://bugs.webkit.org/show_bug.cgi?id=116304
</ins><span class="cx"> 
</span><del>-        * fileapi/FileReaderLoader.cpp:
-        (WebCore::FileReaderLoader::convertToText): Use decodeAndFlush.
-        * inspector/InspectorPageAgent.cpp:
-        (WebCore::InspectorPageAgent::cachedResourceContent): Ditto.
-        * inspector/NetworkResourcesData.cpp:
-        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent): Ditto.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * loader/TextResourceDecoder.cpp:
-        (WebCore::TextResourceDecoder::decodeAndFlush): Added.
-        * loader/TextResourceDecoder.h: Ditto.
</del><ins>+        Remove Custom code for the &quot;ports&quot; attribute getter in MessageEvent
+        IDL interface. The JSC bindings generator already supports attributes
+        of type MessagePortArray.
</ins><span class="cx"> 
</span><del>-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest): Use decodeAndFlush.
-        * loader/cache/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::sheetText): Ditto.
-        (WebCore::CachedCSSStyleSheet::finishLoading): Ditto.
</del><ins>+        No new tests, already covered by existing layout tests and bindings
+        tests.
</ins><span class="cx"> 
</span><del>-        * loader/cache/CachedFont.cpp:
-        (WebCore::CachedFont::ensureSVGFontData): Use decodeAndFlush. Also use nullptr.
-        (WebCore::CachedFont::getSVGFontById): Use descendantsOfType&lt;SVGFontElement&gt;
-        instead of using a NodeList. Much more efficient!
</del><ins>+        * bindings/js/JSMessageEventCustom.cpp: Remove Custom code for ports getter.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (NativeToJSValue): Small tweak to correctly handle the case where impl-&gt;ports()
+        returns NULL and avoid crashing in this case.
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp: Rebaseline due
+        to bindings generator tweak.
+        * dom/MessageEvent.idl: Remove [CustomGetter] extended attribute for 'ports' attribute
+        and switch to MessagePortArray type.
</ins><span class="cx"> 
</span><del>-        * loader/cache/CachedSVGDocument.cpp:
-        (WebCore::CachedSVGDocument::finishLoading): Use decodeAndFlush.
-        * loader/cache/CachedScript.cpp:
-        (WebCore::CachedScript::script): Ditto.
-        * loader/cache/CachedXSLStyleSheet.cpp:
-        (WebCore::CachedXSLStyleSheet::finishLoading): Ditto.
-        * page/Page.cpp:
-        (WebCore::Page::userStyleSheet): Ditto.
</del><ins>+2013-05-16  Jesus Sanchez-Palencia  &lt;jesus.palencia@openbossa.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-20  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Add stubs for ContextMenu and ContextMenuItem
+        https://bugs.webkit.org/show_bug.cgi?id=116235
</ins><span class="cx"> 
</span><del>-        Remove a couple of unused functions from CSSOMUtils
-        https://bugs.webkit.org/show_bug.cgi?id=130558
</del><ins>+        Reviewed by Antonio Gomes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        No new tests needed, only a refactor.
</ins><span class="cx"> 
</span><del>-        * css/CSSOMUtils.cpp: Remove String overloads. Callers all use the StringBuilder
-        ones, which is good since that is a more efficient idiom.
-        * css/CSSOMUtils.h: Ditto.
</del><ins>+        Add ContextMenuNone.cpp and ContextMenuItemNone.cpp
+        so ports using ENABLE(CROSS_PLATFORM_CONTEXT_MENU) don't
+        need to replicate these stubs.
</ins><span class="cx"> 
</span><del>-2014-03-20  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+        * PlatformEfl.cmake:
+        * Target.pri:
+        * platform/ContextMenuNone.cpp: Added.
+        (WebCore):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::getContextMenuItems):
+        (WebCore::ContextMenu::createPlatformContextMenuFromItems):
+        (WebCore::ContextMenu::platformContextMenu):
+        * platform/ContextMenuItemNone.cpp: Added.
+        (WebCore):
+        (WebCore::ContextMenuItem::platformContextMenuItem):
+        * platform/efl/ContextMenuEfl.cpp: Removed.
+        * platform/efl/ContextMenuItemEfl.cpp: Removed.
+        * platform/qt/ContextMenuQt.cpp: Removed.
+        * platform/qt/ContextMenuItemQt.cpp: Removed.
</ins><span class="cx"> 
</span><del>-        Unreviewed. iOS build fix after r166017, r166032.
</del><ins>+2013-05-16  Alexis Menard  &lt;alexis@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::visibleContentRectInternal):
</del><ins>+        Regression: Event#stopPropagation() does not halt bubbling for webkitTransitionEnd
+        https://bugs.webkit.org/show_bug.cgi?id=115656
</ins><span class="cx"> 
</span><del>-2014-03-20  Hyowon Kim  &lt;hw1008.kim@samsung.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Move to using std::unique_ptr for EFL objects.
-        https://bugs.webkit.org/show_bug.cgi?id=129853
</del><ins>+        If we create a prefixed event to dispatch it (in the case we have only
+        prefixed event listeners in client's code) then we need to make sure to
+        keep it in sync with the original unprefixed event after it has been
+        dispatched. While being dispatched the event can be modified by
+        client's code and when propagated back to outer elements, attributes were
+        not updated. This patch changes the old design of creating a separate event
+        for the prefixed case and now change the type of the event (so the name) before
+        dispatching it, keeping the attributes if changed and then rename it
+        back to unprefixed when the dispatching is finished.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        Tests: transitions/transition-end-event-prefixed-01.html
+               transitions/transition-end-event-prefixed-02.html
+               transitions/transition-end-event-prefixed-03.html
</ins><span class="cx"> 
</span><del>-        EflUniquePtr is a template alias of std::unique_ptr
-        with a custom deleter for each Efl Objects, which is motivated by GUniquePtr.
-        This patch replaces uses of OwnPtr and PassOwnPtr for Efl objects with EflUniquePtr.
</del><ins>+        * dom/Event.h:
+        (WebCore::Event::setType):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
</ins><span class="cx"> 
</span><del>-        No new tests. No new functionality.
</del><ins>+2013-05-16  Mike Fenton  &lt;mifenton@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/efl/EflScreenUtilities.h:
-        * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::RenderThemeEfl::ThemePartCacheEntry::create):
-        (WebCore::RenderThemeEfl::loadTheme):
-        * platform/efl/RenderThemeEfl.h:
-        * platform/graphics/Icon.h:
-        * platform/graphics/efl/EvasGLContext.h:
-        (WebCore::EvasGLContext::create):
-        * platform/graphics/efl/EvasGLSurface.h:
-        (WebCore::EvasGLSurface::create):
</del><ins>+        [BlackBerry] Strip invoke URLs when writing to the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=116226
</ins><span class="cx"> 
</span><del>-2014-03-20  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        [EFL][GTK] Get CMake to find Freetype2 properly
-        https://bugs.webkit.org/show_bug.cgi?id=130150
</del><ins>+        PR 333516.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        Invoke URLs should not be included in the paste data.
</ins><span class="cx"> 
</span><del>-        Newer versions of CMake are not able to find Freetype2 correctly.
-        FindFreetype2.cmake checks for the version number in freetype.h header, since it seems that bug exists in
-        freetype2 repo, because a completely different version number is found in freetype2.pc.
</del><ins>+        Internally Reviewed by Gen Mak.
</ins><span class="cx"> 
</span><del>-        * PlatformEfl.cmake:
-        * PlatformGTK.cmake:
</del><ins>+        * platform/blackberry/PasteboardBlackBerry.cpp:
+        (WebCore::Pasteboard::writeSelection):
</ins><span class="cx"> 
</span><del>-2014-03-20  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+2013-05-16  Eduardo Lima Mitev  &lt;elima@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Suppress errors about using gdk_threads_enter gdk_threads_leave
-        https://bugs.webkit.org/show_bug.cgi?id=130517
</del><ins>+        Missing UNUSED_PARAM macro for textPosition argument in WebKitAccessibleInterfaceText
+        https://bugs.webkit.org/show_bug.cgi?id=116230
</ins><span class="cx"> 
</span><del>-        Reviewed by Sergio Villar Senin.
</del><ins>+        Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        * plugins/gtk/gtk2xtbin.c: Use GCC suppression to suppress errors about deprecations.
</del><ins>+        No new functionality, no new tests.
</ins><span class="cx"> 
</span><del>-2014-03-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
+        (webkitAccessibleTextGetTextForOffset): List textPosition argument as
+        unused parameter for all platforms except GTK.
</ins><span class="cx"> 
</span><del>-        Cleanup in aisle r166017.
</del><ins>+2013-05-16  Jaehun Lim  &lt;ljaehun.lim@samsung.com&gt;
+
+        Frame flattening prevents &lt;HTML&gt; in &lt;OBJECT&gt; from having scrollbars
+        https://bugs.webkit.org/show_bug.cgi?id=115884
</ins><span class="cx">         
</span><del>-        visibleContentRectInternal() was dropping the scrollbar
-        inclusiveness on the floor, and we need to reset the top inset
-        between tests.
</del><ins>+        Reviewed by Antonio Gomes.
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::visibleContentRectInternal):
-        * testing/Internals.cpp:
-        (WebCore::Internals::resetToConsistentState):
</del><ins>+        Frame flattening should be applied when the frame owner is frame or iframe. But when
+        the frame owner is object element, frame flattening prevents it from having scrollbars.
+        In this situation, we can't scroll the html document in object element.
</ins><span class="cx"> 
</span><del>-2014-03-20  Enrica Casucci  &lt;enrica@apple.com&gt;
-
-        Build fix.
-
-        Removing unused variable.
</del><ins>+        This patch adds two helper functions to verify flattening conditions.
</ins><span class="cx">         
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::didPaintContents):
</del><ins>+        Test: fast/frames/flattening/scrolling-in-object.html
</ins><span class="cx"> 
</span><del>-2014-03-20  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        Rename TextTrackRegion/TextTrackRegionList to VTTRegion/VTTRegionList
-        https://bugs.webkit.org/show_bug.cgi?id=130543
-
-        Reviewed by Dean Jackson.
-
-        Merged from Blink (patch by philipj@opera.com):
-        https://chromium.googlesource.com/chromium/blink/+/69ee6d3399d64163e4936ac1bde222036c54c4b8
-        http://crbug.com/55653003
-
-        Tests: media/track/regions-webvtt/vtt-region-constructor.html
-               media/track/regions-webvtt/vtt-region-display.html
-               media/track/regions-webvtt/vtt-region-dom-layout.html
-               media/track/regions-webvtt/vtt-region-list.html
-               media/track/regions-webvtt/vtt-region-parser.html
-
-        * Configurations/FeatureDefines.xcconfig:
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::updateDisplay):
-        * html/track/LoadableTextTrack.cpp:
-        (WebCore::LoadableTextTrack::newRegionsAvailable):
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::ensureVTTRegionList):
-        (WebCore::TextTrack::regions):
-        (WebCore::TextTrack::addRegion):
-        (WebCore::TextTrack::removeRegion):
-        * html/track/TextTrack.h:
-        * html/track/TextTrack.idl:
-        * html/track/TextTrackCue.cpp:
-        * html/track/TextTrackRegion.cpp: Removed.
-        * html/track/TextTrackRegion.h: Removed.
-        * html/track/TextTrackRegion.idl: Removed.
-        * html/track/TextTrackRegionList.cpp: Removed.
-        * html/track/TextTrackRegionList.h: Removed.
-        * html/track/TextTrackRegionList.idl: Removed.
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::removeDisplayTree):
-        * html/track/VTTRegion.cpp: Copied from Source/WebCore/html/track/TextTrackRegion.cpp.
-        (WebCore::VTTRegion::VTTRegion):
-        (WebCore::VTTRegion::~VTTRegion):
-        (WebCore::VTTRegion::setTrack):
-        (WebCore::VTTRegion::setId):
-        (WebCore::VTTRegion::setWidth):
-        (WebCore::VTTRegion::setHeight):
-        (WebCore::VTTRegion::setRegionAnchorX):
-        (WebCore::VTTRegion::setRegionAnchorY):
-        (WebCore::VTTRegion::setViewportAnchorX):
-        (WebCore::VTTRegion::setViewportAnchorY):
-        (WebCore::VTTRegion::scroll):
-        (WebCore::VTTRegion::setScroll):
-        (WebCore::VTTRegion::updateParametersFromRegion):
-        (WebCore::VTTRegion::setRegionSettings):
-        (WebCore::VTTRegion::getSettingFromString):
-        (WebCore::VTTRegion::parseSettingValue):
-        (WebCore::VTTRegion::parseSetting):
-        (WebCore::VTTRegion::textTrackCueContainerScrollingClass):
-        (WebCore::VTTRegion::textTrackCueContainerShadowPseudoId):
-        (WebCore::VTTRegion::textTrackRegionShadowPseudoId):
-        (WebCore::VTTRegion::appendTextTrackCueBox):
-        (WebCore::VTTRegion::displayLastTextTrackCueBox):
-        (WebCore::VTTRegion::willRemoveTextTrackCueBox):
-        (WebCore::VTTRegion::getDisplayTree):
-        (WebCore::VTTRegion::prepareRegionDisplayTree):
-        (WebCore::VTTRegion::startTimer):
-        (WebCore::VTTRegion::stopTimer):
-        (WebCore::VTTRegion::scrollTimerFired):
-        * html/track/VTTRegion.h: Copied from Source/WebCore/html/track/TextTrackRegion.h.
-        (WebCore::VTTRegion::create):
-        * html/track/VTTRegion.idl: Copied from Source/WebCore/html/track/TextTrackRegion.idl.
-        * html/track/VTTRegionList.cpp: Copied from Source/WebCore/html/track/TextTrackRegionList.cpp.
-        (WebCore::VTTRegionList::VTTRegionList):
-        (WebCore::VTTRegionList::length):
-        (WebCore::VTTRegionList::item):
-        (WebCore::VTTRegionList::getRegionById):
-        (WebCore::VTTRegionList::add):
-        (WebCore::VTTRegionList::remove):
-        (WebCore::VTTRegionList::clear):
-        * html/track/VTTRegionList.h: Copied from Source/WebCore/html/track/TextTrackRegionList.h.
-        (WebCore::VTTRegionList::create):
-        (WebCore::VTTRegionList::~VTTRegionList):
-        * html/track/VTTRegionList.idl: Copied from Source/WebCore/html/track/TextTrackRegionList.idl.
-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTParser::parseFloatPercentageValue):
-        (WebCore::WebVTTParser::getNewRegions):
-        (WebCore::WebVTTParser::createNewRegion):
-        * html/track/WebVTTParser.h:
-        * loader/TextTrackLoader.cpp:
-        (WebCore::TextTrackLoader::getNewRegions):
-        * loader/TextTrackLoader.h:
-
-2014-03-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Fix the iOS build.
-
</del><span class="cx">         * page/FrameView.cpp:
</span><del>-        (WebCore::FrameView::willPaintContents):
-        (WebCore::FrameView::didPaintContents):
</del><ins>+        (WebCore::frameFlatteningEnabled): Added. Helper to check whether flattening is enabled or not.
+        (WebCore::supportsFrameFlattening): Added. Helper to check whether the frame owner is &lt;frame&gt; or &lt;iframe&gt;.
+        (WebCore::FrameView::avoidScrollbarCreation):
+        (WebCore::FrameView::calculateScrollbarModesForLayout): Use frameFlatteningEnabled().
+        (WebCore::FrameView::layout): Use frameFlatteningEnabled().
+        (WebCore::FrameView::isInChildFrameWithFrameFlattening): Use frameFlatteningEnabled().
</ins><span class="cx"> 
</span><del>-2014-03-20  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+2013-05-16  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] clamp RasterShape shapeMargin to reference box size
-        https://bugs.webkit.org/show_bug.cgi?id=130350
</del><ins>+        Port functions for pathhandling to Windows CE in FileSystemWin
+        https://bugs.webkit.org/show_bug.cgi?id=116208
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Corrected the way the maximum shape-margin value was computed for image valued
-        shapes. The limiting case is an image with just one above threshold pixel. The
-        largest possible value for shapeMargin is the radius of a circle that encloses
-        the size of the shape-outside element's margin-box, since the shape-outside's
-        boundary is clipped to the margin-box. The radius is just sqrt(2) * the margin-box's
-        largest dimension.
</del><ins>+        This will allow us to remove FileSystemWinCE in a next step.
</ins><span class="cx"> 
</span><del>-        Also cleaned up up a few poorly named parameters.
</del><ins>+        * platform/win/FileSystemWin.cpp:
+        (WebCore::pathByAppendingComponent):
+        (WebCore::pathGetFileName):
</ins><span class="cx"> 
</span><del>-        Test: fast/shapes/shape-outside-floats/shape-outside-one-pixel.html
</del><ins>+2013-05-16  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/RasterShape.cpp:
-        (WebCore::RasterShape::marginIntervals):
-        * rendering/shapes/RasterShape.h:
-        (WebCore::RasterShape::RasterShape):
-        * rendering/shapes/Shape.h:
</del><ins>+        PDFPlugins don't load when plugins are disabled, but they should
+        https://bugs.webkit.org/show_bug.cgi?id=75790
+        &lt;rdar://problem/11650197&gt;
</ins><span class="cx"> 
</span><del>-2014-03-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Build fix.
</del><ins>+        Make it possible to load &quot;application&quot; plug-ins even if settings or the FrameLoaderClient
+        say that plug-ins should be disabled, providing a mechanism for WebKit* to offer built-in
+        functionality which happens to use the plug-in infrastructure, and which also doesn't
+        unexpectedly disappear for users with plug-ins off.
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::paintContents):
</del><ins>+        * WebCore.exp.in:
+        Export SubframeLoader::allowPlugins().
+        Update signature for PluginData::supportsMimeType to include the AllowedPluginTypes argument.
</ins><span class="cx"> 
</span><del>-2014-03-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        Load PluginData even if plug-ins are disabled, but if that is the case, only
+        create a PluginDocument for application plug-ins.
</ins><span class="cx"> 
</span><del>-        Implement contentInset for Mac WebKit2
-        https://bugs.webkit.org/show_bug.cgi?id=130273
</del><ins>+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::appendBytes):
+        Don't bail if plug-ins are disabled, because we could still be a PluginDocument
+        for an application plug-in.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
-
-        This patch adds support for topContentInset(). If a page has a topContentInset(), 
-        the root layer’s position is adjusted to account for the inset. It is assumed that 
-        the area accounted for by the inset is visible but obscured, so scrollbars need to 
-        be moved so that they only cover the non-obscured area, and most parts of WebCore 
-        that wonder about visibleContentSize only care about the unobscured area, so this 
-        patch makes that visibleContentRect return the unobscuredRect. Finally since this 
-        is achieved by moving a layer’s position, the topContentInset() also needs to be 
-        factored into various functions that are used to convert between coordinate 
-        spaces. 
-
-        Return Page::topContentInset() if this is the main frame.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::topContentInset):
-        * page/FrameView.h:
-
-        Cache the inset on Page.
</del><span class="cx">         * page/Page.cpp:
</span><del>-        (WebCore::Page::Page):
-        * page/Page.h:
-        (WebCore::Page::topContentInset):
-        (WebCore::Page::setTopContentInset):
</del><ins>+        (WebCore::Page::pluginData):
+        Allow PluginData to be constructed even if plug-ins are disabled, as there might
+        be application plug-ins that we want to load anyway.
</ins><span class="cx"> 
</span><del>-        unobscuredContentRect() used to unconditionally return visibleContentRect() on 
-        non-iOS platforms. Now that it is possible for some technically visible content to 
-        be obscured, this code needed to be re-worked a bit to make some more sense. 
-        visibleContentRect() now represents that visible content that is completely 
-        unobscured, so it should call into unobscuredContentRect() rather than the other 
-        way around.
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::unobscuredContentRect):
</del><ins>+        * platform/mac/MIMETypeRegistryMac.mm:
+        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
+        On Mac, if we have PDFPlugin, we can support PDF and PostScript with a native application plug-in.
</ins><span class="cx"> 
</span><del>-        unscaledTotalVisibleContentSize() includes the size of all content that might be 
-        visible. Some of this content might be obscured.
-        (WebCore::ScrollView::unscaledTotalVisibleContentSize):
</del><ins>+        * plugins/PluginData.cpp:
+        (WebCore::PluginData::supportsMimeType):
+        Add an AllowedPluginTypes argument to supportsMimeType, allowing callers to specify
+        whether they are looking for any plug-in, or are looking only for application plug-ins.
</ins><span class="cx"> 
</span><del>-        Most of the time, we only care about the content that is FULLY visible. That is 
-        what you get from unscaledUnobscuredVisibleContentSize().
-        (WebCore::ScrollView::unscaledUnobscuredVisibleContentSize):
</del><ins>+        * plugins/PluginData.h:
+        (PluginInfo): Added an isApplicationPlugin field, to specify whether this is a &quot;built-in&quot; plug-in.
+        (PluginData): Add the aforementioned AllowedPluginTypes enum and the argument to supportsMimeType.
</ins><span class="cx"> 
</span><del>-        Use the unobscured size for these computations.
-        (WebCore::ScrollView::visibleContentRectInternal):
-        (WebCore::ScrollView::layoutSize):
</del><ins>+2013-05-16  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Factor in the topContentInset().
-        (WebCore::ScrollView::scrollOffsetRelativeToDocument):
-        (WebCore::ScrollView::scrollPositionRelativeToDocument):
</del><ins>+        [BlackBerry] Crash due to an assert running test editing/execCommand/indent-paragraphs.html
+        https://bugs.webkit.org/show_bug.cgi?id=114944
</ins><span class="cx"> 
</span><del>-        The scrollbars should be positioned to cover the non-obscured content only. 
-        (WebCore::ScrollView::updateScrollbars):
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Again, factor the topContentInset() into these conversions since the root layer’s 
-        position has been adjusted to account for it.
-        (WebCore::ScrollView::contentsToRootView):
-        (WebCore::ScrollView::contentsToWindow):
</del><ins>+        It crashes in network platform code when trying to save an
+        invalid URL in the disk cache. That test contains references to
+        empty URLs like http://. Those empty URLs, are parsed as http:/ by
+        KURL and considered valid. BlackBerry network platform uses GURL
+        which considers those URLs invalid. We needed to check that the
+        URLs are valid for our platform before starting the network
+        operation.
</ins><span class="cx"> 
</span><del>-         Just like the scrollbars, the scroll corner must be moved the account for the 
-        inset.
-        (WebCore::ScrollView::scrollCornerRect):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::topContentInset):
</del><ins>+        Fixes a crash running test
+        editing/execCommand/indent-paragraphs.html.
</ins><span class="cx"> 
</span><del>-        RenderLayerCompositor cares about unscaledTotalVisibleContentSize(). It does not 
-        care if some of that content is obscured.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::frameViewDidChangeSize):
</del><ins>+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob): Check if the request URL is
+        valid from the platform point of view right after creating the
+        platform network request and return early if the URL is invalid
+        with StatusErrorInvalidUrl error.
</ins><span class="cx"> 
</span><del>-        Move the root layer’s position based on the contentInset.
-        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
-        (WebCore::RenderLayerCompositor::ensureRootLayer):
</del><ins>+2013-05-16  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Allow setting contentInset via Internals for testing purposes.
-        * testing/Internals.cpp:
-        (WebCore::Internals::setTopContentInset):
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+        Remove unused function safeCreateFile() from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=116211
</ins><span class="cx"> 
</span><del>-2014-03-20  Laszlo Vidacs  &lt;lvidacs.u-szeged@partner.samsung.com&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Optimize RenderTable::colToEffCol() for tables without colspans
-        https://bugs.webkit.org/show_bug.cgi?id=129298
</del><ins>+        * platform/FileSystem.h:
+        * platform/win/FileSystemWin.cpp:
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-16  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Create an alternative fast path to RenderTable colToEffCol() and effColToCol()
-        when there is no colspan or colspan does not exceed the width of table.
-        Blink merge https://codereview.chromium.org/154243002 by rhogan
</del><ins>+        [curl] MIME type should be in lowercase
+        https://bugs.webkit.org/show_bug.cgi?id=116218
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::RenderTable):
-        (WebCore::RenderTable::appendColumn):
-        (WebCore::RenderTable::recalcSections):
-        * rendering/RenderTable.h:
-        (WebCore::RenderTable::colToEffCol):
-        (WebCore::RenderTable::effColToCol):
-        (WebCore::RenderTable::hasCellColspanThatDeterminesTableWidth):
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-2014-03-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Existing testcase: http/tests/mime/uppercase-mime-type.html
</ins><span class="cx"> 
</span><del>-        FrameView::paintContents() is not called for composited content
-        https://bugs.webkit.org/show_bug.cgi?id=130541
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::headerCallback): Convert the MIME type to lowercase.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+2013-05-16  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        FrameView::paintContents() is not called for frames that have
-        composited contents, yet it contains code that is expected
-        to run for all Frames.
-        
-        Fix by factoring into will/didPaintContents(), and calling
-        the will/did functions from RenderLayerBacking::paintIntoLayer().
-        
-        Also add a SetLayoutNeededForbiddenScope check for composited-layer
-        painting.
</del><ins>+        Web Inspector: Fix optional value of promptText in Inspector.json
+        https://bugs.webkit.org/show_bug.cgi?id=116203
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateControlTints):
-        (WebCore::FrameView::willPaintContents):
-        (WebCore::FrameView::didPaintContents):
-        (WebCore::FrameView::paintContents):
-        * page/FrameView.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintIntoLayer):
-
-2014-03-20  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        Fix the Mountain Lion build.
-
-        * platform/graphics/cocoa/IOSurface.mm:
-        (IOSurface::setIsPurgeable):
-
-2014-03-20  Brian Burg  &lt;bburg@apple.com&gt;
-
-        Web Replay: capture and replay mouse events
-        https://bugs.webkit.org/show_bug.cgi?id=129395
-
</del><span class="cx">         Reviewed by Joseph Pecoraro.
</span><span class="cx"> 
</span><del>-        Add support for capturing and replaying mouse inputs that come from WebKit2.
-        Hook up the UserInputBridge to session state changes in the ReplayController so
-        that the bridge knows when to capture or deny mouse inputs.
</del><ins>+        Merge from https://chromiumcodereview.appspot.com/14672031.
</ins><span class="cx"> 
</span><del>-        Test: ManualTests/inspector/replay-mouse-events.html
</del><ins>+        No new tests needed.
</ins><span class="cx"> 
</span><del>-        * platform/PlatformEvent.h: Give explicit storage types to Modifiers and Type enums
-        so they can be forward-declared.
-        * platform/PlatformMouseEvent.h: Give an explicit storage type to enum MouseButton.
-        Add operator== and operator!= for MouseButton to work around an MSVC bug.
</del><ins>+        * inspector/Inspector.json:
</ins><span class="cx"> 
</span><del>-        * replay/ReplayController.cpp: Perform session state changes in a helper function, and
-        at the same time change the state of the page's user input bridge.
-        (WebCore::ReplayController::setSessionState):
-        (WebCore::ReplayController::startCapturing):
-        (WebCore::ReplayController::stopCapturing):
-        (WebCore::ReplayController::startPlayback):
-        (WebCore::ReplayController::cancelPlayback):
</del><ins>+2013-05-16  Mary Wu  &lt;mary.wu@torchmobile.com.cn&gt;
</ins><span class="cx"> 
</span><del>-        * replay/ReplayInputDispatchMethods.cpp: Add dispatch methods for new inputs.
-        (WebCore::HandleMouseMove::dispatch):
-        (WebCore::HandleMousePress::dispatch):
-        (WebCore::HandleMouseRelease::dispatch):
</del><ins>+        [BlackBerry] Unable to download blob resource
+        https://bugs.webkit.org/show_bug.cgi?id=115888
</ins><span class="cx"> 
</span><del>-        * replay/SerializationMethods.cpp: Add helper macros so that encode/decode methods look
-        symmetric with one data member per line. This helps reduce unintentional inconsistencies.
-        (JSC::EncodingTraits&lt;PlatformMouseEvent&gt;::encodeValue): Added.
-        (JSC::EncodingTraits&lt;PlatformMouseEvent&gt;::decodeValue): Added.
-        * replay/SerializationMethods.h:
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * replay/UserInputBridge.cpp: Fill in the bridge method implementations for mouse
-        events, adding helpers and macros as necessary to reduce boilerplate.
-        (WebCore::UserInputBridge::activeCursor): Added.
-        (WebCore::UserInputBridge::handleMousePressEvent):
-        (WebCore::UserInputBridge::handleMouseReleaseEvent):
-        (WebCore::UserInputBridge::handleMouseMoveEvent):
-        (WebCore::UserInputBridge::handleMouseMoveOnScrollbarEvent):
</del><ins>+        Add BlobStream to handle over blob data from BlobResourceHandle to download stream.
+        RIM bug 331086, internally reviewed by Charles Wei and Leo Yang.
</ins><span class="cx"> 
</span><del>-        * replay/UserInputBridge.h: Add a bridge state enum along with getters and setters.
-        The enum value controls whether the bridge should capture commands, deny non-synthetic
-        commands (from the user), or allow anything to pass (the default).
-        (WebCore::UserInputBridge::setState): Added.
-        (WebCore::UserInputBridge::state): Added.
</del><ins>+        * PlatformBlackBerry.cmake:
+        * platform/network/blackberry/BlobStream.cpp: Added.
+        (WebCore):
+        (WebCore::BlobStream::BlobStream):
+        (WebCore::BlobStream::~BlobStream):
+        (WebCore::BlobStream::didReceiveData):
+        (WebCore::BlobStream::didFinishLoading):
+        (WebCore::BlobStream::didFail):
+        (WebCore::BlobStream::url):
+        (WebCore::BlobStream::mimeType):
+        * platform/network/blackberry/BlobStream.h: Added.
+        (WebCore):
+        (BlobStream):
</ins><span class="cx"> 
</span><del>-        * replay/WebInputs.json: Add inputs HandleMouseMove, HandleMousePress, HandleMouseRelease.
-        Add enum definitions for PlatformEvent::Type, PlatformEvent::Modifiers, and PlatformMouseEvent::MouseButton.
-        Alphabetize the existing data type definitions.
</del><ins>+2013-05-16  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-20  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Remove SystemTime header and implementations
+        https://bugs.webkit.org/show_bug.cgi?id=116200
</ins><span class="cx"> 
</span><del>-        Add WebCore::IOSurface wrapper
-        https://bugs.webkit.org/show_bug.cgi?id=130529
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        SystemTim just had a single function that's not called anymore. Remove it.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/cg/ColorCG.cpp:
-        * platform/graphics/cg/GraphicsContextCG.h:
-        (WebCore::cachedCGColorSpace):
-        Move cachedCGColorSpace out so that other clients of GraphicsContextCG
-        can use its mapping from WebCore::ColorSpace -&gt; CGColorSpaceRef.
-
-        * platform/graphics/cg/ImageBufferBackingStoreCache.cpp:
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        Add FIXMEs for ImageBuffer to adopt WebCore::IOSurface.
-
-        * platform/graphics/cocoa/IOSurface.h: Added.
-        * platform/graphics/cocoa/IOSurface.mm: Added.
-        (IOSurface::create):
-        (IOSurface::createFromMachPort):
-        (IOSurface::createFromSurface):
-        (IOSurface::IOSurface):
-        (IOSurface::maximumSize):
-        (IOSurface::createMachPort):
-        (IOSurface::createImage):
-        (IOSurface::ensurePlatformContext):
-        (IOSurface::ensureGraphicsContext):
-        (IOSurface::state):
-        (IOSurface::isPurgeable):
-        (IOSurface::setIsPurgeable):
-        (IOSurface::inUse):
-        Add WebCore::IOSurface.
-
-2014-03-20  Pratik Solanki  &lt;psolanki@apple.com&gt;
-
-        iOS build fix after r165992.
-
-        * generate-export-file:
-        (preprocessorMacros):
-
-2014-03-20  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
-
-        [WebRTC] Moving RTCConfiguration and RTCIceServer to Modules/mediastream
-        https://bugs.webkit.org/show_bug.cgi?id=130434
-
-        Reviewed by Eric Carlson.
-
-        Those classes are defined in WebRTC spec, so they should not be in platform layer.
-        Adding a platform implementation to be passed to handler classes.
-
-        * Modules/mediastream/RTCConfiguration.h: Copied from Source/WebCore/platform/mediastream/RTCConfiguration.h.
-        * Modules/mediastream/RTCIceServer.h: Copied from Source/WebCore/platform/mediastream/RTCIceServer.h.
-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::RTCPeerConnection):
-        (WebCore::RTCPeerConnection::updateIce):
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/mediastream/RTCConfigurationPrivate.h: Added.
-        * platform/mediastream/RTCIceServerPrivate.h: Added.
-        * platform/mediastream/RTCPeerConnectionHandler.h:
-        * platform/mock/RTCPeerConnectionHandlerMock.cpp:
-        (WebCore::RTCPeerConnectionHandlerMock::initialize):
-        (WebCore::RTCPeerConnectionHandlerMock::updateIce):
-        * platform/mock/RTCPeerConnectionHandlerMock.h:
-
-2014-03-20  Alex Christensen  &lt;achristensen@webkit.org&gt;
-
-        [WinCairo] Unreviewed speculative build after my r165996.
-
-        * platform/network/soup/AuthenticationChallengeSoup.cpp:
-        * platform/network/soup/CertificateInfo.cpp:
-        * platform/network/soup/CookieJarSoup.cpp:
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        * platform/network/soup/ResourceResponseSoup.cpp:
-        * platform/network/soup/SynchronousLoaderClientSoup.cpp:
-
-2014-03-20  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        Add a flushing mechanism for the WebVTTParser
-        https://bugs.webkit.org/show_bug.cgi?id=130532
-
-        Reviewed by Eric Carlson.
-
-        Merged from Blink (patch by vcarbune@chromium.org):
-        https://chromium.googlesource.com/chromium/blink/+/1ac2b3081492ab8661429230004013a9a3623f0f
-        http://crbug.com/54203003
-        https://chromium.googlesource.com/chromium/blink/+/24343d32bc36d20d59ef3e10040faddde65929e6
-        http://crbug.com/59453002
-        https://chromium.googlesource.com/chromium/blink/+/ef2793f1d9d207389589ecf9a136ea5c7170b4af
-        http://crbug.com/75233002
-        https://chromium.googlesource.com/chromium/blink/+/a29f2f8324abcd4826b41e7dc34373dee2ec57a9
-        http://crbug.com/52713005
-        https://chromium.googlesource.com/chromium/blink/+/7ce003c8d47b39f116f1f2a592a5dfb4a9e77228
-        http://crbug.com/64303004
-        https://chromium.googlesource.com/chromium/blink/+/18f896b3498478311e880f782813d5dfc8c0c7d1
-        http://crbug.com/96933004
-        https://chromium.googlesource.com/chromium/blink/+/8670e8ecb13254a651f5493ec83f4484d18c154e
-        http://crbug.com/98783005
-        https://chromium.googlesource.com/chromium/blink/+/4ac55780a6af3d76e0159c1d145330964ad56647
-        http://crbug.com/104713002
-
-        Tests: http/tests/media/track/track-webvtt-slow-loading-2.html
-               http/tests/media/track/track-webvtt-slow-loading.html
-
-        * CMakeLists.txt:
</del><span class="cx">         * GNUmakefile.list.am:
</span><ins>+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * PlatformWinCE.cmake:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
</ins><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj.filters:
</span><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * html/track/BufferedLineReader.cpp: Added.
-        * html/track/BufferedLineReader.h: Added.
-        * html/track/TextTrackRegion.cpp:
-        * html/track/VTTCue.cpp:
-        * html/track/WebVTTParser.cpp:
-        * html/track/WebVTTParser.h:
-        * loader/TextTrackLoader.cpp:
</del><ins>+        * history/PageCache.cpp:
+        * platform/SystemTime.h: Removed.
+        * platform/blackberry/SystemTimeBlackBerry.cpp: Removed.
+        * platform/efl/SystemTimeEfl.cpp: Removed.
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        * platform/mac/SystemTimeMac.cpp: Removed.
+        * platform/qt/TemporaryLinkStubsQt.cpp:
+        * platform/win/SystemTimeWin.cpp: Removed.
</ins><span class="cx"> 
</span><del>-2014-03-20  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+2013-05-16  Glenn Adams  &lt;glenn@skynav.com&gt;
</ins><span class="cx"> 
</span><del>-        Preparation for using Soup on Windows.
-        https://bugs.webkit.org/show_bug.cgi?id=130472
</del><ins>+        [Inspector] Don't filter syntax error caused by asterisk in CSS Property name.
+        https://bugs.webkit.org/show_bug.cgi?id=116196
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        Added Soup source to build on WinCairo.
-        * platform/network/curl/CookieJarCurl.cpp:
-        * platform/network/curl/CredentialStorageCurl.cpp:
-        * platform/network/curl/CurlCacheEntry.cpp:
-        * platform/network/curl/CurlCacheManager.cpp:
-        * platform/network/curl/CurlDownload.cpp:
-        * platform/network/curl/DNSCurl.cpp:
-        * platform/network/curl/FormDataStreamCurl.cpp:
-        * platform/network/curl/MultipartHandle.cpp:
-        * platform/network/curl/ProxyServerCurl.cpp:
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        * platform/network/curl/ResourceHandleManager.cpp:
-        * platform/network/curl/SSLHandle.cpp:
-        * platform/network/curl/SocketStreamHandleCurl.cpp:
-        Protected with USE(CURL) to avoid duplicate symbols when linking.
-        * platform/network/soup/AuthenticationChallengeSoup.cpp:
-        * platform/network/soup/CertificateInfo.cpp:
-        * platform/network/soup/CookieJarSoup.cpp:
-        * platform/network/soup/CookieStorageSoup.cpp:
-        * platform/network/soup/CredentialStorageSoup.cpp:
-        * platform/network/soup/DNSSoup.cpp:
-        * platform/network/soup/NetworkStorageSessionSoup.cpp:
-        * platform/network/soup/ProxyResolverSoup.cpp:
-        * platform/network/soup/ProxyServerSoup.cpp:
-        * platform/network/soup/ResourceErrorSoup.cpp:
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        * platform/network/soup/ResourceRequestSoup.cpp:
-        * platform/network/soup/ResourceResponseSoup.cpp:
-        * platform/network/soup/SocketStreamHandleSoup.cpp:
-        * platform/network/soup/SoupNetworkSession.cpp:
-        * platform/network/soup/SynchronousLoaderClientSoup.cpp:
-        Protected with USE(CURL) to avoid duplicate symbols when linking.
</del><ins>+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::addMessageToConsole):
+            - Remove questionable IE7 related error filtering
</ins><span class="cx"> 
</span><del>-2014-03-20  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+2013-05-16  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        iOS build fix after r165979.
</del><ins>+        Page::chrome() should return a reference.
+        &lt;http://webkit.org/b/116185&gt;
</ins><span class="cx"> 
</span><del>-        * generate-export-file:
-        (preprocessorMacros):
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-03-20  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+        A Page's chrome() can never be null. Change Page::chrome() to return a reference to reflect this.
+        Also, make Page::m_chrome a const member variable so nobody will accidentally set it to null.
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] getClientRects returns wrong rectangle
-        https://bugs.webkit.org/show_bug.cgi?id=128614
</del><ins>+2013-05-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Content disappears when scrolling http://www.childrenscancer.org/zach/
+        https://bugs.webkit.org/show_bug.cgi?id=116206
</ins><span class="cx"> 
</span><del>-        Added fast/multicol/newmulticol/client-rects.html and beefed up existing
-        fast/multicol/client-rects.html to use more writing modes.
</del><ins>+        Reviewed by Darin Adler.
+        
+        When a RenderLayerBacking gains or loses a foregroundLayer or backgroundLayer,
+        we need to repaint the primary layer, since what paints into that primary
+        layer will change.
+        
+        On the page in question, we gained/lost a foreground layer when scrolling because
+        the page popped an element into position:fixed.
</ins><span class="cx"> 
</span><del>-        * rendering/LayoutState.h:
-        Removed unused function.
</del><ins>+        Test: compositing/repaint/foreground-layer-change.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.h:
-        Make mapFlowToRegion virtual so that RenderMultiColumnFlowThread can
-        override it.
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::updateBackgroundLayer):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::mapFromFlowToRegion):
-        * rendering/RenderMultiColumnFlowThread.h:
-        Implement mapFlowToRegion to correctly translate a flow thread position
-        into a column offset within a region.
</del><ins>+2013-05-16  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::columnTranslationForOffset):
-        (WebCore::RenderMultiColumnSet::adjustRegionBoundsFromFlowThreadPortionRect):
-        * rendering/RenderMultiColumnSet.h:
-        Refactored some code to make a columnTranslationForOffset helper that
-        can be used by RenderMultiColumnFlowThread.
</del><ins>+        Do not indefinitely cache resources from blob URLs.
</ins><span class="cx"> 
</span><del>-2014-03-20  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Preserve original document URL for XSSAuditor reports
</del><ins>+        Alexey pointed out after I landed r150169 that blob URLs backed by
+        files should return an error if the file changed after the URL was
+        created. By indefinitely caching them in memory, we don't give the
+        loader a chance to check for modification. Remove &quot;blob&quot; from the list
+        of schemes that should be indefinitely cached.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by Tom Sepez):
-        https://src.chromium.org/viewvc/blink?view=rev&amp;revision=158406
</del><ins>+        * platform/SchemeRegistry.cpp:
+        (WebCore::SchemeRegistry::shouldCacheResponsesFromURLSchemeIndefinitely):
</ins><span class="cx"> 
</span><del>-        Test: http/tests/security/xssAuditor/report-script-tag-replace-state.html
</del><ins>+2013-05-16  Claudio Saavedra  &lt;csaavedra@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/parser/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::filterToken):
-        * html/parser/XSSAuditorDelegate.cpp:
-        (WebCore::buildConsoleError):
-        (WebCore::XSSAuditorDelegate::generateViolationReport):
-        (WebCore::XSSAuditorDelegate::didBlockScript):
-        * html/parser/XSSAuditorDelegate.h:
-        (WebCore::XSSInfo::XSSInfo):
</del><ins>+        [CSS] CSS Variables are case-sensitive
+        https://bugs.webkit.org/show_bug.cgi?id=116239
</ins><span class="cx"> 
</span><del>-2014-03-20  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        XSSAuditor bypass with frameset tags
</del><ins>+        The CSS Variables specification states that variables are
+        case-sensitive, unlike other CSS properties.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by Tom Sepez):
-        https://src.chromium.org/viewvc/blink?view=rev&amp;revision=157794
</del><ins>+        Test: fast/css/variables/case-sensitive.html
</ins><span class="cx"> 
</span><del>-        Test: http/tests/security/xssAuditor/frameset-injection.html
</del><ins>+        * css/CSSParser.cpp:
+        (WebCore::CSSParserString::substring): Replace
+        the now unnecessary lowerSubstring() with this method.
+        Also, since the method is only used by the CSS variables
+        implementation, #ifdef it.
+        (WebCore::CSSParser::createPrimitiveVariableNameValue):
+        (WebCore::CSSParser::storeVariableDeclaration):
+        Do not normalize variable declarations to lowercase.
+        * css/CSSParserValues.h:
+        (CSSParserString): Replace the lowerSubstring() declaration
+        and wrap with #if/#endif.
</ins><span class="cx"> 
</span><del>-        * html/parser/XSSAuditor.cpp:
-        (WebCore::XSSAuditor::filterStartToken):
-        (WebCore::XSSAuditor::filterFrameToken):
-        * html/parser/XSSAuditor.h:
</del><ins>+2013-05-16  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-20  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        svg/as-image/img-zoom-svg-stylesheet.html crashes with NetworkProcess enabled.
+        &lt;rdar://problem/13837408&gt; and https://bugs.webkit.org/show_bug.cgi?id=115917
</ins><span class="cx"> 
</span><del>-        Web Replay: fix some oversights in the replay backend
-        https://bugs.webkit.org/show_bug.cgi?id=130435
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Give WebKit2 the ability to not mis-cast.
</ins><span class="cx"> 
</span><del>-        This functionality will be covered by tests in https://webkit.org/b/130145.
</del><ins>+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::isEmptyFrameLoaderClient): Defaults to false, and include a FIXME
+          to remove it once https://bugs.webkit.org/show_bug.cgi?id=116233 is resolved.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorInstrumentation.cpp:
-        (WebCore::InspectorInstrumentation::playbackFinishedImpl):
-        * inspector/InspectorInstrumentation.h:
-        (WebCore::InspectorInstrumentation::playbackFinished):
-        * inspector/InspectorReplayAgent.cpp:
-        (WebCore::buildInspectorObjectForSegment):
-        (WebCore::InspectorReplayAgent::playbackFinished):
-        * inspector/InspectorReplayAgent.h: Add a playbackFinished event to Inspector
-        instrumentation. This is fired by ReplayController when playback is cancelled or 
-        playback of the final segment has completed.
</del><ins>+        * loader/EmptyClients.h: Make isEmptyFrameLoaderClient() return true, and add a FIXME to remove it.
</ins><span class="cx"> 
</span><del>-        * replay/EventLoopInputDispatcher.cpp:
-        (WebCore::EventLoopInputDispatcher::dispatchInputSoon): Fix wrong cast.
-        (WebCore::EventLoopInputDispatcher::dispatchInput): Ensure that m_dispatching is
-        false when m_running is false.
-        * replay/EventLoopInputDispatcher.h: Distinguish 'dispaching' and 'running' in comments.
-        (WebCore::EventLoopInputDispatcher::isRunning): Added.
</del><ins>+2013-05-14  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * replay/FunctorInputCursor.h: Since the base class InputCursor is RefCounted, the
-        Functor subclass cannot be put into a unique_ptr. Add create() method instead.
</del><ins>+        [GTK] Add support for building WebCore to the cmake build
+        https://bugs.webkit.org/show_bug.cgi?id=116128
</ins><span class="cx"> 
</span><del>-        * replay/ReplayController.cpp:
-        (WebCore::ReplayController::loadSegmentAtIndex): Renamed from loadSegment(). Callers
-        now pass in the desired segment index rather than the segment itself. The index is
-        necessary to properly reset m_position after the segment is loaded.
</del><ins>+        Reviewed by Gustavo Noronha Silva.
</ins><span class="cx"> 
</span><del>-        (WebCore::ReplayController::startPlayback): Set the dispatcher's speed before run().
-        (WebCore::ReplayController::pausePlayback): Only pause the dispatcher if it's running.
-        (WebCore::ReplayController::cancelPlayback): Add playbackFinished instrumentation.
-        (WebCore::ReplayController::replayToPosition):
-        (WebCore::ReplayController::didDispatchFinalInput): If there are no more segments to load,
-        manually adjust the final m_position and defer to cancelPlayback to unload the segment.
-        * replay/ReplayController.h:
-        * replay/ReplaySessionSegment.cpp:
-        (WebCore::ReplaySessionSegment::createFunctorCursor):
-        * replay/ReplaySessionSegment.h:
</del><ins>+        * PlatformGTK.cmake: Added.
+        * platform/gtk/GtkVersioning.c: Include &quot;config.h&quot; because we removed
+        the autotoolsconfig.h include from the header.
+        * platform/gtk/GtkVersioning.h: Remove autotoolsconfig.h include to support for
+        non-autotools build systems.
</ins><span class="cx"> 
</span><del>-2014-03-20  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+2013-05-15  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [iOS] Get code to compile on older iOS versions
-        https://bugs.webkit.org/show_bug.cgi?id=130142
-        &lt;rdar://problem/16302908&gt;
</del><ins>+        DocumentOrderedMap doesn't need to have two HashMaps
+        https://bugs.webkit.org/show_bug.cgi?id=116167
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
-        (-[WebVideoFullscreenController WebCore::]):
-        (-[WebVideoFullscreenController enterFullscreen:]):
-        (-[WebVideoFullscreenController exitFullscreen]):
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        * platform/mac/HTMLConverter.mm:
-        (_dateForString):
-        * platform/network/cf/CookieJarCFNet.cpp:
-        (WebCore::copyCookiesForURLWithFirstPartyURL):
-        * platform/text/ios/LocalizedDateCache.mm:
-        (WebCore::LocalizedDateCache::calculateMaximumWidth):
-        * platform/text/mac/LocaleMac.mm:
-        (WebCore::LocaleMac::LocaleMac):
</del><ins>+        Previously, we had two hash maps: m_map and m_duplicateCounts in DocumentOrderedMap to keep track
+        of the first element and the number of duplicates for a given name. This patch simplifies this structure
+        by having a single hash map that contains both the pointer and the number of duplicates.
</ins><span class="cx"> 
</span><del>-2014-03-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        In addition, this patch fixes a regression introduced in r149652 that window and document name maps
+        were not updated for some elements inside a SVG use element, and makes use of the newly added list of
+        the matching elements in SelectorQuery.
</ins><span class="cx"> 
</span><del>-        Followup build fix: AnimationBase.h needs to be private because
-        it's included by AnimationController.h.
</del><ins>+        * dom/DocumentOrderedMap.cpp:
+        (WebCore::DocumentOrderedMap::clear): Updated to use the new hash map.
+        (WebCore::DocumentOrderedMap::add): Ditto.
+        (WebCore::DocumentOrderedMap::remove): Ditto.
+        (WebCore::DocumentOrderedMap::get): Ditto.
+        (WebCore::DocumentOrderedMap::getAllElementsById): Added.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        * dom/DocumentOrderedMap.h:
</ins><span class="cx"> 
</span><del>-2014-03-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        (WebCore::DocumentOrderedMap::MapEntry::MapEntry): Added.
+        (WebCore::DocumentOrderedMap::containsSingle): Updated to use new hash map.
+        (WebCore::DocumentOrderedMap::contains): Ditto.
+        (WebCore::DocumentOrderedMap::containsMultiple): Ditto.
</ins><span class="cx"> 
</span><del>-        A completed fill-forwards animation should not disable overlap testing
-        https://bugs.webkit.org/show_bug.cgi?id=130522
-        &lt;rdar://problem/15862395&gt;
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::insertedInto): This function didn't add this element to window and document's name maps
+        if the element had already been inserted into a tree scope, and the current call was inserting an ancestor
+        of the tree scope into the document. We were exiting early per scope != treeScope().
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
-        
-        Previously, if -webkit-transform was being keyframe-animated, and the
-        animation had fill-forwards, then we would continue to think that the
-        animation is running and turn off compositing overlap testing. This
-        caused some sites to keep too much backing store around.
-        
-        Fix by having isRunning{Accelerated}AnimationOnRenderer take some flags
-        so that more specific questions about the running state can be asked.
-        For layer creation, keep using the same criteria as before (for now)
-        which includes paused and fill-forwards animations. For overlap testing,
-        don't include the fill-forwards test.
</del><ins>+        Fixed the bug by splitting updateId into two functions updateIdForTreeScope and updateIdForDocument.
+        The former is called when this element is inserted into a new tree scope, and the latter is called when
+        this element is inserted into a HTML document even if it had already been inside some tree scope.
</ins><span class="cx"> 
</span><del>-        Tests: compositing/animation/filling-animation-overlap-at-end.html
-               compositing/animation/filling-animation-overlap.html
-               compositing/animation/layer-for-filling-animation.html
</del><ins>+        (WebCore::Element::removedFrom): This function didn't remove this element from tree scope's id maps if
+        the tree scope wasn't a document. Fixed the bug by simply checking that the removal happens beneath the
+        current tree scope.
+        (WebCore::Element::updateName):
+        (WebCore::Element::updateNameForTreeScope): Renamed from updateName.
+        (WebCore::Element::updateNameForDocument): Extracted from updateName.
+        (WebCore::Element::updateId):
+        (WebCore::Element::updateIdForTreeScope): Renamed from updateId.
+        (WebCore::Element::updateIdForDocument): Extracted from updateId.
</ins><span class="cx"> 
</span><del>-        * page/animation/AnimationBase.h:
-        (WebCore::AnimationBase::fillingForwards):
-        (WebCore::AnimationBase::inPausedState):
-        (WebCore::AnimationBase::isAnimatingProperty):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::isRunningAnimationOnRenderer):
-        (WebCore::AnimationControllerPrivate::isRunningAcceleratedAnimationOnRenderer):
-        (WebCore::AnimationController::isRunningAnimationOnRenderer):
-        (WebCore::AnimationController::isRunningAcceleratedAnimationOnRenderer):
-        * page/animation/AnimationController.h:
-        * page/animation/AnimationControllerPrivate.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::isAnimatingProperty):
-        * page/animation/CompositeAnimation.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
-        (WebCore::RenderLayerCompositor::isRunningAcceleratedTransformAnimation):
</del><ins>+        * dom/Element.h:
</ins><span class="cx"> 
</span><del>-2014-03-20  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        * dom/SelectorQuery.cpp:
+        (WebCore::SelectorDataList::canUseIdLookup): Refactored to return the id subselector instead of checking if
+        the first subselector happens to be matching an id.
+        (WebCore::SelectorDataList::execute): Use the subselector canUseIdLookup returned. Also make use of newly
+        added getAllElementsById when there are multiple matching elements for a given id.
</ins><span class="cx"> 
</span><del>-        Canvas methods clip/fill/stroke should not except 0 argument
-        https://bugs.webkit.org/show_bug.cgi?id=130497
</del><ins>+        * dom/SelectorQuery.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::getAllElementsById): Added.
</ins><span class="cx"> 
</span><del>-        Do not allow nullable argument for fill/stroke/clip.
</del><ins>+        * dom/TreeScope.h:
</ins><span class="cx"> 
</span><del>-        No new tests. Updated existing tests.
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.idl:
</del><ins>+        [Mac] Make Clipboard::create functions for Mac platform independent by moving Pasteboard creation to Pasteboard functions
+        https://bugs.webkit.org/show_bug.cgi?id=116179
</ins><span class="cx"> 
</span><del>-2014-03-20  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        [iOS] Support MediaDocument when building with PLUGIN_PROXY_FOR_VIDEO
-        https://bugs.webkit.org/show_bug.cgi?id=130520
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::createForCopyAndPaste): Moved the function here from
+        ClipboardMac, and have it use Pasteboard functions that are not Mac-specific.
+        (WebCore::Clipboard::create): Ditto.
+        (WebCore::Clipboard::createForDragAndDrop): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        * platform/DragData.h:
+        (WebCore::DragData::pasteboardName): Made this const.
</ins><span class="cx"> 
</span><del>-        * dom/DOMImplementation.cpp:
-        (WebCore::DOMImplementation::createDocument): Check the isVideoPluginProxyEnabled setting 
-            when building with ENABLE_PLUGIN_PROXY_FOR_VIDEO.
</del><ins>+        * platform/Pasteboard.h: Added new create functions, used by the clipboard
+        create functions above.
</ins><span class="cx"> 
</span><del>-2014-03-20  Mihai Tica  &lt;mitica@adobe.com&gt;
</del><ins>+        * platform/mac/ClipboardMac.mm: Removed the functions that were moved to the
+        Clipboard.cpp file.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Blending operation is not isolated when setting z-index on parent from javascript
-        https://bugs.webkit.org/show_bug.cgi?id=129307
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::createForCopyAndPaste): Added.
+        (WebCore::Pasteboard::createPrivate): Added.
+        (WebCore::Pasteboard::createForDragAndDrop): Added.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2013-05-15  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reimplement the logic behind isolating blend modes. The blending operation should be limited to the
-        contents of the parent stacking context. The proposed solution implies adding logic in updateDescendantDependentFlags,
-        to track child elements that have blending and create a transparency layer that triggers isolation.
</del><ins>+        Fix a thinko.
</ins><span class="cx"> 
</span><del>-        Tests: css3/compositing/blend-mode-background.html
-               fast/repaint/blend-mode-isolate-stacking-context.html
</del><ins>+        We want to invalidate the file icon loader if it exists, not create it!
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::RenderLayer): Remove old members, add new members to constructor.
-        (WebCore::RenderLayer::updateBlendMode): Update parent stacking context isolation on blend mode change.
-        (WebCore::RenderLayer::updateNonCompositedParentStackingContextHasBlendedChild):
-        - Set m_hasBlendedElementInChildStackingContext for the non composited parent stacking context.
-        (WebCore::RenderLayer::dirtyAncestorParentStackingContextHasBlendedElement):
-        - Set flag so isolation should be considered in updateDescendantDependentFlags.
-        (WebCore::RenderLayer::nonCompositedParentStackingContextHasBlendedChild):
-        - Return whether the non composited parent stacking context isolates blending.
-        (WebCore::RenderLayer::updateDescendantDependentFlags): Add logic for isolating blending.
-        (WebCore::RenderLayer::addChild): Call to updateNonCompositedParentStackingContextHasBlendedChild if needed.
-        (WebCore::RenderLayer::removeChild): Call to dirtyAncestorParentStackingContextHasBlendedElement if needed.
-        (WebCore::RenderLayer::updateStackingContextsAfterStyleChange): Update isolation when a stacking context was set or unset.
-        (WebCore::RenderLayer::styleChanged): Removed oldStyle parameter from updateBlendMode call.
-         Update parent stacking context isolation on blend mode change.
-        * rendering/RenderLayer.h:
-        - Add members, getters and setters for tracking whether the element has a blended child:
-            - m_hasBlendedElementInChildStackingContext
-            - m_hasBlendedElementInChildStackingContextStatusDirty
-        - Removed m_updateParentStackingContextShouldIsolateBlendingDirty (replaced with m_hasBlendedElementInChildStackingContextStatusDirty)
-        - Removed m_isolatesBlending (replaced with m_hasBlendedElementInChildStackingContext)
-        - Updated the isolatesBlending method to return true only when the element is a stacking context and has a blended child.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Removed layer.updateParentStackingContextShouldIsolateBlending call.
</del><ins>+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::requestIcon):
</ins><span class="cx"> 
</span><del>-2014-03-20  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] [CMake] Do not compile ProxyResolverSoup.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=130516
</del><ins>+        Move drag-specific Clipboard functions inside ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=116176
</ins><span class="cx"> 
</span><del>-        Reviewed by Sergio Villar Senin.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Remove the file from the source list.
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::writeRange):
+        (WebCore::Clipboard::writePlainText):
+        (WebCore::Clipboard::writeURL):
+        Move these three functions inside ENABLE(DRAG_SUPPORT). Even though their names do
+        not make it obvious, these are here only for use by dragging code. Later we may
+        refactor them away entirely, but for now it's good not to compile them in on any
+        platform that does not support dragging.
</ins><span class="cx"> 
</span><del>-2014-03-20  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+2013-05-15  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165962.
-        https://bugs.webkit.org/show_bug.cgi?id=130512
</del><ins>+        Resources from non-HTTP schemes should not be cached indefinitely
+        https://bugs.webkit.org/show_bug.cgi?id=113626
</ins><span class="cx"> 
</span><del>-        It broke the build (Requested by Ossy on #webkit).
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        With the exception of schemes that we know will always return the same
+        result for a given URL, we should not indefinitely cache non-HTTP
+        resources when their freshness cannot be verified.
</ins><span class="cx"> 
</span><del>-        &quot;[EFL][GTK] Get CMake to find Freetype2 properly&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130150
-        http://trac.webkit.org/changeset/165962
</del><ins>+        Writing a test for this is blocked on https://webkit.org/b/116199.
</ins><span class="cx"> 
</span><del>-2014-03-20  Lorenzo Tilve  &lt;ltilve@igalia.com&gt;
</del><ins>+        The following two existing tests of memory cache behavior were
+        converted to HTTP tests so that they continue to function as expected:
</ins><span class="cx"> 
</span><del>-        &quot;input&quot; event is not fired when changing a select element's value
-        https://bugs.webkit.org/show_bug.cgi?id=117526
</del><ins>+        Tests: http/tests/cache/display-image-unset-allows-cached-image-load.html
+               http/tests/cache/willsendrequest-returns-null-for-memory-cache-load.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::freshnessLifetime): Returned a freshness
+        lifetime of 0 for non-HTTP schemes that can't be indefinitely cached.
+        * platform/SchemeRegistry.cpp:
+        (WebCore::SchemeRegistry::shouldCacheResponsesFromURLSchemeIndefinitely):
+        Checked whether the scheme is blob:, data:, or applewebdata:.
+        * platform/SchemeRegistry.h:
</ins><span class="cx"> 
</span><del>-        Add a call to dispatch input event when listbox or menulist
-        values are modified.
</del><ins>+2013-05-15  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        According to the spec: &quot;When the user agent is to send select update
-        notifications, queue a task to first fire a simple even that bubbles
-        named input at the select element, and then fire a simple event that
-        bubbles named change at the select element, using the user interaction
-        task source as the task source.&quot;
</del><ins>+        makeRGBAFromNSColor throws an exception if given a color in a greyscale colorspace
+        https://bugs.webkit.org/show_bug.cgi?id=116198
+        &lt;rdar://problem/13904395&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/forms/select/listbox-oninput-fired.html
-               fast/forms/select/menulist-oninput-fired.html
-
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::listBoxOnChange):
-        (WebCore::HTMLSelectElement::dispatchChangeEventForMenuList):
-
-2014-03-20  Radu Stavila  &lt;stavila@adobe.com&gt;
-
-        [CSS Regions] The height of a scrollable element flowed inside a scrollable region is not computed correctly
-        https://bugs.webkit.org/show_bug.cgi?id=129487
-
-        Reviewed by Andrei Bucur.
-
-        When propagating the layout overflow from the flowed element up to the flow thread itself,
-        the region's logical bottom padding and the element's logical bottom margin must be taken into consideration.
-        However, if the flowed element has overflow, the overflow will be painted over the region's padding
-        and the element's margin, in order to be compatible with the non-regions case.
-        More info can be found here: http://lists.w3.org/Archives/Public/www-style/2014Jan/0089.html
-
-        Tests: fast/regions/scrollable-region-content-size-horiz-bt.html
-               fast/regions/scrollable-region-content-size-no-overflow-horiz-bt.html
-               fast/regions/scrollable-region-content-size-no-overflow-vert-rl.html
-               fast/regions/scrollable-region-content-size-no-overflow.html
-               fast/regions/scrollable-region-content-size-relative.html
-               fast/regions/scrollable-region-content-size-vert-rl.html
-               fast/regions/scrollable-region-content-size-vertical-lr.html
-               fast/regions/scrollable-region-content-size.html
-               fast/regions/scrollable-region-scrollable-content.html
-
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::addRegionsOverflowFromChild):
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::rectFlowPortionForBox):
-
-2014-03-20  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Subpixel rendering: Nested layers with subpixel accumulation paint to wrong position.
-        https://bugs.webkit.org/show_bug.cgi?id=130153
-
</del><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        Subpixels (fractional device pixels here) can accumulate through nested layers. Subpixels
-        need to be propagated through the layer tree so that painting coordinates match layout coordinates.
</del><ins>+        Block Objective-C exceptions in makeRGBAFromNSColor.
+        Remove a comment saying that they're impossible.
</ins><span class="cx"> 
</span><del>-        Subpixel accumulation through nesting (absolute positioning, 2x display):
-        non-compositing case:
-        (nested boxes)  (layout pos) (norm.paint pos) (translate accumulation, subpixel accumulation, final paint pos)
-        div -&gt; top: 1.3px   1.3px     1.5px      1.5px 0.2px -&gt; snapped 0.0px -&gt; 1.5px
-         div -&gt; top: 1.3px   2.6px     2.5px      3.0px 0.4px -&gt; snapped 0.5px -&gt; 2.5px
-          div -&gt; top: 1.3px   3.9px     4.0px      4.5px 0.6px -&gt; snapped 0.5px -&gt; 4.0px
-           div -&gt; top: 1.3px   5.2px     5.0px      6.0px 0.8px -&gt; snapped 1.0px -&gt; 5.0px
</del><ins>+        Convert the incoming color to the DeviceRGB colorspace to match
+        existing color sources. Some rare cases (attributed strings that come
+        from PDFKit) can have DeviceGrayscale color spaces, which would
+        previously throw an exception here.
</ins><span class="cx"> 
</span><del>-        compositing case:
-        (nested boxes)  (layout pos) (norm.paint pos) (device pixel offset + fractional offset, final pos)
-        div -&gt; top: 1.3px   1.3px      1.5px      1.0px + 0.3px -&gt; snapped -&gt; 1.5px
-         div -&gt; top: 1.3px   2.6px      2.5px      2.5px + 0.1px -&gt; snapped -&gt; 2.5px
-          div -&gt; top: 1.3px   3.9px      4.0px      3.5px + 0.4px -&gt; snapped -&gt; 4.0px
-           div -&gt; top: 1.3px   5.2px      5.0px      5.0px + 0.2px -&gt; snapped -&gt; 5.0px
</del><ins>+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::makeRGBAFromNSColor):
</ins><span class="cx"> 
</span><del>-        Tests: compositing/hidpi-nested-compositing-layers-with-subpixel-accumulation.html
-               fast/layers/hidpi-nested-layers-with-subpixel-accumulation.html
</del><ins>+2013-05-15  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::devicePixelFractionFromRenderer):
</del><ins>+        BUILD FIX (r150140): Frame::editor() should return a reference for iOS, too
</ins><span class="cx"> 
</span><del>-2014-03-20  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+        * platform/ios/ClipboardIOS.mm:
+        (WebCore::ClipboardIOS::ClipboardIOS):
+        (WebCore::ClipboardIOS::hasData):
+        (WebCore::ClipboardIOS::clearData):
+        (WebCore::ClipboardIOS::clearAllData):
+        (WebCore::ClipboardIOS::getData):
+        (WebCore::ClipboardIOS::setData):
+        (WebCore::ClipboardIOS::types):
+        (WebCore::ClipboardIOS::writeRange):
+        * platform/ios/PasteboardIOS.mm:
+        (WebCore::Pasteboard::getStringSelection):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::documentFragmentWithRTF):
+        (WebCore::Pasteboard::documentFragmentForPasteboardItemAtIndex):
+        (WebCore::Pasteboard::documentFragment):
</ins><span class="cx"> 
</span><del>-        [EFL][GTK] Get CMake to find Freetype2 properly
-        https://bugs.webkit.org/show_bug.cgi?id=130150
</del><ins>+2013-05-15  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+        Stop using the factory pattern in FileIconLoaderClient
+        https://bugs.webkit.org/show_bug.cgi?id=116197
</ins><span class="cx"> 
</span><del>-        Newer versions of CMake are not able to find Freetype2 correctly.
-        FindFreetype2.cmake checks for the version number in freetype.h header, since it seems that bug exists in
-        freetype2 repo, because a completely different version number is found in freetype2.pc.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * PlatformEfl.cmake:
-        * PlatformGTK.cmake:
</del><ins>+        Move the FileIconLoader member out of FileIconLoaderClient and into FileInputType and remove the factory gunk.
</ins><span class="cx"> 
</span><del>-2014-03-20  Peter Molnar  &lt;pmolnar.u-szeged@partner.samsung.com&gt;
</del><ins>+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::~FileInputType):
+        (WebCore::FileInputType::requestIcon):
+        * html/FileInputType.h:
+        (FileInputType):
+        * platform/FileIconLoader.cpp:
+        (WebCore::FileIconLoader::invalidate):
+        * platform/FileIconLoader.h:
+        (WebCore::FileIconLoaderClient::~FileIconLoaderClient):
+        (FileIconLoader):
</ins><span class="cx"> 
</span><del>-        Refactor checking log channel state in MediaPlayerPrivateGStreamerBase.
-        https://bugs.webkit.org/show_bug.cgi?id=130241
</del><ins>+2013-05-15  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        Fix FileChooserClient design
+        https://bugs.webkit.org/show_bug.cgi?id=116195
</ins><span class="cx"> 
</span><del>-        The channel was passed around only to check its state. Cleaned this up
-        by adding a method to check whether a log channel is enabled.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * platform/Logging.cpp:
-        (WebCore::isLogChannelEnabled):
-        * platform/Logging.h:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
-        (WebCore::MediaPlayerPrivateGStreamerBase::createVideoSink):
</del><ins>+        FileChooserClient doesn't match the standard WebCore client idiom of only having virtual member functions.
+        Instead it holds on to its FileChooser and it's even a factory for creating new file choosers(!).
</ins><span class="cx"> 
</span><del>-2014-03-20  Lorenzo Tilve  &lt;ltilve@igalia.com&gt;
</del><ins>+        Fix this by making it an abstract class, and moving FileChooser into FileInputType.
</ins><span class="cx"> 
</span><del>-        Dispatch input event for Range element keyboard event
-        https://bugs.webkit.org/show_bug.cgi?id=129929
</del><ins>+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::~FileInputType):
+        Invalidate the file chooser.
</ins><span class="cx"> 
</span><del>-        Reviewed by Kent Tamura.
</del><ins>+        (WebCore::FileInputType::handleDOMActivateEvent):
+        Apply the file chooser settings.
</ins><span class="cx"> 
</span><del>-        For any value update, dispatch both input and change event.
-        Also removes extra dispatch change event, as event is dispatched
-        from TextFieldInputType:setValue.
</del><ins>+        (WebCore::FileInputType::applyFileChooserSettings):
+        Recreate the file chooser with new settings.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by Habib Virji):
-        https://src.chromium.org/viewvc/blink?revision=168558&amp;view=revision
</del><ins>+        (WebCore::FileInputType::receiveDropForDirectoryUpload):
+        Apply the settings.
</ins><span class="cx"> 
</span><del>-        Test: fast/forms/range/range-keyboard-oninput-event.html
</del><ins>+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::invalidate):
+        Set m_client to null.
</ins><span class="cx"> 
</span><del>-        * html/RangeInputType.cpp:
-        (WebCore::RangeInputType::handleKeydownEvent):
</del><ins>+        (WebCore::FileChooser::chooseFiles):
+        Early return.
</ins><span class="cx"> 
</span><del>-2014-03-20  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        * platform/FileChooser.h:
</ins><span class="cx"> 
</span><del>-        Refine BatteryStatus module
-        https://bugs.webkit.org/show_bug.cgi?id=130495
</del><ins>+2013-05-15  Gavin Barraclough  &lt;barraclough@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        ScriptedAnimationController::setThrottled should extend MinimumAnimationInterval
+        https://bugs.webkit.org/show_bug.cgi?id=116193
</ins><span class="cx"> 
</span><del>-        Small refinements:
-         - Return PassRef instead of PassRefPtr in create method
-         - Switched to nullptr instead of 0 where appropriate.
-         - Removed unused function and header file.
-         - Removed unnecessary empty lines.
</del><ins>+        Reviewed by Darin Adler
</ins><span class="cx"> 
</span><del>-        * Modules/battery/BatteryController.h:
-        * Modules/battery/BatteryManager.cpp:
-        (WebCore::BatteryManager::create): Make return passRef.
-        * Modules/battery/BatteryManager.h:
-        (WebCore::BatteryManager::batteryControllerDestroyed): Use nullptr.
-        * Modules/battery/BatteryStatus.cpp:
-        (WebCore::BatteryStatus::create): Make return passRef.
-        * Modules/battery/BatteryStatus.h:
-        * Modules/battery/NavigatorBattery.cpp:
-        (WebCore::NavigatorBattery::webkitBattery): Remove batteryManager().
-        * Modules/battery/NavigatorBattery.h:
</del><ins>+        * dom/ScriptedAnimationController.cpp:
+        (WebCore::ScriptedAnimationController::ScriptedAnimationController):
+        (WebCore::ScriptedAnimationController::setThrottled):
+        (WebCore::ScriptedAnimationController::scheduleAnimation):
+        * dom/ScriptedAnimationController.h:
+        (ScriptedAnimationController):
+            - Fixes for review comments.
</ins><span class="cx"> 
</span><del>-2014-03-19  Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+2013-05-15  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS] Get code to compile on older iOS versions
-        https://bugs.webkit.org/show_bug.cgi?id=130142
-        &lt;rdar://problem/16302908&gt;
</del><ins>+        Move HTTPRequest class to WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=116192
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
-        (-[WebVideoFullscreenController WebCore::]):
-        (-[WebVideoFullscreenController enterFullscreen:]):
-        (-[WebVideoFullscreenController exitFullscreen]):
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        * platform/mac/HTMLConverter.mm:
-        (_dateForString):
-        * platform/network/cf/CookieJarCFNet.cpp:
-        (WebCore::copyCookiesForURLWithFirstPartyURL):
-        * platform/text/ios/LocalizedDateCache.mm:
-        (WebCore::LocalizedDateCache::calculateMaximumWidth):
-        * platform/text/mac/LocaleMac.mm:
-        (WebCore::LocaleMac::LocaleMac):
</del><ins>+        HTTPRequest is only used by the &quot;remote inspector&quot; feature in WebKit2,
+        so there's no need to have it in WebCore.
</ins><span class="cx"> 
</span><del>-2014-03-19  Byungseon Shin  &lt;sun.shin@lge.com&gt;
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-        Fix &quot;WEBKIT_WEBGL_compressed_texture_pvrtc&quot; extension support
-        https://bugs.webkit.org/show_bug.cgi?id=130292
</del><ins>+2013-05-15  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        RefCountedArray needs to use vector initialisers for its backing store
+        https://bugs.webkit.org/show_bug.cgi?id=116194
</ins><span class="cx"> 
</span><del>-        WebGLRenderingContext::getExtension was not returning WEBGL_compressed_texture_pvrtc extension.
</del><ins>+        Reviewed by Gavin Barraclough.
</ins><span class="cx"> 
</span><del>-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::getExtension):
</del><ins>+        Update to use new functions for operating on the exception stack.
</ins><span class="cx"> 
</span><del>-2014-03-19  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * bindings/js/ScriptCallStackFactory.cpp:
+        (WebCore::createScriptCallStackFromException):
</ins><span class="cx"> 
</span><del>-        Merge Misc. WebVTT Updates from Blink.
-        https://bugs.webkit.org/show_bug.cgi?id=130491
</del><ins>+2013-05-15  Gavin Barraclough  &lt;barraclough@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        ScriptedAnimationController::setThrottled should extend MinimumAnimationInterval
+        https://bugs.webkit.org/show_bug.cgi?id=116193
</ins><span class="cx"> 
</span><del>-        Test: media/track/track-webvtt-tc030-interspersed-non-cue.html
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by vcarbune@chromium.org):
-        https://chromium.googlesource.com/chromium/blink/+/fb62b2b54944bd19026192c049a1db250756fc12
-        http://crbug.com/40323003
-        https://chromium.googlesource.com/chromium/blink/+/29176fb0b394a97e85f4dabc07e18329f3ceae41
-        http://crbug.com/54463002
-        https://chromium.googlesource.com/chromium/blink/+/29476f839a08cb17c5a3fc713f7e454e7cea9c60
-        http://crbug.com/55853002
-        https://chromium.googlesource.com/chromium/blink/+/ba2378ef873e786cf2937034e012669cdd37dfe8
-        http://crbug.com/65343003
-        https://chromium.googlesource.com/chromium/blink/+/1915b9aa1bba45aebf28531b40ae627ecf9a3d59
-        http://crbug.com/62833005
-        https://chromium.googlesource.com/chromium/blink/+/ea46dbd0f1f29779a1cd4f59b19361b803f09a9b
-        http://crbug.com/64273013
-        https://chromium.googlesource.com/chromium/blink/+/9eb4bb6b627357bb94d66386a4123ec004cccfc4
-        http://crbug.com/101513002
-        https://chromium.googlesource.com/chromium/blink/+/192a843b32eafb77bf92c50ec50d334ba935028a
-        http://crbug.com/102403002
-        https://chromium.googlesource.com/chromium/blink/+/15f9efcc952fcf73184e28fb9db79633c1fa6653
-        http://crbug.com/104443002
-        https://chromium.googlesource.com/chromium/blink/+/74fd66b451a464683f7cb748855b1740a54b2c16
-        http://crbug.com/75243004
</del><ins>+        * dom/ScriptedAnimationController.cpp:
+        (WebCore::ScriptedAnimationController::ScriptedAnimationController):
+            - initialize m_throttled
+        (WebCore::ScriptedAnimationController::setThrottled):
+            - sets m_throttled, reschedule when this changes.
+        (WebCore::ScriptedAnimationController::scheduleAnimation):
+            - if throtled don't use a display link, and extend the timeout.
+        * dom/ScriptedAnimationController.h:
+        (ScriptedAnimationController):
+            - Added m_throttled
</ins><span class="cx"> 
</span><del>-        * html/track/TextTrackRegion.cpp:
-        (WebCore::TextTrackRegion::parseSettingValue):
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::markFutureAndPastNodes):
-        (WebCore::VTTCue::setCueSettings):
-        * html/track/WebVTTParser.cpp:
-        (WebCore::scanDigits):
-        (WebCore::WebVTTParser::collectDigitsToInt):
-        (WebCore::WebVTTParser::parseFloatPercentageValue):
-        (WebCore::WebVTTParser::parseBytes):
-        (WebCore::WebVTTParser::collectMetadataHeader):
-        (WebCore::WebVTTParser::collectTimingsAndSettings):
-        (WebCore::WebVTTParser::createDocumentFragmentFromCueText):
-        (WebCore::WebVTTParser::createNewCue):
-        (WebCore::WebVTTParser::createNewRegion):
-        (WebCore::WebVTTParser::collectTimeStamp):
-        (WebCore::tokenToNodeType):
-        (WebCore::WebVTTParser::constructTreeFromToken):
-        * html/track/WebVTTParser.h:
-        * html/track/WebVTTToken.h:
-        (WebCore::WebVTTToken::name):
-        (WebCore::WebVTTToken::characters):
-        (WebCore::WebVTTToken::appendToCharacter):
-        (WebCore::WebVTTToken::addNewClass):
-        (WebCore::WebVTTToken::classes):
-        (WebCore::WebVTTToken::addNewAnnotation):
-        (WebCore::WebVTTToken::annotation):
-        * html/track/WebVTTTokenizer.cpp:
-        (WebCore::equalLiteral):
-        (WebCore::WebVTTTokenizer::WebVTTTokenizer):
-        (WebCore::WebVTTTokenizer::nextToken):
-        * html/track/WebVTTTokenizer.h:
</del><ins>+2013-05-08  Gavin Barraclough  &lt;barraclough@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-19  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+        Process suppression should throttle scripted animations
+        https://bugs.webkit.org/show_bug.cgi?id=115812
</ins><span class="cx"> 
</span><del>-        GC timer should intelligently choose between EdenCollections and FullCollections
-        https://bugs.webkit.org/show_bug.cgi?id=128261
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        &lt;rdar://problem/13799726&gt;
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        * WebCore.exp.in:
+            - Expose Page::setThrottled
+        * dom/Document.cpp:
+        (WebCore::Document::scriptedAnimationControllerSetThrottled):
+        (WebCore):
+        * dom/Document.h:
+        (Document):
+            - Forwards to ScriptedAnimationController::setThrottled
+        * dom/ScriptedAnimationController.cpp:
+        (WebCore::ScriptedAnimationController::setThrottled):
+        (WebCore):
+        * dom/ScriptedAnimationController.h:
+            - Force use of a timer.
+        (ScriptedAnimationController):
+        * page/Page.cpp:
+        (WebCore::Page::setThrottled):
+        (WebCore):
+        * page/Page.h:
+        (Page):
+            - When under throttling force the ScriptedAnimationController to use a timer.
</ins><span class="cx"> 
</span><del>-        Updated WebSafeGCActivityCallbacks for both Eden and Full timers.
</del><ins>+2013-05-15  Igor Oliveira  &lt;igor.o@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::commonVM):
-        * platform/ios/WebSafeGCActivityCallbackIOS.h:
</del><ins>+        Implement run-in remove child cases.
+        https://bugs.webkit.org/show_bug.cgi?id=86520
</ins><span class="cx"> 
</span><del>-2014-03-19  Andy Estes  &lt;aestes@apple.com&gt;
</del><ins>+        Move runin to original position when sibling element is destroyed.
</ins><span class="cx"> 
</span><del>-        Fix the iOS build after r165917.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebCoreSystemInterfaceIOS.mm:
</del><ins>+        Tests: fast/runin/runin-remove-child-simple.html
+               fast/runin/runin-sibling-inline.html
</ins><span class="cx"> 
</span><del>-2014-03-19  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::willBeDestroyed):
+        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):
+            If moveRunInUnderSiblingBlockIfNeeded is called when the sibling run-in block
+            is being destroyed, it means that the run-in is moving to original position and
+            we do not need to do nothing.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165926.
-        https://bugs.webkit.org/show_bug.cgi?id=130488
</del><ins>+2013-05-15  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        broke the iOS build (Requested by estes on #webkit).
</del><ins>+        Remove WebSocketHandshakeResponse class
+        https://bugs.webkit.org/show_bug.cgi?id=116190
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        &quot;GC timer should intelligently choose between EdenCollections
-        and FullCollections&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=128261
-        http://trac.webkit.org/changeset/165926
</del><ins>+        Just use ResourceResponse instead of WebSocketHandshakeResponse.
</ins><span class="cx"> 
</span><del>-2014-03-19  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
+        (WebCore::WebSocketHandshake::serverWebSocketProtocol):
+        (WebCore::WebSocketHandshake::serverSetCookie):
+        (WebCore::WebSocketHandshake::serverSetCookie2):
+        (WebCore::WebSocketHandshake::serverUpgrade):
+        (WebCore::WebSocketHandshake::serverConnection):
+        (WebCore::WebSocketHandshake::serverWebSocketAccept):
+        (WebCore::WebSocketHandshake::serverHandshakeResponse):
+        (WebCore::WebSocketHandshake::readHTTPHeaders):
+        * Modules/websockets/WebSocketHandshake.h:
+        * Modules/websockets/WebSocketHandshakeResponse.cpp: Removed.
+        * Modules/websockets/WebSocketHandshakeResponse.h: Removed.
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::didReceiveWebSocketHandshakeResponseImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didReceiveWebSocketHandshakeResponse):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        * inspector/InspectorResourceAgent.h:
+        (WebCore):
+        (InspectorResourceAgent):
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165929.
-        https://bugs.webkit.org/show_bug.cgi?id=130487
</del><ins>+2013-05-15  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        in order to roll out r165926 (Requested by estes on #webkit).
</del><ins>+        [Mac] media engine may deliver NULL in-band &quot;cue&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=116180
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-        http://trac.webkit.org/changeset/165929
</del><ins>+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
+        (WebCore::InbandTextTrackPrivateAVF::processCue): NULL check before logging cue count.
</ins><span class="cx"> 
</span><del>-2014-03-19  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Build fix for iOS after r165926
</del><ins>+        List platforms that still use the legacy clipboard instead of just saying &quot;not Mac&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=116177
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::commonVM):
-        * platform/ios/WebSafeGCActivityCallbackIOS.h:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-19  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        * dom/Clipboard.h: Replaced the &quot;!MAC || IOS&quot; with a list of platforms still on the
+        legacy model.
</ins><span class="cx"> 
</span><del>-        Allow media engine to update HTMLMediaElement state when playing to external device
-        https://bugs.webkit.org/show_bug.cgi?id=130480
</del><ins>+2013-05-15  Yongjun Zhang  &lt;yongjun_zhang@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        We should clear mainResource in DocumentLoader::cancelMainResourceLoad.
+        https://bugs.webkit.org/show_bug.cgi?id=116119
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.h: Add mediaPlayerHandlePlaybackCommand.
</del><ins>+        Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::handlePlaybackCommand): New.
-        * platform/graphics/MediaPlayer.h:
-        (WebCore::MediaPlayerClient::mediaPlayerHandlePlaybackCommand):
</del><ins>+        MainResourceLoader::clearResource() was left out in r146239 when moving MainResourceLoader::cancel()
+        to DocumentLoader::cancelMainResourceLoad(), we need to add it back to make sure m_mainResource is
+        cleared when we cancel the loader.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundation::rateChanged): Send Play and Pause commands when
-            playing to an external device.
</del><ins>+        No new tests needed.
</ins><span class="cx"> 
</span><del>-2014-03-19  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::~DocumentLoader):
+        (WebCore::DocumentLoader::continueAfterNavigationPolicy):
+        (WebCore::DocumentLoader::cancelMainResourceLoad):
+        (WebCore::DocumentLoader::clearMainResource):
+        (WebCore):
+        * loader/DocumentLoader.h: add helper method clearMainResource()
+        (DocumentLoader):
</ins><span class="cx"> 
</span><del>-        Implement isPointInPath and isPointInStroke with Path2D argument
-        https://bugs.webkit.org/show_bug.cgi?id=130473
</del><ins>+2013-05-15  Joe Mason  &lt;jmason@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        [BlackBerry] When HTTP auth fails, only purge credentials that match the failed credentials
+        https://bugs.webkit.org/show_bug.cgi?id=116164
</ins><span class="cx"> 
</span><del>-        Implement isPointInPath and isPointInStroke for 2D Canvas contxts
-        with Path2D argument.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><ins>+        Internal PR: 338490
+        Internally Reviewed By: Lyon Chen
</ins><span class="cx"> 
</span><del>-        Tests: fast/canvas/canvas-path-isPointInPath.html
-               fast/canvas/canvas-path-isPointInStroke.html
</del><ins>+        When there are multiple HTTP requests in flight with the same bad credentials (common with
+        proxy auth if the user mistyped their password), the first 407 that's received will cause
+        the credentials to be purged and the password dialog to open for new credentials. This means
+        that all 407's received after this should only purge the credentials if they have not
+        already been updated from the dialog; otherwise they will be wiping out credentials that
+        haven't failed yet.
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::isPointInPath):
-        (WebCore::CanvasRenderingContext2D::isPointInStroke):
-        (WebCore::CanvasRenderingContext2D::isPointInPathInternal):
-        (WebCore::CanvasRenderingContext2D::isPointInStrokeInternal):
-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/CanvasRenderingContext2D.idl:
</del><ins>+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::sendRequestWithCredentials):
+        (WebCore::NetworkJob::purgeCredentials):
</ins><span class="cx"> 
</span><del>-2014-03-13  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+2013-05-15  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        GC timer should intelligently choose between EdenCollections and FullCollections
-        https://bugs.webkit.org/show_bug.cgi?id=128261
</del><ins>+        AX: Use caching when requesting children object on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=116112
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        Building up the children list in the AX hierarchy can be time consuming. On iOS, this
+        is now much more noticeable (I believe due to the way tables calculate their AX ignored flag).
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebSafeGCActivityCallbackIOS.h: Update WebSafeGCActivityCallback
-        appropriately for the introduction of another type of GCActivityCallback.
</del><ins>+        We can speed everything up if we just cache the isIgnored() attribute while building up children.
</ins><span class="cx"> 
</span><del>-2014-03-18  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXAttributeCacheEnabler::AXAttributeCacheEnabler):
+        (WebCore):
+        (WebCore::AXAttributeCacheEnabler::~AXAttributeCacheEnabler):
+        * accessibility/AXObjectCache.h:
+        (AXAttributeCacheEnabler):
+        (WebCore):
+        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityHitTest:]):
+        (-[WebAccessibilityObjectWrapper accessibilityElementCount]):
+        (-[WebAccessibilityObjectWrapper accessibilityElementAtIndex:]):
+        (-[WebAccessibilityObjectWrapper indexOfAccessibilityElement:]):
+        (-[WebAccessibilityObjectWrapper accessibilityContainer]):
</ins><span class="cx"> 
</span><del>-        GC timer should intelligently choose between EdenCollections and FullCollections
-        https://bugs.webkit.org/show_bug.cgi?id=128261
</del><ins>+2013-05-15  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Remove WebSocketHandshakeRequest class
+        https://bugs.webkit.org/show_bug.cgi?id=116178
</ins><span class="cx"> 
</span><del>-        No new tests.
-
-        Updated WebSafeGCActivityCallbacks for both Eden and Full timers.
-
-        * platform/ios/WebSafeGCActivityCallbackIOS.h:
-
-2014-03-19  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Crash with long selector list
-        https://bugs.webkit.org/show_bug.cgi?id=123006
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Test: fast/css/long-selector-list-crash.html
</del><ins>+        Turns out WebSocketHandshakeRequest is just used by the web inspector, and there's no reason 
+        why we can't just use a ResourceRequest instead.
</ins><span class="cx"> 
</span><del>-        * css/CSSSelectorList.cpp:
-        (WebCore::CSSSelectorList::CSSSelectorList):
-        (WebCore::CSSSelectorList::adoptSelectorVector):
-        (WebCore::CSSSelectorList::operator=):
-        * css/StyleRule.cpp:
-        (WebCore::StyleRule::create):
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didOpenSocketStream):
+        * Modules/websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeRequest):
+        * Modules/websockets/WebSocketHandshake.h:
+        (WebCore):
+        * Modules/websockets/WebSocketHandshakeRequest.cpp: Removed.
+        * Modules/websockets/WebSocketHandshakeRequest.h: Removed.
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::willSendWebSocketHandshakeRequestImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willSendWebSocketHandshakeRequest):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        * inspector/InspectorResourceAgent.h:
+        (WebCore):
+        (InspectorResourceAgent):
+        * platform/network/HTTPRequest.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-            Add a bunch of asserts.
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):
-        
-            This could produce a zero-length selector list.
</del><ins>+        Try to fix iOS build.
</ins><span class="cx"> 
</span><del>-2014-03-19  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * platform/Pasteboard.h: Fix #if so that we don't try to compile pasteboard name code
+        on iOS.
</ins><span class="cx"> 
</span><del>-        Rebaseline bindings tests.
</del><ins>+2013-05-13  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/test/JS/*:
</del><ins>+        Frame::editor() should return a reference
+        https://bugs.webkit.org/show_bug.cgi?id=116037
</ins><span class="cx"> 
</span><del>-2014-03-04  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        [iOS][MediaControls] Reverse-pinching using the built-in controls should enter full screen
-        https://bugs.webkit.org/show_bug.cgi?id=129707
</del><ins>+        A frame's editor can never be null. Change Frame::editor() to return a reference to reflect this.
+        Also, make Frame::m_editor a const member variable so nobody will accidentally set it to null.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::hasMisspelling):
+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+        (AXAttributeStringSetSpelling):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::cloneChildNodes):
+        * dom/Document.cpp:
+        (WebCore::acceptsEditingFocus):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::command):
+        * editing/AlternativeTextController.cpp:
+        (WebCore::AlternativeTextController::timerFired):
+        (WebCore::AlternativeTextController::applyDictationAlternative):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::EditCommandComposition::unapply):
+        (WebCore::EditCommandComposition::reapply):
+        (WebCore::CompositeEditCommand::apply):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/DeleteButton.cpp:
+        (WebCore::DeleteButton::defaultEventHandler):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::show):
+        * editing/DeleteButtonController.h:
+        (WebCore::DeleteButtonControllerDisableScope::DeleteButtonControllerDisableScope):
+        (WebCore::DeleteButtonControllerDisableScope::~DeleteButtonControllerDisableScope):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+        (WebCore::DeleteSelectionCommand::doApply):
+        * editing/EditCommand.cpp:
+        (WebCore::EditCommand::EditCommand):
+        * editing/EditingStyle.cpp:
+        (WebCore::StyleChange::StyleChange):
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+        * editing/EditorCommand.cpp:
+        (WebCore::applyCommandToFrame):
+        (WebCore::executeToggleStyle):
+        (WebCore::executeApplyParagraphStyle):
+        (WebCore::expandSelectionToGranularity):
+        (WebCore::stateStyle):
+        (WebCore::valueStyle):
+        (WebCore::executeCopy):
+        (WebCore::executeCut):
+        (WebCore::executeDefaultParagraphSeparator):
+        (WebCore::executeDelete):
+        (WebCore::executeDeleteBackward):
+        (WebCore::executeDeleteBackwardByDecomposingPreviousCharacter):
+        (WebCore::executeDeleteForward):
+        (WebCore::executeDeleteToBeginningOfLine):
+        (WebCore::executeDeleteToBeginningOfParagraph):
+        (WebCore::executeDeleteToEndOfLine):
+        (WebCore::executeDeleteToEndOfParagraph):
+        (WebCore::executeDeleteToMark):
+        (WebCore::executeDeleteWordBackward):
+        (WebCore::executeDeleteWordForward):
+        (WebCore::executeFindString):
+        (WebCore::executeForwardDelete):
+        (WebCore::executeIgnoreSpelling):
+        (WebCore::executeInsertNewline):
+        (WebCore::executeMakeTextWritingDirectionLeftToRight):
+        (WebCore::executeMakeTextWritingDirectionNatural):
+        (WebCore::executeMakeTextWritingDirectionRightToLeft):
+        (WebCore::executeToggleOverwrite):
+        (WebCore::executePaste):
+        (WebCore::executePasteGlobalSelection):
+        (WebCore::executePasteAndMatchStyle):
+        (WebCore::executePasteAsPlainText):
+        (WebCore::executeRedo):
+        (WebCore::executeRemoveFormat):
+        (WebCore::executeSelectToMark):
+        (WebCore::executeSetMark):
+        (WebCore::executeStyleWithCSS):
+        (WebCore::executeUseCSS):
+        (WebCore::executeSwapWithMark):
+        (WebCore::executeTakeFindStringFromSelection):
+        (WebCore::executeTranspose):
+        (WebCore::executeUndo):
+        (WebCore::executeYank):
+        (WebCore::executeYankAndSelect):
+        (WebCore::supportedCopyCut):
+        (WebCore::supportedPaste):
+        (WebCore::enabledVisibleSelection):
+        (WebCore::enabledVisibleSelectionAndMark):
+        (WebCore::enableCaretInEditableText):
+        (WebCore::enabledCopy):
+        (WebCore::enabledCut):
+        (WebCore::enabledInEditableText):
+        (WebCore::enabledDelete):
+        (WebCore::enabledPaste):
+        (WebCore::enabledRedo):
+        (WebCore::enabledTakeFindStringFromSelection):
+        (WebCore::enabledUndo):
+        (WebCore::stateOrderedList):
+        (WebCore::stateStyleWithCSS):
+        (WebCore::stateUnorderedList):
+        (WebCore::valueDefaultParagraphSeparator):
+        * editing/FrameSelection.cpp:
+        (WebCore::shouldAlwaysUseDirectionalSelection):
+        (WebCore::FrameSelection::setSelection):
+        (WebCore::FrameSelection::nextWordPositionForPlatform):
+        (WebCore::FrameSelection::modifyMovingRight):
+        (WebCore::FrameSelection::modifyMovingLeft):
+        (WebCore::FrameSelection::modify):
+        (WebCore::shouldStopBlinkingDueToTypingCommand):
+        (WebCore::FrameSelection::shouldDeleteSelection):
+        (WebCore::FrameSelection::shouldChangeSelection):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::doApply):
+        * editing/SpellChecker.cpp:
+        (WebCore::SpellChecker::didCheck):
+        * editing/SpellingCorrectionCommand.cpp:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::insertText):
+        (WebCore::TypingCommand::lastTypingCommandIfStillOpenForTyping):
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/htmlediting.cpp:
+        (WebCore::createDefaultParagraphElement):
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::pasteWithPasteboard):
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::endEditing):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::subtreeHasChanged):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::handleKeydownEvent):
+        (WebCore::TextFieldInputType::didSetValueByUserEdit):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::clear):
+        * page/ContextMenuController.cpp:
+        (WebCore::insertUnicodeCharacter):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        (WebCore::ContextMenuController::populate):
+        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::find):
+        * page/DragController.cpp:
+        (WebCore::DragController::dispatchTextInputEventFor):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::startDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::handlePasteGlobalSelection):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::sendContextMenuEventForKey):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::defaultKeyboardEventHandler):
+        (WebCore::EventHandler::defaultTextInputEventHandler):
+        (WebCore::EventHandler::defaultBackspaceEventHandler):
+        * page/FocusController.cpp:
+        (WebCore::relinquishesEditingFocus):
+        * page/Frame.cpp:
+        (WebCore::Frame::rangeForPoint):
+        * page/Frame.h:
+        (Frame):
+        (WebCore::Frame::editor):
+        * page/Page.cpp:
+        (WebCore::Page::findString):
+        (WebCore::Page::findStringMatchingRanges):
+        (WebCore::Page::rangeOfString):
+        (WebCore::Page::markAllMatchesForText):
+        (WebCore::Page::setDeviceScaleFactor):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::writeRange):
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::asURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::getStringSelection):
+        (WebCore::Pasteboard::getDataSelection):
+        (WebCore::Pasteboard::writeSelectionForTypes):
+        (WebCore::writeURLForTypes):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::documentFragmentWithRTF):
+        (WebCore::Pasteboard::documentFragment):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::dictationAlternatives):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        * testing/Internals.cpp:
+        (WebCore::spellchecker):
+        (WebCore::Internals::resetToConsistentState):
+        (WebCore::Internals::hasSpellingMarker):
+        (WebCore::Internals::hasAutocorrectedMarker):
+        (WebCore::Internals::setContinuousSpellCheckingEnabled):
+        (WebCore::Internals::setAutomaticQuoteSubstitutionEnabled):
+        (WebCore::Internals::setAutomaticLinkDetectionEnabled):
+        (WebCore::Internals::setAutomaticDashSubstitutionEnabled):
+        (WebCore::Internals::setAutomaticTextReplacementEnabled):
+        (WebCore::Internals::setAutomaticSpellingCorrectionEnabled):
+        (WebCore::Internals::isOverwriteModeEnabled):
+        (WebCore::Internals::toggleOverwriteModeEnabled):
+        (WebCore::Internals::hasGrammarMarker):
</ins><span class="cx"> 
</span><del>-        The default controls on iOS should respond to a pinch gesture by entering fullscreen. Add a gesture
-        event listener, and enter full screen if the user does a quick (&gt;2 velocity) reverse (&gt;1.25 scale) pinch.
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.createBase):
-        (ControllerIOS.prototype.handlePlayButtonTouchEnd):
-        (ControllerIOS.prototype.handleBaseGestureStart):
-        (ControllerIOS.prototype.handleBaseGestureChange):
-        (ControllerIOS.prototype.handleBaseGestureEnd):
</del><ins>+        [Mac] Make Clipboard class no longer polymorphic by removing the last virtual functions
+        https://bugs.webkit.org/show_bug.cgi?id=116166
</ins><span class="cx"> 
</span><del>-2014-03-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-
-        REGRESSION(r156316): Scrollbar on a large document is broken
-        https://bugs.webkit.org/show_bug.cgi?id=130474
-        &lt;rdar://problem/16371523&gt;
-
</del><span class="cx">         Reviewed by Anders Carlsson.
</span><span class="cx"> 
</span><del>-        The bug was caused by updateArrowPlacement() doing the work even though Scrollbar Overlay API is available.
-        Prior to r156316, this function exited early:
-        http://trac.webkit.org/browser/trunk/Source/WebCore/platform/mac/ScrollbarThemeMac.mm?rev=156315#L147
</del><ins>+        * WebCore.exp.in: Add ~Clipboard since it's no longer a virtual function, but to the
+        non-iOS section, since iOS is still using the legacy version of Clipboard.
</ins><span class="cx"> 
</span><del>-        Fixed the bug by deleting updateArrowPlacement() entirely.
</del><ins>+        * dom/Clipboard.h: Mark items non-virtual, too. It's not implemented on Mac yet.
</ins><span class="cx"> 
</span><del>-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::preferencesChanged):
</del><ins>+2013-05-15  Dongseong Hwang  &lt;dongseong.hwang@intel.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-19  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Remove an overloaded strokeRect in &lt;canvas&gt;
+        https://bugs.webkit.org/show_bug.cgi?id=116017
</ins><span class="cx"> 
</span><del>-        [Mac][EME] Query whether decoder support exists before creating a new MediaKeys object.
-        https://bugs.webkit.org/show_bug.cgi?id=130459
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        The canvas spec [1] does not define strokeRect with 5 arguments, so this issue
+        remains only strokeRect with 4 arguments.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export the new WCSI method.
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::supportsKeySystem): Bail early if we have no decoder support.
-        * platform/mac/WebCoreSystemInterface.h: Provide a WCSI wrapper for WKSI.
-        * platform/mac/WebCoreSystemInterface.mm: Ditto.
</del><ins>+        [1] http://www.w3.org/TR/2dcontext2/
</ins><span class="cx"> 
</span><del>-2014-03-19  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Covered by existing tests: canvas/philip/tests/2d.missingargs.html
</ins><span class="cx"> 
</span><del>-        Make Remote Control commands testable
-        https://bugs.webkit.org/show_bug.cgi?id=130358
</del><ins>+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::strokeRect):
+        * html/canvas/CanvasRenderingContext2D.h:
+        (CanvasRenderingContext2D):
+        * html/canvas/CanvasRenderingContext2D.idl:
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+2013-05-15  Bruno de Oliveira Abinader  &lt;bruno.abinader@basyskom.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: media/video-remote-control-playpause.html
</del><ins>+        [css3-text] text-decoration-line now accepts &quot;blink&quot; as valid value
+        https://bugs.webkit.org/show_bug.cgi?id=116104
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Call session-&gt;clientWillPausePlayback.
-        (WebCore::HTMLMediaElement::didReceiveRemoteControlCommand): Log the command.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * platform/audio/MediaSession.cpp:
-        (WebCore::MediaSessionClient::mediaSessionTitle): Move from header file.
-        (WebCore::MediaSessionClient::mediaSessionDuration): Ditto.
-        (WebCore::MediaSessionClient::mediaSessionCurrentTime): Ditto.
-        * platform/audio/MediaSession.h:
</del><ins>+        As of November 13th 2012, the W3C specification has been updated to
+        accept &quot;blink&quot; as a valid property value in text-decoration-line. Though
+        accepting the value as valid, it is ignored as CSS Level 1
+        text-decoration property currently does.
</ins><span class="cx"> 
</span><del>-        * platform/audio/MediaSessionManager.cpp:
-        (WebCore::MediaSessionManager::MediaSessionManager): Get rid of m_activeSession.
-        (WebCore::MediaSessionManager::removeSession): No need to clear m_activeSession because 
-            we use the m_sessions vector.
-        (WebCore::MediaSessionManager::sessionWillBeginPlayback): setCurrentSession takes a 
-            MediaSession&amp;.
-        (WebCore::MediaSessionManager::sessionWillEndPlayback): Keep m_sessions sorted so playing
-            sessions are before paused sessions.
-        (WebCore::MediaSessionManager::setCurrentSession): Move the session that is beginning to
-            play to the head of m_sessions.
-        (WebCore::MediaSessionManager::currentSession): Return m_sessions[0] or nullptr.
-        (WebCore::MediaSessionManager::didReceiveRemoteControlCommand):
-        * platform/audio/MediaSessionManager.h:
</del><ins>+        Updated related layout tests to reflect changes in specification.
</ins><span class="cx"> 
</span><del>-        * platform/audio/ios/MediaSessionManagerIOS.mm: Include MediaPlayer.h.
</del><ins>+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseTextDecoration):
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp:
-        (WebCore::Internals::postRemoteControlCommand): New.
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+2013-05-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-19  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+        Revert http://trac.webkit.org/changeset/150047
+        
+        It introduced unwanted behavioral differences between
+        Retina and non-Retina Mac hardware.
</ins><span class="cx"> 
</span><del>-        Improving webkitGetUserMedia error handling and error messages
-        https://bugs.webkit.org/show_bug.cgi?id=130452
</del><ins>+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::requiresTiledLayer):
+        (WebCore::GraphicsLayerCA::computePixelAlignment):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Checking if first argument of webkitGetUserMedia is a valid Dictionary. If not, throw an exception with a
-        clearer message of the error.
</del><ins>+        [Mac] Remove the ClipboardMac class and header file
+        https://bugs.webkit.org/show_bug.cgi?id=116165
</ins><span class="cx"> 
</span><del>-        Test updated.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/NavigatorMediaStream.idl:
-        * UseJSC.cmake:
-        * bindings/js/JSNavigatorCustom.cpp: Added.
</del><ins>+        * WebCore.xcodeproj/project.pbxproj: Remove ClipboardMac.h.
+        * editing/mac/EditorMac.mm: Import Clipboard.h rather than ClipboardMac.h.
+        * page/mac/EventHandlerMac.mm: Ditto.
+        * platform/mac/ClipboardMac.h: Removed.
</ins><span class="cx"> 
</span><del>-2014-03-19  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * platform/mac/ClipboardMac.mm: Import Clipboard.h rather than ClipboardMac.h.
+        Deleted ClipboardMac constructor.
</ins><span class="cx"> 
</span><del>-        JSC bindings should use the passed-in global object for wrapper caching.
-        &lt;https://webkit.org/b/130458&gt;
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Take a shorter path to the DOMWrapperWorld by using the passed-in
-        global object instead of getting the lexical global from ExecState.
-        Removed an old FIXME that no longer applies since JSObjects can
-        always find the right global object these days.
</del><ins>+        [Mac] Change Clipboard::create functions so they don't use ClipboardMac::create any more
+        https://bugs.webkit.org/show_bug.cgi?id=116163
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoff Garen.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::getPropertyCSSValue):
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::createWrapper):
-        (WebCore::wrap):
-        (WebCore::getExistingWrapper):
-        (WebCore::createNewWrapper):
-        (WebCore::toJS):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::setTimeout):
-        (WebCore::JSDOMWindow::setInterval):
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::location):
-        (WebCore::toJS):
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLTemplateElementCustom.cpp:
-        (WebCore::JSHTMLTemplateElement::content):
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::createWrapperInline):
-        * bindings/js/JSNodeCustom.h:
-        (WebCore::toJS):
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSTextTrackCueCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSTrackCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSWorkerGlobalScopeCustom.cpp:
-        (WebCore::JSWorkerGlobalScope::setTimeout):
-        (WebCore::JSWorkerGlobalScope::setInterval):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
</del><ins>+        * dom/Clipboard.h: Made the file drag boolean default to false, better for most callers.
</ins><span class="cx"> 
</span><del>-2014-03-19  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        * platform/mac/ClipboardMac.mm: Remove #if ENABLE(DRAG_SUPPORT); that's always on for Mac
+        and it's not helpful to have the conditionals in here. It's helpful in cross-platform
+        source files.
+        (WebCore::Clipboard::create): Create a Pasteboard and then create a Clipboard with new.
+        Later could refactor to have the Pasteboard creation be platform-specific, and make these
+        functions platform-independent.
+        (WebCore::Clipboard::createForDragAndDrop): Ditto.
+        (WebCore::Clipboard::createForCopyAndPaste): Ditto.
</ins><span class="cx"> 
</span><del>-        Page::setPageScaleFactor should not force the scroll view position when using delegatesScrolling()
-        https://bugs.webkit.org/show_bug.cgi?id=130429
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        [Mac] Remove call to ClipboardMac::create from Editor::newGeneralClipboard
+        https://bugs.webkit.org/show_bug.cgi?id=116162
</ins><span class="cx"> 
</span><del>-        When setting the same scale mutliple time (for example on load), Page was asking the top scrollview
-        to scroll to the origin. This is bogus since the scroll view is driving Page::setDeviceScaleFactor,
-        not the other way around.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Simon fixed the general case in http://trac.webkit.org/changeset/165652/trunk/Source/WebCore/page/Page.cpp
-        but this branch was still scrolling content.
</del><ins>+        * dom/Clipboard.h: Add createForCopyAndPaste function.
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::setPageScaleFactor):
</del><ins>+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::newGeneralClipboard): Call createForCopyAndPaste.
</ins><span class="cx"> 
</span><del>-2014-03-19  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        * platform/mac/ClipboardMac.mm:
+        (WebCore::Clipboard::createForCopyAndPaste): Added. Moved code here from
+        Editor::newGeneralClipboard.
</ins><span class="cx"> 
</span><del>-        Filter out editable services from image menu for non-contenteditable images
-        &lt;rdar://problem/16319645&gt; and https://bugs.webkit.org/show_bug.cgi?id=130437
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        [Mac] Remove call to ClipboardMac::create from EventHandler::createDraggingClipboard
+        https://bugs.webkit.org/show_bug.cgi?id=116161
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-19  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+        * dom/Clipboard.h: Added createForDragAndDrop function.
</ins><span class="cx"> 
</span><del>-        Implement method addPath for Path2D
-        https://bugs.webkit.org/show_bug.cgi?id=130461
</del><ins>+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::createDraggingClipboard): Changed to use new Clipboard function
+        instead of ClipboardMac::create.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        * platform/mac/ClipboardMac.mm:
+        (WebCore::Clipboard::createForDragAndDrop): Added. For now it does exactly what the
+        EventHandler::createDraggingClipboard function did, soon to be refactored better.
</ins><span class="cx"> 
</span><del>-        Add support for the Path2D method addPath. The method allows
-        to append and existing Path2D object to another one. It can be
-        combined with a transformation matrix SVGMatrix.
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/canvas/canvas-path-addPath.html
</del><ins>+        [Mac] Thin out the ClipboardMac class and header file to prepare for deleting them
+        https://bugs.webkit.org/show_bug.cgi?id=116159
</ins><span class="cx"> 
</span><del>-        * html/canvas/DOMPath.h: Add new method addPath().
-        (WebCore::DOMPath::addPath):
-        * html/canvas/DOMPath.idl:
-        * platform/graphics/Path.h: Add support for appending paths.
-        * platform/graphics/cairo/PathCairo.cpp:
-        (WebCore::Path::addPath):
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::Path::addPath):
-        * platform/graphics/wince/PathWinCE.cpp:
-        (WebCore::Path::addPath):
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-19  Yongjun Zhang  &lt;yongjun_zhang@apple.com&gt;
</del><ins>+        * dom/Clipboard.h:
+        (WebCore::Clipboard::pasteboard): Added. For clients that have a DOM clipboard
+        object and need to get to the Pasteboard platform abstraction.
</ins><span class="cx"> 
</span><del>-        [iOS] WebKit2 Quicklook.
-        https://bugs.webkit.org/show_bug.cgi?id=130360
</del><ins>+        * editing/Editor.cpp:
+        (WebCore::Editor::dispatchCPPEvent): Call writePasteboard instead of writeClipboard.
+        Our long term plan is to delete writeClipboard.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        * platform/Pasteboard.h: Added writePasteboard function.
+        (WebCore::Pasteboard::name): Made this const.
</ins><span class="cx"> 
</span><del>-        Since ResourceLoaders using WebKit2 network process don't have ResourceHandle any more, we
-        need to make it possible to create QuickLookHandle from ResourceLoader.
</del><ins>+        * platform/mac/ClipboardMac.h: Deleted unneeded includes and forward declarations.
+        Deleted all the data members and the virtual destructor.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Make some QuickLookHandle methods visible from WebKit2.
-        * loader/ResourceLoader.h: Add m_quickLookHandle data member to ResourceLoader.
-        (WebCore::ResourceLoader::quickLookHandle):
-        (WebCore::ResourceLoader::setQuickLookHandle):
-        * platform/network/ios/QuickLook.h: Add a new method to create QuickLookHandle from ResourceLoader.
-        * platform/network/ios/QuickLook.mm:
-        (WebCore::QuickLookHandle::create):
</del><ins>+        * platform/mac/ClipboardMac.mm: Deleted the many includes that are no longer needed.
+        Deleted the destructor, since it's now automatically generated. Deleted the comment
+        on an #endif since it's only a few source lines away from the #if.
+        (WebCore::ClipboardMac::ClipboardMac): Deleted the code to set the data members,
+        since they are no longer used.
</ins><span class="cx"> 
</span><del>-2014-03-19  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * platform/mac/PasteboardMac.mm: Changed include to Clipboard.h instead of ClipboardMac.h.
+        (WebCore::Pasteboard::writePasteboard): Replaced writeClipboard with this.
</ins><span class="cx"> 
</span><del>-        Fix cue rendering test and include support for left/right alignment
-        https://bugs.webkit.org/show_bug.cgi?id=130406
</del><ins>+2013-05-15  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Web Inspector: Get rid of addNativeSnapshotChunk and HeapSnapshotChunk from Memory domain
+        https://bugs.webkit.org/show_bug.cgi?id=116144
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by vcarbune@chromium.org):
-        https://chromium.googlesource.com/chromium/blink/+/e695703cb603421c741e59a557a7989113c13b94
-        http://crbug.com/25155003
</del><ins>+        Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-        No new tests. Covered by media/track/track-cue-rendering-snap-to-lines-not-set.html.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        * html/track/VTTCue.cpp:
-        (WebCore::leftKeyword): Added.
-        (WebCore::rightKeyword): Added.
-        (WebCore::VTTCueBox::applyCSSProperties): Added.
-        (WebCore::VTTCue::VTTCue):
-        (WebCore::VTTCue::align): Handle left/right alignment.
-        (WebCore::VTTCue::setAlign): Ditto.
-        (WebCore::VTTCue::calculateDisplayParameters): Refactored and revised for left/right tokens.
-        (WebCore::VTTCue::setCueSettings): Ditto.
-        (WebCore::VTTCue::getCSSAlignment): Added.
-        (WebCore::VTTCue::getCSSWritingMode): Added.
-        * html/track/VTTCue.h:
</del><ins>+        * inspector/Inspector.json:
</ins><span class="cx"> 
</span><del>-2014-03-18  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+2013-05-15  Jocelyn Turcotte  &lt;jocelyn.turcotte@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        Add new functionality that will be required by the history item decoding
-        https://bugs.webkit.org/show_bug.cgi?id=130433
</del><ins>+        [Qt] Fix a crash under ~PingLoader when the QNAM on the page has been destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=116035
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Reviewed by Allan Sandfeld Jensen.
</ins><span class="cx"> 
</span><del>-        * platform/KeyedCoding.h:
-        (WebCore::KeyedDecoder::decodeConditionalObject):
</del><ins>+        The previous fix only moved the crash location from WebKit down to QNetworkReplyHttpImpl
+        which expects its QNetworkAccessManager to still be alive.
</ins><span class="cx"> 
</span><del>-2014-03-19  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Fix it by watching the QNetworkReply's destroyed() signal and avoid the dangling pointer
+        instead. The QNetworkReply doesn't need to be aborted in this case anyway.
</ins><span class="cx"> 
</span><del>-        Fix the iOS build.
</del><ins>+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::release):
+        (WebCore::QNetworkReplyWrapper::stopForwarding):
+          Rename resetConnections to stopForwarding since not all connections are related
+          to data forwarding to the client anymore.
+        (WebCore::QNetworkReplyWrapper::receiveMetaData):
+        (WebCore::QNetworkReplyWrapper::replyDestroyed):
+        (WebCore::QNetworkReplyWrapper::didReceiveFinished):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (QNetworkReplyWrapper):
</ins><span class="cx"> 
</span><del>-        * html/BaseDateAndTimeInputType.cpp:
-        (WebCore::BaseDateAndTimeInputType::parseToDateComponents):
-        Missing a StringView().
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-19  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        [Mac] Make Clipboard::declareAndWriteDragImage non-virtual
+        https://bugs.webkit.org/show_bug.cgi?id=116156
</ins><span class="cx"> 
</span><del>-        Tighten ElementRuleCollector::m_matchedRuleList typing
-        https://bugs.webkit.org/show_bug.cgi?id=130446
-
</del><span class="cx">         Reviewed by Anders Carlsson.
</span><span class="cx"> 
</span><del>-        StyleRuleBase -&gt; StyleRule.
</del><ins>+        * dom/Clipboard.h: Make declareAndWriteDragImage non-virtual for non-legacy.
</ins><span class="cx"> 
</span><del>-        * css/ElementRuleCollector.cpp:
-        (WebCore::ElementRuleCollector::matchedRuleList):
-        * css/ElementRuleCollector.h:
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::styleRulesForElement):
-        (WebCore::StyleResolver::pseudoStyleRulesForElement):
-        * css/StyleResolver.h:
-        * editing/EditingStyle.cpp:
-        (WebCore::styleFromMatchedRulesForElement):
-        * inspector/InspectorCSSAgent.cpp:
-        (WebCore::InspectorCSSAgent::getMatchedStylesForNode):
-        (WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):
-        * inspector/InspectorCSSAgent.h:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::getMatchedCSSRules):
</del><ins>+        * platform/Pasteboard.h:
+        (WebCore::Pasteboard::name): Added. Can be used in Mac platform code to do
+        pasteboard operations directly instead of through the Pasteboard class
+        functions. Not sure if we'll need it long term or not.
</ins><span class="cx"> 
</span><del>-2014-03-19  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        * platform/mac/ClipboardMac.h: Removed declareAndWriteDragImage function.
</ins><span class="cx"> 
</span><del>-        [CSSRegions] An unsplittable box is always displayed in a single region
-        https://bugs.webkit.org/show_bug.cgi?id=130451
</del><ins>+        * platform/mac/ClipboardMac.mm:
+        (WebCore::Clipboard::declareAndWriteDragImage): Made this function a Clipboard
+        member instead of ClipboardMac.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+2013-05-15  Peter Gal  &lt;galpeter@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Add an ASSERT stating that an unsplittable box region range always contains 1 region.
-        No new functionality, no new tests.
</del><ins>+        [curl] Remove version #if guards
+        https://bugs.webkit.org/show_bug.cgi?id=116152
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-03-19  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        No tests required.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Transform origin is miscalculated when RenderLayer's
-        offsetfromRenderer has device pixel fraction value.
-        https://bugs.webkit.org/show_bug.cgi?id=129859
</del><ins>+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::platformSetDefersLoading): Removed version guard.
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback): Ditto.
+        (WebCore::headerCallback): Ditto.
+        (WebCore::readCallback): Ditto.
+        (WebCore::ResourceHandleManager::dispatchSynchronousJob): Ditto.
+        (WebCore::ResourceHandleManager::initializeHandle): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-15  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        We need to calculate the transformed origin using the painting coordinates to produce
-        pixel precise result.
</del><ins>+        BUILD FIX (r150089): Make WebCoreTestShim build for iOS
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::computeTransformOriginForPainting):
-        * rendering/RenderLayerBacking.h:
</del><ins>+        * Configurations/WebCoreTestShim.xcconfig: Exclude
+        WebCoreTestShimLibrary.cpp when building for iOS.
</ins><span class="cx"> 
</span><del>-2014-03-19  Claudio Saavedra  &lt;csaavedra@igalia.com&gt;
</del><ins>+2013-05-15  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        [GStreamer] Clean timeout source ids
-        https://bugs.webkit.org/show_bug.cgi?id=130450
</del><ins>+        [CSSRegions] Implement offsetParent for elements inside named flow
+        https://bugs.webkit.org/show_bug.cgi?id=113276
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        In the offsetParent algorithm, the nearest ancestor search skips from the topmost named flow elements directly to the body element.
+        http://dev.w3.org/csswg/css-regions/#cssomview-offset-attributes
</ins><span class="cx"> 
</span><del>-        Sources IDs need to be cleaned up if the callback removes the
-        source, otherwise we'll be attempting to remove an empty source at
-        some point.
</del><ins>+        As a result of this change, the DumpRenderTree tool would crash in 
+        WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent when running the selecting-text-through-different-region-flows.html
+        test. The RenderObjects inside a flow are attached to the RenderFlowThread. However, the RenderFlowThread is attached to the 
+        RenderView directly, meaning that we are going to bypass the &lt;body&gt;'s RenderObject while iterating the parents.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/WebKitMediaSourceGStreamer.cpp:
-        (webKitMediaVideoSrcStart): Clean the source id.
-        (webKitMediaAudioSrcStart): Ditto.
-        (webKitMediaVideoSrcSeekMainCb): Ditto.
-        (webKitMediaAudioSrcSeekMainCb): Ditto.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-03-19  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        Tests: fast/regions/offsetParent-body-in-flow-thread.html
+               fast/regions/offsetParent-in-flow-thread.html
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Compute region ranges for children of inline blocks
-        https://bugs.webkit.org/show_bug.cgi?id=130392
-
-        Reviewed by Andrei Bucur.
-
-        Extend the region ranges computation for children of inline blocks.
-        When we cannot retrieve the region range for a box using cached information,
-        either from region range map or from the region cached on the RootInlineBox,
-        try to find the top most unsplittable box up to the flow thread boundary.
-        If we find such unsplittable box and the box has a region range, then return
-        this range.
-
-        Before this patch, method getRegionRangeForBox did not return true/false
-        if it was able to retrieve the range and the caller checked the returned
-        region values. I modified the method to return true if we were able to compute
-        the range.
-
-        Tests: fast/regions/inline-block-inline-children-flowed-in-regions.html
-               fast/regions/inline-blocks-dyn-enlarged-regions.html
-               fast/regions/inline-blocks-dyn-shrunk-regions.html
-               fast/regions/inline-blocks-in-two-regions.html
-
-        * inspector/InspectorOverlay.cpp:
-        (WebCore::buildObjectForRendererFragments):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::updateRegionRangeForBoxChild):
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::hasNextPage):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::clampToStartAndEndRegions):
-        (WebCore::RenderBox::borderBoxRectInRegion):
-        (WebCore::RenderBox::computeRectForRepaint):
-        (WebCore::RenderBox::layoutOverflowRectForPropagation):
</del><span class="cx">         * rendering/RenderBoxModelObject.cpp:
</span><del>-        (WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::regionForCompositedLayer):
-        (WebCore::RenderFlowThread::adjustedPositionRelativeToOffsetParent):
-        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo):
-        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock):
-        (WebCore::RenderFlowThread::getRegionRangeForBoxFromCachedInfo):
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
-        (WebCore::RenderFlowThread::objectShouldPaintInFlowRegion):
-        (WebCore::RenderFlowThread::objectInFlowRegion):
-        (WebCore::RenderFlowThread::addRegionsVisualEffectOverflow):
-        (WebCore::RenderFlowThread::addRegionsVisualOverflowFromTheme):
-        (WebCore::RenderFlowThread::addRegionsOverflowFromChild):
-        (WebCore::RenderFlowThread::addRegionsLayoutOverflow):
-        (WebCore::RenderFlowThread::addRegionsVisualOverflow):
-        (WebCore::RenderFlowThread::clearRegionsOverflow):
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::fragmentFromAbsolutePointAndBox):
</del><ins>+        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
</ins><span class="cx">         * rendering/RenderObject.cpp:
</span><del>-        (WebCore::RenderObject::locateFlowThreadContainingBlock):
-        Make sure we return the right render flow thread in the case of
-        region-based multicolumn inside named flows.
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::rectFlowPortionForBox):
</del><ins>+        (WebCore::RenderObject::offsetParent):
</ins><span class="cx"> 
</span><del>-2014-03-19  Krzysztof Wolanski  &lt;k.wolanski@samsung.com&gt;
</del><ins>+2013-05-15  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [EFL] vibration/cancelVibration-during-pattern-vibrating.html is failing after r165598
-        https://bugs.webkit.org/show_bug.cgi?id=130333
</del><ins>+        [Mac] Make Clipboard::createDragImage non-virtual
+        https://bugs.webkit.org/show_bug.cgi?id=116136
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Added setting m_state when calling Vibration::vibrate. It was missing after
-        refactoring Vibration (r165598).
</del><ins>+        * dom/Clipboard.h: Made createDragImage non-virtual for non-legacy.
</ins><span class="cx"> 
</span><del>-        * Modules/vibration/Vibration.cpp:
-        (WebCore::Vibration::vibrate):
</del><ins>+        * platform/mac/ClipboardMac.h: Removed frame argument from create function
+        and constructor. Removed createDragImage and dragNSImage. Removed m_frame
+        data member.
</ins><span class="cx"> 
</span><del>-2014-03-19  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::ClipboardMac): Removed frame argument and code
+        to initialize m_frame.
+        (WebCore::Clipboard::createDragImage): Merged the createDragImage and
+        dragNSImage functions, since they were the same thing. Changed code to get
+        the frame from the drag image element. Made the createDragImage function
+        a Clipboard member instead of ClipboardMac.
</ins><span class="cx"> 
</span><del>-        Rewrite WebHTMLConverter::_colorForNode in C++
-        https://bugs.webkit.org/show_bug.cgi?id=130443
</del><ins>+2013-05-15  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><ins>+        [WINCE] Fix calls to GlyphPage::setGlyphDataForIndex()
+        https://bugs.webkit.org/show_bug.cgi?id=116137
+
</ins><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.mm:
-        (_platformColor):
-        Rename from _colorForRGBColor and simplify to just do the platform conversion.
</del><ins>+        Use zero for the glyp when the fontData pointer is null.
+        This aligns GlyphPageTreeNodeWinCE with the other implementations
+        and makes all ASSERT() pass in setGlyphDataForIndex().
</ins><span class="cx"> 
</span><del>-        (normalizedColor):
-        Extract normalization out of _colorForRGBColor and remove cases that are impossible to hit
-        due to us only ever using the device color space.
</del><ins>+        * platform/graphics/wince/GlyphPageTreeNodeWinCE.cpp:
+        (WebCore::GlyphPage::fill):
</ins><span class="cx"> 
</span><del>-        (HTMLConverterCaches::colorPropertyValueForNode):
-        (-[WebHTMLConverter _colorForNode:property:]):
-        Convert to C++.
</del><ins>+2013-05-15  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (-[WebHTMLConverter dealloc]):
-        (-[WebHTMLConverter init]):
-        Remove caches, we already cache in ColorMac.
</del><ins>+        Do not bloat HTMLTokenizer with a giant inline InputStreamPreprocessor::peek
+        https://bugs.webkit.org/show_bug.cgi?id=116066
</ins><span class="cx"> 
</span><del>-2014-03-18  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Strange layout for content with region breaks
-        https://bugs.webkit.org/show_bug.cgi?id=121318
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/45e0337b2f2db535ab08365f6e763a5015e4d990.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+        On x86_64, this removes 40kb from the binary. On my machine it is completely neutral on performance.
</ins><span class="cx"> 
</span><del>-        When break-inside: avoid is used on an element, the implementation tries to
-        force it inside a single fragmentation container even though the descendants
-        of the element specify forced breaks. This leads to unexpected results and
-        unstable layout.
</del><ins>+        * html/parser/InputStreamPreprocessor.h:
+        (WebCore::InputStreamPreprocessor::peek):
+        (InputStreamPreprocessor):
+        (WebCore::InputStreamPreprocessor::advance):
+        (WebCore::InputStreamPreprocessor::skipNextNewLine):
+        (WebCore::InputStreamPreprocessor::reset):
+        (WebCore::InputStreamPreprocessor::processNextInputCharacter):
</ins><span class="cx"> 
</span><del>-        The change extends the definition of unsplittable elements for flow threads
-        using the same conditions found inside RenderBlockFlow::adjustForUnsplittableChild.
-        This change forces elements that require break avoidance to have a single region
-        in the region range. As a result, forced breaks have no effect inside them.
</del><ins>+2013-05-14  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        It should be noted this may not the behavior defined by the CSS3 Fragmentation spec.
-        From my understanding of the text, forced breaks override any avoidance specified
-        by ancestor elements. However, implementing this is a larger change that will require
-        a fundamental new approach in handling break avoidance. This patch just brings
-        consistency to the API.
</del><ins>+        Remove WTF_USE_PLATFORM_STRATEGIES
+        https://bugs.webkit.org/show_bug.cgi?id=114431
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/forced-break-inside-avoid-break.html
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::childBoxIsUnsplittableForFragmentation):
-        (WebCore::RenderBlock::computeRegionRangeForBoxChild):
-        (WebCore::RenderBlock::estimateRegionRangeForBoxChild):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::adjustForUnsplittableChild): Move the avoidance conditions inside
-        a helper method RenderBlock::childBoxIsUnsplittableForFragmentation.
</del><ins>+        * Modules/webdatabase/DatabaseManager.cpp:
+        (WebCore::DatabaseManager::DatabaseManager):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks):
+        (WebCore::ContainerNode::resumePostAttachCallbacks):
+        * dom/VisitedLinkState.cpp:
+        (WebCore::VisitedLinkState::determineLinkStateSlowCase):
+        * loader/CookieJar.cpp:
+        (WebCore::cookies):
+        (WebCore::setCookies):
+        (WebCore::cookiesEnabled):
+        (WebCore::cookieRequestHeaderFieldValue):
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/HistoryController.cpp:
+        (WebCore::addVisitedLink):
+        * loader/LoaderStrategy.cpp:
+        * loader/LoaderStrategy.h:
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::resourceLoadScheduler):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources):
+        (WebCore::ResourceLoader::willSendRequest):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::load):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::performPostLoadActions):
+        * platform/CookiesStrategy.h:
+        * platform/DatabaseStrategy.cpp:
+        * platform/DatabaseStrategy.h:
+        * platform/PasteboardStrategy.h:
+        * platform/PlatformStrategies.cpp:
+        * platform/PlatformStrategies.h:
+        * platform/VisitedLinkStrategy.h:
+        * platform/mac/PasteboardMac.mm:
+        * platform/network/BlobRegistry.cpp:
+        (WebCore::blobRegistry):
+        * plugins/PluginData.cpp:
+        (WebCore::PluginData::initPlugins):
+        * plugins/PluginStrategy.h:
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::transientLocalStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        * storage/StorageStrategy.cpp:
+        * storage/StorageStrategy.h:
+        * workers/SharedWorkerStrategy.h:
</ins><span class="cx"> 
</span><del>-2014-03-18  Samuel White  &lt;samuel_white@apple.com&gt;
</del><ins>+2013-05-15  Dávid Szabolcs  &lt;David.Szabolcs@stud.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        AX: Not able to use arrow keys to read text with VoiceOver before selection is set someplace (anyplace).
-        https://bugs.webkit.org/show_bug.cgi?id=130250
</del><ins>+        [curl] Add support for HttpOnly cookies
+        https://bugs.webkit.org/show_bug.cgi?id=116102
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        If initial selection isn't set when we handle selection movement for accessibility, we need to set it. If we don't, using arrow
-        keys to read text with VoiceOver doesn't work as expected. Things will only start working after the user holds shift and arrows
-        around to select any arbitrary thing to force selection to get set. This logic handles that special case more gracefully.
</del><ins>+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::addMatchingCurlCookie):
+        (WebCore::cookiesForSession):
+        (WebCore::cookiesForDOM):
+        (WebCore):
+        (WebCore::cookieRequestHeaderFieldValue):
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/accessibility/selection-initial.html
</del><ins>+2013-05-14  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/EventHandler.cpp:
-        (WebCore::handleKeyboardSelectionMovement):
-        (WebCore::EventHandler::handleKeyboardSelectionMovementForAccessibility):
-        * testing/Internals.cpp:
-        (WebCore::Internals::resetToConsistentState):
</del><ins>+        REGRESSION(r147548): Broken comboboxes
+        https://bugs.webkit.org/show_bug.cgi?id=115475
</ins><span class="cx"> 
</span><del>-2014-03-18  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Gustavo Noronha Silva.
</ins><span class="cx"> 
</span><del>-        TextTrackRegion Not Implemented
-        https://bugs.webkit.org/show_bug.cgi?id=116546
</del><ins>+        The problem is that r147548 made the popup to be closed when a
+        blur event is received. Right before showing the popup the input
+        element is focused, so that after the the popup is shown the focus
+        event is emitted and the event handler is called again hiding the
+        popup.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler): Check
+        element has lost the focus before closing the popup menu.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by vcarbune@chromium.org):
-        https://chromium.googlesource.com/chromium/blink/+/4940f89a087fea5b5ea628e98d0b355d398a9eea
-        http://crbug.com/25798003
</del><ins>+2013-05-14  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: media/track/regions-webvtt/text-track-region-display.html
-               media/track/regions-webvtt/text-track-region-dom-layout.html
</del><ins>+        [Mac] Move setDragImage from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116036
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        * html/track/LoadableTextTrack.cpp:
-        (WebCore::LoadableTextTrack::newRegionsAvailable):
-        * html/track/TextTrack.cpp:
-        * html/track/TextTrack.h:
-        * html/track/TextTrackRegion.cpp:
-        (WebCore::TextTrackRegion::TextTrackRegion):
-        (WebCore::TextTrackRegion::appendTextTrackCueBox):
-        * html/track/TextTrackRegion.h:
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::VTTCue):
-        (WebCore::VTTCue::notifyRegionWhenRemovingDisplayTree):
-        (WebCore::VTTCue::removeDisplayTree):
-        * html/track/VTTCue.h:
-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTParser::parseBytes):
-        (WebCore::WebVTTParser::collectMetadataHeader):
-        * html/track/WebVTTParser.h:
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-03-18  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::~Clipboard): Stop loading the drag image when
+        the clipboard object is deallocated. It would be better if there was
+        a more-well-defined time to stop the load.
+        (WebCore::Clipboard::setDragImage): Added. Sets up a drag image
+        based on a CachedImage. This tells the image loader to load the image
+        and updates the drag image when the image arrives. Copied from the
+        code in ClipboardMac, but refactored to use a separate loader object.
+        (WebCore::Clipboard::setDragImageElement): Added. Sets up a drag image
+        based on an element.
+        (WebCore::Clipboard::updateDragImage): Added. Common code to update
+        drag image when a new one is set or when a drag image load completes.
+        (WebCore::DragImageLoader::create): Added.
+        (WebCore::DragImageLoader::DragImageLoader): Ditto.
+        (WebCore::DragImageLoader::startLoading): Ditto.
+        (WebCore::DragImageLoader::stopLoading): Ditto.
+        (WebCore::DragImageLoader::imageChanged): Ditto.
</ins><span class="cx"> 
</span><del>-        Share MemoryPressureHandler::releaseMemory() between platforms.
-        &lt;https://webkit.org/b/130416&gt;
</del><ins>+        * dom/Clipboard.h: Made setDragImage and setDragImageElement non-virtual
+        for non-legacy. Added updateDragImage and m_dragImageLoader.
</ins><span class="cx"> 
</span><del>-        Move the code that scours WebKit for things we can free up right now
-        to the common part of MemoryPressureHandler. This will enable other
-        platforms to do the same thing under pressure.
</del><ins>+        * platform/Pasteboard.h: Added setDragImage function.
</ins><span class="cx"> 
</span><del>-        There's now also a platformReleaseMemory() where platform-specific
-        pressure relief stuff can go.
</del><ins>+        * platform/mac/ClipboardMac.h: Removed CachedImageClient as a base class
+        for ClipboardMac. Removed setDragImage and setDragImageElement.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        * platform/mac/ClipboardMac.mm: Removed setDragImage and setDragImageElement.
+        (WebCore::ClipboardMac::~ClipboardMac): Removed code to remove self as
+        client loading the drag image. This is now in the Clipboard base class.
</ins><span class="cx"> 
</span><del>-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::releaseMemory):
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
-        * platform/MemoryPressureHandler.h:
-        * platform/mac/MemoryPressureHandlerMac.mm:
-        (WebCore::MemoryPressureHandler::respondToMemoryPressure):
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::setDragImage): Added. Contains code moved here
+        from ClipboardMac.
</ins><span class="cx"> 
</span><del>-2014-03-18  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+2013-05-14  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [WebGL] Destroy EAGLContext's backing store
-        https://bugs.webkit.org/show_bug.cgi?id=130439
-        &lt;rdar://problem/16295217&gt;
</del><ins>+        Use ElementTraversal in SelectorDataList::execute
+        https://bugs.webkit.org/show_bug.cgi?id=116131
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        When a GraphicsContext3D is being destroyed, we should
-        also remove any EAGLContext backing store.
</del><ins>+        Use ElementTraversal::firstWithin and ElementTraversal::next to simplify the code.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/GraphicsContext3DMac.mm:
-        (WebCore::GraphicsContext3D::~GraphicsContext3D):
</del><ins>+        * dom/SelectorQuery.cpp:
+        (WebCore::SelectorDataList::execute):
</ins><span class="cx"> 
</span><del>-2014-03-18  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+2013-05-14  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS][WebKit2] Mark layer contents as being opaque if they are
-        https://bugs.webkit.org/show_bug.cgi?id=130427
-        &lt;rdar://problem/15540434&gt;
</del><ins>+        [wk2] Not updating tiled backing coverage when main frame scrollability changes
+        https://bugs.webkit.org/show_bug.cgi?id=116123
+        &lt;rdar://problem/13836559&gt;
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::GraphicsLayerClient::paintsOpaquelyAtNonIntegralScales):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateContentsOpaque):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintsOpaquelyAtNonIntegralScales):
-        * rendering/RenderLayerBacking.h:
-        r159463 stopped us from setting layers opaque if they were being painted
-        at non-integral scale. This makes sense for compositing layers, which
-        are painted by arbitrary elements, but the main frame's RenderView
-        will always paint its entire contents. To restore the opaque contents
-        optimization to the main frame's tiles, don't de-opaquify layers
-        belonging to the main frame's RenderView.
</del><ins>+        Export FrameView::adjustTiledBackingCoverage.
</ins><span class="cx"> 
</span><del>-2014-03-18  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Unify &lt;media&gt; element callback registration and unregistration
-        https://bugs.webkit.org/show_bug.cgi?id=130417
</del><ins>+2013-05-14  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        [Mac] Add a testing shim for secure event input functions
+        https://bugs.webkit.org/show_bug.cgi?id=116122
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        (WebCore::HTMLMediaElement::~HTMLMediaElement):
-        (WebCore::HTMLMediaElement::registerWithDocument):
-        (WebCore::HTMLMediaElement::unregisterWithDocument):
-        (WebCore::HTMLMediaElement::didMoveToNewDocument):
-        * html/HTMLMediaElement.h:
</del><ins>+        Reviewed by Mark Rowe.
</ins><span class="cx"> 
</span><del>-2014-03-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Added a new target with a dynamic library that interposes secure event input functions.
+        We need this to avoid interfering with user session state.
</ins><span class="cx"> 
</span><del>-        MediaDocument should set a max-width on its &lt;video&gt; element.
-        https://bugs.webkit.org/show_bug.cgi?id=114691
</del><ins>+        * Configurations/WebCoreTestShim.xcconfig: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/DynamicLinkerInterposing.h: Moved from Source/WebKit2/Shared/mac/DyldInterpose.h.
+        * testing/WebCoreTestShimLibrary.cpp: Added.
+        (shimEnableSecureEventInput):
+        (shimDisableSecureEventInput):
+        (shimIsSecureEventInputEnabled):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-05-14  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Set a style attribute containing max-width:100% and max-height:100% so that large videos
-        are entirely visible within the browser window bounds.
</del><ins>+        Get rid of Gradient::getColor()
+        https://bugs.webkit.org/show_bug.cgi?id=116089
</ins><span class="cx"> 
</span><del>-        * html/MediaDocument.cpp:
-        (WebCore::MediaDocumentParser::createDocumentStructure):
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-18  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+        This code is now useless, remove it.
</ins><span class="cx"> 
</span><del>-        [WebRTC] Fix layering violation in RTCStatsRequest
-        https://bugs.webkit.org/show_bug.cgi?id=130426
</del><ins>+        * html/canvas/CanvasGradient.h:
+        (CanvasGradient):
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::Gradient):
+        (WebCore::Gradient::hash):
+        * platform/graphics/Gradient.h:
+        (Gradient):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-05-14  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        RTCStatsRequest::track() should return a MediaStreamTrackPrivate*.
</del><ins>+        REGRESSION: united.com has overlapping elements and is broken by flex box changes.
+        https://bugs.webkit.org/show_bug.cgi?id=115329
+        &lt;rdar://problem/13690610&gt;
+        
+        The new flexbox spec says that flex-basis omitted in the flex shorthand defaults to
+        0 when flex-grow/shrink are set. This has undesirable behavior when objects don't
+        end up flexing at all, and it's something the spec is going to eventually address.
+        
+        For now, though, to fix the regression, I'm making a targeted &quot;hack&quot; to deliberately
+        violate the spec, but to do so as minimally as possible. This hack detects if there
+        is infinite available space on a line, and if so, it treats a flex-basis of 0 like
+        auto.
+        
+        This means that when height is constrained and set by a container, flexing will do
+        the right thing. Basically any time you end up actually flexing, the spec behavior
+        should happen. If you're just laying out at intrinsic sizes, though, and no flexing
+        is going to occur, we ignore a flex-basis of 0 and just use the child's normal size.
+        
+        Note that widths don't have to be patched because the preferred logical widths
+        algorithm is broken right now and not checking flex-basis. If it did, we'd have seen
+        the same bug in the width direction.
+        
+        This width issue is covered by https://bugs.webkit.org/show_bug.cgi?id=116117
+        
+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        No new tests needed.
</del><ins>+        Added fast/flexbox/auto-height-with-flex.html
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::getStats):
-        * Modules/mediastream/RTCStatsRequestImpl.cpp:
-        (WebCore::RTCStatsRequestImpl::create):
-        (WebCore::RTCStatsRequestImpl::RTCStatsRequestImpl):
-        (WebCore::RTCStatsRequestImpl::track):
-        * Modules/mediastream/RTCStatsRequestImpl.h:
-        * platform/mediastream/RTCStatsRequest.h:
</del><ins>+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::mainAxisContentExtent):
+        Make sure we return LayoutUnit::max when you have infinite free space and not
+        max - borderPadding.
</ins><span class="cx"> 
</span><del>-2014-03-18  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
+        Only clear override size if it was set. Only mark for relayout if we did
+        an override size clear (i.e., if we were actually flexed). Add a new parameter,
+        hasInfiniteLineLength, that - if set - causes us to special case flex-basis:0
+        and treat it like flex-basis:auto.
</ins><span class="cx"> 
</span><del>-        Fix a trivial FIXME
-        https://bugs.webkit.org/show_bug.cgi?id=130432
</del><ins>+        (WebCore::RenderFlexibleBox::layoutFlexItems):
+        Define hasInfiniteLineLength and pass it to all the functions that need it.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        Remove the code that marks for layout and does a layout so early. This code
+        is moving (and changing) to preferredMainAxisContentExtentForChild.
</ins><span class="cx"> 
</span><del>-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::encodeBackForwardTreeNode):
</del><ins>+        (WebCore::RenderFlexibleBox::computeNextFlexLine):
+        Computes whether or not we have infinite line length now.
</ins><span class="cx"> 
</span><del>-2014-03-18  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        (WebCore::RenderFlexibleBox::freezeViolations):
+        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
+        Propagate hasInfiniteLineLength through to preferredMainAxisContentExtentForChild.
</ins><span class="cx"> 
</span><del>-        Begin cleaning up KeyedDecoder and KeyedEncoder
-        https://bugs.webkit.org/show_bug.cgi?id=130431
</del><ins>+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+        Add hasInfiniteLineLength parameter to a bunch of functions.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+2013-05-14  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rename KeyedDecoder::decodeVerifiedEnum to decodeEnum to match the encode function,
-        and sort the decode functions to be in the same logical order as the encode functions.
</del><ins>+        Assertion failure in GlyphPage::setGlyphDataForIndex: (!glyph || fontData == m_fontDataForAllGlyphs)
+        &lt;http://webkit.org/b/116113&gt;
+        &lt;rdar://problem/13833790&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/indexeddb/IDBKeyData.cpp:
-        (WebCore::IDBKeyData::decode):
-        * Modules/indexeddb/IDBKeyPath.cpp:
-        (WebCore::IDBKeyPath::decode):
-        * platform/KeyedCoding.h:
-        (WebCore::KeyedDecoder::decodeEnum):
</del><ins>+        Reviewed by Dan Bernstein.
</ins><span class="cx"> 
</span><del>-2014-03-18  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        If we're filling a full GlyphPage with a SimpleFontData that is actually a composite font reference,
+        we need to make sure we have per-glyph font data pointers, since it may end up using them.
</ins><span class="cx"> 
</span><del>-        Reduce use of deprecatedCharacters in WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=130318
</del><ins>+        Added GlyphPage::mayUseMixedFontDataWhenFilling() which can be implemented by the platform to let
+        GlyphPageTreeNode know that it should allocate a full-sized GlyphPage for mixed font data pointers
+        in case the font is a composite font reference, or if there are CJK ideographs in the text.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        This code can be made smarter, but that's outside the scope of this change.
+        Fixes heavy asserting on bots running unreleased software.
</ins><span class="cx"> 
</span><del>-        * Modules/indexeddb/IDBKeyPath.cpp:
-        (WebCore::IDBKeyPathLexer::IDBKeyPathLexer): Use StringView for parsing.
-        (WebCore::IDBKeyPathLexer::lex): Ditto.
-        (WebCore::IDBKeyPathLexer::lexIdentifier): Ditto.
</del><ins>+        * platform/graphics/GlyphPage.h:
+        (GlyphPage):
+        (WebCore::GlyphPage::mayUseMixedFontDataWhenFilling):
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
+        (WebCore::shouldUseCoreText):
+        (WebCore::GlyphPage::mayUseMixedFontDataWhenFilling):
</ins><span class="cx"> 
</span><del>-        * Modules/indexeddb/leveldb/IDBLevelDBCoding.cpp:
-        (WebCore::IDBLevelDBCoding::encodeString): Index directly into string instead of
-        using deprecatedCharacters.
</del><ins>+2013-05-14  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
-        (WebCore::ThreadableWebSocketChannelClientWrapper::setSubprotocol): Use
-        StringView::getCharactersWithUpconvert.
-        (WebCore::ThreadableWebSocketChannelClientWrapper::setExtensions): Ditto.
</del><ins>+        Heap-use-after-free in WebCore::RenderBox::exclusionShapeOutsideInfo
+        https://bugs.webkit.org/show_bug.cgi?id=115566
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper arrayOfTextForTextMarkers:attributed:]):
-        Use operator NSString * instead of explicitly creating an NSString.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::writeLittleEndianUInt16): Added.
-        (WebCore::CloneSerializer::serialize): Added a separate code path for 8-bit strings.
-        (WebCore::CloneSerializer::write): Ditto.
</del><ins>+        When a portion of the render tree is being detached, anonymous blocks
+        will be combined as their children are deleted. In this process, the
+        anonymous block later in the tree is merged into the one preceeding it.
+        It can happen that the later block contains floats that the previous
+        block did not contain, and thus are not in the floating objects list for
+        the new block. This can result in the new block containing floats that
+        are not in it's floating objects list, but are in the floating objects
+        lists of siblings and parents. This can cause problems when the float
+        itself is deleted, since the deletion code assumes that if a float is not
+        in it's containing block's floating objects list, it isn't in any
+        floating objects list, causing dangling pointers in the floating objects
+        lists of the siblings and parents. In order to preserve this condition
+        (removing it has serious performance implications), we need to copy the
+        floating objects from the old block to the new block.  The float's
+        metrics will likely all be wrong, but since the new block is already
+        marked for layout, this will get fixed before anything gets displayed.
</ins><span class="cx"> 
</span><del>-        * bindings/objc/WebScriptObject.mm:
-        (+[WebScriptObject _convertValueToObjcValue:JSC::originRootObject:rootObject:]):
-        Use operator NSString * instead of explicitly creating an NSString.
</del><ins>+        Test: fast/block/float/float-append-child-crash.html
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::parseQualifiedName): Index directly into string instead of
-        using deprecatedCharacters.
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::containsOnlyWhitespace): Ditto.
-        * editing/SmartReplace.cpp:
-        (WebCore::addAllCodePoints): Ditto.
-        (WebCore::getSmartSet): Use StringView::upconvertedCharacters.
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::moveAllChildrenIncludingFloatsTo): Copy
+            floating objects list in addition to children.
+        (WebCore::RenderBlock::FloatingObject::clone): Added.
+        (WebCore::RenderBlock::removeChild): Use new method to copy children.
+        * rendering/RenderBlock.h:
+        (RenderBlock): Add method.
</ins><span class="cx"> 
</span><del>-        * editing/TextIterator.cpp:
-        (WebCore::foldQuoteMarksAndSoftHyphens): Changed to return a value so it can be
-        used in initialization rather than assignment.
-        (WebCore::SearchBuffer::SearchBuffer): Use StringView::upconvertedCharacters.
</del><ins>+2013-05-14  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * editing/TypingCommand.cpp:
-        (WebCore::TypingCommand::insertText): Index directly into string instead of using
-        deprecatedCharacters.
-        * editing/VisiblePosition.cpp:
-        (WebCore::VisiblePosition::characterAfter): Ditto.
-        * editing/VisibleUnits.cpp:
-        (WebCore::startOfParagraph): Ditto.
-        (WebCore::endOfParagraph): Ditto.
</del><ins>+        Unreviewed, rolling out r150023.
+        http://trac.webkit.org/changeset/150023
+        https://bugs.webkit.org/show_bug.cgi?id=116120
</ins><span class="cx"> 
</span><del>-        * fileapi/WebKitBlobBuilder.cpp:
-        (WebCore::BlobBuilder::append): Pass a StringView to TextEncoding::encode.
</del><ins>+        Causes table layout issues (Bug 116118) and crashes on
+        buildbot waterfall pages. (Requested by ddkilzer on #webkit).
</ins><span class="cx"> 
</span><del>-        * html/BaseDateAndTimeInputType.cpp:
-        (WebCore::BaseDateAndTimeInputType::parseToDateComponents): Use
-        StringView::upconvertedCharacters.
</del><ins>+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        * rendering/RenderTableSection.h:
+        (RenderTableSection):
</ins><span class="cx"> 
</span><del>-        * html/FormDataList.cpp:
-        (WebCore::FormDataList::appendString): Pass a StringView to TextEncoding::encode.
</del><ins>+2013-05-14  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/canvas/CanvasRenderingContext2D.cpp:
-        (WebCore::normalizeSpaces): Use StringView::getCharactersWithUpconvert.
</del><ins>+        Snapshotted plug-ins shadow tree should reset style inheritance
+        https://bugs.webkit.org/show_bug.cgi?id=116098
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLParserIdioms.cpp:
-        (WebCore::stripLeadingAndTrailingHTMLSpaces): Use characters16 for a code path
-        that already handled 8-bit characters separately.
-        (WebCore::parseHTMLNonNegativeInteger): Ditto.
-        (WebCore::parseDescriptors): Added an 8-bit code path.
</del><ins>+        Reset the styles such that only injected user-agent stylesheets affect
+        the rendering of snapshotted plug-ins' shadow content.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorStyleSheet.cpp:
-        (WebCore::InspectorStyle::newLineAndWhitespaceDelimiters): Index directly into
-        string instead of using deprecatedCharacters.
-        * inspector/InspectorStyleTextEditor.cpp:
-        (WebCore::InspectorStyleTextEditor::insertProperty): Ditto.
-        (WebCore::InspectorStyleTextEditor::internalReplaceProperty): Ditto.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::isSourceListNone): Use StringView::upconvertedCharacters.
-        (WebCore::CSPSourceList::parse): Ditto.
-        (WebCore::NonceDirective::parse): Ditto.
-        (WebCore::MediaListDirective::parse): Ditto.
-        (WebCore::CSPDirectiveList::parse): Ditto.
-        (WebCore::CSPDirectiveList::parseReportURI): Ditto.
-        (WebCore::CSPDirectiveList::parseReflectedXSS): Ditto.
-        (WebCore::ContentSecurityPolicy::didReceiveHeader): Ditto.
</del><ins>+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
</ins><span class="cx"> 
</span><del>-        * page/PageSerializer.cpp:
-        (WebCore::PageSerializer::serializeFrame): Pass a StringView into
-        TextEncoding::encode.
-        (WebCore::PageSerializer::serializeCSSStyleSheet): Ditto.
</del><ins>+2013-05-14  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/Length.cpp:
-        (WebCore::countCharacter): Index directly into string instead of using
-        deprecatedCharacters. Also changed to take a StringImpl&amp;.
-        (WebCore::newCoordsArray): Ditto. Call countCharacter the new way, and
-        use StringView::upconvertedCharacters.
-        (WebCore::newLengthArray): Ditto.
</del><ins>+        [CSSRegions] Improve hit testing for empty regions
+        https://bugs.webkit.org/show_bug.cgi?id=115534
</ins><span class="cx"> 
</span><del>-        * platform/LinkHash.cpp:
-        (WebCore::visitedLinkHash): Use characters16 for the 16-bit path.
-        Also removed unused visitedURL function.
-        * platform/LinkHash.h: Removed unused visitedURL function.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * platform/SharedBuffer.cpp:
-        (WebCore::utf8Buffer): Added an 8-bit code path.
-        * platform/URL.cpp:
-        (WebCore::URL::port): Ditto.
-        (WebCore::encodeRelativeString): Use StringView to call TextEncoding::encode.
</del><ins>+        As a better follow up after WebKit bug https://bugs.webkit.org/show_bug.cgi?id=107752,
+        we can improve the code by not doing hit testing on the render flow thread object when
+        we are trying to hit test the render flow thread background. In this case, we should just bail out.
+        No new tests, covered by existing regions tests.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Color.cpp:
-        (WebCore::Color::parseHexColor): Use characters16 in the 16-bit path.
-        (WebCore::Color::Color): Ditto.
</del><ins>+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::nodeAtPoint):
+        (WebCore):
+        (WebCore::RenderFlowThread::hitTestFlowThreadPortionInRegion):
+        * rendering/RenderFlowThread.h:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:
-        (WebCore::harfBuzzGetGlyph): Use StringView to call TextEncoding::encode.
</del><ins>+2013-05-14  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/StringTruncator.cpp:
-        (WebCore::centerTruncateToBuffer): Use StringView::getCharactersWithUpconvert.
-        (WebCore::rightTruncateToBuffer): Ditto.
-        (WebCore::rightClipToCharacterBuffer): Ditto.
-        (WebCore::rightClipToWordBuffer): Ditto.
-        (WebCore::leftTruncateToBuffer): Ditto.
-        (WebCore::truncateString): Ditto.
</del><ins>+        [BlackBerry] Handle network errors when starting a new job
+        https://bugs.webkit.org/show_bug.cgi?id=116101
</ins><span class="cx"> 
</span><del>-        * platform/graphics/TextRun.h:
-        (WebCore::TextRun::TextRun): Use characters16 in the 16-bit code path.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::shouldWaitForLoadingOfResource):
-        Use StringView::upconvertedCharacters.
</del><ins>+        Make startJob() return a network status that can be used by the
+        caller to create a network error.
</ins><span class="cx"> 
</span><del>-        * platform/network/DataURL.cpp:
-        (WebCore::handleDataURL): Use StringView to call TextEncoding::encode.
-        * platform/network/FormDataBuilder.cpp:
-        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader): Ditto.
</del><ins>+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::initialize): createNetworkStream() should
+        always return a valid pointer so use an ASSERT instead of an early
+        return to make sure we have a valid stream.
+        (WebCore::NetworkJob::startNewJobWithRequest): Only return true if
+        the network job was started successfully.
+        * platform/network/blackberry/NetworkJob.h:
+        (NetworkJob): Make initialize method void instead of bool since it
+        can't fail.
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob): Return a network error or
+        StatusSuccess.
+        * platform/network/blackberry/NetworkManager.h:
+        (NetworkManager):
+        * platform/network/blackberry/ResourceHandleBlackBerry.cpp:
+        (WebCore::ResourceHandle::start): Return true if job was started
+        successfully.
+        (WebCore::ResourceHandle::platformLoadResourceSynchronously):
+        Check return value of startJob and fill the ResourceError with the
+        network status returned to finish the load.
</ins><span class="cx"> 
</span><del>-        * platform/sql/SQLiteStatement.cpp:
-        (WebCore::SQLiteStatement::bindBlob): Use StringView::upconvertedCharacters.
-        (WebCore::SQLiteStatement::bindText): Ditto.
</del><ins>+2013-05-14  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/text/DecodeEscapeSequences.h:
-        (WebCore::Unicode16BitEscapeSequence::decodeRun): Changed to take a StringView.
-        (WebCore::URLEscapeSequence::decodeRun): Ditto.
-        (WebCore::decodeEscapeSequences): Pass StringView to decodeRun.
</del><ins>+        [Mac] captions menu is not positioned correctly in full-screen
+        https://bugs.webkit.org/show_bug.cgi?id=116103
</ins><span class="cx"> 
</span><del>-        * platform/text/Hyphenation.cpp:
-        (WebCore::lastHyphenLocation): Take a StringView.
-        * platform/text/Hyphenation.h: Make lastHyphenLocation take a StringView.
</del><ins>+        Update the positioning properties of the captions menu in full-screen
+        following the fix for https://webkit.org/b/115968.
</ins><span class="cx"> 
</span><del>-        * platform/text/TextBreakIterator.cpp:
-        (WebCore::initializeIteratorWithRules): Use StringView::upconvertedCharacters.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * platform/text/TextEncoding.cpp:
-        (WebCore::TextEncoding::encode): Use StringView::upconvertedCharacters.
-        Change argument type to StringView.
-        * platform/text/TextEncoding.h: Ditto.
</del><ins>+        * css/fullscreenQuickTime.css:
+        (video:-webkit-full-screen::-webkit-media-controls-closed-captions-container):
+        Add 50px to the bottom position since we're now positioned relative to the
+        media element, and use a calc() command to be right-aligned to the captions
+        icon in the media controller. The max-width and max-height properties follow
+        the same technique used for the non-full-screen mode.
</ins><span class="cx"> 
</span><del>-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::atomicCanonicalTextEncodingName): Use characters16 for the 16-bit path.
</del><ins>+2013-05-14  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/text/cf/HyphenationCF.cpp:
-        (WebCore::lastHyphenLocation): Use StringView::text.createCFStringWithoutCopying.
-        Change argument type to StringView.
</del><ins>+        [GTK] Move generated ColorData.cpp, WebKitFontFamilyNames.(cpp|h) build targets into libPlatform
+        https://bugs.webkit.org/show_bug.cgi?id=115921
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::constructTextRun): Use characters16 for the 16-bit path.
</del><ins>+        Reviewed by Gustavo Noronha Silva.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderCombineText.cpp:
-        (WebCore::RenderCombineText::width): Removed check for null characters pointer,
-        since the pointer will never be null, and even if it was there would be no need
-        for an early exit.
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderText.cpp:
-        (WebCore::maxWordFragmentWidth): Take a StringView.
-        (WebCore::RenderText::computePreferredLogicalWidths): Pass in a StringView.
-        * rendering/line/BreakingContextInlineHeaders.h:
-        (WebCore::tryHyphenating): Ditto.
</del><ins>+        * GNUmakefile.am: Add platform_cppflags to the list of CPPFLAGS for libWebCoreSVG, libWebCore,
+        libWebCorePlatform, libWebCoreGtk. Remove generation rules for ColorData.cpp and WebKitFontFamilyNames.(cpp|h).
+        * GNUmakefile.list.am: Include the ColorData.cpp and WebKitFontFamilyNames.(cpp|h) build targers under
+        platform_built_sources.
+        * bindings/gobject/GNUmakefile.am: Add platform_cppflags to the list of libWebCoreDOM CPPFLAGS.
</ins><span class="cx"> 
</span><del>-        * rendering/svg/SVGTextLayoutEngine.cpp:
-        (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath): Use
-        StringView::upconvertedCharacters.
</del><ins>+2013-05-14  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/svg/SVGTextMetrics.cpp:
-        (WebCore::SVGTextMetrics::SVGTextMetrics): Use String::substring.
</del><ins>+        [GTK] libPlatform, libPlatformGtk must depend on the related GNUmakefiles
+        https://bugs.webkit.org/show_bug.cgi?id=115937
</ins><span class="cx"> 
</span><del>-        * svg/SVGAngle.cpp:
-        (WebCore::SVGAngle::setValueAsString): Use StringView::upconvertedCharacters.
-        * svg/SVGAnimateMotionElement.cpp:
-        (WebCore::parsePoint): Ditto.
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::parseKeySplines): Ditto.
-        * svg/SVGFitToViewBox.cpp:
-        (WebCore::SVGFitToViewBox::parseViewBox): Ditto.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        * svg/SVGFontData.cpp:
-        (WebCore::SVGFontData::applySVGGlyphSelection): Pass StringView to
-        createStringWIthMirroredCharacters.
-        (WebCore::createStringWithMirroredCharacters): Changed to use StringView and
-        use indexing into that instead of a characters pointer.
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-        * svg/SVGFontData.h: Removed createStringWithMirroredCharacters member function,
-        since it has nothing to do with the SVGFontData object. Now it's just a private
-        helper function in the SVGFontData.cpp source file.
</del><ins>+        * GNUmakefile.am: Fix typos in two libraries' names - Webcore -&gt; WebCore.
</ins><span class="cx"> 
</span><del>-        * svg/SVGFontElement.cpp:
-        (WebCore::SVGFontElement::registerLigaturesInGlyphCache): Index into the string
-        instead of using deprecatedCharacters.
</del><ins>+2013-05-13  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * svg/SVGGlyphMap.h:
-        (WebCore::SVGGlyphMap::addGlyph): Use StringView::upconvertedCharacters.
-        (WebCore::SVGGlyphMap::collectGlyphsForString): Ditto.
-        * svg/SVGGlyphRefElement.cpp:
-        (WebCore::SVGGlyphRefElement::parseAttribute): Ditto.
-        * svg/SVGLength.cpp:
-        (WebCore::SVGLength::setValueAsString): Ditto.
-        * svg/SVGLengthList.cpp:
-        (WebCore::SVGLengthList::parse): Ditto.
-        * svg/SVGNumberList.cpp:
-        (WebCore::SVGNumberList::parse): Ditto.
-        * svg/SVGParserUtilities.cpp:
-        (WebCore::parseNumberFromString): Ditto.
-        (WebCore::parseNumberOptionalNumber): Ditto.
-        (WebCore::parseRect): Ditto.
-        (WebCore::pointsListFromSVGData): Ditto.
-        (WebCore::parseGlyphName): Ditto.
-        (WebCore::parseKerningUnicodeString): Ditto.
-        (WebCore::parseDelimitedString): Ditto.
-        * svg/SVGPreserveAspectRatio.cpp:
-        (WebCore::SVGPreserveAspectRatio::parse): Ditto.
-        * svg/SVGStringList.cpp:
-        (WebCore::SVGStringList::parse): Ditto.
-        * svg/SVGTransformList.cpp:
-        (WebCore::SVGTransformList::parse): Ditto.
-        * svg/SVGTransformable.cpp:
-        (WebCore::SVGTransformable::parseTransformType): Ditto.
-        * svg/SVGViewSpec.cpp:
-        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
-        * svg/SVGZoomAndPan.h:
-        (WebCore::SVGZoomAndPan::parseAttribute): Ditto.
</del><ins>+        Removing Attr can delete a wrong Attribute in ElementData
+        https://bugs.webkit.org/show_bug.cgi?id=116077
</ins><span class="cx"> 
</span><del>-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::send): Pass a StringView to TextEncoding::encode.
</del><ins>+        Reviewed by Benjamin Poulain.
+        
+        Merge https://chromium.googlesource.com/chromium/blink/+/e861452a292e185501e48940305947aa6a4e23c2
+        after simplifying and renaming functions to be more WebKit style.
</ins><span class="cx"> 
</span><del>-        * xml/XSLStyleSheetLibxslt.cpp:
-        (WebCore::XSLStyleSheet::parseString): Use StringView::upconvertedCharacters.
</del><ins>+        The XML parser can produce elements with attributes whose names have
+        distinct prefixes, but the same expanded name. When one of these
+        attributes is put up for adoption, it may be its similarly named
+        sibling that is removed from its owner element. As a result the
+        original owner hangs onto the adopted attribute, despite the fact that
+        it is now in a different document. Sometimes it's just hard to let go.
</ins><span class="cx"> 
</span><del>-2014-03-18  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        Test: fast/dom/adopt-attribute-crash.svg
</ins><span class="cx"> 
</span><del>-        LayoutBox is a terrible name
-        https://bugs.webkit.org/show_bug.cgi?id=130351
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeNode):
+        (WebCore::Element::removeAttributeNode):
+        (WebCore::ElementData::getAttributeItemIndex):
+        * dom/Element.h:
+        (ElementData):
+        (Element):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-14  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rename LayoutBox to CSSBoxType. Also rename the functions and methods
-        that mention &quot;LayoutBox&quot; to something that makes sense for each
-        specific situation.
</del><ins>+        Remove ::-webkit-distributed()
+        https://bugs.webkit.org/show_bug.cgi?id=116106
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
-
-        * css/BasicShapeFunctions.cpp:
-        (WebCore::valueForBasicShape):
-        (WebCore::basicShapeForValue):
-        * css/CSSBasicShapes.cpp:
-        (WebCore::CSSBasicShapeCircle::cssText):
-        (WebCore::CSSBasicShapeCircle::equals):
-        (WebCore::CSSBasicShapeEllipse::cssText):
-        (WebCore::CSSBasicShapeEllipse::equals):
-        (WebCore::CSSBasicShapePolygon::cssText):
-        (WebCore::CSSBasicShapePolygon::equals):
-        (WebCore::CSSBasicShapeInset::cssText):
-        * css/CSSBasicShapes.h:
-        (WebCore::CSSBasicShape::referenceBox):
-        (WebCore::CSSBasicShape::setReferenceBox):
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::shapePropertyValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator CSSBoxType):
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyClipPath::applyValue):
-        (WebCore::ApplyPropertyShape::applyValue):
-        * page/animation/CSSPropertyAnimation.cpp:
-        (WebCore::blendFunc):
-        * rendering/ClipPathOperation.h:
-        (WebCore::ShapeClipPathOperation::setReferenceBox):
-        (WebCore::ShapeClipPathOperation::referenceBox):
-        (WebCore::BoxClipPathOperation::create):
-        (WebCore::BoxClipPathOperation::referenceBox):
-        (WebCore::BoxClipPathOperation::BoxClipPathOperation):
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createBoxShape):
-        * rendering/shapes/Shape.h:
-        * rendering/shapes/ShapeInfo.cpp:
-        (WebCore::ShapeInfo&lt;RenderType&gt;::computedShape):
-        * rendering/shapes/ShapeInfo.h:
-        * rendering/shapes/ShapeInsideInfo.h:
-        * rendering/shapes/ShapeOutsideInfo.h:
-        * rendering/style/BasicShapes.cpp:
-        (WebCore::BasicShape::canBlend):
-        * rendering/style/BasicShapes.h:
-        (WebCore::BasicShape::referenceBox):
-        (WebCore::BasicShape::setReferenceBox):
-        (WebCore::BasicShape::BasicShape):
-        * rendering/style/RenderStyleConstants.h:
-        * rendering/style/ShapeValue.h:
-        (WebCore::ShapeValue::createShapeValue):
-        (WebCore::ShapeValue::createBoxShapeValue):
-        (WebCore::ShapeValue::cssBox):
-        (WebCore::ShapeValue::ShapeValue):
-
-2014-03-18  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        REGRESSION (r162334): RenderTableCol::styleDidChange uses out-of-date table information
-        https://bugs.webkit.org/show_bug.cgi?id=129561
-
-        Reviewed by Antti Koivisto.
-
-        Test: fast/table/update-col-width-and-remove-table-cell-crash.html
-
-        Fixes an issue where a table column or table column group may query an out-
-        of-date model of its associated table as part of its process to propagate
-        style changes to affected table cells.
-
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::styleDidChange): Ensure that all sections in the table
-        are up-to-date before querying for a table cell.
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::recalcCells): Update comment to read well. In
-        particular, remove the reference to RenderTableSection::fillRowsWithDefaultStartingAtPosition()
-        as this function was removed in &lt;http://trac.webkit.org/changeset/99919&gt;.
-        (WebCore::RenderTableSection::setNeedsCellRecalc): Clear the grid preemptively to
-        to ensure that accessors cannot access stale data. We'll build the grid again
-        in RenderTableSection::recalcCells().
-        (WebCore::RenderTableSection::numColumns): Add ASSERT(!m_needsCellRecalc) to assert
-        that the grid cells are up-to-date. That is, we don't need to calculate them again.
-        * rendering/RenderTableSection.h: Add ASSERT(!m_needsCellRecalc) or call recalcCellsIfNeeded()
-        before accessing the grid to ensure that it's up-to-date.
-
-2014-03-18  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        REGRESSION (r163560): ASSERTION FAILED: childrenInline() in WebCore::RenderSVGText::layout
-        https://bugs.webkit.org/show_bug.cgi?id=130346
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Following &lt;http://trac.webkit.org/changeset/163560&gt;, SVG inline elements may be treated as block-
-        level elements depending on their CSS styles (e.g. display: block). But such elements should always
-        be treated as inline-level elements.
</del><ins>+        This experimental Shadow DOM selector code is unused and has no owner.
</ins><span class="cx"> 
</span><del>-        Partially revert &lt;http://trac.webkit.org/changeset/164368&gt; as it addressed a similar issue for
-        &lt;tspan&gt; and &lt;tref&gt;. Instead we should implement RenderSVGInline::updateFromStyle() to ensure that
-        RenderSVGInline and any derived classes (e.g. RenderSVGTSpan) are always treated as inline elements
-        regardless of their CSS style because the SVG text layout code depends on this assumption as part
-        of a performance optimization. We may want to revaluate the benefits of this optimization with respect
-        to code clarity and ensuring the code is less error prone.
-
-        Test: svg/text/a-display-block.html
-              svg/text/tref-display-inherit.html
-
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::adjustRenderStyle): Revert changes from &lt;http://trac.webkit.org/changeset/164368&gt;.
-        * rendering/RenderInline.h:
-        * rendering/svg/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::updateFromStyle): Added; ensure that RenderSVGInline and any derived
-        classes are treated as inline elements because the SVG text layout code depends on this assumption.
-        * rendering/svg/RenderSVGInline.h:
-
-2014-03-18  Hans Muller  &lt;hmuller@adobe.com&gt;
-
-        [CSS Shapes] shape-outside: ellipse(50% 50% at) causes crash
-        https://bugs.webkit.org/show_bug.cgi?id=130366
-
-        Reviewed by Andreas Kling.
-
-        The BasicShape ellipse and circle functions now report a syntax error
-        if the &quot;at&quot; keyword is not followed by a position.
-
-        The existing parsing tests have been updated to include this case.
-
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx">         * css/CSSParser.cpp:
</span><del>-        (WebCore::CSSParser::parseBasicShapeCircle):
-        (WebCore::CSSParser::parseBasicShapeEllipse):
</del><ins>+        (WebCore::CSSParser::rewriteSpecifiersWithNamespaceIfNeeded):
+        (WebCore::CSSParser::rewriteSpecifiersWithElementName):
+        * css/CSSParser.h:
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserSelector::CSSParserSelector):
+        * css/CSSParserValues.h:
+        (CSSParserSelector):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::selectorText):
+        * css/CSSSelector.h:
+        * css/CSSSelectorList.cpp:
+        * css/CSSSelectorList.h:
+        (CSSSelectorList):
+        * css/DocumentRuleSets.cpp:
+        (WebCore::DocumentRuleSets::resetAuthorStyle):
+        * css/DocumentRuleSets.h:
+        (DocumentRuleSets):
+        * css/ElementRuleCollector.cpp:
+        (WebCore::ElementRuleCollector::matchAuthorRules):
+        * css/ElementRuleCollector.h:
+        (ElementRuleCollector):
+        * css/RuleSet.cpp:
+        (WebCore::RuleSet::addChildRules):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::match):
+        * css/SelectorFilter.cpp:
+        (WebCore::SelectorFilter::collectIdentifierHashes):
+        * html/shadow/InsertionPoint.cpp:
+        * html/shadow/InsertionPoint.h:
</ins><span class="cx"> 
</span><del>-2014-03-18  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+2013-05-14  Daker Fernandes Pinheiro  &lt;daker.pinheiro@openbossa.org&gt;
</ins><span class="cx"> 
</span><del>-        Removing MediaStreamVector typedef
-        https://bugs.webkit.org/show_bug.cgi?id=130402
</del><ins>+        Remove RenderTheme::supportsCalendarPicker
+        https://bugs.webkit.org/show_bug.cgi?id=116068
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/MediaStream.h:
-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::getLocalStreams):
-        (WebCore::RTCPeerConnection::getRemoteStreams):
-        (WebCore::RTCPeerConnection::getStreamById):
-        (WebCore::RTCPeerConnection::hasLocalStreamWithTrackId):
-        * Modules/mediastream/RTCPeerConnection.h:
</del><ins>+        No new tests needed because it doesn't affect behaviour.
</ins><span class="cx"> 
</span><del>-2014-03-18  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        This method was never overrided by any platform
+        and always leaded to the same behaviour.
+        The code which depended on it was also removed.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165815.
-        https://bugs.webkit.org/show_bug.cgi?id=130410
</del><ins>+        * html/BaseMultipleFieldsDateAndTimeInputType.cpp:
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::createShadowSubtree):
+        (WebCore::BaseMultipleFieldsDateAndTimeInputType::updatePickerIndicatorVisibility):
+        * html/BaseMultipleFieldsDateAndTimeInputType.h:
+        (BaseMultipleFieldsDateAndTimeInputType):
+        * page/ChromeClient.h:
+        (ChromeClient):
+        * rendering/RenderTheme.h:
</ins><span class="cx"> 
</span><del>-        Broke many VTT tests (Requested by bfulgham on #webkit).
</del><ins>+2013-04-30  Balazs Kelemen  &lt;b.kelemen@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        [GStreamer] cannot seek after video finished
+        https://bugs.webkit.org/show_bug.cgi?id=114044
</ins><span class="cx"> 
</span><del>-        &quot;TextTrackRegion Not Implemented&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=116546
-        http://trac.webkit.org/changeset/165815
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-2014-03-18  Renata Hodovan  &lt;rhodovan.u-szeged@partner.samsung.com&gt;
</del><ins>+        Test: media/video-seek-after-end.html
</ins><span class="cx"> 
</span><del>-        Bad cast with toRenderBox in WebCore::RenderView::repaintViewRectangle
-        https://bugs.webkit.org/show_bug.cgi?id=129104
</del><ins>+        Reland without wrong assertion. If seek is called after didEnd the pipeline
+        state will not be in GST_STATE_NULL yet but it is not a problem because we handle that.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Rework the seeking logic to be able to seek after reseting the pipeline.
+        In addition to solve the actual problem this patch supposed to make seeking
+        more robust and correct.
+        The previous implementation tried to hide the complexity of asynchronous operations
+        on the pipeline. It did not handle the GST_MESSAGE_ASYNC_DONE message from the bus
+        but instead reported the seek as finished when it saw an asynchronous pending state
+        (GST_STATE_CHANGE_ASYNC) which could happen way before the seek is really done.
+        Now we pay attention to the GST_MESSAGE_ASYNC_DONE message to track the status of seeks.
+        Seeks are not the only operations executed asynchronously, changing the pipeling state is
+        similar. It means a seek can overlap with onother ongoing asynchronous operation.
+        This change address this by introducing an invariant for seeks, which is that we only request
+        a seek if there are no other ongoing asynchronous operations and the pipeline state is either
+        paused or playing (which is recommended anyway according to GStreamer's documentation).
+        This way we can be sure that the time when we get the next GST_MESSAGE_ASYNC_DONE message the
+        seek has been completed.
</ins><span class="cx"> 
</span><del>-        We should not cast the renderer of a RenderView's owner to RenderBox
-        unless we are sure it is one.
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::toGstClockTime): Factored time conversation into a helper.
+        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
</ins><span class="cx"> 
</span><del>-        Test: plugins/crash-invalid-data-reference.html
</del><ins>+        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition): The position might not be available
+        if the pipeline still has a pending state. As a workaround, if we are right after a seek we can
+        use the seek time. Avoiding this situation would be possible by not allowing any asynchronous
+        operation to overlap. I believe it would add a lot more complexity so I decided to rather introduce
+        this workaround. Otherwise those overlapping operations are handled fine by GStreamer.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::repaintViewRectangle):
</del><ins>+        (WebCore::MediaPlayerPrivateGStreamer::prepareToPlay): Do not reset internal state variables.
+        This function called when there is an intent to restart playback but it does not actually restart it.
+        (WebCore::MediaPlayerPrivateGStreamer::currentTime): Just removed a staling newline.
+        (WebCore::MediaPlayerPrivateGStreamer::seek): Take a look to the pipeline state and act upon that.
+        If there is an ongoing asynchronous operation make the seek pending, otherwise do it now.
+        Now we handle overlapping seeks as well because I saw that it can happen in some tests.
+        Added an early return for live streams as it doesn't makes sense to try seeking in them.
</ins><span class="cx"> 
</span><del>-2014-03-18  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        (WebCore::MediaPlayerPrivateGStreamer::handleMessage): Handle GST_MESSAGE_ASYNC_DONE and some refactoring.
+        (WebCore::MediaPlayerPrivateGStreamer::asyncStateChangeDone):
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates): Only handle seeks in the pending case, the rest is
+        now handled in asyncStateChangeDone.
+        (WebCore::MediaPlayerPrivateGStreamer::cacheDuration): Do not reset the m_mediaDurationKnown if the pipeline
+        has an asynchronous pending state because it would fail. It does actually happen when we get a duration message
+        after restarting the pipeline and it would result in restarting playback from the start. It seems to be a bug
+        in GStreamer that it sends the duration message too early. Also sanitized this function by merging redundant branches.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
</ins><span class="cx"> 
</span><del>-        Micro-optimize element descendant iterator.
-        &lt;https://webkit.org/b/130384&gt;
</del><ins>+2013-05-14  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add a slightly more efficient ElementDescendantIterator that keeps a stack
-        of relevant ancestor siblings instead of walking up the parent chain every
-        time we run out of children.
</del><ins>+        Ellipsis text is placed to wrong position, when the truncated text is fully cut off in RTL direction.
+        https://bugs.webkit.org/show_bug.cgi?id=115858
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/ElementDescendantIterator.h: Added.
-        (WebCore::ElementDescendantIterator::ElementDescendantIterator):
-        (WebCore::ElementDescendantIterator::operator++):
-        (WebCore::ElementDescendantConstIterator::ElementDescendantConstIterator):
-        (WebCore::ElementDescendantConstIterator::operator++):
-        (WebCore::ElementDescendantIteratorAdapter::ElementDescendantIteratorAdapter):
-        (WebCore::ElementDescendantIteratorAdapter::begin):
-        (WebCore::ElementDescendantIteratorAdapter::end):
-        (WebCore::ElementDescendantConstIteratorAdapter::ElementDescendantConstIteratorAdapter):
-        (WebCore::ElementDescendantConstIteratorAdapter::begin):
-        (WebCore::ElementDescendantConstIteratorAdapter::end):
-        (WebCore::elementDescendants):
-        * dom/ElementIterator.h:
-        * dom/SelectorQuery.cpp:
-        (WebCore::elementsForLocalName):
-        (WebCore::anyElement):
-        (WebCore::SelectorDataList::executeSingleTagNameSelectorData):
-        (WebCore::SelectorDataList::executeSingleClassNameSelectorData):
-        (WebCore::SelectorDataList::executeSingleSelectorData):
-        (WebCore::SelectorDataList::executeSingleMultiSelectorData):
-        (WebCore::SelectorDataList::executeCompiledSimpleSelectorChecker):
</del><ins>+        Take text direction into account to calculate ellipsis position in case of
+        full truncation.
</ins><span class="cx"> 
</span><del>-2014-03-18  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Test: fast/css/text-overflow-ellipsis-full-truncate-rtl.html
</ins><span class="cx"> 
</span><del>-        Mutating rules returned by getMatchedCSSRules can result in crash
-        https://bugs.webkit.org/show_bug.cgi?id=130209
</del><ins>+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
-        
-        The non-standard getMatchedCSSRules API returns CSSStyleRule objects that don't
-        have parent stylesheet pointer (as we don't know which sheet the rule originated from).
-        Mutating the rule via such wrapper can lead to crashes later as we fail to invalidate
-        the underlying stylesheet.
-        
-        Fix by disallowing mutation of style rules that don't have parent sheet pointer. CSSStyleRule
-        has two mutable properties selectorText and style. The latter gives back CSSStyleDeclaration.
-        This patch disallows mutations in both cases for CSSStyleRules that don't have parent stylesheet
-        pointer.
-        
-        While it is technically possible to have CSSRules that are legitimately disconnected
-        from stylesheet (by removing rule from sheet while holding a reference to it) it never
-        makes sense to mutate such rule as there is no way to do anything with it afterwards.
</del><ins>+2013-05-14  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/css/getMatchedCSSProperties-rule-mutation.html
-               fast/css/getMatchedCSSRules-crash.html
</del><ins>+        [BlackBerry] Implement platform strategies
+        https://bugs.webkit.org/show_bug.cgi?id=112162
</ins><span class="cx"> 
</span><del>-        * css/CSSStyleRule.cpp:
-        (WebCore::CSSStyleRule::setSelectorText):
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-            Bail out if parent stylesheet is null.
</del><ins>+        This is just a refactoring, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        * css/PropertySetCSSStyleDeclaration.cpp:
-        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
-        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
-        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
-        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
-        
-            Allow StyleRuleCSSStyleDeclaration subclass cancel the mutation via
-            boolean return value from willMutate.
</del><ins>+        * CMakeLists.txt: Move PlatformStrategies.cpp from platform
+        specific makefiles to the global one now that all platforms using
+        cmake implement platform strategies.
+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * PlatformWinCE.cmake:
+        * loader/CookieJar.cpp: Remove the preprocessor error that is not
+        needed anymore.
+        * loader/blackberry/CookieJarBlackBerry.cpp: Removed.
+        * platform/network/blackberry/CookieJarBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::setCookiesFromDOM):
+        (WebCore::cookiesForDOM):
+        (WebCore::cookieRequestHeaderFieldValue):
+        (WebCore::cookiesEnabled):
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        (WebCore::getHostnamesWithCookies):
+        (WebCore::deleteCookiesForHostname):
+        (WebCore::deleteAllCookies):
+        * plugins/blackberry/PluginDataBlackBerry.cpp: Removed.
</ins><span class="cx"> 
</span><del>-        (WebCore::StyleRuleCSSStyleDeclaration::willMutate):
-        
-            Disallow mutation if the owning CSSStyleRule is null or has null stylesheet.
</del><ins>+2013-05-14  Jocelyn Turcotte  &lt;jocelyn.turcotte@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
-        
-            We never get here with null rule or stylesheet anymore.
</del><ins>+        [Qt] Fix a crash under ~PingLoader when the QNAM on the page has been destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=116035
</ins><span class="cx"> 
</span><del>-        * css/PropertySetCSSStyleDeclaration.h:
-        (WebCore::PropertySetCSSStyleDeclaration::willMutate):
</del><ins>+        Reviewed by Simon Hausmann.
</ins><span class="cx"> 
</span><del>-2014-03-17  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</del><ins>+        Reproduced with arora which does destroy the QNetworkAccessManager in some situations.
+        The problem is that PingLoader can still be pending meanwhile, holding a ResourceHandle
+        with a dangling pointer to a QNetworkReply destroyed with the QNetworkAccessManager.
</ins><span class="cx"> 
</span><del>-        &lt;media&gt; elements are not properly moved to new documents' visibility callback lists
-        https://bugs.webkit.org/show_bug.cgi?id=127711
</del><ins>+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+          Set the parent to 0 like we did before the introduction of QNetworkReplyWrapper.
+        (WebCore::QNetworkReplyWrapper::release):
</ins><span class="cx"> 
</span><del>-        Reviewed by David Kilzer.
</del><ins>+2013-05-13  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::didMoveToNewDocument):
</del><ins>+        [Mac] update in-band caption attributes
+        https://bugs.webkit.org/show_bug.cgi?id=116057
</ins><span class="cx"> 
</span><del>-2014-03-18  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        More FTL enabling.
</del><ins>+        * html/track/InbandTextTrack.cpp:
+        (WebCore::InbandTextTrack::updateCueFromCueData): Copy highlight color.
</ins><span class="cx"> 
</span><del>-        Rubber stamped by Dan Bernstein and Mark Hahnenberg.
</del><ins>+        * html/track/TextTrackCueGeneric.cpp:
+        (WebCore::TextTrackCueGenericBoxElement::applyCSSProperties): &quot;highlight&quot; color sets the cue
+            background, &quot;background&quot; color sets the cue container background.
+        * html/track/TextTrackCueGeneric.h:
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        * platform/graphics/InbandTextTrackPrivateClient.h:
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
</del><ins>+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
+        (WebCore::InbandTextTrackPrivateAVF::processCueAttributes): Process &quot;highlight&quot; color.
</ins><span class="cx"> 
</span><del>-2014-03-18  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2013-05-13  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        TextTrackRegion Not Implemented
-        https://bugs.webkit.org/show_bug.cgi?id=116546
</del><ins>+        BUILD FIX (r150049): Fix RetainPtr&lt;&gt; type in PasteboardIOS.mm
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * platform/ios/PasteboardIOS.mm:
+        (WebCore::Pasteboard::writeImage): Use RetainPtr&lt;CFStringRef&gt;
+        instead of RetainPtr&lt;NSString&gt;.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by vcarbune@chromium.org):
-        https://chromium.googlesource.com/chromium/blink/+/4940f89a087fea5b5ea628e98d0b355d398a9eea
-        http://crbug.com/25798003
</del><ins>+2013-05-13  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: media/track/regions-webvtt/text-track-region-display.html
-               media/track/regions-webvtt/text-track-region-dom-layout.html
</del><ins>+        Remove platform/graphic's Generator
+        https://bugs.webkit.org/show_bug.cgi?id=116084
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        * html/track/LoadableTextTrack.cpp:
-        (WebCore::LoadableTextTrack::newRegionsAvailable):
-        * html/track/TextTrack.cpp:
-        * html/track/TextTrack.h:
-        * html/track/TextTrackRegion.cpp:
-        (WebCore::TextTrackRegion::TextTrackRegion):
-        (WebCore::TextTrackRegion::appendTextTrackCueBox):
-        * html/track/TextTrackRegion.h:
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::VTTCue):
-        (WebCore::VTTCue::notifyRegionWhenRemovingDisplayTree):
-        (WebCore::VTTCue::removeDisplayTree):
-        * html/track/VTTCue.h:
-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTParser::parseBytes):
-        (WebCore::WebVTTParser::collectMetadataHeader):
-        * html/track/WebVTTParser.h:
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-03-18  Philippe Normand  &lt;pnormand@igalia.com&gt;
</del><ins>+        The Generator no longer abstract anything useful, its only
+        implementation is Gradient.
</ins><span class="cx"> 
</span><del>-        [GTK] ResourceLoaderSoup.cpp was added by mistake
-        https://bugs.webkit.org/show_bug.cgi?id=130396
-
-        Reviewed by Carlos Garcia Campos.
-
-        This file was committed by mistake in r152778 and is not built by
-        any port.
-
-        * loader/soup/ResourceLoaderSoup.cpp: Removed.
-
-2014-03-18  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Rename ElementDescendantIterator to TypedElementDescendantIterator.
-        Romper-stubbed by Antti &quot;Latte Lung&quot; Koivisto.
-
</del><span class="cx">         * GNUmakefile.list.am:
</span><ins>+        * WebCore.exp.in:
+        * WebCore.vcproj/WebCore.vcproj:
</ins><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj.filters:
</span><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * dom/ElementDescendantIterator.h: Removed.
-        * dom/ElementIterator.h:
-        * dom/TypedElementDescendantIterator.h: Added.
-        (WebCore::TypedElementDescendantIterator&lt;ElementType&gt;::TypedElementDescendantIterator):
-        (WebCore::TypedElementDescendantIterator&lt;ElementType&gt;::operator):
-        (WebCore::TypedElementDescendantConstIterator&lt;ElementType&gt;::TypedElementDescendantConstIterator):
-        (WebCore::TypedElementDescendantConstIterator&lt;ElementType&gt;::operator):
-        (WebCore::TypedElementDescendantIteratorAdapter&lt;ElementType&gt;::TypedElementDescendantIteratorAdapter):
-        (WebCore::TypedElementDescendantIteratorAdapter&lt;ElementType&gt;::begin):
-        (WebCore::TypedElementDescendantIteratorAdapter&lt;ElementType&gt;::end):
-        (WebCore::TypedElementDescendantIteratorAdapter&lt;ElementType&gt;::beginAt):
-        (WebCore::TypedElementDescendantIteratorAdapter&lt;ElementType&gt;::from):
-        (WebCore::TypedElementDescendantIteratorAdapter&lt;ElementType&gt;::first):
-        (WebCore::TypedElementDescendantIteratorAdapter&lt;ElementType&gt;::last):
-        (WebCore::TypedElementDescendantConstIteratorAdapter&lt;ElementType&gt;::TypedElementDescendantConstIteratorAdapter):
-        (WebCore::TypedElementDescendantConstIteratorAdapter&lt;ElementType&gt;::begin):
-        (WebCore::TypedElementDescendantConstIteratorAdapter&lt;ElementType&gt;::end):
-        (WebCore::TypedElementDescendantConstIteratorAdapter&lt;ElementType&gt;::beginAt):
-        (WebCore::TypedElementDescendantConstIteratorAdapter&lt;ElementType&gt;::from):
-        (WebCore::TypedElementDescendantConstIteratorAdapter&lt;ElementType&gt;::first):
-        (WebCore::TypedElementDescendantConstIteratorAdapter&lt;ElementType&gt;::last):
-        (WebCore::descendantsOfType):
</del><ins>+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Generator.h: Removed.
+        * platform/graphics/GeneratorGeneratedImage.cpp:
+        (WebCore::GeneratorGeneratedImage::draw):
+        (WebCore::GeneratorGeneratedImage::drawPattern):
+        * platform/graphics/GeneratorGeneratedImage.h:
+        (WebCore::GeneratorGeneratedImage::create):
+        (WebCore::GeneratorGeneratedImage::GeneratorGeneratedImage):
+        (GeneratorGeneratedImage):
+        * platform/graphics/Gradient.h:
+        (WebCore):
+        (Gradient):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore):
+        (GraphicsContext):
</ins><span class="cx"> 
</span><del>-2014-03-18  Ion Rosca  &lt;rosca@adobe.com&gt;
</del><ins>+2013-05-13  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add blend mode property to dumped information in GraphicsLayer.
-        https://bugs.webkit.org/show_bug.cgi?id=130331
</del><ins>+        Upstream iOS Clipboard and Pasteboard changes
+        &lt;http://webkit.org/b/116062&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Functionality is not changed, therefore no new tests added.
-        I adjusted the affected test results generated with layerTreeAsText.
</del><ins>+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Clipboard.h:
+        * platform/Pasteboard.h:
+        * platform/ios/ClipboardIOS.h: Added.
+        * platform/ios/ClipboardIOS.mm: Added.
+        * platform/ios/PasteboardIOS.mm: Added.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::dumpProperties):
</del><ins>+2013-05-13  Huang Dongsung  &lt;luxtella@company100.net&gt;
</ins><span class="cx"> 
</span><del>-2014-03-17  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        [Mac] Use pageScaleFactor * deviceScaleFactor in requiresTiledLayer() and computePixelAlignment() of GraphicsLayerCA.
+        https://bugs.webkit.org/show_bug.cgi?id=107359
</ins><span class="cx"> 
</span><del>-        webdatabase: Replace DEPRECATED_DEFINE_STATIC_LOCAL by static NeverDestroyed&lt;T&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=130347
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * Modules/webdatabase/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::openDatabaseMutex):
-        (WebCore::notificationMutex):
-        (WebCore::notificationQueue):
</del><ins>+        Currently GraphicsLayerCA uses pageScaleFactor in requiresTiledLayer() and
+        computePixelAlignment(), but we must use pageScaleFactor * deviceScaleFactor in
+        them.
+        It is because:
+        1. requiresTiledLayer() uses the scale to compute an actual layer size in the device
+        pixel unit.
+        2. computePixelAlignment() uses the scale to compute an aligned layer position
+        in the device pixel unit.
</ins><span class="cx"> 
</span><del>-2014-03-17  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        No new tests. We can not test about requiresTiledLayer() because it depends on
+        gpu. computePixelAlignment() is correct now because fortunately Mac uses
+        only 2 (for retina display) as a deviceScaleFactor.
</ins><span class="cx"> 
</span><del>-        Add RemoteCommandListener support to MediaSessionManager.
-        https://bugs.webkit.org/show_bug.cgi?id=130354
</del><ins>+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::requiresTiledLayer):
+        (WebCore::GraphicsLayerCA::computePixelAlignment):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-05-13  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Listen for remote commands in MediaSessionManager.
</del><ins>+        Rename BarInfo to BarProp and remove [NoInterfaceObject]
+        https://bugs.webkit.org/show_bug.cgi?id=116027
</ins><span class="cx"> 
</span><del>-        * platform/audio/MediaSessionManager.cpp:
-        (WebCore::MediaSessionManager::addSession):
-        (WebCore::MediaSessionManager::removeSession):
-        * platform/audio/MediaSessionManager.h:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Add RemoteCommandListener to the project files:
</del><ins>+        Rename BarInfo to BarProp and remove [NoInterfaceObject] extended attribute from
+        the IDL interface to match the specification:
+        http://www.w3.org/html/wg/drafts/html/master/browsers.html#barprop
+
+        The new behavior also matches Firefox and Blink.
+
+        No new tests, covered by LayoutTests/fast/js/global-constructors-attributes.html.
+
</ins><span class="cx">         * CMakeLists.txt:
</span><ins>+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
</ins><span class="cx">         * GNUmakefile.list.am:
</span><ins>+        * Target.pri:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
</ins><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj.filters:
</span><ins>+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/gobject/GNUmakefile.am:
+        * page/BarProp.cpp: Renamed from Source/WebCore/page/BarInfo.cpp.
+        * page/BarProp.h: Renamed from Source/WebCore/page/BarInfo.h.
+        * page/BarProp.idl: Renamed from Source/WebCore/page/BarInfo.idl.
+        * page/DOMWindow.cpp:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
</ins><span class="cx"> 
</span><del>-2014-03-17  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2013-05-13  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rewrite WebHTMLConverter::_elementHasOwnBackgroundColor in C++
-        https://bugs.webkit.org/show_bug.cgi?id=130291
</del><ins>+        Remove ChromeClient::willPopupMenu
+        https://bugs.webkit.org/show_bug.cgi?id=116063
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Extracted HTMLConverterCaches::elementHasOwnBackgroundColor.
</del><ins>+        Remove ChromeClient::willPopupMenu.
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.mm:
-        (HTMLConverterCaches::elementHasOwnBackgroundColor):
-        (-[WebHTMLConverter _elementHasOwnBackgroundColor:]):
</del><ins>+        * page/ChromeClient.h:
</ins><span class="cx"> 
</span><del>-2014-03-17  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2013-05-13  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rewrite WebHTMLConverter::_elementIsBlockLevel in C++
-        https://bugs.webkit.org/show_bug.cgi?id=130287
</del><ins>+        Headers and footers should be pinned to the left edge of the window when scrolling 
+        horizontally
+        https://bugs.webkit.org/show_bug.cgi?id=116061
+        -and corresponding-
+        &lt;rdar://problem/13599215&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Rewrote _elementIsBlockLevel as HTMLConverterCaches::isBlockElement. Also removed the code to update
-        _elementIsBlockLevel in _traverseNode as computing the value of _elementIsBlockLevel is now fast.
</del><ins>+        The scrolling thread will need to know about the header and footer layers in order 
+        the implement this custom scrolling behavior. 
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.h:
-        * platform/mac/HTMLConverter.mm:
-        (HTMLConverterCaches::isBlockElement):
-        (-[WebHTMLConverter _elementIsBlockLevel:]):
-        (-[WebHTMLConverter _traverseNode:depth:embedded:]):
-        (-[WebHTMLConverter dealloc]):
-        (-[WebHTMLConverter init]):
</del><ins>+        These getters will fetch the header or footer layer from the FrameView as 
+        appropriate.
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::headerLayerForFrameView):
+        (WebCore::ScrollingCoordinator::footerLayerForFrameView):
+        * page/scrolling/ScrollingCoordinator.h:
</ins><span class="cx"> 
</span><del>-2014-03-17  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        When we’re scrolling on the main thread, adjust the position of the header and 
+        footer layers here.
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPosition):
</ins><span class="cx"> 
</span><del>-        Rewrite WebHTMLConverter::_getComputedFloat in C++
-        https://bugs.webkit.org/show_bug.cgi?id=130284
</del><ins>+        ScrollingStateScrollingNode now stores GraphicsLayers and PlatformLayers for the 
+        header and footer, just like it already does for the counterScrollingLayer.
+        * page/scrolling/ScrollingStateScrollingNode.cpp:
+        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
+        * page/scrolling/ScrollingStateScrollingNode.h:
+        (ScrollingStateScrollingNode):
+        (WebCore::ScrollingStateScrollingNode::headerLayer):
+        (WebCore::ScrollingStateScrollingNode::footerLayer):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Setters for the new layers.
+        * page/scrolling/mac/ScrollingCoordinatorMac.h:
+        (ScrollingCoordinatorMac):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::frameViewRootLayerDidChange):
+        (WebCore::ScrollingCoordinatorMac::setHeaderLayerForNode):
+        (WebCore::ScrollingCoordinatorMac::setFooterLayerForNode):
</ins><span class="cx"> 
</span><del>-        Rewrote _getComputedFloat as HTMLConverterCaches::floatPropertyValueForNode.
</del><ins>+        These setters and getters mirror the existing one for counterScrollingLayer.
+        * page/scrolling/mac/ScrollingStateScrollingNodeMac.mm:
+        (WebCore::ScrollingStateScrollingNode::headerPlatformLayer):
+        (WebCore::ScrollingStateScrollingNode::setHeaderLayer):
+        (WebCore::ScrollingStateScrollingNode::footerPlatformLayer):
+        (WebCore::ScrollingStateScrollingNode::setFooterLayer):
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.h:
-        * platform/mac/HTMLConverter.mm:
-        (HTMLConverterCaches::floatPropertyValueForNode):
-        (-[WebHTMLConverter _getFloat:forNode:property:]): Now that computing the float value is fast, we don't need to
-        store it in the cache.
-        (-[WebHTMLConverter dealloc]):
-        (-[WebHTMLConverter init]):
</del><ins>+        And the ScrollingTree will store CALayers for the header and footer.
+        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
+        (ScrollingTreeScrollingNodeMac):
+        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeScrollingNodeMac::updateBeforeChildren):
</ins><span class="cx"> 
</span><del>-2014-03-16  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        This is where the magic happens when we are scrolling on the scrolling thread. 
+        Adjust the horizontal position the behave like a fixed object, but keep the 
+        vertical position what it was when layer was created.
+        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
</ins><span class="cx"> 
</span><del>-        HTMLInputElement::defaultEventHandler() shouldn't force style updates.
-        &lt;https://webkit.org/b/130303&gt;
</del><ins>+        RenderLayerCompositor must now provide getters for the header and footer.
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::headerLayer):
+        (WebCore::RenderLayerCompositor::footerLayer):
</ins><span class="cx"> 
</span><del>-        Move the updateStyleIfNeeded() call down to TextFieldInputType instead
-        of doing it for every HTMLInputEvent.
</del><ins>+        Set the anchor point for when we adjust the position later on. Also call 
+        frameViewRootLayerDidChange() to get the new layers picked up and sent to the 
+        scrolling tree.
+        (WebCore::RenderLayerCompositor::updateLayerForHeader):
+        (WebCore::RenderLayerCompositor::updateLayerForFooter):
</ins><span class="cx"> 
</span><del>-        There might be a better way to do this; we only want to know about this
-        specific element's renderer, and don't need the rest of the tree.
-        This is still an easy hack to avoid a lot of unnecessary work.
</del><ins>+2013-05-12  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Add support for updating the Web Inspector toolbar height.
</ins><span class="cx"> 
</span><del>-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        * html/TextFieldInputType.cpp:
-        (WebCore::TextFieldInputType::forwardEvent):
</del><ins>+        https://bugs.webkit.org/show_bug.cgi?id=115996
</ins><span class="cx"> 
</span><del>-2014-03-17  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Joseph Pecoraro and Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        [WebVTT] Extending WebVTT Rendering with Regions
-        https://bugs.webkit.org/show_bug.cgi?id=109822
</del><ins>+        * inspector/InspectorFrontendClient.h:
+        (InspectorFrontendClient):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setToolbarHeight):
+        * inspector/InspectorFrontendHost.h:
+        (InspectorFrontendHost):
+        * inspector/InspectorFrontendHost.idl:
+        * testing/Internals.cpp:
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-05-13  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by Victor Carbune vcarbune@chromium.org):
-        https://chromium.googlesource.com/chromium/blink/+/0cdebc1d76d41bfcb9c4b022e54a4fbff132225d
</del><ins>+        toDataURL can return an empty image in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=115981
+        &lt;rdar://problem/13760256&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, as this feature is not active in default builds. New tests will be added
-        in an upcoming bug.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * css/mediaControls.css:
-        (video::-webkit-media-text-track-region):
-        (video::-webkit-media-text-track-region-container):
-        (video::-webkit-media-text-track-region-container.scrolling):
-        (video::-webkit-media-text-track-display):
-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::updateDisplay):
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::~TextTrack):
-        * html/track/TextTrackCue.cpp:
-        * html/track/TextTrackRegion.cpp:
-        (WebCore::TextTrackRegion::TextTrackRegion):
-        (WebCore::TextTrackRegion::textTrackCueContainerScrollingClass):
-        (WebCore::TextTrackRegion::textTrackCueContainerShadowPseudoId):
-        (WebCore::TextTrackRegion::textTrackRegionShadowPseudoId):
-        (WebCore::TextTrackRegion::appendTextTrackCueBox):
-        (WebCore::TextTrackRegion::displayLastTextTrackCueBox):
-        (WebCore::TextTrackRegion::willRemoveTextTrackCueBox):
-        (WebCore::TextTrackRegion::getDisplayTree):
-        (WebCore::TextTrackRegion::prepareRegionDisplayTree):
-        (WebCore::TextTrackRegion::startTimer):
-        (WebCore::TextTrackRegion::stopTimer):
-        (WebCore::TextTrackRegion::scrollTimerFired):
-        * html/track/TextTrackRegion.h:
-        (WebCore::TextTrackRegion::create):
-        (WebCore::TextTrackRegion::isScrollingRegion):
-        (WebCore::TextTrackRegion::ownerDocument):
-        * html/track/TextTrackRegion.idl:
-        * html/track/TextTrackRegionList.cpp:
-        (WebCore::TextTrackRegionList::getRegionById):
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCueBox::applyCSSProperties):
-        (WebCore::VTTCue::~VTTCue):
-        (WebCore::VTTCue::setIsActive):
-        (WebCore::VTTCue::removeDisplayTree):
-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTParser::createNewRegion):
-        * rendering/RenderVTTCue.cpp:
-        (WebCore::RenderVTTCue::layout):
</del><ins>+        In some accelerated rendering cases, calling toDataURL on
+        an off-screen canvas produced an empty image. The solution
+        was to force a CGContextFlush before extracting the data
+        for image generation.
</ins><span class="cx"> 
</span><del>-2014-03-17  Brendan Long  &lt;b.long@cablelabs.com&gt;
</del><ins>+        While here, I collected the flushing code from other methods
+        into a single place. Also we were getting into a situation where
+        we called flush two times in a row.
</ins><span class="cx"> 
</span><del>-        [GStreamer] human readable language code for tracks
-        https://bugs.webkit.org/show_bug.cgi?id=124514
</del><ins>+        Test: fast/canvas/toDataURL-not-empty.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        * platform/graphics/ImageBuffer.h:
+        (ImageBuffer): Define two new methods flushContext and flushContextIfNecessary.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::context): Call flushContextIfNecessary.
+        (WebCore::ImageBuffer::flushContextIfNecessary): Moved the 10.7 code in here.
+        (WebCore::ImageBuffer::flushContext): Calls CGContextFlush.
+        (WebCore::ImageBuffer::getUnmultipliedImageData): Call new helper.
+        (WebCore::ImageBuffer::getPremultipliedImageData): Call new helper.
+        (WebCore::ImageBuffer::toDataURL): Flush the CG context.
</ins><span class="cx"> 
</span><del>-        * PlatformEfl.cmake: Add GSTREAMER_TAG_INCLUDE_DIRS and GSTREAMER_TAG_LIBRARIES.
-        * PlatformGTK.cmake: Same.
-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
-        (WebCore::TrackPrivateBaseGStreamer::getLanguageCode): Run language codes though gst_tag_get_language_code_iso_639_1() to make sure they're valid.
-        (WebCore::TrackPrivateBaseGStreamer::notifyTrackOfTagsChanged): Use getLanguageCode() for languages instead of just getTag().
</del><ins>+2013-05-13  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-17  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Regressions in flexbox layout caused by the flexing optimizations.
+        https://bugs.webkit.org/show_bug.cgi?id=116058
+        &lt;rdar://problem/13863647&gt;
+        
+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        [Mac] Rewrite WebHTMLConverter::_computedStringForNode in C++
-        https://bugs.webkit.org/show_bug.cgi?id=130274
</del><ins>+        Roll out the flex-related changes from r149597 so that the layout
+        algorithm goes back to the way it was. Leave the repainting optimizations
+        in place though.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::gatherFlexChildrenInfo):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
</ins><span class="cx"> 
</span><del>-        Rewrote WebHTMLConverter::_computedStringForNode as HTMLConverterCaches::propertyValueForNode.
</del><ins>+2013-05-13  Philippe Normand  &lt;pnormand@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.h: Removed unused caches.
-        * platform/mac/HTMLConverter.mm:
-        (HTMLConverterCaches::computedStylePropertyForElement): Added use const String&amp; instead of String&amp; on property name.
-        (HTMLConverterCaches::inlineStylePropertyForElement): Ditto.
-        (HTMLConverterCaches::propertyValueForNode): Renamed and rewritten from _computedStringForNode.
-        (-[WebHTMLConverter _stringForNode:property:]): Simply return the computed value instead of storing it in the cache
-        now that the computing the value is fast.
-        (-[WebHTMLConverter dealloc]):
-        (-[WebHTMLConverter init]):
</del><ins>+        Unreviewed, rolling out r150014.
+        http://trac.webkit.org/changeset/150014
+        https://bugs.webkit.org/show_bug.cgi?id=86410
</ins><span class="cx"> 
</span><del>-2014-03-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Broke video playback on WK2 and some webgl tests
</ins><span class="cx"> 
</span><del>-        Remove unnecessary JSC::Handle null checks in bindings code.
-        &lt;https://webkit.org/b/130356&gt;
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
+        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
+        (WebCore::MediaPlayerPrivateGStreamerBase::paint):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
+        (MediaPlayerPrivateGStreamerBase):
</ins><span class="cx"> 
</span><del>-        Use Handle::slot() directly instead of going through Handle::get().
-        This avoids null checking the HandleSlot, which isn't necessary here
-        anyway, and the code already assumes it'll never be null.
</del><ins>+2013-05-13  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+        Unreviewed, rolling out r150022.
+        http://trac.webkit.org/changeset/150022
+        https://bugs.webkit.org/show_bug.cgi?id=114044
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSCSSRuleListCustom.cpp:
-        (WebCore::JSCSSRuleListOwner::isReachableFromOpaqueRoots):
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::JSCSSValueOwner::isReachableFromOpaqueRoots):
-        (WebCore::JSCSSValueOwner::finalize):
-        * bindings/js/JSMutationObserverCustom.cpp:
-        (WebCore::JSMutationObserverOwner::isReachableFromOpaqueRoots):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNodeOwner::isReachableFromOpaqueRoots):
-        * bindings/js/JSNodeListCustom.cpp:
-        (WebCore::JSNodeListOwner::isReachableFromOpaqueRoots):
-        * bindings/js/JSTextTrackCueCustom.cpp:
-        (WebCore::JSTextTrackCueOwner::isReachableFromOpaqueRoots):
-        * bindings/js/WebCoreTypedArrayController.cpp:
-        (WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots):
-        (WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::finalize):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        * bridge/runtime_root.cpp:
-        (JSC::Bindings::RootObject::finalize):
</del><ins>+        Causes assertions in media tests
</ins><span class="cx"> 
</span><del>-2014-03-17  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
+        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
+        (WebCore::MediaPlayerPrivateGStreamer::prepareToPlay):
+        (WebCore::MediaPlayerPrivateGStreamer::currentTime):
+        (WebCore::MediaPlayerPrivateGStreamer::seek):
+        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
</ins><span class="cx"> 
</span><del>-        AX: Reducing some code by using helper function ariaElementsFromAttribute
-        https://bugs.webkit.org/show_bug.cgi?id=130344
</del><ins>+2013-05-13  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Floats should not overhang from flex items
+        https://bugs.webkit.org/show_bug.cgi?id=115925
</ins><span class="cx"> 
</span><del>-        Change visibility of ariaElementsFromAttribute function from private to protected
-        so that other classes that derives from AccessibilityRenderObject can use it.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        No new tests. No behaviour change.
</del><ins>+        Allowing floats to overhand from flex items is not only against the
+        spec, it causes bad bugs. Fix this by having flex items properly avoid
+        floats.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::columnHeaders):
</del><ins>+        Test: fast/block/float/float-not-removed-crash2.html
</ins><span class="cx"> 
</span><del>-2014-03-16  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::avoidsFloats): Add flex items to avoid floats.
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::isFlexItemIncludingDeprecated): Determine if the current box is a
+            flex item or deprecated flex item.
</ins><span class="cx"> 
</span><del>-        Provide preference to enable additional AVFoundation options
-        https://bugs.webkit.org/show_bug.cgi?id=130275
</del><ins>+2013-05-13  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        [CSS Regions][CSS Exclusions] Shape-inside on regions should respect region borders and paddings
+        https://bugs.webkit.org/show_bug.cgi?id=115456
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::doesHaveAttribute): Added.
-        * html/HTMLMediaElement.h:
-        * page/Settings.in: Add new attribute.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::doesHaveAttribute): Added stub to call private player object's
-        implementation of doesHaveAttribute.
-        * platform/graphics/MediaPlayer.h:
-        (WebCore::MediaPlayerClient::doesHaveAttribute):
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundationCF::AVFWrapper::createAssetForURL): Check the &lt;media&gt; object,
-        and notify AVFoundationCF to use URI option if relevant.
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Check the &lt;media&gt; object,
-        and notify AVFoundation to use URI option if relevant.
-
-2014-03-17  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [EME] Add NULL protections in SourceBuffer and MediaSource.
-        https://bugs.webkit.org/show_bug.cgi?id=130266
-
-        Reviewed by Eric Carlson.
-
-        Add NULL checks in places which may be called after a SourceBuffer has been removed:
-
-        * Modules/mediasource/MediaSource.cpp:
-        (WebCore::MediaSource::monitorSourceBuffers): Protect against a SourceBuffer being removed
-            (and thus activeSourceBuffers being empty) when monitoring source buffer state.
-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::appendBufferTimerFired): Protect against SourceBuffer being removed.
-        (WebCore::SourceBuffer::videoTracks): Ditto.
-        (WebCore::SourceBuffer::audioTracks): Ditto.
-        (WebCore::SourceBuffer::textTracks): Ditto.
-        (WebCore::SourceBuffer::setActive): Ditto.
-        (WebCore::SourceBuffer::sourceBufferPrivateDidEndStream): Ditto.
-        (WebCore::SourceBuffer::hasCurrentTime): Ditto.
-        (WebCore::SourceBuffer::canPlayThrough): Ditto.
-        (WebCore::SourceBuffer::hasFutureTime): Ditto, and check for an empty buffered ranges.
-
-2014-03-17  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        WKThumbnailView should support snapshots
-        https://bugs.webkit.org/show_bug.cgi?id=130335
-        &lt;rdar://problem/16255139&gt;
-
-        Reviewed by Simon Fraser.
-
-        * WebCore.exp.in:
-
-2014-01-29  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
-
-        [CSS Grid Layout] getComputedStyle() not using author's order when showing named grid lines
-        https://bugs.webkit.org/show_bug.cgi?id=127837
-
</del><span class="cx">         Reviewed by David Hyatt.
</span><span class="cx"> 
</span><del>-        Added a couple of new Vectors to store the names of the grid lines
-        respecting their order. They will be used to get the right outcome
-        for getComputedStyle().
</del><ins>+        I refactored the computation logic of shape-inside on regions by removing access to RenderFlowThread from ExclusionShapeInfo's logicalTopOffset
+        function, this means all the logic is now existing in RenderBlockLineLayout.cpp. By modifying the logicalTopOffset it turned out that the borders
+        and padding hadn't worked correctly, since borders and paddings were counted twice in the shape-inside's computation. This patch adds the necessary
+        modifications to let it respect the borders and padding in the correct way. I created 2 new helper functions to prevent increasing the code size of
+        the layoutRunsAndFloatsInRange function.
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::addValuesForNamedGridLinesAtIndex):
-        (WebCore::valueForGridTrackList):
-        * css/StyleResolver.cpp:
-        (WebCore::createGridTrackList):
-        (WebCore::StyleResolver::applyProperty):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleGridData.cpp:
-        (WebCore::StyleGridData::StyleGridData):
-        * rendering/style/StyleGridData.h:
-        (WebCore::StyleGridData::operator==):
</del><ins>+        I introduced 7 new tests to test for testing the correct behavior.
</ins><span class="cx"> 
</span><del>-2014-03-17  Zsolt Borbely  &lt;borbezs@inf.u-szeged.hu&gt;
</del><ins>+        Tests: fast/regions/shape-inside/shape-inside-on-first-region-block-content.html
+               fast/regions/shape-inside/shape-inside-on-first-region-inline-content.html
+               fast/regions/shape-inside/shape-inside-on-second-region-block-content.html
+               fast/regions/shape-inside/shape-inside-on-second-region-inline-content.html
+               fast/regions/shape-inside/shape-inside-on-regions-inline-content.html
+               fast/regions/shape-inside/shape-inside-with-region-borders.html
+               fast/regions/shape-inside/shape-inside-with-region-padding.html
</ins><span class="cx"> 
</span><del>-        Fix the !ENABLE(PROMISES) build
-        https://bugs.webkit.org/show_bug.cgi?id=130328
</del><ins>+        * rendering/ExclusionShapeInfo.cpp:
+        (WebCore): Remove FlowThread logic from logicalTopOffset move definition to header.
+        * rendering/ExclusionShapeInfo.h:
+        (WebCore::ExclusionShapeInfo::logicalTopOffset): Moved from cpp.
+        (WebCore::ExclusionShapeInfo::logicalLeftOffset): Add condition for RenderRegions. 
+        * rendering/RenderBlock.h:
+        (RenderBlock): Add definition to the new helper members.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutExclusionShapeInsideInfo): Modified the flow thread case to return the appropriate region.
+        (WebCore::RenderBlock::updateLineBoundariesForExclusions): Added new helper function. Modify the shape-inside on regions
+        line boundaries and position computation logic.
+        (WebCore::RenderBlock::adjustLogicalLineTopAndLogicalHeightIfNeeded): Added new helper function which handles the flow thread case also.
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange): Modified the code to use the helper functions.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-05-13  Bear Travis  &lt;betravis@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Add missing ENABLE(PROMISES) guards.
</del><ins>+        [css exclusions] Enable CSS Exclusions by default when CSS_EXCLUSIONS is set
+        https://bugs.webkit.org/show_bug.cgi?id=115919
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMPromise.cpp:
-        * bindings/js/JSDOMPromise.h:
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-03-17  Gurpreet Kaur  &lt;k.gurpreet@samsung.com&gt;
</del><ins>+        Change the RuntimeEnabledFeatures::isCSSExclusionsEnabled boolean to default
+        to true. CSS Exclusions can still be enabled / disabled in platforms by
+        setting the CSS_EXCLUSIONS compile flag in one of the FeatureDefine files.
</ins><span class="cx"> 
</span><del>-        Safari should not render a cell if the &lt;td&gt; is empty
-        https://bugs.webkit.org/show_bug.cgi?id=15273
</del><ins>+        Test: fast/exclusions/css-exclusions-enabled.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        When table cell has no children and the doctype is not present or not
-        correct the border for that cell should not be drawn. Firefox also
-        follows the same behaviour hence making the changes to make it similiar
-        to Firefox behaviour.
</del><ins>+2013-05-13  Suchit Agrawal  &lt;a.suchit@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/table/table-cell-border-doctype.html
-               fast/table/table-cell-border-no-doctype.html
</del><ins>+        Cell heights are disproportional when a row-spanning cell contains a block element that determines the height of the rows
+        https://bugs.webkit.org/show_bug.cgi?id=52185
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::paintBoxDecorations):
-        Added condition for not drawing the border when table cell has no child
-        and doctype.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><ins>+        Cells heights are not proper when rowspan cell have its own height and rowspan height
+        is more than the height of the rows present in rowspan.
</ins><span class="cx"> 
</span><del>-2014-03-17  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        After calculating logical height of the rows in the table, we are recalculating the height
+        of the rows present in rowspan. Based on the ratio of row's logical height, we are
+        distributing rowspan cell height in rows.
</ins><span class="cx"> 
</span><del>-        Fix handling of &lt;annotation&gt; in MathMLTextElement.
-        https://bugs.webkit.org/show_bug.cgi?id=124128.
</del><ins>+        Test: fast/table/table-rowspan-height-distribution-in-rows.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * rendering/RenderTableSection.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        Update the logical height of the rows based on rowspan cell height.
+        (WebCore::RenderTableSection::distributeRowSpanHeightToRows):
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLTextElement.cpp:
-        (WebCore::MathMLTextElement::createElementRenderer): do not create the special RenderMathMLToken for the &lt;annotation&gt; tag.
-        (WebCore::MathMLTextElement::childShouldCreateRenderer): only allow text inside &lt;annotation&gt;.
</del><ins>+        It calculates logical height of the rows in the table.
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
</ins><span class="cx"> 
</span><del>-2014-03-17  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        Added new private API to distribute rowSpan cell height in rows.
+        * rendering/RenderTableSection.h:
+        (RenderTableSection):
</ins><span class="cx"> 
</span><del>-        [GTK][CMake] Credential storage is not enabled
-        https://bugs.webkit.org/show_bug.cgi?id=130149
</del><ins>+2013-04-30  Balazs Kelemen  &lt;b.kelemen@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><ins>+        [GStreamer] cannot seek after video finished
+        https://bugs.webkit.org/show_bug.cgi?id=114044
+
</ins><span class="cx">         Reviewed by Philippe Normand.
</span><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Add the libsecret include directories and link line to the build.
</del><ins>+        Test: media/video-seek-after-end.html
</ins><span class="cx"> 
</span><del>-2014-03-17  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        Rework the seeking logic to be able to seek after reseting the pipeline.
+        In addition to solve the actual problem this patch supposed to make seeking
+        more robust and correct.
+        The previous implementation tried to hide the complexity of asynchronous operations
+        on the pipeline. It did not handle the GST_MESSAGE_ASYNC_DONE message from the bus
+        but instead reported the seek as finished when it saw an asynchronous pending state
+        (GST_STATE_CHANGE_ASYNC) which could happen way before the seek is really done.
+        Now we pay attention to the GST_MESSAGE_ASYNC_DONE message to track the status of seeks.
+        Seeks are not the only operations executed asynchronously, changing the pipeling state is
+        similar. It means a seek can overlap with onother ongoing asynchronous operation.
+        This change address this by introducing an invariant for seeks, which is that we only request
+        a seek if there are no other ongoing asynchronous operations and the pipeline state is either
+        paused or playing (which is recommended anyway according to GStreamer's documentation).
+        This way we can be sure that the time when we get the next GST_MESSAGE_ASYNC_DONE message the
+        seek has been completed.
</ins><span class="cx"> 
</span><del>-        Unreviewed.
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::toGstClockTime): Factored time conversation into a helper.
+        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
</ins><span class="cx"> 
</span><del>-        Addressing reviewing comments by Darin in bug #130310 that I forgot
-        to address before landing the changes in r165732.
-        https://bugs.webkit.org/show_bug.cgi?id=130310
</del><ins>+        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition): The position might not be available
+        if the pipeline still has a pending state. As a workaround, if we are right after a seek we can
+        use the seek time. Avoiding this situation would be possible by not allowing any asynchronous
+        operation to overlap. I believe it would add a lot more complexity so I decided to rather introduce
+        this workaround. Otherwise those overlapping operations are handled fine by GStreamer.
</ins><span class="cx"> 
</span><del>-        * rendering/InlineTextBox.cpp:
-        * rendering/RenderLayer.cpp:
-        * rendering/RenderObject.cpp:
</del><ins>+        (WebCore::MediaPlayerPrivateGStreamer::prepareToPlay): Do not reset internal state variables.
+        This function called when there is an intent to restart playback but it does not actually restart it.
+        (WebCore::MediaPlayerPrivateGStreamer::currentTime): Just removed a staling newline.
+        (WebCore::MediaPlayerPrivateGStreamer::seek): Take a look to the pipeline state and act upon that.
+        If there is an ongoing asynchronous operation make the seek pending, otherwise do it now.
+        Now we handle overlapping seeks as well because I saw that it can happen in some tests.
+        Added an early return for live streams as it doesn't makes sense to try seeking in them.
</ins><span class="cx"> 
</span><del>-2014-03-17  Jessie Berlin  &lt;jberlin@apple.com&gt;
</del><ins>+        (WebCore::MediaPlayerPrivateGStreamer::handleMessage): Handle GST_MESSAGE_ASYNC_DONE and some refactoring.
+        (WebCore::MediaPlayerPrivateGStreamer::asyncStateChangeDone):
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates): Only handle seeks in the pending case, the rest is
+        now handled in asyncStateChangeDone.
+        (WebCore::MediaPlayerPrivateGStreamer::cacheDuration): Do not reset the m_mediaDurationKnown if the pipeline
+        has an asynchronous pending state because it would fail. It does actually happen when we get a duration message
+        after restarting the pipeline and it would result in restarting playback from the start. It seems to be a bug
+        in GStreamer that it sends the duration message too early. Also sanitized this function by merging redundant branches.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
</ins><span class="cx"> 
</span><del>-        Speculative build fix for ENABLE(TELEPHONE_NUMBER_DETECTION) after r165724.
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::HTMLTreeBuilder::linkifyPhoneNumbers):
</del><ins>+        [Mac] Move writeRange/PlainText/URL from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116009
</ins><span class="cx"> 
</span><del>-2014-03-17  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Only supplement Page with UserMediaController once
-        https://bugs.webkit.org/show_bug.cgi?id=130311
-
-        Reviewed by Darin Adler.
-
-        Don't supplement the Page with an UserMediaController object if that Page was
-        already supplemented with one. This avoids triggering an assertion in
-        Supplementable::provideSupplement() that ensures no supplement with the same key
-        exists yet. The cause of this is calling provideUserMediaTo() in the Internals
-        constructor that's using the same Page for two subsequent tests.
-
-        * Modules/mediastream/UserMediaController.cpp:
-        (WebCore::provideUserMediaTo):
-
-2014-03-17  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Explicitly include cstdio header for debug builds in InlineTextBox, RenderLayer, RenderObject
-        https://bugs.webkit.org/show_bug.cgi?id=130310
-
-        Reviewed by Darin Adler.
-
-        Building the GTK port with Clang through CMake falls into a configuration where
-        the cstdio header is not indirectly included in InlineTextBox, RenderLayer and
-        RenderObject source files. fprintf() is required for helper functions that print
-        out helpful debugging information in debug builds, so the cstdio header should
-        be included explicitly in that case.
-
-        * rendering/InlineTextBox.cpp:
-        * rendering/RenderLayer.cpp:
-        * rendering/RenderObject.cpp:
-
-2014-03-17  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
-
-        [GTK] Cleanup WebKitDOMObject
-        https://bugs.webkit.org/show_bug.cgi?id=130246
-
-        Reviewed by Martin Robinson.
-
-        Remove unneeded getter and fix coding style.
-
-        * bindings/gobject/WebKitDOMObject.cpp:
-        (webkitDOMObjectSetProperty):
-        (webkit_dom_object_class_init):
-
-2014-03-17  Darin Adler  &lt;darin@apple.com&gt;
-
-        Stop using deprecatedCharacters in HTMLTreeBuilder
-        https://bugs.webkit.org/show_bug.cgi?id=130323
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Keeping this separate from other patches because of concern that this could affect
-        page load performance.
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::writeRange): Added. Moved from ClipboardMac,
+        but added some FIXMEs.
+        (WebCore::Clipboard::writePlainText): Ditto.
+        (WebCore::Clipboard::writeURL): Ditto.
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::ExternalCharacterTokenBuffer):
-        Use a StringView instead of a character pointer.
-        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::isEmpty): Ditto.
-        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::skipAtMostOneLeadingNewline):
-        Ditto.
-        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::takeRemaining): Ditto.
-        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::giveRemainingTo): Ditto.
-        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::takeRemainingWhitespace): Ditto.
-        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::skipLeading): Ditto.
-        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::takeLeading): Ditto.
-        (WebCore::HTMLTreeBuilder::linkifyPhoneNumbers): Use StringView::upconvertedCharacters.
</del><ins>+        * dom/Clipboard.h: Made writeURL, writeRange, and writePlainText
+        non-virtual in non-legacy clipboard implementations.
</ins><span class="cx"> 
</span><del>-2014-03-17  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        * platform/mac/ClipboardMac.h: Removed writeRange, writeURL, and
+        writePlainText.
+        * platform/mac/ClipboardMac.mm: Ditto.
</ins><span class="cx"> 
</span><del>-        Make some Module class constructors return PassRef.
-        https://bugs.webkit.org/show_bug.cgi?id=130282
</del><ins>+2013-05-13  Noam Rosenthal  &lt;noam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        [CoordGfx] requestAnimationFrame performance issues
+        https://bugs.webkit.org/show_bug.cgi?id=112345
</ins><span class="cx"> 
</span><del>-        Make the constructor helpers for the following classes return PassRef
-        instead of PassRefPtr since they will never return null.
-         - GamepadList
-         - Geolocation
-         - NavigatorContentUtils
-         - NetworkInfoConnection
-         - Notification
-         - NotificationCenter
-         - DeviceProximityEvent
</del><ins>+        Reviewed by Jocelyn Turcotte.
</ins><span class="cx"> 
</span><del>-        * Modules/gamepad/GamepadList.h:
-        (WebCore::GamepadList::create):
-        * Modules/geolocation/Geolocation.cpp:
-        (WebCore::Geolocation::create):
-        * Modules/geolocation/Geolocation.h:
-        (WebCore::Geolocation::GeoNotifier::create):
-        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
-        (WebCore::NavigatorContentUtils::create):
-        * Modules/navigatorcontentutils/NavigatorContentUtils.h:
-        * Modules/networkinfo/NetworkInfoConnection.cpp:
-        (WebCore::NetworkInfoConnection::create):
-        * Modules/networkinfo/NetworkInfoConnection.h:
-        * Modules/notifications/Notification.cpp:
-        (WebCore::Notification::create):
-        * Modules/notifications/Notification.h:
-        * Modules/notifications/NotificationCenter.cpp:
-        (WebCore::NotificationCenter::create):
-        * Modules/notifications/NotificationCenter.h:
-        * Modules/proximity/DeviceProximityEvent.h:
-        (WebCore::DeviceProximityEvent::create):
</del><ins>+        Removed current requestAnimationFrame logic from CoordinatedGraphics. The new logic
+        is entirely in WebKit2 CoordinatedLayerTreeHost.
</ins><span class="cx"> 
</span><del>-2014-03-16  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        Covered by existing tests in fast/animations.
</ins><span class="cx"> 
</span><del>-        [CSSRegions]Do not compute region range for a box unless the parent has one
-        https://bugs.webkit.org/show_bug.cgi?id=130249
</del><ins>+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
+        (WebCore::CoordinatedGraphicsScene::CoordinatedGraphicsScene):
+        (WebCore::CoordinatedGraphicsScene::paintToCurrentGLContext):
+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.h:
+        (CoordinatedGraphicsScene):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+2013-05-13  Víctor Manuel Jáquez Leal  &lt;vjaquez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        If the containing block does not have a region range computed, do not attempt to compute
-        a region range for a child. In such cases, the range computation for a child can lead to
-        a result that is wrong, possibly leading to an incorrect clipping.
</del><ins>+        [texmap][GStreamer] Composited Video support
+        https://bugs.webkit.org/show_bug.cgi?id=86410
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/inline-block-flowed-in-regions.html
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::canComputeRegionRangeForBox):
-        (WebCore::RenderBlock::computeRegionRangeForBoxChild):
-        (WebCore::RenderBlock::estimateRegionRangeForBoxChild):
-        (WebCore::RenderBlock::updateRegionRangeForBoxChild):
-        * rendering/RenderFlowThread.h:
</del><ins>+        Enable the video accelerated compositing using the WebKit's
+        TextureMapper.
</ins><span class="cx"> 
</span><del>-2014-03-16  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        This patch does not use hardware accelerated video decoding. It
+        provides a generic path for system memory buffers.
</ins><span class="cx"> 
</span><del>-        CSSValueList should assert that no null values are added to it.
-        &lt;https://webkit.org/b/130315&gt;
</del><ins>+        No new tests, already covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Add assertions in CSSValueList's append() and prepend() that we are
-        not adding a null value. This caught a single place in CSSParser
-        that was appending an alread-released RefPtr to a CSSValueList.
-        That list was eventually discarded anyway (due to &quot;foundClip&quot; now
-        being true), so the fix is simply to remove the adding.
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
+        (WebCore):
+        (WebCore::MediaPlayerPrivateGStreamerBase::updateTexture): update the
+        texture content with the new received video buffer.
+        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint): choose to
+        use the accelerated compositing or the normal code path
+        (WebCore::MediaPlayerPrivateGStreamerBase::paint): if accelerated
+        compositing is used this method is halted.
+        (WebCore::MediaPlayerPrivateGStreamerBase::paintToTextureMapper): get
+        a texture from the pool and draws it if it is already available.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
+        (MediaPlayerPrivateGStreamerBase):
+        (WebCore::MediaPlayerPrivateGStreamerBase::platformLayer): returns itself
+        (WebCore::MediaPlayerPrivateGStreamerBase::supportsAcceleratedRendering):
+        returns true
</ins><span class="cx"> 
</span><del>-        Eventually we should use Ref and PassRef all over for CSSValueList,
-        this is just a first step on the way.
</del><ins>+2013-05-13  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Document: Use a DeferrableOneShotTimer to throw out StyleResolver when unused.
+        &lt;http://webkit.org/b/115929&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseFillShorthand):
-        * css/CSSValueList.h:
-        (WebCore::CSSValueList::append):
-        (WebCore::CSSValueList::prepend):
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-03-16  Praveen R Jadhav  &lt;praveen.j@samsung.com&gt;
</del><ins>+        Nothing exciting here, just replacing a rickety-looking punting mechanism with a proper
+        DeferrableOneShotTimer. Note that the timeout changes from 60 to 30 seconds because DOST
+        works by punting a full interval on next timeout.
</ins><span class="cx"> 
</span><del>-        AudioBufferSourceNode stop attribute shouldn't throw exception in finished state.
-        https://bugs.webkit.org/show_bug.cgi?id=130000.
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::didAccessStyleResolver):
+        (WebCore::Document::styleResolverThrowawayTimerFired):
+        * dom/Document.h:
+        (Document):
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+2013-05-13  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        AudioBufferSourceNode may go to FINISHED_STATE even before &quot;stop&quot; method is called 
-        as silence rendered after audio data is played out when its not looping.
-        A call to &quot;stop&quot; method after this shouldn't throw exception.
</del><ins>+        REGRESSION(r149287): FoldingText only shows me half of my text.
+        &lt;http://webkit.org/b/115956&gt;
+        &lt;rdar://problem/13831099&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/webaudio/AudioScheduledSourceNode.cpp:
-        (WebCore::AudioScheduledSourceNode::stop):
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-03-16  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        Check if the FrameView geometry changed post-layout, and send a resize event if needed.
+        This brings us closer to the original resize event behavior, with the exception that
+        setFrameRect() still fires an event right away if possible. This means we are still
+        guarded from FOUC's but frames that layout via [WebHTMLView layoutToMinimumPageWidth]
+        also get resize events like they used to.
</ins><span class="cx"> 
</span><del>-        Web Inspector: generated backend commands should reflect build system ENABLE settings
-        https://bugs.webkit.org/show_bug.cgi?id=130111
</del><ins>+        No new tests, because I don't know how to test this.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setFrameRect):
+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::sendResizeEventIfNeeded):
</ins><span class="cx"> 
</span><del>-        Add guards for conditional inspector domains.
</del><ins>+            Factor out the resize event logic from setFrameRect() so we can call it from both
+            there and performPostLayoutTasks(). sendResizeEventIfNeeded() only sends an event
+            if view geometry or zoom factor has changed since last time it was called.
</ins><span class="cx"> 
</span><del>-        For Makefile-based build systems, force regeneration of the
-        combined file if the list of domains has changed.
</del><ins>+2013-05-13  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Combine only the Inspector domains listed in INSPECTOR_DOMAINS,
-        instead of globbing any .json file.
</del><ins>+        Remove unneeded counters from ScopeContentDistribution.
+        https://bugs.webkit.org/show_bug.cgi?id=116028
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * GNUmakefile.am:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-16  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        They don't do much.
</ins><span class="cx"> 
</span><del>-        Follow-up: Double values passed to fabsf() in maxScaleFromTransform()
-        &lt;http://webkit.org/b/130297&gt;
</del><ins>+        * WebCore.exp.in:
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        * dom/ShadowRoot.h:
+        
+            No need for registration code anymore.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ScopeContentDistribution::ScopeContentDistribution):
+        
+            Default m_insertionPointListIsValid to true to avoid crawling when there are no InsertionPoints.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::maxScaleFromTransform): Use narrowPrecisionToFloat()
-        instead of static_cast&lt;float&gt;().
</del><ins>+        (WebCore::ScopeContentDistribution::ensureInsertionPointList):
+        (WebCore::ScopeContentDistribution::registerInsertionPoint):
+        (WebCore::ScopeContentDistribution::unregisterInsertionPoint):
+        * html/shadow/ContentDistributor.h:
+        
+            Remove distributeNodeChildrenTo, it was only used by the older/younger shadow root code.
</ins><span class="cx"> 
</span><del>-2014-03-16  Andreas Kling  &lt;akling@apple.com&gt;
-
-        ScriptExecutionContext::vm() should return a reference.
-        &lt;https://webkit.org/b/129611&gt;
-
-        Every ScriptExecutionContext has a VM, so this can never return null.
-        Made WorkerScriptController::vm() return a reference as well, since
-        that was needed for this change.
-
-        Reviewed by Geoffrey Garen.
-
-        * bindings/js/WorkerScriptController.h:
-        (WebCore::WorkerScriptController::vm):
-        * bindings/js/WorkerScriptDebugServer.cpp:
-        (WebCore::WorkerScriptDebugServer::recompileAllJSFunctions):
-        * css/ElementRuleCollector.cpp:
-        (WebCore::ElementRuleCollector::ruleMatches):
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::vm):
-        * dom/ScriptExecutionContext.h:
-        * dom/SelectorQuery.cpp:
-        (WebCore::SelectorDataList::execute):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::dropProtection):
</del><span class="cx">         * testing/Internals.cpp:
</span><del>-        (WebCore::Internals::parserMetaData):
</del><ins>+        * testing/Internals.h:
+        * testing/Internals.idl:
</ins><span class="cx"> 
</span><del>-2014-03-16  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+2013-05-13  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove OwnPtr.h, PassOwnPtr.h header inclusions in Source/WebCore/html/parser/ code
-        https://bugs.webkit.org/show_bug.cgi?id=129667
</del><ins>+        Web Inspector: Remove unused references from projects in Visual Studio
+        https://bugs.webkit.org/show_bug.cgi?id=116002
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Reviewed by Csaba Osztrogonác.
</ins><span class="cx"> 
</span><del>-        Remove unnecessary inclusions of the OwnPtr.h and PassOwnPtr.h headers
-        in the code under Source/WebCore/html/parser/.
</del><ins>+        nativeMemoryProfiler.css and NativeMemorySnapshotView.js were removed in r149807.
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLParserScheduler.h:
-        * html/parser/HTMLToken.h:
-        * html/parser/HTMLTreeBuilder.h:
-        * html/parser/XSSAuditor.h:
-        * html/parser/XSSAuditorDelegate.h:
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-03-16  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
</ins><span class="cx"> 
</span><del>-        Remove uses of &quot;cat&quot; in DerivedSources.make outside platform-specific rules
-        https://bugs.webkit.org/show_bug.cgi?id=130307
</del><ins>+2013-05-13  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        WebProcess consuming very high CPU on linkedin.com
+        https://bugs.webkit.org/show_bug.cgi?id=115601
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make: Use &quot;perl -pe ''&quot; instead of &quot;cat&quot;.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-16  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        Disable WEB_TIMING_MINIMAL.
+        Turn off window.performance and performance.now(). Some JS frameworks expect
+        additional Web Timing APIs, when performance.now() is available.
</ins><span class="cx"> 
</span><del>-        Web Inspector: vended backend commands file should be generated as part of the build
-        https://bugs.webkit.org/show_bug.cgi?id=130110
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
+        * dom/EventTargetFactory.in:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::resetDOMWindowProperties):
+        (WebCore):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * page/DOMWindow.idl:
+        * page/Performance.cpp:
+        (WebCore::Performance::timing):
+        * page/Performance.h:
+        (Performance):
+        * page/Performance.idl:
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+2013-05-12  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj: Copy InspectorWebBackendCommands.js to the
-        private headers directory.
</del><ins>+        REGRESSION (r149749): Video becomes invisible when it starts playing at newyorkbygehry.com
+        https://bugs.webkit.org/show_bug.cgi?id=115963
</ins><span class="cx"> 
</span><del>-2014-03-16  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        [regression] foreign content not displayed in MathML
-        &lt;https://webkit.org/b/124128&gt;
</del><ins>+        Test: media/video-remove-insert-repaints.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::insertedInto): Set m_inActiveDocument when inserted into a document.
+        (WebCore::HTMLMediaElement::removedFrom): Fix logging.
</ins><span class="cx"> 
</span><del>-        This restores foreign content in &lt;mtext&gt;, &lt;mn&gt; and &lt;mi&gt; elements, but only when it is &quot;phrasing content&quot; as defined per the HTML5 specification. Other token elements are not handled here. This change makes mspace-units.html work again on Linux.
</del><ins>+2013-05-12  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: mathml/presentation/foreign-mi-dynamic.html
-               mathml/presentation/foreign-mi.html
-               mathml/presentation/foreign-mn.html
-               mathml/presentation/foreign-mtext-rejected.html
-               mathml/presentation/foreign-mtext.html
</del><ins>+        Move sudden termination symbols to the Mac-only section
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLTextElement.cpp:
-        (WebCore::MathMLTextElement::createElementRenderer): create a RenderMathMLToken for mn, ms and mtext.
-        (WebCore::isPhrasingContent): helper function to check phrasing content, as defined by the HTML spec.
-        (WebCore::MathMLTextElement::childShouldCreateRenderer): &lt;mi&gt;, &lt;mn&gt;, &lt;mtext&gt; and, &lt;ms&gt; now accepts phrasing content.
-        * rendering/mathml/RenderMathMLToken.cpp:
-        (WebCore::RenderMathMLToken::RenderMathMLToken):
-        (WebCore::RenderMathMLToken::updateTokenContent): initialize the m_containsElement boolean when updating the token content.
-        (WebCore::RenderMathMLToken::updateStyle): move &lt;mi&gt; specific handling in its own section and only apply the single-char rule when it does not contain elements.
-        * rendering/mathml/RenderMathMLToken.h: add an m_containsElement boolean to handle token element specifically.
</del><ins>+        * WebCore.exp.in: Move the sudden termination symbols to the
+        !PLATFORM(IOS) section for reals this time.
</ins><span class="cx"> 
</span><del>-2014-03-16  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        PlatformTimeRanges::nearest() truncates closestDelta values from double to float
-        &lt;http://webkit.org/b/130298&gt;
</del><ins>+        Fix Mac build.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * platform/mac/PasteboardMac.mm: Add back include of ClipboardMac.h
+        that was removed by accident a couple of patches back.
</ins><span class="cx"> 
</span><del>-        Fixes the following build failures using trunk clang:
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            WebCore/platform/graphics/PlatformTimeRanges.cpp:210:28: error: absolute value function 'fabsf' given an argument of type 'double' but has parameter of type 'float' which may cause truncation of value [-Werror,-Wabsolute-value]
-                        closestDelta = fabsf(startTime - time);
-                                       ^
-            WebCore/platform/graphics/PlatformTimeRanges.cpp:210:28: note: use function 'fabs' instead
-                        closestDelta = fabsf(startTime - time);
-                                       ^~~~~
-                                       fabs
-            WebCore/platform/graphics/PlatformTimeRanges.cpp:214:28: error: absolute value function 'fabsf' given an argument of type 'double' but has parameter of type 'float' which may cause truncation of value [-Werror,-Wabsolute-value]
-                        closestDelta = fabsf(endTime - time);
-                                       ^
-            WebCore/platform/graphics/PlatformTimeRanges.cpp:214:28: note: use function 'fabs' instead
-                        closestDelta = fabsf(endTime - time);
-                                       ^~~~~
-                                       fabs
</del><ins>+        [Mac] Moved files function from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116008
</ins><span class="cx"> 
</span><del>-        * platform/graphics/PlatformTimeRanges.cpp:
-        (WebCore::PlatformTimeRanges::nearest): Extract start and end
-        time deltas into local variables so they don't have to be
-        computed twice, using fabs() instead of fabsf().
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-03-16  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::files): Added. Moved the DOM-depdendent and
+        platform-independent part of the files function in ClipboardMac here.
</ins><span class="cx"> 
</span><del>-        Optimize hasTagName when called on an HTMLElement
-        https://bugs.webkit.org/show_bug.cgi?id=130090
</del><ins>+        * dom/Clipboard.h: Made files function non-virtual in non-legacy case.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        * platform/Pasteboard.h: Removed static member function
+        absoluteURLsFromPasteboardFilenames since it can now be private to
+        PasteboardMac. Added member function readFilenames.
</ins><span class="cx"> 
</span><del>-        Added new hasTagName functions that have the efficiency of hasLocalName.
-        but are safe.
</del><ins>+        * platform/mac/ClipboardMac.h: Removed function member files and also
+        now-unused data member m_clipboardContents.
</ins><span class="cx"> 
</span><del>-        Now we can always use hasTagName, and we'll get a compile time error if
-        we try to use an SVG tag name with an HTML element. All call sites that
-        use the more specific tag name types are more efficient, and call sites
-        that have a specific pointer type will get even more efficient checking
-        that is exactly what we used to get by calling hasLocalName.
</del><ins>+        * platform/mac/ClipboardMac.mm: Removed files function.
+        (WebCore::ClipboardMac::ClipboardMac): Removed code to initialize
+        m_clipboardContents.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::hasTagName): Cast explicitly to Element
-        since Node::hasTagName no longer works on a general QualifiedName.
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isDescendantOfElementType): Use
-        more specific type, RenderElement, so we can call hasTagName on Element
-        instead of Node; eliminates an unnecessary branch.
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::absoluteURLsFromPasteboardFilenames): Changed from a static
+        member function to a file-local function.
+        (WebCore::absoluteURLsFromPasteboard): Changed to call the function
+        above in its new location.
+        (WebCore::Pasteboard::readFilenames): Added. Code from ClipboardMac,
+        minus the DOM-specific parts. Added a FIXME about the peculiar round
+        trip through NSURL this code takes.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityTableColumn.cpp: Added now-needed include.
-        * accessibility/atk/AccessibilityObjectAtk.cpp: Ditto.
</del><ins>+2013-05-12  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/DocumentStyleSheetCollection.cpp:
-        (WebCore::DocumentStyleSheetCollection::collectActiveStyleSheets): Use
-        new for loop and full words for variable names. Also use nullptr instead
-        of 0. Call toHTMLElement and toSVGElement in code that checks hasTagName
-        since it's already checking isHTMLElement and isSVGElement.
</del><ins>+        Fix WebKit2 build.
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::attrNodeListMap): Use NeverDestroyed and put the vectors into
-        the map rather than putting pointers to a vector into the map.
-        (WebCore::attrNodeListForElement): Take a reference rather than a pointer,
-        and update for the change above.
-        (WebCore::ensureAttrNodeListForElement): Ditto.
-        (WebCore::removeAttrNodeListForElement): Ditto.
-        (WebCore::findAttrNodeInList): Ditto.
-        (WebCore::Element::isFocusable): Use lineageOfType&lt;HTMLCanvasElement&gt;
-        to fine the canvas rather than a hand-written loop.
-        (WebCore::Element::attrNodeList): Update for above changes.
-        (WebCore::Element::setAttributeNode): Ditto.
-        (WebCore::Element::attrIfExists): Ditto.
-        (WebCore::Element::ensureAttr): Ditto.
-        (WebCore::Element::detachAttrNodeFromElementWithValue): Ditto.
-        (WebCore::Element::detachAllAttrNodesFromElement): Ditto.
</del><ins>+        * WebCore.exp.in:
+        Put WebCore::disableSuddenTermination and WebCore::enableSuddenTermination symbols in the right section.
</ins><span class="cx"> 
</span><del>-        * dom/Element.h: Removed the overload of hasLocalName that takes a
-        QualifiedName and ignores the non-local-name parts of it. Callers should
-        use hasTagName instead, now that it's optimized appropriately. Added
-        overloads of hasTagName for all the specific qualified name types. It's
-        more efficient to use the Node versions of these functions rather than
-        using QualifiedName::matches to do the check. Removed the hasTagName and
-        hasLocalName functions from the Node class; the only convenience functions
-        needed in Node are the specific checks for tags from HTML, MathML, and SVG,
-        not the general purpose ones.
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Node.h: Removed hasLocalName and replaced the single hasTagName
-        that takes a QualifiedName with three faster ones that take HTML, MathML,
-        and SVG qualified names instead. Also updated to use nullptr instead of 0.
</del><ins>+        [Mac] Move types function from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116007
</ins><span class="cx"> 
</span><del>-        * dom/PositionIterator.cpp: Added now-needed include.
-        * dom/Text.cpp: Ditto.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * dom/make_names.pl:
-        (printHeaderHead): Renamed an argument for clarity and added a definitions
-        argument, which is where we insert the classes derived from QualifiedName.
-        (printCppHead): Renamed an argument for clarity.
-        (printTypeHelpers): Use hasTagName rather than hasLocalName, since the
-        former is now optimized to be the same as what the latter was.
-        (printNamesHeaderFile): Define a class derived from QualifiedName that can
-        be used at compile time to avoid having to check the namespace.
-        (printNamesCppFile): Use the new more-specific type as needed.
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::types): Added. Calls through to Pasteboard
+        after doing checks needed at this level.
</ins><span class="cx"> 
</span><del>-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::isLegacyAppleStyleSpan): Use hasTagName instead of hasLocalName,
-        and references instead of pointers.
-        (WebCore::ApplyStyleCommand::ApplyStyleCommand): Removed uneeded explicit
-        construction of a smart pointer.
-        (WebCore::ApplyStyleCommand::shouldApplyInlineStyleToRun): Updated to use
-        the enclosingElementWithTag function by its new name.
</del><ins>+        * dom/Clipboard.h: Made types function non-virtual in non-legacy case,
+        and removed non-helpful comment.
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::selectionUnorderedListState): Updated to use the
-        enclosingElementWithTag function by its new name.
-        (WebCore::Editor::selectionOrderedListState): Ditto.
</del><ins>+        * platform/Pasteboard.h: Updated includes and comments at the top of
+        the file a bit. Removed static member function addHTMLClipboardTypesForCocoaType,
+        since it can now be private to PasteboardMac. Added member function types.
</ins><span class="cx"> 
</span><del>-        * editing/InsertListCommand.cpp:
-        (WebCore::InsertListCommand::doApply): Use a more-specific type for the list tag.
-        (WebCore::InsertListCommand::doApplyForSingleParagraph): Ditto.
-        * editing/InsertListCommand.h: Ditto.
</del><ins>+        * platform/mac/ClipboardMac.h: Removed types function.
+        * platform/mac/ClipboardMac.mm: Ditto.
</ins><span class="cx"> 
</span><del>-        * editing/MarkupAccumulator.cpp:
-        (WebCore::MarkupAccumulator::serializeNodesWithNamespaces): Added an explicit
-        cast to Element in the loop that is already guarded by an isElementNode check.
-        Also use a modern C++ for loop.
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType): Made this a file-local
+        function instead of a static member function.
+        (WebCore::Pasteboard::types): Added. Moved from ClipboardMac.
</ins><span class="cx"> 
</span><del>-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
-        Updated to use the enclosingElementWithTag function by its new name.
-        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds): Ditto.
-        (WebCore::ReplaceSelectionCommand::positionAtEndOfInsertedContent): Ditto.
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/TypingCommand.cpp: Added now-needed includes.
-        * editing/VisibleUnits.cpp: Ditto.
</del><ins>+        [Mac] Move setData from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116006
</ins><span class="cx"> 
</span><del>-        * editing/htmlediting.cpp:
-        (WebCore::enclosingElementWithTag): Changed to return an Element instead of a Node,
-        since nodes other than elements do not have tags.
-        * editing/htmlediting.h: Ditto.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::adjustedSelectionRange): Updated to use the enclosingElementWithTag
-        function by its new name.
-        * editing/markup.cpp:
-        (WebCore::StyledMarkupAccumulator::appendText): Ditto.
-        (WebCore::StyledMarkupAccumulator::traverseNodesForSerialization): Ditto.
-        (WebCore::highestAncestorToWrapMarkup): Ditto.
-        (WebCore::createMarkupInternal): Ditto.
-        (WebCore::createContextualFragment): Ditto. Use hasTagName instead of hasLocalName,
-        since the former is now optimized to be the same as the latter was before.
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::setData): Added. Calls through to Pasteboard
+        after doing checks needed at this level.
</ins><span class="cx"> 
</span><del>-        * html/HTMLCollection.cpp:
-        (WebCore::isMatchingElement): Use hasTagName instead of hasLocalName,
-        since the former is now optimized to be the same as the latter was before.
-        (WebCore::nameShouldBeVisibleInDocumentAll): Ditto.
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::ieForbidsInsertHTML): Ditto.
-        (WebCore::unicodeBidiAttributeForDirAuto): Ditto.
-        (WebCore::HTMLElement::parseBorderWidthAttribute): Ditto.
-        (WebCore::HTMLElement::setInnerHTML): Ditto.
-        (WebCore::shouldProhibitSetInnerOuterText): Ditto. Added this to share code between
-        setInnerText and setOuterText.
-        (WebCore::HTMLElement::setInnerText): Ditto.
-        (WebCore::HTMLElement::setOuterText): Ditto.
-        (WebCore::HTMLElement::rendererIsNeeded): Ditto.
-        (WebCore::HTMLElement::createElementRenderer): Ditto.
</del><ins>+        * dom/Clipboard.h: Made setData non-virtual in non-legacy case.
</ins><span class="cx"> 
</span><del>-        * html/HTMLElement.h: Added hasTagName, which hides the one inherited from Element
-        and takes the more-specific HTMLQualifiedName type. This means we don't need to check
-        the namespace at runtime because it's known at compile time. Also put the
-        implementation of Node::hasTagName for HTMLQualifiedName into this header.
</del><ins>+        * platform/Pasteboard.h: Updated includes and forward declarations.
+        Removed static member function cocoaTypeFromHTMLClipboardType, since
+        it can now be private to PasteboardMac. Added static member function
+        addHTMLClipboardTypesForCocoaType, which is shared between the
+        ClipboardMac and PasteboardMac files for now. Added writeString.
</ins><span class="cx"> 
</span><del>-        * html/HTMLObjectElement.cpp:
-        (WebCore::isRecognizedTagName): Updated for change in return type of
-        HTMLNames::getHTMLTags.
</del><ins>+        * platform/mac/ClipboardMac.h: Removed setData.
</ins><span class="cx"> 
</span><del>-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::add): Use hasTagName inastead of hasLocalName.
-        (WebCore::HTMLSelectElement::value): Use isHTMLOptionElement instead of hasTagName.
-        Also use a new style for loop and emptyString() instead of &quot;&quot;.
-        (WebCore::HTMLSelectElement::setValue): Ditto.
-        (WebCore::HTMLSelectElement::setLength): Ditto.
-        (WebCore::HTMLSelectElement::searchOptionsForValue): Ditto.
-        (WebCore::HTMLSelectElement::restoreFormControlState): Ditto.
</del><ins>+        * platform/mac/ClipboardMac.mm: Removed utiTypeFromCocoaType,
+        addHTMLClipboardTypesForCocoaType, and setData.
+        (WebCore::ClipboardMac::types): Call addHTMLClipboardTypesForCocoaType
+        as a Pasteboard static member function, for now.
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::additionalPresentationAttributeStyle): Use hasTagName
-        instead of hasLocalName.
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::cocoaTypeFromHTMLClipboardType): Added. Moved from ClipboardMac.
+        (WebCore::Pasteboard::readString): Changed to call
+        cocoaTypeFromHTMLClipboardType as a file-local function, not a member
+        function (in fact, we didn't need to repeat the class name before, either,
+        so this is just removing something we didn't need).
+        (WebCore::utiTypeFromCocoaType): Added. Moved from ClipboardMac.
+        (WebCore::Pasteboard::addHTMLClipboardTypesForCocoaType): Ditto.
+        (WebCore::Pasteboard::writeString): Ditto.
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableRowsCollection.cpp:
-        (WebCore::isInSection): Updated to use hasTagName and take a reference.
-        (WebCore::HTMLTableRowsCollection::rowAfter): Pass a reference.
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLConstructionSite.cpp: Added now-needed include.
</del><ins>+        [Mac] Move getData from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116005
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::createCaseMap): Updated to return a map rather than filling one in, and to
-        be flxible about the type of the table being used.
-        (WebCore::adjustSVGTagNameCase): Updated to use NeverDestroyed.
-        (WebCore::adjustAttributes): Added new helper so we can share more code. Updated
-        template argument names for clarity.
-        (WebCore::adjustSVGAttributes): Marked this inline, since it just turns around and
-        calls a single non-inline function.
-        (WebCore::adjustMathMLAttributes): Ditto.
-        (WebCore::addNamesWithPrefix): Changed to take argument by reference instead of pointer.
-        (WebCore::createForeignAttributesMap): Added. Factors out the map creation from the
-        function below.
-        (WebCore::adjustForeignAttributes): Updated for above changes.
-        (WebCore::HTMLTreeBuilder::processStartTagForInBody): Updated to pass reference.
-        (WebCore::HTMLTreeBuilder::processTokenInForeignContent): Ditto.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorStyleSheet.cpp: Added now-needed include.
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard): Added a new boolean argument, forFileDrag,
+        to the constructor. Maybe we can find a better way to do this once we move
+        all the platforms over, but this boolean seems a good way to do it for now.
+        (WebCore::Clipboard::getData): Added. Calls through to Pasteboard after
+        doing the canReadData check, which is part of DOM rules, not the platform.
+        Also checks for the file drag case like the old ClipboardMac code did.
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLElement.h: Added hasTagName, which hides the one inherited from Element
-        and takes the more-specific MathMLQualifiedName type. This means we don't need to check
-        the namespace at runtime because it's known at compile time. Also put the
-        implementation of Node::hasTagName for MathMLQualifiedName into this header.
</del><ins>+        * dom/Clipboard.h: Made getData non-virtual in non-legacy case.
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLInlineContainerElement.cpp:
-        (WebCore::MathMLInlineContainerElement::createElementRenderer): Use hasTagName.
</del><ins>+        * platform/Pasteboard.h: Added a static member function named
+        absoluteURLsFromPasteboardFilenames, temporary so it can be shared between
+        ClipboardMac and PasteboardMac. Added a readString public function member,
+        and a m_changeCount data member. The type of m_changeCount is long since
+        that can always hold an NSInteger but yet is a type we can compile without
+        including the header file that defines NSInteger.
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLSelectElement.cpp:
-        (WebCore::MathMLSelectElement::attributeChanged): Use hasTagName.
-        (WebCore::MathMLSelectElement::getSelectedActionChildAndIndex): Ditto.
-        (WebCore::MathMLSelectElement::getSelectedActionChild): Ditto.
-        (WebCore::MathMLSelectElement::getSelectedSemanticsChild): Ditto.
-        (WebCore::MathMLSelectElement::updateSelectedChild): Ditto.
-        * mathml/MathMLTextElement.cpp:
-        (WebCore::MathMLTextElement::createElementRenderer): Ditto.
-        (WebCore::MathMLTextElement::childShouldCreateRenderer): Ditto.
</del><ins>+        * platform/mac/ClipboardMac.h: Removed getData.
+        * platform/mac/ClipboardMac.mm: Removed getData.
+        (WebCore::ClipboardMac::ClipboardMac): Added code to pass in the new
+        forFileDrag boolean.
+        (WebCore::ClipboardMac::files): Call absoluteURLsFromPasteboardFilenames
+        as a static member function in Pasteboard since we moved it there.
</ins><span class="cx"> 
</span><del>-        * platform/gtk/PasteboardGtk.cpp: Added now-needed include.
-        * platform/mac/HTMLConverter.mm: Ditto.
-        * rendering/RenderBlockFlow.cpp: Ditto.
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::Pasteboard): Initialize the change count, so later
+        pasteboard operations can check it.
+        (WebCore::Pasteboard::absoluteURLsFromPasteboardFilenames): Added. Moved
+        here from ClipboardMac.
+        (WebCore::absoluteURLsFromPasteboard): Ditto.
+        (WebCore::Pasteboard::readString): Added. Moved here from ClipboardMac.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Use hasTagName.
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::rendererForRootBackground): Ditto.
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Ditto.
</del><ins>+2013-05-12  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderReplaced.cpp: Added now-needed include.
</del><ins>+        Stop including UnusedParam.h
+        https://bugs.webkit.org/show_bug.cgi?id=116003
</ins><span class="cx"> 
</span><del>-        * rendering/mathml/RenderMathMLScripts.cpp:
-        (WebCore::RenderMathMLScripts::RenderMathMLScripts): Use hasTagName.
-        * rendering/mathml/RenderMathMLUnderOver.cpp:
-        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver): Ditto.
-
-        * svg/SVGElement.h: Added hasTagName, which hides the one inherited from Element
-        and takes the more-specific SVGQualifiedName type. This means we don't need to check
-        the namespace at runtime because it's known at compile time. Also put the
-        implementation of Node::hasTagName for SVGQualifiedName into this header.
-
-        * svg/SVGFontFaceSrcElement.cpp:
-        (WebCore::SVGFontFaceSrcElement::childrenChanged): Use isSVGFontFaceElement instead
-        of calling hasTagName.
-
-        * svg/SVGUseElement.cpp:
-        (WebCore::isDirectReference): Changed to take a reference and a more specific type.
-        (WebCore::SVGUseElement::toClipPath): Added a type cast.
-        (WebCore::SVGUseElement::rendererClipChild): Use more specific types so we don't
-        need a type cast.
-
-        * xml/parser/XMLDocumentParser.cpp:
-        (WebCore::XMLDocumentParser::parseDocumentFragment): Added explicit calls to this
-        unusual call site that has a good reason to use hasLocalName instead of hasTagName.
-
-2014-03-16  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Stop pulling in JSDOMBinding.h via JSEventListener.h
-        &lt;https://webkit.org/b/130299&gt;
-
-        Just chippin' away at the compile time monster.
-
-        Reviewed by Darin Adler.
-
-        * bindings/js/IDBBindingUtilities.cpp:
-        * bindings/js/JSEventListener.h:
-
-2014-03-16  David Kilzer  &lt;ddkilzer@apple.com&gt;
-
-        Double values passed to fabsf() in maxScaleFromTransform()
-        &lt;http://webkit.org/b/130297&gt;
-
-        Reviewed by Darin Adler.
-
-        Fixes the following build failures using trunk clang:
-
-            WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:287:21: error: absolute value function 'fabsf' given an argument of type 'double' but has parameter of type 'float' which may cause truncation of value [-Werror,-Wabsolute-value]
-                return std::max(fabsf(decomposeData.scaleX), fabsf(decomposeData.scaleY));
-                                ^
-            WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:287:21: note: use function 'fabs' instead
-                return std::max(fabsf(decomposeData.scaleX), fabsf(decomposeData.scaleY));
-                                ^~~~~
-                                fabs
-            WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:287:50: error: absolute value function 'fabsf' given an argument of type 'double' but has parameter of type 'float' which may cause truncation of value [-Werror,-Wabsolute-value]
-                return std::max(fabsf(decomposeData.scaleX), fabsf(decomposeData.scaleY));
-                                                             ^
-            WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:287:50: note: use function 'fabs' instead
-                return std::max(fabsf(decomposeData.scaleX), fabsf(decomposeData.scaleY));
-                                                             ^~~~~
-                                                             fabs
-
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::maxScaleFromTransform): Use static_cast&lt;float&gt;() to
-        convert float values to double values.
-
-2014-03-15  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Move BorderEdge class to its own file.
-        https://bugs.webkit.org/show_bug.cgi?id=130294
-
</del><span class="cx">         Reviewed by Sam Weinig.
</span><span class="cx"> 
</span><del>-        This is in preparation to have better encapsulation for border box decoration painting.
</del><ins>+        UnusedParam.h is empty now so there's no need to include it anymore.
</ins><span class="cx"> 
</span><del>-        No change in functionality.
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/BorderEdge.cpp: Added.
-        (WebCore::BorderEdge::BorderEdge):
-        (WebCore::BorderEdge::getBorderEdgeInfo):
-        (WebCore::BorderEdge::includesAdjacentEdges):
-        (WebCore::BorderEdge::obscuresBackgroundEdge):
-        (WebCore::BorderEdge::obscuresBackground):
-        (WebCore::BorderEdge::getDoubleBorderStripeWidths):
-        * rendering/BorderEdge.h: Added.
-        (WebCore::BorderEdge::edgeFlagForSide):
-        (WebCore::BorderEdge::includesEdge):
-        (WebCore::BorderEdge::edgesShareColor):
-        (WebCore::BorderEdge::hasVisibleColorAndStyle):
-        (WebCore::BorderEdge::shouldRender):
-        (WebCore::BorderEdge::presentButInvisible):
-        (WebCore::BorderEdge::widthForPainting):
-        (WebCore::BorderEdge::borderWidthInDevicePixel):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::borderStyleHasUnmatchedColorsAtCorner):
-        (WebCore::colorsMatchAtCorner):
-        (WebCore::colorNeedsAntiAliasAtCorner):
-        (WebCore::willBeOverdrawn):
-        (WebCore::joinRequiresMitre):
-        (WebCore::RenderBoxModelObject::paintBorderSides):
-        (WebCore::RenderBoxModelObject::paintTranslucentBorderSides):
-        (WebCore::RenderBoxModelObject::paintBorder):
-        (WebCore::RenderBoxModelObject::borderObscuresBackgroundEdge):
-        (WebCore::RenderBoxModelObject::borderObscuresBackground):
-        * rendering/RenderBoxModelObject.h:
-
-2014-03-15  Martin Robinson  &lt;mrobinson@igalia.com&gt;
-
-        Fix WebCore unused parameter warnings for WebKitGTK+ CMake build
-        https://bugs.webkit.org/show_bug.cgi?id=130252
-
-        Reviewed by Carlos Garcia Campos.
-
-        * Modules/mediastream/HTMLMediaElementMediaStream.cpp: Fix unused parameters.
-        * html/RangeInputType.cpp: Ditto.
-        * page/gtk/EventHandlerGtk.cpp: Ditto.
-        * platform/graphics/cairo/GraphicsContextCairo.cpp: Ditto.
-        * platform/graphics/gstreamer/WebKitMediaSourceGStreamer.cpp: Ditto.
-        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp: Ditto.
-        * platform/graphics/opengl/Extensions3DOpenGLES.cpp: Ditto.
-        * platform/gtk/GamepadsGtk.cpp: Ditto.
-        * platform/gtk/GtkClickCounter.cpp: Ditto.
-        * platform/gtk/GtkPopupMenu.cpp: Ditto.
-        * platform/gtk/GtkTouchContextHelper.cpp: Ditto.
-        * platform/gtk/GtkVersioning.c: Ditto.
-        * platform/gtk/MainFrameScrollbarGtk.cpp: Ditto.
-        * platform/gtk/PasteboardGtk.cpp: Ditto.
-        * platform/gtk/PasteboardHelper.cpp: Ditto.
-        * platform/gtk/RedirectedXCompositeWindow.cpp: Ditto.
-        * platform/gtk/RenderThemeGtk.cpp: Ditto.
-        * platform/gtk/RenderThemeGtk.h: Ditto.
-        * platform/gtk/RenderThemeGtk2.cpp: Ditto.
-        * platform/gtk/ScrollbarThemeGtk.cpp: Ditto.
-        * platform/gtk/ScrollbarThemeGtk2.cpp: Ditto.
-        * platform/gtk/WidgetGtk.cpp: Ditto.
-        * platform/network/gtk/CredentialBackingStore.cpp: Ditto.
-        * platform/soup/SharedBufferSoup.cpp: Ditto.
-        * plugins/gtk/PluginViewGtk.cpp: Ditto.
-        * plugins/gtk/gtk2xtbin.c: Ditto.
-        * rendering/InlineTextBox.cpp: Ditto.
-
-2014-03-14  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-
-        RenderTextControl::hasValidAvgCharWidth doesn't detect System Font
-        https://bugs.webkit.org/show_bug.cgi?id=130168
-
-        Reviewed by Dean Jackson.
-
-        No new tests.
-
-        * platform/graphics/Font.cpp: Moved functions from RenderTextControl
-        (WebCore::Font::hasValidAverageCharWidth):
-        (WebCore::Font::fastAverageCharWidthIfAvailable):
-        * platform/graphics/Font.h:
-        * rendering/RenderTextControl.cpp: Moved functions to Font.cpp
-        (WebCore::RenderTextControl::getAverageCharWidth): Removed redundant function argument
-        (WebCore::RenderTextControl::computeIntrinsicLogicalWidths):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::getAverageCharWidth): Removed redundant function argument
-        * rendering/RenderTextControlMultiLine.h:
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::getAverageCharWidth): Removed redundant function argument
-        (WebCore::RenderTextControlSingleLine::preferredContentLogicalWidth):
-        * rendering/RenderTextControlSingleLine.h:
-
-2014-03-15  David Kilzer  &lt;ddkilzer@apple.com&gt;
-
-        [iOS] Define SYSTEM_VERSION_PREFIX consistently
-        &lt;http://webkit.org/b/130293&gt;
-        &lt;rdar://problem/15926359&gt;
-
-        Reviewed by Dan Bernstein.
-
-        * Configurations/Version.xcconfig:
-        (SYSTEM_VERSION_PREFIX_iphoneos): Sync with
-        Source/WebKit/mac/Version.xcconfig.
-
-2014-03-14  Mark Rowe  &lt;mrowe@apple.com&gt;
-
-        Fix the production build.
-
-        Don't rely on USE_INTERNAL_SDK being set for the Production configuration since UseInternalSDK.xcconfig won't
-        be at the expected relative path when working from installed source.
-
-        * Configurations/Base.xcconfig:
-
-2014-03-14  Maciej Stachowiak  &lt;mjs@apple.com&gt;
-
-        Replace &quot;Apple Computer, Inc.&quot; with &quot;Apple Inc.&quot; in copyright headers
-        https://bugs.webkit.org/show_bug.cgi?id=130276
-        &lt;rdar://problem/16266927&gt;
-
-        Reviewed by Simon Fraser.
-
-        No new tests because no behavior changes.
-
-        * DerivedSources.make:
-        * Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.cpp:
-        * Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.h:
-        * Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.idl:
-        * Modules/encryptedmedia/MediaKeyMessageEvent.cpp:
-        * Modules/encryptedmedia/MediaKeyMessageEvent.h:
-        * Modules/encryptedmedia/MediaKeyMessageEvent.idl:
-        * Modules/encryptedmedia/MediaKeyNeededEvent.cpp:
-        * Modules/encryptedmedia/MediaKeyNeededEvent.h:
-        * Modules/encryptedmedia/MediaKeyNeededEvent.idl:
-        * Modules/encryptedmedia/MediaKeySession.idl:
-        * Modules/encryptedmedia/MediaKeys.idl:
-        * Modules/geolocation/NavigatorGeolocation.cpp:
-        * Modules/indexeddb/DOMWindowIndexedDatabase.idl:
-        * Modules/indexeddb/IDBCallbacks.h:
-        * Modules/indexeddb/IDBDatabaseException.cpp:
-        * Modules/indexeddb/IDBDatabaseMetadata.h:
-        * Modules/indexeddb/IDBEventDispatcher.cpp:
-        * Modules/indexeddb/IDBEventDispatcher.h:
-        * Modules/indexeddb/IDBFactory.cpp:
-        * Modules/indexeddb/IDBFactory.h:
-        * Modules/indexeddb/IDBFactoryBackendInterface.cpp:
-        * Modules/indexeddb/IDBFactoryBackendInterface.h:
-        * Modules/indexeddb/IDBHistograms.h:
-        * Modules/indexeddb/IDBIndexMetadata.h:
-        * Modules/indexeddb/IDBObjectStoreMetadata.h:
-        * Modules/indexeddb/IDBRecordIdentifier.h:
-        * Modules/indexeddb/IDBRequest.cpp:
-        * Modules/indexeddb/IDBRequest.h:
-        * Modules/indexeddb/IDBRequest.idl:
-        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:
-        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:
-        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.idl:
-        * Modules/indexeddb/leveldb/IDBFactoryBackendLevelDB.cpp:
-        * Modules/indexeddb/leveldb/IDBFactoryBackendLevelDB.h:
-        * Modules/mediacontrols/MediaControlsHost.cpp:
-        * Modules/mediacontrols/MediaControlsHost.h:
-        * Modules/mediacontrols/MediaControlsHost.idl:
-        * Modules/mediacontrols/mediaControlsApple.css:
-        * Modules/mediacontrols/mediaControlsiOS.css:
-        * Modules/mediasource/AudioTrackMediaSource.h:
-        * Modules/mediasource/AudioTrackMediaSource.idl:
-        * Modules/mediasource/TextTrackMediaSource.h:
-        * Modules/mediasource/TextTrackMediaSource.idl:
-        * Modules/mediasource/VideoTrackMediaSource.h:
-        * Modules/mediasource/VideoTrackMediaSource.idl:
-        * Modules/mediastream/AllAudioCapabilities.h:
-        * Modules/mediastream/AllAudioCapabilities.idl:
-        * Modules/mediastream/AllVideoCapabilities.h:
-        * Modules/mediastream/AllVideoCapabilities.idl:
-        * Modules/mediastream/AudioStreamTrack.cpp:
-        * Modules/mediastream/AudioStreamTrack.h:
-        * Modules/mediastream/AudioStreamTrack.idl:
-        * Modules/mediastream/CapabilityRange.cpp:
-        * Modules/mediastream/CapabilityRange.h:
-        * Modules/mediastream/CapabilityRange.idl:
-        * Modules/mediastream/MediaSourceStates.cpp:
-        * Modules/mediastream/MediaSourceStates.h:
-        * Modules/mediastream/MediaSourceStates.idl:
-        * Modules/mediastream/MediaStreamCapabilities.cpp:
-        * Modules/mediastream/MediaStreamCapabilities.h:
-        * Modules/mediastream/MediaStreamCapabilities.idl:
-        * Modules/mediastream/MediaTrackConstraint.cpp:
-        * Modules/mediastream/MediaTrackConstraint.h:
-        * Modules/mediastream/MediaTrackConstraint.idl:
-        * Modules/mediastream/MediaTrackConstraintSet.cpp:
-        * Modules/mediastream/MediaTrackConstraintSet.h:
-        * Modules/mediastream/MediaTrackConstraints.cpp:
-        * Modules/mediastream/MediaTrackConstraints.h:
-        * Modules/mediastream/MediaTrackConstraints.idl:
-        * Modules/mediastream/NavigatorMediaStream.cpp:
-        * Modules/mediastream/NavigatorUserMediaError.cpp:
-        * Modules/mediastream/RTCConfiguration.idl:
-        * Modules/mediastream/RTCIceServer.idl:
-        * Modules/mediastream/RTCOfferAnswerOptions.cpp:
-        * Modules/mediastream/RTCOfferAnswerOptions.h:
-        * Modules/mediastream/VideoStreamTrack.cpp:
-        * Modules/mediastream/VideoStreamTrack.h:
-        * Modules/mediastream/VideoStreamTrack.idl:
-        * Modules/networkinfo/NetworkInfo.cpp:
-        * Modules/networkinfo/NetworkInfo.h:
-        * Modules/networkinfo/NetworkInfoConnection.cpp:
-        * Modules/networkinfo/NetworkInfoConnection.h:
-        * Modules/networkinfo/NetworkInfoController.cpp:
-        * Modules/notifications/DOMWindowNotifications.cpp:
-        * Modules/notifications/DOMWindowNotifications.h:
-        * Modules/notifications/DOMWindowNotifications.idl:
-        * Modules/notifications/NotificationController.cpp:
-        * Modules/notifications/NotificationController.h:
-        * Modules/notifications/NotificationPermissionCallback.h:
-        * Modules/notifications/NotificationPermissionCallback.idl:
-        * Modules/notifications/WorkerGlobalScopeNotifications.cpp:
-        * Modules/notifications/WorkerGlobalScopeNotifications.h:
-        * Modules/notifications/WorkerGlobalScopeNotifications.idl:
-        * Modules/plugins/PluginReplacement.h:
-        * Modules/plugins/QuickTimePluginReplacement.cpp:
-        * Modules/plugins/QuickTimePluginReplacement.css:
-        * Modules/plugins/QuickTimePluginReplacement.h:
-        * Modules/plugins/QuickTimePluginReplacement.idl:
-        * Modules/quota/DOMWindowQuota.idl:
-        * Modules/speech/DOMWindowSpeechSynthesis.h:
-        * Modules/speech/DOMWindowSpeechSynthesis.idl:
-        * Modules/speech/SpeechSynthesis.cpp:
-        * Modules/speech/SpeechSynthesis.h:
-        * Modules/speech/SpeechSynthesis.idl:
-        * Modules/speech/SpeechSynthesisEvent.cpp:
-        * Modules/speech/SpeechSynthesisEvent.h:
-        * Modules/speech/SpeechSynthesisEvent.idl:
-        * Modules/speech/SpeechSynthesisUtterance.cpp:
-        * Modules/speech/SpeechSynthesisUtterance.h:
-        * Modules/speech/SpeechSynthesisUtterance.idl:
-        * Modules/speech/SpeechSynthesisVoice.cpp:
-        * Modules/speech/SpeechSynthesisVoice.h:
-        * Modules/speech/SpeechSynthesisVoice.idl:
-        * Modules/webaudio/AudioBuffer.cpp:
-        * Modules/webaudio/AudioBuffer.h:
-        * Modules/webaudio/AudioBuffer.idl:
-        * Modules/webaudio/AudioListener.cpp:
-        * Modules/webaudio/AudioListener.h:
-        * Modules/webaudio/AudioListener.idl:
-        * Modules/webaudio/AudioParam.h:
-        * Modules/webaudio/AudioParam.idl:
-        * Modules/webaudio/AudioParamTimeline.h:
-        * Modules/webaudio/AudioScheduledSourceNode.h:
-        * Modules/webaudio/ChannelMergerNode.cpp:
-        * Modules/webaudio/ChannelMergerNode.h:
-        * Modules/webaudio/ChannelMergerNode.idl:
-        * Modules/webaudio/MediaStreamAudioSource.cpp:
-        * Modules/webaudio/MediaStreamAudioSource.h:
-        * Modules/webaudio/PeriodicWave.cpp:
-        * Modules/webaudio/PeriodicWave.h:
-        * Modules/webdatabase/ChangeVersionWrapper.cpp:
-        * Modules/webdatabase/ChangeVersionWrapper.h:
-        * Modules/webdatabase/DOMWindowWebDatabase.cpp:
-        * Modules/webdatabase/DOMWindowWebDatabase.h:
-        * Modules/webdatabase/DOMWindowWebDatabase.idl:
-        * Modules/webdatabase/Database.cpp:
-        * Modules/webdatabase/Database.h:
-        * Modules/webdatabase/Database.idl:
-        * Modules/webdatabase/DatabaseAuthorizer.cpp:
-        * Modules/webdatabase/DatabaseAuthorizer.h:
-        * Modules/webdatabase/DatabaseBackendBase.cpp:
-        * Modules/webdatabase/DatabaseBackendBase.h:
-        * Modules/webdatabase/DatabaseCallback.idl:
-        * Modules/webdatabase/DatabaseContext.cpp:
-        * Modules/webdatabase/DatabaseContext.h:
-        * Modules/webdatabase/DatabaseDetails.h:
-        * Modules/webdatabase/DatabaseTask.cpp:
-        * Modules/webdatabase/DatabaseTask.h:
</del><ins>+        * Modules/encryptedmedia/CDMPrivateAVFoundation.mm:
+        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        * Modules/webdatabase/DatabaseServer.cpp:
</ins><span class="cx">         * Modules/webdatabase/DatabaseThread.cpp:
</span><del>-        * Modules/webdatabase/DatabaseThread.h:
-        * Modules/webdatabase/DatabaseTracker.cpp:
-        * Modules/webdatabase/DatabaseTracker.h:
-        * Modules/webdatabase/SQLCallbackWrapper.h:
-        * Modules/webdatabase/SQLError.h:
-        * Modules/webdatabase/SQLError.idl:
-        * Modules/webdatabase/SQLException.cpp:
-        * Modules/webdatabase/SQLResultSet.cpp:
-        * Modules/webdatabase/SQLResultSet.h:
-        * Modules/webdatabase/SQLResultSet.idl:
-        * Modules/webdatabase/SQLResultSetRowList.cpp:
-        * Modules/webdatabase/SQLResultSetRowList.h:
-        * Modules/webdatabase/SQLResultSetRowList.idl:
-        * Modules/webdatabase/SQLStatement.cpp:
-        * Modules/webdatabase/SQLStatement.h:
-        * Modules/webdatabase/SQLStatementBackend.cpp:
-        * Modules/webdatabase/SQLStatementBackend.h:
-        * Modules/webdatabase/SQLStatementCallback.h:
-        * Modules/webdatabase/SQLStatementCallback.idl:
-        * Modules/webdatabase/SQLStatementErrorCallback.h:
-        * Modules/webdatabase/SQLStatementErrorCallback.idl:
-        * Modules/webdatabase/SQLStatementSync.cpp:
-        * Modules/webdatabase/SQLTransaction.cpp:
-        * Modules/webdatabase/SQLTransaction.h:
-        * Modules/webdatabase/SQLTransaction.idl:
-        * Modules/webdatabase/SQLTransactionBackend.cpp:
-        * Modules/webdatabase/SQLTransactionBackend.h:
-        * Modules/webdatabase/SQLTransactionCallback.h:
-        * Modules/webdatabase/SQLTransactionCallback.idl:
-        * Modules/webdatabase/SQLTransactionErrorCallback.h:
-        * Modules/webdatabase/SQLTransactionErrorCallback.idl:
-        * Modules/webdatabase/WorkerGlobalScopeWebDatabase.cpp:
-        * Modules/webdatabase/WorkerGlobalScopeWebDatabase.h:
-        * Modules/webdatabase/WorkerGlobalScopeWebDatabase.idl:
-        * Resources/deleteButton.tiff:
-        * Resources/deleteButtonPressed.tiff:
-        * WebCore.vcxproj/MigrateScripts:
-        * WebCorePrefix.cpp:
-        * accessibility/AXObjectCache.cpp:
-        * accessibility/AXObjectCache.h:
-        * accessibility/AccessibilityARIAGrid.cpp:
-        * accessibility/AccessibilityARIAGrid.h:
-        * accessibility/AccessibilityARIAGridCell.cpp:
-        * accessibility/AccessibilityARIAGridCell.h:
-        * accessibility/AccessibilityARIAGridRow.cpp:
-        * accessibility/AccessibilityARIAGridRow.h:
-        * accessibility/AccessibilityImageMapLink.cpp:
-        * accessibility/AccessibilityImageMapLink.h:
-        * accessibility/AccessibilityList.cpp:
-        * accessibility/AccessibilityList.h:
-        * accessibility/AccessibilityListBox.cpp:
-        * accessibility/AccessibilityListBox.h:
-        * accessibility/AccessibilityListBoxOption.cpp:
-        * accessibility/AccessibilityListBoxOption.h:
-        * accessibility/AccessibilityMediaControls.cpp:
-        * accessibility/AccessibilityMediaControls.h:
-        * accessibility/AccessibilityNodeObject.cpp:
-        * accessibility/AccessibilityNodeObject.h:
-        * accessibility/AccessibilityObject.cpp:
-        * accessibility/AccessibilityObject.h:
-        * accessibility/AccessibilityRenderObject.cpp:
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/AccessibilitySVGRoot.cpp:
-        * accessibility/AccessibilitySVGRoot.h:
-        * accessibility/AccessibilityScrollbar.cpp:
-        * accessibility/AccessibilityScrollbar.h:
-        * accessibility/AccessibilitySlider.cpp:
-        * accessibility/AccessibilitySlider.h:
-        * accessibility/AccessibilityTable.cpp:
-        * accessibility/AccessibilityTable.h:
-        * accessibility/AccessibilityTableCell.cpp:
-        * accessibility/AccessibilityTableCell.h:
-        * accessibility/AccessibilityTableColumn.cpp:
-        * accessibility/AccessibilityTableColumn.h:
-        * accessibility/AccessibilityTableHeaderContainer.cpp:
-        * accessibility/AccessibilityTableHeaderContainer.h:
-        * accessibility/AccessibilityTableRow.cpp:
-        * accessibility/AccessibilityTableRow.h:
-        * accessibility/ios/AXObjectCacheIOS.mm:
-        * accessibility/ios/AccessibilityObjectIOS.mm:
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.h:
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        * accessibility/mac/AXObjectCacheMac.mm:
-        * accessibility/mac/AccessibilityObjectMac.mm:
-        * accessibility/mac/WebAccessibilityObjectWrapperBase.h:
-        * accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.h:
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-        * bindings/gobject/WebKitDOMEventTarget.cpp:
-        * bindings/gobject/WebKitDOMHTMLPrivate.cpp:
-        * bindings/gobject/WebKitDOMHTMLPrivate.h:
-        * bindings/js/Dictionary.cpp:
-        * bindings/js/GCController.cpp:
-        * bindings/js/GCController.h:
-        * bindings/js/JSAttrCustom.cpp:
-        * bindings/js/JSAudioTrackCustom.cpp:
-        * bindings/js/JSAudioTrackListCustom.cpp:
-        * bindings/js/JSCSSRuleCustom.cpp:
-        * bindings/js/JSCSSRuleCustom.h:
-        * bindings/js/JSCSSRuleListCustom.cpp:
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        * bindings/js/JSCSSValueCustom.cpp:
-        * bindings/js/JSCallbackData.cpp:
-        * bindings/js/JSCallbackData.h:
-        * bindings/js/JSCanvasRenderingContextCustom.cpp:
-        * bindings/js/JSClipboardCustom.cpp:
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        * bindings/js/JSCustomXPathNSResolver.h:
-        * bindings/js/JSDOMGlobalObject.cpp:
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowShell.cpp:
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSElementCustom.cpp:
-        * bindings/js/JSEventCustom.cpp:
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        * bindings/js/JSHTMLCanvasElementCustom.cpp:
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/js/JSHTMLElementCustom.cpp:
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        * bindings/js/JSHTMLSelectElementCustom.h:
-        * bindings/js/JSHistoryCustom.cpp:
-        * bindings/js/JSMediaListCustom.h:
-        * bindings/js/JSMediaSourceStatesCustom.cpp:
-        * bindings/js/JSMediaStreamCapabilitiesCustom.cpp:
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        * bindings/js/JSNodeCustom.cpp:
-        * bindings/js/JSNodeCustom.h:
-        * bindings/js/JSNodeFilterCustom.cpp:
-        * bindings/js/JSNodeListCustom.cpp:
-        * bindings/js/JSSQLResultSetRowListCustom.cpp:
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        * bindings/js/JSSQLTransactionSyncCustom.cpp:
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        * bindings/js/JSStyleSheetCustom.cpp:
-        * bindings/js/JSStyleSheetCustom.h:
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        * bindings/js/JSTextTrackCueCustom.cpp:
-        * bindings/js/JSTextTrackCustom.cpp:
-        * bindings/js/JSTextTrackListCustom.cpp:
-        * bindings/js/JSTouchCustom.cpp:
-        * bindings/js/JSTouchListCustom.cpp:
-        * bindings/js/JSTrackCustom.cpp:
-        * bindings/js/JSTrackCustom.h:
-        * bindings/js/JSTrackEventCustom.cpp:
-        * bindings/js/JSVideoTrackCustom.cpp:
-        * bindings/js/JSVideoTrackListCustom.cpp:
-        * bindings/js/JSWebGLRenderingContextCustom.cpp:
-        * bindings/js/JSWebKitPointCustom.cpp:
-        * bindings/js/JSWorkerGlobalScopeBase.cpp:
-        * bindings/js/JSWorkerGlobalScopeBase.h:
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        * bindings/js/ScriptControllerMac.mm:
-        * bindings/js/ScriptProfile.cpp:
-        * bindings/js/ScriptProfile.h:
-        * bindings/js/ScriptProfileNode.h:
-        * bindings/js/ScriptProfiler.cpp:
-        * bindings/js/ScriptProfiler.h:
-        * bindings/js/SerializedScriptValue.cpp:
-        * bindings/js/SerializedScriptValue.h:
-        * bindings/js/WorkerScriptController.cpp:
-        * bindings/js/WorkerScriptController.h:
-        * bindings/objc/DOM.h:
-        * bindings/objc/DOM.mm:
-        * bindings/objc/DOMAbstractView.mm:
-        * bindings/objc/DOMAbstractViewFrame.h:
-        * bindings/objc/DOMCSS.h:
-        * bindings/objc/DOMCSS.mm:
-        * bindings/objc/DOMCore.h:
-        * bindings/objc/DOMCustomXPathNSResolver.h:
-        * bindings/objc/DOMCustomXPathNSResolver.mm:
-        * bindings/objc/DOMEventException.h:
-        * bindings/objc/DOMEvents.h:
-        * bindings/objc/DOMEvents.mm:
-        * bindings/objc/DOMException.h:
-        * bindings/objc/DOMExtensions.h:
-        * bindings/objc/DOMHTML.h:
-        * bindings/objc/DOMHTML.mm:
-        * bindings/objc/DOMInternal.h:
-        * bindings/objc/DOMInternal.mm:
-        * bindings/objc/DOMObject.h:
</del><ins>+        * bindings/js/JSDOMWindowBase.cpp:
</ins><span class="cx">         * bindings/objc/DOMObject.mm:
</span><del>-        * bindings/objc/DOMPrivate.h:
-        * bindings/objc/DOMRangeException.h:
-        * bindings/objc/DOMRanges.h:
-        * bindings/objc/DOMStylesheets.h:
-        * bindings/objc/DOMTraversal.h:
-        * bindings/objc/DOMUIKitExtensions.h:
-        * bindings/objc/DOMUIKitExtensions.mm:
-        * bindings/objc/DOMUtility.mm:
-        * bindings/objc/DOMViews.h:
-        * bindings/objc/DOMXPath.h:
-        * bindings/objc/DOMXPath.mm:
-        * bindings/objc/DOMXPathException.h:
-        * bindings/objc/ExceptionHandlers.h:
-        * bindings/objc/ExceptionHandlers.mm:
-        * bindings/objc/ObjCEventListener.h:
-        * bindings/objc/ObjCEventListener.mm:
-        * bindings/objc/ObjCNodeFilterCondition.h:
-        * bindings/objc/ObjCNodeFilterCondition.mm:
-        * bindings/objc/PublicDOMInterfaces.h:
-        * bindings/objc/WebScriptObject.mm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * bindings/scripts/InFilesCompiler.pm:
-        (license):
-        * bindings/scripts/InFilesParser.pm:
-        * bindings/scripts/generate-bindings.pl:
-        * bindings/scripts/test/ObjC/DOMFloat64Array.h:
-        * bindings/scripts/test/ObjC/DOMFloat64Array.mm:
-        * bindings/scripts/test/ObjC/DOMFloat64ArrayInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestActiveDOMObject.h:
-        * bindings/scripts/test/ObjC/DOMTestActiveDOMObject.mm:
-        * bindings/scripts/test/ObjC/DOMTestActiveDOMObjectInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestCallback.h:
-        * bindings/scripts/test/ObjC/DOMTestCallback.mm:
-        * bindings/scripts/test/ObjC/DOMTestCallbackInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestCustomNamedGetter.h:
-        * bindings/scripts/test/ObjC/DOMTestCustomNamedGetter.mm:
-        * bindings/scripts/test/ObjC/DOMTestCustomNamedGetterInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestEventConstructor.h:
-        * bindings/scripts/test/ObjC/DOMTestEventConstructor.mm:
-        * bindings/scripts/test/ObjC/DOMTestEventConstructorInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestEventTarget.h:
-        * bindings/scripts/test/ObjC/DOMTestEventTarget.mm:
-        * bindings/scripts/test/ObjC/DOMTestEventTargetInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestException.h:
-        * bindings/scripts/test/ObjC/DOMTestException.mm:
-        * bindings/scripts/test/ObjC/DOMTestExceptionInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestGenerateIsReachable.h:
-        * bindings/scripts/test/ObjC/DOMTestGenerateIsReachable.mm:
-        * bindings/scripts/test/ObjC/DOMTestGenerateIsReachableInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestInterface.h:
-        * bindings/scripts/test/ObjC/DOMTestInterface.mm:
-        * bindings/scripts/test/ObjC/DOMTestInterfaceInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestMediaQueryListListener.h:
-        * bindings/scripts/test/ObjC/DOMTestMediaQueryListListener.mm:
-        * bindings/scripts/test/ObjC/DOMTestMediaQueryListListenerInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestNamedConstructor.h:
-        * bindings/scripts/test/ObjC/DOMTestNamedConstructor.mm:
-        * bindings/scripts/test/ObjC/DOMTestNamedConstructorInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestNode.h:
-        * bindings/scripts/test/ObjC/DOMTestNode.mm:
-        * bindings/scripts/test/ObjC/DOMTestNodeInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestObj.h:
-        * bindings/scripts/test/ObjC/DOMTestObj.mm:
-        * bindings/scripts/test/ObjC/DOMTestObjInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestOverloadedConstructors.h:
-        * bindings/scripts/test/ObjC/DOMTestOverloadedConstructors.mm:
-        * bindings/scripts/test/ObjC/DOMTestOverloadedConstructorsInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.h:
-        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.mm:
-        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterfaceInternal.h:
-        * bindings/scripts/test/ObjC/DOMTestTypedefs.h:
-        * bindings/scripts/test/ObjC/DOMTestTypedefs.mm:
-        * bindings/scripts/test/ObjC/DOMTestTypedefsInternal.h:
-        * bindings/scripts/test/ObjC/DOMattribute.h:
-        * bindings/scripts/test/ObjC/DOMattribute.mm:
-        * bindings/scripts/test/ObjC/DOMattributeInternal.h:
-        * bindings/scripts/test/ObjC/DOMreadonly.h:
-        * bindings/scripts/test/ObjC/DOMreadonly.mm:
-        * bindings/scripts/test/ObjC/DOMreadonlyInternal.h:
-        * bindings/scripts/test/TestCallback.idl:
-        * bindings/scripts/test/TestCustomNamedGetter.idl:
-        * bindings/scripts/test/TestDomainSecurity.idl:
-        * bindings/scripts/test/TestEventConstructor.idl:
-        * bindings/scripts/test/TestEventTarget.idl:
-        * bindings/scripts/test/TestException.idl:
-        * bindings/scripts/test/TestImplements.idl:
-        * bindings/scripts/test/TestInterface.idl:
-        * bindings/scripts/test/TestMediaQueryListListener.idl:
-        * bindings/scripts/test/TestNamedConstructor.idl:
-        * bindings/scripts/test/TestObj.idl:
-        * bindings/scripts/test/TestOverloadedConstructors.idl:
-        * bindings/scripts/test/TestSupplemental.idl:
-        * bridge/Bridge.h:
-        * bridge/IdentifierRep.cpp:
-        * bridge/IdentifierRep.h:
-        * bridge/NP_jsobject.cpp:
-        * bridge/NP_jsobject.h:
-        * bridge/c/CRuntimeObject.cpp:
-        * bridge/c/CRuntimeObject.h:
-        * bridge/c/c_class.cpp:
-        * bridge/c/c_class.h:
-        * bridge/c/c_instance.cpp:
-        * bridge/c/c_instance.h:
-        * bridge/c/c_runtime.cpp:
-        * bridge/c/c_runtime.h:
-        * bridge/c/c_utility.cpp:
-        * bridge/c/c_utility.h:
-        * bridge/jsc/BridgeJSC.cpp:
-        * bridge/jsc/BridgeJSC.h:
-        * bridge/npruntime.cpp:
-        * bridge/npruntime_impl.h:
-        * bridge/npruntime_priv.h:
-        * bridge/objc/ObjCRuntimeObject.h:
-        * bridge/objc/ObjCRuntimeObject.mm:
-        * bridge/objc/WebScriptObject.h:
-        * bridge/objc/objc_class.h:
-        * bridge/objc/objc_class.mm:
-        * bridge/objc/objc_header.h:
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        * bridge/objc/objc_utility.h:
-        * bridge/objc/objc_utility.mm:
-        * bridge/runtime_array.cpp:
-        * bridge/runtime_array.h:
-        * bridge/runtime_method.cpp:
-        * bridge/runtime_method.h:
-        * bridge/runtime_object.cpp:
-        * bridge/runtime_object.h:
-        * bridge/runtime_root.cpp:
-        * bridge/runtime_root.h:
-        * bridge/testbindings.mm:
-        * css/CSSAllInOne.cpp:
-        * css/CSSAspectRatioValue.cpp:
-        * css/CSSAspectRatioValue.h:
-        * css/CSSBorderImageSliceValue.cpp:
-        * css/CSSBorderImageSliceValue.h:
-        * css/CSSCanvasValue.cpp:
-        * css/CSSCanvasValue.h:
-        * css/CSSCrossfadeValue.cpp:
-        * css/CSSCrossfadeValue.h:
-        * css/CSSFontFace.cpp:
-        * css/CSSFontFace.h:
-        * css/CSSFontFaceSource.cpp:
-        * css/CSSFontFaceSource.h:
-        * css/CSSFontFaceSrcValue.cpp:
-        * css/CSSFontFaceSrcValue.h:
-        * css/CSSFontFeatureValue.cpp:
-        * css/CSSFontFeatureValue.h:
-        * css/CSSFontSelector.cpp:
-        * css/CSSFontSelector.h:
-        * css/CSSFontValue.cpp:
-        * css/CSSGradientValue.cpp:
-        * css/CSSGradientValue.h:
-        * css/CSSImageGeneratorValue.cpp:
-        * css/CSSImageGeneratorValue.h:
-        * css/CSSMediaRule.cpp:
-        * css/CSSProperty.cpp:
-        * css/CSSProperty.h:
-        * css/CSSReflectValue.cpp:
-        * css/CSSReflectValue.h:
-        * css/CSSReflectionDirection.h:
-        * css/CSSRuleList.cpp:
-        * css/CSSRuleList.h:
-        * css/CSSRuleList.idl:
-        * css/CSSSegmentedFontFace.cpp:
-        * css/CSSSegmentedFontFace.h:
-        * css/CSSShadowValue.cpp:
-        * css/CSSTimingFunctionValue.cpp:
-        * css/CSSTimingFunctionValue.h:
-        * css/CSSUnicodeRangeValue.cpp:
-        * css/CSSUnicodeRangeValue.h:
-        * css/CSSUnknownRule.idl:
-        * css/CSSValue.cpp:
-        * css/CSSValueList.idl:
-        * css/MediaAllInOne.cpp:
-        * css/MediaFeatureNames.cpp:
-        * css/MediaList.idl:
-        * css/MediaQuery.cpp:
-        * css/MediaQuery.h:
-        * css/MediaQueryEvaluator.cpp:
-        * css/MediaQueryEvaluator.h:
-        * css/MediaQueryExp.cpp:
-        * css/MediaQueryExp.h:
-        * css/Pair.h:
-        * css/PropertySetCSSStyleDeclaration.h:
-        * css/RGBColor.cpp:
-        * css/RGBColor.h:
-        * css/SVGCSSParser.cpp:
-        * css/SVGCSSStyleSelector.cpp:
-        * css/StyleInvalidationAnalysis.cpp:
-        * css/StyleInvalidationAnalysis.h:
-        * css/StyleMedia.cpp:
-        * css/StyleMedia.h:
-        * css/StyleMedia.idl:
-        * css/StyleSheet.cpp:
-        * css/WebKitCSSFilterValue.cpp:
-        * css/WebKitCSSFilterValue.h:
-        * css/WebKitCSSFilterValue.idl:
-        * css/WebKitCSSKeyframeRule.cpp:
-        * css/WebKitCSSKeyframeRule.h:
-        * css/WebKitCSSKeyframeRule.idl:
-        * css/WebKitCSSKeyframesRule.cpp:
-        * css/WebKitCSSKeyframesRule.h:
-        * css/WebKitCSSKeyframesRule.idl:
-        * css/WebKitCSSTransformValue.cpp:
-        * css/WebKitCSSTransformValue.h:
-        * css/WebKitCSSTransformValue.idl:
-        * css/make-css-file-arrays.pl:
-        * css/mediaControls.css:
-        * css/mediaControlsEfl.css:
-        * css/mediaControlsEflFullscreen.css:
-        * css/mediaControlsGtk.css:
-        * css/mediaControlsiOS.css:
-        * css/svg.css:
-        * dom/ActiveDOMObject.cpp:
-        * dom/ActiveDOMObject.h:
-        * dom/BeforeLoadEvent.h:
-        * dom/BeforeLoadEvent.idl:
-        * dom/BeforeTextInsertedEvent.cpp:
-        * dom/BeforeTextInsertedEvent.h:
-        * dom/BeforeUnloadEvent.cpp:
-        * dom/BeforeUnloadEvent.h:
-        * dom/BeforeUnloadEvent.idl:
-        * dom/ClassNodeList.cpp:
-        * dom/ClassNodeList.h:
-        * dom/ClientRect.cpp:
-        * dom/ClientRect.h:
-        * dom/ClientRect.idl:
-        * dom/ClientRectList.cpp:
-        * dom/ClientRectList.h:
-        * dom/ClientRectList.idl:
-        * dom/Clipboard.cpp:
-        * dom/Clipboard.idl:
-        * dom/ClipboardAccessPolicy.h:
-        * dom/ClipboardMac.mm:
-        * dom/CompositionEvent.cpp:
-        * dom/CompositionEvent.h:
-        * dom/CompositionEvent.idl:
-        * dom/ContextDestructionObserver.cpp:
-        * dom/ContextDestructionObserver.h:
-        * dom/CurrentScriptIncrementer.h:
-        * dom/CustomEvent.cpp:
-        * dom/CustomEvent.h:
-        * dom/CustomEvent.idl:
-        * dom/DOMCoreException.cpp:
-        * dom/DOMCoreException.h:
-        * dom/DOMCoreException.idl:
-        * dom/DOMError.idl:
-        * dom/DeviceMotionEvent.cpp:
-        * dom/DeviceMotionEvent.h:
-        * dom/DeviceMotionEvent.idl:
-        * dom/DocumentEventQueue.cpp:
-        * dom/DocumentEventQueue.h:
-        * dom/DocumentMarker.h:
-        * dom/DocumentParser.h:
-        * dom/DocumentSharedObjectPool.cpp:
-        * dom/DocumentSharedObjectPool.h:
-        * dom/Entity.idl:
-        * dom/EventContext.cpp:
-        * dom/EventContext.h:
-        * dom/EventException.cpp:
-        * dom/EventException.h:
-        * dom/EventException.idl:
-        * dom/EventListener.idl:
-        * dom/EventListenerMap.cpp:
-        * dom/EventListenerMap.h:
-        * dom/EventNames.cpp:
-        * dom/EventQueue.h:
-        * dom/EventTarget.cpp:
-        * dom/EventTarget.h:
-        * dom/ExceptionBase.cpp:
-        * dom/ExceptionBase.h:
-        * dom/GenericEventQueue.cpp:
-        * dom/GenericEventQueue.h:
-        * dom/KeyboardEvent.idl:
-        * dom/MessageChannel.cpp:
-        * dom/MessageChannel.h:
-        * dom/MessageChannel.idl:
-        * dom/MessageEvent.cpp:
-        * dom/MessageEvent.h:
-        * dom/MessageEvent.idl:
-        * dom/MessagePort.cpp:
-        * dom/MessagePort.h:
-        * dom/MessagePort.idl:
-        * dom/MouseRelatedEvent.h:
-        * dom/MutationEvent.idl:
-        * dom/Notation.idl:
-        * dom/OverflowEvent.cpp:
-        * dom/OverflowEvent.h:
-        * dom/OverflowEvent.idl:
-        * dom/PopStateEvent.cpp:
-        * dom/PopStateEvent.h:
-        * dom/PopStateEvent.idl:
-        * dom/Position.cpp:
-        * dom/Position.h:
-        * dom/ProcessingInstruction.idl:
-        * dom/ProgressEvent.cpp:
-        * dom/ProgressEvent.h:
-        * dom/ProgressEvent.idl:
-        * dom/Range.idl:
-        * dom/RangeException.cpp:
-        * dom/RangeException.h:
-        * dom/ScriptExecutionContext.cpp:
-        * dom/ScriptExecutionContext.h:
-        * dom/SecurityContext.cpp:
-        * dom/SecurityContext.h:
-        * dom/StaticNodeList.cpp:
-        * dom/StaticNodeList.h:
-        * dom/Text.idl:
-        * dom/TextEvent.cpp:
-        * dom/TextEvent.h:
-        * dom/TextEvent.idl:
-        * dom/Touch.cpp:
-        * dom/Touch.h:
-        * dom/Touch.idl:
-        * dom/TouchEvent.cpp:
-        * dom/TouchEvent.h:
-        * dom/TouchEvent.idl:
-        * dom/TouchList.cpp:
-        * dom/TouchList.h:
-        * dom/TouchList.idl:
-        * dom/TransitionEvent.cpp:
-        * dom/TransitionEvent.h:
-        * dom/TransitionEvent.idl:
-        * dom/TreeWalker.idl:
-        * dom/UIEvent.idl:
-        * dom/UIEventWithKeyState.cpp:
-        * dom/WebKitAnimationEvent.cpp:
-        * dom/WebKitAnimationEvent.h:
-        * dom/WebKitAnimationEvent.idl:
-        * dom/WebKitTransitionEvent.cpp:
-        * dom/WebKitTransitionEvent.h:
-        * dom/WebKitTransitionEvent.idl:
-        * dom/make_dom_exceptions.pl:
-        * dom/make_event_factory.pl:
-        * dom/make_names.pl:
-        (printLicenseHeader):
-        * editing/AlternativeTextController.cpp:
</del><ins>+        * css/CSSCursorImageValue.cpp:
+        * css/DeprecatedStyleBuilder.cpp:
+        * dom/EventDispatcher.cpp:
+        * dom/Node.cpp:
</ins><span class="cx">         * editing/AlternativeTextController.h:
</span><del>-        * editing/AppendNodeCommand.cpp:
-        * editing/AppendNodeCommand.h:
-        * editing/ApplyStyleCommand.cpp:
-        * editing/ApplyStyleCommand.h:
-        * editing/BreakBlockquoteCommand.cpp:
-        * editing/BreakBlockquoteCommand.h:
-        * editing/CompositeEditCommand.cpp:
-        * editing/CompositeEditCommand.h:
-        * editing/CreateLinkCommand.cpp:
-        * editing/CreateLinkCommand.h:
-        * editing/DeleteButton.cpp:
-        * editing/DeleteButton.h:
-        * editing/DeleteButtonController.cpp:
-        * editing/DeleteButtonController.h:
-        * editing/DeleteFromTextNodeCommand.cpp:
-        * editing/DeleteFromTextNodeCommand.h:
-        * editing/DeleteSelectionCommand.cpp:
-        * editing/DeleteSelectionCommand.h:
-        * editing/EditAction.h:
-        * editing/EditCommand.cpp:
-        * editing/EditCommand.h:
-        * editing/EditingBoundary.h:
-        * editing/EditingStyle.cpp:
</del><span class="cx">         * editing/Editor.cpp:
</span><del>-        * editing/Editor.h:
-        * editing/EditorCommand.cpp:
-        * editing/EditorDeleteAction.h:
-        * editing/EditorInsertAction.h:
-        * editing/FormatBlockCommand.cpp:
-        * editing/FormatBlockCommand.h:
-        * editing/FrameSelection.cpp:
-        * editing/FrameSelection.h:
-        * editing/HTMLInterchange.cpp:
-        * editing/HTMLInterchange.h:
-        * editing/IndentOutdentCommand.cpp:
-        * editing/IndentOutdentCommand.h:
-        * editing/InsertIntoTextNodeCommand.cpp:
-        * editing/InsertIntoTextNodeCommand.h:
-        * editing/InsertLineBreakCommand.cpp:
-        * editing/InsertLineBreakCommand.h:
-        * editing/InsertListCommand.cpp:
-        * editing/InsertListCommand.h:
-        * editing/InsertNodeBeforeCommand.cpp:
-        * editing/InsertNodeBeforeCommand.h:
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        * editing/InsertParagraphSeparatorCommand.h:
-        * editing/InsertTextCommand.cpp:
-        * editing/InsertTextCommand.h:
-        * editing/MarkupAccumulator.h:
-        * editing/MergeIdenticalElementsCommand.cpp:
-        * editing/MergeIdenticalElementsCommand.h:
-        * editing/ModifySelectionListLevel.cpp:
-        * editing/ModifySelectionListLevel.h:
-        * editing/MoveSelectionCommand.cpp:
-        * editing/MoveSelectionCommand.h:
-        * editing/RemoveCSSPropertyCommand.cpp:
-        * editing/RemoveCSSPropertyCommand.h:
-        * editing/RemoveFormatCommand.cpp:
-        * editing/RemoveFormatCommand.h:
-        * editing/RemoveNodeCommand.cpp:
-        * editing/RemoveNodeCommand.h:
-        * editing/RemoveNodePreservingChildrenCommand.cpp:
-        * editing/RemoveNodePreservingChildrenCommand.h:
-        * editing/ReplaceSelectionCommand.cpp:
-        * editing/ReplaceSelectionCommand.h:
-        * editing/SetNodeAttributeCommand.cpp:
-        * editing/SetNodeAttributeCommand.h:
-        * editing/SetSelectionCommand.cpp:
-        * editing/SetSelectionCommand.h:
-        * editing/SimplifyMarkupCommand.cpp:
-        * editing/SimplifyMarkupCommand.h:
-        * editing/SmartReplace.cpp:
-        * editing/SmartReplace.h:
-        * editing/SmartReplaceCF.cpp:
-        * editing/SpellChecker.cpp:
-        * editing/SpellChecker.h:
-        * editing/SpellingCorrectionCommand.cpp:
-        * editing/SpellingCorrectionCommand.h:
-        * editing/SplitElementCommand.cpp:
-        * editing/SplitElementCommand.h:
-        * editing/SplitTextNodeCommand.cpp:
-        * editing/SplitTextNodeCommand.h:
-        * editing/SplitTextNodeContainingElementCommand.cpp:
-        * editing/SplitTextNodeContainingElementCommand.h:
-        * editing/TextAffinity.h:
-        * editing/TextCheckingHelper.cpp:
-        * editing/TextGranularity.h:
-        * editing/TextIterator.cpp:
-        * editing/TextIterator.h:
-        * editing/TextIteratorBehavior.h:
-        * editing/TypingCommand.cpp:
-        * editing/TypingCommand.h:
-        * editing/UnlinkCommand.cpp:
-        * editing/UnlinkCommand.h:
-        * editing/VisiblePosition.cpp:
-        * editing/VisiblePosition.h:
-        * editing/VisibleSelection.cpp:
-        * editing/VisibleSelection.h:
-        * editing/VisibleUnits.cpp:
-        * editing/VisibleUnits.h:
-        * editing/WrapContentsInDummySpanCommand.cpp:
-        * editing/WrapContentsInDummySpanCommand.h:
-        * editing/WritingDirection.h:
-        * editing/efl/EditorEfl.cpp:
-        * editing/htmlediting.cpp:
-        * editing/htmlediting.h:
-        * editing/mac/EditorMac.mm:
-        * editing/mac/FrameSelectionMac.mm:
-        * editing/markup.cpp:
-        * editing/markup.h:
-        * extract-localizable-strings.pl:
-        * fileapi/FileException.cpp:
-        * history/BackForwardClient.h:
-        * history/BackForwardList.cpp:
-        * history/BackForwardList.h:
-        * history/CachedFrame.cpp:
-        * history/CachedFrame.h:
-        * history/CachedFramePlatformData.h:
-        * history/CachedPage.cpp:
-        * history/CachedPage.h:
-        * history/HistoryItem.cpp:
-        * history/HistoryItem.h:
-        * history/PageCache.cpp:
-        * history/PageCache.h:
-        * history/mac/HistoryItemMac.mm:
-        * html/FTPDirectoryDocument.cpp:
-        * html/FTPDirectoryDocument.h:
-        * html/HTMLAudioElement.cpp:
-        * html/HTMLAudioElement.h:
-        * html/HTMLAudioElement.idl:
-        * html/HTMLCanvasElement.cpp:
-        * html/HTMLCanvasElement.h:
-        * html/HTMLCanvasElement.idl:
-        * html/HTMLFieldSetElement.idl:
-        * html/HTMLImageLoader.h:
-        * html/HTMLMediaElement.cpp:
-        * html/HTMLMediaElement.h:
-        * html/HTMLMediaElement.idl:
-        * html/HTMLOptionsCollection.cpp:
</del><span class="cx">         * html/HTMLPlugInElement.cpp:
</span><del>-        * html/HTMLSourceElement.cpp:
-        * html/HTMLSourceElement.h:
-        * html/HTMLSourceElement.idl:
-        * html/HTMLTablePartElement.cpp:
-        * html/HTMLTableRowsCollection.cpp:
-        * html/HTMLTableRowsCollection.h:
-        * html/HTMLTitleElement.idl:
-        * html/HTMLTrackElement.cpp:
-        * html/HTMLTrackElement.h:
-        * html/HTMLTrackElement.idl:
-        * html/HTMLVideoElement.cpp:
-        * html/HTMLVideoElement.h:
-        * html/HTMLVideoElement.idl:
-        * html/ImageData.cpp:
-        * html/ImageData.h:
-        * html/ImageData.idl:
-        * html/ImageDocument.cpp:
-        * html/ImageDocument.h:
-        * html/MediaController.cpp:
-        * html/MediaController.h:
-        * html/MediaController.idl:
-        * html/MediaControllerInterface.h:
-        * html/MediaError.h:
-        * html/MediaError.idl:
-        * html/MediaFragmentURIParser.cpp:
-        * html/MediaFragmentURIParser.h:
-        * html/MediaKeyError.h:
-        * html/MediaKeyError.idl:
-        * html/MediaKeyEvent.cpp:
-        * html/MediaKeyEvent.h:
-        * html/MediaKeyEvent.idl:
-        * html/PluginDocument.cpp:
-        * html/PluginDocument.h:
-        * html/TextDocument.cpp:
-        * html/TextDocument.h:
-        * html/TimeRanges.cpp:
-        * html/TimeRanges.h:
-        * html/TimeRanges.idl:
-        * html/VoidCallback.h:
-        * html/VoidCallback.idl:
-        * html/canvas/CanvasGradient.cpp:
-        * html/canvas/CanvasGradient.h:
-        * html/canvas/CanvasGradient.idl:
-        * html/canvas/CanvasPattern.cpp:
-        * html/canvas/CanvasPattern.h:
-        * html/canvas/CanvasPattern.idl:
-        * html/canvas/CanvasRenderingContext.cpp:
-        * html/canvas/CanvasRenderingContext.h:
-        * html/canvas/CanvasRenderingContext.idl:
</del><span class="cx">         * html/canvas/CanvasRenderingContext2D.cpp:
</span><del>-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/CanvasRenderingContext2D.idl:
-        * html/canvas/CanvasStyle.cpp:
-        * html/canvas/CanvasStyle.h:
-        * html/canvas/DOMPath.idl:
-        * html/canvas/OESVertexArrayObject.cpp:
</del><span class="cx">         * html/canvas/OESVertexArrayObject.h:
</span><del>-        * html/canvas/OESVertexArrayObject.idl:
-        * html/canvas/WebGLBuffer.cpp:
-        * html/canvas/WebGLBuffer.h:
-        * html/canvas/WebGLBuffer.idl:
-        * html/canvas/WebGLContextGroup.cpp:
-        * html/canvas/WebGLContextGroup.h:
-        * html/canvas/WebGLContextObject.cpp:
-        * html/canvas/WebGLContextObject.h:
-        * html/canvas/WebGLFramebuffer.cpp:
-        * html/canvas/WebGLFramebuffer.h:
-        * html/canvas/WebGLFramebuffer.idl:
-        * html/canvas/WebGLObject.cpp:
-        * html/canvas/WebGLObject.h:
-        * html/canvas/WebGLProgram.cpp:
-        * html/canvas/WebGLProgram.h:
-        * html/canvas/WebGLProgram.idl:
-        * html/canvas/WebGLRenderbuffer.cpp:
-        * html/canvas/WebGLRenderbuffer.h:
-        * html/canvas/WebGLRenderbuffer.idl:
-        * html/canvas/WebGLRenderingContext.cpp:
-        * html/canvas/WebGLRenderingContext.h:
-        * html/canvas/WebGLRenderingContext.idl:
-        * html/canvas/WebGLShader.cpp:
-        * html/canvas/WebGLShader.h:
-        * html/canvas/WebGLShader.idl:
-        * html/canvas/WebGLSharedObject.cpp:
-        * html/canvas/WebGLSharedObject.h:
-        * html/canvas/WebGLTexture.cpp:
-        * html/canvas/WebGLTexture.h:
-        * html/canvas/WebGLTexture.idl:
-        * html/canvas/WebGLUniformLocation.cpp:
-        * html/canvas/WebGLUniformLocation.h:
-        * html/canvas/WebGLUniformLocation.idl:
-        * html/canvas/WebGLVertexArrayObjectOES.cpp:
-        * html/canvas/WebGLVertexArrayObjectOES.h:
-        * html/canvas/WebGLVertexArrayObjectOES.idl:
-        * html/forms/FileIconLoader.cpp:
-        * html/forms/FileIconLoader.h:
-        * html/parser/TextDocumentParser.cpp:
-        * html/parser/TextDocumentParser.h:
-        * html/shadow/MediaControlElementTypes.cpp:
-        * html/shadow/MediaControlElementTypes.h:
-        * html/shadow/MediaControlElements.cpp:
-        * html/shadow/MediaControlElements.h:
-        * html/shadow/MediaControls.cpp:
-        * html/shadow/MediaControls.h:
-        * html/shadow/MediaControlsApple.cpp:
-        * html/shadow/MediaControlsApple.h:
-        * html/shadow/MediaControlsGtk.cpp:
-        * html/shadow/MediaControlsGtk.h:
-        * html/shadow/SpinButtonElement.cpp:
-        * html/shadow/SpinButtonElement.h:
-        * html/shadow/TextControlInnerElements.cpp:
-        * html/shadow/TextControlInnerElements.h:
-        * html/track/AudioTrack.h:
-        * html/track/AudioTrack.idl:
-        * html/track/AudioTrackList.cpp:
-        * html/track/AudioTrackList.h:
-        * html/track/AudioTrackList.idl:
-        * html/track/DataCue.cpp:
-        * html/track/DataCue.h:
-        * html/track/DataCue.idl:
-        * html/track/InbandGenericTextTrack.cpp:
-        * html/track/InbandGenericTextTrack.h:
</del><ins>+        * html/parser/HTMLConstructionSite.cpp:
+        * html/parser/HTMLTokenizer.cpp:
</ins><span class="cx">         * html/track/InbandTextTrack.cpp:
</span><del>-        * html/track/InbandTextTrack.h:
-        * html/track/InbandWebVTTTextTrack.cpp:
-        * html/track/InbandWebVTTTextTrack.h:
-        * html/track/LoadableTextTrack.cpp:
-        * html/track/LoadableTextTrack.h:
-        * html/track/TextTrack.h:
-        * html/track/TextTrack.idl:
-        * html/track/TextTrackCue.idl:
-        * html/track/TextTrackCueGeneric.cpp:
-        * html/track/TextTrackCueGeneric.h:
-        * html/track/TextTrackCueList.cpp:
-        * html/track/TextTrackCueList.h:
-        * html/track/TextTrackCueList.idl:
-        * html/track/TextTrackList.cpp:
-        * html/track/TextTrackList.h:
-        * html/track/TextTrackList.idl:
-        * html/track/TextTrackRegion.idl:
-        * html/track/TextTrackRegionList.cpp:
-        * html/track/TextTrackRegionList.h:
-        * html/track/TextTrackRegionList.idl:
-        * html/track/TrackBase.cpp:
-        * html/track/TrackBase.h:
-        * html/track/TrackEvent.cpp:
-        * html/track/TrackEvent.h:
-        * html/track/TrackEvent.idl:
-        * html/track/TrackListBase.cpp:
-        * html/track/TrackListBase.h:
-        * html/track/VTTCue.idl:
-        * html/track/VideoTrack.h:
-        * html/track/VideoTrack.idl:
-        * html/track/VideoTrackList.cpp:
-        * html/track/VideoTrackList.h:
-        * html/track/VideoTrackList.idl:
-        * html/track/WebVTTElement.cpp:
-        * html/track/WebVTTElement.h:
-        * inspector/CommandLineAPIHost.cpp:
-        * inspector/CommandLineAPIHost.h:
-        * inspector/CommandLineAPIModuleSource.js:
-        * inspector/InspectorAllInOne.cpp:
-        * inspector/InspectorClient.h:
-        * inspector/InspectorDOMAgent.cpp:
-        * inspector/InspectorDOMAgent.h:
-        * inspector/InspectorDOMStorageAgent.cpp:
-        * inspector/InspectorDOMStorageAgent.h:
-        * inspector/InspectorDatabaseAgent.cpp:
-        * inspector/InspectorDatabaseAgent.h:
-        * inspector/InspectorDatabaseResource.cpp:
-        * inspector/InspectorDatabaseResource.h:
-        * inspector/InspectorForwarding.h:
-        * inspector/InspectorFrontendHost.cpp:
-        * inspector/InspectorFrontendHost.h:
-        * inspector/InspectorLayerTreeAgent.h:
-        * inspector/InspectorNodeFinder.cpp:
-        * inspector/InspectorNodeFinder.h:
-        * inspector/InspectorOverlay.cpp:
-        * inspector/InspectorOverlay.h:
-        * inspector/InspectorOverlayPage.html:
-        * inspector/InspectorProfilerAgent.cpp:
-        * inspector/InspectorProfilerAgent.h:
-        * inspector/ScriptProfile.idl:
-        * inspector/ScriptProfileNode.idl:
-        * loader/CookieJar.h:
-        * loader/CrossOriginAccessControl.cpp:
-        * loader/CrossOriginAccessControl.h:
-        * loader/CrossOriginPreflightResultCache.cpp:
-        * loader/CrossOriginPreflightResultCache.h:
-        * loader/DocumentLoader.cpp:
-        * loader/DocumentLoader.h:
-        * loader/DocumentWriter.cpp:
-        * loader/EmptyClients.h:
-        * loader/FormState.cpp:
-        * loader/FormState.h:
-        * loader/FrameLoadRequest.h:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/FrameLoaderClient.h:
-        * loader/FrameLoaderTypes.h:
-        * loader/HistoryController.cpp:
-        * loader/HistoryController.h:
-        * loader/MixedContentChecker.cpp:
-        * loader/NavigationAction.cpp:
-        * loader/NavigationAction.h:
-        * loader/NavigationScheduler.cpp:
-        * loader/NavigationScheduler.h:
-        * loader/NetscapePlugInStreamLoader.cpp:
-        * loader/NetscapePlugInStreamLoader.h:
-        * loader/PolicyCallback.cpp:
-        * loader/PolicyCallback.h:
-        * loader/PolicyChecker.cpp:
-        * loader/PolicyChecker.h:
-        * loader/ProgressTracker.cpp:
-        * loader/ProgressTracker.h:
-        * loader/ResourceBuffer.cpp:
-        * loader/ResourceBuffer.h:
-        * loader/ResourceLoadNotifier.cpp:
-        * loader/ResourceLoadNotifier.h:
-        * loader/ResourceLoader.cpp:
-        * loader/ResourceLoader.h:
-        * loader/SinkDocument.cpp:
-        * loader/SinkDocument.h:
-        * loader/SubframeLoader.cpp:
-        * loader/SubframeLoader.h:
-        * loader/SubresourceLoader.cpp:
-        * loader/SubresourceLoader.h:
-        * loader/SubstituteData.h:
-        * loader/TextTrackLoader.cpp:
-        * loader/appcache/ApplicationCacheAllInOne.cpp:
-        * loader/archive/Archive.cpp:
-        * loader/archive/Archive.h:
-        * loader/archive/ArchiveFactory.cpp:
-        * loader/archive/ArchiveFactory.h:
-        * loader/archive/ArchiveResource.cpp:
-        * loader/archive/ArchiveResource.h:
-        * loader/archive/ArchiveResourceCollection.cpp:
-        * loader/archive/ArchiveResourceCollection.h:
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        * loader/archive/cf/LegacyWebArchive.h:
-        * loader/archive/cf/LegacyWebArchiveMac.mm:
-        * loader/cache/CachePolicy.h:
-        * loader/cache/CachedCSSStyleSheet.cpp:
-        * loader/cache/CachedFont.cpp:
-        * loader/cache/CachedFont.h:
-        * loader/cache/CachedResourceRequest.cpp:
-        * loader/cache/CachedResourceRequest.h:
-        * loader/cache/CachedResourceRequestInitiators.cpp:
-        * loader/cache/CachedResourceRequestInitiators.h:
-        * loader/cf/ResourceLoaderCFNet.cpp:
-        * loader/icon/IconController.cpp:
-        * loader/icon/IconController.h:
-        * loader/icon/IconDatabase.cpp:
-        * loader/icon/IconDatabase.h:
-        * loader/icon/IconDatabaseBase.cpp:
-        * loader/icon/IconDatabaseBase.h:
-        * loader/icon/IconDatabaseClient.h:
-        * loader/icon/IconLoader.cpp:
-        * loader/icon/IconLoader.h:
-        * loader/icon/IconRecord.cpp:
-        * loader/icon/IconRecord.h:
-        * loader/icon/PageURLRecord.cpp:
-        * loader/icon/PageURLRecord.h:
</del><ins>+        * inspector/InspectorCanvasInstrumentation.h:
+        * inspector/InspectorConsoleInstrumentation.h:
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorCounters.h:
+        * inspector/InspectorDatabaseInstrumentation.h:
+        * inspector/InspectorInstrumentation.h:
+        * loader/DocumentThreadableLoader.cpp:
+        * loader/PingLoader.cpp:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * loader/cache/CachedResourceLoader.cpp:
</ins><span class="cx">         * loader/mac/DocumentLoaderMac.cpp:
</span><del>-        * loader/mac/LoaderNSURLExtras.h:
-        * loader/mac/LoaderNSURLExtras.mm:
-        * loader/mac/ResourceBuffer.mm:
-        * loader/mac/ResourceLoaderMac.mm:
-        * loader/win/DocumentLoaderWin.cpp:
-        * loader/win/FrameLoaderWin.cpp:
-        * mathml/MathMLAllInOne.cpp:
-        * page/AbstractView.idl:
-        * page/AlternativeTextClient.h:
-        * page/AutoscrollController.cpp:
-        * page/AutoscrollController.h:
-        * page/BarProp.cpp:
-        * page/BarProp.h:
-        * page/BarProp.idl:
-        * page/ContentSecurityPolicy.cpp:
-        * page/ContentSecurityPolicy.h:
-        * page/ContextMenuClient.h:
-        * page/ContextMenuContext.cpp:
-        * page/ContextMenuContext.h:
-        * page/ContextMenuController.cpp:
-        * page/ContextMenuController.h:
-        * page/DOMSecurityPolicy.cpp:
-        * page/DOMSecurityPolicy.h:
-        * page/DOMSelection.cpp:
-        * page/DOMSelection.h:
-        * page/DOMSelection.idl:
-        * page/DOMTimer.cpp:
-        * page/DOMTimer.h:
-        * page/DOMWindow.cpp:
-        * page/DOMWindow.h:
-        * page/DOMWindow.idl:
-        * page/DragActions.h:
-        * page/DragClient.h:
-        * page/DragController.cpp:
-        * page/DragController.h:
-        * page/DragSession.h:
-        * page/DragState.h:
-        * page/EditorClient.h:
-        * page/EventHandler.cpp:
-        * page/EventHandler.h:
-        * page/FocusController.cpp:
-        * page/FocusController.h:
-        * page/FocusDirection.h:
-        * page/FrameTree.h:
-        * page/GestureTapHighlighter.cpp:
-        * page/GestureTapHighlighter.h:
-        * page/History.cpp:
-        * page/History.h:
-        * page/History.idl:
-        * page/Location.cpp:
-        * page/Location.h:
-        * page/Location.idl:
-        * page/MouseEventWithHitTestResults.cpp:
-        * page/MouseEventWithHitTestResults.h:
-        * page/Navigator.cpp:
-        * page/NavigatorBase.cpp:
-        * page/NavigatorBase.h:
</del><ins>+        * page/ChromeClient.h:
+        * page/Console.cpp:
+        * page/FrameView.cpp:
</ins><span class="cx">         * page/PageConsole.cpp:
</span><del>-        * page/PageConsole.h:
-        * page/Screen.cpp:
-        * page/Screen.h:
-        * page/Screen.idl:
-        * page/SecurityOrigin.cpp:
-        * page/SecurityOrigin.h:
-        * page/SecurityOriginHash.h:
-        * page/Settings.cpp:
-        * page/Settings.h:
-        * page/SpatialNavigation.cpp:
-        * page/SuspendableTimer.cpp:
-        * page/SuspendableTimer.h:
-        * page/UserContentTypes.h:
-        * page/UserContentURLPattern.cpp:
-        * page/UserContentURLPattern.h:
-        * page/UserScript.h:
-        * page/UserScriptTypes.h:
-        * page/UserStyleSheet.h:
-        * page/UserStyleSheetTypes.h:
-        * page/WebCoreKeyboardUIMode.h:
-        * page/WebKitPoint.h:
-        * page/WebKitPoint.idl:
-        * page/WindowBase64.idl:
-        * page/WindowFeatures.h:
-        * page/WindowFocusAllowedIndicator.cpp:
-        * page/WindowFocusAllowedIndicator.h:
-        * page/WindowTimers.idl:
-        * page/WorkerNavigator.cpp:
-        * page/WorkerNavigator.h:
-        * page/WorkerNavigator.idl:
-        * page/animation/AnimationBase.cpp:
-        * page/animation/AnimationBase.h:
</del><span class="cx">         * page/animation/AnimationController.cpp:
</span><del>-        * page/animation/AnimationController.h:
-        * page/animation/AnimationControllerPrivate.h:
-        * page/animation/CSSPropertyAnimation.cpp:
-        * page/animation/CSSPropertyAnimation.h:
-        * page/animation/CompositeAnimation.cpp:
-        * page/animation/CompositeAnimation.h:
</del><span class="cx">         * page/animation/ImplicitAnimation.cpp:
</span><del>-        * page/animation/ImplicitAnimation.h:
</del><span class="cx">         * page/animation/KeyframeAnimation.cpp:
</span><del>-        * page/animation/KeyframeAnimation.h:
-        * page/efl/DragControllerEfl.cpp:
-        * page/efl/EventHandlerEfl.cpp:
-        * page/gtk/DragControllerGtk.cpp:
-        * page/gtk/EventHandlerGtk.cpp:
-        * page/ios/EventHandlerIOS.mm:
-        * page/mac/DragControllerMac.mm:
-        * page/mac/EventHandlerMac.mm:
-        * page/mac/PageMac.cpp:
-        * page/mac/WebCoreFrameView.h:
-        * page/make_settings.pl:
-        * page/win/DragControllerWin.cpp:
-        * page/win/EventHandlerWin.cpp:
-        * page/win/FrameCGWin.cpp:
-        * page/win/FrameCairoWin.cpp:
-        * page/win/FrameGdiWin.cpp:
-        * page/win/FrameWin.cpp:
-        * page/win/FrameWin.h:
-        * pdf/ios/PDFDocument.h:
-        * platform/Clock.cpp:
-        * platform/Clock.h:
-        * platform/ClockGeneric.cpp:
-        * platform/ClockGeneric.h:
-        * platform/ColorChooser.h:
-        * platform/ColorChooserClient.h:
-        * platform/ContentType.cpp:
-        * platform/ContentType.h:
-        * platform/ContextMenu.h:
-        * platform/ContextMenuItem.h:
-        * platform/Cookie.h:
-        * platform/Cursor.h:
-        * platform/DragData.cpp:
-        * platform/DragData.h:
-        * platform/DragImage.cpp:
-        * platform/DragImage.h:
-        * platform/FileChooser.cpp:
-        * platform/FileChooser.h:
-        * platform/FileSystem.h:
-        * platform/FloatConversion.h:
-        * platform/KillRing.h:
-        * platform/LinkHash.h:
</del><span class="cx">         * platform/LocalizedStrings.cpp:
</span><del>-        * platform/LocalizedStrings.h:
-        * platform/Logging.cpp:
-        * platform/Logging.h:
-        * platform/MIMETypeRegistry.cpp:
-        * platform/MIMETypeRegistry.h:
-        * platform/MediaDescription.h:
-        * platform/MediaSample.h:
-        * platform/NotImplemented.h:
-        * platform/PODFreeListArena.h:
-        * platform/Pasteboard.h:
-        * platform/PasteboardStrategy.h:
-        * platform/PlatformExportMacros.h:
-        * platform/PlatformKeyboardEvent.h:
-        * platform/PlatformMenuDescription.h:
-        * platform/PlatformMouseEvent.h:
-        * platform/PlatformPasteboard.h:
-        * platform/PlatformScreen.h:
-        * platform/PlatformSpeechSynthesis.h:
-        * platform/PlatformSpeechSynthesisUtterance.cpp:
-        * platform/PlatformSpeechSynthesisUtterance.h:
-        * platform/PlatformSpeechSynthesisVoice.cpp:
-        * platform/PlatformSpeechSynthesisVoice.h:
-        * platform/PlatformSpeechSynthesizer.cpp:
-        * platform/PlatformSpeechSynthesizer.h:
-        * platform/PlatformWheelEvent.h:
-        * platform/PopupMenuClient.h:
-        * platform/RemoteCommandListener.cpp:
-        * platform/RemoteCommandListener.h:
-        * platform/SSLKeyGenerator.h:
-        * platform/SchemeRegistry.cpp:
-        * platform/SchemeRegistry.h:
-        * platform/ScrollTypes.h:
-        * platform/ScrollView.cpp:
-        * platform/ScrollView.h:
-        * platform/Scrollbar.cpp:
-        * platform/Scrollbar.h:
-        * platform/SharedBuffer.cpp:
-        * platform/SharedBuffer.h:
-        * platform/SharedTimer.h:
-        * platform/Sound.h:
-        * platform/ThreadCheck.h:
</del><ins>+        * platform/ScrollAnimator.h:
</ins><span class="cx">         * platform/ThreadGlobalData.cpp:
</span><del>-        * platform/ThreadGlobalData.h:
-        * platform/ThreadTimers.cpp:
-        * platform/ThreadTimers.h:
-        * platform/Timer.cpp:
-        * platform/Timer.h:
-        * platform/URL.cpp:
-        * platform/URL.h:
-        * platform/Widget.cpp:
-        * platform/Widget.h:
-        * platform/animation/AnimationUtilities.h:
-        * platform/audio/AudioArray.h:
-        * platform/audio/AudioBus.cpp:
-        * platform/audio/AudioBus.h:
-        * platform/audio/AudioChannel.cpp:
-        * platform/audio/AudioChannel.h:
-        * platform/audio/AudioDestination.h:
-        * platform/audio/AudioFIFO.cpp:
-        * platform/audio/AudioFIFO.h:
-        * platform/audio/AudioFileReader.h:
-        * platform/audio/AudioIOCallback.h:
-        * platform/audio/AudioPullFIFO.cpp:
-        * platform/audio/AudioPullFIFO.h:
-        * platform/audio/AudioSourceProvider.h:
-        * platform/audio/Biquad.cpp:
-        * platform/audio/Biquad.h:
-        * platform/audio/Cone.cpp:
-        * platform/audio/Cone.h:
-        * platform/audio/DirectConvolver.cpp:
-        * platform/audio/DirectConvolver.h:
-        * platform/audio/Distance.cpp:
-        * platform/audio/Distance.h:
-        * platform/audio/DownSampler.cpp:
-        * platform/audio/DownSampler.h:
-        * platform/audio/DynamicsCompressor.cpp:
-        * platform/audio/DynamicsCompressor.h:
-        * platform/audio/DynamicsCompressorKernel.cpp:
-        * platform/audio/DynamicsCompressorKernel.h:
-        * platform/audio/FFTConvolver.cpp:
-        * platform/audio/FFTConvolver.h:
-        * platform/audio/FFTFrame.cpp:
-        * platform/audio/FFTFrame.h:
-        * platform/audio/HRTFDatabase.cpp:
-        * platform/audio/HRTFDatabase.h:
-        * platform/audio/HRTFDatabaseLoader.cpp:
-        * platform/audio/HRTFDatabaseLoader.h:
-        * platform/audio/HRTFElevation.cpp:
-        * platform/audio/HRTFElevation.h:
-        * platform/audio/HRTFKernel.cpp:
-        * platform/audio/HRTFKernel.h:
-        * platform/audio/MultiChannelResampler.cpp:
-        * platform/audio/MultiChannelResampler.h:
-        * platform/audio/Panner.cpp:
-        * platform/audio/Panner.h:
-        * platform/audio/Reverb.cpp:
-        * platform/audio/Reverb.h:
-        * platform/audio/ReverbAccumulationBuffer.cpp:
-        * platform/audio/ReverbAccumulationBuffer.h:
-        * platform/audio/ReverbConvolver.cpp:
-        * platform/audio/ReverbConvolver.h:
-        * platform/audio/ReverbConvolverStage.cpp:
-        * platform/audio/ReverbConvolverStage.h:
-        * platform/audio/ReverbInputBuffer.cpp:
-        * platform/audio/ReverbInputBuffer.h:
-        * platform/audio/SincResampler.cpp:
-        * platform/audio/SincResampler.h:
-        * platform/audio/UpSampler.cpp:
-        * platform/audio/UpSampler.h:
-        * platform/audio/ZeroPole.cpp:
-        * platform/audio/ZeroPole.h:
-        * platform/audio/ios/AudioDestinationIOS.cpp:
-        * platform/audio/ios/AudioDestinationIOS.h:
-        * platform/audio/ios/AudioFileReaderIOS.cpp:
-        * platform/audio/ios/AudioFileReaderIOS.h:
-        * platform/audio/mac/AudioDestinationMac.cpp:
-        * platform/audio/mac/AudioDestinationMac.h:
-        * platform/audio/mac/AudioFileReaderMac.cpp:
-        * platform/audio/mac/AudioFileReaderMac.h:
-        * platform/audio/mac/FFTFrameMac.cpp:
-        * platform/cf/FileSystemCF.cpp:
-        * platform/cf/SharedBufferCF.cpp:
-        * platform/cf/URLCF.cpp:
-        * platform/cocoa/KeyEventCocoa.h:
-        * platform/cocoa/KeyEventCocoa.mm:
-        * platform/efl/CursorEfl.cpp:
-        * platform/efl/EflKeyboardUtilities.cpp:
-        * platform/efl/EflKeyboardUtilities.h:
-        * platform/efl/FileSystemEfl.cpp:
-        * platform/efl/LanguageEfl.cpp:
-        * platform/efl/LocalizedStringsEfl.cpp:
-        * platform/efl/MIMETypeRegistryEfl.cpp:
-        * platform/efl/PlatformKeyboardEventEfl.cpp:
-        * platform/efl/PlatformMouseEventEfl.cpp:
-        * platform/efl/PlatformScreenEfl.cpp:
-        * platform/efl/PlatformWheelEventEfl.cpp:
-        * platform/efl/RenderThemeEfl.h:
-        * platform/efl/ScrollbarEfl.h:
-        * platform/efl/SharedTimerEfl.cpp:
-        * platform/efl/SoundEfl.cpp:
-        * platform/efl/TemporaryLinkStubs.cpp:
-        * platform/efl/WidgetEfl.cpp:
-        * platform/graphics/ANGLEWebKitBridge.cpp:
-        * platform/graphics/ANGLEWebKitBridge.h:
-        * platform/graphics/AudioTrackPrivate.h:
-        * platform/graphics/BitmapImage.cpp:
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/Color.cpp:
-        * platform/graphics/Color.h:
-        * platform/graphics/CrossfadeGeneratedImage.cpp:
-        * platform/graphics/CrossfadeGeneratedImage.h:
-        * platform/graphics/DashArray.h:
-        * platform/graphics/DisplayRefreshMonitor.cpp:
-        * platform/graphics/DisplayRefreshMonitor.h:
-        * platform/graphics/FloatPoint.cpp:
-        * platform/graphics/FloatPoint.h:
-        * platform/graphics/FloatQuad.cpp:
-        * platform/graphics/FloatQuad.h:
-        * platform/graphics/FloatRect.cpp:
-        * platform/graphics/FloatRect.h:
-        * platform/graphics/FloatSize.cpp:
-        * platform/graphics/FloatSize.h:
-        * platform/graphics/FontBaseline.h:
-        * platform/graphics/FontCache.cpp:
-        * platform/graphics/FontCache.h:
-        * platform/graphics/FontData.cpp:
-        * platform/graphics/FontData.h:
-        * platform/graphics/FontDescription.cpp:
-        * platform/graphics/FontFeatureSettings.cpp:
-        * platform/graphics/FontFeatureSettings.h:
-        * platform/graphics/FontGlyphs.cpp:
-        * platform/graphics/FontOrientation.h:
-        * platform/graphics/FontRenderingMode.h:
-        * platform/graphics/FontSelector.h:
-        * platform/graphics/FontWidthVariant.h:
-        * platform/graphics/FormatConverter.cpp:
-        * platform/graphics/FormatConverter.h:
-        * platform/graphics/GeneratedImage.h:
-        * platform/graphics/Glyph.h:
</del><ins>+        * platform/blackberry/AsyncFileSystemBlackBerry.cpp:
+        * platform/graphics/Font.cpp:
</ins><span class="cx">         * platform/graphics/GlyphBuffer.h:
</span><del>-        * platform/graphics/GlyphMetricsMap.h:
-        * platform/graphics/GlyphPage.h:
-        * platform/graphics/GlyphPageTreeNode.cpp:
-        * platform/graphics/GlyphPageTreeNode.h:
</del><span class="cx">         * platform/graphics/Gradient.cpp:
</span><del>-        * platform/graphics/Gradient.h:
-        * platform/graphics/GradientImage.h:
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/GraphicsContext3D.cpp:
-        * platform/graphics/GraphicsContext3D.h:
-        * platform/graphics/GraphicsLayer.cpp:
-        * platform/graphics/GraphicsLayer.h:
-        * platform/graphics/GraphicsLayerClient.h:
-        * platform/graphics/GraphicsTypes.cpp:
-        * platform/graphics/GraphicsTypes.h:
-        * platform/graphics/GraphicsTypes3D.h:
-        * platform/graphics/Image.cpp:
-        * platform/graphics/Image.h:
-        * platform/graphics/ImageBuffer.cpp:
-        * platform/graphics/ImageBuffer.h:
-        * platform/graphics/ImageBufferData.h:
-        * platform/graphics/ImageObserver.h:
-        * platform/graphics/ImageSource.cpp:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/InbandTextTrackPrivate.h:
-        * platform/graphics/InbandTextTrackPrivateClient.h:
-        * platform/graphics/IntPoint.cpp:
-        * platform/graphics/IntPoint.h:
-        * platform/graphics/IntSize.cpp:
-        * platform/graphics/IntSize.h:
-        * platform/graphics/MediaPlayer.cpp:
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        * platform/graphics/MediaSourcePrivateClient.h:
-        * platform/graphics/NativeImagePtr.h:
-        * platform/graphics/OpenGLESShims.h:
-        * platform/graphics/Path.cpp:
-        * platform/graphics/Path.h:
-        * platform/graphics/PathTraversalState.h:
-        * platform/graphics/Pattern.cpp:
-        * platform/graphics/Pattern.h:
-        * platform/graphics/PlatformLayer.h:
-        * platform/graphics/PlatformTimeRanges.cpp:
-        * platform/graphics/PlatformTimeRanges.h:
-        * platform/graphics/SegmentedFontData.cpp:
-        * platform/graphics/SegmentedFontData.h:
</del><span class="cx">         * platform/graphics/ShadowBlur.cpp:
</span><del>-        * platform/graphics/ShadowBlur.h:
</del><span class="cx">         * platform/graphics/SimpleFontData.cpp:
</span><del>-        * platform/graphics/SourceBufferPrivateClient.h:
-        * platform/graphics/StringTruncator.cpp:
-        * platform/graphics/StringTruncator.h:
-        * platform/graphics/TrackPrivateBase.h:
-        * platform/graphics/VideoTrackPrivate.h:
-        * platform/graphics/WindRule.h:
-        * platform/graphics/avfoundation/AVTrackPrivateAVFObjCImpl.h:
-        * platform/graphics/avfoundation/AVTrackPrivateAVFObjCImpl.mm:
</del><ins>+        * platform/graphics/SimpleFontData.h:
</ins><span class="cx">         * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
</span><del>-        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h:
</del><span class="cx">         * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
</span><del>-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
-        * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h:
-        * platform/graphics/avfoundation/cf/CoreMediaSoftLinking.h:
-        * platform/graphics/avfoundation/cf/InbandTextTrackPrivateAVCF.cpp:
-        * platform/graphics/avfoundation/cf/InbandTextTrackPrivateAVCF.h:
-        * platform/graphics/avfoundation/cf/InbandTextTrackPrivateLegacyAVCF.cpp:
-        * platform/graphics/avfoundation/cf/InbandTextTrackPrivateLegacyAVCF.h:
</del><span class="cx">         * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
</span><del>-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
-        * platform/graphics/avfoundation/objc/AudioTrackPrivateMediaSourceAVFObjC.cpp:
-        * platform/graphics/avfoundation/objc/AudioTrackPrivateMediaSourceAVFObjC.h:
-        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.h:
</del><span class="cx">         * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.mm:
</span><del>-        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.h:
</del><span class="cx">         * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.mm:
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
</del><span class="cx">         * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        * platform/graphics/avfoundation/objc/VideoTrackPrivateMediaSourceAVFObjC.h:
-        * platform/graphics/avfoundation/objc/VideoTrackPrivateMediaSourceAVFObjC.mm:
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * platform/graphics/ca/LayerFlushScheduler.cpp:
-        * platform/graphics/ca/LayerFlushScheduler.h:
-        * platform/graphics/ca/LayerFlushSchedulerClient.h:
-        * platform/graphics/ca/PlatformCAAnimation.h:
-        * platform/graphics/ca/PlatformCAFilters.h:
-        * platform/graphics/ca/PlatformCALayer.cpp:
-        * platform/graphics/ca/PlatformCALayer.h:
-        * platform/graphics/ca/PlatformCALayerClient.h:
-        * platform/graphics/ca/TransformationMatrixCA.cpp:
-        * platform/graphics/ca/mac/LayerFlushSchedulerMac.cpp:
-        * platform/graphics/ca/mac/LayerPool.mm:
</del><ins>+        * platform/graphics/blackberry/GradientBlackBerry.cpp:
+        * platform/graphics/blackberry/GraphicsContextBlackBerry.cpp:
</ins><span class="cx">         * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
</span><del>-        * platform/graphics/ca/mac/PlatformCAFiltersMac.h:
-        * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
-        * platform/graphics/ca/mac/PlatformCALayerMac.h:
</del><span class="cx">         * platform/graphics/ca/mac/PlatformCALayerMac.mm:
</span><del>-        * platform/graphics/ca/mac/WebTiledBackingLayer.h:
-        * platform/graphics/ca/mac/WebTiledBackingLayer.mm:
-        * platform/graphics/ca/win/AbstractCACFLayerTreeHost.h:
-        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
-        * platform/graphics/ca/win/CACFLayerTreeHost.h:
-        * platform/graphics/ca/win/CACFLayerTreeHostClient.h:
-        * platform/graphics/ca/win/LayerChangesFlusher.cpp:
-        * platform/graphics/ca/win/LayerChangesFlusher.h:
-        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp:
-        * platform/graphics/ca/win/LegacyCACFLayerTreeHost.h:
</del><ins>+        * platform/graphics/ca/mac/WebTileLayer.mm:
</ins><span class="cx">         * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
</span><del>-        * platform/graphics/ca/win/PlatformCAFiltersWin.cpp:
-        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
-        * platform/graphics/ca/win/PlatformCALayerWin.h:
-        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
-        * platform/graphics/ca/win/PlatformCALayerWinInternal.h:
-        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
-        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h:
-        * platform/graphics/cairo/BitmapImageCairo.cpp:
-        * platform/graphics/cairo/CairoUtilities.cpp:
-        * platform/graphics/cairo/CairoUtilities.h:
-        * platform/graphics/cairo/DrawingBufferCairo.cpp:
-        * platform/graphics/cairo/FloatRectCairo.cpp:
-        * platform/graphics/cairo/FontCairo.cpp:
-        * platform/graphics/cairo/FontCairoHarfbuzzNG.cpp:
-        * platform/graphics/cairo/GradientCairo.cpp:
-        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        * platform/graphics/cairo/ImageBufferDataCairo.h:
-        * platform/graphics/cairo/ImageCairo.cpp:
-        * platform/graphics/cairo/PatternCairo.cpp:
-        * platform/graphics/cairo/PlatformContextCairo.cpp:
-        * platform/graphics/cairo/PlatformContextCairo.h:
-        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
-        * platform/graphics/cg/BitmapImageCG.cpp:
-        * platform/graphics/cg/ColorCG.cpp:
-        * platform/graphics/cg/FloatPointCG.cpp:
-        * platform/graphics/cg/FloatRectCG.cpp:
-        * platform/graphics/cg/FloatSizeCG.cpp:
-        * platform/graphics/cg/GradientCG.cpp:
-        * platform/graphics/cg/GraphicsContext3DCG.cpp:
</del><span class="cx">         * platform/graphics/cg/GraphicsContextCG.cpp:
</span><del>-        * platform/graphics/cg/GraphicsContextCG.h:
-        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
</del><span class="cx">         * platform/graphics/cg/ImageBufferCG.cpp:
</span><del>-        * platform/graphics/cg/ImageBufferDataCG.cpp:
-        * platform/graphics/cg/ImageBufferDataCG.h:
-        * platform/graphics/cg/ImageCG.cpp:
</del><span class="cx">         * platform/graphics/cg/ImageSourceCG.cpp:
</span><del>-        * platform/graphics/cg/IntPointCG.cpp:
-        * platform/graphics/cg/IntRectCG.cpp:
-        * platform/graphics/cg/IntSizeCG.cpp:
-        * platform/graphics/cg/PDFDocumentImage.cpp:
-        * platform/graphics/cg/PDFDocumentImage.h:
-        * platform/graphics/cg/PathCG.cpp:
-        * platform/graphics/cg/PatternCG.cpp:
-        * platform/graphics/cg/TransformationMatrixCG.cpp:
-        * platform/graphics/efl/IconEfl.cpp:
-        * platform/graphics/efl/ImageEfl.cpp:
-        * platform/graphics/filters/FilterOperation.cpp:
-        * platform/graphics/filters/FilterOperation.h:
-        * platform/graphics/filters/FilterOperations.cpp:
-        * platform/graphics/filters/FilterOperations.h:
-        * platform/graphics/freetype/FontPlatformDataFreeType.cpp:
-        * platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp:
-        * platform/graphics/freetype/SimpleFontDataFreeType.cpp:
-        * platform/graphics/gpu/mac/DrawingBufferMac.mm:
-        * platform/graphics/gtk/GdkCairoUtilities.cpp:
-        * platform/graphics/gtk/GdkCairoUtilities.h:
-        * platform/graphics/gtk/IconGtk.cpp:
-        * platform/graphics/gtk/ImageGtk.cpp:
-        * platform/graphics/ios/DisplayRefreshMonitorIOS.mm:
-        * platform/graphics/ios/FontCacheIOS.mm:
-        * platform/graphics/ios/GraphicsContext3DIOS.h:
-        * platform/graphics/ios/InbandTextTrackPrivateAVFIOS.h:
-        * platform/graphics/ios/InbandTextTrackPrivateAVFIOS.mm:
-        * platform/graphics/ios/MediaPlayerPrivateIOS.h:
-        * platform/graphics/ios/MediaPlayerPrivateIOS.mm:
-        * platform/graphics/mac/ColorMac.h:
-        * platform/graphics/mac/ColorMac.mm:
-        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
-        * platform/graphics/mac/FloatPointMac.mm:
-        * platform/graphics/mac/FloatRectMac.mm:
-        * platform/graphics/mac/FloatSizeMac.mm:
-        * platform/graphics/mac/FontCacheMac.mm:
-        * platform/graphics/mac/FontCustomPlatformData.h:
-        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
</del><ins>+        * platform/graphics/clutter/PlatformClutterAnimation.cpp:
+        * platform/graphics/filters/ValidatedCustomFilterOperation.cpp:
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
</ins><span class="cx">         * platform/graphics/mac/GraphicsContext3DMac.mm:
</span><del>-        * platform/graphics/mac/GraphicsContextMac.mm:
-        * platform/graphics/mac/ImageMac.mm:
-        * platform/graphics/mac/IntPointMac.mm:
-        * platform/graphics/mac/IntRectMac.mm:
-        * platform/graphics/mac/IntSizeMac.mm:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
</del><span class="cx">         * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
</span><del>-        * platform/graphics/mac/MediaPlayerProxy.h:
-        * platform/graphics/mac/WebCoreCALayerExtras.h:
-        * platform/graphics/mac/WebCoreCALayerExtras.mm:
-        * platform/graphics/mac/WebGLLayer.h:
</del><ins>+        * platform/graphics/mac/SimpleFontDataMac.mm:
</ins><span class="cx">         * platform/graphics/mac/WebGLLayer.mm:
</span><del>-        * platform/graphics/mac/WebLayer.h:
</del><span class="cx">         * platform/graphics/mac/WebLayer.mm:
</span><del>-        * platform/graphics/mac/WebTiledLayer.h:
</del><span class="cx">         * platform/graphics/mac/WebTiledLayer.mm:
</span><span class="cx">         * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
</span><span class="cx">         * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
</span><del>-        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
-        * platform/graphics/opentype/OpenTypeUtilities.cpp:
-        * platform/graphics/opentype/OpenTypeUtilities.h:
-        * platform/graphics/transforms/AffineTransform.cpp:
-        * platform/graphics/transforms/AffineTransform.h:
-        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
-        * platform/graphics/transforms/Matrix3DTransformOperation.h:
-        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
-        * platform/graphics/transforms/PerspectiveTransformOperation.h:
-        * platform/graphics/transforms/TransformState.cpp:
-        * platform/graphics/transforms/TransformState.h:
-        * platform/graphics/transforms/TransformationMatrix.cpp:
-        * platform/graphics/transforms/TransformationMatrix.h:
-        * platform/graphics/win/FontCGWin.cpp:
-        * platform/graphics/win/FontCacheWin.cpp:
-        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
-        * platform/graphics/win/FontWin.cpp:
-        * platform/graphics/win/FullScreenController.cpp:
-        * platform/graphics/win/FullScreenController.h:
-        * platform/graphics/win/FullScreenControllerClient.h:
-        * platform/graphics/win/GlyphPageTreeNodeCGWin.cpp:
-        * platform/graphics/win/GlyphPageTreeNodeCairoWin.cpp:
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        * platform/graphics/win/GraphicsContextCairoWin.cpp:
-        * platform/graphics/win/GraphicsContextWin.cpp:
-        * platform/graphics/win/ImageCGWin.cpp:
-        * platform/graphics/win/ImageCairoWin.cpp:
-        * platform/graphics/win/ImageWin.cpp:
-        * platform/graphics/win/IntPointWin.cpp:
-        * platform/graphics/win/IntRectWin.cpp:
-        * platform/graphics/win/IntSizeWin.cpp:
-        * platform/graphics/win/LocalWindowsContext.h:
-        * platform/graphics/win/MediaPlayerPrivateTaskTimer.cpp:
-        * platform/graphics/win/MediaPlayerPrivateTaskTimer.h:
-        * platform/graphics/win/SimpleFontDataCGWin.cpp:
-        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
-        * platform/graphics/win/SimpleFontDataWin.cpp:
-        * platform/graphics/win/TransformationMatrixWin.cpp:
-        * platform/graphics/wince/FontCacheWinCE.cpp:
-        * platform/graphics/wince/FontWinCE.cpp:
-        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
-        * platform/graphics/wince/SimpleFontDataWinCE.cpp:
-        * platform/gtk/CompositionResults.h:
-        * platform/gtk/CursorGtk.cpp:
-        * platform/gtk/GtkPluginWidget.cpp:
-        * platform/gtk/GtkPluginWidget.h:
-        * platform/gtk/LocalizedStringsGtk.cpp:
-        * platform/gtk/MIMETypeRegistryGtk.cpp:
-        * platform/gtk/PlatformKeyboardEventGtk.cpp:
-        * platform/gtk/PlatformMouseEventGtk.cpp:
-        * platform/gtk/PlatformScreenGtk.cpp:
-        * platform/gtk/PlatformWheelEventGtk.cpp:
-        * platform/gtk/RedirectedXCompositeWindow.cpp:
-        * platform/gtk/RedirectedXCompositeWindow.h:
-        * platform/gtk/RenderThemeGtk.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/gtk/SharedTimerGtk.cpp:
-        * platform/gtk/TemporaryLinkStubs.cpp:
-        * platform/gtk/UserAgentGtk.cpp:
-        * platform/gtk/UserAgentGtk.h:
-        * platform/gtk/WidgetGtk.cpp:
-        * platform/gtk/WidgetRenderingContext.cpp:
-        * platform/image-decoders/ImageDecoder.h:
-        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-        * platform/image-decoders/gif/GIFImageReader.cpp:
-        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        * platform/image-decoders/png/PNGImageDecoder.cpp:
-        * platform/image-decoders/png/PNGImageDecoder.h:
-        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
-        * platform/image-decoders/webp/WEBPImageDecoder.h:
-        * platform/ios/CursorIOS.cpp:
-        * platform/ios/DragImageIOS.mm:
-        * platform/ios/KeyEventCodesIOS.h:
-        * platform/ios/KeyEventIOS.mm:
-        * platform/ios/PlatformPasteboardIOS.mm:
-        * platform/ios/PlatformScreenIOS.mm:
-        * platform/ios/PlatformSpeechSynthesizerIOS.mm:
-        * platform/ios/RemoteCommandListenerIOS.h:
-        * platform/ios/RemoteCommandListenerIOS.mm:
-        * platform/ios/ScrollViewIOS.mm:
-        * platform/ios/SoundIOS.mm:
-        * platform/ios/SystemMemory.h:
-        * platform/ios/SystemMemoryIOS.cpp:
-        * platform/ios/WebCoreSystemInterfaceIOS.h:
-        * platform/ios/WebCoreSystemInterfaceIOS.mm:
-        * platform/ios/WidgetIOS.mm:
-        * platform/mac/BlockExceptions.h:
-        * platform/mac/BlockExceptions.mm:
-        * platform/mac/ContextMenuItemMac.mm:
-        * platform/mac/ContextMenuMac.mm:
-        * platform/mac/CursorMac.mm:
-        * platform/mac/DragDataMac.mm:
-        * platform/mac/DragImageMac.mm:
-        * platform/mac/FileSystemMac.mm:
-        * platform/mac/KeyEventMac.mm:
-        * platform/mac/LocalCurrentGraphicsContext.h:
-        * platform/mac/LocalCurrentGraphicsContext.mm:
-        * platform/mac/LoggingMac.mm:
-        * platform/mac/MIMETypeRegistryMac.mm:
-        * platform/mac/MediaTimeMac.cpp:
-        * platform/mac/MediaTimeMac.h:
</del><ins>+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        * platform/graphics/texmap/TextureMapper.h:
+        * platform/graphics/wince/ImageBufferWinCE.cpp:
</ins><span class="cx">         * platform/mac/PasteboardMac.mm:
</span><del>-        * platform/mac/PlatformClockCA.cpp:
-        * platform/mac/PlatformClockCA.h:
-        * platform/mac/PlatformClockCM.h:
-        * platform/mac/PlatformClockCM.mm:
-        * platform/mac/PlatformPasteboardMac.mm:
-        * platform/mac/PlatformScreenMac.mm:
-        * platform/mac/PlatformSpeechSynthesisMac.mm:
-        * platform/mac/PlatformSpeechSynthesizerMac.mm:
</del><ins>+        * platform/mac/ScrollAnimatorMac.mm:
</ins><span class="cx">         * platform/mac/ScrollViewMac.mm:
</span><del>-        * platform/mac/SharedBufferMac.mm:
</del><ins>+        * platform/mac/ScrollbarThemeMac.mm:
</ins><span class="cx">         * platform/mac/SharedTimerMac.mm:
</span><del>-        * platform/mac/SoftLinking.h:
-        * platform/mac/SoundMac.mm:
-        * platform/mac/ThreadCheck.mm:
-        * platform/mac/URLMac.mm:
-        * platform/mac/WebCoreNSStringExtras.h:
-        * platform/mac/WebCoreNSStringExtras.mm:
-        * platform/mac/WebCoreNSURLExtras.h:
-        * platform/mac/WebCoreNSURLExtras.mm:
-        * platform/mac/WebCoreObjCExtras.h:
</del><ins>+        * platform/mac/WebCoreFullScreenPlaceholderView.mm:
</ins><span class="cx">         * platform/mac/WebCoreObjCExtras.mm:
</span><del>-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-        * platform/mac/WebCoreView.h:
-        * platform/mac/WebCoreView.m:
-        * platform/mac/WebFontCache.h:
</del><span class="cx">         * platform/mac/WebFontCache.mm:
</span><del>-        * platform/mac/WebWindowAnimation.h:
</del><ins>+        * platform/mac/WebVideoFullscreenController.mm:
+        * platform/mac/WebVideoFullscreenHUDWindowController.mm:
</ins><span class="cx">         * platform/mac/WebWindowAnimation.mm:
</span><del>-        * platform/mac/WidgetMac.mm:
-        * platform/mediastream/MediaStreamConstraintsValidationClient.h:
-        * platform/mediastream/MediaStreamCreationClient.h:
-        * platform/mediastream/MediaStreamSourceCapabilities.h:
-        * platform/mediastream/MediaStreamSourceStates.h:
-        * platform/mediastream/MediaStreamTrackSourcesRequestClient.h:
-        * platform/mediastream/RTCIceServer.h:
-        * platform/mediastream/mac/AVAudioCaptureSource.h:
-        * platform/mediastream/mac/AVAudioCaptureSource.mm:
-        * platform/mediastream/mac/AVCaptureDeviceManager.h:
-        * platform/mediastream/mac/AVCaptureDeviceManager.mm:
-        * platform/mediastream/mac/AVMediaCaptureSource.h:
-        * platform/mediastream/mac/AVMediaCaptureSource.mm:
-        * platform/mediastream/mac/AVVideoCaptureSource.h:
-        * platform/mediastream/mac/AVVideoCaptureSource.mm:
-        * platform/mock/MockMediaStreamCenter.cpp:
-        * platform/mock/MockMediaStreamCenter.h:
-        * platform/mock/PlatformSpeechSynthesizerMock.cpp:
-        * platform/mock/PlatformSpeechSynthesizerMock.h:
-        * platform/mock/mediasource/MockBox.cpp:
-        * platform/mock/mediasource/MockBox.h:
-        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
-        * platform/mock/mediasource/MockMediaPlayerMediaSource.h:
-        * platform/mock/mediasource/MockMediaSourcePrivate.cpp:
-        * platform/mock/mediasource/MockMediaSourcePrivate.h:
-        * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
-        * platform/mock/mediasource/MockSourceBufferPrivate.h:
-        * platform/mock/mediasource/MockTracks.cpp:
-        * platform/mock/mediasource/MockTracks.h:
-        * platform/network/AuthenticationChallengeBase.cpp:
-        * platform/network/AuthenticationChallengeBase.h:
-        * platform/network/Credential.cpp:
-        * platform/network/Credential.h:
-        * platform/network/DNS.h:
-        * platform/network/DNSResolveQueue.cpp:
-        * platform/network/DNSResolveQueue.h:
-        * platform/network/DataURL.cpp:
-        * platform/network/DataURL.h:
-        * platform/network/HTTPHeaderMap.h:
-        * platform/network/HTTPParsers.cpp:
-        * platform/network/HTTPParsers.h:
-        * platform/network/PlatformCookieJar.h:
-        * platform/network/ProtectionSpace.cpp:
-        * platform/network/ProtectionSpace.h:
-        * platform/network/ResourceErrorBase.cpp:
-        * platform/network/ResourceErrorBase.h:
-        * platform/network/ResourceHandle.cpp:
-        * platform/network/ResourceHandle.h:
-        * platform/network/ResourceHandleClient.h:
-        * platform/network/ResourceHandleInternal.h:
-        * platform/network/ResourceRequestBase.cpp:
-        * platform/network/ResourceRequestBase.h:
-        * platform/network/ResourceResponseBase.cpp:
-        * platform/network/ResourceResponseBase.h:
-        * platform/network/cf/AuthenticationCF.cpp:
-        * platform/network/cf/AuthenticationCF.h:
-        * platform/network/cf/AuthenticationChallenge.h:
-        * platform/network/cf/CookieJarCFNet.cpp:
-        * platform/network/cf/CookieStorageCFNet.cpp:
-        * platform/network/cf/DNSCFNet.cpp:
-        * platform/network/cf/DownloadBundle.h:
-        * platform/network/cf/FormDataStreamCFNet.cpp:
-        * platform/network/cf/FormDataStreamCFNet.h:
-        * platform/network/cf/ResourceError.h:
</del><ins>+        * platform/network/blackberry/CredentialStorageBlackBerry.cpp:
</ins><span class="cx">         * platform/network/cf/ResourceErrorCF.cpp:
</span><del>-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.cpp:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.h:
-        * platform/network/cf/ResourceRequest.h:
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        * platform/network/cf/ResourceRequestCFNet.h:
-        * platform/network/cf/ResourceResponse.h:
-        * platform/network/cf/ResourceResponseCFNet.cpp:
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/curl/AuthenticationChallenge.h:
-        * platform/network/curl/CurlDownload.cpp:
-        * platform/network/curl/CurlDownload.h:
-        * platform/network/curl/DNSCurl.cpp:
-        * platform/network/curl/DownloadBundle.h:
-        * platform/network/curl/FormDataStreamCurl.cpp:
-        * platform/network/curl/FormDataStreamCurl.h:
-        * platform/network/curl/ResourceError.h:
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        * platform/network/curl/ResourceHandleManager.cpp:
-        * platform/network/curl/ResourceHandleManager.h:
-        * platform/network/curl/ResourceRequest.h:
-        * platform/network/curl/ResourceResponse.h:
-        * platform/network/curl/SSLHandle.cpp:
-        * platform/network/curl/SSLHandle.h:
-        * platform/network/gtk/CredentialBackingStore.cpp:
-        * platform/network/gtk/CredentialBackingStore.h:
-        * platform/network/ios/WebCoreURLResponseIOS.h:
-        * platform/network/ios/WebCoreURLResponseIOS.mm:
-        * platform/network/mac/AuthenticationMac.h:
-        * platform/network/mac/AuthenticationMac.mm:
-        * platform/network/mac/CookieJarMac.mm:
</del><span class="cx">         * platform/network/mac/CookieStorageMac.mm:
</span><del>-        * platform/network/mac/FormDataStreamMac.h:
-        * platform/network/mac/FormDataStreamMac.mm:
-        * platform/network/mac/ResourceErrorMac.mm:
</del><span class="cx">         * platform/network/mac/ResourceHandleMac.mm:
</span><del>-        * platform/network/mac/ResourceRequestMac.mm:
-        * platform/network/mac/ResourceResponseMac.mm:
-        * platform/network/mac/WebCoreURLResponse.h:
-        * platform/network/mac/WebCoreURLResponse.mm:
-        * platform/network/soup/AuthenticationChallenge.h:
-        * platform/network/soup/AuthenticationChallengeSoup.cpp:
-        * platform/network/soup/CookieJarSoup.h:
-        * platform/network/soup/DNSSoup.cpp:
-        * platform/network/soup/ResourceError.h:
-        * platform/network/soup/ResourceErrorSoup.cpp:
-        * platform/network/soup/ResourceRequest.h:
-        * platform/network/soup/ResourceResponse.h:
-        * platform/network/soup/SoupNetworkSession.cpp:
-        * platform/network/soup/SoupNetworkSession.h:
-        * platform/network/win/CookieJarWin.cpp:
-        * platform/network/win/DownloadBundleWin.cpp:
-        * platform/network/win/ResourceError.h:
</del><span class="cx">         * platform/network/win/ResourceHandleWin.cpp:
</span><del>-        * platform/network/win/ResourceRequest.h:
-        * platform/network/win/ResourceResponse.h:
-        * platform/posix/FileSystemPOSIX.cpp:
-        * platform/posix/SharedBufferPOSIX.cpp:
-        * platform/soup/URLSoup.cpp:
-        * platform/sql/SQLValue.cpp:
-        * platform/sql/SQLValue.h:
-        * platform/sql/SQLiteAuthorizer.cpp:
-        * platform/sql/SQLiteDatabase.cpp:
-        * platform/sql/SQLiteDatabase.h:
-        * platform/sql/SQLiteStatement.cpp:
-        * platform/sql/SQLiteStatement.h:
-        * platform/sql/SQLiteTransaction.cpp:
-        * platform/sql/SQLiteTransaction.h:
-        * platform/text/SuffixTree.h:
-        * platform/text/TextAllInOne.cpp:
-        * platform/text/TextBoundaries.cpp:
-        * platform/text/TextBoundaries.h:
-        * platform/text/TextCodec.cpp:
-        * platform/text/TextCodec.h:
-        * platform/text/TextCodecASCIIFastPath.h:
-        * platform/text/TextCodecICU.cpp:
-        * platform/text/TextCodecICU.h:
-        * platform/text/TextCodecLatin1.cpp:
-        * platform/text/TextCodecLatin1.h:
-        * platform/text/TextCodecUTF16.cpp:
-        * platform/text/TextCodecUTF16.h:
-        * platform/text/TextCodecUTF8.cpp:
-        * platform/text/TextCodecUTF8.h:
-        * platform/text/TextCodecUserDefined.cpp:
-        * platform/text/TextCodecUserDefined.h:
-        * platform/text/TextDirection.h:
-        * platform/text/TextEncoding.cpp:
-        * platform/text/TextEncoding.h:
-        * platform/text/TextEncodingRegistry.cpp:
-        * platform/text/TextEncodingRegistry.h:
-        * platform/text/TextStream.cpp:
-        * platform/text/TextStream.h:
-        * platform/text/UnicodeBidi.h:
-        * platform/text/mac/CharsetData.h:
-        * platform/text/mac/TextBoundaries.mm:
-        * platform/text/mac/TextCodecMac.cpp:
-        * platform/text/mac/TextCodecMac.h:
-        * platform/text/mac/character-sets.txt:
-        * platform/text/mac/make-charset-table.pl:
-        * platform/text/win/TextCodecWin.h:
-        * platform/win/BString.cpp:
-        * platform/win/BString.h:
-        * platform/win/COMPtr.h:
-        * platform/win/ClipboardUtilitiesWin.cpp:
-        * platform/win/ClipboardUtilitiesWin.h:
-        * platform/win/ContextMenuItemWin.cpp:
-        * platform/win/ContextMenuWin.cpp:
-        * platform/win/CursorWin.cpp:
-        * platform/win/DragDataWin.cpp:
-        * platform/win/DragImageCGWin.cpp:
-        * platform/win/DragImageCairoWin.cpp:
-        * platform/win/DragImageWin.cpp:
-        * platform/win/FileSystemWin.cpp:
-        * platform/win/GDIObjectCounter.cpp:
-        * platform/win/GDIObjectCounter.h:
-        * platform/win/HWndDC.h:
-        * platform/win/KeyEventWin.cpp:
-        * platform/win/LanguageWin.cpp:
-        * platform/win/MIMETypeRegistryWin.cpp:
-        * platform/win/PasteboardWin.cpp:
-        * platform/win/PlatformMouseEventWin.cpp:
-        * platform/win/PlatformScreenWin.cpp:
-        * platform/win/SharedBufferWin.cpp:
-        * platform/win/SharedTimerWin.cpp:
-        * platform/win/SoftLinking.h:
-        * platform/win/SoundWin.cpp:
-        * platform/win/StructuredExceptionHandlerSuppressor.cpp:
-        * platform/win/TemporaryLinkStubs.cpp:
-        * platform/win/WCDataObject.cpp:
-        * platform/win/WCDataObject.h:
-        * platform/win/WebCoreTextRenderer.cpp:
-        * platform/win/WebCoreTextRenderer.h:
-        * platform/win/WheelEventWin.cpp:
-        * platform/win/WidgetWin.cpp:
-        * platform/win/WindowMessageBroadcaster.cpp:
-        * platform/win/WindowMessageBroadcaster.h:
-        * platform/win/WindowMessageListener.h:
-        * platform/win/WindowsTouch.h:
-        * platform/win/makesafeseh.asm:
-        * plugins/PluginDatabase.cpp:
-        * plugins/PluginDatabase.h:
-        * plugins/PluginDebug.cpp:
-        * plugins/PluginDebug.h:
-        * plugins/PluginPackage.cpp:
-        * plugins/PluginPackage.h:
-        * plugins/PluginQuirkSet.h:
-        * plugins/PluginStream.cpp:
-        * plugins/PluginStream.h:
-        * plugins/PluginView.cpp:
-        * plugins/PluginView.h:
-        * plugins/efl/PluginPackageEfl.cpp:
-        * plugins/efl/PluginViewEfl.cpp:
-        * plugins/gtk/PluginPackageGtk.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/mac/PluginPackageMac.cpp:
-        * plugins/mac/PluginViewMac.mm:
-        * plugins/npapi.cpp:
-        * plugins/npfunctions.h:
-        * plugins/npruntime.h:
-        * plugins/win/PluginDatabaseWin.cpp:
-        * plugins/win/PluginPackageWin.cpp:
-        * plugins/win/PluginViewWin.cpp:
-        * plugins/x11/PluginViewX11.cpp:
-        * rendering/EllipsisBox.cpp:
-        * rendering/EllipsisBox.h:
-        * rendering/FilterEffectRenderer.cpp:
-        * rendering/FilterEffectRenderer.h:
-        * rendering/HitTestLocation.h:
-        * rendering/HitTestRequest.h:
-        * rendering/HitTestResult.h:
-        * rendering/HitTestingTransformState.cpp:
-        * rendering/HitTestingTransformState.h:
-        * rendering/RenderBoxRegionInfo.h:
-        * rendering/RenderButton.cpp:
-        * rendering/RenderButton.h:
-        * rendering/RenderDeprecatedFlexibleBox.cpp:
-        * rendering/RenderDeprecatedFlexibleBox.h:
-        * rendering/RenderFieldset.cpp:
-        * rendering/RenderFrameBase.cpp:
-        * rendering/RenderFrameBase.h:
-        * rendering/RenderFrameSet.cpp:
-        * rendering/RenderGeometryMap.cpp:
-        * rendering/RenderGeometryMap.h:
-        * rendering/RenderGrid.cpp:
-        * rendering/RenderGrid.h:
-        * rendering/RenderHTMLCanvas.cpp:
-        * rendering/RenderHTMLCanvas.h:
-        * rendering/RenderIFrame.cpp:
-        * rendering/RenderIFrame.h:
-        * rendering/RenderLayerBacking.cpp:
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        * rendering/RenderLayerCompositor.h:
-        * rendering/RenderLineBoxList.cpp:
-        * rendering/RenderLineBoxList.h:
-        * rendering/RenderListBox.cpp:
-        * rendering/RenderListBox.h:
-        * rendering/RenderMarquee.h:
-        * rendering/RenderMedia.cpp:
-        * rendering/RenderMedia.h:
-        * rendering/RenderMultiColumnFlowThread.cpp:
-        * rendering/RenderMultiColumnFlowThread.h:
-        * rendering/RenderMultiColumnSet.cpp:
-        * rendering/RenderMultiColumnSet.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        * rendering/RenderNamedFlowThread.h:
-        * rendering/RenderRegionSet.cpp:
-        * rendering/RenderRegionSet.h:
-        * rendering/RenderReplica.cpp:
-        * rendering/RenderReplica.h:
-        * rendering/RenderTheme.cpp:
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeWin.h:
-        * rendering/RenderThemeWinCE.cpp:
-        * rendering/RenderThemeWinCE.h:
</del><ins>+        * platform/text/TextEncodingDetectorICU.cpp:
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderObject.cpp:
</ins><span class="cx">         * rendering/RenderTreeAsText.cpp:
</span><del>-        * rendering/RenderTreeAsText.h:
-        * rendering/RenderVTTCue.cpp:
-        * rendering/RenderVTTCue.h:
-        * rendering/RenderVideo.cpp:
-        * rendering/RenderVideo.h:
-        * rendering/RenderView.h:
-        * rendering/style/SVGRenderStyle.cpp:
-        * rendering/style/SVGRenderStyle.h:
-        * rendering/style/SVGRenderStyleDefs.cpp:
-        * rendering/style/SVGRenderStyleDefs.h:
-        * rendering/style/StyleFilterData.cpp:
-        * rendering/style/StyleFilterData.h:
-        * rendering/style/StylePendingImage.h:
-        * rendering/svg/RenderSVGBlock.cpp:
-        * rendering/svg/RenderSVGBlock.h:
-        * rendering/svg/RenderSVGForeignObject.cpp:
-        * rendering/svg/RenderSVGForeignObject.h:
-        * rendering/svg/RenderSVGImage.cpp:
-        * rendering/svg/RenderSVGInline.h:
-        * rendering/svg/RenderSVGInlineText.cpp:
-        * rendering/svg/RenderSVGPath.h:
-        * rendering/svg/RenderSVGShape.h:
-        * rendering/svg/RenderSVGTSpan.h:
-        * rendering/svg/RenderSVGText.cpp:
-        * rendering/svg/RenderSVGText.h:
-        * rendering/svg/SVGInlineFlowBox.cpp:
-        * rendering/svg/SVGInlineFlowBox.h:
-        * rendering/svg/SVGRenderTreeAsText.cpp:
-        * rendering/svg/SVGRenderTreeAsText.h:
-        * rendering/svg/SVGRootInlineBox.cpp:
-        * rendering/svg/SVGRootInlineBox.h:
-        * storage/StorageEventDispatcher.h:
-        * svg/SVGException.cpp:
-        * svg/graphics/SVGImageChromeClient.h:
-        * workers/Worker.cpp:
-        * workers/Worker.h:
-        * workers/Worker.idl:
-        * workers/WorkerEventQueue.cpp:
-        * workers/WorkerEventQueue.h:
-        * workers/WorkerGlobalScope.cpp:
-        * workers/WorkerGlobalScope.h:
-        * workers/WorkerGlobalScope.idl:
-        * workers/WorkerLocation.cpp:
-        * workers/WorkerLocation.h:
-        * workers/WorkerLocation.idl:
-        * workers/WorkerMessagingProxy.cpp:
-        * workers/WorkerMessagingProxy.h:
</del><ins>+        * rendering/svg/RenderSVGResourceClipper.cpp:
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        * rendering/svg/RenderSVGResourceGradient.cpp:
+        * rendering/svg/RenderSVGResourceMasker.cpp:
+        * rendering/svg/SVGRenderSupport.cpp:
+        * rendering/svg/SVGTextLayoutEngineSpacing.cpp:
+        * workers/WorkerContext.cpp:
</ins><span class="cx">         * workers/WorkerScriptLoader.cpp:
</span><del>-        * workers/WorkerScriptLoader.h:
-        * workers/WorkerScriptLoaderClient.h:
-        * workers/WorkerThread.cpp:
-        * workers/WorkerThread.h:
-        * xml/DOMParser.h:
-        * xml/DOMParser.idl:
-        * xml/NativeXPathNSResolver.cpp:
-        * xml/NativeXPathNSResolver.h:
-        * xml/XMLHttpRequest.idl:
-        * xml/XMLHttpRequestException.cpp:
-        * xml/XMLHttpRequestException.h:
-        * xml/XMLHttpRequestException.idl:
-        * xml/XMLHttpRequestProgressEvent.h:
-        * xml/XMLHttpRequestProgressEvent.idl:
-        * xml/XMLHttpRequestUpload.idl:
-        * xml/XMLSerializer.h:
-        * xml/XMLSerializer.idl:
-        * xml/XPathEvaluator.cpp:
-        * xml/XPathEvaluator.h:
-        * xml/XPathEvaluator.idl:
-        * xml/XPathException.cpp:
-        * xml/XPathException.h:
-        * xml/XPathException.idl:
-        * xml/XPathExpression.idl:
-        * xml/XPathExpressionNode.cpp:
-        * xml/XPathNSResolver.cpp:
-        * xml/XPathNSResolver.h:
-        * xml/XPathNSResolver.idl:
-        * xml/XPathNodeSet.h:
-        * xml/XPathResult.idl:
-        * xml/XPathUtil.h:
-        * xml/XPathVariableReference.cpp:
-        * xml/XSLTProcessor.idl:
-        * xml/XSLTUnicodeSort.cpp:
-        * xml/XSLTUnicodeSort.h:
</del><ins>+        * xml/XMLHttpRequest.cpp:
+        * xml/parser/XMLDocumentParserLibxml2.cpp:
</ins><span class="cx"> 
</span><del>-2014-03-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix scrollperf logging
-        https://bugs.webkit.org/show_bug.cgi?id=130278
-        &lt;rdar://problem/16320003&gt;
</del><ins>+        [Mac] Move clearAllData from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116001
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
-        
-        r165493 broke scrollperf logging by adding in the scroll position
-        to the viewport rect, which used to be 0,0 based. Restore
-        the previous behavior.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::logExposedUnfilledArea):
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::clearAllData): Added. Calls through to Pasteboard after
+        doing the canWriteData check, which is part of DOM rules, not the platform.
</ins><span class="cx"> 
</span><del>-2014-03-14  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        * dom/Clipboard.h: Made clearAllData non-virtual in non-legacy case.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: border-radius painting falls back to rectangle at subpixel positions.
-        https://bugs.webkit.org/show_bug.cgi?id=130272
</del><ins>+        * platform/mac/ClipboardMac.h: Removed clearAllData.
+        * platform/mac/ClipboardMac.mm: Ditto.
</ins><span class="cx"> 
</span><del>-        Unreviewed. Missing piece from http://trac.webkit.org/changeset/165670
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/RoundedRect.cpp:
-        (WebCore::RoundedRect::pixelSnappedRoundedRectForPainting):
</del><ins>+        [Mac] Move clearData from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=116000
</ins><span class="cx"> 
</span><del>-2014-03-14  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: border-radius painting falls back to rectangle at subpixel positions.
-        https://bugs.webkit.org/show_bug.cgi?id=130272
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::clearData): Added. Calls through to Pasteboard after
+        doing the canWriteData check, which is part of DOM rules, not the platform.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * dom/Clipboard.h: Made clearData non-virtual in non-legacy case.
</ins><span class="cx"> 
</span><del>-        Rounded rectangle's radius needs adjustment after its containing rect gets pixel snapped.
-        Keeping the old radius value could make rounded rectangle non-renderable, because the
-        originally calculated radius length does not fit the snapped rectangle anymore.
</del><ins>+        * platform/Pasteboard.h: Added an overload of the clear function that takes
+        a single type and clears only that type. Also temporarily exported the
+        cocoaTypeFromHTMLClipboardType function as a static member so it can be used
+        in both ClipboardMac and PasteboardMac during the transition.
</ins><span class="cx"> 
</span><del>-        Test: fast/borders/hidpi-border-radius-outer-border-goes-rectangle.html
</del><ins>+        * platform/mac/ClipboardMac.h: Removed clearData.
+        * platform/mac/ClipboardMac.mm: Removed clearData.
+        (WebCore::ClipboardMac::getData): Changed to call cocoaTypeFromHTMLClipboardType
+        as a Pasteboard class static member function.
+        (WebCore::ClipboardMac::setData): Ditto.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/RoundedRect.cpp:
-        (WebCore::RoundedRect::pixelSnappedRoundedRectForPainting):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBorder):
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::cocoaTypeFromHTMLClipboardType): Moved here from
+        ClipboardMac.
+        (WebCore::Pasteboard::clear): Added. Moved here from ClipboardMac.
</ins><span class="cx"> 
</span><del>-2014-03-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-05-12  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] background-attachment: fixed renders oddly, moves around
-        https://bugs.webkit.org/show_bug.cgi?id=130277
-        &lt;rdar://problem/16332883&gt;
</del><ins>+        [Mac] Move hasData from ClipboardMac to PasteboardMac
+        https://bugs.webkit.org/show_bug.cgi?id=115999
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        If we have a counter-scrolling layer (for a fixed background), move
-        it around when changing the viewport.
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::hasData): Added. Calls through to Pasteboard.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::updateForViewport):
</del><ins>+        * dom/Clipboard.h: Added LEGACY_VIRTUAL and LEGACY_PURE macros,
+        only for within this header file. These help us keep many functions
+        as pure virtual in the legacy style Clipboard class, but have them
+        be non-virtual in the normal/future style. Use LEGACY_VIRTUAL and
+        LEGACY_PURE to make the hasData member non-virtual.
</ins><span class="cx"> 
</span><del>-2014-03-14  Jae Hyun Park  &lt;jaepark@webkit.org&gt;
</del><ins>+        * platform/Pasteboard.h: Added hasData, and added some blank lines and a FIXME.
</ins><span class="cx"> 
</span><del>-        [Texmap] Remove duplicated code in TextureMapperLayer
-        https://bugs.webkit.org/show_bug.cgi?id=130173
</del><ins>+        * platform/mac/ClipboardMac.h: Removed hasData override.
+        * platform/mac/ClipboardMac.mm: Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::hasData): Added. Moved code here from ClipboardMac.
</ins><span class="cx"> 
</span><del>-        This patch is a simple refactoring to remove duplicated code in
-        TextureMapperLayer.
</del><ins>+2013-05-12  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/texmap/TextureMapperLayer.cpp:
-        (WebCore::TextureMapperLayer::~TextureMapperLayer):
-        (WebCore::TextureMapperLayer::removeFromParent):
</del><ins>+        BUILD FIX (r149971): sudden termination is a Mac-only concept
</ins><span class="cx"> 
</span><del>-2014-03-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * WebCore.exp.in: Move sudden termination symbols to Mac-only
+        section.
</ins><span class="cx"> 
</span><del>-        Release-assert if someone starts the WebThread in the WebProcess
-        https://bugs.webkit.org/show_bug.cgi?id=130270
-        &lt;rdar://problem/16332380&gt;
</del><ins>+2013-05-12  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Node: Use FINAL instead of the non-virtual shadowing hack.
+        &lt;http://webkit.org/b/115995&gt;
</ins><span class="cx"> 
</span><del>-        If someone tries to start the WebThread in the WebProcess, assert,
-        even in release builds, because this should never happen.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * platform/ios/wak/WebCoreThread.mm:
-        (WebThreadEnable):
</del><ins>+        Decorate Element/Attr implementations of prefix/localName/namespaceURI getters with FINAL
+        so that call sites with a more specific pointer type than Node* can avoid the virtual dispatch.
</ins><span class="cx"> 
</span><del>-2014-03-14  Peter Molnar  &lt;pmolnar.u-szeged@partner.samsung.com&gt;
</del><ins>+        * dom/Attr.h:
+        * dom/Element.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
</ins><span class="cx"> 
</span><del>-        Clean up unused externs from WebCore logging.
-        https://bugs.webkit.org/show_bug.cgi?id=130240
</del><ins>+2013-05-11  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><ins>+        [Mac] Give every Clipboard an underlying Pasteboard
+        https://bugs.webkit.org/show_bug.cgi?id=115979
+
</ins><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        * platform/Logging.h:
</del><ins>+        This is the first step in Clipboard and Pasteboard refactoring
+        to fix the overlap and many layering violations.
</ins><span class="cx"> 
</span><del>-2014-03-14  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard): Add an m_pasteboard data member,
+        Mac-only for now, but eventually for all platforms.
+        (WebCore::Clipboard::~Clipboard): No longer inline the destructor.
</ins><span class="cx"> 
</span><del>-        AX: AccessibilityObject::invalidStatus() is incorrect when aria-invalid=&quot;undefined&quot; or whitespace
-        https://bugs.webkit.org/show_bug.cgi?id=130071
</del><ins>+        * dom/Clipboard.h: Add WTF_USE_LEGACY_STYLE_ABSTRACT_CLIPBOARD_CLASS
+        flag, currently true for all non-Mac platforms. Make the constructor
+        no longer inline. Added a PassOwnPtr&lt;Pasteboard&gt; argument to the
+        constructor and an OwnPtr&lt;Pasteboard&gt; data member.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        * platform/Pasteboard.h: Added a create function to make it easy
+        to create a pasteboard given a pasteboard name.
</ins><span class="cx"> 
</span><del>-        Accounted for whitespace values and the explicit string, &quot;undefined&quot;.
</del><ins>+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::ClipboardMac): Create a pasteboard and pass
+        it to the Clipboard constructor.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/aria-invalid.html
</del><ins>+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::create): Added.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::invalidStatus):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
-        (getAttributeSetForAccessibilityObject):
</del><ins>+2013-05-12  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-14  Bear Travis  &lt;betravis@adobe.com&gt;
</del><ins>+        Unload event listeners should prevent Safari from insta-killing the web process on last tab close.
+        &lt;http://webkit.org/b/115988&gt;
+        &lt;rdar://problem/13870943&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] CSS parser accepts trailing position arguments
-        https://bugs.webkit.org/show_bug.cgi?id=129514
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Add two methods to Chrome (and ChromeClient):
</ins><span class="cx"> 
</span><del>-        Add a check to make sure there are no remaining function args
-        following a position in the circle() and ellipse() css shape
-        functions.
</del><ins>+            - enableSuddenTermination()
+            - disableSuddenTermination()
</ins><span class="cx"> 
</span><del>-        Updated existing parsing tests.
</del><ins>+        ..and call these from DOMWindow instead of the free global functions.
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseBasicShapeCircle):
-        (WebCore::CSSParser::parseBasicShapeEllipse):
</del><ins>+        For WebKit1, it just calls the NSProcessInfo methods to keep behavior the same.
+        For WebKit2, the new methods plumb through the information to the UI process.
</ins><span class="cx"> 
</span><del>-2014-03-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Also updated the DOMWindow logic to think in terms of per-DOMWindow sudden termination counters
+        instead of a process-global one, since that gets confusing in a WK2 world.
+        When a DOMWindow transitions between having/not having unload/beforeunload event listeners,
+        we send a notification to the Chrome.
</ins><span class="cx"> 
</span><del>-        Fix the iOS build and sort the exports file.
-
</del><span class="cx">         * WebCore.exp.in:
</span><ins>+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Chrome.h:
+        (WebCore::Chrome::enableSuddenTermination):
+        (WebCore::Chrome::disableSuddenTermination):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::enableSuddenTermination):
+        (WebCore::ChromeClient::disableSuddenTermination):
+        * page/DOMWindow.cpp:
+        (WebCore::addUnloadEventListener):
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::addBeforeUnloadEventListener):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::enableSuddenTermination):
+        (WebCore::DOMWindow::disableSuddenTermination):
+        * page/DOMWindow.h:
+        (DOMWindow):
</ins><span class="cx"> 
</span><del>-2014-03-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-05-12  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Improve behavior of fixed elments on zooming
-        https://bugs.webkit.org/show_bug.cgi?id=130253
</del><ins>+        Remove Complex.h from WTF
+        https://bugs.webkit.org/show_bug.cgi?id=115989
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Beth Dakin.
</span><span class="cx"> 
</span><del>-        Correctly reposition right- and bottom-relative position:fixed
-        elements on zooming in WK2 iOS by telling the scrolling tree
-        about zoom-related viewport changes.
</del><ins>+        Replace Complex declarations with std::complex&lt;double&gt;. Pass by value since the struct
+        is small enough to go into two registers on X86-64.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::rectForViewportConstrainedObjects):
-        (WebCore::FrameView::viewportConstrainedObjectsRect): We need to be able to
-        recompute the fixed position rect from the scrolling tree on iOS, so we need
-        a static function, similar to scrollOffsetForFixedPosition(), that computes
-        the constrained viewport.
-        * page/FrameView.h:
-        * page/Page.cpp:
-        (WebCore::Page::setPageScaleFactor): When scrolling (and, by implication, zooming)
-        is delegated, then setPageScaleFactor() should not affect the scroll position.
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated): Go back to just
-        passing the visibleContentRect() for iOS.
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::viewportChangedViaDelegatedScrolling): Entrypoint to
-        the scrolling tree, called when the viewport is changed by zooming.
-        * page/scrolling/ScrollingTree.h:
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h:
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::setScrollLayerPosition): Use the
-        new FrameView::rectForViewportConstrainedObjects() to compute the correct viewport
-        for fixed/sticky child nodes.
-        (WebCore::ScrollingTreeScrollingNodeIOS::updateForViewport):
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::updateForViewport):
</del><ins>+        * Modules/webaudio/RealtimeAnalyser.cpp:
+        (WebCore::RealtimeAnalyser::doFFTAnalysis):
+        (WebCore::RealtimeAnalyser::getFloatFrequencyData):
+        (WebCore::RealtimeAnalyser::getByteFrequencyData):
+        (WebCore::RealtimeAnalyser::getByteTimeDomainData):
+        * platform/audio/Biquad.cpp:
+        (WebCore::Biquad::setZeroPolePairs):
+        (WebCore::Biquad::setAllpassPole):
+        (WebCore::Biquad::getFrequencyResponse):
+        * platform/audio/Biquad.h:
+        * platform/audio/FFTFrame.cpp:
+        (WebCore::FFTFrame::interpolateFrequencyComponents):
+        (WebCore::FFTFrame::extractAverageGroupDelay):
+        (WebCore::FFTFrame::addConstantGroupDelay):
</ins><span class="cx"> 
</span><del>-2014-03-14  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+2013-05-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Refactor Path to Path2D and remove currentPath
-        https://bugs.webkit.org/show_bug.cgi?id=130236
</del><ins>+        Dropdowns on http://www.exploratorium.edu don't show anything
+        https://bugs.webkit.org/show_bug.cgi?id=115991
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Dan Bernstein.
+        
+        We can't optimize away the backing store of a layer by saying that
+        it paints into a composited ancestor if its composited bounds are not contained
+        by that ancestor.
</ins><span class="cx"> 
</span><del>-        Other implementations prefer Path2D over Path. Furthermore, currentPath is not the right
-        way to apply a Path2D object to a context. Main argument is that currentPath creates a copy
-        of the Path2D object. Instead we pass Path2D as argument to fill, stroke and clip now.
</del><ins>+        Test: compositing/backing/no-backing-for-clip-overhang.html
</ins><span class="cx"> 
</span><del>-        Tests: fast/canvas/canvas-clip-path.html
-               fast/canvas/canvas-fill-path.html
-               fast/canvas/canvas-stroke-path.html
</del><ins>+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Pass in our 
+        previously computed composited bounds relative to our composited ancestor,
+        and its composited bounds.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresOwnBackingStore): If the ancestor's
+        composited bounds don't contain the layer's composited bounds, the layer
+        needs its own backing store.
+        * rendering/RenderLayerCompositor.h:
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm: WebIDL parser didn't handle enumerations
-            for overloaded methods at all.
-        (GenerateParametersCheckExpression):
-        * html/canvas/CanvasRenderingContext2D.cpp: New functions with DOMPath argument.
-        (WebCore::CanvasRenderingContext2D::fill):
-        (WebCore::CanvasRenderingContext2D::stroke):
-        (WebCore::CanvasRenderingContext2D::clip):
-        (WebCore::CanvasRenderingContext2D::fillInternal): Internal method to avoid code duplication
-            and copy operation.
-        (WebCore::CanvasRenderingContext2D::strokeInternal): Ditto.
-        (WebCore::CanvasRenderingContext2D::clipInternal): Ditto.
-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/CanvasRenderingContext2D.idl:
-        * html/canvas/DOMPath.idl: Rename Path to Path2D.
</del><ins>+2013-05-12  Commit Queue  &lt;commit-queue@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-14  Grzegorz Czajkowski  &lt;g.czajkowski@samsung.com&gt;
</del><ins>+        Unreviewed, rolling out r149955.
+        http://trac.webkit.org/changeset/149955
+        https://bugs.webkit.org/show_bug.cgi?id=115990
</ins><span class="cx"> 
</span><del>-        ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder should take a const reference to InsertedNodes
-        https://bugs.webkit.org/show_bug.cgi?id=130232
</del><ins>+        Broke lots of tests (Requested by smfr on #webkit).
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * WebCore.exp.in:
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.h:
+        (InlineTextBox):
+        * rendering/RenderApplet.h:
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        (WebCore::RenderBlock::virtualContinuation):
+        (WebCore::RenderBlock::virtualChildren):
+        (WebCore::RenderBlock::isRenderBlock):
+        (WebCore::RenderBlock::isBlockFlow):
+        (WebCore::RenderBlock::isInlineBlockOrInlineTable):
+        (WebCore::RenderBlock::dirtyLinesFromChangedChild):
+        (WebCore::RenderBlock::collapsedMarginBefore):
+        (WebCore::RenderBlock::collapsedMarginAfter):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderBoundingBox):
+        (RenderBox):
+        (WebCore::RenderBox::marginLogicalLeft):
+        (WebCore::RenderBox::marginLogicalRight):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::isBoxModelObject):
+        * rendering/RenderButton.h:
+        * rendering/RenderCombineText.h:
+        * rendering/RenderCounter.h:
+        * rendering/RenderDeprecatedFlexibleBox.h:
+        * rendering/RenderDetailsMarker.h:
+        * rendering/RenderEmbeddedObject.h:
+        (RenderEmbeddedObject):
+        (WebCore::RenderEmbeddedObject::isEmbeddedObject):
+        (WebCore::RenderEmbeddedObject::virtualChildren):
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderFlexibleBox.h:
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameSet.h:
+        * rendering/RenderFullScreen.cpp:
+        * rendering/RenderFullScreen.h:
+        * rendering/RenderGrid.h:
+        * rendering/RenderHTMLCanvas.h:
+        * rendering/RenderIFrame.h:
+        * rendering/RenderImage.h:
+        (RenderImage):
+        (WebCore::RenderImage::isRenderImage):
+        * rendering/RenderInline.h:
+        (RenderInline):
+        (WebCore::RenderInline::virtualContinuation):
+        (WebCore::RenderInline::virtualChildren):
+        (WebCore::RenderInline::isRenderInline):
+        (WebCore::RenderInline::layout):
+        (WebCore::RenderInline::requiresLayer):
+        (WebCore::RenderInline::offsetWidth):
+        (WebCore::RenderInline::offsetHeight):
+        (WebCore::RenderInline::borderBoundingBox):
+        (WebCore::RenderInline::dirtyLinesFromChangedChild):
+        * rendering/RenderLayerModelObject.h:
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::virtualChildren):
+        (WebCore::RenderMedia::canHaveChildren):
+        (WebCore::RenderMedia::isMedia):
+        (WebCore::RenderMedia::isImage):
+        (WebCore::RenderMedia::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderMediaControlElements.h:
+        * rendering/RenderMenuList.h:
+        * rendering/RenderMeter.h:
+        * rendering/RenderMultiColumnBlock.h:
+        * rendering/RenderMultiColumnFlowThread.h:
+        * rendering/RenderMultiColumnSet.h:
+        * rendering/RenderNamedFlowThread.h:
+        * rendering/RenderPart.h:
+        (RenderPart):
+        (WebCore::RenderPart::isRenderPart):
+        (WebCore::RenderPart::renderName):
+        * rendering/RenderProgress.h:
+        * rendering/RenderRegion.h:
+        (WebCore::RenderRegion::isRenderRegion):
+        * rendering/RenderRegionSet.h:
+        * rendering/RenderReplaced.h:
+        (RenderReplaced):
+        (WebCore::RenderReplaced::renderName):
+        * rendering/RenderReplica.h:
+        * rendering/RenderRuby.h:
+        * rendering/RenderRubyBase.h:
+        * rendering/RenderRubyRun.h:
+        * rendering/RenderRubyText.h:
+        * rendering/RenderScrollbarPart.h:
+        * rendering/RenderSearchField.h:
+        * rendering/RenderSlider.h:
+        * rendering/RenderSnapshottedPlugIn.h:
+        (RenderSnapshottedPlugIn):
+        * rendering/RenderTable.h:
+        (RenderTable):
+        (WebCore::RenderTable::renderName):
+        (WebCore::RenderTable::isTable):
+        (WebCore::RenderTable::avoidsFloats):
+        * rendering/RenderTableCaption.h:
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.h:
+        (RenderText):
+        (WebCore::RenderText::marginLeft):
+        (WebCore::RenderText::marginRight):
+        (WebCore::RenderText::styleWillChange):
+        (WebCore::RenderText::length):
+        (WebCore::RenderText::paint):
+        (WebCore::RenderText::layout):
+        * rendering/RenderTextControl.h:
+        (RenderTextControl):
+        (WebCore::RenderTextControl::renderName):
+        (WebCore::RenderTextControl::isTextControl):
+        (WebCore::RenderTextControl::avoidsFloats):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::isTextField):
+        * rendering/RenderTextFragment.h:
+        * rendering/RenderTextTrackCue.h:
+        * rendering/RenderVideo.h:
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.h:
+        (RenderWidget):
+        (WebCore::RenderWidget::isWidget):
+        * rendering/RenderWordBreak.h:
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+        * rendering/mathml/RenderMathMLBlock.h:
+        * rendering/svg/RenderSVGBlock.h:
+        (RenderSVGBlock):
+        * rendering/svg/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::setNeedsBoundariesUpdate):
+        (WebCore::RenderSVGContainer::virtualChildren):
+        (WebCore::RenderSVGContainer::isSVGContainer):
+        (WebCore::RenderSVGContainer::renderName):
+        (RenderSVGContainer):
+        (WebCore::RenderSVGContainer::objectBoundingBox):
+        (WebCore::RenderSVGContainer::strokeBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/svg/RenderSVGEllipse.h:
+        * rendering/svg/RenderSVGForeignObject.h:
+        * rendering/svg/RenderSVGGradientStop.h:
+        * rendering/svg/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::renderName):
+        (RenderSVGHiddenContainer):
+        (WebCore::RenderSVGHiddenContainer::isSVGHiddenContainer):
+        * rendering/svg/RenderSVGImage.h:
+        * rendering/svg/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::renderName):
+        (WebCore::RenderSVGInline::requiresLayer):
+        (WebCore::RenderSVGInline::isSVGInline):
+        (RenderSVGInline):
+        * rendering/svg/RenderSVGInlineText.h:
+        * rendering/svg/RenderSVGModelObject.h:
+        (WebCore::RenderSVGModelObject::requiresLayer):
+        (RenderSVGModelObject):
+        * rendering/svg/RenderSVGPath.h:
+        * rendering/svg/RenderSVGRect.h:
+        * rendering/svg/RenderSVGResourceClipper.h:
+        * rendering/svg/RenderSVGResourceContainer.h:
+        (RenderSVGResourceContainer):
+        (WebCore::RenderSVGResourceContainer::isSVGResourceContainer):
+        (WebCore::RenderSVGResourceContainer::toRenderSVGResourceContainer):
+        * rendering/svg/RenderSVGResourceFilter.h:
+        * rendering/svg/RenderSVGResourceFilterPrimitive.h:
+        * rendering/svg/RenderSVGResourceGradient.h:
+        (RenderSVGResourceGradient):
+        (WebCore::RenderSVGResourceGradient::resourceBoundingBox):
+        * rendering/svg/RenderSVGResourceLinearGradient.h:
+        * rendering/svg/RenderSVGResourceMarker.h:
+        * rendering/svg/RenderSVGResourceMasker.h:
+        * rendering/svg/RenderSVGResourcePattern.h:
+        * rendering/svg/RenderSVGResourceRadialGradient.h:
+        * rendering/svg/RenderSVGRoot.h:
+        * rendering/svg/RenderSVGShape.h:
+        (WebCore::RenderSVGShape::setNeedsBoundariesUpdate):
+        (WebCore::RenderSVGShape::setNeedsTransformUpdate):
+        (WebCore::RenderSVGShape::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGShape::localToParentTransform):
+        (WebCore::RenderSVGShape::localTransform):
+        (WebCore::RenderSVGShape::isSVGShape):
+        (RenderSVGShape):
+        (WebCore::RenderSVGShape::objectBoundingBox):
+        (WebCore::RenderSVGShape::strokeBoundingBox):
+        * rendering/svg/RenderSVGTSpan.h:
+        * rendering/svg/RenderSVGText.h:
+        * rendering/svg/RenderSVGTextPath.h:
+        * rendering/svg/RenderSVGTransformableContainer.h:
+        * rendering/svg/RenderSVGViewportContainer.h:
</ins><span class="cx"> 
</span><del>-        This method doesn't modify InsertedNodes object.
</del><ins>+2013-05-12  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+        Simplify AutodrainedPool
+        https://bugs.webkit.org/show_bug.cgi?id=115986
</ins><span class="cx"> 
</span><del>-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
-        * editing/ReplaceSelectionCommand.h:
-
-2014-03-14  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [EME] Extend the lifetime of MediaKeySession.
-        https://bugs.webkit.org/show_bug.cgi?id=129841
-
-        Reviewed by Eric Carlson.
-
-        Test: media/encrypted-media/encrypted-media-session-lifetime.html
-
-        In anticipation of guidance to be added to the EME Spec &lt;https://www.w3.org/Bugs/Public/show_bug.cgi?id=24771&gt;,
-        extend the lifetime of MediaKeySession by making the session an ActiveDOMObject, and returning true to
-        hasPendingActivity when the session is both not closed and is associated with a live MediaKeys object.
-
-        Additionally, keep the object from being destroyed while events are pending.
-
-        * Modules/encryptedmedia/MediaKeySession.cpp:
-        (WebCore::MediaKeySession::MediaKeySession):
-        * Modules/encryptedmedia/MediaKeySession.h:
-        * Modules/encryptedmedia/MediaKeySession.idl:
-
-2014-03-14  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-
-        Remove an unused function fix builds.
-
-        * platform/mac/HTMLConverter.mm:
-
-2014-03-14  Frédéric Wang  &lt;fred.wang@free.fr&gt;
-
-        FontCache: Replace DEPRECATED_DEFINE_STATIC_LOCAL with static NeverDestroyed&lt;T&gt;.
-        https://bugs.webkit.org/show_bug.cgi?id=130233
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        Remove calls to AutodrainedPool::cycle as well as the iteration counter passed to the constructor.
+        Instead, just declare RAII pools where it seems necessary.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/FontCache.cpp:
-        (WebCore::fontCache):
-        (WebCore::FontVerticalDataCacheKeyTraits::emptyValue):
-        (WebCore::fontVerticalDataCacheInstance):
-        (WebCore::FontDataCacheKeyTraits::emptyValue):
-        * platform/graphics/FontCache.h:
</del><ins>+        * Modules/webdatabase/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        * fileapi/FileThread.cpp:
+        (WebCore::FileThread::runLoop):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::performURLImport):
+        (WebCore::IconDatabase::readFromDatabase):
</ins><span class="cx"> 
</span><del>-2014-03-11  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+2013-05-12  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Improve dom error messages
-        https://bugs.webkit.org/show_bug.cgi?id=130103
</del><ins>+        Apply FINAL to the Node hierarchy.
+        &lt;http://webkit.org/b/115984&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Mostly from Blink r149454 by &lt;cevans@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=149454&gt;
</ins><span class="cx"> 
</span><del>-        Make the DOM error messages more descriptive, and update bindings tests.
</del><ins>+        A couple of the stable DOM/ microbenchmarks are perf positive on Linux clang:
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        (GenerateParametersCheck):
-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        (WebCore::jsTestActiveDOMObjectExcitingAttr):
-        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
-        (WebCore::jsTestActiveDOMObjectPrototypeFunctionPostMessage):
-        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
-        (WebCore::jsTestCustomNamedGetterPrototypeFunctionAnotherFunction):
-        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
-        (WebCore::jsTestEventConstructorAttr1):
-        (WebCore::jsTestEventConstructorAttr2):
-        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
-        (WebCore::jsTestEventTargetPrototypeFunctionItem):
-        (WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
-        (WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
-        (WebCore::jsTestEventTargetPrototypeFunctionDispatchEvent):
-        * bindings/scripts/test/JS/JSTestException.cpp:
-        (WebCore::jsTestExceptionName):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::jsTestInterfaceImplementsStr1):
-        (WebCore::jsTestInterfaceImplementsStr2):
-        (WebCore::jsTestInterfaceImplementsStr3):
-        (WebCore::jsTestInterfaceImplementsNode):
-        (WebCore::jsTestInterfaceSupplementalStr1):
-        (WebCore::jsTestInterfaceSupplementalStr2):
-        (WebCore::jsTestInterfaceSupplementalStr3):
-        (WebCore::jsTestInterfaceSupplementalNode):
-        (WebCore::setJSTestInterfaceImplementsStr2):
-        (WebCore::setJSTestInterfaceImplementsStr3):
-        (WebCore::setJSTestInterfaceImplementsNode):
-        (WebCore::setJSTestInterfaceSupplementalStr2):
-        (WebCore::setJSTestInterfaceSupplementalStr3):
-        (WebCore::setJSTestInterfaceSupplementalNode):
-        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod1):
-        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
-        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod3):
-        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod1):
-        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
-        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod3):
-        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
-        (WebCore::jsTestMediaQueryListListenerPrototypeFunctionMethod):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::JSTestObjConstructor::constructJSTestObj):
-        (WebCore::jsTestObjReadOnlyLongAttr):
-        (WebCore::jsTestObjReadOnlyStringAttr):
-        (WebCore::jsTestObjReadOnlyTestObjAttr):
-        (WebCore::jsTestObjConstructorTestSubObj):
-        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
-        (WebCore::jsTestObjEnumAttr):
-        (WebCore::jsTestObjByteAttr):
-        (WebCore::jsTestObjOctetAttr):
-        (WebCore::jsTestObjShortAttr):
-        (WebCore::jsTestObjUnsignedShortAttr):
-        (WebCore::jsTestObjLongAttr):
-        (WebCore::jsTestObjLongLongAttr):
-        (WebCore::jsTestObjUnsignedLongLongAttr):
-        (WebCore::jsTestObjStringAttr):
-        (WebCore::jsTestObjTestObjAttr):
-        (WebCore::jsTestObjXMLObjAttr):
-        (WebCore::jsTestObjCreate):
-        (WebCore::jsTestObjReflectedStringAttr):
-        (WebCore::jsTestObjReflectedIntegralAttr):
-        (WebCore::jsTestObjReflectedUnsignedIntegralAttr):
-        (WebCore::jsTestObjReflectedBooleanAttr):
-        (WebCore::jsTestObjReflectedURLAttr):
-        (WebCore::jsTestObjReflectedCustomIntegralAttr):
-        (WebCore::jsTestObjReflectedCustomBooleanAttr):
-        (WebCore::jsTestObjReflectedCustomURLAttr):
-        (WebCore::jsTestObjTypedArrayAttr):
-        (WebCore::jsTestObjAttrWithGetterException):
-        (WebCore::jsTestObjAttrWithSetterException):
-        (WebCore::jsTestObjStringAttrWithGetterException):
-        (WebCore::jsTestObjStringAttrWithSetterException):
-        (WebCore::jsTestObjCustomAttr):
-        (WebCore::jsTestObjWithScriptStateAttribute):
-        (WebCore::jsTestObjWithScriptExecutionContextAttribute):
-        (WebCore::jsTestObjWithScriptStateAttributeRaises):
-        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
-        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
-        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
-        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
-        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
-        (WebCore::jsTestObjConditionalAttr1):
-        (WebCore::jsTestObjConditionalAttr2):
-        (WebCore::jsTestObjConditionalAttr3):
-        (WebCore::jsTestObjConditionalAttr4Constructor):
-        (WebCore::jsTestObjConditionalAttr5Constructor):
-        (WebCore::jsTestObjConditionalAttr6Constructor):
-        (WebCore::jsTestObjCachedAttribute1):
-        (WebCore::jsTestObjCachedAttribute2):
-        (WebCore::jsTestObjAnyAttribute):
-        (WebCore::jsTestObjContentDocument):
-        (WebCore::jsTestObjMutablePoint):
-        (WebCore::jsTestObjImmutablePoint):
-        (WebCore::jsTestObjStrawberry):
-        (WebCore::jsTestObjStrictFloat):
-        (WebCore::jsTestObjDescription):
-        (WebCore::jsTestObjId):
-        (WebCore::jsTestObjHash):
-        (WebCore::jsTestObjReplaceableAttribute):
-        (WebCore::jsTestObjNullableDoubleAttribute):
-        (WebCore::jsTestObjNullableLongAttribute):
-        (WebCore::jsTestObjNullableBooleanAttribute):
-        (WebCore::jsTestObjNullableStringAttribute):
-        (WebCore::jsTestObjNullableLongSettableAttribute):
-        (WebCore::jsTestObjNullableStringValue):
-        (WebCore::jsTestObjAttribute):
-        (WebCore::jsTestObjAttributeWithReservedEnumType):
-        (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
-        (WebCore::setJSTestObjEnumAttr):
-        (WebCore::setJSTestObjByteAttr):
-        (WebCore::setJSTestObjOctetAttr):
-        (WebCore::setJSTestObjShortAttr):
-        (WebCore::setJSTestObjUnsignedShortAttr):
-        (WebCore::setJSTestObjLongAttr):
-        (WebCore::setJSTestObjLongLongAttr):
-        (WebCore::setJSTestObjUnsignedLongLongAttr):
-        (WebCore::setJSTestObjStringAttr):
-        (WebCore::setJSTestObjTestObjAttr):
-        (WebCore::setJSTestObjXMLObjAttr):
-        (WebCore::setJSTestObjCreate):
-        (WebCore::setJSTestObjReflectedStringAttr):
-        (WebCore::setJSTestObjReflectedIntegralAttr):
-        (WebCore::setJSTestObjReflectedUnsignedIntegralAttr):
-        (WebCore::setJSTestObjReflectedBooleanAttr):
-        (WebCore::setJSTestObjReflectedURLAttr):
-        (WebCore::setJSTestObjReflectedCustomIntegralAttr):
-        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
-        (WebCore::setJSTestObjReflectedCustomURLAttr):
-        (WebCore::setJSTestObjTypedArrayAttr):
-        (WebCore::setJSTestObjAttrWithGetterException):
-        (WebCore::setJSTestObjAttrWithSetterException):
-        (WebCore::setJSTestObjStringAttrWithGetterException):
-        (WebCore::setJSTestObjStringAttrWithSetterException):
-        (WebCore::setJSTestObjCustomAttr):
-        (WebCore::setJSTestObjWithScriptStateAttribute):
-        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
-        (WebCore::setJSTestObjWithScriptStateAttributeRaises):
-        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
-        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
-        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
-        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
-        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
-        (WebCore::setJSTestObjConditionalAttr1):
-        (WebCore::setJSTestObjConditionalAttr2):
-        (WebCore::setJSTestObjConditionalAttr3):
-        (WebCore::setJSTestObjConditionalAttr4Constructor):
-        (WebCore::setJSTestObjConditionalAttr5Constructor):
-        (WebCore::setJSTestObjConditionalAttr6Constructor):
-        (WebCore::setJSTestObjAnyAttribute):
-        (WebCore::setJSTestObjMutablePoint):
-        (WebCore::setJSTestObjImmutablePoint):
-        (WebCore::setJSTestObjStrawberry):
-        (WebCore::setJSTestObjStrictFloat):
-        (WebCore::setJSTestObjId):
-        (WebCore::setJSTestObjReplaceableAttribute):
-        (WebCore::setJSTestObjNullableLongSettableAttribute):
-        (WebCore::setJSTestObjNullableStringValue):
-        (WebCore::setJSTestObjAttributeWithReservedEnumType):
-        (WebCore::jsTestObjPrototypeFunctionVoidMethod):
-        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionByteMethod):
-        (WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionOctetMethod):
-        (WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionLongMethod):
-        (WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionObjMethod):
-        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithSequenceArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithEnumArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
-        (WebCore::jsTestObjPrototypeFunctionSerializedValue):
-        (WebCore::jsTestObjPrototypeFunctionOptionsObject):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithException):
-        (WebCore::jsTestObjPrototypeFunctionCustomMethod):
-        (WebCore::jsTestObjPrototypeFunctionCustomMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionAddEventListener):
-        (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateVoid):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObj):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateVoidException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObjException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContext):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg):
-        (WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackAndOptionalArg):
-        (WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackArg):
-        (WebCore::jsTestObjPrototypeFunctionConditionalMethod1):
-        (WebCore::jsTestObjPrototypeFunctionConditionalMethod2):
-        (WebCore::jsTestObjPrototypeFunctionConditionalMethod3):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod3):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
-        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod11):
-        (WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
-        (WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
-        (WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
-        (WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
-        (WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
-        (WebCore::jsTestObjPrototypeFunctionConvert1):
-        (WebCore::jsTestObjPrototypeFunctionConvert2):
-        (WebCore::jsTestObjPrototypeFunctionConvert4):
-        (WebCore::jsTestObjPrototypeFunctionConvert5):
-        (WebCore::jsTestObjPrototypeFunctionMutablePointFunction):
-        (WebCore::jsTestObjPrototypeFunctionImmutablePointFunction):
-        (WebCore::jsTestObjPrototypeFunctionOrange):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunction):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
-        (WebCore::jsTestObjPrototypeFunctionVariadicStringMethod):
-        (WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
-        (WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
-        (WebCore::jsTestObjPrototypeFunctionAny):
-        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
-        (WebCore::jsTestSerializedScriptValueInterfaceValue):
-        (WebCore::jsTestSerializedScriptValueInterfaceReadonlyValue):
-        (WebCore::jsTestSerializedScriptValueInterfaceCachedValue):
-        (WebCore::jsTestSerializedScriptValueInterfacePorts):
-        (WebCore::jsTestSerializedScriptValueInterfaceCachedReadonlyValue):
-        (WebCore::setJSTestSerializedScriptValueInterfaceValue):
-        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::JSTestTypedefsConstructor::constructJSTestTypedefs):
-        (WebCore::jsTestTypedefsUnsignedLongLongAttr):
-        (WebCore::jsTestTypedefsImmutableSerializedScriptValue):
-        (WebCore::jsTestTypedefsConstructorTestSubObj):
-        (WebCore::jsTestTypedefsAttrWithGetterException):
-        (WebCore::jsTestTypedefsAttrWithSetterException):
-        (WebCore::jsTestTypedefsStringAttrWithGetterException):
-        (WebCore::jsTestTypedefsStringAttrWithSetterException):
-        (WebCore::setJSTestTypedefsUnsignedLongLongAttr):
-        (WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
-        (WebCore::setJSTestTypedefsAttrWithGetterException):
-        (WebCore::setJSTestTypedefsAttrWithSetterException):
-        (WebCore::setJSTestTypedefsStringAttrWithGetterException):
-        (WebCore::setJSTestTypedefsStringAttrWithSetterException):
-        (WebCore::jsTestTypedefsPrototypeFunctionFunc):
-        (WebCore::jsTestTypedefsPrototypeFunctionSetShadow):
-        (WebCore::jsTestTypedefsPrototypeFunctionMethodWithSequenceArg):
-        (WebCore::jsTestTypedefsPrototypeFunctionNullableArrayArg):
-        (WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):
-        (WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction):
-        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction):
-        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction2):
-        (WebCore::jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude):
-        (WebCore::jsTestTypedefsPrototypeFunctionMethodWithException):
-        * bindings/scripts/test/JS/JSattribute.cpp:
-        (WebCore::jsattributeReadonly):
</del><ins>+            - CloneNodes time reduced from 162.4 to 156.5 ms.
+            - CreateNodes time reduced from 113.9 to 104.9 ms.
</ins><span class="cx"> 
</span><del>-2014-03-14  Bear Travis  &lt;betravis@adobe.com&gt;
</del><ins>+        * dom/: Beat things with the FINAL stick.
+        * html/: Ditto.
+        * svg/: Ditto.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] polygon default fill-rule should be omitted from the serialization
-        https://bugs.webkit.org/show_bug.cgi?id=129840
</del><ins>+2013-05-12  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Devirtualize some things on Document.
</ins><span class="cx"> 
</span><del>-        Modifying the default polygon string opening to be &quot;polygon(&quot; rather than
-        &quot;polygon(nonzero&quot;.
</del><ins>+        From Blink r149967 by &lt;esprehn@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=149967&gt;
</ins><span class="cx"> 
</span><del>-        Updated existing parsing tests.
</del><ins>+        Several methods on Document are virtual but don't override a super class method
+        and don't need to be virtual. This patch devirtualizes:
</ins><span class="cx"> 
</span><del>-        * css/CSSBasicShapes.cpp:
-        (WebCore::buildPolygonString):
</del><ins>+            - createElementNS()
+            - finishedParsing()
+            - suspendScriptedAnimationControllerCallbacks()
+            - resumeScriptedAnimationControllerCallbacks()
</ins><span class="cx"> 
</span><del>-2014-03-14  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        It also removes the suspend and resume callbacks from ScriptExecutionContext
+        since they didn't need to be there.
</ins><span class="cx"> 
</span><del>-        Crash when using a mixture of In-Band and Out-of-Band Tracks
-        https://bugs.webkit.org/show_bug.cgi?id=130247
</del><ins>+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-05-12  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundation::processNewAndRemovedTextTracks): Do not include
-        the new Out-of-Band placeholder tracks in our counts of in-band tracks.
</del><ins>+        Remove redundant call to removeAllEventListeners() in Document::open().
</ins><span class="cx"> 
</span><del>-2014-03-13  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        From Blink r150175 by &lt;dcheng@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=150175&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] Avoid creating DOMCSSStyleDeclaration in WebHTMLConverter
-        https://bugs.webkit.org/show_bug.cgi?id=130226
</del><ins>+        Document::open() already calls Document::removeAllEventListeners(), which
+        removes the event listeners from the DOMWindow it's attached to, so
+        there's no need to do it manually here as well.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::open):
</ins><span class="cx"> 
</span><del>-        Extracted HTMLConverterCaches in C++ that directly calls getPropertyCSSValue on computed style
-        and inline style to avoid creating Objective-C wrappers for CSSComputedStyleDeclaration.
</del><ins>+2013-05-12  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This improves the runtime of PerformanceTests/Interactive/CopyAll.html from 31-32s to 25-26s (20%).
</del><ins>+        Apply FINAL to the RenderObject hierarchy.
+        &lt;http://webkit.org/b/115977&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.h:
-        * platform/mac/HTMLConverter.mm:
-        (HTMLConverterCaches::computedStylePropertyForElement):
-        (HTMLConverterCaches::inlineStylePropertyForElement):
-        (stringFromCSSValue):
-        (-[WebHTMLConverter _computedStringForNode:property:]):
-        (floatValueFromPrimitiveValue):
-        (_getFloat):
-        (-[WebHTMLConverter _getComputedFloat:forNode:property:]):
-        (-[WebHTMLConverter _computedColorForNode:property:]):
-        (-[WebHTMLConverter dealloc]):
-        (-[WebHTMLConverter init]):
</del><ins>+        Mostly from Blink r148795 by &lt;cevans@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=148795&gt;
</ins><span class="cx"> 
</span><del>-2014-03-14  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        * rendering/: Beat things with the FINAL stick.
+        * WebCore.exp.in: Export a now-needed symbol.
</ins><span class="cx"> 
</span><del>-        Web Inspector: AXI: Include Role as an extra attribute in the page overlay.
-        https://bugs.webkit.org/show_bug.cgi?id=130214
</del><ins>+2013-05-12  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        [GTK] Remove unnecessary GTK_CHECK_VERSION #ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=115914
</ins><span class="cx"> 
</span><del>-        Adding Role to the Web Inspector element overlay.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorOverlay.cpp:
-        (WebCore::buildObjectForElementInfo):
-        * inspector/InspectorOverlayPage.js:
-        (_createElementTitle):
</del><ins>+        * platform/graphics/gtk/FullscreenVideoControllerGtk.cpp:
+        (WebCore::FullscreenVideoControllerGtk::hideHud):
+        (WebCore::FullscreenVideoControllerGtk::initializeWindow):
+        * platform/gtk/GtkVersioning.c:
+        * platform/gtk/GtkVersioning.h:
+        * platform/gtk/WidgetRenderingContext.cpp:
+        (WebCore::WidgetRenderingContext::WidgetRenderingContext):
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_realize):
</ins><span class="cx"> 
</span><del>-2014-03-14  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+2013-05-11  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: AXI: Expose Accessibility Tree parent of the selected node
-        https://bugs.webkit.org/show_bug.cgi?id=129943
</del><ins>+        [Windows] Unreviewed build fix after r149932
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * make-export-file-generator: Don't attempt to import
+        (or use) non-existent cxxabi functions on Windows.
</ins><span class="cx"> 
</span><del>-        Tests: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
</del><ins>+2013-05-11  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Accessibility Node Inspector now displays a link to the AX parent node,
-        because it's not a 1:1 match with the DOMNode parent.
</del><ins>+        Add more info to compositing log channel output
+        https://bugs.webkit.org/show_bug.cgi?id=115978
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorDOMAgent.cpp: Support for DOMNode.role and AccessibilityProperties.axParentNodeId.
-        (WebCore::InspectorDOMAgent::buildObjectForNode): Support for role.
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties): Support for axParentNodeId.
-        * inspector/protocol/DOM.json: Added axParentNodeId on AccessibilityProperties, and role on DOMNode.
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-03-14  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Add to compositing log channel output whether a layer paints
+        into its compositing ancestor.
</ins><span class="cx"> 
</span><del>-        [Mac] Remove NSURLCache logic from WebCore pressure relief code.
-        &lt;https://webkit.org/b/130248&gt;
</del><ins>+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::logLayerInfo):
</ins><span class="cx"> 
</span><del>-        The NSURLCache lives in the networking process and should be cleared
-        on that end. Furthermore, this code doesn't really do what we thought
-        it was doing; it merely sets and and resets the limits. No truncation
-        ever occurred. The intended functionality was implemented in r165342.
</del><ins>+2013-05-10  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        REGRESSION: Fixed background on ColterReed.com scrolls
+        https://bugs.webkit.org/show_bug.cgi?id=115951
</ins><span class="cx"> 
</span><del>-        * platform/mac/MemoryPressureHandlerMac.mm:
-        (WebCore::MemoryPressureHandler::releaseMemory):
</del><ins>+        Reviewed by Beth Dakin.
+        
+        The logic for painting the fixed root background into its own layer was
+        broken when the document element's layer was composited. This could be caused
+        by a negative z-index child of the body, or by an explicit compositing-causing
+        style on the &lt;html&gt;.
+        
+        There were two issues. First, when painting the layer for the fixed root
+        background, we would simply short-circuit the fixed background paint in
+        RenderLayer::paintLayer(), when checking for a composited layer. We have
+        to continue to paint through the composited &lt;html&gt; layer to get the root
+        background in this case.
+        
+        Secondly, RenderLayerBacking::paintIntoLayer() would only set the PaintLayerPaintingSkipRootBackground
+        flag if this RenderLayerBacking had a m_backgroundLayer. However, when the &lt;html&gt; is
+        composited, we need to skip painting the root layer for both the RenderView's backing,
+        and for the &lt;html&gt;'s backing. Checking whether there is *any* layer that paints
+        the fixed root background (i.e. checking compositor()-&gt;fixedRootBackgroundLayer())
+        is a simple way to fix this test.
</ins><span class="cx"> 
</span><del>-2014-03-14  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Tests: platform/mac-wk2/tiled-drawing/fixed-background/fixed-background-composited-html.html
+               platform/mac-wk2/tiled-drawing/fixed-background/fixed-background-negative-z-index-fixed.html
</ins><span class="cx"> 
</span><del>-        Simplify jettisoning of style resolvers on memory pressure.
-        &lt;https://webkit.org/b/129644&gt;
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::paintForFixedRootBackground):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
</ins><span class="cx"> 
</span><del>-        Now that we have Document::allDocuments(), we can jettison all the
-        style resolvers by walking the set of live documents and calling
-        clearStyleResolver() on each one, instead of having a function on
-        Page that walks the frame tree of every living page, etc.
</del><ins>+2013-05-11  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        Possible crash when going Back while loading PDF
+        https://bugs.webkit.org/show_bug.cgi?id=115972
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        * page/Page.h:
-        * platform/mac/MemoryPressureHandlerMac.mm:
-        (WebCore::MemoryPressureHandler::releaseMemory):
-
-2014-03-07  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        Add Remote Control command support to HTLMediaElement
-        https://bugs.webkit.org/show_bug.cgi?id=129926
-
-        Reviewed by Eric Carlson.
-
-        Support the new MediaSession remote control commands by pulling in code from
-        MediaControlElementTypes to control scanning.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        * html/HTMLMediaElement.h:
-        * html/MediaController.cpp:
-        (MediaController::beginScanning): Moved from MediaControlElementTypes.
-        (MediaController::endScanning): Ditto.
-        * html/MediaController.h:
-        * html/MediaControllerInterface.h:
-
-        Remove all the scanning code from MediaControlSeekButtonElement.
-        * html/shadow/MediaControlElementTypes.cpp:
-        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
-        (WebCore::MediaControlSeekButtonElement::setActive):
-        * html/shadow/MediaControlElementTypes.h:
-
-2014-03-14  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
-
-        Move WebSpeech code to use std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=130231
-
-        Reviewed by Anders Carlsson.
-
-        Replace uses of OwnPtr and PassOwnPtr in WebSpeech code with std::unique_ptr.
-
-        No new tests. Covered by existing ones.
-
-        * Modules/speech/SpeechRecognitionController.cpp:
-        * Modules/speech/SpeechRecognitionController.h:
-        * Modules/speech/SpeechSynthesis.cpp:
-        (WebCore::SpeechSynthesis::setPlatformSynthesizer):
-        (WebCore::SpeechSynthesis::getVoices):
-        (WebCore::SpeechSynthesis::startSpeakingImmediately):
-        * Modules/speech/SpeechSynthesis.h:
-        * WebCore.exp.in:
-        * platform/PlatformSpeechSynthesizer.cpp:
-        * platform/PlatformSpeechSynthesizer.h:
-        * platform/mock/PlatformSpeechSynthesizerMock.cpp:
-        * platform/mock/PlatformSpeechSynthesizerMock.h:
-        * testing/Internals.cpp:
-        (WebCore::Internals::enableMockSpeechSynthesizer):
-
-2014-03-13  Anders Carlsson  &lt;andersca@apple.com&gt;
-
-        Move visited link handling to VisitedLinkTableController and VisitedLinkProvider
-        https://bugs.webkit.org/show_bug.cgi?id=130223
-        &lt;rdar://problem/16315792&gt;
-
</del><span class="cx">         Reviewed by Dan Bernstein.
</span><span class="cx"> 
</span><del>-        Export symbols needed by WebKit2.
</del><ins>+        It's possible for m_frame to be null when Document::findUnsafeParentScrollPropagationBoundary()
+        is called, so null-check currentFrame.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::findUnsafeParentScrollPropagationBoundary):
</ins><span class="cx"> 
</span><del>-2014-03-12  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+2013-05-11  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Fix unused parameter warnings in the GObject WebKitDOM bindings
-        https://bugs.webkit.org/show_bug.cgi?id=130174
</del><ins>+        &lt;rdar://problem/13823864&gt; TextCodecICU complains about ambiguous codec names with current ICU release
+        https://bugs.webkit.org/show_bug.cgi?id=115953
</ins><span class="cx"> 
</span><del>-        Reviewed by Daniel Bates.
-
-        * bindings/gobject/DOMObjectCache.cpp:
-        (WebKit::weakRefNotify): Fix unused parameters.
-        * bindings/gobject/WebKitDOMDeprecated.cpp: Ditto.
-        * bindings/gobject/WebKitDOMObject.cpp: Ditto.
-        * bindings/scripts/CodeGeneratorGObject.pm: Generate UNUSED_PARAM when appropriate and clean
-        up the getter and setter code generation a little to make it easier to read.
-
-2014-03-14  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
-
-        Build fix with SUBPIXEL_LAYOUT disabled
-        https://bugs.webkit.org/show_bug.cgi?id=130210
-
-        Reviewed by Daniel Bates.
-
-        Use pre-incremeent operator for LayoutUnit instead of post-increment operator as LayoutUnit doesn't support the
-        latter and we don't make use of the return value.
-
-        * dom/Element.cpp:
-        (WebCore::adjustForLocalZoom):
-
-2014-03-14  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
-
-        [CSSRegions] Inline-block child of content node incorrectly clipped
-        https://bugs.webkit.org/show_bug.cgi?id=130229
-
-        Reviewed by Andrei Bucur.
-
-        Constrain the target box rect to the region box rect only if we are able
-        to determine the region range for box. If we cannot do that, getRegionRangeForBox
-        returns null values for start and end region and we should not perform the clamping.
-
-        Test: fast/regions/inlineblock-child-inlineblock-contentnode-in-region.html
-
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::rectFlowPortionForBox):
-
-2014-03-14  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Unnecessary ImplementationLacksVTable IDL attribute used for RTCConfiguration, RTCIceServer
-        https://bugs.webkit.org/show_bug.cgi?id=130230
-
-        Reviewed by Philippe Normand.
-
-        The RTCConfiguration and RTCIceServer classes do not own virtual tables, so using the
-        ImplementationLacksVTable attribute in the IDL interface leads to a compile-time assertion
-        failure in the generates JSC wrappers because none of the classes is polymorphic.
-
-        * Modules/mediastream/RTCConfiguration.idl:
-        * Modules/mediastream/RTCIceServer.idl:
-
-2014-03-14  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
-
-        [CSS Grid Layout] the &quot;grid-template-areas&quot; is not identified as computable property.
-        https://bugs.webkit.org/show_bug.cgi?id=130073
-
-        Reviewed by Sergio Villar Senin.
-
-        The &quot;grid-template-areas&quot; property is a computable CSS property, so it should be
-        handled accordingly by the Web Inspector.
-
-        No new tests.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        CSSPropertyWebkitGridTemplateAreas added to the computedProperties array.
-
-2014-03-14  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
-
-        [CSS Grid layout] Initial position in span not correctly computed sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=130124
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        The code uses std::lower_bound() to get the first grid line
-        position before a given resolved position in a Vector. That
-        function returns an iterator pointing to the first value not
-        &quot;strictly less&quot; than the given one. Consequently, the returned
-        position might be actually located after the resolved final
-        position. In those cases we need to select the previous position
-        in the Vector (which is guaranted to be &quot;&lt; resolved position&quot; due
-        to how std::lower_bound() works).
</del><ins>+        Store and use canonical converter name to create converters.
</ins><span class="cx"> 
</span><del>-        For example, if we have vector=[2,5,8] as grid positions, and we
-        need the first position before 7, std::lower_bound(vector, 7) will
-        point to 8 (first value not &lt; 7). It's obvious that we should
-        select 5 instead. Should the pointed value be equal, then we
-        should do nothing, because the indexes mean tracks, so the item
-        will be placed in just one cell of the grid.
</del><ins>+        As a side effect, we now actually reuse cached converters - previously we would compare
+        a standard encoding name to internal canonical one, which rarely match.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderGrid.cpp:
-        (WebCore::firstNamedGridLineBeforePosition):
-        (WebCore::RenderGrid::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
</del><ins>+        * platform/text/TextCodecICU.h:
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::create): Pass canonical ICU converter name to constructor.
+        (WebCore::TextCodecICU::registerEncodingNames): 
+            - Updated terminology.
+            - Added a comment that special cases should be kept in sync between registerEncodingNames
+            and registerCodecs.
+            - Moved maccyrillic alias to a correct section. It's not present in ICU even today.
+            - Changed a few aliases to actually map to standard name, not to an overridden one
+            (this doesn't change behavior since addToTextEncodingNameMap looks up canonical
+            name, but is clearer).
+        (WebCore::TextCodecICU::registerCodecs): Store a converter name to use with each
+        canonical encoding name.
+        (WebCore::TextCodecICU::TextCodecICU): Ditto.
+        (WebCore::TextCodecICU::releaseICUConverter): Reset the converter to remove any
+        leftover data.
+        (WebCore::TextCodecICU::createICUConverter): 
+            - Compare converter name to converter name, not to another alias name.
+            - Use proper string comparison instead of pointer comparison.
+            - When creating a converter, assert that the name is not ambigous - canonical
+            converter names should never be, otherwise there would be no way to create
+            the converter without ambiguity.
</ins><span class="cx"> 
</span><del>-2014-03-14  Zsolt Borbely  &lt;borbezs@inf.u-szeged.hu&gt;
</del><ins>+2013-05-11  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix the !ENABLE(SVG_FONTS) build
-        https://bugs.webkit.org/show_bug.cgi?id=130193
</del><ins>+        [Mac] The captions menu should not use a canned max-width and max-height
+        https://bugs.webkit.org/show_bug.cgi?id=115968
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Add missing ENABLE(SVG_FONTS) guards for createGlyphToPathTranslator() function
-        in SVGTextRunRenderingContext.h and TextRun.h, because when the SVG_FONTS are
-        disabled the function is not implemented.
</del><ins>+        Use more real estate to display the captions menu should the caption names
+        be long.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/TextRun.h:
-        * rendering/svg/SVGTextRunRenderingContext.h:
</del><ins>+        * css/mediaControlsQuickTime.css:
+        (video::-webkit-media-controls-closed-captions-container):
+        (video::-webkit-media-controls-closed-captions-track-list):
+        Make the captions menu scale to a max-width and max-height to allow 4px
+        above and below the menu, except on the right where it always aligns with
+        the captions icon in the media controller.
+        * html/shadow/MediaControlsApple.cpp:
+        (WebCore::MediaControlsApple::createControls):
+        Move the captions menu element to be a child of the controls instead of
+        the panel such that it may scale relative to the controls when using %
+        CSS values.
</ins><span class="cx"> 
</span><del>-2014-03-14  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+2013-05-11  Jochen Eisinger  &lt;jochen@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r165607. There were two missing replaces.
</del><ins>+        Disallow a window to focus itself via javascript URLs or using target _self
+        https://bugs.webkit.org/show_bug.cgi?id=115906
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        * dom/Element.cpp:
-        (WebCore::attrNodeListMap):
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-2014-03-14  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Test: fast/dom/Window/window-focus-self.html
</ins><span class="cx"> 
</span><del>-        Migrate the MathML stretchy code from UChar to Glyph.
-        https://bugs.webkit.org/show_bug.cgi?id=128907
</del><ins>+        * loader/FrameLoader.cpp:
+        (WebCore::createWindow):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::focus):
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+2013-05-11  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        This prepares the MathML stretchy code for future support for the MATH
-        table. In particular, this uses the glyph index for measuring and
-        drawing instead of Unicode code point since the MATH table uses glyph
-        indices. Also, this merges the preferred width and stretchy character
-        selection into one common path since they will also have to share the
-        size variants measuring/selection. Finally, we expose a drawGlyphs()
-        method so that we can draw a glyph by index.
</del><ins>+        Fix several style warnings in generated bindings
+        https://bugs.webkit.org/show_bug.cgi?id=115961
</ins><span class="cx"> 
</span><del>-        No new tests. This should not change the behavior of the stretchy code.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Font.h:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::drawGlyphs):
-        * platform/graphics/GraphicsContext.h:
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::RenderMathMLOperator):
-        (WebCore::RenderMathMLOperator::boundsForGlyph):
-        (WebCore::RenderMathMLOperator::heightForGlyph):
-        (WebCore::RenderMathMLOperator::advanceForGlyph):
-        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths):
-        (WebCore::RenderMathMLOperator::findStretchyData):
-        (WebCore::RenderMathMLOperator::updateStyle):
-        (WebCore::RenderMathMLOperator::firstLineBaseline):
-        (WebCore::RenderMathMLOperator::computeLogicalHeight):
-        (WebCore::RenderMathMLOperator::paintGlyph):
-        (WebCore::RenderMathMLOperator::fillWithExtensionGlyph):
-        (WebCore::RenderMathMLOperator::paint):
-        (WebCore::RenderMathMLOperator::paintChildren):
-        * rendering/mathml/RenderMathMLOperator.h:
</del><ins>+        Fix several style errors in the bindings generated under
+        Source/WebCore/bindings/scripts/test/
</ins><span class="cx"> 
</span><del>-2014-03-12  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Rename DEFINE_STATIC_LOCAL to DEPRECATED_DEFINE_STATIC_LOCAL
-        https://bugs.webkit.org/show_bug.cgi?id=129612
-
-        Reviewed by Darin Adler.
-
-        For new code use static NeverDestroyed&lt;T&gt; instead.
-
-        Removed the list of changed files as it was huge.
-
-2014-03-14  Gavin Barraclough  &lt;barraclough@apple.com&gt;
-
-        Reduce memory use for static property maps
-        https://bugs.webkit.org/show_bug.cgi?id=129986
-
-        Unreviewed Windows build fix / update bindings test results following r165603.
-
</del><ins>+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateImplementation):
+        (WriteData):
</ins><span class="cx">         * bindings/scripts/CodeGeneratorJS.pm:
</span><del>-        (GenerateHashTable):
</del><ins>+        (GenerateHeader):
+        (GenerateImplementation):
+        (WriteData):
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateHeader):
+        * bindings/scripts/test/CPP/WebDOMFloat64Array.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestActiveDOMObject.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestCallback.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestCustomNamedGetter.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestEventConstructor.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestEventTarget.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestException.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestInterface.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestMediaQueryListListener.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestNamedConstructor.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestNode.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestOverloadedConstructors.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestTypedefs.cpp:
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
</span><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
+        (WebCore::JSTestActiveDOMObject::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
</span><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
+        (WebCore::JSTestCustomNamedGetter::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
</span><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestEventConstructor.h:
+        (WebCore::JSTestEventConstructor::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestEventTarget.cpp:
</span><del>-        (WebCore::jsTestEventTargetPrototypeFunctionItem):
-        (WebCore::jsTestEventTargetPrototypeFunctionDispatchEvent):
</del><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestEventTarget.h:
+        (WebCore::JSTestEventTarget::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestException.cpp:
</span><del>-        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
</del><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestException.h:
+        (WebCore::JSTestException::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestInterface.cpp:
</span><del>-        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
-        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
</del><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        (WebCore::JSTestInterface::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
</span><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        (WebCore::JSTestMediaQueryListListener::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
</span><del>-        * bindings/scripts/test/JS/JSTestNode.cpp:
</del><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
+        (WebCore::JSTestNamedConstructor::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestObj.cpp:
</span><del>-        (WebCore::jsTestObjAttrWithGetterException):
-        (WebCore::jsTestObjStringAttrWithGetterException):
-        (WebCore::jsTestObjWithScriptStateAttributeRaises):
-        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
-        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
-        (WebCore::jsTestObjNullableStringValue):
-        (WebCore::jsTestObjPrototypeFunctionByteMethod):
-        (WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionOctetMethod):
-        (WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionLongMethod):
-        (WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionObjMethod):
-        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence):
-        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObj):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObjException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
-        (WebCore::jsTestObjPrototypeFunctionConditionalMethod1):
-        (WebCore::jsTestObjConstructorFunctionClassMethodWithOptional):
-        (WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
-        (WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
-        (WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
-        (WebCore::jsTestObjPrototypeFunctionMutablePointFunction):
-        (WebCore::jsTestObjPrototypeFunctionImmutablePointFunction):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunction):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
</del><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore::JSTestObj::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
</span><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
+        (WebCore::JSTestOverloadedConstructors::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
</span><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        (WebCore::JSTestSerializedScriptValueInterface::releaseImplIfNotNull):
</ins><span class="cx">         * bindings/scripts/test/JS/JSTestTypedefs.cpp:
</span><del>-        (WebCore::jsTestTypedefsAttrWithGetterException):
-        (WebCore::jsTestTypedefsStringAttrWithGetterException):
-        (WebCore::jsTestTypedefsPrototypeFunctionMethodWithSequenceArg):
-        (WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction):
-        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction):
-        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction2):
-        (WebCore::jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude):
-        * bindings/scripts/test/JS/JSattribute.cpp:
-        * bindings/scripts/test/JS/JSreadonly.cpp:
</del><ins>+        (WebCore::toJS):
+        * bindings/scripts/test/JS/JSTestTypedefs.h:
+        (WebCore::JSTestTypedefs::releaseImplIfNotNull):
+        * bindings/scripts/test/ObjC/DOMFloat64ArrayInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestActiveDOMObjectInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestCallbackInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestCustomNamedGetterInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestEventConstructorInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestEventTargetInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestExceptionInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestInterfaceInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestMediaQueryListListenerInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestNamedConstructorInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestNodeInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObjInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestOverloadedConstructorsInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterfaceInternal.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestTypedefsInternal.h:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-2014-03-14  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+2013-05-11  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Use override keyword in BatteryManager
-        https://bugs.webkit.org/show_bug.cgi?id=130225
</del><ins>+        Make it a build error to put invalid C++ symbol names in WebCore.exp.in
+        https://bugs.webkit.org/show_bug.cgi?id=115958
</ins><span class="cx"> 
</span><del>-        Reviewed by Daniel Bates.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * Modules/battery/BatteryManager.h:
</del><ins>+        While invalid C++ symbols will eventually show up as a link error since the symbol won't be found,
+        this makes it easier to catch invalid symbols inside of #ifdefs.
</ins><span class="cx"> 
</span><del>-2014-03-12  Gavin Barraclough  &lt;barraclough@apple.com&gt;
</del><ins>+        * make-export-file-generator:
+        Try to demangle C++ symbols before printing them.
</ins><span class="cx"> 
</span><del>-        Reduce memory use for static property maps
-        https://bugs.webkit.org/show_bug.cgi?id=129986
</del><ins>+2013-05-11  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        BUILD FIX (r149718): Move exported symbol into ENABLE(FULLSCREEN_API) section
</ins><span class="cx"> 
</span><del>-        Static property tables are currently duplicated on first use from read-only memory into dirty memory
-        in every process, and since the entries are large (48 bytes) and the tables can be unusually sparse
-        (we use a custom hash table without a rehash) a lot of memory may be wasted.
</del><ins>+        Fixes the following build failure when ENABLE(FULLSCREEN_API) is
+        off:
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.h:
-        (WebCore::getStaticValueSlotEntryWithoutCaching):
-        (WebCore::getStaticValueSlotEntryWithoutCaching&lt;JSDOMWrapper&gt;):
-            - HashEntry -&gt; HashTableValue.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertySlot):
-            - HashEntry -&gt; HashTableValue.
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::getOwnPropertySlotDelegate):
-            - HashEntry -&gt; HashTableValue.
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::getOwnPropertySlotDelegate):
-        (WebCore::JSLocation::putDelegate):
-            - HashEntry -&gt; HashTableValue.
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateGetOwnPropertySlotBody):
-            - HashEntry -&gt; HashTableValue.
-        (GenerateHashTable):
-            - emit the hash table index into the derived source (we were calculating this already to ensure chaining does not get too deep).
</del><ins>+            Undefined symbols for architecture i386:
+              &quot;__ZNK7WebCore7Element25containsFullScreenElementEv&quot;, referenced from:
+                 -exported_symbol[s_list] command line option
</ins><span class="cx"> 
</span><del>-2014-03-13  Manish R Gurnaney  &lt;m.gurnaney@samsung.com&gt;
</del><ins>+        * WebCore.exp.in: Move the symbol.
</ins><span class="cx"> 
</span><del>-        Scroll size is not recalculated when absolute left of child is updated
-        https://bugs.webkit.org/show_bug.cgi?id=123958
</del><ins>+2013-05-11  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Unreviewed, remove some lint accidentally left in r149929.
</ins><span class="cx"> 
</span><del>-        Test: fast/css/display-inline-block-scrollbar.html
-        Actual issue was that whenever there is the content change in the
-        RenderBlock having inline-block children, The InlineFlowBox while
-        computing overflow never resets previous value.
-        
</del><span class="cx">         * rendering/InlineFlowBox.cpp:
</span><del>-        (WebCore::InlineFlowBox::computeOverflow):
-        Added code to clear overflow when we start computing overflow for
-        InlineFlowBox. So as to ScrollSize can be recalculated properly.
</del><ins>+        (WebCore::verticalAlignApplies):
</ins><span class="cx"> 
</span><del>-2014-03-13  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-03-17  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Pass const RenderStyle&amp; to box decoration functions.
-        https://bugs.webkit.org/show_bug.cgi?id=130201
</del><ins>+        Text flow broken in elements with vertical align top/bottom and inline elements taller than line-height
+        https://bugs.webkit.org/show_bug.cgi?id=111974
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Goran Kling.
</del><ins>+        Reviewed by Ryosuke Niwa.
+        
+        Per http://www.w3.org/TR/CSS2/visudet.html#propdef-vertical-align 'vertical-align' only applies to inline and table-cell
+        elements.
</ins><span class="cx"> 
</span><del>-        No change in functionality.
</del><ins>+        Test: fast/css/vertical-align-block-elements.html
</ins><span class="cx"> 
</span><span class="cx">         * rendering/InlineFlowBox.cpp:
</span><del>-        (WebCore::InlineFlowBox::paintBoxShadow):
-        (WebCore::InlineFlowBox::paintBoxDecorations):
-        (WebCore::InlineFlowBox::paintMask):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::paintMaskImages):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintNinePieceImage):
-        (WebCore::RenderBoxModelObject::paintOneBorderSide):
-        (WebCore::RenderBoxModelObject::paintBorderSides):
-        (WebCore::RenderBoxModelObject::paintTranslucentBorderSides):
-        (WebCore::RenderBoxModelObject::paintBorder):
-        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
-        (WebCore::RenderBoxModelObject::getBorderEdgeInfo):
-        (WebCore::RenderBoxModelObject::borderObscuresBackgroundEdge):
-        (WebCore::RenderBoxModelObject::borderObscuresBackground):
-        (WebCore::RenderBoxModelObject::paintBoxShadow):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::paintBoxDecorations):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::paintBoxDecorations):
</del><ins>+        (WebCore::isTextInBlockElement):
+        (WebCore):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
</ins><span class="cx"> 
</span><del>-2014-03-13  Jinwoo Jeong  &lt;jw00.jeong@samsung.com&gt;
</del><ins>+2013-05-11  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Refactor Vibration algorithm to use only one timer.
-        https://bugs.webkit.org/show_bug.cgi?id=130059
</del><ins>+        Make CanvasStyle a plain object instead of an RefCounted object
+        https://bugs.webkit.org/show_bug.cgi?id=115775
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Currently Vibration is using two timers,
-        one is to start a vibration and another is to check termination of a vibration.
-        But they do not work in same time, if one of them is fired, then anothor will start.
-        Thus this patch removes one of them, and manages vibration states by enumeration.
</del><ins>+        CanvasStyle is just 2 words wide. We do not gain anything from allocating
+        it on the heap. Change the object to be just a type and some data.
</ins><span class="cx"> 
</span><del>-        Also, this patch implement the missing part of the algorithm,
-        which check the maximum length of the vibration pattern and the maximum duration of the vibration.
</del><ins>+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::toHTMLCanvasStyle):
+        * html/HTMLCanvasElement.cpp:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::State::State):
+        (WebCore::CanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::CanvasRenderingContext2D::setFillStyle):
+        (WebCore::CanvasRenderingContext2D::setStrokeColor):
+        (WebCore::CanvasRenderingContext2D::setFillColor):
+        (WebCore::CanvasRenderingContext2D::fullCanvasCompositedFill):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasRenderingContext2D.h:
+        (WebCore::CanvasRenderingContext2D::strokeStyle):
+        (CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::fillStyle):
+        (State):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::CanvasStyle):
+        (WebCore::CanvasStyle::createFromString):
+        (WebCore::CanvasStyle::createFromStringWithOverrideAlpha):
+        (WebCore::CanvasStyle::isEquivalentColor):
+        (WebCore):
+        (WebCore::CanvasStyle::operator=):
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * html/canvas/CanvasStyle.h:
+        (CanvasStyle):
+        (WebCore::CanvasStyle::isValid):
+        (WebCore::CanvasStyle::CanvasStyle):
+        (WebCore):
+        (WebCore::CanvasStyle::operator=):
</ins><span class="cx"> 
</span><del>-        Lastly, this patch removes unused methods from Vibration.
</del><ins>+2013-05-11  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/vibration/Vibration.cpp:
-        (WebCore::Vibration::Vibration):
-        (WebCore::Vibration::vibrate):
-        (WebCore::Vibration::cancelVibration):
-        Removed stopVibration() and its contents moved to cancelVibration().
-        (WebCore::Vibration::timerFired): Combined timerStartFired() and timerStopFired().
-        Removed suspendVibration() and resumeVibration(), which is never called since r.
-        * Modules/vibration/Vibration.h: Added new enumertaion to specify states of Vibration.
-        (WebCore::Vibration::isVibrating):
</del><ins>+        Gradient::platformGradient: Vector reserveCapacity -&gt; reserveInitialCapacity
+        https://bugs.webkit.org/show_bug.cgi?id=115779
</ins><span class="cx"> 
</span><del>-2014-03-13  James Craig  &lt;jcraig@apple.com&gt;
-
-        Web Inspector: AXI: Use loc strings for known aria-invalid types
-        https://bugs.webkit.org/show_bug.cgi?id=129952
-
-        Reviewed by Joseph Pecoraro.
-
-        Updating inspector-protocol enum and UI display values for @aria-invalid.
-
-        Test: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
-
-        * inspector/InspectorDOMAgent.cpp: Enum for DOM.AccessibilityPropertiesInvalid
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/protocol/DOM.json: Enum for DOM.AccessibilityPropertiesInvalid
-
-2014-03-13  Dirk Schulze  &lt;krit@webkit.org&gt;
-
-        [SVG2] support paint-order presentation attribute
-        https://bugs.webkit.org/show_bug.cgi?id=129373
-
-        Reviewed by Dean Jackson.
-
-        Add support for the paint-order property from SVG2. The presentation
-        attribute/CSS property allows to paint fill, stroke and markers in any order
-        the author desires.
-
-        Firefox supports this but behind a runtime flag. It is just activated in
-        nightly builds by default.
-
-        Chromium supports it behind a runtime flag as well but is going to ship it
-        pretty soon.
-
-        Tests: svg/paint-order/paint-order-fill-expected.svg
-               svg/paint-order/paint-order-fill-markers-expected.svg
-               svg/paint-order/paint-order-fill-markers.svg
-               svg/paint-order/paint-order-fill.svg
-               svg/paint-order/paint-order-markers-expected.svg
-               svg/paint-order/paint-order-markers-stroke-expected.svg
-               svg/paint-order/paint-order-markers-stroke.svg
-               svg/paint-order/paint-order-markers.svg
-               svg/paint-order/paint-order-normal-expected.svg
-               svg/paint-order/paint-order-normal.svg
-               svg/paint-order/paint-order-stroke-expected.svg
-               svg/paint-order/paint-order-stroke-marker-expected.svg
-               svg/paint-order/paint-order-stroke-marker.svg
-               svg/paint-order/paint-order-stroke.svg
-               svg/paint-order/paint-order-text-markers-expected.svg
-               svg/paint-order/paint-order-text-markers.svg
-               svg/paint-order/paint-order-text-normal-expected.svg
-               svg/paint-order/paint-order-text-normal.svg
-               svg/paint-order/paint-order-text-stroke-expected.svg
-               svg/paint-order/paint-order-text-stroke.svg
-               svg/paint-order/paint-order-text-tspan-001-expected.svg
-               svg/paint-order/paint-order-text-tspan-001.svg
-               svg/paint-order/paint-order-text-tspan-002-expected.svg
-               svg/paint-order/paint-order-text-tspan-002.svg
-               svg/paint-order/parsing-paint-order.html
-
-        * css/CSSComputedStyleDeclaration.cpp: Computed style for paint-order.
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in:
-        * css/CSSValueKeywords.in:
-        * css/SVGCSSComputedStyleDeclaration.cpp:
-        (WebCore::paintOrder):
-        (WebCore::ComputedStyleExtractor::svgPropertyValue):
-        * css/SVGCSSParser.cpp: Parse paint-order. Take care of serialization
-            at this point already to get element style correct.
-        (WebCore::CSSParser::parseSVGValue):
-        (WebCore::CSSParser::parsePaintOrder):
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::StyleResolver::applySVGProperty):
-        * rendering/style/SVGRenderStyle.cpp:
-        (WebCore::SVGRenderStyle::paintTypesForPaintOrder):
-        (WebCore::SVGRenderStyle::diff): Repaint on change.
-        * rendering/style/SVGRenderStyle.h:
-        (WebCore::SVGRenderStyle::initialPaintOrder):
-        (WebCore::SVGRenderStyle::setPaintOrder):
-        (WebCore::SVGRenderStyle::paintOrder):
-        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
-        (WebCore::SVGRenderStyle::setBitDefaults):
-        * rendering/style/SVGRenderStyleDefs.h:
-        * rendering/svg/RenderSVGShape.cpp: Change order of painting based on paint-order.
-        (WebCore::RenderSVGShape::strokeShape):
-        (WebCore::RenderSVGShape::fillStrokeMarkers):
-        (WebCore::RenderSVGShape::paint):
-        (WebCore::RenderSVGShape::addFocusRingRects):
-        * rendering/svg/RenderSVGShape.h:
-        * rendering/svg/SVGInlineTextBox.cpp:
-        (WebCore::SVGInlineTextBox::paint): Ditto.
-        * svg/SVGElement.cpp: Make property a presentation attribute.
-        (WebCore::populateAttributeNameToCSSPropertyIDMap):
-        (WebCore::populateAttributeNameToAnimatedPropertyTypeMap):
-        * svg/svgattrs.in: Add paint-order attribute.
-
-2014-03-13  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Network process instantiates JSC::VM under fake memory pressure.
-        &lt;https://webkit.org/b/130143&gt;
-
-        Stop calling GCController::garbageCollectSoon() in the fake memory
-        pressure callback. The pressure relief code already schedules GC
-        by way of discardAllCode() which does reportAbandonedObjectGraph().
-        This way we don't accidentally instantiate a VM in the networking
-        process for no reason.
-
-        Reviewed by Geoffrey Garen.
-
-        * platform/mac/MemoryPressureHandlerMac.mm:
-        (WebCore::MemoryPressureHandler::install):
-
-2014-03-13  Diego Pino Garcia  &lt;dpino@igalia.com&gt;
-
-        Web Inspector: AXI: Expose focused/focusable state in the Accessibility Node Inspector
-        https://bugs.webkit.org/show_bug.cgi?id=129779
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/InspectorDOMAgent.cpp: Set property &quot;focused&quot;.
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/protocol/DOM.json: Add property &quot;focused&quot; to
-        AccessibilityProperties.
-
-2014-03-12  Jae Hyun Park  &lt;jaepark@webkit.org&gt;
-
-        Remove remaining Nix port related files
-        https://bugs.webkit.org/show_bug.cgi?id=130179
-
-        Reviewed by Csaba Osztrogonác.
-
-        GLContextFromCurrentEGL was added in r155360 as a part of nix
-        upstreaming. As Nix port is removed from the source tree, these files
-        are in no use.
-
-        * platform/graphics/egl/GLContextFromCurrentEGL.cpp: Removed.
-        * platform/graphics/egl/GLContextFromCurrentEGL.h: Removed.
-
-2014-03-13  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        REGRESSION (r160806): Incorrect cascade order of prefixed and non-prefixed variants of
-        CSS properties box-shadow and background-{clip, origin, size}
-        https://bugs.webkit.org/show_bug.cgi?id=130102
-        &lt;rdar://problem/16187037&gt;
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Fixes an issues in the computation of the final value for the CSS properties
-        box-shadow and background-{clip, origin, size} when the definition of a selector
-        uses both the prefixed and non-prefixed variants (in order) of these properties.
</del><ins>+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformGradient): Clang is surprisingly smart at removing
+        all the branches of this function. Remove two more with reserveInitialCapacity.
</ins><span class="cx"> 
</span><del>-        Tests: fast/css/cascade/background-clip-and-webkit-background-clip-cascade-order.html
-               fast/css/cascade/background-origin-and-webkit-background-origin-cascade-order.html
-               fast/css/cascade/background-size-and-webkit-background-size-cascade-order.html
-               fast/css/cascade/box-shadow-and-webkit-box-shadow-cascade-order.html
</del><ins>+2013-05-10  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSPropertyNames.in: Add a comment to explain the difference between property
-        -webkit-box-shadow and property box-shadow.
-        * css/StyleResolver.cpp:
-        (WebCore::shouldApplyPropertyInParseOrder): Add prefixed and non-prefixed variants
-        of box-shadow and background-{clip, origin, size} to the list of properties that need
-        to be applied in the same order as they were parsed from the stylesheet.
</del><ins>+        &lt;rdar://problem/13666412&gt; Clean up some edge cases of URL parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=104919
</ins><span class="cx"> 
</span><del>-2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Web Inspector: Remove InspectorFrontendHost.loadResourceSynchronously
-        https://bugs.webkit.org/show_bug.cgi?id=130217
</del><ins>+        Test: fast/url/segments-userinfo-vs-host.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * page/SecurityOrigin.cpp:
+        (WebCore::schemeRequiresHost):
+        (WebCore::shouldTreatAsUniqueOrigin):
+        Updated function name and comments (host is not the same as authority). We still
+        need this check - KURL can still produce http URLs with an empty host (even as this
+        patch reduces the number of such cases). So can Gecko and current draft of URL
+        Standard.
+        It would be good to have a guarantee that such useless URLs can not come out of
+        URL parser, as relying on downstream code re-parsing the URL correctly would be fragile.
</ins><span class="cx"> 
</span><del>-        This has been replaced by NetworkAgent.loadResource,
-        which loads asynchronously through the backend.
</del><ins>+        * platform/KURL.cpp:
+        (WebCore::hostPortIsEmptyButCredentialsArePresent): Updated an argument name for
+        correctness.
+        (WebCore::KURL::parse):
+        1. Reverted behavior changes from &lt;http://trac.webkit.org/changeset/82181&gt; - I could
+        find no reason to allow &quot;@&quot; in hostnames, and having a URL like this re-parsed by
+        a different parser would likely produce different results. It's better to just treat
+        these edge case URLs as invalid.
+        2. When hostname component is a lone colon, preserve it in parsed URL string,
+        as otherwise path would get pushed in its place when re-parsing.
+        3. When authority component is a lone colon, don't forget to &quot;//&quot; after scheme, too.
+        4. Added some assertions about contents of authority component, to catch potential
+        mis-parsing earlier.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorFrontendHost.cpp:
-        * inspector/InspectorFrontendHost.h:
-        * inspector/InspectorFrontendHost.idl:
</del><ins>+2013-05-10  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Make TextCodecICU not depend on TextEncoding
+        https://bugs.webkit.org/show_bug.cgi?id=115848
</ins><span class="cx"> 
</span><del>-        Web Inspector: Network.loadResource should include the response status code
-        https://bugs.webkit.org/show_bug.cgi?id=130216
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::create):
+        (WebCore::TextCodecICU::TextCodecICU):
+        (WebCore::TextCodecICU::createICUConverter):
+        (WebCore::TextCodecICU::decode):
+        (WebCore::TextCodecICU::encode):
+        * platform/text/TextCodecICU.h:
+        Use a plain encoding string in platform encoder wrapper, not a higher level concept.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorResourceAgent.cpp:
-        Record and send the http status code.
</del><ins>+2013-05-10  Laszlo Gombos  &lt;l.gombos@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * inspector/protocol/Network.json:
-        Include status code property in the success callback.
</del><ins>+        Remove Mac OS X Leopard (10.5) support
+        https://bugs.webkit.org/show_bug.cgi?id=107964
</ins><span class="cx"> 
</span><del>-2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Web Inspector: Network.loadResource XHR crash if page reloaded while request is ongoing
-        https://bugs.webkit.org/show_bug.cgi?id=130211
</del><ins>+        Removed the code for 10.5 and removed if-def for 10.6.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Merged from Blink with changes, (patch by vsevik@chromium.org):
-        http://src.chromium.org/viewvc/blink?view=revision&amp;revision=152712
</del><ins>+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/mac/EmptyProtocolDefinitions.h:
+        * platform/mac/NSScrollerImpDetails.h:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/text/mac/HyphenationMac.mm:
</ins><span class="cx"> 
</span><del>-        Using an XMLHttpRequest to download resources had a few issues. Being an
-        Active DOM Object the load could be paused. Without an extra retain,
-        when the load was cancelled (e.g. a page reload) the XHR would get
-        destructed and could cause a crash if the list of active DOM objects
-        was actively being iterated.
</del><ins>+2013-05-10  Laszlo Gombos  &lt;l.gombos@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Switch to a DocumentThreadableLoader to manage the load ourselves.
-        This still uses the Memory cache, but we have a little more control.
</del><ins>+        Remove USE(OS_RANDOMNESS)
+        https://bugs.webkit.org/show_bug.cgi?id=108095
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorResourceAgent.h:
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::InspectorResourceAgent):
-        (WebCore::InspectorResourceAgent::loadResource):
-        Switch from XHR to DocumentThreadableLoader.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * xml/XMLHttpRequest.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::createRequest):
-        (WebCore::XMLHttpRequest::sendForInspector):
-        Remove the now unnecessary XHR sendForInspector path.
</del><ins>+        Remove the USE(OS_RANDOMNESS) guard as it is turned on for all
+        ports.
</ins><span class="cx"> 
</span><del>-2014-03-13  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        No new tests as this is covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165540.
-        https://bugs.webkit.org/show_bug.cgi?id=130199
</del><ins>+        * page/Crypto.cpp:
+        (WebCore::Crypto::getRandomValues):
+        * platform/UUID.cpp:
+        (WebCore::createCanonicalUUIDString):
</ins><span class="cx"> 
</span><del>-        caused 1 hidpi test fail (Requested by zalan on #webkit).
</del><ins>+2013-05-10  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Remove [NoInterfaceObject] from several WebAudio IDL interfaces
+        https://bugs.webkit.org/show_bug.cgi?id=115894
</ins><span class="cx"> 
</span><del>-        &quot;Subpixel rendering: Nested layers with subpixel accumulation
-        paint to wrong position.&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130153
-        http://trac.webkit.org/changeset/165540
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-03-13  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Several WebAudio IDL interfaces had [NoInterfaceObject] extended attribute set,
+        meaning that there was no corresponding attribute on the global window object.
+        This behavior is not according to the specification:
+        https://dvcs.w3.org/hg/audio/raw-file/tip/webaudio/specification.html
</ins><span class="cx"> 
</span><del>-        Fix a bunch of mistakes in the parsing of ::cue( and ::cue
-        https://bugs.webkit.org/show_bug.cgi?id=130113
</del><ins>+        This patch removes the [NoInterfaceObject] extended attribute where needed to
+        match the specification.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        No new tests, already covered by existing tests.
</ins><span class="cx"> 
</span><del>-        * css/CSSGrammar.y.in:
-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserSelector::setPseudoTypeValue):
-        The ::cue() pseudo element &quot;function&quot; was passed as a PseudoClass.
-        The type was then parsed and considered as a compatibility type to flip
-        the match type back to PseudoElement.
</del><ins>+        * Modules/webaudio/AnalyserNode.idl:
+        * Modules/webaudio/AudioBuffer.idl:
+        * Modules/webaudio/AudioBufferSourceNode.idl:
+        * Modules/webaudio/AudioDestinationNode.idl:
+        * Modules/webaudio/AudioListener.idl:
+        * Modules/webaudio/AudioNode.idl:
+        * Modules/webaudio/AudioParam.idl:
+        * Modules/webaudio/BiquadFilterNode.idl:
+        * Modules/webaudio/ChannelMergerNode.idl:
+        * Modules/webaudio/ChannelSplitterNode.idl:
+        * Modules/webaudio/ConvolverNode.idl:
+        * Modules/webaudio/DelayNode.idl:
+        * Modules/webaudio/DynamicsCompressorNode.idl:
+        * Modules/webaudio/GainNode.idl:
+        * Modules/webaudio/MediaElementAudioSourceNode.idl:
+        * Modules/webaudio/MediaStreamAudioDestinationNode.idl:
+        * Modules/webaudio/MediaStreamAudioSourceNode.idl:
+        * Modules/webaudio/OscillatorNode.idl:
+        * Modules/webaudio/ScriptProcessorNode.idl:
+        * Modules/webaudio/WaveShaperNode.idl:
+        * Modules/webaudio/WaveTable.idl:
</ins><span class="cx"> 
</span><del>-        Instead of all that jazz, just pass the right type from the grammar.
</del><ins>+2013-05-10  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::parsePseudoType):
-        The non-function ::cue pseudo element use shadow pseudo ID for matching the element.
-        Since it is unprefixed, it needs to map to one of the Custom types. The previous code
-        was using String::startsWith() for some reason, change that to a simple equality.
</del><ins>+        REGRESSION (r145680): No box shadow rendered on element with positioned child that obscures it
+        https://bugs.webkit.org/show_bug.cgi?id=115840
</ins><span class="cx"> 
</span><del>-2014-03-13  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        Reviewed by Antti Koivisto.
+        
+        In r107836, we moved some box-shadow painting into the paintFillLayer code for performance.
+        However, in r145680 we started to skip background painting when we know the background is
+        obscured. This broke shadow painting in some cases.
+        
+        Fix by always painting the background fill layers if we know that they will also
+        paint the shadow.
</ins><span class="cx"> 
</span><del>-        Clean up RenderStyle creation
-        https://bugs.webkit.org/show_bug.cgi?id=130180
</del><ins>+        Test: fast/box-shadow/box-shadow-obscured-backgrounds.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBackground):
</ins><span class="cx"> 
</span><del>-        Use the copy constructor with the default style instead of having a special
-        constructor for that.
</del><ins>+2013-05-10  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::create):
-        (WebCore::RenderStyle::RenderStyle):
-        * rendering/style/RenderStyle.h:
</del><ins>+        REGRESSION (r143626): Element shows as garbage in image gallery
+        https://bugs.webkit.org/show_bug.cgi?id=115946
</ins><span class="cx"> 
</span><del>-2014-03-13  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Reviewed by Antti Koivisto.
+        
+        RenderLayer::backgroundIsKnownToBeOpaqueInRect() used hasVisibleContent()
+        to check whether the layer's content was hidden via the visibility property.
+        However, this assumed that a passing hasVisibleContent() check meant that the
+        entire area was covered by the renderers and layers checked layer.
+        
+        This is not always true. It's possible to have a visibility:hidden layer
+        with a non-covering visbility:visible child, or even a single RenderText
+        child that happens to have visibility:visible style. In these situations,
+        hasVisibleContent() returns true but the entire area is not painted.
+        
+        So we have to fall back to on a more conservative check using the
+        visibility style, which will give is a reliable answer for the current layer.
</ins><span class="cx"> 
</span><del>-        The viewport code should not depend on WebKitSystemInterface
-        https://bugs.webkit.org/show_bug.cgi?id=130218
</del><ins>+        Tests: compositing/contents-opaque/hidden-with-visible-child.html
+               compositing/contents-opaque/hidden-with-visible-text.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::backgroundIsKnownToBeOpaqueInRect):
</ins><span class="cx"> 
</span><del>-        The viewport code cannot be generalized to other ports because it relies
-        on WebKit system interface to get the device screen size.
-        This patch fixes that by going through ChromeClient to get the data.
</del><ins>+2013-05-10  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::processViewport):
-        Get the screensize from chrome client.
</del><ins>+        Garbage down left side of nytimes.com page (if subscriber)
+        https://bugs.webkit.org/show_bug.cgi?id=115839
</ins><span class="cx"> 
</span><del>-        * dom/ViewportArguments.cpp:
-        (WebCore::computeViewportAttributes):
-        This is dead code. Nothing should ever use computeViewportAttributes().
</del><ins>+        Reviewed by Antti Koivisto.
+        
+        RenderLayer::backgroundIsKnownToBeOpaqueInRect() would incorrectly return true
+        for layers where the given rect wasn't contained in the background rect, but
+        where some child layer obscured the rect, even though clipping hid part
+        of that child layer.
+        
+        So bail from RenderLayer::backgroundIsKnownToBeOpaqueInRect() if we have
+        any overflow clipping. This could be enhanced in future to test whether child
+        layers obscure the clipping rect, but that would be more expensive.
</ins><span class="cx"> 
</span><del>-        (WebCore::finalizeViewportArguments):
-        * dom/ViewportArguments.h:
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::viewportScreenSize):
</del><ins>+        Test: compositing/contents-opaque/overflow-hidden-child-layers.html
</ins><span class="cx"> 
</span><del>-2014-03-07  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::backgroundIsKnownToBeOpaqueInRect):
</ins><span class="cx"> 
</span><del>-        Add remote control command support to MediaSession.
-        https://bugs.webkit.org/show_bug.cgi?id=129903
</del><ins>+2013-05-10  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        In-band captions not visible immediately after track mode change
+        https://bugs.webkit.org/show_bug.cgi?id=115922
</ins><span class="cx"> 
</span><del>-        Add the capability to receive remote control commands (currently iOS only) and to
-        pass those commands through the MediaSessionManager.
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Add a new platform class which can listen for remote control commands:
-        * platform/RemoteCommandListener.cpp: Added.
-        (WebCore::RemoteCommandListener::create):
-        * platform/RemoteCommandListener.h: Added.
-        (WebCore::RemoteCommandListenerClient::~RemoteCommandListenerClient):
-        (WebCore::RemoteCommandListener::~RemoteCommandListener):
-        (WebCore::RemoteCommandListener::RemoteCommandListener):
-        * platform/ios/RemoteCommandListenerIOS.h: Added.
-        * platform/ios/RemoteCommandListenerIOS.mm: Added.
-        (WebCore::RemoteCommandListener::create):
-        (WebCore::RemoteCommandListenerIOS::RemoteCommandListenerIOS):
-        (WebCore::RemoteCommandListenerIOS::~RemoteCommandListenerIOS):
</del><ins>+        Test: media/track/track-in-band-mode.html
</ins><span class="cx"> 
</span><del>-        Handle remote control command events in HTMLMediaElement and AudioDestinationMac:
</del><span class="cx">         * html/HTMLMediaElement.cpp:
</span><del>-        (WebCore::HTMLMediaElement::parseAttribute):
-        * html/HTMLMediaElement.h:
-        * platform/audio/mac/AudioDestinationMac.h:
-        (WebCore::AudioDestinationMac::canReceiveRemoteControlCommands):
-        (WebCore::AudioDestinationMac::didReceiveRemoteControlCommand):
</del><ins>+        (WebCore::HTMLMediaElement::textTrackModeChanged): Add cues for all loaded tracks, regardless
+            of track type.
</ins><span class="cx"> 
</span><del>-        Pipe command events through MediaSessionManager:
-        * platform/audio/MediaSession.cpp:
-        (WebCore::MediaSession::canReceiveRemoteControlCommands):
-        (WebCore::MediaSession::didReceivRemoteControlCommand):
-        * platform/audio/MediaSession.h:
-        * platform/audio/MediaSessionManager.cpp:
-        (WebCore::MediaSessionManager::addSession):
-        (WebCore::MediaSessionManager::removeSession):
-        (WebCore::MediaSessionManager::sessionWillBeginPlayback):
-        (WebCore::MediaSessionManager::didReceiveRemoteControlCommand):
-        (WebCore::MediaSessionManager::addClient):
-        (WebCore::MediaSessionManager::removeClient):
-        * platform/audio/MediaSessionManager.h:
-        (WebCore::MediaSessionManagerClient::~MediaSessionManagerClient):
-        (WebCore::MediaSessionManagerClient::MediaSessionManagerClient):
</del><ins>+2013-05-10  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Make sessionWillBegin/EndPlayback() methods take non-const parameters:
-        * platform/audio/MediaSessionManager.h:
-        (WebCore::MediaSessionManager::sessionWillEndPlayback):
-        * platform/audio/ios/MediaSessionManagerIOS.h:
-        * platform/audio/ios/MediaSessionManagerIOS.mm:
-        (WebCore::MediaSessionManagerIOS::sessionWillBeginPlayaback):
-        (WebCore::MediaSessionManagerIOS::sessionWillEndPlayaback):
</del><ins>+        Web Inspector: determine the resource type in InspectorResourceAgent::willSendRequest.
</ins><span class="cx"> 
</span><del>-        Add new files and export new symbols:
-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        This allows the Network timeline and Resources sidebar to filter Resources earlier,
+        before the server sends a response. Useful for long polling (comet) XHRs.
</ins><span class="cx"> 
</span><del>-2014-03-13  Csaba Osztrogonác  &lt;ossy@webkit.org&gt;
</del><ins>+        https://webkit.org/b/74935
+        rdar://problem/13726105
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165544 and r165560.
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-        It broke EFL/GTK/Windows build
</del><ins>+        * inspector/Inspector.json:
+        (Network.requestWillBeSent): Added.
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::willSendRequest): Send the type if it isn't Other along in requestWillBeSent.
+        (WebCore::InspectorResourceAgent::didReceiveResponse): Don't determine the type here anymore. Clear the CachedResource
+        if isNotModified like the old code path did by not setting cachedResource if !isNotModified.
</ins><span class="cx"> 
</span><del>-        Reverted changesets:
</del><ins>+2013-05-10  Laszlo Gombos  &lt;l.gombos@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Optimize hasTagName when called on an HTMLElement&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=130090
-        http://trac.webkit.org/changeset/165544
</del><ins>+        [CMake] Consolidate list of files to build for WebCore plugin support
+        https://bugs.webkit.org/show_bug.cgi?id=104429
</ins><span class="cx"> 
</span><del>-        http://trac.webkit.org/changeset/165560
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-2014-03-13  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Move the common files to support plugins and the logic for disabling
+        plugins) to CMakeLists.txt from PlatformXXX.cmake.
</ins><span class="cx"> 
</span><del>-        Try to stop asserts in debug build.
</del><ins>+        No new tests as there is no new functionality.
</ins><span class="cx"> 
</span><del>-        * dom/Node.cpp:
-        (WebCore::Document::invalidateNodeListAndCollectionCaches):
</del><ins>+        * CMakeLists.txt:
+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * PlatformWinCE.cmake:
</ins><span class="cx"> 
</span><del>-2014-03-13  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-05-10  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Update the build fix for r165544
</del><ins>+        REGRESSION(r148121): Empty Span does not get a linebox when it's in an anonymous block
+        https://bugs.webkit.org/show_bug.cgi?id=115818
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        Fix typo :(
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-2014-03-13  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        r148121 only worried about split inlines inside anonymous blocks - it ought to have 
+        catered for empty inlines, with no continuations, inside a single solitary anonymous block too.
</ins><span class="cx"> 
</span><del>-        Update the build fix for r165544
</del><ins>+        Test: fast/inline/anonymous-block-with-empty-inline.html
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper isSVGGroupElement]):
-        Use the SVG version since the name being tested is a SVG name.
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::hasInlineDirectionBordersPaddingOrMargin):
</ins><span class="cx"> 
</span><del>-2014-03-13  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-05-10  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Attempt to fix the build after r165542
</del><ins>+        [GTK] Remove unnecessary includes in WidgetGtk.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=115912
</ins><span class="cx"> 
</span><del>-        * dom/NodeRenderStyle.h:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-13  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-        Update WebAccessibilityObjectWrapperIOS after r165544
</del><ins>+        * platform/gtk/WidgetGtk.cpp: Remove the unnecessary includes of the Chrome.h, Frame.h, FrameView.h,
+        Page.h and RenderObject.h headers as the included declarations are not used anywhere. ScrollView.h is
+        included instead as it is required and was previously included by one of the removed header inclusions.
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper isSVGGroupElement]):
</del><ins>+2013-05-10  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-13  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        [Cairo] Remove the unnecessary ImageData.h include in ImageBufferCairo.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=115911
</ins><span class="cx"> 
</span><del>-        REGRESSION(r165542): printing/page-rule-selection.html failing
-        https://bugs.webkit.org/show_bug.cgi?id=130205
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::keyframeStylesForAnimation):
-        (WebCore::StyleResolver::styleForPage):
-        
-            Use Document style as parent when resolving page style.
</del><ins>+        * platform/graphics/cairo/ImageBufferCairo.cpp: Remove the ImageData.h include
+        as the included declarations are not used anywhere.
</ins><span class="cx"> 
</span><del>-        (WebCore::StyleResolver::applyPropertyToStyle):
-        * css/StyleResolver.h:
-        
-            Get rid of the default null parameter.
</del><ins>+2013-05-10  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-13  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        [Cairo] Remove the unnecessary CSSParser.h include in GradientCairo.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=115910
</ins><span class="cx"> 
</span><del>-        Remove INPUT_LIST_BUTTON from the PseudoIds
-        https://bugs.webkit.org/show_bug.cgi?id=130108
</del><ins>+        Reviewed by Laszlo Gombos.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyleConstants.h:
-        It is unused.
</del><ins>+        * platform/graphics/cairo/GradientCairo.cpp: Remove the CSSParser.h include
+        as the included declarations are not used anywhere.
</ins><span class="cx"> 
</span><del>-2014-03-12  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+2013-05-10  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS] Sync media playback with now playing
-        https://bugs.webkit.org/show_bug.cgi?id=130172
</del><ins>+        Include tab character as a word end for kerning
+        https://bugs.webkit.org/show_bug.cgi?id=115915
+        &lt;rdar://problem/13861491&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
-        
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::play): Move clientWillBeginPlayback to
-            playInternal so it is called every time playback begins.
-        (WebCore::HTMLMediaElement::playInternal): Call clientWillBeginPlayback.
-        (WebCore::HTMLMediaElement::pause): Move clientWillPausePlayback to
-            playInternal so it is called every time playback begins.
-        (WebCore::HTMLMediaElement::playInternal): Call clientWillPausePlayback.
-        (WebCore::HTMLMediaElement::mediaSessionTitle): New. Return the 'title' attribute,
-            or currenSrc if that is empty.
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::mediaSessionDuration): Return duration.
-        (WebCore::HTMLMediaElement::mediaSessionCurrentTime): Return current time.
</del><ins>+        Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        * platform/audio/MediaSession.cpp:
-        (WebCore::MediaSession::clientWillPausePlayback): New, passthrough to the
-            media element.
-        (WebCore::MediaSession::title): Ditto.
-        (WebCore::MediaSession::duration): Ditto.
-        (WebCore::MediaSession::currentTime): Ditto.
-        * platform/audio/MediaSession.h:
-        (WebCore::MediaSessionClient::mediaSessionTitle):
-        (WebCore::MediaSessionClient::mediaSessionDuration):
-        (WebCore::MediaSessionClient::mediaSessionCurrentTime):
</del><ins>+        This is a follow-up to https://bugs.webkit.org/show_bug.cgi?id=112507
+        which only looked for a space character as a word end. It should
+        look for tab characters too.
</ins><span class="cx"> 
</span><del>-        * platform/audio/MediaSessionManager.cpp:
-        (WebCore::MediaSessionManager::MediaSessionManager): Initialize m_activeSession.
-        (WebCore::MediaSessionManager::removeSession): Set m_activeSession if the session
-            being removed is currently active.
-        (WebCore::MediaSessionManager::sessionWillBeginPlayback): Set m_activeSession.
-        * platform/audio/MediaSessionManager.h:
-        (WebCore::MediaSessionManager::sessionWillEndPlayback):
-        (WebCore::MediaSessionManager::setCurrentSession):
-        (WebCore::MediaSessionManager::currentSession):
</del><ins>+        Test: fast/text/word-space-with-kerning-4.html
</ins><span class="cx"> 
</span><del>-        * platform/audio/ios/MediaSessionManagerIOS.h:
-        * platform/audio/ios/MediaSessionManagerIOS.mm:
-        (WebCore::MediaSessionManageriOS::sessionWillBeginPlayback): Call updateNowPlayingInfo. 
-        (WebCore::MediaSessionManageriOS::sessionWillEndPlayback): Ditto.
-        (WebCore::MediaSessionManageriOS::updateNowPlayingInfo): Update MPNowPlayingInfoCenter
-            with the current media item's title, duration, and current time.
-        (-[WebMediaSessionHelper initWithCallback:]): Turn on deliver of remote control
-            events, even though we don't respond to them yet, or Now Playing won't work.
</del><ins>+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::setLogicalWidthForTextRun): Look for '    '.
</ins><span class="cx"> 
</span><del>-2014-03-13  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+2013-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Webkit not building on XCode 5.1 due to garbage collection no longer being supported
-        https://bugs.webkit.org/show_bug.cgi?id=130087
</del><ins>+        Remove EventTracer
+        https://bugs.webkit.org/show_bug.cgi?id=115916
</ins><span class="cx"> 
</span><del>-        Reviewed by Mark Rowe.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Disable garbage collection on macosx when not using internal SDK.
</del><ins>+        EventTracer is dead code, remove it.
</ins><span class="cx"> 
</span><del>-        No new tests required.
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/EventTracer.cpp: Removed.
+        * platform/EventTracer.h: Removed.
</ins><span class="cx"> 
</span><del>-        * Configurations/Base.xcconfig:
</del><ins>+2013-05-10  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-13  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        [GTK] Generated files are regenerated always
+        https://bugs.webkit.org/show_bug.cgi?id=115908
</ins><span class="cx"> 
</span><del>-        Don't send synchronous resize events when FrameView has auto-sizing enabled.
-        &lt;https://webkit.org/b/130198&gt;
-        &lt;rdar://problem/15991333&gt;
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        No new tests - no change in functionality.
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::sendResizeEventIfNeeded):
</del><ins>+        * GNUmakefile.am: Don't treat the window constructors IDL file as a dependency of the JavaScriptCore bindings.
+        The file is generated during the IDL preprocessing, and the JSC bindings already depend on that step through
+        the idl_supplemental_dependencies file. Because of that the window constructors IDL file has a phony target
+        which seems to confuse the bindings generation rule into thinking that a complete regeration of the bindings is required.
</ins><span class="cx"> 
</span><del>-2014-03-13  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-05-10  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Try to fix release build.
</del><ins>+        Caching of generated images in CSS should be smarter.
+        &lt;http://webkit.org/b/115902&gt;
+        &lt;rdar://problem/13542727&gt;
</ins><span class="cx"> 
</span><del>-        * css/MediaQueryMatcher.cpp:
-        * css/StyleMedia.cpp:
-        * html/HTMLTitleElement.cpp:
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-03-11  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Add an IntSize =&gt; GeneratorGeneratedImage cache at the CSSImageGeneratorValue level.
</ins><span class="cx"> 
</span><del>-        Avoid copy-prone idiom &quot;for (auto item : collection)&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=129990
</del><ins>+        CSSGradientValue is currently the only CSSImageGeneratorValue subclass that makes use of the cache.
+        Generated images are kept for 3 seconds after last use.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        The main problem with the previous approach was that background renderers (e.g &lt;body&gt;, &lt;tr&gt;, etc)
+        would be passed to multiple CSSImageGeneratorValue::getImage() calls with different sizes requested
+        for each of the descendent renderers that inherit their background from the same parent.
+        The cache wasn't smart enough for this, it just thought the background renderer was changing size
+        a lot, and would regenerate the image over and over.
</ins><span class="cx"> 
</span><del>-        Most of these changes have no effect. A few of them get rid of unwanted
-        copying of the items as we iterate them. Found these with the command
-        'git grep &quot;for (auto .*:&quot;' or the equivalent.
</del><ins>+        We already had caching of intermediate image buffers for GeneratorGeneratedImage::drawPattern().
+        This removes the eviction timer from that cache so that the intermediate images can live a bit longer.
</ins><span class="cx"> 
</span><del>-        * Modules/indexeddb/IDBKeyData.cpp:
-        (WebCore::IDBKeyData::IDBKeyData): Use auto&amp; to avoid copying the keys.
-        (WebCore::IDBKeyData::maybeCreateIDBKey): Ditto.
-        (WebCore::IDBKeyData::isolatedCopy): Ditto.
</del><ins>+        (WebCore::CSSImageGeneratorValue::cachedImageForSize):
+        (WebCore::CSSImageGeneratorValue::saveCachedImageForSize):
</ins><span class="cx"> 
</span><del>-        * dom/Node.cpp:
-        (WebCore::Document::invalidateNodeListAndCollectionCaches): Use auto*
-        to make explicit the fact that these are pointers. Stop using &quot;it&quot; for
-        a variable that is not an iterator. Get rid of unneeded local variables
-        for the collections themselves.
</del><ins>+            Renamed from getImage() and putImage().
</ins><span class="cx"> 
</span><del>-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::adoptDocument): Use auto&amp; to make sure we
-        don't do any unnecessary copying. Stop using &quot;it&quot; for a variable that
-        is not an iterator.
</del><ins>+        (WebCore::CSSImageGeneratorValue::evictCachedGeneratedImage):
+        (WebCore::CSSImageGeneratorValue::CachedGeneratedImage::CachedGeneratedImage):
+        (WebCore::CSSImageGeneratorValue::CachedGeneratedImage::evictionTimerFired):
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableRowsCollection.cpp:
-        (WebCore::HTMLTableRowsCollection::lastRow): Use auto* to be explicit
-        that these are pointers.
-        * inspector/InspectorNodeFinder.cpp:
-        (WebCore::InspectorNodeFinder::searchUsingDOMTreeTraversal): Ditto.
-        * page/ios/FrameIOS.mm:
-        (WebCore::Frame::interpretationsForCurrentRoot): Ditto. Also got rid of
-        an unnecessary local variable.
</del><ins>+            Let the CachedGeneratedImage throw itself out from cache when the timer fires.
</ins><span class="cx"> 
</span><del>-        * platform/FileChooser.cpp:
-        (WebCore::FileChooser::chooseFiles): Use auto&amp;. Also fix a FIXME.
-        (WebCore::FileChooser::chooseMediaFiles): Ditto.
</del><ins>+        * css/CSSImageGeneratorValue.h:
+        (CachedGeneratedImage):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        (WebCore::SourceBufferPrivateAVFObjC::naturalSize): Use auto&amp;.
</del><ins>+            Exactly what it sounds like. These go into CSSImageGeneratorValue::m_images with the size
+            as the hash key.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderIterator.h: Changed include from RenderObject.h to
-        RenderElement.h; iterators are based on RenderElement now.
</del><ins>+        * platform/graphics/GeneratorGeneratedImage.cpp:
+        (WebCore::GeneratorGeneratedImage::drawPattern):
+        * platform/graphics/GeneratorGeneratedImage.h:
+        (WebCore::GeneratorGeneratedImage::~GeneratorGeneratedImage):
+        (WebCore::GeneratorGeneratedImage::GeneratorGeneratedImage):
</ins><span class="cx"> 
</span><del>-        * rendering/svg/RenderSVGResource.cpp:
-        (WebCore::removeFromCacheAndInvalidateDependencies): Use auto*.
</del><ins>+            Keep the intermediate image for drawPattern() until destruction instead of dropping it on
+            a timer. These objects are now evicted by the CSSImageGeneratorValue's image cache
+            after 3 seconds of disuse rather than kept for the lifetime of the renderer.
</ins><span class="cx"> 
</span><del>-        * rendering/svg/RenderSVGResourceContainer.cpp:
-        (WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation): Use auto*.
-        (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation): Ditto.
-        (WebCore::RenderSVGResourceContainer::registerResource): Ditto.
</del><ins>+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasChanged):
+        (WebCore::CSSCanvasValue::canvasResized):
+        * css/CSSCrossfadeValue.cpp:
+        (WebCore::CSSCrossfadeValue::crossfadeChanged):
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::addClient):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::addClient):
+        (WebCore::CSSImageGeneratorValue::removeClient):
</ins><span class="cx"> 
</span><del>-        * rendering/svg/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderSupport::layoutChildren): Updated to use a more specific
-        type, to use auto* instead of of auto, and to eliminate the slightly sloppily
-        capitalized and not-so-slightly ungrammatical notlayoutedObjects.
-        (WebCore::SVGRenderSupport::applyStrokeStyleToContext): Use auto&amp;.
-        (WebCore::SVGRenderSupport::updateMaskedAncestorShouldIsolateBlending): Use auto*.
</del><ins>+            CSSImageGeneratorValue::m_clients is now a HashCountedSet&lt;RenderObject*&gt;, tweak accordingly.
</ins><span class="cx"> 
</span><del>-        * rendering/svg/SVGResourcesCycleSolver.cpp:
-        (WebCore::SVGResourcesCycleSolver::resourceContainsCycles): Use auto*.
-        (WebCore::SVGResourcesCycleSolver::resolveCycles): Ditto. Also lineageOfType.
</del><ins>+2013-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * svg/SVGAnimateMotionElement.cpp:
-        (WebCore::SVGAnimateMotionElement::applyResultsToTarget): Use auto*.
-        * svg/SVGPathElement.cpp:
-        (WebCore::SVGPathElement::invalidateMPathDependencies): Ditto.
</del><ins>+        Remove MemoryUsageSupport class
+        https://bugs.webkit.org/show_bug.cgi?id=115913
</ins><span class="cx"> 
</span><del>-2014-03-13  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Web Inspector: Remove unused callId parameter from evaluateInWebInspector
-        https://bugs.webkit.org/show_bug.cgi?id=129744
</del><ins>+        MemoryUsageSupport was just used by a single call site in InspectorTimelineAgent,
+        and the function called always returns zero on all platforms! Remove it.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorMemoryAgent.cpp:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorTimelineAgent::setNativeHeapStatistics):
+        * platform/MemoryUsageSupport.cpp: Removed.
+        * platform/MemoryUsageSupport.h: Removed.
+        * platform/qt/MemoryUsageSupportQt.cpp: Removed.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::evaluateForTestInFrontend):
-        * inspector/InspectorController.h:
</del><ins>+2013-05-10  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-13  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        REGRESSION (r149652): Videos do not play on cnn.com, just black box
+        https://bugs.webkit.org/show_bug.cgi?id=115887
</ins><span class="cx"> 
</span><del>-        Optimize hasTagName when called on an HTMLElement
-        https://bugs.webkit.org/show_bug.cgi?id=130090
-
</del><span class="cx">         Reviewed by Antti Koivisto.
</span><span class="cx"> 
</span><del>-        Added new hasTagName functions that have the efficiency of hasLocalName.
-        but are safe.
</del><ins>+        The bug was caused by window and document named item maps counting the same element twice
+        when it has the same id and name attribute values. Fixed the bug by avoiding to add or remove
+        an element per id and name attribute updates when it had already been added or removed by
+        name and id attribute updates respectively.
</ins><span class="cx"> 
</span><del>-        Now we can always use hasTagName, and we'll get a compile time error if
-        we try to use an SVG tag name with an HTML element. All call sites that
-        use the more specific tag name types are more efficient, and call sites
-        that have a specific pointer type will get even more efficient checking
-        that is exactly what we used to get by calling hasLocalName.
</del><ins>+        We do this by checking whether the other attribute affects the element's precense in window
+        and document named item maps and avoiding to add or remove the attribute when they do and
+        the other attribute is present in updateId and updateName.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::hasTagName): Cast explicitly to Element
-        since Node::hasTagName no longer works on a general QualifiedName.
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isDescendantOfElementType): Use
-        more specific type, RenderElement, so we can call hasTagName on Element
-        instead of Node; eliminates an unnecessary branch.
</del><ins>+        Consider a scenario when an object element has id &quot;foo&quot;, and name attribute is about to be also
+        set to &quot;foo&quot;. If the id attribute doesn't affect element's presense in window or document
+        named item maps, we're done. If it does, then the maps already have this element so we don't
+        want to add it again. Conversely, if the element already has id and name attributes set to
+        &quot;foo&quot;, and we're moving the id attribute, then we want to remove the element from the maps only
+        if the id doesn't affect the presence of the element in the maps.
</ins><span class="cx"> 
</span><del>-        * dom/DocumentStyleSheetCollection.cpp:
-        (WebCore::DocumentStyleSheetCollection::collectActiveStyleSheets): Use
-        new for loop and full words for variable names. Also use nullptr instead
-        of 0. Call toHTMLElement and toSVGElement in code that checks hasTagName
-        since it's already checking isHTMLElement and isSVGElement.
</del><ins>+        Unfortuntely, this logic doesn't work when we're inserting or removing an element on its entirely
+        because updateId and updateName are called when both id and name attributes are present so skip
+        this step (AlwaysUpdateHTMLDocumentNamedItemMaps) for the id attribute to break the symmetry.
</ins><span class="cx"> 
</span><ins>+        Test: fast/dom/HTMLDocument/image-with-same-id-and-name.html
+              fast/dom/HTMLDocument/object-with-same-id-and-name.html
+
</ins><span class="cx">         * dom/Element.cpp:
</span><del>-        (WebCore::attrNodeListMap): Use NeverDestroyed and put the vectors into
-        the map rather than putting pointers to a vector into the map.
-        (WebCore::attrNodeListForElement): Take a reference rather than a pointer,
-        and update for the change above.
-        (WebCore::ensureAttrNodeListForElement): Ditto.
-        (WebCore::removeAttrNodeListForElement): Ditto.
-        (WebCore::findAttrNodeInList): Ditto.
-        (WebCore::Element::isFocusable): Use ancestorsOfType&lt;HTMLCanvasElement&gt;
-        to fine the canvas rather than a hand-written loop.
-        (WebCore::Element::attrNodeList): Update for above changes.
-        (WebCore::Element::setAttributeNode): Ditto.
-        (WebCore::Element::attrIfExists): Ditto.
-        (WebCore::Element::ensureAttr): Ditto.
-        (WebCore::Element::detachAttrNodeFromElementWithValue): Ditto.
-        (WebCore::Element::detachAllAttrNodesFromElement): Ditto.
</del><ins>+        (WebCore::Element::insertedInto): Call updateId and updateName with
+        AlwaysUpdateHTMLDocumentNamedItemMaps.
+        (WebCore::Element::removedFrom): Ditto.
+        (WebCore::Element::updateName): Don't add or remove this element if the id attribute has already
+        done so except when we're inserting, removing, or cloning an element.
+        (WebCore::Element::updateId): Ditto for the name attribute.
+        (WebCore::Element::cloneAttributesFromElement): Added a comment and assert that we never call this
+        function when this element is in the document. We can't update window and documemt named item
+        maps here because image element's id attribute value, for example, is present in the document's
+        named item map if it has a name attribute. Since this function calls updateId and updateName
+        before updating attributes, this check is going to fail in DocumentNameCollection's
+        nodeMatchesIfIdAttributeMatch and bad things will happen.
</ins><span class="cx"> 
</span><del>-        * dom/Element.h: Removed the overload of hasLocalName that takes a
-        QualifiedName and ignores the non-local-name parts of it. Callers should
-        use hasTagName instead, now that it's optimized appropriately. Added
-        overloads of hasTagName for all the specific qualified name types. It's
-        more efficient to use the Node versions of these functions rather than
-        using QualifiedName::matches to do the check. Removed the hasTagName and
-        hasLocalName functions from the Node class; the only convenience functions
-        needed in Node are the specific checks for tags from HTML, MathML, and SVG,
-        not the general purpose ones.
</del><ins>+        * dom/Element.h:
</ins><span class="cx"> 
</span><del>-        * dom/Node.h: Removed hasLocalName and replaced the single hasTagName
-        that takes a QualifiedName with three faster ones that take HTML, MathML,
-        and SVG qualified names instead. Also updated to use nullptr instead of 0.
</del><ins>+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren): Clone children and attributes before
+        inserting the swapped span to avoid hitting the assertion in cloneAttributesFromElement we added.
</ins><span class="cx"> 
</span><del>-        * dom/PositionIterator.cpp: Added now-needed include.
-        * dom/Text.cpp: Ditto.
</del><ins>+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseAttribute):
</ins><span class="cx"> 
</span><del>-        * dom/make_names.pl:
-        (printHeaderHead): Renamed an argument for clarity and added a definitions
-        argument, which is where we insert the classes derived from QualifiedName.
-        (printCppHead): Renamed an argument for clarity.
-        (printTypeHelpers): Use hasTagName rather than hasLocalName, since the
-        former is now optimized to be the same as what the latter was.
-        (printNamesHeaderFile): Define a class derived from QualifiedName that can
-        be used at compile time to avoid having to check the namespace.
-        (printNamesCppFile): Use the new more-specific type as needed.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::isLegacyAppleStyleSpan): Use hasTagName instead of hasLocalName,
-        and references instead of pointers.
-        (WebCore::ApplyStyleCommand::ApplyStyleCommand): Removed uneeded explicit
-        construction of a smart pointer.
-        (WebCore::ApplyStyleCommand::shouldApplyInlineStyleToRun): Updated to use
-        the enclosingElementWithTag function by its new name.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::selectionUnorderedListState): Updated to use the
-        enclosingElementWithTag function by its new name.
-        (WebCore::Editor::selectionOrderedListState): Ditto.
-
-        * editing/InsertListCommand.cpp:
-        (WebCore::InsertListCommand::doApply): Use a more-specific type for the list tag.
-        (WebCore::InsertListCommand::doApplyForSingleParagraph): Ditto.
-        * editing/InsertListCommand.h: Ditto.
-
-        * editing/MarkupAccumulator.cpp:
-        (WebCore::MarkupAccumulator::serializeNodesWithNamespaces): Added an explicit
-        cast to Element in the loop that is already guarded by an isElementNode check.
-        Also use a modern C++ for loop.
-
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
-        Updated to use the enclosingElementWithTag function by its new name.
-        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds): Ditto.
-        (WebCore::ReplaceSelectionCommand::positionAtEndOfInsertedContent): Ditto.
-
-        * editing/TypingCommand.cpp: Added now-needed includes.
-        * editing/VisibleUnits.cpp: Ditto.
-
-        * editing/htmlediting.cpp:
-        (WebCore::enclosingElementWithTag): Changed to return an Element instead of a Node,
-        since nodes other than elements do not have tags.
-        * editing/htmlediting.h: Ditto.
-
-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::adjustedSelectionRange): Updated to use the enclosingElementWithTag
-        function by its new name.
-        * editing/markup.cpp:
-        (WebCore::StyledMarkupAccumulator::appendText): Ditto.
-        (WebCore::StyledMarkupAccumulator::traverseNodesForSerialization): Ditto.
-        (WebCore::highestAncestorToWrapMarkup): Ditto.
-        (WebCore::createMarkupInternal): Ditto.
-        (WebCore::createContextualFragment): Ditto. Use hasTagName instead of hasLocalName,
-        since the former is now optimized to be the same as the latter was before.
-
-        * html/HTMLCollection.cpp:
-        (WebCore::isMatchingElement): Use hasTagName instead of hasLocalName,
-        since the former is now optimized to be the same as the latter was before.
-        (WebCore::nameShouldBeVisibleInDocumentAll): Ditto.
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::ieForbidsInsertHTML): Ditto.
-        (WebCore::unicodeBidiAttributeForDirAuto): Ditto.
-        (WebCore::HTMLElement::parseBorderWidthAttribute): Ditto.
-        (WebCore::HTMLElement::setInnerHTML): Ditto.
-        (WebCore::shouldProhibitSetInnerOuterText): Ditto. Added this to share code between
-        setInnerText and setOuterText.
-        (WebCore::HTMLElement::setInnerText): Ditto.
-        (WebCore::HTMLElement::setOuterText): Ditto.
-        (WebCore::HTMLElement::rendererIsNeeded): Ditto.
-        (WebCore::HTMLElement::createElementRenderer): Ditto.
-
-        * html/HTMLElement.h: Added hasTagName, which hides the one inherited from Element
-        and takes the more-specific HTMLQualifiedName type. This means we don't need to check
-        the namespace at runtime because it's known at compile time. Also put the
-        implementation of Node::hasTagName for HTMLQualifiedName into this header.
-
</del><span class="cx">         * html/HTMLObjectElement.cpp:
</span><del>-        (WebCore::isRecognizedTagName): Updated for change in return type of
-        HTMLNames::getHTMLTags.
</del><ins>+        (WebCore::HTMLObjectElement::updateDocNamedItem):
</ins><span class="cx"> 
</span><del>-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::add): Use hasTagName inastead of hasLocalName.
-        (WebCore::HTMLSelectElement::value): Use isHTMLOptionElement instead of hasTagName.
-        Also use a new style for loop and emptyString() instead of &quot;&quot;.
-        (WebCore::HTMLSelectElement::setValue): Ditto.
-        (WebCore::HTMLSelectElement::setLength): Ditto.
-        (WebCore::HTMLSelectElement::searchOptionsForValue): Ditto.
-        (WebCore::HTMLSelectElement::restoreFormControlState): Ditto.
</del><ins>+2013-05-09  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::additionalPresentationAttributeStyle): Use hasTagName
-        instead of hasLocalName.
</del><ins>+        Don't trust character widths for internal OS X fonts in form controls
+        https://bugs.webkit.org/show_bug.cgi?id=115883
+        &lt;rdar://problem/13817757&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableRowsCollection.cpp:
-        (WebCore::isInSection): Updated to use hasTagName and take a reference.
-        (WebCore::HTMLTableRowsCollection::rowAfter): Pass a reference.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLConstructionSite.cpp: Added now-needed include.
</del><ins>+        We ignore the character width for a bunch of fonts when predicting
+        the width of a form control. Some of the internal fonts in OS X are
+        not in the ignored list. Rather than add them, simply test for
+        fonts whose family begins with a period character &quot;.&quot;.
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::createCaseMap): Updated to return a map rather than filling one in, and to
-        be flxible about the type of the table being used.
-        (WebCore::adjustSVGTagNameCase): Updated to use NeverDestroyed.
-        (WebCore::adjustAttributes): Added new helper so we can share more code. Updated
-        template argument names for clarity.
-        (WebCore::adjustSVGAttributes): Marked this inline, since it just turns around and
-        calls a single non-inline function.
-        (WebCore::adjustMathMLAttributes): Ditto.
-        (WebCore::addNamesWithPrefix): Changed to take argument by reference instead of pointer.
-        (WebCore::createForeignAttributesMap): Added. Factors out the map creation from the
-        function below.
-        (WebCore::adjustForeignAttributes): Updated for above changes.
-        (WebCore::HTMLTreeBuilder::processStartTagForInBody): Updated to pass reference.
-        (WebCore::HTMLTreeBuilder::processTokenInForeignContent): Ditto.
</del><ins>+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::hasValidAvgCharWidth): Return false for
+            any family that starts with &quot;.&quot;
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorStyleSheet.cpp: Added now-needed include.
</del><ins>+2013-05-10  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLElement.h: Added hasTagName, which hides the one inherited from Element
-        and takes the more-specific MathMLQualifiedName type. This means we don't need to check
-        the namespace at runtime because it's known at compile time. Also put the
-        implementation of Node::hasTagName for MathMLQualifiedName into this header.
</del><ins>+        [GTK] Remove unnecessary GLIB_CHECK_VERSION #ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=115904
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLInlineContainerElement.cpp:
-        (WebCore::MathMLInlineContainerElement::createElementRenderer): Use hasTagName.
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        * mathml/MathMLSelectElement.cpp:
-        (WebCore::MathMLSelectElement::attributeChanged): Use hasTagName.
-        (WebCore::MathMLSelectElement::getSelectedActionChildAndIndex): Ditto.
-        (WebCore::MathMLSelectElement::getSelectedActionChild): Ditto.
-        (WebCore::MathMLSelectElement::getSelectedSemanticsChild): Ditto.
-        (WebCore::MathMLSelectElement::updateSelectedChild): Ditto.
-        * mathml/MathMLTextElement.cpp:
-        (WebCore::MathMLTextElement::createElementRenderer): Ditto.
-        (WebCore::MathMLTextElement::childShouldCreateRenderer): Ditto.
</del><ins>+        * bindings/gobject/WebKitDOMEventTarget.cpp:
+        * platform/gtk/GtkVersioning.c:
+        * platform/gtk/GtkVersioning.h:
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.mm: Added now-needed include.
-        * rendering/RenderBlockFlow.cpp: Ditto.
</del><ins>+2013-05-10  Zoltan Arvai  &lt;zarvai@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Use hasTagName.
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::rendererForRootBackground): Ditto.
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Ditto.
</del><ins>+        Unreviewed. Fix the ENABLE(SHARED_WORKERS) build after r149864.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderReplaced.cpp: Added now-needed include.
</del><ins>+        * workers/SharedWorkerThread.cpp: include &quot;SecurityOrigin.h&quot;
</ins><span class="cx"> 
</span><del>-        * rendering/mathml/RenderMathMLScripts.cpp:
-        (WebCore::RenderMathMLScripts::RenderMathMLScripts): Use hasTagName.
-        * rendering/mathml/RenderMathMLUnderOver.cpp:
-        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver): Ditto.
</del><ins>+2013-05-10  Claudio Saavedra  &lt;csaavedra@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * svg/SVGElement.h: Added hasTagName, which hides the one inherited from Element
-        and takes the more-specific SVGQualifiedName type. This means we don't need to check
-        the namespace at runtime because it's known at compile time. Also put the
-        implementation of Node::hasTagName for SVGQualifiedName into this header.
</del><ins>+        Fix build after r149864.
</ins><span class="cx"> 
</span><del>-        * svg/SVGFontFaceSrcElement.cpp:
-        (WebCore::SVGFontFaceSrcElement::childrenChanged): Use isSVGFontFaceElement instead
-        of calling hasTagName.
</del><ins>+        Unreviewed build fix.
</ins><span class="cx"> 
</span><del>-        * svg/SVGUseElement.cpp:
-        (WebCore::isDirectReference): Changed to take a reference and a more specific type.
-        (WebCore::SVGUseElement::toClipPath): Added a type cast.
-        (WebCore::SVGUseElement::rendererClipChild): Use more specific types so we don't
-        need a type cast.
</del><ins>+        * loader/ThreadableLoader.h: include &lt;wtf/text/AtomicString.h&gt;
+        when building with RESOURCE_TIMING enabled.
</ins><span class="cx"> 
</span><del>-        * xml/parser/XMLDocumentParser.cpp:
-        (WebCore::XMLDocumentParser::parseDocumentFragment): Added explicit calls to this
-        unusual call site that has a good reason to use hasLocalName instead of hasTagName.
</del><ins>+2013-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-13  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Fix build.
</ins><span class="cx"> 
</span><del>-        Try to fix iOS build.
</del><ins>+        * bindings/js/ScriptController.cpp:
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::performPostLayoutTasks):
</del><ins>+2013-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-13  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Remove ScriptInstance.h
+        https://bugs.webkit.org/show_bug.cgi?id=115900
</ins><span class="cx"> 
</span><del>-        Remove StyleResolver::State::m_parentNode
-        https://bugs.webkit.org/show_bug.cgi?id=130194
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        This variable was the &quot;parent&quot; node where the style was being inherited from, not the actual parent.
-        The code would also recompute it even though the call sites generally know the rendering parent already.
</del><ins>+        Remove yet another abstraction now that we don't support V8.
</ins><span class="cx"> 
</span><del>-        If we consistently pass parent style to StyleResolver::styleForElement we won't need the variable and
-        the associated code. We also get rid of one more client of NodeRenderingTraversal.
</del><ins>+        * GNUmakefile.list.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.h:
+        (Bindings):
+        (ScriptController):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/js/ScriptInstance.h: Removed.
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::getInstance):
+        * html/HTMLPlugInElement.h:
+        (Bindings):
+        (HTMLPlugInElement):
+        * platform/graphics/wince/MediaPlayerProxy.h:
+        (WebMediaPlayerProxy):
+        * rendering/RenderEmbeddedObject.cpp:
+        * rendering/RenderSnapshottedPlugIn.cpp:
</ins><span class="cx"> 
</span><del>-        * css/MediaQueryMatcher.cpp:
-        (WebCore::MediaQueryMatcher::prepareEvaluator):
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::StyleResolver::applySVGProperty):
-        * css/StyleMedia.cpp:
-        (WebCore::StyleMedia::matchMedium):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::State::clear):
-        (WebCore::StyleResolver::StyleResolver):
-        (WebCore::StyleResolver::State::initForStyleResolve):
-        (WebCore::StyleResolver::applyProperty):
-        * css/StyleResolver.h:
-        (WebCore::StyleResolver::document):
-        (WebCore::StyleResolver::State::State):
-        * dom/Element.cpp:
-        (WebCore::Element::customStyleForRenderer):
-        
-            Add parentStyle parameter.
</del><ins>+2013-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Element.h:
-        * dom/PseudoElement.cpp:
-        (WebCore::PseudoElement::customStyleForRenderer):
-        * dom/PseudoElement.h:
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::didAttachRenderers):
-        (WebCore::HTMLOptGroupElement::updateNonRenderStyle):
-        (WebCore::HTMLOptGroupElement::customStyleForRenderer):
-        * html/HTMLOptGroupElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::didAttachRenderers):
-        (WebCore::HTMLOptionElement::updateNonRenderStyle):
-        (WebCore::HTMLOptionElement::customStyleForRenderer):
-        * html/HTMLOptionElement.h:
-        * html/HTMLTitleElement.cpp:
-        (WebCore::HTMLTitleElement::textWithDirection):
-        * html/shadow/TextControlInnerElements.cpp:
-        (WebCore::TextControlInnerElement::customStyleForRenderer):
-        (WebCore::TextControlInnerTextElement::customStyleForRenderer):
-        * html/shadow/TextControlInnerElements.h:
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::computeStyleInRegion):
-        (WebCore::RenderNamedFlowFragment::computeChildrenStyleInRegion):
-        (WebCore::RenderNamedFlowFragment::setRegionObjectsRegionStyle):
-        * rendering/RenderNamedFlowFragment.h:
-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::styleForElement):
-        
-            This used to be Element::styleForRenderer. It is now a standalone static.
</del><ins>+        Unreviewed, rolling out r149866.
+        http://trac.webkit.org/changeset/149866
+        https://bugs.webkit.org/show_bug.cgi?id=115898
</ins><span class="cx"> 
</span><del>-        (WebCore::Style::elementInsideRegionNeedsRenderer):
-        (WebCore::Style::createRendererIfNeeded):
-        (WebCore::Style::resolveLocal):
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::customStyleForRenderer):
-        * svg/SVGElement.h:
</del><ins>+        Broke tests
</ins><span class="cx"> 
</span><del>-2014-03-13  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::setDomain):
+        (WebCore::Document::initSecurityContext):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::isolatedCopy):
+        (WebCore::SecurityOrigin::setDomainFromDOM):
+        (WebCore::SecurityOrigin::grantUniversalAccess):
+        * page/SecurityOrigin.h:
+        (SecurityOrigin):
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Nested layers with subpixel accumulation paint to wrong position.
-        https://bugs.webkit.org/show_bug.cgi?id=130153
</del><ins>+2013-05-10  Andrei Bucur  &lt;abucur@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Remove overflow dead code
+        https://bugs.webkit.org/show_bug.cgi?id=115893
</ins><span class="cx"> 
</span><del>-        Subpixels (fractional device pixels here) can accumulate through nested layers. Subpixels
-        need to be propagated through the layer tree so that painting coordinates match layout coordinates.
-        
-        Compositing case: (absolute positioning, 2x display)
-        parent layer pos(0.3, 0.3) -&gt; floored painting position (0, 0)
-        child layer pos(10.2, 10.2) -&gt; layout offset from parent (10.2, 10.2), 
-        but the actual painting offset is (10.5, 10.5) as the result of parent flooring.
-        
-        Non-compositing case: (absolute positioning, 2x display)
-        parent layer pos(0.3, 0.3) -&gt; GraphicsContext is translated to (0, 0).
-        child layer pos(10.2, 10.2) -&gt; layout offset from parent (10.2, 10.2)
-        but the GraphicsContext's offset is (10.5, 10.5) as the result of the parent's translate.   
-
-        In both cases, without the subpixel adjustment, we'd paint the current layer at (10.0, 10.0)
-        after flooring, while its painting position is actually (10.5, 10.5).
-        Subpixels do accumulate through nested layers.
-
-        Tests: compositing/hidpi-nested-compositing-layers-with-subpixel-accumulation.html
-               fast/layers/hidpi-nested-layers-with-subpixel-accumulation.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::devicePixelFractionFromRenderer):
-
-2014-03-13  Radu Stavila  &lt;stavila@adobe.com&gt;
-
-        The scrolledContentOffset method should handle the hasOverflowClip check
-        https://bugs.webkit.org/show_bug.cgi?id=130028
-
</del><span class="cx">         Reviewed by Antti Koivisto.
</span><span class="cx"> 
</span><del>-        Before this patch, every call to RenderBox::scrolledContentOffset was guarded by the
-        hasOverflowClip check, because the scrolledContentOffset method would ASSERT(hasOverflowClip()).
-        This was simplified by moving the hasOverflowClip check inside the scrolledContentOffset method
-        and returning (0, 0) for elements that do not clip the overflow.
</del><ins>+        The patch removes unused public overflow accesor functions from RenderOverflow and InlineFlowBox.
</ins><span class="cx"> 
</span><del>-        No new tests needed, just a refactor.
</del><ins>+        Tests: no tests, code cleanup.
</ins><span class="cx"> 
</span><del>-        * editing/VisibleUnits.cpp:
-        (WebCore::absoluteLineDirectionPointToLocalPointInBlock):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paintObject):
-        (WebCore::RenderBlock::selectionGapRectsForRepaint):
-        (WebCore::RenderBlock::paintSelection):
-        (WebCore::RenderBlock::nodeAtPoint):
-        (WebCore::RenderBlock::offsetForContents):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scrolledContentOffset):
-        (WebCore::RenderBox::offsetFromContainer):
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::offsetFromContainer):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::mapLocalToContainer):
-        (WebCore::RenderObject::pushMappingToContainer):
-        (WebCore::RenderObject::mapAbsoluteToLocalPoint):
-        (WebCore::RenderObject::offsetFromContainer):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::hitInnerTextElement):
</del><ins>+        * rendering/InlineFlowBox.h: Removed logicalLeftLayoutOverflow and logicalRightLayoutOverflow.
+        * rendering/RenderOverflow.h: Removed setMinYLayoutOverflow, setMaxYLayoutOverflow,
+            setMinXLayoutOverflow, setMaxXLayoutOverflow, setMinYVisualOverflow, setMaxYVisualOverflow,
+            setMinXVisualOverflow and setMaxXVisualOverflow.
</ins><span class="cx"> 
</span><del>-2014-03-13  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+2013-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        AX: accessibility data table heuristics fail on this jQuery table
-        https://bugs.webkit.org/show_bug.cgi?id=129369
</del><ins>+        Begin making SecurityOrigin immutable
+        https://bugs.webkit.org/show_bug.cgi?id=115898
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Updated accessibility/table-detection.html
</del><ins>+        Replace SecurityOrigin::setDomainFromDOM and SecurityOrigin::grantUniversalAccess with
+        member functions that return new SecurityOrigin objects.
</ins><span class="cx"> 
</span><del>-        If a table uses display style of table-row-group, the RenderTable gets disassociated from the HTMLTableElement.
-        We can find that element in a different way by asking for the parent of the first table section.
-
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::activeDescendant):
-            This method was accessing an object's element unsafely and this table change exposed the issue.
-        * accessibility/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::tableElement):
-        (WebCore::AccessibilityTable::isDataTable):
-        * accessibility/AccessibilityTable.h:
-
-2014-03-13  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Ensure that layout milestones complete in all cases
-        https://bugs.webkit.org/show_bug.cgi?id=130101
-        
-        Reviewed by Darin Adler.
-        
-        Milestones fail to complete in some testing scenarios.
-
</del><span class="cx">         * dom/Document.cpp:
</span><del>-        (WebCore::Document::setParsing):
-        
-            Check if we need to fire layout milestones if parsing finishes without pending layout.
-            Parsing status affects whether the document is considered non-empty and that affects
-            layout milestones.
</del><ins>+        (WebCore::Document::setDomain):
+        Update the security origin to one returned by copyWithDomainSetFromDOM.
+    
+        (WebCore::Document::initSecurityContext):
+        Set the security origin to one returned by copyWithUniversalAccessGranted().
</ins><span class="cx"> 
</span><del>-            Remove explicit layout scheduling here, layout timer will be active already if there
-            is a layout pending
</del><ins>+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        Add a new constructor that takes all the member variables as parameters. This is a little unwieldy at the moment,
+        but all the boolean parameters could be replaced by a bitmask of flags.
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::performPostLayoutTasks):
-        (WebCore::FrameView::firePaintRelatedMilestonesIfNeeded):
-        
-            Renamed for consistency
</del><ins>+        (WebCore::SecurityOrigin::isolatedCopy):
+        Call the new constructor.
</ins><span class="cx"> 
</span><del>-        (WebCore::FrameView::fireLayoutRelatedMilestonesIfNeeded):
-        
-            Factor layout milestone firing into a function.
</del><ins>+        (WebCore::SecurityOrigin::copyWithDomainSetFromDOM):
+        Return a new security origin with m_domainWasSetInDOM set to true and the domain updated.
</ins><span class="cx"> 
</span><del>-        * page/FrameView.h:
</del><ins>+        (WebCore::SecurityOrigin::copyWithUniversalAccessGranted):
+        Return a new security origin with m_universalAccess set to true.
</ins><span class="cx"> 
</span><del>-2014-03-12  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+2013-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Replay: add infrastructure for memoizing nondeterministic DOM APIs
-        https://bugs.webkit.org/show_bug.cgi?id=129445
</del><ins>+        Remove ScriptController::updateSecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=115895
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Add two pieces of infrastructure to support memoization of selected DOM APIs.
</del><ins>+        ScriptController::updateSecurityOrigin is just dead code now that the V8 bindings are gone.
</ins><span class="cx"> 
</span><del>-        The first piece is MemoizedDOMResult, a templated replay input class that knows
-        how to serialize a DOM API's return value, ctype, and exception code.
</del><ins>+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::setIsViewSource):
+        (WebCore::Document::setDomain):
+        * dom/Document.h:
+        (Document):
+        * dom/SecurityContext.cpp:
+        (WebCore::SecurityContext::enforceSandboxFlags):
+        * dom/SecurityContext.h:
+        (SecurityContext):
</ins><span class="cx"> 
</span><del>-        The second piece is the addition of a new IDL attribute called `Nondeterministic`.
-        When placed on a DOM function or attribute, the code generator will emit code
-        to save the DOM API's return value or use a memoized return value instead,
-        depending on the current replay state. This new emitted code path is behind
-        a feature flag.
</del><ins>+2013-05-10  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, as no new inputs are addressed by this change. Per-DOM API replay
-        regression tests will be added when those APIs are marked as nondeterministic.
</del><ins>+        Stop including SecurityOrigin.h where unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=115897
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/scripts/CodeGeneratorJS.pm: Add support of the `Nondeterministic` attribute.
-        (GenerateImplementation): Handle cases for attributes and getters with exceptions.
-        (GenerateImplementationFunctionCall): Handle function calls with and without exceptions.
-        (GetNativeTypeForMemoization): Added. Converts DOMString to WTF::String.
-        * bindings/scripts/IDLAttributes.txt: Add new `Nondeterministic` attribute.
-        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
-        (WebCore::jsTestEventTargetPrototypeFunctionItem):
-        (WebCore::jsTestEventTargetPrototypeFunctionDispatchEvent):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
-        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::jsTestObjAttrWithGetterException):
-        (WebCore::jsTestObjStringAttrWithGetterException):
-        (WebCore::jsTestObjWithScriptStateAttributeRaises):
-        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
-        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
-        (WebCore::jsTestObjNullableStringValue):
-        (WebCore::jsTestObjPrototypeFunctionByteMethod):
-        (WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionOctetMethod):
-        (WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionLongMethod):
-        (WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionObjMethod):
-        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
-        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence):
-        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObj):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObjException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
-        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
-        (WebCore::jsTestObjPrototypeFunctionConditionalMethod1):
-        (WebCore::jsTestObjConstructorFunctionClassMethodWithOptional):
-        (WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
-        (WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
-        (WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
-        (WebCore::jsTestObjPrototypeFunctionMutablePointFunction):
-        (WebCore::jsTestObjPrototypeFunctionImmutablePointFunction):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunction):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
-        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::jsTestTypedefsAttrWithGetterException):
-        (WebCore::jsTestTypedefsStringAttrWithGetterException):
-        (WebCore::jsTestTypedefsPrototypeFunctionMethodWithSequenceArg):
-        (WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction):
-        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction):
-        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction2):
-        (WebCore::jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude):
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * replay/AllReplayInputs.h:
-        * replay/MemoizedDOMResult.cpp: Added.
-        (WebCore::MemoizedDOMResultBase::type):
-        (WebCore::MemoizedDOMResultBase::createFromEncodedResult):
-        (InputTraits&lt;MemoizedDOMResultBase&gt;::type):
-        (InputTraits&lt;MemoizedDOMResultBase&gt;::encode):
-        (InputTraits&lt;MemoizedDOMResultBase&gt;::decode):
</del><ins>+        Move rarely called functions out of line so headers don't have to include SecurityOrigin.h
</ins><span class="cx"> 
</span><del>-        * replay/MemoizedDOMResult.h: Added. Every specialization of MemoizedDOMResult&lt;T&gt;
-        stores a binding name, ctype, result value of type T, and optional exception code.
-        The ctype-specific code uses the CTypeTraits struct to abstract over enum names and
-        compiler types. The actual encode/decode methods just use methods from EncodingTraits&lt;T&gt;.
</del><ins>+        * Modules/indexeddb/IDBFactoryBackendImpl.h:
+        * Modules/webdatabase/DatabaseBackendBase.cpp:
+        (WebCore::DatabaseBackendBase::databaseDebugName):
+        * Modules/webdatabase/DatabaseBackendBase.h:
+        (DatabaseBackendBase):
+        * Modules/webdatabase/DatabaseSync.h:
+        * bindings/js/JSDOMWindowCustom.h:
+        * html/parser/XSSAuditor.cpp:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions):
+        (WebCore::ThreadableLoaderOptions::~ThreadableLoaderOptions):
+        (WebCore::ThreadableLoader::create):
+        * loader/ThreadableLoader.h:
+        (ThreadableLoaderOptions):
+        * loader/WorkerThreadableLoader.cpp:
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerThread.cpp:
+        * workers/SharedWorkerContext.cpp:
+        * workers/WorkerThread.cpp:
+        * workers/WorkerThread.h:
</ins><span class="cx"> 
</span><del>-        (WebCore::MemoizedDOMResultBase::MemoizedDOMResultBase):
-        (WebCore::MemoizedDOMResultBase::~MemoizedDOMResultBase):
-        (WebCore::MemoizedDOMResultBase::attribute):
-        (WebCore::MemoizedDOMResultBase::ctype):
-        (WebCore::MemoizedDOMResultBase::exceptionCode):
-        (WebCore::CTypeTraits::decode):
-        (WebCore::MemoizedDOMResultBase::convertTo):
-        (JSC::InputTraits&lt;MemoizedDOMResultBase&gt;::queue):
-        * replay/ReplayInputTypes.cpp: See below.
-        (WebCore::ReplayInputTypes::ReplayInputTypes):
-        * replay/ReplayInputTypes.h: See below.
-        * replay/SerializationMethods.cpp: We need to special-case the encoding
-        and decoding of MemoizedDOMResult inputs because the input is not part of
-        the generated per-framework replay inputs enum.
-        (JSC::EncodingTraits&lt;NondeterministicInputBase&gt;::encodeValue):
-        (JSC::EncodingTraits&lt;NondeterministicInputBase&gt;::decodeValue):
</del><ins>+2013-05-10  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * replay/WebInputs.json: Add the EncodedCType enum as an external enum type,
-        so that we can use a generated EncodingTraits specialization to encode the enum.
</del><ins>+        Unreviewed. Fix GTK+ build after r149839.
</ins><span class="cx"> 
</span><del>-2014-03-11  Jae Hyun Park  &lt;jaepark@webkit.org&gt;
</del><ins>+        * platform/gtk/RenderThemeGtk3.cpp:
+        (WebCore::gtkStyleChangedCallback):
</ins><span class="cx"> 
</span><del>-        Make HTMLCanvasElement::is3D private
-        https://bugs.webkit.org/show_bug.cgi?id=130117
</del><ins>+2013-05-09  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        AX: VoiceOver is no longer seeing items in poorly formed tables
+        https://bugs.webkit.org/show_bug.cgi?id=115837
</ins><span class="cx"> 
</span><del>-        HTMLCanvasElement::is3D is not used anywhere except HTMLCanvasElement.
-        So, make HTMLCanvasElement::is3D a private method. Also, make more use
-        of is3D method.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::reset):
-        (WebCore::HTMLCanvasElement::getImageData):
-        * html/HTMLCanvasElement.h:
</del><ins>+        In case the author didn't include the rows of a table as the 
+        direct children, a table needs to dive down its descendant chain
+        until the rows are found. 
</ins><span class="cx"> 
</span><del>-2014-03-12  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        I also took the opportunity to clean up a bit around what the different
+        meanings of table are in the accessibility classes.
</ins><span class="cx"> 
</span><del>-        Web Inspector: OS X View Indication
-        https://bugs.webkit.org/show_bug.cgi?id=130119
</del><ins>+        Test: accessibility/poorly-formed-aria-table.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::addRowDescendant):
+        (WebCore::AccessibilityARIAGrid::addChildren):
+        * accessibility/AccessibilityARIAGrid.h:
+        (AccessibilityARIAGrid):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::parentTable):
+        (WebCore):
+        * accessibility/AccessibilityARIAGridRow.h:
+        (AccessibilityARIAGridRow):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isTable):
+        * accessibility/AccessibilityTable.h:
+        (AccessibilityTable):
+        (WebCore::AccessibilityTable::isTable):
+        (WebCore::toAccessibilityTable):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::parentTable):
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setIndicating):
-        OS X will handles this in the InspectorOverlay. iOS does not use the
-        overlay, so it handles this in the client (already implemented).
</del><ins>+2013-05-09  Yael Aharon  &lt;yael.aharon@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorOverlay.h:
-        Remove unused m_size, and add a boolean for the indicating state.
</del><ins>+        REGRESSION: Disabled multiline select element now responds to (certain) clicks
+        https://bugs.webkit.org/show_bug.cgi?id=115710
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorOverlay.cpp:
-        (WebCore::InspectorOverlay::InspectorOverlay):
-        (WebCore::InspectorOverlay::shouldShowOverlay):
-        Helper for determining if we should show the overlay or not.
</del><ins>+        Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        (WebCore::InspectorOverlay::setIndicating):
-        Set the state and trigger an overlay update.
</del><ins>+        After http://trac.webkit.org/changeset/140286, select elements can scroll whether they
+        are disabled or not. While they scroll, they also change the selected item.
+        This patch allows the select element to scroll, but does not change the selection
+        if the select element is disabled.        
</ins><span class="cx"> 
</span><del>-        (WebCore::InspectorOverlay::paint):
-        (WebCore::InspectorOverlay::update):
-        (WebCore::InspectorOverlay::drawGutter):
-        (WebCore::InspectorOverlay::evaluateInOverlay):
-        Simplification of existing methods.
</del><ins>+        Test: fast/forms/select/listbox-disabled-scroll-no-onchange.html
+        Test: fast/forms/select/listbox-disabled-no-autoscroll.html
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorOverlayPage.css:
-        (.indicate):
-        Give the page a blue tint, matching the node highlight color.
</del><ins>+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::autoscroll):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::stopAutoscroll):
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorOverlayPage.js:
-        (showPageIndication):
-        (hidePageIndication):
-        Add / remove a body style class.
</del><ins>+2013-05-09  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (drawNodeHighlight):
-        Remove unused parameters.
</del><ins>+        Clean up SecurityOrigin::databaseIdentifier
+        https://bugs.webkit.org/show_bug.cgi?id=115882
</ins><span class="cx"> 
</span><del>-2014-03-12  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        Web Inspector: Disable REMOTE_INSPECTOR in earlier OS X releases
-        https://bugs.webkit.org/show_bug.cgi?id=130118
</del><ins>+        Remove m_encodedHost and just call encodeHost from databaseIdentifier().
+        Also, use a StringBuilder when constructing the database identifier to avoid allocating
+        temporary String objects over and over.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore):
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+        (WebCore::SecurityOrigin::databaseIdentifier):
+        * page/SecurityOrigin.h:
+        (SecurityOrigin):
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
</del><ins>+2013-05-09  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-12  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Remove m_securityOrigin from XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=115881
</ins><span class="cx"> 
</span><del>-        Build fix for ENABLE(IMAGE_CONTROLS) after 165479
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::servicesRolloverButtonCell):
-        (WebCore::RenderThemeMac::paintImageControlsButton):
-        (WebCore::RenderThemeMac::imageControlsButtonSize):
-        Don't try to use the AppKit methods that are only available on 64-bit.
</del><ins>+        The security origin passed to XMLHttpRequest::create was always null, so just get rid of the member variable completely.
</ins><span class="cx"> 
</span><del>-2014-03-12  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::create):
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::securityOrigin):
+        * xml/XMLHttpRequest.h:
+        (XMLHttpRequest):
</ins><span class="cx"> 
</span><del>-        [WebVTT] HTML5 &quot;space&quot; cahracters around &quot;--&gt;&quot; are not required
-        https://bugs.webkit.org/show_bug.cgi?id=117421
</del><ins>+2013-05-09  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        [NoInterfaceObject] extended attribute should be removed for several interfaces
+        https://bugs.webkit.org/show_bug.cgi?id=115852
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by caitpotter88@gmail.com):
-        https://chromium.googlesource.com/chromium/blink/+/4ef469cd627a13696b88e285ae28a60e38f9c286
-        http://crbug.com/242158
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        New tests: media/track/track-webvtt-tc029-timings-whitespace.html
</del><ins>+        Remove [NoInterfaceObject] extended attribute from the following Web IDL
+        interfaces: SecurityPolicy, History, Location, Navigator, Performance,
+        PerformanceEntry, PerformanceMark, PerformanceMeasure, PerformanceNavigation,
+        PerformanceResourceTiming, PerformanceTiming and Screen.
</ins><span class="cx"> 
</span><del>-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTParser::collectTimingsAndSettings): Make whitespace around cue-timings optional.
</del><ins>+        These interfaces should not have the [NoInterfaceObject] extended attribute
+        according to their respective specifications:
+        - http://www.w3.org/html/wg/drafts/html/master/browsers.html#the-history-interface
+        - http://www.w3.org/html/wg/drafts/html/master/browsers.html#the-location-interface
+        - https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#securitypolicy
+        - http://www.w3.org/html/wg/drafts/html/master/webappapis.html#the-navigator-object
+        - http://www.w3.org/TR/navigation-timing/#performance
+        - https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/PerformanceTimeline/Overview.html#sec-PerformanceEntry-interface
+        - http://www.w3.org/TR/navigation-timing/#performancenavigation
+        - http://www.w3.org/TR/navigation-timing/#performancetiming
+        - http://www.w3.org/TR/user-timing/#performancemark
+        - http://www.w3.org/TR/user-timing/#performancemeasure
+        - http://www.w3c-test.org/webperf/specs/ResourceTiming/#performanceresourcetiming
+        - http://dev.w3.org/csswg/cssom-view/#the-screen-interface
</ins><span class="cx"> 
</span><del>-2014-03-12  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        The new behavior is consistent with the specifications, Firefox and soon Blink.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165482.
-        https://bugs.webkit.org/show_bug.cgi?id=130157
</del><ins>+        No new tests, already covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Broke the windows build; &quot;error C2466: cannot allocate an
-        array of constant size 0&quot; (Requested by jernoble on #webkit).
</del><ins>+        * page/DOMSecurityPolicy.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/Navigator.idl:
+        * page/Performance.idl:
+        * page/PerformanceEntry.idl:
+        * page/PerformanceMark.idl:
+        * page/PerformanceMeasure.idl:
+        * page/PerformanceNavigation.idl:
+        * page/PerformanceResourceTiming.idl:
+        * page/PerformanceTiming.idl:
+        * page/Screen.idl:
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+2013-05-09  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        &quot;Reduce memory use for static property maps&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=129986
-        http://trac.webkit.org/changeset/165482
</del><ins>+        REGRESSION (Safari 3-Safari 4): Replaced element with percent height in table has incorrect height
+        https://bugs.webkit.org/show_bug.cgi?id=26394
</ins><span class="cx"> 
</span><del>-2014-03-12  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Web Inspector receives spurious setScriptEnabled instrumentation calls
-        https://bugs.webkit.org/show_bug.cgi?id=130147
</del><ins>+        Text controls or any object that has scrollable content should not flex inside a table cell. 
+        This makes our behaviour the same as IE, FF and Opera (Presto).
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
</ins><span class="cx"> 
</span><del>-        When page settings change, inspector instrumentation should only fire if
-        the scriptsEnabled setting actually changes from the previous setting. But
-        due to an unnecessary PLATFORM(IOS) guard, the inspector was being notified
-        on every settings update even if nothing changed.
</del><ins>+2013-05-09  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This manifested as lots of Page.scriptsEnabled messages being sent to
-        the inspector frontend as the Inspector window is dragged.
</del><ins>+        Build fix.
</ins><span class="cx"> 
</span><del>-        * page/Settings.cpp:
-        (WebCore::Settings::setScriptEnabled): Remove PLATFORM(IOS) from early return.
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-2014-03-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-05-09  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Have the scrolling tree track the viewport size, not the viewport rect
-        https://bugs.webkit.org/show_bug.cgi?id=130141
</del><ins>+        Add a StorageStrategy hook for creating transient local storage namespaces
+        https://bugs.webkit.org/show_bug.cgi?id=115870
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        The scrolling tree only needs to know the size of the viewport, not its
-        origin, since the origin is deduced from the updated scroll position.
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated):
-        * page/scrolling/ScrollingStateScrollingNode.cpp:
-        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
-        (WebCore::ScrollingStateScrollingNode::setViewportSize):
-        (WebCore::ScrollingStateScrollingNode::dumpProperties):
-        * page/scrolling/ScrollingStateScrollingNode.h:
-        * page/scrolling/ScrollingTreeScrollingNode.cpp:
-        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        (WebCore::ScrollingTreeScrollingNode::viewportSize):
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::setScrollLayerPosition):
-        (WebCore::ScrollingTreeScrollingNodeIOS::maximumScrollPosition):
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::updateAfterChildren):
-        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
-        (WebCore::ScrollingTreeScrollingNodeMac::maximumScrollPosition):
-        (WebCore::ScrollingTreeScrollingNodeMac::logExposedUnfilledArea):
</del><ins>+        Export symbol needed by WebKit2.
+        
+        * dom/Document.cpp:
+        (WebCore::Document::topOrigin):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        * workers/WorkerContext.h:
+        Remove const qualifier from topOrigin() to avoid ugly const_casts when assigning into a RefPtr&lt;SecurityOrigin&gt; variable.
</ins><span class="cx"> 
</span><del>-2014-03-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::transientLocalStorage):
+        Do a single hash lookup instead of three and use the SecurityOrigin itself as the hash key instead of a string representation of it.
</ins><span class="cx"> 
</span><del>-        Spelling is hard
-        https://bugs.webkit.org/show_bug.cgi?id=130146
</del><ins>+        * page/PageGroup.h:
+        Update HashMap declaration.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::transientLocalStorageNamespace):
+        Add new implementation that will optionally call out to the storage strategy.
</ins><span class="cx"> 
</span><del>-        Fix spelling (constained -&gt; constrained).
-
-        * rendering/RenderLayerModelObject.cpp:
-        (WebCore::RenderLayerModelObject::styleDidChange):
-
-2014-03-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Change scrollOffsetForFixedPosition() to do LayoutUnit math
-        https://bugs.webkit.org/show_bug.cgi?id=129981
-
-        Reviewed by Beth Dakin.
-
-        FrameView::scrollOffsetForFixedPosition() returned an IntSize,
-        but to allow subpixel scroll offsets, we need it to return a LayoutSize.
</del><ins>+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::transientLocalStorageNamespace):
+        Move the default implementation here from PageGroup.
</ins><span class="cx">         
</span><del>-        Fix code that calls this to use more LayoutUnit math.
-        
-        This progresses fixed background images on zoom, which cam now be subpixel
-        positioned.
</del><ins>+        * storage/StorageStrategy.cpp:
+        (WebCore::StorageStrategy::transientLocalStorageNamespace):
+        Call the default implementation.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::viewportConstrainedVisibleContentRect):
-        (WebCore::FrameView::scrollOffsetForFixedPosition):
-        * page/FrameView.h:
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
-        * platform/ScrollableArea.cpp:
-        (WebCore::ScrollableArea::constrainScrollPositionForOverhang):
-        * platform/ScrollableArea.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollLayerPosition):
</del><ins>+2013-05-09  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-12  Gavin Barraclough  &lt;barraclough@apple.com&gt;
</del><ins>+        A change in system environment should force all CSS properties to be recomputed.
+        https://bugs.webkit.org/show_bug.cgi?id=115872
+        &lt;rdar://problem/13781171&gt;
</ins><span class="cx"> 
</span><del>-        Reduce memory use for static property maps
-        https://bugs.webkit.org/show_bug.cgi?id=129986
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
-
-        Static property tables are currently duplicated on first use from read-only memory into dirty memory
-        in every process, and since the entries are large (48 bytes) and the tables can be unusually sparse
-        (we use a custom hash table without a rehash) a lot of memory may be wasted.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::getStaticValueSlotEntryWithoutCaching):
-        (WebCore::getStaticValueSlotEntryWithoutCaching&lt;JSDOMWrapper&gt;):
-            - HashEntry -&gt; HashTableValue.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertySlot):
-            - HashEntry -&gt; HashTableValue.
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::getOwnPropertySlotDelegate):
-            - HashEntry -&gt; HashTableValue.
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::getOwnPropertySlotDelegate):
-        (WebCore::JSLocation::putDelegate):
-            - HashEntry -&gt; HashTableValue.
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateGetOwnPropertySlotBody):
-            - HashEntry -&gt; HashTableValue.
-        (GenerateHashTable):
-            - emit the hash table index into the derived source (we were calculating this already to ensure chaining does not get too deep).
-
-2014-03-12  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        Hook up image controls for WebKit1
-        https://bugs.webkit.org/show_bug.cgi?id=130062
-        &lt;rdar://problem/15964809&gt;
-
-        Reviewed by Brady Eidson.
-
-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSPrimitiveValueMappings.h:
-        Fix some header ordering.
-
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        Handle mapping ImageControlsButtonPart to the -webkit-appearance value CSSValueImageControlsButton.
-
-        * css/CSSValueKeywords.in:
-        * platform/ThemeTypes.h:
-        Add a -webkit-appearance value image-controls-button, and an associated control part.
-
-        * dom/Node.h:
-        (WebCore::Node::isImageControlsButtonElement): Added.
-
-        * html/shadow/mac/ImageControlsButtonElementMac.cpp: Added.
-        (WebCore::RenderImageControlsButton::RenderImageControlsButton):
-        (WebCore::RenderImageControlsButton::~RenderImageControlsButton):
-        (WebCore::RenderImageControlsButton::updateLogicalWidth):
-        (WebCore::RenderImageControlsButton::computeLogicalHeight):
-        (WebCore::ImageControlsButtonElementMac::ImageControlsButtonElementMac):
-        (WebCore::ImageControlsButtonElementMac::~ImageControlsButtonElementMac):
-        (WebCore::ImageControlsButtonElementMac::maybeCreate):
-        (WebCore::ImageControlsButtonElementMac::defaultEventHandler):
-        (WebCore::ImageControlsButtonElementMac::createElementRenderer):
-        * html/shadow/mac/ImageControlsButtonElementMac.h: Added.
-        Add a new element/renderer pair for the single button that comprises image controls on Mac.
-        RenderImageControlsButton gets its size from the theme's imageControlsButtonSize.
-
-        * html/shadow/mac/ImageControlsRootElementMac.cpp:
-        (WebCore::RenderImageControls::RenderImageControls):
-        (WebCore::RenderImageControls::~RenderImageControls):
-        (WebCore::RenderImageControls::updateLogicalWidth):
-        (WebCore::RenderImageControls::computeLogicalHeight):
-        (WebCore::ImageControlsRootElement::maybeCreate):
-        (WebCore::ImageControlsRootElementMac::ImageControlsRootElementMac):
-        (WebCore::ImageControlsRootElementMac::~ImageControlsRootElementMac):
-        (WebCore::ImageControlsRootElementMac::createElementRenderer):
-        * html/shadow/mac/ImageControlsRootElementMac.h:
-        Add a custom renderer for the root image controls element on Mac, which inherits
-        its size from the &lt;img&gt; that it is shadowing.
-        Add a ImageControlsButtonElementMac as the sole child of the root element.
-
-        * html/shadow/mac/imageControlsMac.css:
-        (.x-webkit-image-controls):
-        (.x-webkit-image-controls-button):
-        (.x-webkit-image-controls:hover .x-webkit-image-controls-button):
-        The button should become opaque whenever *any* part of the image is hovered,
-        not just the button itself. Also, use the new image-controls-button -webkit-appearance
-        value to get the appropriate appearance from the theme.
-
-        * page/ContextMenuContext.cpp:
-        (WebCore::ContextMenuContext::ContextMenuContext):
-        * page/ContextMenuContext.h:
-        (WebCore::ContextMenuContext::setControlledImage):
-        (WebCore::ContextMenuContext::controlledImage):
-        Store an image on the ContextMenuContext instead of just whether we hit an image.
-
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::handleContextMenuEvent):
-        (WebCore::ContextMenuController::showContextMenu):
-        (WebCore::imageFromImageElementNode):
-        (WebCore::ContextMenuController::maybeCreateContextMenu):
-        (WebCore::ContextMenuController::populate):
-        Keep track of the hit image in the ContextMenuContext.
-
-        (WebCore::ContextMenuController::replaceControlledImage):
-        Replace the hit image with a new one.
-
-        * page/ContextMenuController.h:
-
-        * rendering/RenderReplaced.h:
-        Fix a double-space typo.
-
</del><ins>+        When a change in the global environment occurs, for example system colors,
+        we need to make sure all the CSS properties are recomputed and not fetched
+        from the cache. For this reason we invalidate the properties cache.
+        I've also renamed the function to give it a more meaningful name.
+        
+        * page/Page.cpp:
+        (WebCore::Page::updateStyleForAllPagesAfterGlobalChangeInEnvironment):
+        * page/Page.h:
</ins><span class="cx">         * rendering/RenderTheme.cpp:
</span><del>-        (WebCore::RenderTheme::adjustStyle):
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::paintBorderOnly):
-        (WebCore::RenderTheme::paintDecorations):
-        Handle ImageControlsButtonPart in RenderTheme's switches.
</del><ins>+        (WebCore::RenderTheme::platformColorsDidChange):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::imageControlsButtonSize):
-        (WebCore::RenderTheme::paintImageControlsButton):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::servicesRolloverButtonCell):
-        (WebCore::RenderThemeMac::paintImageControlsButton):
-        (WebCore::RenderThemeMac::imageControlsButtonSize):
-        Paint the image controls button.
</del><ins>+2013-05-09  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/ios/EditorIOS.mm:
-        (WebCore::Editor::WebContentReader::readImage):
-        (WebCore::Editor::WebContentReader::readURL):
-        * editing/mac/EditorMac.mm:
-        (WebCore::Editor::WebContentReader::readImage):
-        * platform/URL.cpp:
-        (WebCore::URL::fakeURLWithRelativePart):
-        * platform/URL.h:
-        Factor out code to create a &quot;fake&quot; URL (with a UUID &quot;hostname&quot; and the
-        webkit-fake-url protocol), and make use of it where we construct such URLs.
</del><ins>+        Reoptimize free-standing :focus/link/visited/-webkit-any-link selectors.
+        &lt;http://webkit.org/b/115590&gt;
</ins><span class="cx"> 
</span><del>-2014-03-12  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [Mac] Crash when running media/fallback.html test in MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification()
-        https://bugs.webkit.org/show_bug.cgi?id=130136
-
-        Reviewed by Eric Carlson.
-
-        MediaPlayerPrivateAVFoundation is trying to lock its m_queueMutex from an async thread after
-        while being destroyed in the main thread. To resolve this race condition, redispatch from
-        the async thread to the main thread, and use a WeakPtr to determine whether the object has
-        been destroyed or not.
-
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):
-
-2014-03-12  Brent Fulgham  &lt;bfulgham@apple.com&gt;
-
-        [Win] Remove use of QTSDK
-        https://bugs.webkit.org/show_bug.cgi?id=130049
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Media testing already covers this functionality.
</del><ins>+        Common pseudo selectors should go into their respective rule buckets instead of ending up in the universal one.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj: Remove QuickTime files.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-        * platform/graphics/MediaPlayer.h: Remove QuickTime and Chromium
-        media references.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp: Removed.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h: Removed.
-        * platform/graphics/win/QTCFDictionary.cpp: Removed.
-        * platform/graphics/win/QTCFDictionary.h: Removed.
-        * platform/graphics/win/QTDecompressionSession.cpp: Removed.
-        * platform/graphics/win/QTDecompressionSession.h: Removed.
-        * platform/graphics/win/QTMovie.cpp: Removed.
-        * platform/graphics/win/QTMovie.h: Removed.
-        * platform/graphics/win/QTMovieGWorld.cpp: Removed.
-        * platform/graphics/win/QTMovieGWorld.h: Removed.
-        * platform/graphics/win/QTMovieTask.cpp: Removed.
-        * platform/graphics/win/QTMovieTask.h: Removed.
-        * platform/graphics/win/QTMovieVisualContext.cpp: Removed.
-        * platform/graphics/win/QTMovieVisualContext.h: Removed.
-        * platform/graphics/win/QTMovieWinTimer.cpp: Removed.
-        * platform/graphics/win/QTMovieWinTimer.h: Removed.
-        * platform/graphics/win/QTPixelBuffer.cpp: Removed.
-        * platform/graphics/win/QTPixelBuffer.h: Removed.
-        * platform/graphics/win/QTTrack.cpp: Removed.
-        * platform/graphics/win/QTTrack.h: Removed.
-        * plugins/win/PluginDatabaseWin.cpp:
-        (WebCore::PluginDatabase::defaultPluginDirectories): Don't look
-        for the QuickTime plugin anymore.
</del><ins>+        * css/RuleSet.cpp:
+        (WebCore::RuleSet::findBestRuleSetAndAdd):
+        
+            Check tag selectors with * local name (usually created for namespace) for a suitable narrower bucket too.
</ins><span class="cx"> 
</span><del>-2014-03-12  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2013-05-09  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix build after r165472
</del><ins>+        RenderQuote has giant function for language to quotes map
+        https://bugs.webkit.org/show_bug.cgi?id=115807
</ins><span class="cx"> 
</span><del>-        Fixes the following build failure:
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-            WebCore/rendering/shapes/Shape.cpp:97:20: error: unused function 'ensureRadiiDoNotOverlap' [-Werror,-Wunused-function]
-            static inline void ensureRadiiDoNotOverlap(FloatRect&amp; bounds, FloatSize&amp; radii)
-                               ^
-            1 error generated.
</del><ins>+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::RenderQuote): Updated for m_isAttached name change.
+        (WebCore::RenderQuote::~RenderQuote): Updated for name change, and also split
+        assertion with &amp;&amp; in it into two separate assertions.
+        (WebCore::checkNumberOfDistinctQuoteCharacters): Added. Helper function that is used
+        to check that the number of distinct quote characters is small enough to fit into
+        our fixed size array below.
+        (WebCore::quotesForLanguage): Replaces the old quotesDataLanguageMap function.
+        Returns a pointer to a struct that contains the four quote characters. This new
+        function doesn't have the massive amount of code that the old one did. We use the
+        standard library bsearch function to do a binary search.
+        (WebCore::stringForQuoteCharacter): Added. This returns a string for a given quote
+        character; one string for any given character.
+        (WebCore::quotationMarkString): Added. Returns the string for the quotation mark.
+        (WebCore::apostropheStringImpl): Added. Returns the string for the apostrophe.
+        (WebCore::RenderQuote::originalText): Rewrote this to include all the logic that
+        used to be in the quotesData function.
+        (WebCore::RenderQuote::attachQuote): Tweak assertions as above. Removed unneeded
+        special case for the first quote in a RenderView; sharing the code is better and
+        there is no significant performance difference. Also use m_isAttached directly
+        when looking at predecessores so there is no need for an isAttached function.
+        (WebCore::RenderQuote::detachQuote): Updated assertions and for name change.
+        (WebCore::RenderQuote::updateDepth): Ditto.
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/Shape.cpp:
-        (ensureRadiiDoNotOverlap): Remove unused function.
</del><ins>+        * rendering/RenderQuote.h: Removed unneeded includes. Marked the class FINAL since
+        we call the originalText function in the class and we don't want to do a virtual
+        function dispatch for that. Removed uneeded const from an argument. Removed a
+        stray semicolon. Removed the quotesData and isAttached functions, since they are no
+        longer needed. Renamed m_attached to m_isAttached.
</ins><span class="cx"> 
</span><del>-2014-03-12  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        * rendering/style/QuotesData.cpp: Removed the overload of QuotesData::create that
+        takes four quote strings. This was only used to build up the quotes table.
+        * rendering/style/QuotesData.h: Ditto.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Remove deprecated shapes
-        https://bugs.webkit.org/show_bug.cgi?id=125235
</del><ins>+2013-05-09  Max Feil  &lt;mfeil@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        shouldUsePluginDocument() needs to be respected when a document is created
+        https://bugs.webkit.org/show_bug.cgi?id=110308
</ins><span class="cx"> 
</span><del>-        Remove support for deprecated shape types and syntax. These have
-        already been removed from the CSS Shapes specification, so this aligns
-        the implementation with the specification.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        The &quot;new&quot; tests below were simply moved from the old csswg directory,
-        as they were the only tests there that applied to the current syntax.
</del><ins>+        In DOMImplementation::createDocument() we should create
+        a PluginDocument for mime types that return &quot;true&quot; for
+        shouldAlwaysUsePluginDocument(), even if there is no pluginData
+        for them. This lets a client choose plugins for which the &quot;missing
+        plugin&quot; text or icon should appear more consistently. Otherwise
+        plugins referenced by iFrames will be treated as an HTMLDocument,
+        possibly resulting in binary files rendered as gibberish text.
</ins><span class="cx"> 
</span><del>-        Tests: fast/shapes/shape-outside-floats/shape-outside-floats-polygon-000.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-polygon-001.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-polygon-002.html
</del><ins>+        Layout test platform/blackberry/plugins/swf-as-src-of-iframe.html
</ins><span class="cx"> 
</span><del>-        * css/BasicShapeFunctions.cpp:
-        (WebCore::valueForBasicShape):
-        (WebCore::basicShapeForValue):
-        * css/BasicShapeFunctions.h:
-        * css/CSSBasicShapes.cpp:
-        * css/CSSBasicShapes.h:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseBasicShape):
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createShape):
-        * rendering/shapes/ShapeInsideInfo.cpp:
-        (WebCore::ShapeInsideInfo::isEnabledFor):
-        * rendering/style/BasicShapes.cpp:
-        * rendering/style/BasicShapes.h:
</del><ins>+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
</ins><span class="cx"> 
</span><del>-2014-03-12  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+2013-05-09  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] [Stable] deadlock in gobject introspection
-        https://bugs.webkit.org/show_bug.cgi?id=125651
</del><ins>+        Fix an exception when hovering native functions while paused in the debugger.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sergio Villar Senin.
</del><ins>+        https://webkit.org/b/115866
+        rdar://problem/13681982
</ins><span class="cx"> 
</span><del>-        Make the default SoupNetworkSession a destroyable object to ensure
-        the wrapped SoupSession is finalized when the process finishes. This
-        is important because soup cancels any ongoing connection when finalized.
</del><ins>+        Reviewed by Darin Adler and Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-        * platform/network/soup/SoupNetworkSession.cpp:
-        (WebCore::SoupNetworkSession::defaultSession): Do not use NeverDestroyed.
-        * platform/network/soup/SoupNetworkSession.h:
</del><ins>+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype.getFunctionDetails): Return an error if the details
+        is null or undefined.
</ins><span class="cx"> 
</span><del>-2014-03-12  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-05-09  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Don't use NodeRenderingTraversal for pseudo elements
-        https://bugs.webkit.org/show_bug.cgi?id=130091
</del><ins>+        [Mac] CFError leak under Objective-C garbage collection
+        https://bugs.webkit.org/show_bug.cgi?id=115862
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Make traversing during style resolve more comprehensible by handling before/after pseudo elements explicitly.
</del><ins>+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::nsError): Use adoptCF instead of adoptNS since
+        the CFError needs a CFRelease, not an -[NSObject release].
</ins><span class="cx"> 
</span><del>-        With this patch NodeRenderingTraversal is only needed for InsertionPoints (which are nothing but an implementation
-        detail of the &lt;details&gt; element at this point).
</del><ins>+2013-05-09  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::shouldUseNodeRenderingTraversalSlowPath):
-        
-            PseudoElements don't need the slow path anymore.
</del><ins>+        BlackBerry: fix call to PluginLayerWebKitThread::setHolePunchRect()
+        https://bugs.webkit.org/show_bug.cgi?id=114953
</ins><span class="cx"> 
</span><del>-        (WebCore::Element::setBeforePseudoElement):
-        (WebCore::Element::setAfterPseudoElement):
-        (WebCore::Element::clearBeforePseudoElement):
-        (WebCore::Element::clearAfterPseudoElement):
-        * dom/NodeRenderingTraversal.cpp:
-        (WebCore::NodeRenderingTraversal::traverseParent):
-        (WebCore::NodeRenderingTraversal::firstChildSlow):
-        (WebCore::NodeRenderingTraversal::nextSiblingSlow):
-        (WebCore::NodeRenderingTraversal::previousSiblingSlow):
-        * dom/NodeRenderingTraversal.h:
-        (WebCore::NodeRenderingTraversal::firstChild):
-        * style/StyleResolveTree.cpp:
-        (WebCore::Style::nextSiblingRenderer):
-        
-            Add ::before/::after pseudo element handling here.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        (WebCore::Style::shouldCreateRenderer):
-        (WebCore::Style::elementInsideRegionNeedsRenderer):
-        (WebCore::Style::createRendererIfNeeded):
-        (WebCore::Style::previousSiblingRenderer):
-        
-            Add ::before pseudo element handling here (text node can't be ::after).
</del><ins>+        data-&gt;layer needs a cast in order to call setHolePunchRect().
</ins><span class="cx"> 
</span><del>-        (WebCore::Style::reattachTextRenderersForWhitespaceOnlySiblingsAfterAttachIfNeeded):
-        (WebCore::Style::textRendererIsNeeded):
-        (WebCore::Style::createTextRendererIfNeeded):
-        (WebCore::Style::attachTextRenderer):
-        (WebCore::Style::updateTextRendererAfterContentChange):
-        (WebCore::Style::attachChildren):
-        (WebCore::Style::attachDistributedChildren):
-        
-            Handle InsertionPoints in one place.
</del><ins>+        * plugins/blackberry/NPCallbacksBlackBerry.cpp:
+        (WebCore::npSetHolePunchHandler):
</ins><span class="cx"> 
</span><del>-        (WebCore::Style::attachShadowRoot):
-        (WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded):
-        (WebCore::Style::attachRenderTree):
-        (WebCore::Style::resolveLocal):
-        (WebCore::Style::updateTextStyle):
-        (WebCore::Style::resolveShadowTree):
-        (WebCore::Style::updateBeforeOrAfterPseudoElement):
-        (WebCore::Style::resolveTree):
-        
-            Pass the rendering parent around to various functions instead of determining it repeatedly by calling 
-            NodeRenderingTraversal::parent. It is always the same for all direct children being resolved and generally just
-            the parent element.
</del><ins>+2013-05-09  Mike Fenton  &lt;mifenton@rim.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-12  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        [BlackBerry] Style updates required based on new check-webkit-style
+        https://bugs.webkit.org/show_bug.cgi?id=115857
</ins><span class="cx"> 
</span><del>-        Invisible Operators should not add space.
-        https://bugs.webkit.org/show_bug.cgi?id=115786
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Update WebCore/platform/graphics BlackBerry sources
+        to match check-webkit-style updates.
</ins><span class="cx"> 
</span><del>-        This change adds special handling for invisible operator to ensure they really behave as empty box. We now ignore their glyph widths and do not paint them.
</del><ins>+        Internally reviewed by Jakob Petsovits.
</ins><span class="cx"> 
</span><del>-        Test: mathml/presentation/mo-invisible.html
</del><ins>+        * platform/graphics/blackberry/CanvasLayerWebKitThread.cpp:
+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
+        (WebCore::GraphicsContext3D::readPixelsIMG):
+        (WebCore::GraphicsContext3D::paintToCanvas):
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp:
+        (WebCore::GraphicsLayerBlackBerry::updateLayerPosition):
+        * platform/graphics/blackberry/IntRectBlackBerry.cpp:
+        (WebCore::IntRect::IntRect):
+        * platform/graphics/blackberry/LayerCompositingThread.h:
+        (WTF::::deref):
+        * platform/graphics/blackberry/LayerFilterRenderer.cpp:
+        (WebCore::LayerFilterRenderer::initializeSharedGLObjects):
+        (WebCore::LayerFilterRenderer::actionsForOperations):
+        (WebCore::LayerFilterRenderer::applyActions):
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::setViewport):
+        (WebCore::LayerRenderer::compositeBuffer):
+        (WebCore::LayerRenderer::drawColor):
+        (WebCore::LayerRenderer::compositeLayersRecursive):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp:
+        (WebCore::LayerWebKitThread::setFrame):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::waitMetadataTimerFired):
+        * platform/image-decoders/blackberry/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::JPEGImageDecoder):
</ins><span class="cx"> 
</span><del>-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths):
-        (WebCore::RenderMathMLOperator::paint):
-        * rendering/mathml/RenderMathMLOperator.h:
</del><ins>+2013-05-09  Mike Fenton  &lt;mifenton@rim.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-11  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        [BlackBerry] Style updates required based on new check-webkit-style
+        https://bugs.webkit.org/show_bug.cgi?id=115857
</ins><span class="cx"> 
</span><del>-        Implement MathML spacing around operators .
-        https://bugs.webkit.org/show_bug.cgi?id=115787
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Update WebCore/platform/network/blackberry
+        to match check-webkit-style updates.
</ins><span class="cx"> 
</span><del>-        This makes the &lt;mo&gt; operators use the lspace/rspace properties to
-        determine their spacing. The spacing is now consistent with the one
-        of &lt;mfenced&gt; and as a consequence bug 118843 is fixed. This also ensures
-        that the rendering of &lt;mo&gt; elements is updated when the form or
-        attributes are changed.
</del><ins>+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::initialize):
+        (WebCore::NetworkJob::handleSetCookieHeader):
+        (WebCore::NetworkJob::sendResponseIfNeeded):
+        (WebCore::NetworkJob::shouldSendClientData):
+        * platform/network/blackberry/NetworkJob.h:
+        (NetworkJob):
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+        * platform/network/blackberry/rss/RSSFilterStream.cpp:
+        (WebCore::isRSSContent):
+        (WebCore::transcode):
</ins><span class="cx"> 
</span><del>-        Tests: mathml/presentation/dir-mo.html
-               mathml/presentation/mo-form-dynamic.html
-               mathml/presentation/mo-form-minus-plus.html
-               mathml/presentation/mo-form.html
-               mathml/presentation/mo-lspace-rspace-dynamic.html
-               mathml/presentation/mo-lspace-rspace.html
-               mathml/presentation/mo-whitespaces.html
</del><ins>+2013-05-09  Mike Fenton  &lt;mifenton@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/mathml.css:
-        * mathml/MathMLInlineContainerElement.cpp:
-        (WebCore::MathMLInlineContainerElement::childrenChanged):
-        * mathml/MathMLInlineContainerElement.h:
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::setOperatorPropertiesFromOpDictEntry):
-        (WebCore::RenderMathMLOperator::SetOperatorProperties):
-        (WebCore::RenderMathMLOperator::updateFromElement):
-        (WebCore::RenderMathMLOperator::updateOperatorProperties):
-        (WebCore::RenderMathMLOperator::updateStyle):
-        * rendering/mathml/RenderMathMLOperator.h:
-        * rendering/mathml/RenderMathMLRow.cpp:
-        (WebCore::RenderMathMLRow::updateOperatorProperties):
-        * rendering/mathml/RenderMathMLRow.h:
-        * rendering/mathml/RenderMathMLToken.h:
</del><ins>+        [BlackBerry] Style updates required based on new check-webkit-style
+        https://bugs.webkit.org/show_bug.cgi?id=115857
</ins><span class="cx"> 
</span><del>-2014-03-11  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Get the incomplete WebVTT Regions code to build again.
-        https://bugs.webkit.org/show_bug.cgi?id=130094
</del><ins>+        Update WebCore/platform/blackberry to match check-webkit-style updates.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        No functional changes.
</ins><span class="cx"> 
</span><del>-        The feature is not being turned on here, so there are no new tests.
</del><ins>+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h:
+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::CookieManager::getRawCookies):
+        * platform/blackberry/CookieMap.h:
+        (WebCore::CookieMap::count):
+        * platform/blackberry/CookieParser.cpp:
+        (WebCore::CookieParser::parseOneCookie):
+        * platform/blackberry/LoggingBlackBerry.cpp:
+        * platform/blackberry/PageClientBlackBerry.h:
+        (Platform):
+        (Graphics):
+        (WebCore):
+        * platform/blackberry/ParsedCookie.cpp:
+        (WebCore::ParsedCookie::appendWebCoreCookie):
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::RenderThemeBlackBerry::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeBlackBerry::paintButton):
+        (WebCore::RenderThemeBlackBerry::paintSliderThumb):
+        * platform/blackberry/SSLKeyGeneratorBlackBerry.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/blackberry/ScrollAnimatorBlackBerry.h:
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make: Add missing IDL files for Regions.
-        * WebCore.xcodeproj/project.pbxproj: Add Regions-related files.
-        * html/track/InbandWebVTTTextTrack.cpp:
-        (WebCore::InbandWebVTTTextTrack::newRegionsParsed): Add stub implementation.
-        * html/track/LoadableTextTrack.cpp: Add missing include file.
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::TextTrack): Correct ordering of construction
-        to avoid compiler warning.
</del><ins>+2013-05-09  Chris Rogers  &lt;crogers@google.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-11  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        Require use of AudioBus::create() to avoid ref-counting issues
+        https://bugs.webkit.org/show_bug.cgi?id=115836
</ins><span class="cx"> 
</span><del>-        Remove unused method from BatteryController
-        https://bugs.webkit.org/show_bug.cgi?id=130063
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        There were a couple of places still embedding raw AudioBus objects as
+        member variables or local variables causing ref-counting problems
+        now that AudioBus is ref-counted.  Make AudioBus constructor private
+        to enforce use of AudioBus::create().
</ins><span class="cx"> 
</span><del>-        * Modules/battery/BatteryController.h: Removed client() which is not used.
</del><ins>+        Adapted from Blink patch:
+        https://chromiumcodereview.appspot.com/14628008/
</ins><span class="cx"> 
</span><del>-2014-03-11  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+        * Modules/webaudio/AudioDestinationNode.h:
+        (WebCore::AudioDestinationNode::LocalAudioInputProvider::LocalAudioInputProvider):
+        (WebCore::AudioDestinationNode::LocalAudioInputProvider::set):
+        (WebCore::AudioDestinationNode::LocalAudioInputProvider::provideInput):
+        (LocalAudioInputProvider):
+        * Modules/webaudio/AudioNodeInput.cpp:
+        (WebCore::AudioNodeInput::AudioNodeInput):
+        (WebCore::AudioNodeInput::updateInternalBus):
+        * Modules/webaudio/AudioNodeOutput.cpp:
+        (WebCore::AudioNodeOutput::AudioNodeOutput):
+        (WebCore::AudioNodeOutput::updateInternalBus):
+        * Modules/webaudio/AudioParam.cpp:
+        (WebCore::AudioParam::calculateFinalValues):
+        * Modules/webaudio/ConvolverNode.cpp:
+        (WebCore::ConvolverNode::setBuffer):
+        * Modules/webaudio/MediaStreamAudioDestinationNode.cpp:
+        (WebCore::MediaStreamAudioDestinationNode::MediaStreamAudioDestinationNode):
+        (WebCore::MediaStreamAudioDestinationNode::process):
+        * Modules/webaudio/MediaStreamAudioDestinationNode.h:
+        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
+        * Modules/webaudio/ScriptProcessorNode.cpp:
+        (WebCore::ScriptProcessorNode::ScriptProcessorNode):
+        (WebCore::ScriptProcessorNode::process):
+        * Modules/webaudio/ScriptProcessorNode.h:
+        (ScriptProcessorNode):
+        * platform/audio/AudioBus.cpp:
+        (WebCore::AudioBus::create):
+        (WebCore):
+        (WebCore::AudioBus::AudioBus):
+        (WebCore::AudioBus::createBufferFromRange):
+        (WebCore::AudioBus::createBySampleRateConverting):
+        (WebCore::AudioBus::createByMixingToMono):
+        * platform/audio/AudioBus.h:
+        (AudioBus):
+        * platform/audio/AudioFIFO.cpp:
+        (WebCore::AudioFIFO::AudioFIFO):
+        (WebCore::AudioFIFO::consume):
+        (WebCore::AudioFIFO::push):
+        * platform/audio/AudioFIFO.h:
+        (AudioFIFO):
+        * platform/audio/AudioPullFIFO.cpp:
+        (WebCore::AudioPullFIFO::AudioPullFIFO):
+        (WebCore::AudioPullFIFO::fillBuffer):
+        * platform/audio/AudioPullFIFO.h:
+        (AudioPullFIFO):
+        * platform/audio/AudioResampler.cpp:
+        (WebCore::AudioResampler::AudioResampler):
+        (WebCore::AudioResampler::configureChannels):
+        * platform/audio/MultiChannelResampler.cpp:
+        * platform/audio/Reverb.cpp:
+        (WebCore::Reverb::initialize):
+        * platform/audio/SincResampler.cpp:
+        (WebCore::SincResampler::consumeSource):
+        (WebCore):
+        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
+        (WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
+        * platform/audio/gstreamer/AudioDestinationGStreamer.h:
+        (AudioDestinationGStreamer):
+        * platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
+        (WebCore::AudioFileReader::createBus):
+        * platform/audio/ios/AudioDestinationIOS.cpp:
+        (WebCore::AudioDestinationIOS::AudioDestinationIOS):
+        (WebCore::AudioDestinationIOS::render):
+        * platform/audio/ios/AudioDestinationIOS.h:
+        (AudioDestinationIOS):
+        * platform/audio/mac/AudioDestinationMac.cpp:
+        (WebCore::AudioDestinationMac::AudioDestinationMac):
+        (WebCore::AudioDestinationMac::render):
+        * platform/audio/mac/AudioDestinationMac.h:
+        (AudioDestinationMac):
+        * platform/audio/mac/AudioFileReaderMac.cpp:
+        (WebCore::AudioFileReader::createBus):
</ins><span class="cx"> 
</span><del>-        [ATK] Expose aria-posinset and aria-setsize through object attributes
-        https://bugs.webkit.org/show_bug.cgi?id=130011
</del><ins>+2013-05-09  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        [BlackBerry] Upstream the input popups
+        https://bugs.webkit.org/show_bug.cgi?id=114608
</ins><span class="cx"> 
</span><del>-        Based on http://www.w3.org/TR/2014/PR-wai-aria-implementation-20140206/
-        aria-poinset and aria-setsize can be exposed as object attributes.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/aria-setsize-posinset.html
</del><ins>+        This patch contains contributions from many members of the
+        BlackBerry WebKit team, including:
</ins><span class="cx"> 
</span><del>-        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
-        (webkitAccessibleGetAttributes):
</del><ins>+        Chris Hutten-Czapski
+        David Hoon
+        Jessica Cao
+        Rob Buis
+        Tiancheng Jiang
</ins><span class="cx"> 
</span><del>-2014-03-10  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        * Resources/blackberry/colorControlBlackBerry.css: Added.
+        (.color-picker-popup-area):
+        (.color-picker-content):
+        (.color-picker-block):
+        (#color-picker-swatch-block):
+        (.color-picker-switcher):
+        (.color-picker-check-mark):
+        (.color-picker-option):
+        (.color-picker-button):
+        (.color-picker-highlight):
+        (input):
+        (.color-picker-sharp):
+        (.color-picker-off):
+        (.color-picker-inactive-font):
+        (.color-picker-row):
+        (.color-picker-hex-style):
+        (.color-picker-input):
+        (.color-picker-well):
+        (.color-picker-input .color-picker-well):
+        (.color-picker-slider):
+        (.color-picker-slider-output):
+        (.color-picker-range):
+        (.color-picker-range::-webkit-slider-thumb):
+        (.color-picker-range::-webkit-slider-thumb:active):
+        (.red-ranger-bg):
+        (.green-ranger-bg):
+        (.blue-ranger-bg):
+        (@media only screen and (height: 768px)):
+        (@media only screen and (height: 720px)):
+        * Resources/blackberry/colorControlBlackBerry.js: Added.
+        (.):
+        * Resources/blackberry/popupControlBlackBerry.css:
+        (body):
+        (.popup-area):
+        (.popup-header):
+        (.popup-content):
+        (.popup-buttons):
+        (.popup-button):
+        (@media only screen and (width: 720px) and (height: 720px)):
+        * Resources/blackberry/selectControlBlackBerry.css:
+        (.popup-content):
+        (@media (min-height: 918px)):
+        (.option):
+        (@media only screen and (width: 720px) and (height: 720px)):
+        (.contents):
+        (.option:active):
+        (.selected):
+        (.selected .contents::after):
+        (.text):
+        (.disabled):
+        (.optgroup):
+        (.optgroup-option):
+        * Resources/blackberry/selectControlBlackBerry.js:
+        (.):
+        * Resources/blackberry/timeControlBlackBerry.css: Added.
+        (#popup-content-time):
+        (.column):
+        (.column:not(:last-child)):
+        (.cell):
+        (.yearmonthdate .cell div:last-child):
+        (.row-highlight-container):
+        (.row-highlight-filler):
+        (.row-highlight):
+        (.tall-bit):
+        (@media only screen and (width: 720px) and (height: 720px)):
+        * Resources/blackberry/timeControlBlackBerry.js: Added.
+        (.):
</ins><span class="cx"> 
</span><del>-        Improve renderer classes for MathML Token elements.
-        https://bugs.webkit.org/show_bug.cgi?id=124838
</del><ins>+2013-05-09  Rob Buis  &lt;rbuis@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        [BlackBerry] texmap code generates warnings
+        https://bugs.webkit.org/show_bug.cgi?id=115815
</ins><span class="cx"> 
</span><del>-        This patch continues the refactoring of token elements that has been
-        started in bug 44208. The &lt;mo&gt; element now derives from the
-        RenderMathMLToken class, which was already used for the &lt;mi&gt; element.
-        The behavior of anonymous &lt;mo&gt; elements created by the &lt;mfenced&gt; element
-        is now more consistent with the one of &quot;standard&quot; &lt;mo&gt; elements and the
-        spacing around them is now handled in RenderMathMLOperator. This is a
-        first step towards fixing bugs 115787 and 118843. The only visible
-        rendering change is how &lt;mfenced&gt; open/close attributes handle
-        whitespace and multiple characters and some tests are added for that.
-        Other features are already covered by other tests. Finally, this also
-        removes some code from AccessibilityRenderObject that was used to
-        workaround issues with &lt;mo&gt; elements.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::startOfContinuations):
-        (WebCore::AccessibilityRenderObject::textUnderElement):
-        (WebCore::AccessibilityRenderObject::isMathOperator):
-        (WebCore::AccessibilityRenderObject::isIgnoredElementWithinMathTree):
-        * mathml/MathMLTextElement.cpp:
-        (WebCore::MathMLTextElement::didAttachRenderers):
-        (WebCore::MathMLTextElement::childrenChanged):
-        * rendering/mathml/RenderMathMLBlock.cpp:
-        (WebCore::RenderMathMLBlock::RenderMathMLBlock):
-        * rendering/mathml/RenderMathMLBlock.h:
-        * rendering/mathml/RenderMathMLFenced.cpp:
-        (WebCore::RenderMathMLFenced::RenderMathMLFenced):
-        (WebCore::RenderMathMLFenced::updateFromElement):
-        (WebCore::RenderMathMLFenced::createMathMLOperator):
-        (WebCore::RenderMathMLFenced::makeFences):
-        (WebCore::RenderMathMLFenced::addChild):
-        * rendering/mathml/RenderMathMLFenced.h:
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::RenderMathMLOperator):
-        (WebCore::RenderMathMLOperator::setOperatorFlagFromAttribute):
-        (WebCore::RenderMathMLOperator::setOperatorPropertiesFromOpDictEntry):
-        (WebCore::RenderMathMLOperator::SetOperatorProperties):
-        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths):
-        (WebCore::RenderMathMLOperator::rebuildTokenContent):
-        (WebCore::RenderMathMLOperator::updateTokenContent):
-        (WebCore::RenderMathMLOperator::updateStyle):
-        (WebCore::RenderMathMLOperator::firstLineBaseline):
-        (WebCore::RenderMathMLOperator::paint):
-        (WebCore::RenderMathMLOperator::paintChildren):
-        * rendering/mathml/RenderMathMLOperator.h:
-        * rendering/mathml/RenderMathMLToken.cpp:
-        (WebCore::RenderMathMLToken::createWrapperIfNeeded):
</del><ins>+        Add USE(TEXTURE_MAPPER) guards since Source/WebCore/CMakeLists.txt includes
+        these files unconditionally.
</ins><span class="cx"> 
</span><del>-2014-03-10  James Craig  &lt;jcraig@apple.com&gt;
</del><ins>+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        * platform/graphics/texmap/TextureMapper.h:
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
+        * platform/graphics/texmap/TextureMapperBackingStore.h:
+        * platform/graphics/texmap/TextureMapperFPSCounter.cpp:
+        * platform/graphics/texmap/TextureMapperFPSCounter.h:
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        * platform/graphics/texmap/TextureMapperGL.h:
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        * platform/graphics/texmap/TextureMapperLayer.h:
+        * platform/graphics/texmap/TextureMapperTile.cpp:
+        * platform/graphics/texmap/TextureMapperTile.h:
+        * platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:
+        * platform/graphics/texmap/TextureMapperTiledBackingStore.h:
</ins><span class="cx"> 
</span><del>-        Web Inspector: AXI: Expose checked/disabled/expanded/pressed/readonly/selected
-        https://bugs.webkit.org/show_bug.cgi?id=129781
</del><ins>+2013-05-09  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        PluginDatabase: add plugin directory for the BlackBerry port.
+        https://bugs.webkit.org/show_bug.cgi?id=114943
</ins><span class="cx"> 
</span><del>-        Enabling several more properties to be exposed in the Accessibility Node Inspector.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Updated Tests: inspector-protocol/dom/getAccessibilityPropertiesForNode.html
</del><ins>+        XP_UNIX is defined for the BlackBerry port, but we don't want to
+        share the same code here.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::supportsChecked):
-        * accessibility/AccessibilityObject.h:
-        * inspector/InspectorDOMAgent.cpp:
-        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
-        * inspector/protocol/DOM.json:
</del><ins>+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+        (WebCore::PluginDatabase::isPreferredPluginDirectory):
</ins><span class="cx"> 
</span><del>-2014-03-10  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+2013-05-09  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] inset corner radii are not flipped for vertical writing modes
-        https://bugs.webkit.org/show_bug.cgi?id=129918
</del><ins>+        Web Inspector: Remove Memory Distribution and Memory Snapshots Panels
+        https://bugs.webkit.org/show_bug.cgi?id=115850
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        When creating an inset shape, convert the radii to logical coordinates
-        as well as the box.
</del><ins>+        Removed the Memory Instrumentation Code after r148921.
</ins><span class="cx"> 
</span><del>-        Tests: fast/shapes/shape-outside-floats/shape-outside-floats-inset-rounded-different-writing-modes-left.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-inset-rounded-different-writing-modes-right.html
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createShape): Convert the radii to logical
-            coordinates.
</del><ins>+        * inspector/compile-front-end.py:
+        * inspector/front-end/NativeMemorySnapshotView.js: Removed.
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._panelDescriptors):
+        * inspector/front-end/nativeMemoryProfiler.css: Removed.
</ins><span class="cx"> 
</span><del>-2014-03-10  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+2013-05-09  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: Frontend loaded resources from cache are not hidden as expected
-        https://bugs.webkit.org/show_bug.cgi?id=130044
</del><ins>+        Unreviewed GTK build fix after r149796.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        * GNUmakefile.am: Add a phony target for the window constructors file and include it among
+        the dependencies for the non-generated code.
</ins><span class="cx"> 
</span><del>-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
-        Use the new request that was passed in. Assume it is filled in appropriately.
</del><ins>+2013-05-09  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/cache/CachedResourceLoader.h:
-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::CachedResourceLoader::shouldContinueAfterNotifyingLoadedFromMemoryCache):
-        Carry over the hidden from inspector state if the passed in request had it,
-        and create the request that loadedResourceFromMemoryCache will use.
</del><ins>+        Unreviewed build fix for Qt minimal build.
</ins><span class="cx"> 
</span><del>-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::createRequest):
-        Add missing ifdefs for INSPECTOR only function.
</del><ins>+        r149796 broke builds that have WEB_SOCKETS flag disabled.
</ins><span class="cx"> 
</span><del>-2014-03-10  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        * page/DOMWindow.idl:
</ins><span class="cx"> 
</span><del>-        Remove 'visibilitychange' attribute event listener from document
-        https://bugs.webkit.org/show_bug.cgi?id=129794
</del><ins>+2013-05-09  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Add support for [NoInterfaceObject] Web IDL extended attribute
+        https://bugs.webkit.org/show_bug.cgi?id=115714
</ins><span class="cx"> 
</span><del>-        Remove the unused attribute event listener which is not defined in Page Visibility API spec.
-        http://www.w3.org/TR/page-visibility/#sec-document-interface
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * dom/Document.h:
</del><ins>+        *Constructor attributes on the global DOMWindow object are now automatically
+        generated for each non-callback interface that is not declared with the
+        [NoInterfaceObject] extended attribute. It is thus no longer needed for
+        developers to manually add *Constructor attributes for their new interfaces
+        unless they wish to register an &quot;extra&quot; constructor for their interface.
</ins><span class="cx"> 
</span><del>-2014-03-10  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        This patch does not modify at all the behavior on JS side. To achieve this,
+        [NoInterfaceObject] extended attribute is added to interfaces that should
+        not have it according to specification (e.g. History, Location, ...).
+        This can be improved later as the behavior should not change with this
+        patch.
</ins><span class="cx"> 
</span><del>-        [iOS][WebKit 2] Wire the unobscured rect in the WebProcess
-        https://bugs.webkit.org/show_bug.cgi?id=130058
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
-
-        * WebCore.exp.in:
-        * platform/ScrollView.h:
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::unobscuredContentRect):
-        (WebCore::ScrollView::setUnobscuredContentRect):
-
-2014-03-10  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
-
-        makeSelectorPseudoTypeMap.py should not be copied in the WebCore bundle
-
</del><ins>+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/battery/BatteryManager.idl:
+        * Modules/encryptedmedia/MediaKeyMessageEvent.idl:
+        * Modules/encryptedmedia/MediaKeyNeededEvent.idl:
+        * Modules/encryptedmedia/MediaKeySession.idl:
+        * Modules/encryptedmedia/MediaKeys.idl:
+        * Modules/filesystem/DOMFileSystem.idl:
+        * Modules/filesystem/DOMFileSystemSync.idl:
+        * Modules/filesystem/DirectoryEntry.idl:
+        * Modules/filesystem/DirectoryEntrySync.idl:
+        * Modules/filesystem/DirectoryReader.idl:
+        * Modules/filesystem/DirectoryReaderSync.idl:
+        * Modules/filesystem/Entry.idl:
+        * Modules/filesystem/EntryArray.idl:
+        * Modules/filesystem/EntryArraySync.idl:
+        * Modules/filesystem/EntrySync.idl:
+        * Modules/filesystem/FileEntry.idl:
+        * Modules/filesystem/FileEntrySync.idl:
+        * Modules/filesystem/FileWriter.idl:
+        * Modules/filesystem/FileWriterSync.idl:
+        * Modules/filesystem/Metadata.idl:
+        * Modules/gamepad/Gamepad.idl:
+        * Modules/gamepad/GamepadList.idl:
+        * Modules/geolocation/Coordinates.idl:
+        * Modules/geolocation/Geolocation.idl:
+        * Modules/geolocation/Geoposition.idl:
+        * Modules/geolocation/PositionError.idl:
+        * Modules/indexeddb/DOMWindowIndexedDatabase.idl:
+        * Modules/indexeddb/IDBAny.idl:
+        * Modules/mediasource/MediaSource.idl:
+        * Modules/mediasource/SourceBuffer.idl:
+        * Modules/mediasource/SourceBufferList.idl:
+        * Modules/mediastream/DOMWindowMediaStream.idl: Removed.
+        * Modules/mediastream/MediaStream.idl:
+        * Modules/mediastream/MediaStreamTrack.idl:
+        * Modules/mediastream/MediaStreamTrackEvent.idl:
+        * Modules/mediastream/NavigatorUserMediaError.idl:
+        * Modules/mediastream/RTCDTMFSender.idl:
+        * Modules/mediastream/RTCDTMFToneChangeEvent.idl:
+        * Modules/mediastream/RTCDataChannel.idl:
+        * Modules/mediastream/RTCDataChannelEvent.idl:
+        * Modules/mediastream/RTCIceCandidateEvent.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/mediastream/RTCStatsReport.idl:
+        * Modules/mediastream/RTCStatsResponse.idl:
+        * Modules/networkinfo/NetworkInfoConnection.idl:
+        * Modules/notifications/DOMWindowNotifications.idl:
+        * Modules/notifications/NotificationCenter.idl:
+        * Modules/quota/StorageInfo.idl:
+        * Modules/quota/StorageQuota.idl:
+        * Modules/speech/DOMWindowSpeech.idl: Removed.
+        * Modules/speech/DOMWindowSpeechSynthesis.idl:
+        * Modules/speech/SpeechGrammar.idl:
+        * Modules/speech/SpeechGrammarList.idl:
+        * Modules/speech/SpeechRecognition.idl:
+        * Modules/speech/SpeechRecognitionAlternative.idl:
+        * Modules/speech/SpeechRecognitionError.idl:
+        * Modules/speech/SpeechRecognitionEvent.idl:
+        * Modules/speech/SpeechRecognitionResult.idl:
+        * Modules/speech/SpeechRecognitionResultList.idl:
+        * Modules/speech/SpeechSynthesis.idl:
+        * Modules/speech/SpeechSynthesisVoice.idl:
+        * Modules/webaudio/AnalyserNode.idl:
+        * Modules/webaudio/AudioBuffer.idl:
+        * Modules/webaudio/AudioBufferSourceNode.idl:
+        * Modules/webaudio/AudioContext.idl:
+        * Modules/webaudio/AudioDestinationNode.idl:
+        * Modules/webaudio/AudioListener.idl:
+        * Modules/webaudio/AudioNode.idl:
+        * Modules/webaudio/AudioParam.idl:
+        * Modules/webaudio/AudioSourceNode.idl:
+        * Modules/webaudio/BiquadFilterNode.idl:
+        * Modules/webaudio/ChannelMergerNode.idl:
+        * Modules/webaudio/ChannelSplitterNode.idl:
+        * Modules/webaudio/ConvolverNode.idl:
+        * Modules/webaudio/DOMWindowWebAudio.idl: Removed.
+        * Modules/webaudio/DelayNode.idl:
+        * Modules/webaudio/DynamicsCompressorNode.idl:
+        * Modules/webaudio/GainNode.idl:
+        * Modules/webaudio/MediaElementAudioSourceNode.idl:
+        * Modules/webaudio/MediaStreamAudioDestinationNode.idl:
+        * Modules/webaudio/MediaStreamAudioSourceNode.idl:
+        * Modules/webaudio/OfflineAudioContext.idl:
+        * Modules/webaudio/OscillatorNode.idl:
+        * Modules/webaudio/PannerNode.idl:
+        * Modules/webaudio/ScriptProcessorNode.idl:
+        * Modules/webaudio/WaveShaperNode.idl:
+        * Modules/webaudio/WaveTable.idl:
+        * Modules/webdatabase/DOMWindowWebDatabase.idl:
+        * Modules/webdatabase/Database.idl:
+        * Modules/webdatabase/DatabaseSync.idl:
+        * Modules/webdatabase/SQLError.idl:
+        * Modules/webdatabase/SQLResultSet.idl:
+        * Modules/webdatabase/SQLResultSetRowList.idl:
+        * Modules/webdatabase/SQLTransaction.idl:
+        * Modules/webdatabase/SQLTransactionSync.idl:
+        * Modules/websockets/DOMWindowWebSocket.idl: Removed.
+        * Modules/websockets/WebSocket.idl:
+        * PlatformBlackBerry.cmake:
+        * UseJSC.cmake:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><ins>+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/IDLParser.pm:
+        (parseTypedef):
+        * bindings/scripts/preprocess-idls.pl:
+        (GenerateConstructorAttribute):
+        (getFileContents):
+        (getPartialInterfaceNameFromIDL):
+        (isCallbackInterfaceFromIDL):
+        (trim):
+        (getInterfaceExtendedAttributesFromIDL):
+        * css/CSSFontFaceLoadEvent.idl:
+        * css/CSSFontFaceRule.idl:
+        * css/CSSSupportsRule.idl:
+        * css/CSSUnknownRule.idl:
+        * css/DOMWindowCSS.idl:
+        * css/FontLoader.idl:
+        * css/MediaQueryList.idl:
+        * css/MediaQueryListListener.idl:
+        * css/StyleMedia.idl:
+        * dom/CustomElementConstructor.idl:
+        * dom/DOMError.idl:
+        * dom/DOMNamedFlowCollection.idl:
+        * dom/DataTransferItem.idl:
+        * dom/DataTransferItemList.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * dom/NodeIterator.idl:
+        * dom/ShadowRoot.idl:
+        * dom/TreeWalker.idl:
+        * dom/WebKitNamedFlow.idl:
+        * fileapi/FileException.idl:
+        * fileapi/FileReaderSync.idl:
+        * html/HTMLAudioElement.idl:
+        * html/HTMLDetailsElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/MediaError.idl:
+        * html/MediaKeyError.idl:
+        * html/MicroDataItemValue.idl:
+        * html/RadioNodeList.idl:
+        * html/ValidityState.idl:
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/DOMPath.idl:
+        * html/canvas/EXTDrawBuffers.idl:
+        * html/canvas/EXTTextureFilterAnisotropic.idl:
+        * html/canvas/OESElementIndexUint.idl:
+        * html/canvas/OESStandardDerivatives.idl:
+        * html/canvas/OESTextureFloat.idl:
+        * html/canvas/OESTextureHalfFloat.idl:
+        * html/canvas/OESVertexArrayObject.idl:
+        * html/canvas/WebGLCompressedTextureATC.idl:
+        * html/canvas/WebGLCompressedTexturePVRTC.idl:
+        * html/canvas/WebGLCompressedTextureS3TC.idl:
+        * html/canvas/WebGLContextAttributes.idl:
+        * html/canvas/WebGLDebugRendererInfo.idl:
+        * html/canvas/WebGLDebugShaders.idl:
+        * html/canvas/WebGLDepthTexture.idl:
+        * html/canvas/WebGLLoseContext.idl:
+        * html/canvas/WebGLVertexArrayObjectOES.idl:
+        * html/track/AudioTrack.idl:
+        * html/track/AudioTrackList.idl:
+        * html/track/TextTrackRegionList.idl:
+        * html/track/VideoTrack.idl:
+        * html/track/VideoTrackList.idl:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/JavaScriptCallFrame.idl:
+        * inspector/ScriptProfile.idl:
+        * inspector/ScriptProfileNode.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/AbstractView.idl:
+        * page/BarInfo.idl:
+        * page/Console.idl:
+        * page/Crypto.idl:
+        * page/DOMSecurityPolicy.idl:
+        * page/DOMWindow.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/MemoryInfo.idl:
+        * page/Navigator.idl:
+        * page/PagePopupController.idl:
+        * page/Performance.idl:
+        * page/PerformanceEntry.idl:
+        * page/PerformanceEntryList.idl:
+        * page/PerformanceMark.idl:
+        * page/PerformanceMeasure.idl:
+        * page/PerformanceNavigation.idl:
+        * page/PerformanceResourceTiming.idl:
+        * page/PerformanceTiming.idl:
+        * page/Screen.idl:
+        * page/SpeechInputResult.idl:
+        * page/SpeechInputResultList.idl:
+        * page/WorkerNavigator.idl:
+        * page/make_settings.pl:
+        (generateInternalSettingsIdlFile):
+        * svg/ElementTimeControl.idl:
+        * svg/SVGAnimationElement.idl:
+        * svg/SVGExternalResourcesRequired.idl:
+        * svg/SVGFilterPrimitiveStandardAttributes.idl:
+        * svg/SVGFitToViewBox.idl:
+        * svg/SVGLangSpace.idl:
+        * svg/SVGLocatable.idl:
+        * svg/SVGStyledElement.idl:
+        * svg/SVGTests.idl:
+        * svg/SVGTransformable.idl:
+        * svg/SVGURIReference.idl:
+        * testing/InternalSettings.idl:
+        * testing/Internals.idl:
+        * testing/MallocStatistics.idl:
+        * testing/TypeConversions.idl:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.idl:
+        * workers/WorkerContext.idl:
+        * workers/WorkerLocation.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathNSResolver.idl:
</ins><span class="cx"> 
</span><del>-2014-03-10  Mario Sanchez Prada  &lt;mario.prada@samsung.com&gt;
</del><ins>+2013-05-09  ChangSeok Oh  &lt;changseok.oh@collabora.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Add support for Geoclue2
-        https://bugs.webkit.org/show_bug.cgi?id=120185
</del><ins>+        [GTK][AC] Buildfix after r149694
+        https://bugs.webkit.org/show_bug.cgi?id=115797
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+        Reviewed by Gustavo Noronha Silva.
</ins><span class="cx"> 
</span><del>-        Patch by Anton Obzhirov &lt;a.obzhirov@samsung.com&gt; and Mario Sanchez Prada &lt;mario.prada@samsung.com&gt;
</del><ins>+        Some interfaces, such as a return value and parameters of functions are changed.
</ins><span class="cx"> 
</span><del>-        Implement a new geolocation provider based on Geoclue2, which will only
-        be used if a good enough version of Geoclue2 is found  at configure time.
</del><ins>+        No new tests since no functionality changed.
</ins><span class="cx"> 
</span><del>-        * GNUmakefile.am: Generate C-API for accessing the D-Bus API
-        provided by Geoclue2, and place it in DerivedSources.
-        * GNUmakefile.list.am: Add GeolocationProviderGeoclue2.cpp, and
-        include the generated proxy files when using Geoclue2.
-        * PlatformGTK.cmake: Likewise, for CMake based builds.
-        * platform/geoclue/GeolocationProviderGeoclue.h: Modified to
-        accomodate the needs both for Geoclue and Geoclue2 providers.
-        * platform/geoclue/GeolocationProviderGeoclue1.cpp: Renamed from Source/WebCore/platform/geoclue/GeolocationProviderGeoclue.cpp.
-        (GeolocationProviderGeoclue::getPositionCallback):
-        (GeolocationProviderGeoclue::positionChangedCallback):
-        (GeolocationProviderGeoclue::createGeocluePositionCallback):
-        (GeolocationProviderGeoclue::geoclueClientSetRequirementsCallback):
-        (GeolocationProviderGeoclue::createGeoclueClientCallback):
-        (GeolocationProviderGeoclue::GeolocationProviderGeoclue):
-        (GeolocationProviderGeoclue::~GeolocationProviderGeoclue):
-        (GeolocationProviderGeoclue::startUpdating):
-        (GeolocationProviderGeoclue::stopUpdating):
-        (GeolocationProviderGeoclue::setEnableHighAccuracy):
-        (GeolocationProviderGeoclue::initializeGeoclueClient):
-        (GeolocationProviderGeoclue::initializeGeocluePosition):
-        (GeolocationProviderGeoclue::updateClientRequirements):
-        (GeolocationProviderGeoclue::positionChanged):
-        (GeolocationProviderGeoclue::errorOccurred):
-        * platform/geoclue/GeolocationProviderGeoclue2.cpp: Added.
-        (GeolocationProviderGeoclue::GeolocationProviderGeoclue):
-        (GeolocationProviderGeoclue::~GeolocationProviderGeoclue):
-        (GeolocationProviderGeoclue::startUpdating):
-        (GeolocationProviderGeoclue::stopUpdating):
-        (GeolocationProviderGeoclue::setEnableHighAccuracy):
-        (GeolocationProviderGeoclue::createGeoclueManagerProxyCallback):
-        (GeolocationProviderGeoclue::getGeoclueClientCallback):
-        (GeolocationProviderGeoclue::createGeoclueClientProxyCallback):
-        (GeolocationProviderGeoclue::startClientCallback):
-        (GeolocationProviderGeoclue::locationUpdatedCallback):
-        (GeolocationProviderGeoclue::createLocationProxyCallback):
-        (GeolocationProviderGeoclue::startGeoclueClient):
-        (GeolocationProviderGeoclue::updateLocation):
-        (GeolocationProviderGeoclue::errorOccurred):
-        (GeolocationProviderGeoclue::updateClientRequirements):
</del><ins>+        * platform/graphics/clutter/GraphicsLayerClutter.cpp:
+        (WebCore::animationHasStepsTimingFunction):
+        (WebCore::GraphicsLayerClutter::timingFunctionForAnimationValue):
+        (WebCore::GraphicsLayerClutter::setTransformAnimationKeyframes):
+        (WebCore::GraphicsLayerClutter::setTransformAnimationEndpoints):
+        (WebCore::GraphicsLayerClutter::createTransformAnimationsFromKeyframes):
+        (WebCore::GraphicsLayerClutter::setAnimationEndpoints):
+        (WebCore::GraphicsLayerClutter::setAnimationKeyframes):
+        * platform/graphics/clutter/GraphicsLayerClutter.h:
+        (GraphicsLayerClutter):
</ins><span class="cx"> 
</span><del>-2014-03-10  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2013-05-08  Rob Buis  &lt;rbuis@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed Windows Build Fix.
</del><ins>+        Fix some compiler warnings (miscellaneous)
+        https://bugs.webkit.org/show_bug.cgi?id=80790
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj: Don't build cURL files for Apple Windows port.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
-        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::LayerClient::platformCALayerPaintContents): Correct
-        method signature to match base class.
-        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::loadInternal): Use proper character encoding.
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-03-10  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Get rid of the following warning for BlackBerry:
</ins><span class="cx"> 
</span><del>-        Fix three leaks
-        https://bugs.webkit.org/show_bug.cgi?id=130048
</del><ins>+        NavigatorContentUtils.cpp:60:78: warning: comparison of unsigned expression &lt; 0 is always false [-Wtype-limits]
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        by not compiling any of the code to add protocols to the protocol whitelist.
</ins><span class="cx"> 
</span><del>-        The NSDictionary was leaked.
</del><ins>+        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
+        (WebCore::initProtocolHandlerWhitelist):
</ins><span class="cx"> 
</span><del>-        * page/ios/UserAgentIOS.mm:
-        (WebCore::osMarketingVersion):
</del><ins>+2013-05-08  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-10  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        [Windows] The function seekFile() is not implemented.
+        https://bugs.webkit.org/show_bug.cgi?id=115246
</ins><span class="cx"> 
</span><del>-        Set background color of WK2's UIScrollView to the pageExtendedBackgroundColor
-        https://bugs.webkit.org/show_bug.cgi?id=129919
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Implemented seekFile() function for Windows.
</ins><span class="cx"> 
</span><del>-        WK2 needs to be able to ask for the pageExtendedBackgroundColor, so this patch 
-        adds a function to Page that will return it
</del><ins>+        * platform/win/FileSystemWin.cpp:
+        (WebCore::seekFile):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/Page.cpp:
-        (WebCore::Page::pageExtendedBackgroundColor):
-        * page/Page.h:
-        * rendering/RenderLayerCompositor.h:
-        (WebCore::RenderLayerCompositor::rootExtendedBackgroundColor):
</del><ins>+2013-05-08  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-10  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Web Inspector: Fix a typo in Settings.js
+        https://bugs.webkit.org/show_bug.cgi?id=115849
</ins><span class="cx"> 
</span><del>-        Generalize unobscured rect to all ports
-        https://bugs.webkit.org/show_bug.cgi?id=130036
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        iOS differentiates visible content and unobscured content. This patch moves the concept to all
-        ports to remove the #ifdefs from the call sites.
</del><ins>+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
</ins><span class="cx"> 
</span><del>-        On everything but iOS, unobscuredRect and visibleRect are the same.
</del><ins>+2013-05-08  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::innerHeight):
-        (WebCore::DOMWindow::innerWidth):
-        * page/SpatialNavigation.cpp:
-        (WebCore::canScrollInDirection):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::paint):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::unobscuredContentRectIncludingScrollbars):
-        (WebCore::ScrollView::unobscuredContentRect):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::viewportSize):
</del><ins>+        SecurityOrigin doesn’t need to forward declare or include Document
+        https://bugs.webkit.org/show_bug.cgi?id=115847
</ins><span class="cx"> 
</span><del>-2014-03-10  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Start splitting CSS Selectors's pseudo types
-        https://bugs.webkit.org/show_bug.cgi?id=130003
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/fc7a88caa9c41f3471d8994a530643e5225f82fc.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Removed unused Document forward declaration+include from SecurityOrigin.
</ins><span class="cx"> 
</span><del>-        CSS Selectors pseudo types come in 3 flavors: page, pseudo class, pseudo elements.
</del><ins>+        * page/SecurityOrigin.cpp:
+        * page/SecurityOrigin.h:
</ins><span class="cx"> 
</span><del>-        The three types are mixed together in a single enum list named PseudoType. Only some combinations
-        of match type + pseudo type are valid, but this is implicitly defined from the code.
</del><ins>+2013-05-08  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This patch is the beginning of a refactoring to add more clear boundaries between
-        valid and invalid combinations.
</del><ins>+        BUILD FIX: Don't use adoptCF() with NSDictionary * object
</ins><span class="cx"> 
</span><del>-        First, the handling of page pseudo types is completely split from the other values.
-        The parser use a different method for handling the value CSSParserSelector::parsePagePseudoSelector().
</del><ins>+        Fixes the following build failure:
</ins><span class="cx"> 
</span><del>-        PagePseudo types no longer store their string in the CSSSelector either to reduce the redundancy
-        with m_pseudoType.
-        When we need to generate the string for those CSSSelector, we recreate the string as needed in
-        CSSSelector::selectorText().
</del><ins>+            In file included from Source/WebCore/platform/network/mac/ResourceErrorMac.mm:27:
+            In file included from Source/WebCore/platform/network/cf/ResourceError.h:31:
+            /usr/local/include/wtf/RetainPtr.h:81:13: error: static_assert failed &quot;Don't use adoptCF with Objective-C pointer types, use adoptNS.&quot;
+                        static_assert(!std::is_convertible&lt;T, id&gt;::value, &quot;Don't use adoptCF with Objective-C pointer types, use adoptNS.&quot;);
+                        ^             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+            /usr/local/include/wtf/RetainPtr.h:274:16: note: in instantiation of member function 'WTF::RetainPtr&lt;NSDictionary *&gt;::RetainPtr' requested here
+                    return RetainPtr&lt;T&gt;(AdoptCF, o);
+                           ^
+            Source/WebCore/platform/network/mac/ResourceErrorMac.mm:214:44: note: in instantiation of function template specialization 'WTF::adoptCF&lt;NSDictionary *&gt;' requested here
+                    RetainPtr&lt;NSDictionary&gt; userInfo = adoptCF((NSDictionary *) CFErrorCopyUserInfo(error));
+                                                       ^
+            1 error generated.
</ins><span class="cx"> 
</span><del>-        The remaining two types are not yet split in this patch but this introduce the preliminary clean up
-        toward that goal.
-        The list of parsed pseudo types is now generated at compile time from the source in SelectorPseudoTypeMap.in.
</del><ins>+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::nsError): Switch from adoptCF() to
+        adoptNS().  This is in USE(CFNETWORK) code, so it's not
+        exercised on the Mac.
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make:
-        The mapping of strings to pseudo types is generated from SelectorPseudoTypeMap.in
-        by the new script makeSelectorPseudoTypeMap.py.
</del><ins>+2013-05-08  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSGrammar.y.in:
-        Split the parsing of Pseudo Types. Pseudo page get its own method. The others will need some work.
</del><ins>+        Remove Editor::setSelectionOffsets
+        https://bugs.webkit.org/show_bug.cgi?id=115831
</ins><span class="cx"> 
</span><del>-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserSelector::parsePagePseudoSelector):
-        (WebCore::CSSParserSelector::setPseudoTypeValue):
-        * css/CSSParserValues.h:
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::specificityForPage):
-        This is an example of invalid combination that is hidden by the current code.
-        First, Left and Right could never appear in a pseudo class match.
-        (WebCore::CSSSelector::pseudoId):
-        (WebCore::CSSSelector::parsePseudoType):
-        (WebCore::appendPseudoTypeTailIfNecessary):
-        (WebCore::CSSSelector::selectorText):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::pseudoType):
-        (WebCore::CSSSelector::matchesPseudoElement):
-        (WebCore::CSSSelector::setValue):
-        (WebCore::CSSSelector::CSSSelector):
-        * css/PageRuleCollector.cpp:
-        (WebCore::checkPageSelectorComponents):
-        * css/SelectorChecker.cpp:
-        (WebCore::SelectorChecker::checkOne):
-        * css/SelectorPseudoTypeMap.h: Added.
-        * css/SelectorPseudoTypeMap.in: Added.
-        * css/makeSelectorPseudoTypeMap.py: Added.
-        (enumerablePseudoType):
-        (expand_ifdef_condition):
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::addPseudoType):
-
-2014-03-10  Enrica Casucci  &lt;enrica@apple.com&gt;
-
-        iOS build fix after http://trac.webkit.org/changeset/165385
-
-        Unreviewed.
-
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper arrayOfTextForTextMarkers:attributed:]):
-
-2014-03-10  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        REGRESSION (r159218): FrameView::layout() should destroy TemporaryChange&lt;LayoutPhase&gt;
-        before destroying Ref&lt;FrameView&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=130034
-        &lt;rdar://problem/15664288&gt;
-
-        Reviewed by Alexey Proskuryakov.
-
-        We should always destroy TemporaryChange&lt;LayoutPhase&gt; before destroying Ref&lt;FrameView&gt;
-        in FrameView::layout() so as to ensure that the FrameView exists when we restore the
-        original layout phase value.
-
-        The existing test fast/frames/crash-remove-iframe-during-object-beforeload.html covers
-        this change. Although you must run the test with Guard Malloc enabled (i.e. run-webkit-tests -r).
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout): Move construction of variable protect before the construction of
-        variable layoutPhaseRestorer. Additionally, add a period to the end of the comment associated
-        with variable protect.
-
-2014-03-10  Zsolt Borbely  &lt;borbezs@inf.u-szeged.hu&gt;
-
-        ASSERTION FAILED: span &gt;= 1
-        https://bugs.webkit.org/show_bug.cgi?id=129148
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Set the value of span to 1 if the given number is too big or zero.
</del><ins>+        Removed the function added in r120985 for Chromium Android port.
</ins><span class="cx"> 
</span><del>-        Test: fast/table/incorrect-colgroup-span-values.html
</del><ins>+        * editing/Editor.cpp:
+        * editing/Editor.h:
</ins><span class="cx"> 
</span><del>-        * html/HTMLTableColElement.cpp:
-        (WebCore::HTMLTableColElement::parseAttribute):
</del><ins>+2013-05-07  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-10  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Potential use-after-free of Frame
+        https://bugs.webkit.org/show_bug.cgi?id=115774
</ins><span class="cx"> 
</span><del>-        [Win] Pass environment to Pre-Build, Pre-Link, and Post-Build Stages.
-        https://bugs.webkit.org/show_bug.cgi?id=130023.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/c5b4a6db82e8280c7fc55ee3dc3a84c6b026e66e.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.proj: Avoid trailing slashes in path values to
-        prevent escaping during later string substitution.
</del><ins>+        * page/Frame.cpp:
+        (WebCore::Frame::setPrinting):
+        (WebCore::Frame::setPageAndTextZoomFactors):
+        (WebCore::Frame::deviceOrPageScaleFactorChanged):
</ins><span class="cx"> 
</span><del>-2014-03-10  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+2013-05-08  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Hit-testing is not working properly inside scrollable regions
-        https://bugs.webkit.org/show_bug.cgi?id=130015
</del><ins>+        Unreviewed build fix, AppleWin port.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
+        (WebCore::MediaPlayerPrivateAVFoundation::seek):
+        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted):
+        (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification):
+        (WebCore):
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        (MediaPlayerPrivateAVFoundation):
</ins><span class="cx"> 
</span><del>-        When hit-testing inside the flow thread's layer, the scrolled offset
-        of the current region must be taken into consideration.
</del><ins>+2013-05-08  Xingnan Wang  &lt;xingnan.wang@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/scrollable-regions-hit-testing-inside.html
</del><ins>+        Heap-use-after-free in WebCore::AudioNodeOutput::pull
+        https://bugs.webkit.org/show_bug.cgi?id=111362
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
</del><ins>+        Reviewed by Chris Rogers.
</ins><span class="cx"> 
</span><del>-2014-03-10  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+        * Modules/webaudio/AudioBuffer.cpp:
+        (WebCore::AudioBuffer::createFromAudioFileData):
+        * Modules/webaudio/AudioNodeInput.cpp:
+        (WebCore::AudioNodeInput::AudioNodeInput):
+        (WebCore::AudioNodeInput::updateInternalBus):
+        * Modules/webaudio/AudioNodeInput.h:
+        (AudioNodeInput):
+        * Modules/webaudio/AudioNodeOutput.cpp:
+        (WebCore::AudioNodeOutput::AudioNodeOutput):
+        (WebCore::AudioNodeOutput::updateInternalBus):
+        (WebCore::AudioNodeOutput::pull):
+        (WebCore::AudioNodeOutput::bus):
+        * Modules/webaudio/AudioNodeOutput.h:
+        (AudioNodeOutput):
+        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
+        * Modules/webaudio/OfflineAudioDestinationNode.h:
+        (OfflineAudioDestinationNode):
+        * platform/audio/AudioBus.cpp:
+        (WebCore::AudioBus::createBufferFromRange):
+        (WebCore::AudioBus::createBySampleRateConverting):
+        (WebCore::AudioBus::createByMixingToMono):
+        * platform/audio/AudioBus.h:
+        (AudioBus):
+        * platform/audio/AudioFileReader.h:
+        (WebCore):
+        * platform/audio/AudioResampler.cpp:
+        (WebCore::AudioResampler::AudioResampler):
+        (WebCore::AudioResampler::configureChannels):
+        * platform/audio/AudioResampler.h:
+        (AudioResampler):
+        * platform/audio/HRTFElevation.cpp:
+        (WebCore::getConcatenatedImpulseResponsesForSubject):
+        (WebCore::HRTFElevation::calculateKernelsForAzimuthElevation):
+        * platform/audio/MultiChannelResampler.cpp:
+        * platform/audio/Reverb.cpp:
+        (WebCore::Reverb::initialize):
+        * platform/audio/Reverb.h:
+        (Reverb):
+        * platform/audio/efl/AudioBusEfl.cpp:
+        (WebCore::AudioBus::loadPlatformResource):
+        * platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
+        (AudioFileReader):
+        (WebCore::AudioFileReader::createBus):
+        (WebCore::createBusFromAudioFile):
+        (WebCore::createBusFromInMemoryAudioFile):
+        * platform/audio/gtk/AudioBusGtk.cpp:
+        (WebCore::AudioBus::loadPlatformResource):
+        * platform/audio/mac/AudioBusMac.mm:
+        (WebCore::AudioBus::loadPlatformResource):
+        * platform/audio/mac/AudioFileReaderMac.cpp:
+        (WebCore::AudioFileReader::createBus):
+        (WebCore::createBusFromAudioFile):
+        (WebCore::createBusFromInMemoryAudioFile):
+        * platform/audio/mac/AudioFileReaderMac.h:
+        (AudioFileReader):
+        * platform/audio/qt/AudioBusQt.cpp:
+        (WebCore::AudioBus::loadPlatformResource):
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] SVG Image valued shape fails if root element's size is relative
-        https://bugs.webkit.org/show_bug.cgi?id=128983
</del><ins>+2013-05-08  Eli Fidler  &lt;efidler@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        [BlackBerry] Fix usage of BlackBerry::Platform::String
+        https://bugs.webkit.org/show_bug.cgi?id=115781
</ins><span class="cx"> 
</span><del>-        When creating a shape based on an Image, compute its dimensions using
-        RenderBoxModelObject::calculateImageIntrinsicDimensions(), then set the
-        ImageResource's containerSize, and then use imageForRenderer() to get the
-        image to be drawn. The first step resolves SVG Image relative sizes, the
-        second step creates and caches an SVGImageForContainer with the correct
-        containerSize, and the last step retrieves the SVGImageForContainer.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Test: fast/shapes/shape-outside-floats/shape-outside-relative-size-svg.html
</del><ins>+        BlackBerry PRs 304193 and 327181
+        Internally Reviewed by Mike Lattanzio, Arvid Nilsson, Joe Mason, Jeff Rogers, and George Staikos
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.h: Publicized calculateImageIntrinsicDimensions() and its enum.
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createRasterShape):
-        * rendering/shapes/Shape.h:
-        * rendering/shapes/ShapeInfo.cpp:
-        (WebCore::getShapeImageAndRect):
-        (WebCore::ShapeInfo&lt;RenderType&gt;::computedShape):
</del><ins>+        We currently have a problem where we're passing UTF-8 encoded data into
+        the char* constructors of BlackBerry::Platform::String. This means the string
+        thinks its data is not UTF-8.
</ins><span class="cx"> 
</span><del>-2014-03-10  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::setData):
+        (WebCore::ClipboardBlackBerry::writeURL):
+        (WebCore::ClipboardBlackBerry::writePlainText):
+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::CookieManager::getRawCookies):
+        (WebCore::CookieManager::getBackingStoreCookies):
+        * platform/blackberry/CookieParser.cpp:
+        (WebCore::CookieParser::CookieParser):
+        (WebCore::CookieParser::parseOneCookie):
+        * platform/blackberry/CursorBlackBerry.cpp:
+        (WebCore::Cursor::Cursor):
+        * platform/blackberry/PlatformBlob.cpp:
+        (WebCore::PlatformBlob::nextDataItem):
+        * platform/blackberry/WorkerAsyncFileSystemBlackBerry.cpp:
+        (WebCore::WorkerAsyncFileSystemBlackBerry::openFileSystemOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::deleteFileSystemOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::moveOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::copyOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::removeOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::removeRecursivelyOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::readMetadataOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::createFileOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::createDirectoryOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::fileExistsOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::directoryExistsOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::readDirectoryOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::createWriterOnMainThread):
+        (WebCore::WorkerAsyncFileSystemBlackBerry::createSnapshotFileAndReadMetadataOnMainThread):
+        * platform/graphics/blackberry/ImageBlackBerry.cpp:
+        (WebCore::Image::loadPlatformResource):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::notifyChallengeResult):
+        (WebCore::toWebMediaStreamSource):
+        (WebCore::toWebMediaStreamDescriptor):
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+        * platform/network/blackberry/SocketStreamHandleBlackBerry.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        * platform/network/blackberry/rss/RSSFilterStream.cpp:
+        (WebCore::RSSFilterStream::notifyStatusReceived):
+        (WebCore::RSSFilterStream::notifyHeadersReceived):
+        (WebCore::RSSFilterStream::convertContentToHtml):
+        (WebCore::RSSFilterStream::charset):
+        (WebCore::RSSFilterStream::removeHeader):
+        (WebCore::RSSFilterStream::updateHeader):
+        (WebCore::RSSFilterStream::updateRSSHeaders):
+        * platform/network/blackberry/rss/RSSFilterStream.h:
+        * platform/text/blackberry/StringBlackBerry.cpp:
+        (WTF::String::operator BlackBerry::Platform::String):
</ins><span class="cx"> 
</span><del>-        TextIterator: Use StringView and references rather than pointers
-        https://bugs.webkit.org/show_bug.cgi?id=129975
</del><ins>+2013-05-08  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Assert at compile time that we don't pass Objective-C object pointers to adoptCF
+        https://bugs.webkit.org/show_bug.cgi?id=115823
</ins><span class="cx"> 
</span><del>-        TextIterator refinements:
-        - Use StringView instead of deprecatedCharacters to point to characters within strings.
-        - Added TextIteratorCopyableText, a safe way to copy the current text of a TextIterator,
-          for use by WordAwareIterator.
-        - Removed m_shouldStop; iterators stop by setting m_positionNode to null, and there is no
-          need for a separate boolean to do the same thing.
-        - Got rid of all the boolean data members set based on the text iterator behavior; instead
-          store the behavior in a data member and check it directly.
-        - Changed most functions to use references rather than pointers.
-        - Small micro-optimizations, such as using fastGetAttribute rather than getAttribute.
-        - Switched to nullptr instead of 0 where appropriate.
-        - Removed unused functions.
-        - Cut down on use of abbreviations instead of words.
-        - Renamed data members and argument names for clarity.
-        - Split up assertions that needlessly asserted more than one thing in a single expression.
-        - Treat CDATASection just like other Text, since its text will be visible.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::advanceToNextMisspelling): Pass reference rather than pointer.
-        (WebCore::Editor::rangeOfString): Ditto.
-        (WebCore::Editor::countMatchesForText): Ditto.
-        * editing/TextCheckingHelper.cpp:
-        (WebCore::TextCheckingHelper::findFirstMisspelling): Ditto.
</del><ins>+        * platform/graphics/ca/mac/TileController.mm:
+        (WebCore::TileController::TileController):
+        Use adoptNS for CALayer.
</ins><span class="cx"> 
</span><del>-        * editing/TextIterator.cpp:
-        (WebCore::depthCrossingShadowBoundaries): Take a reference rather than a pointer.
-        (WebCore::nextInPreOrderCrossingShadowBoundaries): Ditto.
-        (WebCore::fullyClipsContents): Ditto.
-        (WebCore::ignoresContainerClip): Ditto.
-        (WebCore::pushFullyClippedState): Ditto.
-        (WebCore::setUpFullyClippedStack): Ditto.
-        (WebCore::isRendererReplacedElement): Use references rather than pointers in the
-        implementation. Also use fastGetAttribute instead of getAttribute.
-        (WebCore::TextIteratorCopyableText::reset): Added.
-        (WebCore::TextIteratorCopyableText::set): Added.
-        (WebCore::TextIteratorCopyableText::appendToStringBuilder): Added.
-        (WebCore::TextIterator::TextIterator): Use more initialization rather than assignment.
-        Got rid of some local variables.
-        (WebCore::TextIterator::advance): Removed the m_shouldStop boolean, uneeded.
-        Many other improvements. Use isTextNode instead of nodeType.
-        (WebCore::hasVisibleTextNode): Changed this into a file-private helper function
-        instead of a member function.
-        (WebCore::TextIterator::handleTextNode): Used references and cut down on type casts.
-        Gave local variables clearer names.
-        (WebCore::TextIterator::handleTextBox): More of the same.
-        (WebCore::TextIterator::handleTextNodeFirstLetter): Ditto.
-        (WebCore::TextIterator::handleReplacedElement): Ditto.
-        (WebCore::shouldEmitTabBeforeNode): Ditto.
-        (WebCore::hasHeaderTag): Added.
-        (WebCore::shouldEmitNewlinesBeforeAndAfterNode): More of the same.
-        (WebCore::shouldEmitNewlineAfterNode): Ditto.
-        (WebCore::shouldEmitNewlineBeforeNode): Ditto.
-        (WebCore::shouldEmitExtraNewlineForNode): Ditto.
-        (WebCore::collapsedSpaceLength): Use StringImpl directly instead of using the
-        deprecatedCharacters function.
-        (WebCore::TextIterator::shouldRepresentNodeOffsetZero): More like above.
-        (WebCore::TextIterator::shouldEmitSpaceBeforeAndAfterNode): Ditto.
-        (WebCore::TextIterator::representNodeOffsetZero): Ditto.
-        (WebCore::TextIterator::handleNonTextNode): Ditto.
-        (WebCore::TextIterator::exitNode): Ditto.
-        (WebCore::TextIterator::emitCharacter): Changed to use the new copyable text class
-        instead of managing the single character buffer directly here.
-        (WebCore::TextIterator::emitText): Changed to take a Text&amp; and use the copyable text
-        class. Added a FIXME about a mistake I noticed.
-        (WebCore::TextIterator::range): Streamlined and simplified a bit. Updated data
-        member names to be a bit clearer. This function never returned null before, but there
-        was a code path that looked like it would; I removed that.
-        (WebCore::TextIterator::node): Removed unneeded null checks; the range function will
-        never return a range of null or one with null for a start container.
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator): More
-        like above.
-        (WebCore::SimplifiedBackwardsTextIterator::advance): Reorganized a bit and removed
-        m_shouldStop.
-        (WebCore::SimplifiedBackwardsTextIterator::handleTextNode): More of the same.
-        (WebCore::SimplifiedBackwardsTextIterator::handleFirstLetter): Ditto.
-        (WebCore::SimplifiedBackwardsTextIterator::handleReplacedElement): Ditto.
-        (WebCore::SimplifiedBackwardsTextIterator::handleNonTextNode): Ditto.
-        (WebCore::SimplifiedBackwardsTextIterator::exitNode): Ditto.
-        (WebCore::SimplifiedBackwardsTextIterator::emitCharacter): Ditto.
-        (WebCore::SimplifiedBackwardsTextIterator::advanceRespectingRange): Ditto.
-        (WebCore::SimplifiedBackwardsTextIterator::range): Ditto.
-        (WebCore::CharacterIterator::CharacterIterator): Ditto.
-        (WebCore::CharacterIterator::range): Ditto. No need for ASSERT_NO_EXCEPTION.
-        (WebCore::CharacterIterator::advance): Ditto.
-        (WebCore::BackwardsCharacterIterator::BackwardsCharacterIterator): Ditto.
-        (WebCore::BackwardsCharacterIterator::range): Ditto.
-        (WebCore::BackwardsCharacterIterator::advance): Ditto.
-        (WebCore::WordAwareIterator::WordAwareIterator): Ditto.
-        (WebCore::WordAwareIterator::advance): Use copyableText for m_previousText, fixing
-        the FIXME that I wrote in here before.
-        (WebCore::WordAwareIterator::text): Ditto.
-        (WebCore::containsKanaLetters): Changed to quickly return false when the pattern
-        is all Latin-1 rather than expanding to 16-bit just to check.
-        (WebCore::SearchBuffer::SearchBuffer): Iterate the target using the string operator[]
-        instead of using deprecatedCharacters.
-        (WebCore::SearchBuffer::append): Do the folding of quote marks and hyphens one character
-        at a time as we move characters into the buffer instead of in a separate loop.
-        (WebCore::TextIterator::rangeLength): Updated for changes eslwehere.
-        (WebCore::TextIterator::subrange): Ditto.
-        (WebCore::isInsideReplacedElement): Ditto. Also streamlined and removed unneeded null check.
-        (WebCore::TextIterator::rangeFromLocationAndLength): Updated for changes elsewhere and
-        removed unneeded ASSERT_NO_EXCEPTION.
-        (WebCore::plainText): Ditto.
-        (WebCore::collapsedToBoundary): Ditto.
-        (WebCore::findPlainText): Ditto.
</del><ins>+2013-05-08  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/TextIterator.h: Changed many functions to take references instead of pointers.
-        Added TextIteratorCopyableText, to represent the current text in a TextIterator in a form
-        that can be safely copied and used after further iteration. Reorganized member functions so
-        they are in the same order in all the classes. Changed TextIterator to use
-        TextIteratorCopyableText. Removed many unused functions, including:
-        - TextIterator::length
-        - TextIterator::deprecatedTextIteratorCharacters
-        - TextIterator::characterAt
-        - SimplifiedBackwardsTextIterator::length
-        - CharacterIterator::length
-        - CharacterIterator::string
-        - WordAwareIterator::length
-        - WordAwareIterator::range
</del><ins>+        TextTrackCue should support empty content
+        https://bugs.webkit.org/show_bug.cgi?id=115821
</ins><span class="cx"> 
</span><del>-        * editing/VisibleSelection.cpp:
-        (WebCore::VisibleSelection::appendTrailingWhitespace): Pass reference rather than pointer.
-        Use text().length() instead of length(). Check atEnd() before using CharacterIterator, since
-        iterator member functions don't work when at the end.
-        * editing/VisibleUnits.cpp:
-        (WebCore::previousBoundary): Ditto.
-        (WebCore::nextBoundary): Ditto.
-        * editing/htmlediting.cpp:
-        (WebCore::visiblePositionForIndexUsingCharacterIterator): Ditto.
-        * page/ios/FrameIOS.mm:
-        (WebCore::Frame::indexCountOfWordPrecedingSelection): Ditto.
-        (WebCore::Frame::wordsInCurrentParagraph): Ditto.
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-2014-03-10  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        Test: media/track/track-cue-empty-text-crash.html
</ins><span class="cx"> 
</span><del>-        [GTK] [CMake] Clean up library linking
-        https://bugs.webkit.org/show_bug.cgi?id=129782
</del><ins>+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Don't bother trying to render
+            cues with no content.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::getCueAsHTML): Return early if there isn't a node tree.
+        (WebCore::TextTrackCue::createCueRenderingTree): Ditto.
+        (WebCore::TextTrackCue::determineTextDirection): Ditto.
+        (WebCore::TextTrackCue::updateDisplayTree): Return early if there isn't a cue rendering tree.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Some files are duplicated on the source list of two convenience
-        libraries. Ensure that they are all compiled into WebCore instead of WebCorePlatformGTK.
-        Some simply need to be moved to WebCore from WebCorePlatformGTK. Don't try to link
-        WebCorePlatformGTK against WebCore -- convenience libraries should be able to save
-        their symbol resolution for the final linking step.
</del><ins>+2013-05-08  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-10  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Unreviewed AppleWin build fix.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Scrolling regions with the mouse wheel only works properly if hovering over the region's padding
-        https://bugs.webkit.org/show_bug.cgi?id=129485
</del><ins>+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
+        (MediaPlayerPrivateAVFoundationCF):
+        (WebCore::MediaPlayerPrivateAVFoundationCF::currentTrack):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+2013-05-08  José Dapena Paz  &lt;jdapena@igalia.com&gt; and Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        When searching for the region under the mouse pointer (to identify which region to scroll), 
-        the localToAbsolute method must be called on the region container, not the region itself.
-        Also, when calling the offsetFromContainer method on a named flow fragment,
-        it must only take into consideration the border and padding of the fragment container,
-        not its scrolled offset.
</del><ins>+        [GTK] Plumb the Automake build system for the Battery Status API feature
+        https://bugs.webkit.org/show_bug.cgi?id=115718
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/wheel-scrollable-single-region.html
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::scroll):
-        * rendering/RenderFlowThread.cpp:
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::offsetFromContainer):
-        * rendering/RenderNamedFlowFragment.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::fragmentFromAbsolutePointAndBox):
-        * rendering/RenderNamedFlowThread.h:
</del><ins>+        No new tests - no new functionality. The feature is not enabled yet, though all the relevant tests
+        pass when it is.
</ins><span class="cx"> 
</span><del>-2014-03-10  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        * GNUmakefile.am: Add the Modules/battery directory to the list of search paths for header inclusions.
+        Include the same directory under the IDL_PATH variable so the IDL files it contains are processed.
+        List these IDL files using a wildcard under the EXTRA_DIST list.
+        * GNUmakefile.list.am: Add the build targets for the module source files, IDLs and resulting JS bindings.
+        * bindings/gobject/GNUmakefile.am: Add the build targets for the GObject DOM bindings.
</ins><span class="cx"> 
</span><del>-        Remove unused dispatchStorageEvent() from StorageAreaSync
-        https://bugs.webkit.org/show_bug.cgi?id=129999
</del><ins>+2013-05-08  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Unreviewed. AppleWin VS2010 build fix.
</ins><span class="cx"> 
</span><del>-        dispatchStorageEvent() is not used anywhere.
-
-        * storage/StorageAreaSync.h: Remove dispatchStorageEvent().
-
-2014-03-09  Alexey Proskuryakov  &lt;ap@apple.com&gt;
-
-        iOS build fix.
-
-        * dom/KeyboardEvent.cpp: (WebCore::KeyboardEvent::KeyboardEvent):
-
-2014-03-06  Alexey Proskuryakov  &lt;ap@apple.com&gt;
-
-        [Mac] Don't perform a round-trip through WebProcess before interpreting key events
-        https://bugs.webkit.org/show_bug.cgi?id=129812
-
-        Reviewed by Darin Adler.
-
-        No significant behavior changes expected, except for Esc key processing, which now
-        dispatches a keypress before executing its default action.
-
-        * platform/KeypressCommand.h: Added.
-        (WebCore::KeypressCommand::KeypressCommand):
-        * GNUmakefile.list.am:
</del><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj.filters:
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        Moved KeypressCommand from dom/KeyboardEvent.h to its own header, as it needed
-        in platform/ directory now.
</del><span class="cx"> 
</span><del>-        * dom/KeyboardEvent.cpp:
-        (WebCore::KeyboardEvent::KeyboardEvent):
-        * dom/KeyboardEvent.h:
-        (WebCore::KeyboardEvent::handledByInputMethod):
-        (WebCore::KeyboardEvent::keypressCommands):
-        * platform/PlatformKeyboardEvent.h:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        (WebCore::PlatformKeyboardEvent::handledByInputMethod):
-        (WebCore::PlatformKeyboardEvent::commands):
-        PlatformKeyboardEvent now carries results of interpreting the event by AppKit. This
-        is logically not much different from carrying charcode, and is similar to what Gtk
-        does for input methods.
-        KeyboardEvent already had keypress commands, which were added to it after construction.
-        It's still possible for WebKit1, while with WebKit2, they are provided at construction
-        time. The event now also has a boolean for whether IM handled it already.
</del><ins>+2013-05-08  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-09  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        REGRESSION(r149700): fast/css-generated-content/close-quote-negative-depth.html
+        https://bugs.webkit.org/show_bug.cgi?id=115776
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Pass FloatSize boxsize to transform animations to support device pixel sizing.
-        https://bugs.webkit.org/show_bug.cgi?id=129985
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        I changed depth to more closely match what is in the CSS3 specification.
+        There may be a more optimal way to make it work, but this seems the most straightforward.
</ins><span class="cx"> 
</span><del>-        This is in preparation to stop passing integral positioned boxes to transform animations.
</del><ins>+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::RenderQuote): Initialize m_depth to -1 because that depth
+        is consistent with the empty string that is the initial value of the text. The
+        real depth will be calculated when the node is attached.
+        (WebCore::RenderQuote::originalText): Removed the &quot;depth - 1&quot; logic that
+        used to be done for close quotes. Instead, the updateDepth function now correctly
+        subtracts one for the close quote itself, not just afterward. Also added an early
+        exit when the depth is negative; these changes together fix the bug.
+        (WebCore::RenderQuote::attachQuote): Added a call to updateDepth even for the render
+        quote head, we now need that to set the depth either to 0 or to -1.
+        (WebCore::RenderQuote::detachQuote): Removed code to set m_depth to 0;  if we are not
+        resetting the text then m_depth should be left matching the text, otherwise updateDepth
+        might not do its job correctly if the quote is later re-attached. What matters is that
+        m_depth and the text are in sync.
+        (WebCore::RenderQuote::updateDepth): Changed updating logic in two ways. First,
+        compute the depth in a local variable rather than computing it in a data member
+        after first saving off the old value of the data member. That's clearer style.
+        Second, add the code to change negative depths to zero when propagating to the
+        next quote in the chain, which matches how the standard is written, and decrement
+        the depth of the close quote itself, not the quote after the close quote.
</ins><span class="cx"> 
</span><del>-        No change in behavior.
</del><ins>+2013-05-08  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::addAnimation):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::getTransformFunctionValue):
-        (WebCore::GraphicsLayerCA::addAnimation):
-        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
-        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
-        (WebCore::GraphicsLayerCA::setTransformAnimationEndpoints):
-        (WebCore::GraphicsLayerCA::setTransformAnimationKeyframes):
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::startTransition):
</del><ins>+        Prevent crash when track is deleted during video element deletion.
+        https://bugs.webkit.org/show_bug.cgi?id=106183
</ins><span class="cx"> 
</span><del>-2014-03-08  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        [iOS Wk2] Can't scroll after going back to page in page cache
-        https://bugs.webkit.org/show_bug.cgi?id=129989
-        &lt;rdar://problem/16217588&gt;
</del><ins>+        Test: media/track/track-remove-crash.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFrom): Set m_inActiveDocument to false so we
+            do not process text track cues or dispatch related events.
</ins><span class="cx"> 
</span><del>-        iOS has a special FrameLoader::forceLayoutWithoutRecalculatingStyle()
-        function that is called instead of FrameView::forceLayout(). This was unimplemented
-        for the WK2 FrameLoaderClient, so no layout was forced, with the result
-        that the contentSize was never updated and scrolling was broken.
-        
-        Fix by renaming the client function to forceLayoutOnRestoreFromPageCache()
-        and having it return a bool to say whether the default forceLayout()
-        should be done. WK1 can then continue to have its custom behavior,
-        and Wk2 will simply do a forceLayout().
-        
-        Also remove FrameLaoderClient::forceLayout(), which was never called.
</del><ins>+2013-05-08  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/EmptyClients.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        * loader/FrameLoaderClient.h:
</del><ins>+        [Mac] Unreviewed buildfix after r149741.
</ins><span class="cx"> 
</span><del>-2014-03-08  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::setClosedCaptionsVisible):
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Get position:fixed working slighlty better
-        https://bugs.webkit.org/show_bug.cgi?id=129988
</del><ins>+2013-05-08  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        [Mac] Inband text tracks are not in track menu on Lion
+        https://bugs.webkit.org/show_bug.cgi?id=115740
</ins><span class="cx"> 
</span><del>-        On iOS we want to use the viewport-constrained visible rect, not
-        just the visible rect.
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated):
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-2014-03-07  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        [iOS] Don't call scrollOffsetForFixedPosition a second time if we have no header and footer layers
-        https://bugs.webkit.org/show_bug.cgi?id=129912
-
-        Reviewed by Tim Horton.
-
-        Avoid extra work if we have no header or footer layers.
-
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::setScrollLayerPosition):
-
-2014-03-08  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        RenderElement::valueForLength() callers misuse bool parameter.
-        https://bugs.webkit.org/show_bug.cgi?id=129982
-
-        Reviewed by Andreas Kling.
-
-        Remove bogus RenderView* parameter.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computePercentageLogicalHeight):
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::repaintAfterLayoutIfNeeded):
-
-2014-03-08  Jeremy Jones  &lt;jeremyj@apple.com&gt;
-
-        Allow media element to supply the video layer after fullscreen transition has already begun.
-        https://bugs.webkit.org/show_bug.cgi?id=129870
-
-        Reviewed by Eric Carlson.
-
-        Instead of borrowing the videolayer from the HTMLMediaElement, WebVideoFullscreen now supplies a layer to HTMLMediaElement to fill in as needed and at the appropriate time.
-
-        This allows fullscreen even if the video layer hasn't yet been created. And in the future it allows MediaPlayer to supply other layers such as closed captions. 
-
-        * WebCore.exp.in:
-        Remove exports related to borrowing and lend the video layer.
-        Add exports for supplying a layer to fullscreen and keepying the frame and gravity properties in sync.
-
</del><span class="cx">         * html/HTMLMediaElement.cpp:
</span><del>-        Remove the concept of borrowing the platform layer.
-        Add the concept of a supplied m_videoFullscreenLayer, into which the media player can add layers.
-        When the m_videoFullscreenFrame is supplied, don't show the video layer inline any more.
-        Stash video layer properties in case the media player is not yet created.
-
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        Initialize gravity to the default. Remove m_platformLayerBorrowed.
-
-        (WebCore::HTMLMediaElement::platformLayer):
-        When we have a m_videoFullscreenLayer, don't show video inline.
-
-        (WebCore::HTMLMediaElement::setVideoFullscreenLayer):
-        Pass along the m_videoFullscreenLayer to the MediaPlayer if available or just stash it for later.
-
-        (WebCore::HTMLMediaElement::createMediaPlayer):
-        Pass along video fullscreen properties that we may have accumulated before the MediaPlayer was created.
-
-        (WebCore::HTMLMediaElement::setVideoFullscreenGravity):
-        Stash the gravity property, pass it along to the media player if possible.
-
</del><ins>+        (WebCore::HTMLMediaElement::HTMLMediaElement): Remove m_legacyWebKitClosedCaptionsVisible.
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): Set m_closedCaptionsVisible
+            to false immediately, it will be reset to the appropriate value if necessary.
+        (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): Remove m_legacyWebKitClosedCaptionsVisible.
+        (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): Remove m_legacyWebKitClosedCaptionsVisible.
</ins><span class="cx">         * html/HTMLMediaElement.h:
</span><del>-        Remove concept of borrowing the video layer. Add properties for a supplied videoFullscreenLayer.
</del><span class="cx"> 
</span><del>-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::setVideoFullscreenLayer):
-        Forward on to internal implementation.
</del><ins>+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Remove 
+            HAVE(AVFOUNDATION_TEXT_TRACK_SUPPORT) requirement. AVFOUNDATION_TEXT_TRACK_SUPPORT -&gt;
+            AVFOUNDATION_MEDIA_SELECTION_GROUP
+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h: Ditto.
</ins><span class="cx"> 
</span><del>-        (WebCore::MediaPlayer::setVideoFullscreenFrame):
-        Forward on to internal implementation.
</del><ins>+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp: 
+        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundation::seek): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundation::trackModeChanged): Ditto.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:  Ditto.
</ins><span class="cx"> 
</span><del>-        (WebCore::MediaPlayer::setVideoFullscreenGravity):
-        Forward on to internal implementation.
-
-        * platform/graphics/MediaPlayer.h:
-        Add methods for video fullscreen Layer, Frame and Gravity.
-
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::setVideoFullscreenLayer):
-        Add default implementation.
-
-        (WebCore::MediaPlayerPrivateInterface::setVideoFullscreenFrame):
-        Add default implementation.
-        
-        (WebCore::MediaPlayerPrivateInterface::setVideoFullscreenGravity):
-        Add default implementation.
-        
</del><ins>+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.h:  Ditto.
+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.mm:
+        (WebCore::InbandTextTrackPrivateLegacyAVFObjC::kind): Don't look at media characteristics, 
+            a legacy CC track is always Captions.
+        (WebCore::InbandTextTrackPrivateLegacyAVFObjC::isClosedCaptions): Ditto.
+        (WebCore::InbandTextTrackPrivateLegacyAVFObjC::containsOnlyForcedSubtitles): Ditto.
+        (WebCore::InbandTextTrackPrivateLegacyAVFObjC::isMainProgramContent): Ditto.
+        (WebCore::InbandTextTrackPrivateLegacyAVFObjC::isEasyToRead): Ditto.
+        (WebCore::InbandTextTrackPrivateLegacyAVFObjC::label): Use different AVFoundation API on 10.7.
</ins><span class="cx">         * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
</span><del>-        Add support for fullscreen video layer, frame and gravity.
</del><span class="cx"> 
</span><span class="cx">         * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
</span><del>-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC):
-        Init m_videoFullscreenGravity. 
</del><ins>+        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): AVFOUNDATION_TEXT_TRACK_SUPPORT -&gt;
+            AVFOUNDATION_MEDIA_SELECTION_GROUP.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::setClosedCaptionsVisible): Do nothing. AVFOUNDATION_TEXT_TRACK_SUPPORT -&gt;
+            AVFOUNDATION_MEDIA_SELECTION_GROUP.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Support legacy CC tracks
+            only on 10.8. AVFOUNDATION_TEXT_TRACK_SUPPORT -&gt; AVFOUNDATION_MEDIA_SELECTION_GROUP
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::processLegacyClosedCaptionsTracks): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::setCurrentTrack): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::languageOfPrimaryAudioTrack): AVFOUNDATION_TEXT_TRACK_SUPPORT -&gt; 
+            AVFOUNDATION_MEDIA_SELECTION_GROUP
</ins><span class="cx"> 
</span><del>-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer):
-        Apply cached properties once video layer is created and add to the fullscreen layer.
</del><ins>+2013-05-08  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer):
-        Cache the property value. Add video layer right away available.
</del><ins>+        Allow blank spaces before colon (:) on CSS variable definition
+        https://bugs.webkit.org/show_bug.cgi?id=115802
</ins><span class="cx"> 
</span><del>-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenFrame):
-        Cache the property value. Apply to video layer right away if available.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenGravity):
-        Cache the property value. Apply to video layer right away if available.
</del><ins>+        Test: css3/css-variable-definition.html
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
-        Supply a fullscreen video layer to the WebVideoFullscreenModel and to the WebVideoFullscreenInterface.
</del><ins>+        Modified the grammar to allow blank spaces before the colon on CSS
+        variable definitions.
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController enterFullscreen:]):
-        Supply a fullscreen video layer to the WebVideoFullscreenModel and to the WebVideoFullscreenInterface.
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController didExitFullscreen]):
-        Clean up the videoFullscreenLayer.
</del><ins>+2013-05-08  Gustavo Noronha Silva  &lt;gustavo.noronha@collabora.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterface.h:
-        Remove methods related to lending the video layer.
</del><ins>+        [GStreamer] Does memory buffering even with preload set to none
+        https://bugs.webkit.org/show_bug.cgi?id=115754
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        Rename WebAVPlayer layer to WebAVVideoLayer to match the AVKit name.
-        Remove functions related to lending the video layer.
-        Supply a layer directly to enterFullscreen.
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (+[WebAVVideoLayer videoLayer]):
-        Rename WebAVPlayer layer to WebAVVideoLayer to match the AVKit name.
</del><ins>+        Covered by existing tests.
</ins><span class="cx"> 
</span><del>-        (-[WebAVVideoLayer setPlayerController:]):
-        Store the AVPlayerController to prevent AVKit's default behavior.
</del><ins>+        Revision 148840 fixed on-disk buffering being done when preload is set to none,
+        but memory buffering is still being done. That is because setting the state to
+        paused causes GStreamer to start loading the media, to gather information. Only
+        doing that when committing the load avoids that while maintaining the tested
+        behaviour unchanged.
</ins><span class="cx"> 
</span><del>-        (-[WebAVVideoLayer setBounds:]):
-        Forward this onto the WebVideoFullscreenModel
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::load): move setting pause state to commitLoad.
+        (WebCore::MediaPlayerPrivateGStreamer::commitLoad): see above.
</ins><span class="cx"> 
</span><del>-        (-[WebAVVideoLayer setVideoLayerGravity:]):
-        Forward this onto the WebVideoFullscreenModel
</del><ins>+2013-05-08  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (-[WebAVVideoLayer videoLayerGravity]):
-        Forward this onto the WebVideoFullscreenModel
</del><ins>+        SVGStyledElement::getPresentationAttribute() does not need to be virtual.
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::enterFullscreen):
-        Supply a video layer directly instead of relying on one being previously loaned.
</del><ins>+        From Blink r149888 by &lt;cevans@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=149888&gt;
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::exitFullscreen):
-        Clean-up now assumes there is a video layer.
</del><ins>+        * svg/SVGStyledElement.h:
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModel.h:
-        Remove methods for borrowing and returning video layers.
-        Add methods for keeping video layer state in sync.
</del><ins>+2013-05-08  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.h:
-        Remove methods for borrowing and returning video layers.
-        Add method for supplying a video fullscreen layer.
-        Add methods for keeping video layer state in sync.
</del><ins>+        Crash when loading link to audio file
+        https://bugs.webkit.org/show_bug.cgi?id=115794
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::setMediaElement):
-        Handle audio element case by setting hasVideo to false.
</del><ins>+        Reviewed by Jocelyn Turcotte.
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::setVideoFullscreenLayer):
-        Pass along the video fullscreen layer to the media element.
</del><ins>+        Do not access a null pointer frame.
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::setVideoLayerFrame):
-        Pass along the video layer frame to the media element.
</del><ins>+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::isApplicationCacheEnabled):
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenModelMediaElement::setVideoLayerGravity):
-        Pass along the video layer gravity to the media element.
</del><ins>+2013-05-08  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-08  Jae Hyun Park  &lt;jaepark@webkit.org&gt;
</del><ins>+        Remove unused [TransferList] extended attribute
+        https://bugs.webkit.org/show_bug.cgi?id=115788
</ins><span class="cx"> 
</span><del>-        Clean up PlatformLayer.h
-        https://bugs.webkit.org/show_bug.cgi?id=129967
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        Remove [TransferList] extended attribute and corresponding tests as it has no
+        effect on the generated JSC bindings.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/PlatformLayer.h:
-        Remove duplicated declaration of PlatformLayer when using TextureMapper.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-03-08  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.h:
+        (WebDOMTestSerializedScriptValueInterface):
+        * bindings/scripts/test/CPP/WebDOMTestTypedefs.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestTypedefs.h:
+        (WebDOMTestTypedefs):
+        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp:
+        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestTypedefs.cpp:
+        * bindings/scripts/test/GObject/WebKitDOMTestTypedefs.h:
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        (JSTestSerializedScriptValueInterfacePrototype):
+        (JSTestSerializedScriptValueInterfaceConstructor):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore):
+        * bindings/scripts/test/JS/JSTestTypedefs.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.h:
+        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.mm:
+        * bindings/scripts/test/ObjC/DOMTestTypedefs.h:
+        * bindings/scripts/test/ObjC/DOMTestTypedefs.mm:
+        * bindings/scripts/test/TestSerializedScriptValueInterface.idl:
+        * bindings/scripts/test/TestTypedefs.idl:
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Simple compositing container layer (isSimpleContainerCompositingLayer) paints to wrong position.
-        https://bugs.webkit.org/show_bug.cgi?id=129861
</del><ins>+2013-05-08  Dongseong Hwang  &lt;dongseong.hwang@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Make optional arguments in CanvasRenderingContext2D match the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=115723
</ins><span class="cx"> 
</span><del>-        This patch ensures that both the simple and non-simple cases paint to the same position.
-        Simple compositing container layer codepath needs to take the fractional device pixel offset
-        into account when painting. Without the fractional value, the final paint rounding could push the
-        paint offset to a different position.
-        retina example:
-        compositing top-left: 0px 0px.
-        fractional offset: 0.3px 0.3px
-        painting coords without offseting: 0px 0px
-                           with offseting: 0.5px 0.5px
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Tests: compositing/hidpi-simple-container-layer-on-device-pixel.html
</del><ins>+        WebKit r98985 set many arguments optional although the canvas spec[1] does not
+        indicate. So this patch corrects CanvasRenderingContext2D.idl to match the spec.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/GraphicsLayer.h:
-        (WebCore::GraphicsLayer::contentsRect):
-        (WebCore::GraphicsLayer::setContentsRect):
-        (WebCore::GraphicsLayer::contentsClippingRect):
-        (WebCore::GraphicsLayer::setContentsClippingRect):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::setContentsRect):
-        (WebCore::GraphicsLayerCA::setContentsClippingRect):
-        (WebCore::GraphicsLayerCA::updateContentsRects):
-        * platform/graphics/ca/GraphicsLayerCA.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundColor):
-        (WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundImage):
-        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
-        (WebCore::RenderLayerBacking::backgroundBoxForPainting):
-        * rendering/RenderLayerBacking.h:
</del><ins>+        [1] http://www.w3.org/html/wg/drafts/2dcontext/html5_canvas/
</ins><span class="cx"> 
</span><del>-2014-03-08  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+        Covered by existing tests:
+          canvas/philip/tests/2d.missingargs.html
+          fast/canvas/canvas-overloads-strokeRect.html
+          inspector/profiler/canvas2d/canvas2d-profiler-capturing-basics.html
</ins><span class="cx"> 
</span><del>-        SerializedScriptValue may move Identifiers between worlds
-        https://bugs.webkit.org/show_bug.cgi?id=129979
</del><ins>+        * html/canvas/CanvasRenderingContext2D.idl:
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-05-08  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/workers/worker-copy-shared-blob-url.html
</del><ins>+        Remove unused method and de-virtualize others in Element.h
+        https://bugs.webkit.org/show_bug.cgi?id=115770
</ins><span class="cx"> 
</span><del>-        Don't use Strings to store blob URLs as String's may be Identifiers
-        and they can only exist in one world/thread at a time.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * Modules/indexeddb/IDBObjectStore.cpp:
-        (WebCore::IDBObjectStore::put):
-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::CloneDeserializer::deserializeString):
-        (WebCore::SerializedScriptValue::addBlobURL):
-        (WebCore::SerializedScriptValue::SerializedScriptValue):
-        * bindings/js/SerializedScriptValue.h:
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/c2c2ff9cb69f46f5cc9d289b2bfbdb8ab5bd3e49
</ins><span class="cx"> 
</span><del>-2014-03-07  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+        The de-virtualization possibilities were noted whilst &quot;FINALizing&quot; the Node
+        hierarchy. If a method is successfully marked FINAL but then fails when marked
+        OVERRIDE as well, the method by definition does not need to be virtual.
</ins><span class="cx"> 
</span><del>-        Load source maps and their resources asynchronously.
-
-        https://bugs.webkit.org/show_bug.cgi?id=112071
-
-        Reviewed by Joseph Pecoraro.
-
-        * inspector/InspectorPageAgent.cpp:
-        (WebCore::InspectorPageAgent::buildObjectForFrameTree):
-        Honor the hiddenFromInspector flag.
-
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::willSendRequest):
-        (WebCore::InspectorResourceAgent::markResourceAsCached):
-        (WebCore::InspectorResourceAgent::didReceiveResponse):
-        (WebCore::InspectorResourceAgent::didReceiveData):
-        (WebCore::InspectorResourceAgent::didFinishLoading):
-        (WebCore::InspectorResourceAgent::didFailLoading):
-        (WebCore::InspectorResourceAgent::replayXHR):
-        (WebCore::InspectorResourceAgent::loadResource):
-        * inspector/InspectorResourceAgent.h:
-        Honor the hiddenFromInspector flag by keeping track of
-        hidden identifiers in a HashSet.
-
-        * inspector/protocol/Network.json:
-        (Network.loadResource): Added.
-
-        * platform/network/ResourceRequestBase.h:
-        (WebCore::ResourceRequestBase::hiddenFromInspector): Added.
-        (WebCore::ResourceRequestBase::setHiddenFromInspector): Added.
-        (WebCore::ResourceRequestBase::ResourceRequestBase):
-        Add a flag to hide the request from the Inspector.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::sendForInspector): Added.
-        (WebCore::XMLHttpRequest::sendForInspectorXHRReplay): Renamed.
-        (WebCore::XMLHttpRequest::createRequest):
-        * xml/XMLHttpRequest.h:
-        Make Inspector loads allow cross-origins and hide their request
-        from the Inspector itself.
-
-2014-03-07  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        [WebKit2][iOS] PDF
-        https://bugs.webkit.org/show_bug.cgi?id=129600
-        &lt;rdar://problem/15260216&gt;
-
-        Reviewed by Anders Carlsson.
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedImageMIMETypes):
-        (WebCore::initializePDFMIMETypes):
-        (WebCore::initializePostScriptMIMETypes):
-        (WebCore::initializeMIMETypeRegistry):
-        (WebCore::MIMETypeRegistry::getPDFMIMETypes):
-        * platform/MIMETypeRegistry.h:
-        Split PDF and PostScript MIME types, so WebKit2 can retrieve just the PDF ones
-        without PostScript included.
</del><ins>+        * dom/Element.h:
+        (WebCore::Element::hasAuthorShadowRoot):
</ins><span class="cx"> 
</span><del>-2014-03-07  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+2013-05-06  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Comment in RenderStyle is no longer accurate
-        https://bugs.webkit.org/show_bug.cgi?id=129956
</del><ins>+        Use adoptCF and adoptNS in more places
+        https://bugs.webkit.org/show_bug.cgi?id=115657
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        RenderStyle::createStyleInheritingFromPseudoStyle was moved from RenderImage. Before it
-        was moved, there was an image-specific comment in the function. However, that comment
-        is both irrelevant to RenderStyle, and incorrect as the function is necessary for
-        RenderQuotes as well.
</del><ins>+        This is similar to my last set of changes, but covers code that I missed with
+        global replace using the Safari Xcode workspace.
</ins><span class="cx"> 
</span><del>-        No new tests are necessary because there is no behavior change.
</del><ins>+        * platform/cf/win/CertificateCFWin.cpp:
+        (WebCore::copyCertificateToData):
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundationCF::platformBufferedTimeRanges):
+        (WebCore::MediaPlayerPrivateAVFoundationCF::platformMinTimeSeekable):
+        (WebCore::MediaPlayerPrivateAVFoundationCF::platformMaxTimeSeekable):
+        (WebCore::MediaPlayerPrivateAVFoundationCF::platformMaxTimeLoaded):
+        (WebCore::MediaPlayerPrivateAVFoundationCF::totalBytes):
+        (WebCore::mimeTypeCache):
+        (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged):
+        (WebCore::MediaPlayerPrivateAVFoundationCF::sizeChanged):
+        (WebCore::AVFWrapper::createAssetForURL):
+        (WebCore::AVFWrapper::createPlayer):
+        (WebCore::AVFWrapper::createPlayerItem):
+        (WebCore::AVFWrapper::setAsset):
+        (WebCore::AVFWrapper::platformLayer):
+        (WebCore::AVFWrapper::createAVCFVideoLayer):
+        (WebCore::AVFWrapper::createImageGenerator):
+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.mm:
+        (WebCore::InbandTextTrackPrivateLegacyAVFObjC::language):
+        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+        (toCACFTimingFunction):
+        (PlatformCAAnimation::PlatformCAAnimation):
+        (PlatformCAAnimation::setFromValue):
+        (PlatformCAAnimation::setToValue):
+        (PlatformCAAnimation::setValues):
+        (PlatformCAAnimation::setKeyTimes):
+        (PlatformCAAnimation::setTimingFunctions):
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+        (PlatformCALayer::PlatformCALayer):
+        (PlatformCALayer::setBackgroundColor):
+        (PlatformCALayer::setBorderColor):
+        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
+        (PlatformCALayerWinInternal::PlatformCALayerWinInternal):
+        (PlatformCALayerWinInternal::addTile):
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
+        (WebCore::WKCACFViewLayerTreeHost::WKCACFViewLayerTreeHost):
+        * platform/graphics/gstreamer/PlatformVideoWindowMac.mm:
+        (PlatformVideoWindow::PlatformVideoWindow):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::getPostScriptName):
+        (WebCore::FontPlatformData::platformDataInit):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::create):
+        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
+        (WebCore::MediaPlayerPrivateFullscreenWindow::setRootChildLayer):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::rfc2616DateStringFromTime):
+        (WebCore::QTCFDictionaryCreateWithDataCallback):
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::retrieveCurrentImage):
+        * platform/graphics/win/WKCAImageQueue.cpp:
+        (WebCore::WKCAImageQueue::WKCAImageQueue):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::qcmsOutputDeviceProfile):
+        * platform/network/cf/AuthenticationCF.cpp:
+        (WebCore::core):
+        * platform/network/cf/CookieJarCFNet.cpp:
+        (WebCore::cookieDomain):
+        (WebCore::cookieName):
+        (WebCore::cookiePath):
+        (WebCore::cookieValue):
+        (WebCore::filterCookies):
+        (WebCore::setCookiesFromDOM):
+        (WebCore::cookiesForDOM):
+        (WebCore::cookieRequestHeaderFieldValue):
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        (WebCore::getHostnamesWithCookies):
+        (WebCore::deleteCookiesForHostname):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::urlFromPath):
+        (WebCore::getURL):
+        * platform/win/LocalizedStringsWin.cpp:
+        (WebCore::createWebKitBundle):
+        (WebCore::localizedString):
+        * platform/win/SearchPopupMenuWin.cpp:
+        (WebCore::SearchPopupMenuWin::saveRecentSearches):
+        (WebCore::SearchPopupMenuWin::loadRecentSearches):
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::stringListFromResourceId):
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::platformStart):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::platformFocusRingColor):
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintSliderTrack):
+        Use adoptCF and adoptNS throughout.
</ins><span class="cx"> 
</span><del>-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::createStyleInheritingFromPseudoStyle):
</del><ins>+2013-05-07  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-07  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+        Make CanvasStyle's CMYKAValues allocated on the heap and move the pointer in the union.
+        https://bugs.webkit.org/show_bug.cgi?id=115764
</ins><span class="cx"> 
</span><del>-        [WebRTC] Throw SYNTAX_ERROR when maxRetransmits and maxRetransmitTime are both set in RTCDataChannelInit
-        https://bugs.webkit.org/show_bug.cgi?id=129894
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        CMYKA input is uncommon enough that we should not pay the price for
+        every CanvasStyle.
+        Make those values heap allocated and put the pointer in the union. Since
+        the RGBA32 values are needed for CMYKA, a RGBA32 value is added to the structure.
</ins><span class="cx"> 
</span><del>-        Existing test was updated.
</del><ins>+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::CanvasStyle):
+        (WebCore::CanvasStyle::~CanvasStyle):
+        (WebCore::CanvasStyle::isEquivalentColor):
+        (WebCore::CanvasStyle::isEquivalentCMYKA):
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * html/canvas/CanvasStyle.h:
+        (CanvasStyle):
+        (CMYKAValues):
+        (WebCore::CanvasStyle::CMYKAValues::CMYKAValues):
+        (WebCore::CanvasStyle::color):
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/RTCDataChannel.cpp:
-        (WebCore::RTCDataChannel::create):
</del><ins>+2013-05-07  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-07  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Use OwnPtr instead of deleteAllValues for requests in PluginView
+        https://bugs.webkit.org/show_bug.cgi?id=115731
</ins><span class="cx"> 
</span><del>-        Fix the regression introduced by r165288
-        https://bugs.webkit.org/show_bug.cgi?id=129934
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::~PluginView): Removed the call to deleteAllValues.
+        (WebCore::PluginView::requestTimerFired): Use release to remove an OwnPtr
+        from m_requests rather than an explicit delete. Also use !isEmpty instead
+        of size &gt; 0.
+        (WebCore::PluginView::scheduleRequest): Changed argument type to PassOwnPtr.
+        (WebCore::PluginView::load): Use adoptPtr to call scheduleRequest.
</ins><span class="cx"> 
</span><del>-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::scrollX):
-        (WebCore::DOMWindow::scrollY):
-        We need to return the new value after layout, not the value from the dirty tree.
</del><ins>+        * plugins/PluginView.h: Changed argument type of scheduleRequest to
+        PassOwnPtr, and m_requests to a Vector&lt;OwnPtr&gt;.
</ins><span class="cx"> 
</span><del>-2014-03-07  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+2013-05-07  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Traversal failure in a direct adjacent chain with tail backtracking lacks the path to clear the tail
-        https://bugs.webkit.org/show_bug.cgi?id=129863
</del><ins>+        Remove SelectRuleFeatureSet
+        https://bugs.webkit.org/show_bug.cgi?id=115757
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Direct adjacent backtracking use the stack to push the backtracking entry point and recover from there.
-        In case of traversal failure, their is no point in recovering from the indirect adjancent entry point and
-        we should clear entry point from the stack (which is the purpose of the tail).
</del><ins>+        This is dead code.
</ins><span class="cx"> 
</span><del>-        The adjancent tail was missing the part for clearing the stack in one case.
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        (WebCore):
+        (WebCore::Element::didAffectSelector):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementShadow.h:
+        (WebCore::ElementShadow::invalidateDistribution):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::ContentDistributor):
+        (WebCore):
+        * html/shadow/ContentDistributor.h:
+        (ContentDistributor):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::insertedInto):
+        (WebCore::InsertionPoint::removedFrom):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+        * html/shadow/SelectRuleFeatureSet.cpp: Removed.
+        * html/shadow/SelectRuleFeatureSet.h: Removed.
+        * testing/Internals.cpp:
+        (WebCore):
+        * testing/Internals.idl:
</ins><span class="cx"> 
</span><del>-        The case with adjancent backtracking inside descendant backtracing was doing everything right. This patch
-        generalize this code and the correct tail is fully generated by generateAdjacentBacktrackingTail().
</del><ins>+2013-05-07  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        JumpToClearAdjacentDescendantTail becomes JumpToClearAdjacentTail, and this new backtracking state is added
-        to the missing traversal action.
</del><ins>+        Store the quotes in the same allocation as the QuotesData object
+        https://bugs.webkit.org/show_bug.cgi?id=115768
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/long-adjacent-backtracking.html
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::solveBacktrackingAction):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::linkFailures):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAdjacentBacktrackingTail):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateBacktrackingTailsIfNeeded):
</del><ins>+        Since the QuotesData object is immutable we don't need a Vector to store the quote pairs,
+        they can just be stored after the class data.
</ins><span class="cx"> 
</span><del>-2014-03-07  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * rendering/style/QuotesData.cpp:
+        (WebCore::sizeForQuotesDataWithQuoteCount):
+        Helper function for computing the allocation size.
</ins><span class="cx"> 
</span><del>-        [Mac] Notify system malloc of fake memory pressure.
-        &lt;https://webkit.org/b/129908&gt;
</del><ins>+        (WebCore::QuotesData::create):
+        Use fastMalloc + placement new.
</ins><span class="cx"> 
</span><del>-        After fixing the leak in r165252, I was surprised to find that it didn't
-        show up on memory test bots. It turns out that while the memory is now
-        getting freed, the system malloc implementation doesn't actually release
-        pages back to the OS until there is memory pressure.
</del><ins>+        (WebCore::QuotesData::QuotesData):
+        Use placement new to allocate the quote pairs.
</ins><span class="cx"> 
</span><del>-        Since we are just faking the memory pressure on bots, we have to let
-        system malloc in on the fun, so we can get representative numbers.
-        With this change, we should finally see the effect of not leaking the
-        URLRequest object tree.
</del><ins>+        (WebCore::QuotesData::~QuotesData):
+        Destroy the quote pairs.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        (WebCore::QuotesData::openQuote):
+        Stop using Vector.
</ins><span class="cx"> 
</span><del>-        * platform/mac/MemoryPressureHandlerMac.mm:
-        (WebCore::MemoryPressureHandler::install):
</del><ins>+        (WebCore::QuotesData::closeQuote):
+        Ditto.
</ins><span class="cx"> 
</span><del>-            Tell system malloc that we are under fake memory pressure.
</del><ins>+        (WebCore::operator==):
+        Ditto.
</ins><span class="cx"> 
</span><del>-2014-03-07  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        * rendering/style/QuotesData.h:
</ins><span class="cx"> 
</span><del>-        [iOS] WebKit1 scroll position is incorrect
-        https://bugs.webkit.org/show_bug.cgi?id=129905
</del><ins>+2013-05-07  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        We should not ref() the RefPtr twice in CanvasStyle
</ins><span class="cx"> 
</span><del>-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::scrollX):
-        (WebCore::DOMWindow::scrollY):
-        A new optimization was avoiding layout if the position is zero. This was using the scrollX/Y instead
-        of actualScrollX/Y which caused us to always bail out instead of returning the value to JavaScript.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.h:
-        (WebCore::ScrollView::actualScrollX):
-        (WebCore::ScrollView::actualScrollY):
-        (WebCore::ScrollView::actualScrollPosition):
-        This was accidentally changed to the iOS compat document visible rect at some point.
</del><ins>+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::CanvasStyle):
+        We leak the ref of PassRefPtr, we should not ref() it a second time.
</ins><span class="cx"> 
</span><del>-2014-03-07  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+2013-05-07  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Remove unused StdDeviation from Drop shadow effect
-        https://bugs.webkit.org/show_bug.cgi?id=129891
</del><ins>+        Devirtualize Document class type checking
+        https://bugs.webkit.org/show_bug.cgi?id=115755
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        No new tests, no change on behavior.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/dae5adc768d5ce6bff301df6515745da8ea24950
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/FEDropShadow.h:
</del><ins>+        Document has a bunch of virtual bool is*Document() methods on it, but it also has
+        two bools for XHTML and HTML documents which is silly. We can merge them all
+        together into an enum of values and devirtualize the type checking methods.
</ins><span class="cx"> 
</span><del>-2014-03-07  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::createElement):
+        * dom/Document.h:
+        (WebCore::Document::create):
+        (WebCore::Document::createXHTML):
+        (WebCore::Document::isHTMLDocument):
+        (WebCore::Document::isXHTMLDocument):
+        (WebCore::Document::isImageDocument):
+        (WebCore::Document::isSVGDocument):
+        (WebCore::Document::isPluginDocument):
+        (WebCore::Document::isMediaDocument):
+        (WebCore::Document):
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::HTMLDocument):
+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument):
+        * html/ImageDocument.cpp:
+        (WebCore::ImageDocument::ImageDocument):
+        * html/ImageDocument.h:
+        (WebCore::ImageDocument):
+        * html/MediaDocument.cpp:
+        (WebCore::MediaDocument::MediaDocument):
+        * html/MediaDocument.h:
+        (WebCore::MediaDocument):
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocument::PluginDocument):
+        * html/PluginDocument.h:
+        (WebCore::PluginDocument):
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::PlaceholderDocument):
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::SVGDocument):
+        * svg/SVGDocument.h:
+        (WebCore::SVGDocument):
</ins><span class="cx"> 
</span><del>-        Correct out-of-band track selection logic.
-        https://bugs.webkit.org/show_bug.cgi?id=129900
</del><ins>+2013-05-07  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Begin unraveling the mess that is QuotesData
+        https://bugs.webkit.org/show_bug.cgi?id=115765
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::synchronizeTextTrackState): Correct test to
-        use inequality.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-07  Bear Travis  &lt;betravis@adobe.com&gt;
</del><ins>+        Change QuotesData to be an immutable object and fix other things that are broken.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Correctly serialize ellipse positions
-        https://bugs.webkit.org/show_bug.cgi?id=129700
</del><ins>+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::applyProperty):
+        QuotesData::addPair is gone. Instead, create the Vector up front and pass it to QuotesData.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::originalText):
+        Update for renames.
</ins><span class="cx"> 
</span><del>-        Updating ellipse serialization to be in line with
-        the CSS Shapes spec. Positions should serialize as
-        2 or 4-value positions, converting keywords to
-        percentages where possible. This uses the same method
-        as circle position serialization (bug 129404).
</del><ins>+        * rendering/style/QuotesData.cpp:
+        (WebCore::QuotesData::create):
+        Remove the create overload that wasn't used. Add a new create overload that takes a Vector.
</ins><span class="cx"> 
</span><del>-        Updated existing parsing tests.
</del><ins>+        (WebCore::QuotesData::openQuote):
+        Rename this from getOpenQuote and clean it up.
</ins><span class="cx"> 
</span><del>-        * css/CSSBasicShapes.cpp:
-        (WebCore::CSSBasicShapeEllipse::cssText): Use the
-        normalization / serialization helpers for shape position.
</del><ins>+        (WebCore::QuotesData::closeQuote):
+        Rename this from getCloseQuote and clean it up.
</ins><span class="cx"> 
</span><del>-2014-03-07  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        (WebCore::operator==):
+        Replace the equals member function with a proper equality operator.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rebaseline run-binding-tests results after r165242.
-
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::jsTestObjPrototypeFunctionMethodWithSequenceArg):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude):
-
-2014-03-07  Darin Adler  &lt;darin@apple.com&gt;
-
-        Remove non-working optimization that was attempted on iOS only
-        https://bugs.webkit.org/show_bug.cgi?id=129595
-        &lt;rdar://problem/15798825&gt;
-
-        Reviewed by Sam Weinig.
-
-        Code in GCController tried to optimize cases where the controller
-        was used, but no JavaScript had been run in the current process.
-        The code was never effective, and was iOS-only. Another way to fix
-        the problem would be to change the code so it works, and if we do
-        that we should do it for all platforms, not just iOS.
-
-        * bindings/js/GCController.cpp:
-        (WebCore::GCController::garbageCollectNow): Remove check of
-        JSDOMWindow::commonVMExists, since it's called just after a call
-        to JSDOMWindow::commonVM, which will create it as a side effect.
-        (WebCore::GCController::releaseExecutableMemory): Ditto.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::commonVM): Removed iOS-specific code
-        that pulled the commonVM global out into another function so we
-        can check for its existence without creating it as a side effect.
-
-        * bindings/js/JSDOMWindowBase.h: Ditto.
-
-2014-03-07  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        [CSS Shapes] inset does not properly clamp large corner radii
-        https://bugs.webkit.org/show_bug.cgi?id=129726
-
-        Reviewed by Dirk Schulze.
-
-        Make sure that radii that are larger than 50% of the associated shape
-        dimension (height or width) are properly reduced the same way as
-        border-radius radii are.
-
-        Test: fast/shapes/shape-outside-floats/shape-outside-floats-inset-rounded-large-radius.html
-
-        * rendering/shapes/Shape.cpp:
-        (WebCore::ensureRadiiDoNotOverlap): Drive by style fix.
-        (WebCore::Shape::createShape): Scale radii the same way as border
-            radii are scaled.
-        * platform/graphics/FloatRoundedRect.h:
-        (WebCore::calcBorderRadiiConstraintScaleFor): Move border radii
-            constraint calculation function out so that it can be shared by
-            the shape code.
</del><span class="cx">         * rendering/style/RenderStyle.cpp:
</span><del>-        (WebCore::RenderStyle::getRoundedBorderFor): Call renamed scale function.
</del><ins>+        (WebCore::RenderStyle::diff):
+        Stop calling QuotesData::equals. Use the same idiom as used for other properties.
</ins><span class="cx"> 
</span><del>-2014-03-07  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+        (WebCore::RenderStyle::setQuotes):
+        * rendering/style/StyleRareInheritedData.cpp:
+        Use operator==.
</ins><span class="cx"> 
</span><del>-        [GST] Set name to several timeout sources
-        https://bugs.webkit.org/show_bug.cgi?id=129878
</del><ins>+        (WebCore::quotesDataEquivalent):
+        Add helper function.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        (WebCore::StyleRareInheritedData::operator==):
+        Call quotesDataEquivalent.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::videoChanged):
-        (WebCore::MediaPlayerPrivateGStreamer::videoCapsChanged):
-        (WebCore::MediaPlayerPrivateGStreamer::audioChanged):
-        (WebCore::MediaPlayerPrivateGStreamer::textChanged):
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
-        (WebCore::MediaPlayerPrivateGStreamerBase::volumeChanged):
-        (WebCore::MediaPlayerPrivateGStreamerBase::muteChanged):
</del><ins>+2013-05-06  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-07  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+        Support -webkit-system-font on OS X.
+        https://bugs.webkit.org/show_bug.cgi?id=115758
+        &lt;rdar://problem/13433854&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Timeout sources not correctly removed
-        https://bugs.webkit.org/show_bug.cgi?id=129877
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        Test: platform/mac/fast/text/systemFont.html
</ins><span class="cx"> 
</span><del>-        Set source ID variables to 0 after removing the sources from the
-        context. Also give a name to the sources.
</del><ins>+        * platform/mac/WebFontCache.mm:
+        (+[WebFontCache internalFontWithFamily:traits:weight:size:]):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
-        (WebCore::TrackPrivateBaseGStreamer::disconnect):
-        (WebCore::TrackPrivateBaseGStreamer::activeChanged):
-        (WebCore::TrackPrivateBaseGStreamer::tagsChanged):
-        (WebCore::TrackPrivateBaseGStreamer::notifyTrackOfActiveChanged):
</del><ins>+2013-05-07  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-07  Gergo Balogh  &lt;gbalogh.u-szeged@partner.samsung.com&gt;
</del><ins>+        Move CanvasGradient and CanvasPattern in the union of CanvasStyle
+        https://bugs.webkit.org/show_bug.cgi?id=115759
</ins><span class="cx"> 
</span><del>-        Remove FFTFrameMKL.
-        https://bugs.webkit.org/show_bug.cgi?id=129866
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+        The Gradient and Pattern are exclusive with the other values, but they
+        were left out of the union because they are ref-counted.
</ins><span class="cx"> 
</span><del>-        * platform/audio/FFTFrame.h:
-        * platform/audio/FFTFrameStub.cpp:
-        * platform/audio/mkl/FFTFrameMKL.cpp: Removed, it is never used.
</del><ins>+        This patch moves them in the union, and simply does the ref-counting manually.
</ins><span class="cx"> 
</span><del>-2014-03-07  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::CanvasStyle):
+        (WebCore::CanvasStyle::~CanvasStyle):
+        * html/canvas/CanvasStyle.h:
+        (CanvasStyle):
+        (WebCore::CanvasStyle::canvasGradient):
+        (WebCore::CanvasStyle::canvasPattern):
</ins><span class="cx"> 
</span><del>-        [WebRTC] Adding getConfiguration method to RTCPeerConnection
-        https://bugs.webkit.org/show_bug.cgi?id=129845
</del><ins>+2013-05-07  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Remove custom allocator support from PODArena
+        https://bugs.webkit.org/show_bug.cgi?id=115762
</ins><span class="cx"> 
</span><del>-        Test: fast/mediastream/RTCPeerConnection-getConfiguration.html
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * GNUmakefile.list.am:
-        * Modules/mediastream/RTCConfiguration.idl: Added.
-        * Modules/mediastream/RTCIceServer.idl: Added.
-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::RTCPeerConnection):
-        (WebCore::RTCPeerConnection::updateIce):
-        (WebCore::RTCPeerConnection::getConfiguration):
-        * Modules/mediastream/RTCPeerConnection.h:
-        * Modules/mediastream/RTCPeerConnection.idl:
</del><ins>+        Nobody uses PODArena with a custom allocator, so just get rid of it and always use fastMalloc/fastFree.
</ins><span class="cx"> 
</span><del>-2014-03-07  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        * platform/PODArena.h:
+        (WebCore::PODArena::PODArena):
+        (WebCore::PODArena::allocateBase):
+        (WebCore::PODArena::Chunk::Chunk):
+        (WebCore::PODArena::Chunk::~Chunk):
+        (Chunk):
+        * platform/PODFreeListArena.h:
+        (WebCore::PODFreeListArena::allocate):
+        (WebCore::PODFreeListArena::FreeListChunk::FreeListChunk):
</ins><span class="cx"> 
</span><del>-        Optimize collectionLast() and collectionTraverseBackward() in LiveNodeList
-        https://bugs.webkit.org/show_bug.cgi?id=129775
</del><ins>+2013-05-07  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        Clean up KeyframeValueList and related classes
+        https://bugs.webkit.org/show_bug.cgi?id=115738
</ins><span class="cx"> 
</span><del>-        Check the LiveNodeList type if it is HTMLTagNodeListType and ClassNodeListType then
-        apply inlined matching methods for each type.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        * dom/LiveNodeList.cpp:
-        (WebCore::lastMatchingElement): Added.
-        (WebCore::previousMatchingElement): Added.
-        (WebCore::traverseMatchingElementsBackward): Added.
-        (WebCore::LiveNodeList::collectionLast): Apply lastMatchingElement() with LiveNodeList type.
-        (WebCore::LiveNodeList::collectionTraverseBackward): Apply traverseMatchingElementsBackward()
-        with LiveNodeList type.
</del><ins>+        Add static create() functions to the AnimationValue subclasses, and change a bunch of parameters
+        and return values that can never be null from pointer types to reference types to better indicate this.
</ins><span class="cx"> 
</span><del>-2014-03-06  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::filterOperationsAt):
+        (WebCore::GraphicsLayer::validateFilterOperations):
+        (WebCore::operationsAt):
+        (WebCore::GraphicsLayer::validateTransformOperations):
+        * platform/graphics/GraphicsLayer.h:
+        (AnimationValue):
+        (WebCore::AnimationValue::AnimationValue):
+        (WebCore::FloatAnimationValue::create):
+        (FloatAnimationValue):
+        (WebCore::FloatAnimationValue::FloatAnimationValue):
+        (WebCore::TransformAnimationValue::create):
+        (TransformAnimationValue):
+        (WebCore::TransformAnimationValue::value):
+        (WebCore::TransformAnimationValue::TransformAnimationValue):
+        (WebCore::FilterAnimationValue::create):
+        (WebCore::FilterAnimationValue::value):
+        (WebCore::FilterAnimationValue::FilterAnimationValue):
+        (FilterAnimationValue):
+        (WebCore::KeyframeValueList::~KeyframeValueList):
+        (KeyframeValueList):
+        (WebCore::KeyframeValueList::at):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::animationHasStepsTimingFunction):
+        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
+        (WebCore::GraphicsLayerCA::createFilterAnimationsFromKeyframes):
+        (WebCore::GraphicsLayerCA::timingFunctionForAnimationValue):
+        (WebCore::GraphicsLayerCA::setAnimationEndpoints):
+        (WebCore::GraphicsLayerCA::setAnimationKeyframes):
+        (WebCore::GraphicsLayerCA::setTransformAnimationEndpoints):
+        (WebCore::GraphicsLayerCA::setTransformAnimationKeyframes):
+        (WebCore::GraphicsLayerCA::setFilterAnimationEndpoints):
+        (WebCore::GraphicsLayerCA::setFilterAnimationKeyframes):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
</ins><span class="cx"> 
</span><del>-        WebCoreResourceHandleAsOperationQueueDelegate over-retains NSURLRequest.
-        &lt;https://webkit.org/b/129862&gt;
</del><ins>+2013-05-07  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Don't retain the pointer before assigning it to a RetainPtr, since that
-        will cause the object to leak.
</del><ins>+        Add and remove databases and origins from the database tracker
+        https://bugs.webkit.org/show_bug.cgi?id=115752
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
-
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleAsOperationQueueDelegate continueWillSendRequest:]):
-
-2014-03-06  Dan Bernstein  &lt;mitz@apple.com&gt;
-
-        Don’t copy WebInputs.json into the framework.
-
-        * WebCore.xcodeproj/project.pbxproj: Removed WebInputs.json from the Copy Bundle Resources
-        build phase of the WebCore target.
-
-2014-03-06  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
-
-        [WebRTC] Updating RTCPeerConnection.idl
-        https://bugs.webkit.org/show_bug.cgi?id=129804
-
-        Reviewed by Eric Carlson.
-
-        Some methods signatures were wrong, marking some arguments as optional when they are mandatory.
-
-        Existing tests were updated.
-
-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::getStats):
-        * Modules/mediastream/RTCPeerConnection.h:
-        * Modules/mediastream/RTCPeerConnection.idl:
-        * Modules/mediastream/RTCStatsRequestImpl.cpp:
-        (WebCore::RTCStatsRequestImpl::create):
-        (WebCore::RTCStatsRequestImpl::RTCStatsRequestImpl):
-        (WebCore::RTCStatsRequestImpl::requestFailed):
-        * Modules/mediastream/RTCStatsRequestImpl.h:
-        * platform/mediastream/RTCStatsRequest.h:
-
-2014-03-06  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
-
-        [WebRTC] Updating RTCIceServer to match spec
-        https://bugs.webkit.org/show_bug.cgi?id=129844
-
-        Reviewed by Eric Carlson.
-
-        Move RTCIceServer from RTCConfiguration to its own file.
-
-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::validateIceServerURL):
-        (WebCore::processIceServer):
-        * platform/mediastream/RTCConfiguration.h:
-        (WebCore::RTCConfiguration::iceServers):
-        * platform/mediastream/RTCIceServer.h: Added.
-
-2014-03-06  Hyowon Kim  &lt;hw1008.kim@samsung.com&gt;
-
-        [EFL] Move EvasGL classes from WebKit to WebCore namespace.
-        https://bugs.webkit.org/show_bug.cgi?id=129797
-
-        Reviewed by Gyuyoung Kim.
-
-        Though EvasGLContext and EvasGLSurface files were moved from WebKit2/UIProcess/API/efl/ 
-        to WebCore/platform/graphics/efl/, they are still in WebKit namespace.
-        Patch for namespace changes.
-
-        * platform/graphics/efl/EvasGLContext.cpp:
-        * platform/graphics/efl/EvasGLContext.h:
-        * platform/graphics/efl/EvasGLSurface.cpp:
-        * platform/graphics/efl/EvasGLSurface.h:
-
-2014-03-06  Brian Burg  &lt;bburg@apple.com&gt;
-
-        CodeGeneratorJS.pm doesn't need to add spaces between consecutive closing template brackets
-        https://bugs.webkit.org/show_bug.cgi?id=129836
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateParametersCheck):
-        (GetNativeVectorInnerType):
-        (GetSVGPropertyTypes):
</del><ins>+        Add symbols needed by WebKit2.
</ins><span class="cx"> 
</span><del>-2014-03-06  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Remove unused method from BatteryController
-        https://bugs.webkit.org/show_bug.cgi?id=129850
</del><ins>+2013-05-07  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        Still possible to fire paint-related LayoutMilestones before CA has committed the 
+        changes
+        https://bugs.webkit.org/show_bug.cgi?id=115753
+        -and corresponding-
+        &lt;rdar://problem/13822315&gt;
</ins><span class="cx"> 
</span><del>-        isActive() method is never called anywhere.
-
-        * Modules/battery/BatteryController.cpp:
-        * Modules/battery/BatteryController.h:
-
-2014-03-06  Pratik Solanki  &lt;psolanki@apple.com&gt;
-
-        [iOS] Crash on launch with website restrictions enabled
-        https://bugs.webkit.org/show_bug.cgi?id=129854
-        &lt;rdar://problem/16207016&gt;
-
</del><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        * platform/mac/ContentFilterMac.mm:
-        (WebCore::ContentFilter::ContentFilter): Initialize m_neFilterSourceQueue so that we don't
-        crash in the dtor due to garbage value in the field.
</del><ins>+        To ensure we wait for the CA commit, we should wait until the end of the runloop 
+        with a zero-delay timer.
</ins><span class="cx"> 
</span><del>-2014-03-06  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
+        (WebCore::RenderLayerCompositor::paintRelatedMilestonesTimerFired):
+        (WebCore):
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
</ins><span class="cx"> 
</span><del>-        Minor optimization in ScrollingTreeScrollingNodeMac
-        https://bugs.webkit.org/show_bug.cgi?id=129848
</del><ins>+2013-05-07  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Bug 115694 - Fix bad cast to RenderHTMLCanvas
+        https://bugs.webkit.org/show_bug.cgi?id=115694
</ins><span class="cx"> 
</span><del>-        No need to call scrollOffsetForFixedPosition() again if we don't have header
-        and footer layers.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
</del><ins>+        Don't cast to RenderHTML until we check what kind of object it is.
</ins><span class="cx"> 
</span><del>-2014-03-06  Mark Lam  &lt;mark.lam@apple.com&gt;
</del><ins>+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
</ins><span class="cx"> 
</span><del>-        XMLHttpRequest: status and statusText throw DOM Exception 11 when the state is UNSENT or OPENED.
-        https://bugs.webkit.org/show_bug.cgi?id=45994
</del><ins>+2013-05-07  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Not reviewed.
</del><ins>+        The storage database tracker should know when databases come and go
+        https://bugs.webkit.org/show_bug.cgi?id=115748
</ins><span class="cx"> 
</span><del>-        Re-landing r161051 (originally by Ryosuke Niwa, reviewed by Alexey Proskuryakov)
-        since https://bugs.webkit.org/show_bug.cgi?id=126219 is no longer an issue.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::status):
-        (WebCore::XMLHttpRequest::statusText):
-        * xml/XMLHttpRequest.h:
-        * xml/XMLHttpRequest.idl:
</del><ins>+        Export symbol needed by WebKit2.
</ins><span class="cx"> 
</span><del>-2014-03-06  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Revise Out-of-band VTT support for better integration with AVFoundation engine
-        https://bugs.webkit.org/show_bug.cgi?id=129749
-        &lt;rdar://problem/16215701&gt;
</del><ins>+2013-05-07  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Use OwnPtr instead of deleteAllValues in SVGResourcesCache
+        https://bugs.webkit.org/show_bug.cgi?id=115729
</ins><span class="cx"> 
</span><del>-        Revise the platform handling of out-of-band text tracks so that we can keep AVFoundation
-        informed of track selections we make. Use a dummy out-of-band child of the existing text
-        track classes to avoid code duplication.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj: Add new OutOfBandTextTrackPrivateAVF.h file.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute): Notify player when OOB tracks change.
-        (WebCore::HTMLMediaElement::outOfBandTrackSources): Also pass track mode to platform backend.
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::platformTextTrack): Also pass track mode to constructor.
-        * html/track/TrackBase.cpp:
-        (WebCore::TrackBase::TrackBase): Move ownership of track unique identifier to this base class.
-        * html/track/TrackBase.h:
-        (WebCore::TrackBase::uniqueId): Ditto.
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::notifyTrackModeChanged): Added stub to pass message to platform player.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::notifyTrackModeChanged): Stub for most platforms.
-        * platform/graphics/PlatformTextTrack.h:
-        (WebCore::PlatformTextTrack::create): Update for revised constructor (with 'mode' argument).
-        (WebCore::PlatformTextTrack::createOutOfBand): Ditto.
-        (WebCore::PlatformTextTrack::mode): Added.
-        (WebCore::PlatformTextTrack::captionMenuOffItem): Use revised constructor arguments.
-        (WebCore::PlatformTextTrack::captionMenuAutomaticItem): Ditto.
-        (WebCore::PlatformTextTrack::PlatformTextTrack): Ditto.
-        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h: Change predicate to return enum indicating the category
-        of track (out-of-band, legacy closed caption, or in band).
-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
-        (WebCore::MediaPlayerPrivateAVFoundation::notifyTrackModeChanged): Added.
-        * platform/graphics/avfoundation/cf/InbandTextTrackPrivateAVCF.h: Override predicate to return category enum.
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: Revise to use new category enum.
-        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.h: Override predicate to return category enum.
-        that this is NOT an out-of-band track.
-        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.h: Ditto.
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::notifyTrackModeChanged): Added implementation.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::processMediaSelectionOptions): Revise to handle out-of-band
-        track placeholders.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setCurrentTrack): Modify to inform AVFoundation about any
-        out-of-band tracks we've selected.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::synchronizeTextTrackState): Added.
-        * platform/graphics/avfoundation/objc/OutOfBandTextTrackPrivateAVF.h: Added.
-        (WebCore::OutOfBandTextTrackPrivateAVF::create):
-        (WebCore::OutOfBandTextTrackPrivateAVF::processCue):
-        (WebCore::OutOfBandTextTrackPrivateAVF::resetCueValues):
-        (WebCore::OutOfBandTextTrackPrivateAVF::mediaSelectionOption):
-        (WebCore::OutOfBandTextTrackPrivateAVF::OutOfBandTextTrackPrivateAVF):
-        (WebCore::OutOfBandTextTrackPrivateAVF::processCueAttributes):
-        * platform/graphics/ios/InbandTextTrackPrivateAVFIOS.h: Override predicate to indicate
-        that this is NOT an out-of-band track.
-        * platform/graphics/ios/MediaPlayerPrivateIOS.mm:
-        (WebCore::MediaPlayerPrivateIOS::setSelectedTextTrack): Correct typo in logging text.
</del><ins>+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::~SVGResourcesCache): Removed call to deleteAllValues.
+        (WebCore::SVGResourcesCache::addResourcesFromRenderObject): Use adoptPtr and release
+        to create new SVGResources object.
+        (WebCore::SVGResourcesCache::removeResourcesFromRenderObject): Use take to remove
+        the SVGResources from the map rather than a get combined with delete/take.
+        (WebCore::SVGResourcesCache::cachedResourcesForRenderObject): Removed unneeded
+        call to contains, since get already returns 0 if there is no item in the map.
+        (WebCore::SVGResourcesCache::resourceDestroyed): Use typedef for the map type so
+        we don't have to repeat the type.
</ins><span class="cx"> 
</span><del>-2014-03-06  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+        * rendering/svg/SVGResourcesCache.h: Added typedef CacheMap, and changed value
+        type to OwnPtr.
</ins><span class="cx"> 
</span><del>-        [WebRTC] Updating createOffer and createAnswer methods to match WebRTC editor's draft of 01/27/2014
-        https://bugs.webkit.org/show_bug.cgi?id=129484
</del><ins>+2013-05-07  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        REGRESSION(r149647): Assertion failure in LocalStorageDatabaseTracker::setLocalStorageDirectoryInternal
+        https://bugs.webkit.org/show_bug.cgi?id=115711
</ins><span class="cx"> 
</span><del>-        According to the spec, createOffer and createAnswer will no longer have MediaConstraints as an argument,
-        instead they will have RTCOfferOptions and RTCOfferAnswerOptions, respectively.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Existing tests were updated.
</del><ins>+        Export SQLiteDatabase::close.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * Modules/mediastream/RTCOfferAnswerOptions.cpp: Added.
-        * Modules/mediastream/RTCOfferAnswerOptions.h: Added.
-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::createOffer):
-        (WebCore::RTCPeerConnection::createAnswer):
-        * Modules/mediastream/RTCPeerConnection.h:
-        * Modules/mediastream/RTCPeerConnection.idl:
-        * platform/mediastream/RTCPeerConnectionHandler.h:
-        * platform/mock/RTCPeerConnectionHandlerMock.cpp:
-        (WebCore::RTCPeerConnectionHandlerMock::createOffer):
-        (WebCore::RTCPeerConnectionHandlerMock::createAnswer):
-        * platform/mock/RTCPeerConnectionHandlerMock.h:
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-2014-03-06  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+2013-05-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Web Replay: premature release() of PassRefPtr in InspectorReplayAgent
-        https://bugs.webkit.org/show_bug.cgi?id=129827
</del><ins>+        Add an 'isReadOnly' member to IDL parse tree structure
+        https://bugs.webkit.org/show_bug.cgi?id=115704
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorReplayAgent.cpp:
-        (WebCore::InspectorReplayAgent::didCreateFrontendAndBackend):
</del><ins>+        Add an 'isReadOnly' member to IDL parse tree structure by merging
+        https://chromium.googlesource.com/chromium/blink/+/d6add80ecd08bcd88a6ae0e1698d929830b3bd8b
+        and update Objective-C, C++, and GObject binding generators to use isReadOnly.
</ins><span class="cx"> 
</span><del>-2014-03-06  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GetWriteableProperties):
+        (GenerateProperty):
+        (GenerateFunctions):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (IsReadonly):
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/IDLParser.pm:
+        (parseAttributeRest):
+        (parseExceptionField):
+        (parseAttributeRestOld):
</ins><span class="cx"> 
</span><del>-        [iOS] Do not compile fake mouse event handling when iOS Touch Events are enabled
-        https://bugs.webkit.org/show_bug.cgi?id=129725
</del><ins>+2013-05-07  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        Use OwnPtr instead of deleteAllValues in SMILTimeContainer
+        https://bugs.webkit.org/show_bug.cgi?id=115730
</ins><span class="cx"> 
</span><del>-        Bug &lt;rdar://problem/16218636&gt;. The code is #ifdef'ed out to avoid setting up useless objects
-        and to avoid future mistake.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::EventHandler):
-        (WebCore::EventHandler::~EventHandler):
-        (WebCore::EventHandler::clear):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::startAutoHideCursorTimer):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon):
-        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoonInQuad):
-        * page/EventHandler.h:
-
-2014-03-06  Pratik Solanki  &lt;psolanki@apple.com&gt;
-
-        Unreviewed. iOS build fix after r165199.
-
-        * rendering/RootInlineBox.cpp:
-
-2014-03-06  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
-
-        [iOS] Rename the actualVisibleXXXRect to unobscuredContentRect for consistency
-        https://bugs.webkit.org/show_bug.cgi?id=129773
-
-        Reviewed by Simon Fraser.
-
-        * dom/TreeScope.cpp:
-        (WebCore::nodeFromPoint):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::visibleContentRectInternal):
-        * platform/ScrollView.h:
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::unoscuredContentRect):
-        * platform/ios/wak/WAKScrollView.h:
-        * platform/ios/wak/WAKScrollView.mm:
-        (-[WAKScrollView unoscuredContentRect]):
-        (-[WAKScrollView description]):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollRectToVisible):
-
-2014-03-05  Oliver Hunt  &lt;oliver@apple.com&gt;
-
-        Support caching of custom setters
-        https://bugs.webkit.org/show_bug.cgi?id=129519
-
-        Reviewed by Filip Pizlo.
-
-        Add forwarding header
-
-        Tests: js/regress/assign-custom-setter-polymorphic.html
-               js/regress/assign-custom-setter.html
-
-        * ForwardingHeaders/jit/SpillRegistersMode.h: Added.
-
-2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
-
-        Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
-
-        &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
-        &lt;rdar://problem/15073043&gt;
-
-        Clang appears to be optimizing out a branch in RenderObject::node()
-        when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
-        We'll work around this by factoring out the code in question into a
-        separate member function marked NEVER_INLINE.
-
-        No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
-
-        Reviewed by David Kilzer.
-
-        * rendering/RenderLayerFilterInfo.cpp:
-        (WebCore::RenderLayer::FilterInfo::layerElement):
-        Code moved from updateReferenceFilterClients(). Returns the Element*
-        for m_layer.
-        (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
-        Use layerElement().
-
-        * rendering/RenderLayerFilterInfo.h:
-        Declared layerElement().
-
-2014-03-06  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
-
-        Web Inspector: Expose the console object in JSContexts to interact with Web Inspector
-        https://bugs.webkit.org/show_bug.cgi?id=127944
-
</del><span class="cx">         Reviewed by Geoffrey Garen.
</span><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::~SMILTimeContainer): Removed call to deleteAllValues.
+        (WebCore::SMILTimeContainer::schedule): Use add instead of get/set to put a new
+        AnimationsVector into the map as needed.
+        (WebCore::SMILTimeContainer::setElapsed): Added get since values are OwnPtr now.
+        (WebCore::SMILTimeContainer::updateAnimations): Ditto.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * ForwardingHeaders/runtime/ConsoleClient.h: Added.
-        * ForwardingHeaders/runtime/ConsoleTypes.h: Renamed from Source/WebCore/ForwardingHeaders/inspector/ConsoleTypes.h.
-        * GNUmakefile.list.am:
-        * PlatformGTK.cmake:
-        * WebCore.exp.in:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/gobject/GNUmakefile.am:
-        Update build systems.
</del><ins>+        * svg/animation/SMILTimeContainer.h: Changed value type of GroupedAnimationsMap
+        to OwnPtr instead of raw pointer.
</ins><span class="cx"> 
</span><del>-        * page/Console.cpp: Removed.
-        * page/Console.h: Removed.
-        * page/Console.idl: Removed.
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::~DOMWindow):
-        (WebCore::DOMWindow::resetDOMWindowProperties):
-        * page/DOMWindow.h:
-        (WebCore::DOMWindow::defaultStatus):
-        * page/DOMWindow.idl:
-        Removed the old IDL generated Console object on window.
</del><ins>+2013-05-07  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/PageConsole.cpp:
-        (WebCore::PageConsole::shouldPrintExceptions):
-        (WebCore::PageConsole::setShouldPrintExceptions):
-        (WebCore::PageConsole::mute):
-        (WebCore::PageConsole::unmute):
-        (WebCore::PageConsole::messageWithTypeAndLevel):
-        (WebCore::PageConsole::count):
-        (WebCore::PageConsole::profile):
-        (WebCore::PageConsole::profileEnd):
-        (WebCore::PageConsole::time):
-        (WebCore::PageConsole::timeEnd):
-        (WebCore::PageConsole::timeStamp):
-        (WebCore::PageConsole::group):
-        (WebCore::PageConsole::groupCollapsed):
-        (WebCore::PageConsole::groupEnd):
-        (WebCore::PageConsole::clearProfiles):
-        * page/PageConsole.h:
-        Move the handling of Console object into PageConsole.
</del><ins>+        Remove AlwaysInline.h from WTF
+        https://bugs.webkit.org/show_bug.cgi?id=115727
</ins><span class="cx"> 
</span><del>-        * bindings/js/ScriptCachedFrameData.cpp:
-        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
-        (WebCore::ScriptCachedFrameData::restore):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::clearWindowShell):
-        (WebCore::ScriptController::initScript):
-        Set the PageConsole as the ConsoleClient of the JSGlobalObject
-        so that WebCore may handle console messages directly. For instance
-        it may pass messages on to the ChromeClient.
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp:
-        (WebCore::Internals::consoleProfiles):
-        To access profiles, go through PageConsole now instead of Console.
</del><ins>+        The macro that used to be in AlwaysInline.h is now in Compiler.h so there's no reason
+        to keep AlwaysInline.h around anymore.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/objc/WebScriptObject.mm:
-        * css/MediaList.cpp:
-        * dom/ScriptExecutionContext.h:
-        * dom/UIEvent.cpp:
-        * dom/ViewportArguments.cpp:
-        * html/parser/XSSAuditorDelegate.cpp:
-        * inspector/CommandLineAPIHost.h:
-        * inspector/InspectorInstrumentation.cpp:
-        * inspector/InspectorInstrumentation.h:
-        * inspector/InspectorProfilerAgent.cpp:
-        * inspector/WebConsoleAgent.cpp:
-        * loader/FrameLoader.cpp:
-        * loader/MixedContentChecker.cpp:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        * loader/cache/CachedResourceLoader.cpp:
-        * page/ChromeClient.h:
-        * page/ContentSecurityPolicy.cpp:
-        * page/Page.cpp:
-        * page/Page.h:
-        * svg/SVGDocumentExtensions.cpp:
-        * workers/WorkerMessagingProxy.cpp:
-        * workers/WorkerReportingProxy.h:
-        Update includes.
</del><ins>+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSDOMWindowCustom.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        * platform/graphics/filters/FEConvolveMatrix.h:
+        * rendering/InlineIterator.h:
+        * rendering/InlineTextBox.cpp:
+        * rendering/RenderBlockLineLayout.cpp:
+        * rendering/RenderText.cpp:
</ins><span class="cx"> 
</span><del>-2014-03-06  Zsolt Borbely  &lt;borbezs@inf.u-szeged.hu&gt;
</del><ins>+2013-05-07  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix the !ENABLE(CSS_STICKY_POSITION) build
-        https://bugs.webkit.org/show_bug.cgi?id=129793
</del><ins>+        [Curl] POST requests sometimes fail.
+        https://bugs.webkit.org/show_bug.cgi?id=111844
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Add missing ENABLE(CSS_STICKY_POSITION) guard to EditingStyle::convertPositionStyle().
</del><ins>+        Curl adds the header 'Expect: 100-Continue' when sending a POST request.
+        When we receive the header 'HTTP/1.1 100 Continue', we should not call
+        ResourceHandleClient::didReceiveResponse(), as this will cancel the request,
+        because the MIME type is empty in this case, causing the POST request to fail.
+        This header is only sent as an info header, or provisional response.
+        
+        In addition, this patch changes the classification of http code 304 (Not modified).
+        It is not reported as a redirect anymore, but as a response
+        (ResourceHandleClient::didReceiveResponse() is called.
</ins><span class="cx"> 
</span><del>-        * editing/EditingStyle.cpp:
-        (WebCore::EditingStyle::convertPositionStyle):
</del><ins>+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::isHttpInfo): Added helper method to determine if http code is http info.
+        (WebCore::isHttpRedirect): Added helper method to determine if http code is http redirect.
+        (WebCore::headerCallback): Just return when receiving the header'HTTP/1.1 100 Continue'.
</ins><span class="cx"> 
</span><del>-2014-03-06  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+2013-05-07  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] Leak: dispatch_semaphore leak allocated in MediaPlayerPrivateAVFoundationObjC::waitForVideoOutputMediaDataWillChange
-        https://bugs.webkit.org/show_bug.cgi?id=129792
</del><ins>+        [X11][BlackBerry] Check if MOZ_X11 is defined instead of XP_UNIX npruntime_internal.h
+        https://bugs.webkit.org/show_bug.cgi?id=113687
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Anders Carlsson.
</span><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC):
</del><ins>+        It's assumed that all UNIX platforms use X11 for plugins, which is
+        not the case of BlackBerry.
</ins><span class="cx"> 
</span><del>-2014-03-06  Brendan Long  &lt;b.long@cablelabs.com&gt;
</del><ins>+        * bridge/npruntime_internal.h: Use MOZ_X11 instead of XP_UNIX.
</ins><span class="cx"> 
</span><del>-        Implement VideoTrackList.selectedIndex
-        https://bugs.webkit.org/show_bug.cgi?id=129770
</del><ins>+2013-05-07  Mikhail Pozdnyakov  &lt;mikhail.pozdnyakov@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        HashTraits&lt;RefPtr&lt;P&gt; &gt;::PeekType should be raw pointer for better performance
+        https://bugs.webkit.org/show_bug.cgi?id=115646
</ins><span class="cx"> 
</span><del>-        Tests: media/track/video/video-track-mkv-theora-selected.html
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * html/track/VideoTrackList.idl:
</del><ins>+        No new tests, no new functionality.
</ins><span class="cx"> 
</span><del>-2014-03-06  Lorenzo Tilve  &lt;ltilve@igalia.com&gt;
</del><ins>+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::get):
+        (WebCore::AXObjectCache::remove):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::objectFromAXID):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::getImage):
+        * css/InspectorCSSOMWrappers.cpp:
+        (WebCore::InspectorCSSOMWrappers::getWrapperForRuleInSheets):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::loadPendingSVGDocuments):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::rootEditableElementForSelectionOnMouseDown):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::elementForAlias):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::findInsertionPointFor):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        * loader/archive/ArchiveResourceCollection.cpp:
+        (WebCore::ArchiveResourceCollection::archiveResourceForURL):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::transientLocalStorage):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateMaskLayer):
+        * platform/network/BlobRegistryImpl.cpp:
+        (WebCore::BlobRegistryImpl::getBlobDataFromURL):
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::pluginForMIMEType):
+        (WebCore::PluginDatabase::MIMETypeForExtension):
+        * rendering/RenderCounter.cpp:
+        (WebCore::makeCounterNode):
+        (showCounterRendererTree):
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::getEffectById):
+            Updated accordingly to new HashMap&lt;.., RefPtr&gt;::get() semantics.
</ins><span class="cx"> 
</span><del>-        [GTK][CMake] Fix the GTK+ CMake build
-        https://bugs.webkit.org/show_bug.cgi?id=129801
</del><ins>+2013-05-06  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        Use OwnPtr instead of deleteAllValues in KeyframeValueList
+        https://bugs.webkit.org/show_bug.cgi?id=115652
</ins><span class="cx"> 
</span><del>-        Include missing files for CMake build
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt: Add a missing references to DOMURLMediaStream
</del><ins>+        Also made a few related style fixes in the functions touched.
</ins><span class="cx"> 
</span><del>-2014-03-06  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::KeyframeValueList::insert): Change argument type to PassOwnPtr
+        and update use of m_values since it has OwnPtr now instead of raw pointer.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Setting content to opaque on m_graphicsLayer depends on subpixel accumulation.
-        https://bugs.webkit.org/show_bug.cgi?id=129776
</del><ins>+        * platform/graphics/GraphicsLayer.h: Move conditional includes to a
+        separate paragraph, removed an unneeded forward class declaration.
+        (WebCore::AnimationValue::AnimationValue): Marked this constructor explicit
+        and removed an unneeded if statement.
+        (WebCore::AnimationValue::clone): Changed to use adoptPtr and PassOwnPtr.
+        (WebCore::FloatAnimationValue::clone): Changed this to return a PassOwnPtr.
+        (WebCore::TransformAnimationValue::TransformAnimationValue): Marked explicit.
+        (WebCore::TransformAnimationValue::clone): Changed to use adoptPtr and PassOwnPtr.
+        (WebCore::FilterAnimationValue::FilterAnimationValue): Marked explicit.
+        (WebCore::FilterAnimationValue::clone): Changed to use adoptPtr and PassOwnPtr.
+        (WebCore::KeyframeValueList::KeyframeValueList): Marked explicit.
+        (WebCore::KeyframeValueList::~KeyframeValueList): Removed, since the default
+        destructor works without an explicit deleteAllValues call.
+        (WebCore::KeyframeValueList::at): Added call to get needed since the vector
+        contains OwnPtr now.
+        (WebCore::KeyframeValueList::insert): Changed to take PassOwnPtr and then
+        removed now-redundant comment saying &quot;takes ownership of the pointer&quot;.
+        (WebCore::KeyframeValueList::m_values): Changed type to Vector&lt;OwnPtr&gt;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
-
-        isEmpty() returns true when any of the dimensions is &lt;= 0. Subpixel accumulation could happen
-        in one direction only. Use isZero() instead().
-
</del><span class="cx">         * rendering/RenderLayerBacking.cpp:
</span><del>-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
</del><ins>+        (WebCore::RenderLayerBacking::startAnimation): Added adoptPtr next to the
+        all the places new was done before calling KeyframeValueList::insert. Also
+        simplified the booleans and #if in this function.
+        (WebCore::RenderLayerBacking::startTransition): Ditto.
</ins><span class="cx"> 
</span><del>-2014-03-06  Gurpreet Kaur  &lt;k.gurpreet@samsung.com&gt;
</del><ins>+2013-05-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r158254): Rubber-banding at Bing image search causes the toolbar to move up and away
-        https://bugs.webkit.org/show_bug.cgi?id=128873
</del><ins>+        [Replaceable] attributes must be readonly
+        https://bugs.webkit.org/show_bug.cgi?id=115692
</ins><span class="cx"> 
</span><del>-        Reviewed by Antonio Gomes.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        This regression is caused by  http://trac.webkit.org/changeset/154614 
-        and http://trac.webkit.org/changeset/156605. So reverting the changes
-        to make it Web compatible as earlier.
</del><ins>+        Merge https://chromium.googlesource.com/chromium/blink/+/ac61fbfe875d3c3c37d529683139ceb0ad4330bb.
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::scrollLeft):
-        (WebCore::Element::scrollTop):
-        (WebCore::Element::setScrollLeft):
-        (WebCore::Element::setScrollTop):
-        Reverting changes as it caused regression.
</del><ins>+        Web IDL specification says [Replaceable] attributes are readonly:
+        http://www.w3.org/TR/2012/CR-WebIDL-20120419/#Replaceable
</ins><span class="cx"> 
</span><del>-2014-03-06  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        Update the two instances of [Replaceable] in WebCore that didn't have readonly modifier to match
+        the specifcation and the rest of WebCore. There should be no behavioral changes as the code generator
+        already assumed [Replaceable] attributes are readonly.
</ins><span class="cx"> 
</span><del>-        Move Source/WebCore/html/canvas/ code to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=129668
</del><ins>+        * html/HTMLDocument.idl:
+        * page/DOMWindow.idl:
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+2013-05-06  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr in code under Source/WebCore/html/canvas/ to std::unique_ptr.
</del><ins>+        Use OwnPtr instead of deleteAllValues in DocumentMarkerController
+        https://bugs.webkit.org/show_bug.cgi?id=115655
</ins><span class="cx"> 
</span><del>-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::~HTMLCanvasElement):
-        (WebCore::HTMLCanvasElement::getContext):
-        * html/HTMLCanvasElement.h:
-        * html/canvas/ANGLEInstancedArrays.cpp:
-        * html/canvas/ANGLEInstancedArrays.h:
-        * html/canvas/CanvasRenderingContext2D.h:
-        * html/canvas/EXTTextureFilterAnisotropic.cpp:
-        * html/canvas/EXTTextureFilterAnisotropic.h:
-        * html/canvas/OESElementIndexUint.cpp:
-        * html/canvas/OESElementIndexUint.h:
-        * html/canvas/OESStandardDerivatives.cpp:
-        * html/canvas/OESStandardDerivatives.h:
-        * html/canvas/OESTextureFloat.cpp:
-        * html/canvas/OESTextureFloat.h:
-        * html/canvas/OESTextureFloatLinear.cpp:
-        * html/canvas/OESTextureFloatLinear.h:
-        * html/canvas/OESTextureHalfFloat.cpp:
-        * html/canvas/OESTextureHalfFloat.h:
-        * html/canvas/OESTextureHalfFloatLinear.cpp:
-        * html/canvas/OESTextureHalfFloatLinear.h:
-        * html/canvas/OESVertexArrayObject.cpp:
-        * html/canvas/OESVertexArrayObject.h:
-        * html/canvas/WebGLCompressedTextureATC.cpp:
-        * html/canvas/WebGLCompressedTextureATC.h:
-        * html/canvas/WebGLCompressedTexturePVRTC.cpp:
-        * html/canvas/WebGLCompressedTexturePVRTC.h:
-        * html/canvas/WebGLCompressedTextureS3TC.cpp:
-        * html/canvas/WebGLCompressedTextureS3TC.h:
-        * html/canvas/WebGLDebugRendererInfo.cpp:
-        * html/canvas/WebGLDebugRendererInfo.h:
-        * html/canvas/WebGLDebugShaders.cpp:
-        * html/canvas/WebGLDebugShaders.h:
-        * html/canvas/WebGLDepthTexture.cpp:
-        * html/canvas/WebGLDepthTexture.h:
-        * html/canvas/WebGLDrawBuffers.cpp:
-        * html/canvas/WebGLDrawBuffers.h:
-        * html/canvas/WebGLLoseContext.cpp:
-        * html/canvas/WebGLLoseContext.h:
-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::create):
-        (WebCore::WebGLRenderingContext::getExtension):
-        * html/canvas/WebGLRenderingContext.h:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-06  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        * dom/DocumentMarkerController.cpp:
+        (WebCore::DocumentMarkerController::~DocumentMarkerController): Added here
+        so the destructor isn't implicitly inline.
+        (WebCore::DocumentMarkerController::detach): Removed now-unneeded code to
+        call deleteAllValues. Also moved code to set m_possiblyExistingMarkerTypes
+        to after clearing m_markers to be consistent with how other functions do it.
+        (WebCore::DocumentMarkerController::addMarker): Changed code to use the
+        add idiom to avoid double hash table lookup. Changed to use adoptPtr since
+        the map now contains OwnPtr.
+        (WebCore::DocumentMarkerController::removeMarkers): Removed explicit calls
+        to delete list since removing the entry from the map now deletes the list.
+        Moved the code to check if m_markers has become empty so it's only called
+        when we actually remove something from m_markers.
+        (WebCore::DocumentMarkerController::markerContainingPoint): Added get().
+        (WebCore::DocumentMarkerController::renderedRectsForMarkers): Added get().
+        (WebCore::DocumentMarkerController::removeMarkers): Changed to use a new
+        interface to removeMarkersFromList. This eliminated the need to copy the
+        entire map when removing markers; instead we can just copy the keys.
+        (WebCore::DocumentMarkerController::removeMarkersFromList): Changed to use
+        an iterator instead of being passed the key/value pair from the map. Also
+        rearranged the logic so there is less repeated code and removed some now-
+        unneeded comments.
+        (WebCore::DocumentMarkerController::repaintMarkers): Added get().
+        (WebCore::DocumentMarkerController::invalidateRenderedRectsForMarkersInRect):
+        Added get().
+        (WebCore::DocumentMarkerController::showMarkers): Added get().
</ins><span class="cx"> 
</span><del>-        Move Source/WebCore/editing/ code to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=129665
</del><ins>+        * dom/DocumentMarkerController.h: Removed implementation of the destructor
+        that called the detach function; that was just sharing the now-unneeded
+        call to deleteAllValues. Changed the type of the map to use an OwnPtr for
+        the value. Changed the interface of removeMarkersFromList to take a map
+        iterator instead of a key/value pair.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+2013-05-06  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr in code under Source/WebCore/editing/ with std::unique_ptr.
</del><ins>+        Reproducible crash in RenderBoxModelObject::adjustedPositionRelativeToOffsetParent()
+        https://bugs.webkit.org/show_bug.cgi?id=115685
+        -and corresponding-
+        &lt;rdar://problem/13700734&gt;
</ins><span class="cx"> 
</span><del>-        * editing/EditingStyle.cpp:
-        (WebCore::htmlElementEquivalents):
-        (WebCore::EditingStyle::conflictsWithImplicitStyleOfElement):
-        (WebCore::htmlAttributeEquivalents):
-        (WebCore::EditingStyle::conflictsWithImplicitStyleOfAttributes):
-        (WebCore::EditingStyle::extractConflictingImplicitStyleOfAttributes):
-        (WebCore::EditingStyle::elementIsStyledSpanOrHTMLEquivalent):
-        (WebCore::EditingStyle::mergeInlineAndImplicitStyleOfElement):
-        * editing/Editor.cpp:
-        (WebCore::Editor::Editor):
-        (WebCore::Editor::clear):
-        * editing/Editor.h:
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        * page/Frame.h:
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-2014-03-06  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        This fix here is just to rollout the change that caused this regression, which is 
+        http://trac.webkit.org/changeset/147395 . That change was not intended to cause any 
+        behavioral differences. The change made it so RenderObject::offsetParent() returned 
+        an Element* instead of a RenderBoxModelObject*. However, can muddle things when the 
+        object we are returning is a continuation. Multiple RenderObjects have the same 
+        Element in a continuation, so this new code can lead to a crash in 
+        adjustedPositionRelativeToOffsetParent() when we expect to walk the RenderObject 
+        chain and find the offsetParent in the Element’s parent chain. But we might crash in 
+        some complicated continuation scenarios because we lost this disambiguation of which 
+        RenderObject to start with.
</ins><span class="cx"> 
</span><del>-        Move to using std::unique_ptr for KeyboardEvent, ScriptExecutionContext::PendingException
-        https://bugs.webkit.org/show_bug.cgi?id=129061
</del><ins>+        Roll out.
+        * dom/Element.cpp:
+        (WebCore::Element::offsetParent):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (RenderObject):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-05-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr for KeyboardEvent and ScriptExecutionContext::PendingException
-        classes with std::unique_ptr. ScriptExecutionContext::Task objects are still handled through OwnPtr,
-        but this will be addressed later.
</del><ins>+        Unify ways to cache named item in HTMLCollections
+        https://bugs.webkit.org/show_bug.cgi?id=115584
</ins><span class="cx"> 
</span><del>-        * dom/KeyboardEvent.cpp:
-        (WebCore::KeyboardEvent::KeyboardEvent):
-        * dom/KeyboardEvent.h:
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::reportException):
-        * dom/ScriptExecutionContext.h:
-        * dom/ScriptRunner.h: Remove an unnecessary PassOwnPtr header inclusion.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-03-06  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Refactor the code to share the same infrastructure for both id and name attributes maps.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165175.
-        http://trac.webkit.org/changeset/165175
-        https://bugs.webkit.org/show_bug.cgi?id=129788
</del><ins>+        Also get rid of shouldRegisterAsNamedItem and shouldRegisterAsExtraNamedItem from various Element subclasses
+        as these member functions were duplicating the information in HTMLNameCollection.cpp. Nevertheless, HTMLImageElement
+        and HTMLObjectElement still update HTMLDocument's window and document name getter maps when their presence as named
+        item changes due to an attribute change and children changes respectively.
</ins><span class="cx"> 
</span><del>-        Linking failures on GTK, EFL due to missing gstreamer-tag-1.0
-        dependency (Requested by zdobersek on #webkit).
</del><ins>+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::namedItemGetter): Use windowNamedItemMap().containsSingle() instead of collection-&gt;hasExactlyOneItem() to
+        avoid instantiating HTMLCollection until we know for sure we're returning multiple items.
+        (WebCore::JSDOMWindow::getOwnPropertySlot): Call windowNamedItemMap().contains() instead of document-&gt;hasNamedItem()
+        since the latter has been removed.
+        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex): Ditto.
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor): Ditto.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
-        (WebCore::TrackPrivateBaseGStreamer::notifyTrackOfTagsChanged):
</del><ins>+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::canGetItemsForName): Call documentNamedItemMap().contains() instead of
+        document-&gt;hasExtraNamedItem() since the latter has been removed.
+        (WebCore::JSHTMLDocument::nameGetter): Use documentNamedItemMap().containsSingle() instead of
+        collection-&gt;hasExactlyOneItem() to avoid instantiating HTMLCollection when we're returning the first item.
</ins><span class="cx"> 
</span><del>-2014-03-05  Brendan Long  &lt;b.long@cablelabs.com&gt;
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::windowNamedItems): Instantiate WindowNameCollection, which is a subclass of HTMLNameCollection,
+        instead of HTMLNameCollection since the latter class no longer has a public constructor.
+        (WebCore::Document::documentNamedItems): Ditto; instantiate DocumentNameCollection.
</ins><span class="cx"> 
</span><del>-        [GStreamer] human readable language code for tracks
-        https://bugs.webkit.org/show_bug.cgi?id=124514
</del><ins>+        * dom/DocumentOrderedMap.cpp:
+        (WebCore::keyMatchesName): Added for name attribute.
+        (WebCore::keyMatchesWindowNamedItem): Added for window name getter.
+        (WebCore::keyMatchesDocumentNamedItem): Added for document name getter.
+        (WebCore::DocumentOrderedMap::getElementByName): Added for name attribute.
+        (WebCore::DocumentOrderedMap::getElementByWindowNamedItem): Added for window name getter.
+        (WebCore::DocumentOrderedMap::getElementByDocumentNamedItem): Added for document name getter.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        * dom/DocumentOrderedMap.h:
+        (WebCore::DocumentOrderedMap::containsSingle): Added.
+        (WebCore::DocumentOrderedMap::containsMultiple): Fixed the bug that containsMultiple returns true even when
+        the duplicate count has been reduced to 1. Unfortunately this behavior change is not testable because the old code
+        worked properly (though less efficient) even if this function returned a wrong value.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
-        (WebCore::TrackPrivateBaseGStreamer::notifyTrackOfTagsChanged): Run language codes though gst_tag_get_language_code_iso_639_1() to make sure they're valid.
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::insertedInto):
+        (WebCore::Element::removedFrom):
+        (WebCore::Element::updateName): Added. Updates TreeScope's name attribute map as well as HTMLDocument's window name
+        and document name maps.
+        (WebCore::Element::updateId): Added the code to update HTMLDocument's window name and document name maps.
</ins><span class="cx"> 
</span><del>-2014-03-05  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        * dom/Element.h:
+        (Element): Removed shouldRegisterAsNamedItem, shouldRegisterAsExtraNamedItem, updateNamedItemRegistration, and
+        updateExtraNamedItemRegistration as they're no longer used.
</ins><span class="cx"> 
</span><del>-        Remove unused method from Vibration
-        https://bugs.webkit.org/show_bug.cgi?id=129732
</del><ins>+        * dom/TreeScope.cpp:
+        (SameSizeAsTreeScope):
+        (WebCore::TreeScope::getElementByName): Added.
+        (WebCore::TreeScope::addElementByName): Added.
+        (WebCore::TreeScope::removeElementByName): Added.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        * dom/TreeScope.h:
+        (WebCore::TreeScope::hasElementWithName): Added.
+        (WebCore::TreeScope::containsMultipleElementsWithName): Added.
</ins><span class="cx"> 
</span><del>-        * Modules/vibration/Vibration.cpp:
-        Removed isActive(), which is never called since r152441.
-        * Modules/vibration/Vibration.h: Ditto.
</del><ins>+        * html/HTMLAppletElement.h:
+        (HTMLAppletElement):
</ins><span class="cx"> 
</span><del>-2014-03-05  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * html/HTMLCollection.cpp:
+        (WebCore::isMatchingElement): Use HTMLNameCollection subclasses' nodeMatches.
+        (WebCore::HTMLCollection::namedItem): Added a fast path for named item.
+        (WebCore::HTMLCollection::hasNamedItem): Use namedItem to avoid the work in the fast path.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r165141, r165157, and r165158.
-        http://trac.webkit.org/changeset/165141
-        http://trac.webkit.org/changeset/165157
-        http://trac.webkit.org/changeset/165158
-        https://bugs.webkit.org/show_bug.cgi?id=129772
</del><ins>+        * html/HTMLCollection.h:
+        (HTMLCollection): Removed checkForNameMatch.
+        * html/HTMLDocument.cpp:
+        (WebCore): Removed various member functions related to m_namedItemCounts and m_extraNamedItemCounts.
</ins><span class="cx"> 
</span><del>-        &quot;broke ftl&quot; (Requested by olliej_ on #webkit).
</del><ins>+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument::documentNamedItemMap): Added.
+        (WebCore::HTMLDocument::windowNamedItemMap): Added.
+        (HTMLDocument): Replaced m_namedItemCounts and m_extraNamedItemCounts by m_documentNamedItem and m_windowNamedItem.
+        Note that they're not one to one.
</ins><span class="cx"> 
</span><del>-        * ForwardingHeaders/jit/SpillRegistersMode.h: Removed.
</del><ins>+        * html/HTMLEmbedElement.h:
+        (HTMLEmbedElement):
</ins><span class="cx"> 
</span><del>-2014-03-05  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        * html/HTMLFormElement.h:
+        (HTMLFormElement):
</ins><span class="cx"> 
</span><del>-        [GTK][CMake] The GObject DOM bindings should always be built
-        https://bugs.webkit.org/show_bug.cgi?id=127963
</del><ins>+        * html/HTMLIFrameElement.cpp: Removed the code to track the element's name since we already do this in Element.
+        (WebCore::HTMLIFrameElement::parseAttribute):
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        * html/HTMLIFrameElement.h:
+        (HTMLIFrameElement):
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Make compilation of the WebKitGTK+ GObject DOM bindings
-        unconditional, instead of conditional on the WebKit2 build.
</del><ins>+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseAttribute): Update the HTMLDocument's maps when the name attribute's existence
+        changes its presence on window and document name getters in turn. This behavior change, again, appears to be
+        untestable due to the old being more graceful when DocumentOrderedMap returned a wrong value.
</ins><span class="cx"> 
</span><del>-2014-03-05  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        * html/HTMLImageElement.h:
</ins><span class="cx"> 
</span><del>-        [MSE] Crash in SourceBuffer::sourceBufferPrivateDidReceiveSample() - received samples after SourceBuffer was removed.
-        https://bugs.webkit.org/show_bug.cgi?id=129761
</del><ins>+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::HTMLNameCollection): No longer overrides itemAfter. This enables backwards traversals
+        of the tree along with other optimizations in HTMLCollection.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        (WebCore::WindowNameCollection::nodeMatchesIfNameAttributeMatch): Added. Used in Element::updateName to determine
+        whether add() or remove() should be called on HTMLDocument's maps.
+        (WebCore::WindowNameCollection::nodeMatches): Added.
</ins><span class="cx"> 
</span><del>-        Guard against the possibility that SourceBufferPrivates will continue to generate samples even after
-        a parse error. Bail out early from sourceBufferPrivateDidReceiveInitializationSegment and
-        sourceBufferPrivateDidReceiveSample if the SourceBuffer has been removed.
</del><ins>+        (WebCore::DocumentNameCollection::nodeMatchesIfIdAttributeMatch): Added. Used in Element::updateName to determine
+        whether add() or remove() should be called on HTMLDocument's maps.
+        (WebCore::DocumentNameCollection::nodeMatchesIfNameAttributeMatch): Ditto.
+        (WebCore::DocumentNameCollection::nodeMatches): Added.
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment):
-        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):
</del><ins>+        * html/HTMLNameCollection.h:
+        (HTMLNameCollection): Removed create since this class shouldn't be instantiated on its own.
</ins><span class="cx"> 
</span><del>-2014-03-05  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        (WebCore::WindowNameCollection): Added.
+        (WebCore::WindowNameCollection::create): Added.
+        (WebCore::WindowNameCollection::nodeMatches): Added.
+        (WebCore::WindowNameCollection::nodeMatchesIfIdAttributeMatch): Added.
+        (WebCore::WindowNameCollection::WindowNameCollection): Added.
+        (WebCore::DocumentNameCollection): Added.
+        (WebCore::DocumentNameCollection::create): Added.
+        (WebCore::DocumentNameCollection::nodeMatches): Added.
+        (WebCore::DocumentNameCollection::DocumentNameCollection): Added.
</ins><span class="cx"> 
</span><del>-        Build fix, take 2.
</del><ins>+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateDocNamedItem): Update both window and document getter maps of HTMLDocument when
+        the visibility of this element changes due to the DOM mutations in the subtree.
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.mm:
</del><ins>+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement):
+        (WebCore::toHTMLObjectElement): Added.
</ins><span class="cx"> 
</span><del>-2014-03-05  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+2013-05-06  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Build fix.
</del><ins>+        Flaky Test: fast/frames/crash-remove-iframe-during-object-beforeload.html
+        &lt;http://webkit.org/b/115674&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.mm:
-
-2014-03-05  Enrica Casucci  &lt;enrica@apple.com&gt;
-
-        Crash when copying content that contains &lt;sup&gt;.
-        https://bugs.webkit.org/show_bug.cgi?id=129765
-        &lt;rdar://problem/16139498&gt;
-        
-        Reviewed by Benjamin Poulain.
-
-        Adding static definition of NSAttributeSuperscriptName.
-
-        * platform/mac/HTMLConverter.mm:
-
-2014-03-05  Gavin Barraclough  &lt;barraclough@apple.com&gt;
-
-        https://bugs.webkit.org/show_bug.cgi?id=128625
-        Add fast mapping from StringImpl to JSString
-
-        Unreviewed roll-out.
-
-        Reverting r164347, r165054, r165066 - not clear the performance tradeoff was right.
-
-        * bindings/js/DOMWrapperWorld.cpp:
-        (WebCore::DOMWrapperWorld::clearWrappers):
-        * bindings/js/DOMWrapperWorld.h:
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::jsStringWithCache):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::commonVM):
-        * bindings/scripts/StaticString.pm:
-        (GenerateStrings):
-
-2014-03-05  Daniel Bates  &lt;dabates@apple.com&gt;
-            And Alexey Proskuryakov  &lt;ap@apple.com&gt;
-
-        ASSERT(newestManifest) fails in WebCore::ApplicationCacheGroup::didFinishLoadingManifest()
-        https://bugs.webkit.org/show_bug.cgi?id=129753
-        &lt;rdar://problem/12069835&gt;
-
</del><span class="cx">         Reviewed by Alexey Proskuryakov.
</span><span class="cx"> 
</span><del>-        Fixes an issue where an assertion failure would occur when visiting a web site whose on-disk
-        app cache doesn't contain a manifest resource.
</del><ins>+        Don't cache the Document::renderer() in a local since layout may blow it away.
</ins><span class="cx"> 
</span><del>-        For some reason an app cache for a web site may be partially written to disk. In particular, the
-        app cache may only contain a CacheGroups entry. That is, the manifest resource and origin records
-        may not be persisted to disk. From looking over the code, we're unclear how such a situation can occur
-        and hence have been unable to create such an app cache. We were able to reproduce this issue using
-        an app cache database file that was provided by a person that was affected by this issue.
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
</ins><span class="cx"> 
</span><del>-        No test included because it's not straightforward to write a test for this change.
</del><ins>+2013-05-06  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Assert that m_cacheBeingUpdated-&gt;manifestResource()
-        is non-null. Currently we only document this assumption in a code comment. Also separated a single assertion
-        expression into two assertion expressions to make it straightforward to identify the failing sub-expression
-        on failure.
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::store): Modified to call ApplicationCacheStorage::deleteCacheGroupRecord()
-        to remove a cache group and associated cache records (if applicable) before inserting a cache group entry.
-        This replacement approach will ultimately repair incomplete app cache data for people affected by this bug.
-        (WebCore::ApplicationCacheStorage::loadCache): Log an error and return nullptr if the cache we loaded doesn't
-        have a manifest resource.
-        (WebCore::ApplicationCacheStorage::deleteCacheGroupRecord): Added.
-        (WebCore::ApplicationCacheStorage::deleteCacheGroup): Extracted deletion logic for cache group record into
-        ApplicationCacheStorage::deleteCacheGroupRecord().
-        * loader/appcache/ApplicationCacheStorage.h:
</del><ins>+        More work on LocalStorageDatabaseTracker
+        https://bugs.webkit.org/show_bug.cgi?id=115680
</ins><span class="cx"> 
</span><del>-2014-03-05  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Support caching of custom setters
-        https://bugs.webkit.org/show_bug.cgi?id=129519
</del><ins>+        Export symbols needed by WebKit2.
</ins><span class="cx"> 
</span><del>-        Reviewed by Filip Pizlo.
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Add forwarding header
</del><ins>+2013-05-06  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: js/regress/assign-custom-setter-polymorphic.html
-               js/regress/assign-custom-setter.html
</del><ins>+        [GTK] Add webkit_uri_scheme_request_finish_error
+        https://bugs.webkit.org/show_bug.cgi?id=94316
</ins><span class="cx"> 
</span><del>-        * ForwardingHeaders/jit/SpillRegistersMode.h: Added.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-03-05  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        No behaviour change, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement()
-        &lt;http://webkit.org/b/129751&gt;
-        &lt;rdar://problem/16237965&gt;
</del><ins>+        * platform/network/soup/ResourceError.h:
+        (ResourceError): Rename genericIOError() to genericGError().
+        * platform/network/soup/ResourceErrorSoup.cpp:
+        (WebCore::ResourceError::httpError): Use genercicGError() instead of
+        genericIOError().
+        (WebCore::ResourceError::genericGError): Use error domain instead of
+        always return a G_IO_ERROR.
+        * platform/network/soup/ResourceHandleSoup.cpp: Use genericGError()
+        instead of genericIOError().
+        (WebCore::redirectSkipCallback):
+        (WebCore::readCallback):
</ins><span class="cx"> 
</span><del>-        Reviewed by Jon Honeycutt.
</del><ins>+2013-05-06  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by Yuta Kitamura):
-        https://src.chromium.org/viewvc/blink?revision=168160&amp;view=revision
-        http://crbug.com/345005
</del><ins>+        Heap-use-after-free in WebCore::InlineFlowBox::deleteLine
+        https://bugs.webkit.org/show_bug.cgi?id=114772
</ins><span class="cx"> 
</span><del>-            The root cause is CompositeEditCommand::moveParagraphWithClones() passing
-            two positions |start| and |end| which do not follow the document order,
-            i.e. in some situations |start| is located after |end| because of
-            the difference in affinity.
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-            This patch fixes this crash by normalizing |end| to |start| in such situations.
-            It also adds an ASSERT that checks the relationship between |start| and |end|.
</del><ins>+        Fix the new use after free issues in Ruby.
</ins><span class="cx"> 
</span><del>-        Test: editing/execCommand/format-block-crash.html
</del><ins>+        Test: fast/ruby/ruby-svg-crash.html
</ins><span class="cx"> 
</span><del>-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
-        (WebCore::CompositeEditCommand::moveParagraphWithClones):
-        * editing/CompositeEditCommand.h:
</del><ins>+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::removeChild):
</ins><span class="cx"> 
</span><del>-2014-03-05  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+2013-05-06  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Scrollable regions
-        https://bugs.webkit.org/show_bug.cgi?id=129301
</del><ins>+        REGRESSION(r140024): child of fixed div inside of absolute div does not get resized when window is resized
+        https://bugs.webkit.org/show_bug.cgi?id=115379
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by David Hyatt.
</span><span class="cx"> 
</span><del>-        Named flow fragments do not inherit the overflow property from the fragment container.
-        When asked if the flow thread content should be clipped, the named flow fragments
-        will respond using the overflow property of the named flow fragment container.
</del><ins>+        When detecting whether a fixed pos object needed to move with an absolute ancestor we checked
+        whether the logical width of the fixed pos object had changed. This check prevented the fixed pos
+        object from detecting later on that it needed to relayout its children in layoutBlock(). So recompute the width
+        for our check instead of updating it.
</ins><span class="cx"> 
</span><del>-        When painting the flow thread layer inside the region, the scrolled content offset of
-        the region must be used to offset the flow thread's layer.
</del><ins>+        Test: fast/block/positioning/child-of-fixed-pos-after-movement.html
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/scrollable-last-region.html
-               fast/regions/scrollable-single-region-bt.html
-               fast/regions/scrollable-single-region-lr.html
-               fast/regions/scrollable-single-region-relative-element.html
-               fast/regions/scrollable-single-region-rl.html
-               fast/regions/scrollable-single-region.html
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markFixedPositionObjectForLayoutIfNeeded):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::createStyle):
-        (WebCore::RenderNamedFlowFragment::shouldClipFlowThreadContent):
-        * rendering/RenderNamedFlowFragment.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::shouldClipFlowThreadContent):
-        * rendering/RenderRegion.h:
</del><ins>+2013-05-06  Mike Lattanzio  &lt;mlattanzio@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-05  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        [BlackBerry] Enable and Expose Text Autosizing through BlackBerry::WebKit::WebSettings
+        https://bugs.webkit.org/show_bug.cgi?id=113808
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Device pixel round accumulated subpixel value when the RenderLayer with transform paints its content.
-        https://bugs.webkit.org/show_bug.cgi?id=129079
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Added TextAutosizer.cpp to the BlackBerry build.
</ins><span class="cx"> 
</span><del>-        Snap the content to the device pixel position (as opposed to integral position) before
-        applying the transform. Recalculate the remaining subpixels that need offsetting at painting time.
</del><ins>+        * PlatformBlackBerry.cmake:
</ins><span class="cx"> 
</span><del>-        Test: compositing/hidpi-absolute-subpixel-positioned-transformed-elements.html
</del><ins>+2013-05-06  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/LayoutPoint.h:
-        (WebCore::roundedForPainting):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
</del><ins>+        Use OwnPtr instead of deleteAllValues in SVGAttributeToPropertyMap
+        https://bugs.webkit.org/show_bug.cgi?id=115653
</ins><span class="cx"> 
</span><del>-2014-03-05  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        [iOS] Show external device name/type in placeholder
-        https://bugs.webkit.org/show_bug.cgi?id=129723
</del><ins>+        Also made a few style fixes to the code at the same time.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        * svg/properties/SVGAttributeToPropertyMap.cpp:
+        (WebCore::SVGAttributeToPropertyMap::addProperties): Changed argument to
+        const because there was no reason for it to be non-const. Added calls to
+        get() since the items in the map are now OwnPtr. Added a couple FIXMEs
+        about performance mistakes.
+        (WebCore::SVGAttributeToPropertyMap::addProperty): Added a FIXME about
+        a small performance mistake, and updated to use OwnPtr instead of raw
+        pointers.
+        (WebCore::SVGAttributeToPropertyMap::synchronizeProperties): Added a call
+        to get().
</ins><span class="cx"> 
</span><del>-        Make the name and type of the external device available to the JS based controls.
-        * Modules/mediacontrols/MediaControlsHost.cpp:
-        (WebCore::MediaControlsHost::externalDeviceDisplayName):
-        (WebCore::MediaControlsHost::externalDeviceType):
-        * Modules/mediacontrols/MediaControlsHost.h:
-        * Modules/mediacontrols/MediaControlsHost.idl:
</del><ins>+        * svg/properties/SVGAttributeToPropertyMap.h: Removed now-unneeded
+        constructor and destructor definitions. Changed the type for the
+        addProperties to be const&amp;. Added a comment about incorrect function
+        naming. Changed the type of the map data member to use OwnPtr.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.updateWirelessPlaybackStatus): Display device type-specific infomation
-            in the placeholder image.
</del><ins>+2013-05-06  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export new WebKitSystemInterface functions.
</del><ins>+        Remove more code that was only needed for younger/older shadow trees
+        https://bugs.webkit.org/show_bug.cgi?id=115662
</ins><span class="cx"> 
</span><del>-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::wirelessPlaybackTargetName): Added.
-        (WebCore::MediaPlayer::wirelessPlaybackTargetType): Ditto.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::wirelessPlaybackTargetType): Added.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::wirelessPlaybackTargetName): Ditto.
</del><ins>+        This is dead code.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebCoreSystemInterfaceIOS.mm:
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-
-2014-03-05  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
-
-        [iOS] Rename the various VisibleExtent variations to exposedContentRect
-        https://bugs.webkit.org/show_bug.cgi?id=129728
-
-        Reviewed by Simon Fraser.
-
-        Rename DocumentVisibleExtent and VisibleExtentContentRect to ExposedContentRect in a desperate
-        attempt to make things a tiny little bit less confusing.
-
-        The name is ExposedContentRect and not ExposedRect as that rect is exposed on ScrollView, while the
-        rect is in document coordinates (which does not make any difference on WebKit1...).
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * platform/ScrollView.h:
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::exposedContentRect):
-        (WebCore::ScrollView::setExposedContentRect):
-        * platform/ios/wak/WAKScrollView.h:
-        * platform/ios/wak/WAKScrollView.mm:
-        (-[WAKScrollView exposedContentRect]):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
-        (WebCore::RenderLayerCompositor::didChangeVisibleRect):
-
-2014-03-05  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        ObjC exception when dropping files into a WKView: drag and drop uses code from WebKit.framework
-        https://bugs.webkit.org/show_bug.cgi?id=129752
-
-        Reviewed by Enrica Casucci.
-
-        Add C functions for NSURL-related functionality required by WebKit2
-
-        * WebCore.exp.in:
-        * platform/mac/WebCoreNSURLExtras.h:
-        * platform/mac/WebCoreNSURLExtras.mm:
-        (WebCore::URLByCanonicalizingURL):
-        (WebCore::rangeOfURLScheme):
-        (WebCore::looksLikeAbsoluteURL):
-
-2014-03-05  Martin Hock  &lt;mhock@apple.com&gt;
-
-        Add support for sessions to MemoryCache.
-        https://bugs.webkit.org/show_bug.cgi?id=127794
-
-        Reviewed by Sam Weinig.
-
-        * WebCore.exp.in:
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI): Initialize CachedImage with sessionID.
-        * html/DOMURL.cpp:
-        (WebCore::DOMURL::revokeObjectURL): Remove URL from MemoryCache for all sessions.
-        * inspector/InspectorPageAgent.cpp:
-        (WebCore::InspectorPageAgent::cachedResource): Pass sessionID to MemoryCache.
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::replayXHR): Ditto.
-        * loader/DocumentLoader.cpp:
-        (WebCore::areAllLoadersPageCacheAcceptable): Ditto.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::tellClientAboutPastMemoryCacheLoads): Ditto.
-        * loader/ImageLoader.cpp:
-        (WebCore::ImageLoader::updateFromElement): Initialize CachedImage with sessionID.
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::create): Pass sessionID to MemoryCache.
-        * loader/cache/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet): Constructor takes sessionID.
-        * loader/cache/CachedCSSStyleSheet.h:
-        * loader/cache/CachedFont.cpp: Ditto.
-        (WebCore::CachedFont::CachedFont):
-        * loader/cache/CachedFont.h:
-        * loader/cache/CachedImage.cpp: Ditto.
-        (WebCore::CachedImage::CachedImage):
-        * loader/cache/CachedImage.h:
-        * loader/cache/CachedRawResource.cpp: Ditto.
-        (WebCore::CachedRawResource::CachedRawResource):
-        * loader/cache/CachedRawResource.h:
-        * loader/cache/CachedResource.cpp: Ditto.
-        (WebCore::CachedResource::CachedResource):
-        (WebCore::CachedResource::~CachedResource): Pass sessionID to MemoryCache.
-        * loader/cache/CachedResource.h:
-        (WebCore::CachedResource::sessionID):
-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::createResource): Constructors take sessionID.
-        (WebCore::CachedResourceLoader::sessionID): Retrieve sessionID from page.
-        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Pass sessionID to MemoryCache.
-        (WebCore::CachedResourceLoader::requestResource): Initialize CachedCSSStyleSheet with sessionID.
-        (WebCore::CachedResourceLoader::revalidateResource): Initialize cached resource with sessionID.
-        (WebCore::CachedResourceLoader::loadResource): Pass sessionID to MemoryCache and initialize cached resource with sessionID.
-        * loader/cache/CachedResourceLoader.h:
-        * loader/cache/CachedSVGDocument.cpp: Constructor takes sessionID.
-        (WebCore::CachedSVGDocument::CachedSVGDocument):
-        * loader/cache/CachedSVGDocument.h:
-        * loader/cache/CachedScript.cpp: Ditto.
-        (WebCore::CachedScript::CachedScript):
-        * loader/cache/CachedScript.h:
-        * loader/cache/CachedTextTrack.cpp: Ditto.
-        (WebCore::CachedTextTrack::CachedTextTrack):
-        * loader/cache/CachedTextTrack.h:
-        * loader/cache/CachedXSLStyleSheet.cpp: Ditto.
-        (WebCore::CachedXSLStyleSheet::CachedXSLStyleSheet):
-        * loader/cache/CachedXSLStyleSheet.h:
-        * loader/cache/MemoryCache.cpp:
-        (WebCore::MemoryCache::getSessionMap): Retrieve CachedResourceMap based on sessionID.
-        (WebCore::MemoryCache::add): Use sessionID from CachedResource parameter.
-        (WebCore::MemoryCache::revalidationSucceeded): Add sessionID parameter.
-        (WebCore::MemoryCache::resourceForURL): Ditto.
-        (WebCore::MemoryCache::resourceForRequest): Ditto, also move impl into impl method.
-        (WebCore::MemoryCache::resourceForRequestImpl): Add CachedResourceMap parameter.
-        (WebCore::MemoryCache::addImageToCache): Use default sessionID.
-        (WebCore::MemoryCache::removeImageFromCache): Ditto.
-        (WebCore::MemoryCache::evict): Use sessionID from CachedResource parameter.
-        (WebCore::MemoryCache::removeResourcesWithOrigin): Iterate through all CachedResourceMaps.
-        (WebCore::MemoryCache::getOriginsWithCache): Ditto.
-        (WebCore::MemoryCache::removeUrlFromCache): Add sessionID parameter.
-        (WebCore::MemoryCache::removeRequestFromCache): Ditto.
-        (WebCore::MemoryCache::removeRequestFromSessionCaches): Remove request from all CachedResourceMaps, with multithread support.
-        (WebCore::MemoryCache::removeRequestFromCacheImpl): Add sessionID parameter.
-        (WebCore::MemoryCache::removeRequestFromSessionCachesImpl): Iterate through all CachedResourceMaps.
-        (WebCore::MemoryCache::crossThreadRemoveRequestFromCache): Add sessionID parameter.
-        (WebCore::MemoryCache::crossThreadRemoveRequestFromSessionCaches): Pass on request to removeRequestFromSessionCachesImpl.
-        (WebCore::MemoryCache::getStatistics): Iterate through all CachedResourceMaps.
-        (WebCore::MemoryCache::setDisabled): Ditto.
-        * loader/cache/MemoryCache.h: Create another level for cache.
-        * platform/CrossThreadCopier.cpp: Allow copying SessionIDs across threads.
-        (WebCore::SessionID&gt;::copy):
-        * platform/CrossThreadCopier.h:
-        * platform/network/cf/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest): Remove trailing whitespace.
-        * rendering/RenderSnapshottedPlugIn.cpp:
-        (WebCore::RenderSnapshottedPlugIn::updateSnapshot): Initialize CachedImage with sessionID.
</del><ins>+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::nodeCanBeDistributed):
+        (WebCore::ComposedShadowTreeWalker::traverseParentBackToShadowRootOrHost):
+        * dom/EventPathWalker.cpp:
+        (WebCore::EventPathWalker::moveToParent):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ScopeContentDistribution::ScopeContentDistribution):
+        (WebCore::ScopeContentDistribution::registerInsertionPoint):
+        (WebCore::ScopeContentDistribution::unregisterInsertionPoint):
+        (WebCore):
+        (WebCore::ScopeContentDistribution::hasInsertionPoint):
+        (WebCore::ContentDistributor::invalidate):
+        * html/shadow/ContentDistributor.h:
+        (ScopeContentDistribution):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::contains):
+        (WebCore::resolveReprojection):
+        (WebCore::collectInsertionPointsWhereNodeIsDistributed):
+        * html/shadow/InsertionPoint.h:
</ins><span class="cx">         * testing/Internals.cpp:
</span><del>-        (WebCore::Internals::isLoadingFromMemoryCache): Pass sessionID to MemoryCache.
</del><ins>+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
</ins><span class="cx"> 
</span><del>-2014-03-03  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+2013-05-06  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK][CMake] Generate documentation for the DOM bindings
-        https://bugs.webkit.org/show_bug.cgi?id=126211
</del><ins>+        [BlackBerry] Update HTML5 progress bar UX.
+        https://bugs.webkit.org/show_bug.cgi?id=115284.
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Add some files to the GObjectDOMBindings build, so that the
-        doc generation succeeds. Have the GObjectDOMBindings_INSTALLED_HEADERS variable contain
-        all installed headers and use another variable for GIR generation. Create the configuration
-        file for the gtkdoc generation.
</del><ins>+        BlackBerry PR 331729.
+        Internally Reviewed by Jeff Rogers.
</ins><span class="cx"> 
</span><del>-2014-03-05  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Use GL render to paint progress bar to meet UX specs.
+        Also change the slider range to GL render.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Wrong cliprect on absolute positioned elements.
-        https://bugs.webkit.org/show_bug.cgi?id=129656
</del><ins>+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore):
+        (WebCore::RenderThemeBlackBerry::paintSliderTrack):
+        (WebCore::RenderThemeBlackBerry::paintProgressTrackRect):
+        (WebCore::drawProgressTexture):
+        (WebCore::RenderThemeBlackBerry::paintProgressBar):
+        * platform/blackberry/RenderThemeBlackBerry.h:
+        (RenderThemeBlackBerry):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-06  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        outlineBoundsForRepaint() is expected to return the outline repaint rect. Using enclosingIntRect()
-        to calculate the outline boundaries breaks repaint logic in RenderElement::repaintAfterLayoutIfNeeded().
-        Since enclosingIntRect() can return bigger rect than repaint rect, the old/new bounds' dimensions could end up
-        being different which triggers the size change repaint code path.
</del><ins>+        [CSS Exclusions] remove unused -webkit-wrap property
+        https://bugs.webkit.org/show_bug.cgi?id=102105
</ins><span class="cx"> 
</span><del>-        Test: fast/repaint/hidpi-absolute-positioned-element-wrong-cliprect-after-move.html
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::outlineBoundsForRepaint):
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::repaintAfterLayoutIfNeeded):
-        * rendering/svg/RenderSVGModelObject.cpp:
-        (WebCore::RenderSVGModelObject::outlineBoundsForRepaint):
</del><ins>+        Remove -webkit-wrap property and all mentions. This property doesn't
+        exist in the spec anymore, and was never implemented more than just
+        parsing the property.
</ins><span class="cx"> 
</span><del>-2014-03-05  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+        * WebCore.order:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::getPropertyValue):
+        (WebCore::StylePropertySet::asText):
+        * css/StylePropertyShorthand.cpp:
+        (WebCore::shorthandForProperty):
+        * css/StylePropertyShorthand.h:
+        (WebCore):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::applyProperty):
</ins><span class="cx"> 
</span><del>-        [ATK] Expose missing functionalities of AtkTableCell to AT.
-        https://bugs.webkit.org/show_bug.cgi?id=129492
</del><ins>+2013-05-06  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+        Write storage changes to disk
+        https://bugs.webkit.org/show_bug.cgi?id=115660
</ins><span class="cx"> 
</span><del>-        Implemented missing API of AtkTableCell.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        No new tests. Covered by existing ones.
</del><ins>+        Export symbols needed by WebKit2.
</ins><span class="cx"> 
</span><del>-        * accessibility/atk/WebKitAccessibleInterfaceTableCell.cpp:
-        (webkitAccessibleTableCellGetColumnSpan):
-        (webkitAccessibleTableCellGetRowSpan):
-        (webkitAccessibleTableCellGetPosition):
-        (webkitAccessibleTableCellGetTable):
-        (webkitAccessibleTableCellInterfaceInit):
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-2014-03-05  Andres Gomez  &lt;agomez@igalia.com&gt;
</del><ins>+2013-05-06  Tiancheng Jiang  &lt;tijiang@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        [GStreamer] WebSource doesn't need the &quot;iradio-mode&quot; property
-        https://bugs.webkit.org/show_bug.cgi?id=129685
</del><ins>+        [BlackBerry] Update HTML5 progress bar UX.
+        https://bugs.webkit.org/show_bug.cgi?id=115284.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Removed the &quot;iradio-mode&quot; property from the WK source element
-        since this was only available for its modification from
-        playbin/uridecodebin and, as discussed in GStreamer bug #725383,
-        it was not being set and now is going to be removed.
</del><ins>+        BlackBerry PR 331729.
+        Internally Reviewed by Jeff Rogers.
</ins><span class="cx"> 
</span><del>-        It is safe just to send always the &quot;icy-metadata&quot; header set and
-        deal with returning &quot;icy&quot; headers as we were already doing.
</del><ins>+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore):
+        (WebCore::createLinearGradient):
+        (WebCore::RenderThemeBlackBerry::paintSliderTrack):
+        (WebCore::RenderThemeBlackBerry::paintSliderTrackRect):
+        (WebCore::RenderThemeBlackBerry::paintProgressBar):
+        * platform/blackberry/RenderThemeBlackBerry.h:
+        (RenderThemeBlackBerry):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
-        (webKitWebSrcSetProperty):
-        (webKitWebSrcGetProperty):
-        (webKitWebSrcStart):
</del><ins>+2013-05-06  Víctor Manuel Jáquez Leal  &lt;vjaquez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-05  Chang Shu  &lt;cshu@webkit.org&gt;
</del><ins>+        [texmap] draw content if graphics layer displays a video
+        https://bugs.webkit.org/show_bug.cgi?id=114742
</ins><span class="cx"> 
</span><del>-        Copying wrapping text results in multiple spaces between wrapped lines stripped.
-        https://bugs.webkit.org/show_bug.cgi?id=129609.
</del><ins>+        Reviewed by Noam Rosenthal.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        Bug #86410 focuses on having composited/accelerated video using the
+        TextureMapper. But the video is not rendered fast by using the
+        repaint() method. In the case of the TextureMapper it is required to
+        call a content display as fast as possible.
</ins><span class="cx"> 
</span><del>-        While checking the condition of restoring the missing space, the collapsed spaces
-        may not be exactly one.
</del><ins>+        This patch adds the class TextureMapperPlatformLayer::Client with the
+        method setLayerNeedsDisplay(). The GraphicsLayerTextureMapper
+        implements this new class and the new method calls
+        setContentsNeedsDisplay(), causing a faster content display when
+        requested.
</ins><span class="cx"> 
</span><del>-        editing/pasteboard/copy-text-with-wrapped-tag.html is enhanced to test this case.
</del><ins>+        No new tests. Covered by existing tests.
</ins><span class="cx"> 
</span><del>-        * editing/TextIterator.cpp:
-        (WebCore::TextIterator::handleTextBox):
</del><ins>+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::setContentsToMedia): sets itself
+        as the TextureMapperPlatformLayer's client
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (WebCore::GraphicsLayerTextureMapper::setLayerNeedsDisplay):
+        TextureMapperPlatformLayer::Client::setLayerNeedsDisplay implementation
+        (GraphicsLayerTextureMapper):
+        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
+        (Client): New class
+        (WebCore::TextureMapperPlatformLayer::TextureMapperPlatformLayer):
+        (WebCore::TextureMapperPlatformLayer::setClient): client setter
+        (WebCore::TextureMapperPlatformLayer::setLayerNeedsDisplay): facade
+        for client's method
</ins><span class="cx"> 
</span><del>-2014-03-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2013-05-02  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        appendChild shouldn't invalidate LiveNodeLists and HTMLCollections if they don't have valid caches
-        https://bugs.webkit.org/show_bug.cgi?id=129727
</del><ins>+        Improve the performance of RenderDeprecatedFlexibleBox.
+        https://bugs.webkit.org/show_bug.cgi?id=115543.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Optimize deprecated flexible box layout to be much faster. This patch implements
+        the following optimizations in the deprecated flexible box:
+        
+        (1) Defer repainting of children until they have been placed into their final
+        positions. This is done by collecting all of the old frame rects into a Vector
+        and then doing a walk after layout is finished to repaint any of the children if
+        they moved from that position. This code matches the new RenderFlexibleBox's system
+        for repainting moved children.
+        
+        (2) Implement support for layout deltas. We keep a Vector of layout deltas for each
+        child as we shift them around, and every time we lay a child out again, we apply that
+        child's current layout delta to avoid repainting at the new position. RenderFlexibleBox
+        does not have support for layout deltas yet, so we'll need to implement this in the
+        new flexbox code as well.
+        
+        (3) Optimize flexible objects to avoid laying them out unflexed. When laying out
+        horizontal and vertical boxes now, we lay out the inflexible items first. We then
+        check to see if the inflexible extent of all those children has changed.
+        
+        If this extent didn't change, and the flexible items either don't need layout or there
+        is only one flexing item, then we avoid laying out the item in an unflexed state
+        and simply lay out one time with the flex applied instead. The new RenderFlexibleBox
+        does not have these optimizations and would benefit from them in the block-direction box
+        case (it uses preferred logical widths in the inline-direction box case, and so avoided
+        layouts in that direction already).
+        
+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        Before this patch, invalidateNodeListAndCollectionCachesInAncestors invalidated node lists and HTML
-        collections on ancestors of a node whenever we're inserting or removing a child node. This patch
-        makes HTMLCollections and LiveNodeLists register themselves with Document only when they have valid
-        caches.
</del><ins>+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::appendChildFrameRects):
+        Cache all of the old child frame rects so that we can compare them with the final
+        positions for repaintDuringLayoutIfMoved. This collection is identical to what the
+        new flexbox code does.
+        
+        (WebCore::appendChildLayoutDeltas):
+        Build up a vector that tracks layout deltas. We apply these layout deltas every
+        time we lay out a child so that any repainting done during layout ignores our shifted
+        position and just keeps using the old position. The new flexbox does not have this
+        code yet.
</ins><span class="cx"> 
</span><del>-        Each user of CollectionIndexCache now implements willValidateIndexCache member function that gets
-        called when CollectionIndexCache caches any state and necessitates the registration with document.
</del><ins>+        (WebCore::repaintChildrenDuringLayoutIfMoved):
+        After final placement of children, we do a single pass over all of the children and
+        repaint them if they shifted their positions. This matches how the new flexbox works.
+        
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        Collect the frame rects and layout deltas, and defer repainting of children to the
+        end of layout.
+        
+        (WebCore::gatherFlexChildrenInfo):
+        Don't clear flex overrides when gathering flex information. Add additional information
+        such as the number of flexing items so that we can use it to optimize flex layout.
+        
+        (WebCore::layoutChildIfNeededApplyingDelta):
+        A helper for applying your current layout delta for a child when laying that child out.
+        
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
+        Both methods are patched to aggregate layout deltas as children move around during
+        the multiple passes. In addition we now optimize layout in a couple of cases, such
+        as when the inflexible space stays the same (thus giving a flexible object the
+        same amount of available space, avoiding a need to lay out unflexed first).
+        
+        (WebCore::RenderDeprecatedFlexibleBox::placeChild):
+        Patched to add to our cached layout delta for that child when we do a movement.
</ins><span class="cx"> 
</span><del>-        * dom/ChildNodeList.h: Added an empty willValidateIndexCache since child node lists are never
-        registered with document.
</del><ins>+        * rendering/RenderDeprecatedFlexibleBox.h:
+        Changes to method signatures.
</ins><span class="cx"> 
</span><del>-        * dom/CollectionIndexCache.h:
-        (WebCore::CollectionIndexCache::hasValidCache): Added.
-        (WebCore::CollectionIndexCache::nodeCount): Calls willValidateIndexCache when caching node count.
-        (WebCore::CollectionIndexCache::nodeAfterCached): Ditto. Also assert that hasValidCache() true in
-        the cases where we're simply updating our caches or adding more caches.
-        (WebCore::CollectionIndexCache::nodeAt): Ditto. Also added a code to set the length cache when
-        we've reached the end of the list. This should be a slight speed up on some cases.
</del><ins>+2013-05-04  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::Document): Initializes a variable used by assertions.
-        (WebCore::Document::unregisterNodeList): Added an early exit for when m_listsInvalidatedAtDocument
-        is empty since invalidateNodeListAndCollectionCaches swaps out the list.
-        (WebCore::Document::registerCollection): Removed the boolean hasIdNameMap since we now explicitly
-        call collectionCachedIdNameMap in HTMLCollection.
-        (WebCore::Document::unregisterCollection): Ditto. Exit early if m_collectionsInvalidatedAtDocument
-        is empty since invalidateNodeListAndCollectionCaches swaps out the list.
-        * dom/Document.h:
</del><ins>+        REGRESSION (r125592): Reproducible crash in DOMWindow::open when a delegate closes the new window in decidePolicyForNavigationAction
+        https://bugs.webkit.org/show_bug.cgi?id=115609
</ins><span class="cx"> 
</span><del>-        * dom/LiveNodeList.cpp:
-        (WebCore::LiveNodeList::invalidateCache): Unregister the node list with document if we had caches.
-        * dom/LiveNodeList.h:
-        (WebCore::LiveNodeList::LiveNodeList):
-        (WebCore::LiveNodeList::~LiveNodeList): Ditto.
-        (WebCore::LiveNodeList::invalidateCache): Pass around document. This is necessary since document()
-        had already moved to the new document inside NodeListsNodeData::invalidateCaches.
-        (WebCore::LiveNodeList::willValidateIndexCache): Added. Registers itself with document.
</del><ins>+        Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        * dom/Node.cpp:
-        (WebCore::Document::invalidateNodeListAndCollectionCaches): Swap the lists since invalidateCache
-        tries to unregister node lists and HTML collections with document. Since this is the only case in
-        which node lists and HTML collections being removed may not be in the lists in unregisterNodeList
-        and unregisterCollection, assert this condition via m_inInvalidateNodeListAndCollectionCaches.
-        (WebCore::NodeListsNodeData::invalidateCaches):
</del><ins>+        When a window created by window.open() is navigated, the embedder might
+        close it in decidePolicyForNavigationAction. If this happens, we end up
+        with a pointer to a deleted Frame.
</ins><span class="cx"> 
</span><del>-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::adoptDocument): Unregister node lists and HTML collections from old
-        document via invalidateCache. We need to explicitly pass in oldDocument here since owner node's
-        document had already been changed to newDocument at this point. Since we're invalidating caches,
-        there is no need to register node lists and HTML collections with newDocument.
</del><ins>+        Fix this by keeping a strong reference to the Frame created by
+        createWindow(). We can later determine if the window was closed by
+        checking if the new Frame has a detached Page.
</ins><span class="cx"> 
</span><del>-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::HTMLCollection):
-        (WebCore::HTMLCollection::~HTMLCollection): Unregister the node list with document if we had caches.
-        (WebCore::HTMLCollection::invalidateCache): Ditto.
-        (WebCore::HTMLCollection::invalidateNamedElementCache):
-        * html/HTMLCollection.h:
-        (WebCore::HTMLCollection::invalidateCache): Pass around document as done in LiveNodeList.
-        (WebCore::HTMLCollection::willValidateIndexCache): Ditto.
</del><ins>+        Added an API test: WebKit1.CloseNewWindowInNavigationPolicyDelegate.
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormControlsCollection.cpp:
-        (WebCore::HTMLFormControlsCollection::invalidateCache): Ditto.
-        * html/HTMLFormControlsCollection.h:
</del><ins>+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::createWindow):
</ins><span class="cx"> 
</span><del>-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::invalidateSelectedItems): Ditto.
-        (WebCore::HTMLSelectElement::setRecalcListItems): Ditto.
</del><ins>+2013-05-06  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-05  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+        [GTK] Move GeolocationProviderGeoclue into libPlatform
+        https://bugs.webkit.org/show_bug.cgi?id=115591
</ins><span class="cx"> 
</span><del>-        Fix linker error after r165087
-        https://bugs.webkit.org/show_bug.cgi?id=129730
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+        No new tests - no new functionality.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Remove undefined symbol __ZN7WebCore32WebVideoFullscreenChangeObserverD2Ev.
</del><ins>+        * GNUmakefile.am: Remove the Source/WebCore/platform/geoclue directory from the webkitgtk_cppflags list.
+        * GNUmakefile.list.am: Move the GeolocationProviderGeoclue(Client) sources under platform_sources.
</ins><span class="cx"> 
</span><del>-2014-03-04  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-05-06  Zoltan Arvai  &lt;zarvai@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        Enable device pixel repaint rect tracking.
-        https://bugs.webkit.org/show_bug.cgi?id=129712
</del><ins>+        [Qt][Win] Unreviewed buildfix after r149579.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * plugins/win/PluginDatabaseWin.cpp:
+        (WebCore::addQtWebKitPluginPath):
</ins><span class="cx"> 
</span><del>-        Tracked repaint rects are device pixel snapped now to support hiDPI test cases.
</del><ins>+2013-05-06  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/repaint/hidpi-device-pixel-based-repaint-rect-tracking.html
</del><ins>+        Manage the presentation of the snapshotted plug-in using JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=115548
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::addTrackedRepaintRect):
-        (WebCore::FrameView::trackedRepaintRectsAsText): Print them as LayoutUnits to get
-        trailing zeros cut off.
-        * page/FrameView.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::repaintViewRectangle):
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-03-04  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * Resources/plugIns.js:
+        (createOverlay):
+        Implement the createOverlay(shadowRoot, titleText, subtitleText) method
+        that is called from WebCore (HTMLPlugInImageElement::didAddUserAgentShadowRoot)
+        to allow the injected script to customize the shadow root for a snapshotted
+        plug-in. This is a default implementation, clients are expected to customize
+        this by providing their own JS file with enhanced behavior.
</ins><span class="cx"> 
</span><del>-        Don't clamp scrolling node offsets when the offset is changed by delegated scrolling
-        https://bugs.webkit.org/show_bug.cgi?id=129724
</del><ins>+        * css/CSSDefaultStyleSheets.cpp:
+        (WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement):
+        Since we no longer have a default shadow tree generated in C++, it makes little
+        sense for clients to extend the default snapshotted plug-in stylesheet, so we
+        only insert it if no custom one is provided by the chrome client.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
-        
-        Call setScrollPositionWithoutContentEdgeConstraints() from
-        ScrollingTree::scrollPositionChangedViaDelegatedScrolling() so that
-        layers are not clamped during rubber-banding.
-        
-        This requires making setScrollPositionWithoutContentEdgeConstraints()
-        a pure virtual function on the base class.
</del><ins>+        * css/plugIns.css:
+        Better styling of the default snapshotted plug-in overlay look by using CSS
+        flex boxes. Also using more explicit selector as an optimization.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::scrollPositionChangedViaDelegatedScrolling):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h:
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::ensurePlugInsInjectedScript):
+        Expose a new method to allow HTMLPlugInImageElement instances to ensure that
+        the JavaScript code required to customize the snapshotted plug-in's shadow root
+        is indeed injected in the current document. The actual injection would only
+        happen once per document so all snapshotted plug-ins share the same scripting
+        context.
</ins><span class="cx"> 
</span><del>-2014-03-04  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+        * dom/Document.h:
+        Expose the new ensurePlugInsInjectedScript method and the m_hasInjectedPlugInsScript
+        property used to ensure injection happens only once per document.
</ins><span class="cx"> 
</span><del>-        WebVideoFullscreen, should make the hand off of the video layer explicit.
-        https://bugs.webkit.org/show_bug.cgi?id=128844
</del><ins>+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::titleText):
+        (WebCore::subtitleText):
+        Store the localized strings for each mime-type in a static hash map as it can be
+        costly to retrieve them each time from the client. It is expected the chrome client
+        will want to provide localized strings taking into account the snapshotted plug-in's
+        mime-type, so we're adding this as a parameter.
+        (WebCore::HTMLPlugInImageElement::checkSnapshotStatus):
+        Dispatch a &quot;resize&quot; event to the shadow root to notify the injected script that the
+        snapshotted plug-in's metrics have changed and to allow the overlay to update itself
+        as a result.
+        (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
+        Remove all the DOM generation code in favor of an approach where we create a shared
+        DOM scripting world in which we inject JavaScript code that will perform the same
+        task but will additionally be provided by the client in order to provide a completely
+        custom overlay for the snapshotted plug-in. The sole contract is for the JavaScript
+        to implement a createOverlay(shadowRoot, titleText, subtitleText) method.
+        (WebCore::HTMLPlugInImageElement::partOfSnapshotOverlay):
+        Renamed method to be generic to the overlay as opposed to text labels and use the
+        element with CSS class name &quot;snapshot-overlay&quot; as the comparison node.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * html/HTMLPlugInImageElement.h:
+        (HTMLPlugInImageElement):
+        Removing a couple of unused members since we no longer generate the shadow DOM from C++
+        and rename the partOfSnapshotLabel method to partOfSnapshotOverlay.
</ins><span class="cx"> 
</span><del>-        This change introduces a more explicit hand-off of the video layer.
-        This describes the interactions between WebVideoFullscreenInterface and WebVideoFullscreenModel
-        WebVideoFullscreenModel &lt;-&gt; WebVideoFullscreenInterface
-              enterFullScreen(*) -&gt;
-                                &lt;- borrowVideoLayer
-              willLendVideoLayer -&gt;
-               didLendVideoLayer -&gt;
-                                &lt;- didEnterFullscreen
-                                ...
-                                &lt;- requestExitFullscreen
-                  exitFullscreen -&gt;
-                                &lt;- returnVideoLayer
-                                &lt;- didExitFullscreen
-        (*) enterFullScreen actually comes from WebVideoFullscreenControllerAVKit.
</del><ins>+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::plugInStartLabelTitle):
+        (WebCore::ChromeClient::plugInStartLabelSubtitle):
+        (WebCore::ChromeClient::plugInExtraScript):
+        Pass in the mime-type to plugInStartLabelTitle and plugInStartLabelSubtitle and expose
+        a new plugInExtraScript method to allow the chrome client to provide a custom JS file
+        for the management of the shadow root.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Export new functions in WebVideoFullscreenInterfaceAVKit, WebVideoFullscreenModelMediaElement, etc.
</del><ins>+        * rendering/RenderSnapshottedPlugIn.cpp:
+        (WebCore::RenderSnapshottedPlugIn::handleEvent):
+        Update the terminology from &quot;label&quot; to &quot;overlay&quot; per the changes made in HTMLPlugInImageElement.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
-        Add WebVideoFullscreenControllerChangeObserver to forward fullscreen callbacks to WebVideoFullscreenController
</del><ins>+2013-05-06  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenControllerChangeObserver::setTarget):
-        Sets obj-c target of fullscreen change callbacks.
</del><ins>+        REGRESSION(r140907) - Backport blink r149612 to fix vertical-align and rowspan issue
+        https://bugs.webkit.org/show_bug.cgi?id=115611
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController init]):
-        Point _changeObserver's target at self.
</del><ins>+        Patch by Julien Chaffraix.
+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController dealloc]):
-        Clear _changeObserver's target.
</del><ins>+        Backport phttps://src.chromium.org/viewvc/blink?view=rev&amp;revision=149612 from 
+        https://chromiumcodereview.appspot.com/14105010
+        
+        Fix the rows' height computation with vertical-align: baseline and rowspan.
+        r140907 was careful in avoiding updating the baseline descent for
+        spanning cells. However it still added the non-spanning cells baseline
+        descent to the spanning cells' row height computation.
+        This change avoids the previous issue by not adding the baseline
+        descent in this case.
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController enterFullscreen:]):
-        Retain self to prevent dealloc during animation or while fullscreen.
-        Connect _interface to _changeObserver.
</del><ins>+        Test: fast/table/baseline-align-rowspan.html
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController exitFullscreen]):
-        Remove use of completion move cleanup to -didExitFullscreen.
</del><ins>+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController didEnterFullscreen]):
-        Nothing to see here.
</del><ins>+2013-05-05  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController didExitFullscreen]):
-        Move clean up code that was in a completion to here.
</del><ins>+        Remove Vector::prepend
+        https://bugs.webkit.org/show_bug.cgi?id=115618
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterface.h:
-        Add delarations for more explicit hand-off of video layer.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        Add WebVideoFullscreenChangeObserver to notify when fullscreen animations complete.
-        Add declarations for more explicit hand-off of video layer.
-        Add WebAVPlayerLayer now always wraps the m_videoLayer to prevent default behavior
-        of AVPlayerLayer.
</del><ins>+        Replace calls to Vector::prepend with either Vector::insert,
+        or a combination of Vector::append and Vector::reverse.
</ins><span class="cx"> 
</span><del>-        (WebCore::WebVideoFullscreenChangeObserver::~WebVideoFullscreenChangeObserver):
-        Add empty virtual destructor.
</del><ins>+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::scrollToGlobalPoint):
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::addStops):
+        * css/CSSValueList.h:
+        (WebCore::CSSValueList::prepend):
+        * dom/Document.cpp:
+        (WebCore::Document::iconURLs):
+        * editing/TextIterator.cpp:
+        (WebCore::SearchBuffer::prependContext):
+        * editing/VisibleUnits.cpp:
+        (WebCore::previousBoundary):
+        (WebCore::nextBoundary):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::padDailyCountsForNewVisit):
+        (WebCore::HistoryItem::collapseDailyVisitsToWeekly):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::addInspectedObject):
+        * platform/graphics/SVGGlyph.cpp:
+        (WebCore::charactersWithArabicForm):
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        Include AVKit headers instead of declaring everything locally.
-        AVPlayerLayer protocol renamed to AVVideoLayer per AVKit.
</del><ins>+2013-05-05  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        (-[WebAVPlayerController dealloc]):
-        Don't refer to self.
</del><ins>+        Remove empty function SQLiteFileSystem::registerSQLiteVFS() and its callers
+        https://bugs.webkit.org/show_bug.cgi?id=115619
</ins><span class="cx"> 
</span><del>-        (-[WebAVPlayerController playerViewController:shouldDismissWithReason:]):
-        Pause before requesting exit fullscreen.
</del><ins>+        Reviewed by Dan Bernstein.
</ins><span class="cx"> 
</span><del>-        (-[WebAVPlayerLayer setPlayerController:]):
-        This is required by AVVideoLayer, but we don't need it.
</del><ins>+        * Modules/webdatabase/DatabaseTracker.cpp:
+        * platform/sql/SQLiteFileSystem.cpp:
+        * platform/sql/SQLiteFileSystem.h:
+        * storage/StorageTracker.cpp:
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::playerController):
-        White space.
</del><ins>+2013-05-05  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::setWebVideoFullscreenChangeObserver):
-        Set observer to forward fullscreen changes to.
</del><ins>+        AX: aria-checked not exposed correctly on menuitemcheckbox or menuitemradio roles
+        https://bugs.webkit.org/show_bug.cgi?id=115499
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::enterFullscreen):
-        Use more explicit video layer hand-off.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::doEnterFullscreen):
-        Move enterFullscreen logic here.
-        AVPlayerViewController now takes the video layer at init time.
-        Always provide a video layer wrapped in a WebAVPlayerLayer.
</del><ins>+        Expose isChecked() for menu item objects.
+        Return the Mac-platform specific value that you find on menu items for &quot;checked&quot; menu items.
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::willLendVideoLayer):
-        Use more explicit video layer hand-off.
</del><ins>+        Test: platform/mac/accessibility/aria-menuitem-checked-value.html
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::didLendVideoLayer):
-        Use more explicit video layer hand-off.
</del><ins>+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::isChecked):
+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
</ins><span class="cx"> 
</span><del>-        (WebVideoFullscreenInterfaceAVKit::exitFullscreen):
-        Use more explicit video layer hand-off.
</del><ins>+2013-05-05  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModel.h:
-        Add functions for more explicit video layer hand-off.
</del><ins>+        [wk2] Page Overlays: deviceScaleFactor doesn't update when the display changes
+        https://bugs.webkit.org/show_bug.cgi?id=115577
+        &lt;rdar://problem/13762583&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.h:
-        Mark virtual functions as virtual.
-        Add changes for WebVideoFullscreenModel.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        Use more explicit video layer hand-off.
-
-        (WebVideoFullscreenModelMediaElement::setMediaElement):
-        Don't push the video layer. Wait for a request for it.
-
-        (WebVideoFullscreenModelMediaElement::handleEvent):
-        Make sure m_videoFullscreenInterface is valid.
-
-        (WebVideoFullscreenModelMediaElement::borrowVideoLayer):
-        Use more explicit video layer hand-off.
-        Lend videoLayer in request to a request to borrow the videoLayer.
-        Make sure to retain the video layer before it is removed from the layer tree.
-
-        (WebVideoFullscreenModelMediaElement::returnVideoLayer):
-        Use more explicit video layer hand-off.
-
-        (WebVideoFullscreenModelMediaElement::requestExitFullscreen):
-        Don't clear the mediaElement reference until completely exited from fullscreen.
-
-2014-03-04  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Get position:fixed working slightly better on iOS
-        https://bugs.webkit.org/show_bug.cgi?id=129714
-
-        Reviewed by Benjamin Poulain.
-
-        Send the scroll position as a FloatPoint, rather than an IntPoint.
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::scrollPositionChangedViaDelegatedScrolling):
-        * page/scrolling/ScrollingTree.h:
</del><ins>+        Export GraphicsLayer::noteDeviceOrPageScaleFactorChangedIncludingDescendants
</ins><span class="cx"> 
</span><del>-2014-03-04  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+2013-05-05  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fixed Windows build without MEDIA_CONTROLS_SCRIPT enabled.
-        https://bugs.webkit.org/show_bug.cgi?id=129701
</del><ins>+        Remove the Vector::append overload that takes a Vector
+        https://bugs.webkit.org/show_bug.cgi?id=115535
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * DerivedSources.cpp:
-        Moved UserAgentScriptsData.cpp to DerivedSources.cpp to only be built if MEDIA_CONTROLS_SCRIPT is enabled.
-        * DerivedSources.make:
-        Only generate UserAgentScripts.cpp/h when USER_AGENT_SCRIPTS is non-empty.
-        * rendering/RenderThemeWin.cpp:
-        Only include UserAgentScripts.h when MEDIA_CONTROLS_SCRIPT is enabled.
</del><ins>+        Use Vector::appendVector instead.
</ins><span class="cx"> 
</span><del>-2014-03-04  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        * Modules/indexeddb/IDBBackingStore.cpp:
+        (WebCore::IDBBackingStore::putRecord):
+        (WebCore::IDBBackingStore::putIndexDataForRecord):
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeStringWithLength):
+        (WebCore::IDBLevelDBCoding::encodeIDBKey):
+        (WebCore::IDBLevelDBCoding::encodeIDBKeyPath):
+        (WebCore::IDBLevelDBCoding::SchemaVersionKey::encode):
+        (WebCore::IDBLevelDBCoding::MaxDatabaseIdKey::encode):
+        (WebCore::IDBLevelDBCoding::DataVersionKey::encode):
+        (WebCore::IDBLevelDBCoding::DatabaseFreeListKey::encode):
+        (WebCore::IDBLevelDBCoding::DatabaseNameKey::encode):
+        (WebCore::IDBLevelDBCoding::DatabaseMetaDataKey::encode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::encode):
+        (WebCore::IDBLevelDBCoding::IndexMetaDataKey::encode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreFreeListKey::encode):
+        (WebCore::IDBLevelDBCoding::IndexFreeListKey::encode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreNamesKey::encode):
+        (WebCore::IDBLevelDBCoding::IndexNamesKey::encode):
+        (WebCore::IDBLevelDBCoding::ObjectStoreDataKey::encode):
+        (WebCore::IDBLevelDBCoding::ExistsEntryKey::encode):
+        (WebCore::IDBLevelDBCoding::IndexDataKey::encode):
+        * Modules/webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::clear):
+        (WebCore::AudioContext::scheduleNodeDeletion):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::addTableCellChild):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::cells):
+        * css/RuleFeature.cpp:
+        (WebCore::RuleFeatureSet::add):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::addToMatchedPropertiesCache):
+        * dom/DocumentStyleSheetCollection.cpp:
+        (WebCore::collectActiveCSSStyleSheetsFromSeamlessParents):
+        (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):
+        * dom/Range.cpp:
+        (WebCore::Range::getBorderAndTextQuads):
+        * html/FormController.cpp:
+        (WebCore::FormController::getReferencedFilePaths):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setLineDash):
+        * html/parser/HTMLFormattingElementList.cpp:
+        (WebCore::HTMLFormattingElementList::tryToEnsureNoahsArkConditionQuickly):
+        * html/track/WebVTTToken.h:
+        (WebCore::WebVTTToken::addNewClass):
+        (WebCore::WebVTTToken::addNewAnnotation):
+        * page/CaptionUserPreferencesMac.mm:
+        (WebCore::CaptionUserPreferencesMac::preferredLanguages):
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooserSettings::acceptTypes):
+        * platform/SharedBufferChunkReader.cpp:
+        (WebCore::SharedBufferChunkReader::nextChunk):
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::getSitesInMediaCache):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::createWritableTypesForImage):
+        (WebCore::writableTypesForImage):
+        (WebCore::Pasteboard::writeSelectionForTypes):
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::FormDataBuilder::generateUniqueBoundaryString):
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::constructBidiRunsForSegment):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::OverlapMap::popCompositingContainer):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::splitColumn):
+        * svg/SVGGlyphMap.h:
+        (WebCore::SVGGlyphMap::collectGlyphsForString):
+        * xml/XPathNodeSet.h:
+        (WebCore::XPath::NodeSet::append):
</ins><span class="cx"> 
</span><del>-        Allow iOS DumpRenderTree crashes to show application-specific information
-        https://bugs.webkit.org/show_bug.cgi?id=129705
</del><ins>+2013-05-05  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Kilzer.
</del><ins>+        Try to fix the Windows build.
</ins><span class="cx"> 
</span><del>-        Make the WKSI function SetCrashReportApplicationSpecificInformation available
-        in iOS simulator builds.
</del><ins>+        Make plugIns.js have a non-zero length.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ios/WebCoreSystemInterfaceIOS.mm:
-        * platform/mac/WebCoreSystemInterface.h:
</del><ins>+        * Resources/plugIns.js:
</ins><span class="cx"> 
</span><del>-2014-03-04  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-05-04  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Spam static branch prediction hints on JS bindings.
-        &lt;https://webkit.org/b/129703&gt;
</del><ins>+        Animations and Transitions should not start when globally suspended
+        https://bugs.webkit.org/show_bug.cgi?id=114915
</ins><span class="cx"> 
</span><del>-        Add UNLIKELY hints to all !castedThis and exec-&gt;hadException() paths
-        in the JS bindings since they are almost always going to get skipped.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoff Garen.
</del><ins>+        When the Document's AnimationController was suspended, we still
+        started new transitions and animations. Change this so that
+        animations enter a paused-but-new state, where they are frozen
+        until the AnimationController resumes. At that time, it is as
+        if they had just appeared: any delay counts down before
+        the animation starts.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation):
-        (GenerateParametersCheck):
-        (GenerateImplementationFunctionCall):
-        (GenerateConstructorDefinition):
</del><ins>+        For transitions, the change in value must still happen, but
+        it does so immediately. No transitionend event should be fired.
+        This produces a slightly confusing behaviour, because any
+        in-progress transitions are suspended, but any new style changes
+        happen instantly. This might sound contradictory, but in general
+        suspending the document is a rare (and dangerous) thing to do.
</ins><span class="cx"> 
</span><del>-2014-03-04  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+        Previously, the Document would call resumeAnimations as it loaded,
+        effectively starting all the animations. This meant if you suspended
+        animations before loading a document, it was ignored as soon as the
+        load finished. Now there is a separate method startAnimationsIfNotSuspended
+        which checks to see if the document is suspended as it loads.
</ins><span class="cx"> 
</span><del>-        Remove unused StdDeviation from Gaussian Blur effect
-        https://bugs.webkit.org/show_bug.cgi?id=129693
</del><ins>+        In order to handle this case, I added a new state to the Animation
+        machinery: AnimationStatePausedNew. This is an animation that was created
+        in the suspended state.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Tests: animations/added-while-suspended.html
+               transitions/started-while-suspended.html
</ins><span class="cx"> 
</span><del>-        No new tests, no change on behavior.
</del><ins>+        * WebCore.exp.in: Export AnimationController::isSuspended().
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        * platform/graphics/filters/FEGaussianBlur.h:
-
-2014-03-04  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Add a Document::updateStyleIfNeededForNode(Node&amp;).
-        &lt;https://webkit.org/b/129689&gt;
-
-        Generalize the mechanism that computed style uses to avoid doing full
-        style updates when the node we're interested in isn't actually dirty.
-
-        Reviewed by Antti Koivisto.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
</del><span class="cx">         * dom/Document.cpp:
</span><del>-        (WebCore::nodeOrItsAncestorNeedsStyleRecalc):
-        (WebCore::Document::updateStyleIfNeededForNode):
-        * dom/Document.h:
-        * editing/htmlediting.cpp:
-        (WebCore::isEditablePosition):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
</del><ins>+        (WebCore::Document::implicitClose):
+            resumeAnimationsForDocument() -&gt; startAnimationsIfNotSuspended()
</ins><span class="cx"> 
</span><del>-2014-03-04  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+        * page/animation/AnimationBase.cpp:
+        (WebCore::nameForState): New name for AnimationStatePausedNew.
+        (WebCore::AnimationBase::updateStateMachine): Handle new state AnimationStatePausedNew. The
+            most important change is that when go from PausedNew to Running, we jump back into
+            the New state and continue from there.
+        (WebCore::AnimationBase::updatePlayState): suspended -&gt; isSuspended
+        * page/animation/AnimationBase.h: New state: AnimationStatePausedNew
+        (WebCore::AnimationBase::waitingToStart): Add AnimationStatePausedNew.
+        (WebCore::AnimationBase::paused): Add AnimationStatePausedNew.
+        (WebCore::AnimationBase::isNew): Add AnimationStatePausedNew.
</ins><span class="cx"> 
</span><del>-        Merge API shims and JSLock
-        https://bugs.webkit.org/show_bug.cgi?id=129650
</del><ins>+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate): Initialise m_suspended.
+        (WebCore::AnimationControllerPrivate::clear): suspended -&gt; isSuspended
+        (WebCore::AnimationControllerPrivate::updateAnimations): Ditto.
+        (WebCore::AnimationControllerPrivate::updateAnimationTimerForRenderer): Ditto.
+        (WebCore::AnimationControllerPrivate::suspendAnimations): Update m_suspended.
+        (WebCore::AnimationControllerPrivate::resumeAnimations): Ditto.
+        (WebCore::AnimationControllerPrivate::suspendAnimationsForDocument):
+        (WebCore::AnimationControllerPrivate::resumeAnimationsForDocument):
+        (WebCore::AnimationControllerPrivate::startAnimationsIfNotSuspended): New method that will
+            only resume animations if we were not globally suspended.
+        (WebCore::AnimationController::isSuspended): New method.
+        (WebCore::AnimationController::suspendAnimations): Add logging.
+        (WebCore::AnimationController::resumeAnimations): Add logging.
+        (WebCore::AnimationController::suspendAnimationsForDocument): Add logging.
+        (WebCore::AnimationController::resumeAnimationsForDocument): Add logging.
+        (WebCore::AnimationController::startAnimationsIfNotSuspended): Calls private method.
+        * page/animation/AnimationController.h:
+        (AnimationController): Add isSuspended() and animationsForDocumentMayStart().
+        * page/animation/AnimationControllerPrivate.h:
+        (WebCore::AnimationControllerPrivate::isSuspended): New method.
+        (AnimationControllerPrivate): Add m_isSuspended member.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mark Lam.
</del><ins>+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::CompositeAnimation): Moved from header - initialise m_isSuspended.
+        (WebCore::CompositeAnimation::updateTransitions): Do not create ImplicitAnimation if suspended.
+        (WebCore::CompositeAnimation::updateKeyframeAnimations): Move to AnimationStatePausedNew if suspended.
+        (WebCore::CompositeAnimation::suspendAnimations): m_suspended -&gt; m_isSuspended
+        (WebCore::CompositeAnimation::resumeAnimations): Ditto.
+        * page/animation/CompositeAnimation.h:
+        (WebCore::CompositeAnimation::isSuspended): Renamed from suspended()
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate): If we're in the AnimationStatePausedNew state, then
+            we need to go to the first frame (to handle fill mode).
</ins><span class="cx"> 
</span><del>-        JSLock is now taking on all of APIEntryShim's responsibilities since there is never a reason 
-        to take just the JSLock. Ditto for DropAllLocks and APICallbackShim.
</del><ins>+        * testing/Internals.cpp:
+        (WebCore::Internals::animationsAreSuspended): New exposed method to reflect AnimationController.
+        * testing/Internals.h: Add animationsAreSuspended.
+        * testing/Internals.idl: Ditto.
</ins><span class="cx"> 
</span><del>-        * bindings/js/DOMRequestState.h:
-        (WebCore::DOMRequestState::Scope::Scope):
-        * bindings/js/JSDOMPromise.h:
-        (WebCore::DeferredWrapper::resolve):
-        (WebCore::DeferredWrapper::reject):
-        (WebCore::DeferredWrapper::resolve&lt;String&gt;):
-        (WebCore::DeferredWrapper::resolve&lt;bool&gt;):
-        (WebCore::char&gt;&gt;):
-        (WebCore::DeferredWrapper::reject&lt;String&gt;):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInWorld):
-        * bindings/js/SerializedScriptValue.cpp:
-        (WebCore::SerializedScriptValue::create):
-        (WebCore::SerializedScriptValue::deserialize):
</del><ins>+2013-05-04  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-03-04  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Move PopupMenuMac and SearchPopupMenuMac to Source/WebKit/mac
+        matching where they are in WebKit2.
</ins><span class="cx"> 
</span><del>-        REGRESSION: Overlay scrollbars that have grown are sometimes askew in the track
-        https://bugs.webkit.org/show_bug.cgi?id=129691
-        -and corresponding-
-        &lt;rdar://problem/15666846&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/PopupMenuMac.h: Removed.
+        * platform/mac/PopupMenuMac.mm: Removed.
+        * platform/mac/SearchPopupMenuMac.h: Removed.
+        * platform/mac/SearchPopupMenuMac.mm: Removed.
</ins><span class="cx"> 
</span><del>-        This regression started happening after we adopted the setPresentationValue 
-        ScrollbarPainter API which allows us to update the position of the scrollbar knob 
-        from our secondary scrolling thread. The bug occurs when the scrollbar grows while 
-        it still thinks it is in presentation-value mode. Whenever the scrollbar grows, it 
-        should be in non-presentation value mode.
</del><ins>+2013-05-04  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        If the wheel event has ended or been cancelled, we can switch out of presentation 
-        value mode.
-        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeScrollingNodeMac::handleWheelEvent):
</del><ins>+        Get rid of special cases in AddIncludesForTypeInImpl
+        https://bugs.webkit.org/show_bug.cgi?id=115602
</ins><span class="cx"> 
</span><del>-        Sometimes we will grow the scrollbar before we have received a wheel event with 
-        the end or cancelled phase, and so automatically switch out of presentation-value 
-        mode whenever we start one of these animations.
-        * platform/mac/ScrollAnimatorMac.mm:
-        (-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-2014-03-04  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        Get rid of the special cases in AddIncludesForTypeInImpl subroutine in the
+        JS bindings generator. Those are no longer needed and special cases should
+        be avoided in the generator.
</ins><span class="cx"> 
</span><del>-        Move Source/WebCore/html/track/ code to std::unique_ptr
-        https://bugs.webkit.org/show_bug.cgi?id=129666
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * bindings/scripts/CodeGeneratorJS.pm:
+        (AddIncludesForTypeInImpl):
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr in code under Source/WebCore/html/track/ with std::unique_ptr.
</del><ins>+2013-05-04  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/track/AudioTrack.h:
-        * html/track/InbandWebVTTTextTrack.cpp:
-        (WebCore::InbandWebVTTTextTrack::parseWebVTTCueData):
-        * html/track/InbandWebVTTTextTrack.h:
-        * html/track/LoadableTextTrack.cpp:
-        (WebCore::LoadableTextTrack::loadTimerFired):
-        (WebCore::LoadableTextTrack::newCuesAvailable):
-        (WebCore::LoadableTextTrack::cueLoadingCompleted):
-        (WebCore::LoadableTextTrack::newRegionsAvailable):
-        * html/track/LoadableTextTrack.h:
-        * html/track/TextTrack.h:
-        * html/track/TextTrackCue.h:
-        * html/track/TextTrackRegion.h:
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::createWebVTTNodeTree):
-        (WebCore::VTTCue::markFutureAndPastNodes):
-        * html/track/VTTCue.h:
-        * html/track/VideoTrack.h:
-        * html/track/WebVTTParser.cpp:
-        (WebCore::WebVTTParser::WebVTTParser):
-        * html/track/WebVTTParser.h:
-        * html/track/WebVTTTokenizer.h:
-        * loader/TextTrackLoader.cpp:
-        (WebCore::TextTrackLoader::processNewCueData):
-        * loader/TextTrackLoader.h:
</del><ins>+        Get rid of AddIncludesForSVGAnimatedType in bindings generator
+        https://bugs.webkit.org/show_bug.cgi?id=115603
</ins><span class="cx"> 
</span><del>-2014-03-04  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Make border-radius painting device pixel aware.
-        https://bugs.webkit.org/show_bug.cgi?id=129558
</del><ins>+        Remove AddIncludesForSVGAnimatedType subroutine from the bindings generator
+        as it is a special case which is no longer needed.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Snap rounded rects to device pixels right before passing them to GraphicsContext.
</del><ins>+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::clipRoundedInnerRect):
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        (WebCore::RenderBoxModelObject::paintBorder):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::paint):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::paint):
</del><ins>+2013-05-04  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-04  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Update code generators to handle a new JavaScript file for snapshotted plug-ins
+        https://bugs.webkit.org/show_bug.cgi?id=115596
</ins><span class="cx"> 
</span><del>-        Crashes and assertions running iOS compositing tests
-        https://bugs.webkit.org/show_bug.cgi?id=129688
-
</del><span class="cx">         Reviewed by Dean Jackson.
</span><del>-        
-        When a layer is no longer composited, we need to unregister it
-        from the scrolling coordinator, and remove it from m_scrollCoordinatedLayers.
</del><span class="cx"> 
</span><del>-        Tested by compositing tests on iOS.
</del><ins>+        In preparation for https://webkit.org/b/115548, adding a new JS file at
+        Resources/plugIns.js that we will use to provide presentation for the
+        snapshotted plug-ins overlay.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
</del><ins>+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Resources/plugIns.js: Added.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-2014-03-04  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+2013-05-04  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Update bindings test results after r165046.
</del><ins>+        REGRESSION(r142647): Flaky Test: fast/frames/crash-remove-iframe-during-object-beforeload.html
+        &lt;http://webkit.org/b/115322&gt;
+        &lt;rdar://problem/13810719&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
-        (webkit_dom_test_obj_set_property):
-        (webkit_dom_test_obj_set_reflected_string_attr):
-        (webkit_dom_test_obj_set_reflected_url_attr):
-        (webkit_dom_test_obj_set_reflected_custom_url_attr):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::setJSTestObjReflectedStringAttr):
-        (WebCore::setJSTestObjReflectedURLAttr):
-        (WebCore::setJSTestObjReflectedCustomURLAttr):
-        * bindings/scripts/test/ObjC/DOMTestObj.mm:
-        (-[DOMTestObj setReflectedStringAttr:]):
-        (-[DOMTestObj setReflectedURLAttr:]):
-        (-[DOMTestObj setReflectedCustomURLAttr:]):
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-03-04  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        Don't cache the FrameView::renderView() in a local since updating Widgets may blow it away.
</ins><span class="cx"> 
</span><del>-        [GTK] Simplify the GObject DOM bindings API break check into one step
-        https://bugs.webkit.org/show_bug.cgi?id=129571
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
</ins><span class="cx"> 
</span><del>-        Reviewed by Carlos Garcia Campos.
</del><ins>+2013-05-04  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/gobject/GNUmakefile.am: We no longer generate the webkitdom.symbols file in the
-        DerivedSources directory. All the logic is handled internally in the script now.
-        * bindings/scripts/gobject-run-api-break-test: Removed.
</del><ins>+        Remove GraphicsContext::strokeArc(), which is unused.
</ins><span class="cx"> 
</span><del>-2014-03-04  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        From Blink r149608 by &lt;jbroman@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=149608&gt;
</ins><span class="cx"> 
</span><del>-        Build fix for iOS.
</del><ins>+        This is no longer used since almost a year ago, when HAVE(PATH_BASED_BORDER_RADIUS_DRAWING) was inlined.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::addRoundedBorderClip):
-        (WebCore::RenderThemeIOS::paintFileUploadIconDecorations):
-
-2014-03-04  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Subpixel rendering: Make GraphicsLayer::fillRect FloatRoundedRect based and cleanup dependencies.
-        https://bugs.webkit.org/show_bug.cgi?id=129557
-
-        Reviewed by Simon Fraser.
-
-        This is the preparation for snapping rounded rects to device pixel position. It enables
-        device pixel aware border-radius painting.
-
-        No change in functionality.
-
-        * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::RenderThemeEfl::paintMediaSliderThumb):
-        * platform/graphics/FloatRoundedRect.cpp:
-        (WebCore::FloatRoundedRect::FloatRoundedRect):
-        (WebCore::FloatRoundedRect::isRenderable):
-        * platform/graphics/FloatRoundedRect.h:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::clipRoundedRect):
-        (WebCore::GraphicsContext::clipOutRoundedRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
-        (WebCore::GraphicsContext::fillRectWithRoundedHole):
</del><span class="cx">         * platform/graphics/GraphicsContext.h:
</span><del>-        * platform/graphics/Path.cpp:
-        (WebCore::Path::addRoundedRect):
-        * platform/graphics/Path.h:
-        * platform/graphics/RoundedRect.cpp:
-        (WebCore::RoundedRect::pixelSnappedRoundedRectForPainting):
-        * platform/graphics/RoundedRect.h:
-        * platform/graphics/ShadowBlur.cpp:
-        (WebCore::ShadowBlur::drawRectShadow):
-        (WebCore::ShadowBlur::drawInsetShadow):
-        (WebCore::ShadowBlur::drawRectShadowWithoutTiling):
-        (WebCore::ShadowBlur::drawInsetShadowWithoutTiling):
-        (WebCore::ShadowBlur::drawInsetShadowWithTiling):
-        (WebCore::ShadowBlur::drawRectShadowWithTiling):
-        * platform/graphics/ShadowBlur.h:
</del><ins>+        * platform/graphics/blackberry/GraphicsContextBlackBerry.cpp:
</ins><span class="cx">         * platform/graphics/cairo/GraphicsContextCairo.cpp:
</span><del>-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::platformFillRoundedRect):
-        (WebCore::GraphicsContext::fillRectWithRoundedHole):
</del><span class="cx">         * platform/graphics/cg/GraphicsContextCG.cpp:
</span><del>-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::platformFillRoundedRect):
-        (WebCore::GraphicsContext::fillRectWithRoundedHole):
</del><span class="cx">         * platform/graphics/wince/GraphicsContextWinCE.cpp:
</span><del>-        (WebCore::GraphicsContext::fillRoundedRect):
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::borderRadiiFromStyle):
-        (WebCore::RenderThemeGtk::paintMediaSliderTrack):
-        (WebCore::RenderThemeGtk::paintMediaSliderThumb):
-        (WebCore::RenderThemeGtk::paintMediaVolumeSliderTrack):
-        * platform/win/DragImageWin.cpp:
-        (WebCore::createDragImageForLink):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::pushContentsClip):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::clipRoundedInnerRect):
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        (WebCore::RenderBoxModelObject::paintBorder):
-        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
-        (WebCore::RenderBoxModelObject::clipBorderSideForComplexInnerPath):
-        (WebCore::RenderBoxModelObject::paintBoxShadow):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::clipToRect):
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::RenderThemeIOS::paintRadioDecorations):
-        (WebCore::RenderThemeIOS::paintTextFieldDecorations):
-        (WebCore::RenderThemeIOS::paintMenuListButtonDecorations):
-        (WebCore::RenderThemeIOS::paintSliderTrack):
-        (WebCore::RenderThemeIOS::paintProgressBar):
-        (WebCore::RenderThemeIOS::paintFileUploadIconDecorations):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMenuListButtonGradients):
-        (WebCore::RenderThemeMac::paintSliderTrack):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
-        (WebCore::RenderThemeSafari::paintSliderTrack):
-        * rendering/shapes/BoxShape.cpp:
-        (WebCore::BoxShape::buildDisplayPaths):
-        * rendering/style/BasicShapes.cpp:
-        (WebCore::BasicShapeInset::path):
</del><span class="cx"> 
</span><del>-2014-03-04  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-05-04  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Micro-optimize Strings in JS bindings.
-        &lt;https://webkit.org/b/129673&gt;
</del><ins>+        Remove unused CSSSelector::isCustomPseudoType().
</ins><span class="cx"> 
</span><del>-        Tweaked for new jsStringWithWeakOwner signature. This patch removes
-        36 bytes of code from every wrapper getter that returns a DOMString.
</del><ins>+        From Blink r149574 by &lt;dominicc@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=149574&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        * css/CSSSelector.h:
+        * css/CSSSelector.cpp:
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.h:
-        (WebCore::jsStringWithCache):
</del><ins>+2013-05-04  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-03  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Remove ShadowRoot's previous/next ShadowRoot pointers.
+        &lt;http://webkit.org/b/115588&gt;
</ins><span class="cx"> 
</span><del>-        SVGPropertyTearOffs should detachChildren before deleting its value.
-        &lt;http://webkit.org/b/129618&gt;
-        &lt;rdar://problem/15661617&gt;
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Maciej Stachowiak.
</del><ins>+        ShadowRoot no longer inherits from DoublyLinkedListNode&lt;ShadowRoot&gt; because that code wasn't
+        doing anything anymore. Shrinks ShadowRoot by two pointers.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by kouhei@chromium.org):
-        https://src.chromium.org/viewvc/blink?revision=158563&amp;view=revision
-        http://crbug.com/296276
</del><ins>+        * dom/ElementShadow.h:
+        * dom/ShadowRoot.cpp:
+        (SameSizeAsShadowRoot):
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::~ShadowRoot):
+        * dom/ShadowRoot.h:
</ins><span class="cx"> 
</span><del>-        Test: svg/transforms/svg-matrix-tearoff-crash.html
</del><ins>+2013-05-04  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        NOTE: The test does not reproduce a crash on WebKit using
-        JavaScriptCore.
</del><ins>+        RenderObject: don't change GraphicsContext state when not drawing dashed/dotted lines.
</ins><span class="cx"> 
</span><del>-        * svg/properties/SVGPropertyTearOff.h:
-        (WebCore::SVGPropertyTearOff::setValue):
-        (WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
-        - Call detachChildren() if m_value is a copy.  The original
-          Blink patch did not modify the destructor code path, although
-          that seems obvious via code inspection.
</del><ins>+        From Blink r149546 by &lt;jbroman@chromium.org&gt;
+        &lt;http://src.chromium.org/viewvc/blink?view=revision&amp;revision=149546&gt;
</ins><span class="cx"> 
</span><del>-2014-03-04  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Previously, there was asymmetry between changing and restoring state (certain state
+        would be restored only if thickness was positive, i.e. a line was actually drawn.)
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Incorrect repaint rect cuts off content's right edge after move.
-        https://bugs.webkit.org/show_bug.cgi?id=129652
</del><ins>+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-05-03  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When repaint rect is adjusted in order to take the distance from renderer into account,
-        the accumulated fraction value need to be added too. This is always a positive value.
</del><ins>+        Remove CSS selector profiler branches from ElementRuleCollector loop.
+        &lt;http://webkit.org/b/115581&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/borders/hidpi-border-clipping-right-after-move.html
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
</del><ins>+        Templatize the method so we don't have to check for active inspector frontends on every
+        pass through the loop.
</ins><span class="cx"> 
</span><del>-2014-03-04  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        Time spent in this loop goes down from 0.5% to 0.2% on iTunes Store, WebCore binary size
+        goes up 480 bytes (sorry Benjamin, I'll make it up to you.)
</ins><span class="cx"> 
</span><del>-        Remove unused member variable of NetworkInfoController
-        https://bugs.webkit.org/show_bug.cgi?id=129674
</del><ins>+        * css/ElementRuleCollector.h:
+        * css/ElementRuleCollector.cpp:
+        (WebCore::ElementRuleCollector::collectMatchingRulesForList):
+        (WebCore::ElementRuleCollector::doCollectMatchingRulesForList):
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+2013-04-30  Robert Hogan  &lt;robert@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/networkinfo/NetworkInfoController.cpp:
-        (WebCore::NetworkInfoController::NetworkInfoController):
-        (WebCore::NetworkInfoController::create):
-        (WebCore::provideNetworkInfoTo):
-        * Modules/networkinfo/NetworkInfoController.h: Removed m_page which is not really used.
</del><ins>+        REGRESSION(r140907): Incorrect baseline on cells after updating vertical-align
+        https://bugs.webkit.org/show_bug.cgi?id=115432
</ins><span class="cx"> 
</span><del>-2014-02-07  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        Reviewed by Julien Chaffraix.
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Percentages of indefinite sizes should compute to auto
-        https://bugs.webkit.org/show_bug.cgi?id=128173
</del><ins>+        If a cell changes vertical-align any intrinsic padding it has is now redundant. It
+        needs to calculate its new height from RenderTableRow::layout() and then find its
+        new intrinsic padding in RenderTableSection::layoutRows().
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Test: fast/table/correct-baseline-after-style-change.html
</ins><span class="cx"> 
</span><del>-        We should treat percentages of indefinite sizes as auto as
-        mandated by the spec. Otherwise we would end up calculating a
-        percentage of -1, the value we use to represent infinite.
</del><ins>+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleDidChange):
</ins><span class="cx"> 
</span><del>-        Added some test cases to the current tests.
</del><ins>+2013-05-03  Arnaud Renevier  &lt;a.renevier@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::gridTrackSize):
-        * rendering/style/GridTrackSize.h:
-        (WebCore::GridTrackSize::isPercentage):
</del><ins>+        incorrect repainting when a table has a transform
+        https://bugs.webkit.org/show_bug.cgi?id=109867
</ins><span class="cx"> 
</span><del>-2014-03-04  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Don't synchronize attributes in reflect setters when we don't need to
-        https://bugs.webkit.org/show_bug.cgi?id=129662
</del><ins>+        Disable LayoutState when table, tableRow or tableSection render
+        objects have transforms or reflections.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Tests: fast/repaint/reflection-table-layout.html
+               fast/repaint/transform-table-layout.html
</ins><span class="cx"> 
</span><del>-        The vast majority of attributes don't need synchronization. Avoid calling synchronizeAttribute in setters
-        for those content attributes generated by &quot;Reflect&quot; keyword in IDL.
</del><ins>+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layout):
+        (WebCore::RenderTableSection::layoutRows):
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGenerator.pm:
-        (SetterExpression):
-        * dom/Element.cpp:
-        (WebCore::Element::setAttributeWithoutSynchronization): Added.
-        * dom/Element.h:
</del><ins>+2013-05-03  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-04  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Remove concept of younger and older shadow trees
+        https://bugs.webkit.org/show_bug.cgi?id=115570
</ins><span class="cx"> 
</span><del>-        Remove Document::idAttributeName().
-        &lt;https://webkit.org/b/129663&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke &quot;DYEB&quot; Niwa.
</del><ins>+        Younger and older shadow trees are an obscure corner of the Shadow DOM spec.
+        
+        Support only one shadow tree per element. This simplifies many things. 
</ins><span class="cx"> 
</span><del>-        This abstraction is not actually used and causes unnecessary indirection
-        in some pretty hot code paths.
-
-        Replace it with hard-coded HTMLNames::idAttr instead which is a compile
-        time constant pointer. We can revisit this in the future if we wish to
-        implement support for custom id attributes.
-
-        * dom/Attr.cpp:
-        (WebCore::Attr::isId):
</del><ins>+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseChild):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingInCurrentTree):
+        (WebCore):
+        (WebCore::ComposedShadowTreeWalker::traverseParent):
+        (WebCore::ComposedShadowTreeWalker::traverseParentInCurrentTree):
+        (WebCore::ComposedShadowTreeWalker::traverseParentBackToShadowRootOrHost):
+        * dom/ComposedShadowTreeWalker.h:
+        (WebCore::ComposedShadowTreeWalker::assertPrecondition):
+        (ComposedShadowTreeWalker):
+        * dom/ContainerNodeAlgorithms.cpp:
+        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument):
+        (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoTree):
+        (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument):
+        (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromTree):
+        (WebCore::ChildFrameDisconnector::collectFrameOwners):
+        (WebCore::assertConnectedSubrameCountIsConsistent):
</ins><span class="cx">         * dom/Document.cpp:
</span><del>-        (WebCore::Document::Document):
-        * dom/Document.h:
</del><ins>+        (WebCore::Document::buildAccessKeyMap):
</ins><span class="cx">         * dom/Element.cpp:
</span><del>-        (WebCore::Element::attributeChanged):
-        (WebCore::Element::willModifyAttribute):
</del><ins>+        (WebCore::Element::authorShadowRoot):
+        (WebCore::Element::userAgentShadowRoot):
+        (WebCore::Element::ensureUserAgentShadowRoot):
</ins><span class="cx">         * dom/Element.h:
</span><del>-        (WebCore::Element::getIdAttribute):
-        (WebCore::Element::getNameAttribute):
-        (WebCore::Element::setIdAttribute):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseAttribute):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseAttribute):
-        * html/HTMLMapElement.cpp:
-        (WebCore::HTMLMapElement::parseAttribute):
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::attributeChanged):
-        (WebCore::SVGElement::isKnownAttribute):
-        (WebCore::SVGElement::svgAttributeChanged):
-
-2014-03-04  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-
-        REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore::StyledElement::attributeChanged
-        https://bugs.webkit.org/show_bug.cgi?id=129550
-
-        Reviewed by Andreas Kling.
-
-        We can't store a reference to QualifiedName here because ensureUniqueElementData could delete QualifiedName inside Attribute.
-
-        Test: fast/dom/uniquing-attributes-via-setAttribute.html
-
-        * dom/Element.cpp:
-        (WebCore::Element::setAttributeInternal):
-
-2014-03-04  Hyowon Kim  &lt;hw1008.kim@samsung.com&gt;
-
-        Move EvasGLContext and EvasGLSurface files into the efl common directory.
-        https://bugs.webkit.org/show_bug.cgi?id=129603
-
-        Reviewed by Gyuyoung Kim.
-
-        EFL port will use EvasGLContext and EvasGLSurface files in both WK1 and WK2.
-
-        No new tests, just refactorings.
-
-        * PlatformEfl.cmake:
-        * platform/graphics/efl/EvasGLContext.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/EvasGLContext.cpp.
-        (WebKit::EvasGLContext::EvasGLContext):
-        (WebKit::EvasGLContext::~EvasGLContext):
-        * platform/graphics/efl/EvasGLContext.h: Renamed from Source/WebKit2/UIProcess/API/efl/EvasGLContext.h.
-        (WebKit::EvasGLContext::create):
-        (WebKit::EvasGLContext::context):
-        * platform/graphics/efl/EvasGLSurface.cpp: Renamed from Source/WebKit2/UIProcess/API/efl/EvasGLSurface.cpp.
-        (WebKit::EvasGLSurface::EvasGLSurface):
-        (WebKit::EvasGLSurface::~EvasGLSurface):
-        * platform/graphics/efl/EvasGLSurface.h: Renamed from Source/WebKit2/UIProcess/API/efl/EvasGLSurface.h.
-        (WebKit::EvasGLSurface::create):
-        (WebKit::EvasGLSurface::surface):
-
-2014-03-03  Martin Robinson  &lt;mrobinson@igalia.com&gt;
-
-        Fix the GTK+ CMake build
-
-        * PlatformGTK.cmake: Add a missing file to the source list.
-
-2014-03-03  Sanghyup Lee  &lt;sh53.lee@samsung.com&gt;
-
-        :active style is not cleared when its display property is set to none before mouse released.
-        https://bugs.webkit.org/show_bug.cgi?id=129465
-
-        Reviewed by Antonio Gomes.
-
-        Source/WebCore:
-
-        We currently clearing the :active style when element has a renderer.
-        This patch makes elements clear its active style regardless of renderer. 
-
-        * dom/Document.cpp:
-        (WebCore::Document::updateHoverActiveState):
-
-        LayoutTests:
-
-        * fast/css/active-display-none-expected.txt: Added.
-        * fast/css/active-display-none.html: Added.
-
-
-2014-03-03  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Remove 2 unnecessary includes from JSDOMBinding.h
-        &lt;https://webkit.org/b/129619&gt;
-
-        Reviewed by Antti Koivisto.
-
-        * bindings/js/JSDOMBinding.h:
-
-2014-03-03  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-
-        GraphicsContext::drawLineForText needs to be exported from WebCore.dylib for iOS builds
-        https://bugs.webkit.org/show_bug.cgi?id=129647
-
-        Reviewed by NOBODY (This is a build fix).
-
-        Fixing after r165025 and r165016.
-
-        No new tests as this is a build fix.
-
-        * WebCore.exp.in:
-
-2014-03-03  Jer Noble  &lt;jer.noble@apple.com&gt;
-
-        [iOS] Start playback button misplaced
-        https://bugs.webkit.org/show_bug.cgi?id=129628
-
-        Reviewed by Simon Fraser.
-
-        On YouTube embeds, while the video is loading it is placed into the DOM with a 0x0 size.
-        This causes the start playback button to be visible in the upper-left corner of the embed
-        area. The button wasn't visible previously (in plugin mode) because the plugin clipped its
-        drawing to its bounds, and so the &lt;video&gt; shadow should do the same.
-
-        * Modules/mediacontrols/mediaControlsiOS.css:
-        (::-webkit-media-controls):
-
-2014-03-03  Enrica Casucci  &lt;enrica@apple.com&gt;
-
-        Build fix for iOS simulator.
-
-        * WebCore.exp.in:
-
-2014-03-03  Jeremy Jones  &lt;jeremyj@apple.com&gt;
-
-        Forward application suspend resume notifications to the web process.
-        https://bugs.webkit.org/show_bug.cgi?id=129356
-
-        Reviewed by Eric Carlson.
-
-        * platform/audio/ios/MediaSessionManagerIOS.mm:
-        (-[WebMediaSessionHelper initWithCallback:]):
-        Observe UIApplicationDidBecomeActiveNotification,
-        WebUIApplicationDidBecomeActiveNotification,
-        WebUIApplicationWillEnterForegroundNotification, and
-        WebUIApplicationWillResignActiveNotification
</del><ins>+        (Element):
+        (WebCore::Element::hasAuthorShadowRoot):
+        * dom/Element.idl:
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::addShadowRoot):
</ins><span class="cx">         
</span><del>-        (-[WebMediaSessionHelper applicationDidBecomeActive:]):
-        Resume session.
-
-2014-03-03  Commit Queue  &lt;commit-queue@webkit.org&gt;
-
-        Unreviewed, rolling out r165013.
-        http://trac.webkit.org/changeset/165013
-        https://bugs.webkit.org/show_bug.cgi?id=129646
-
-        New code is not thread safe, asserting on a worker test
-        (Requested by ap on #webkit).
-
-        * WebCore.exp.in:
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI):
-        * html/DOMURL.cpp:
-        (WebCore::DOMURL::revokeObjectURL):
-        * inspector/InspectorPageAgent.cpp:
-        (WebCore::InspectorPageAgent::cachedResource):
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::replayXHR):
-        * loader/DocumentLoader.cpp:
-        (WebCore::areAllLoadersPageCacheAcceptable):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::tellClientAboutPastMemoryCacheLoads):
-        * loader/ImageLoader.cpp:
-        (WebCore::ImageLoader::updateFromElement):
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::create):
-        * loader/cache/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet):
-        * loader/cache/CachedCSSStyleSheet.h:
-        * loader/cache/CachedFont.cpp:
-        (WebCore::CachedFont::CachedFont):
-        * loader/cache/CachedFont.h:
-        * loader/cache/CachedImage.cpp:
-        (WebCore::CachedImage::CachedImage):
-        * loader/cache/CachedImage.h:
-        * loader/cache/CachedRawResource.cpp:
-        (WebCore::CachedRawResource::CachedRawResource):
-        * loader/cache/CachedRawResource.h:
-        * loader/cache/CachedResource.cpp:
-        (WebCore::CachedResource::CachedResource):
-        (WebCore::CachedResource::~CachedResource):
-        * loader/cache/CachedResource.h:
-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::createResource):
-        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
-        (WebCore::CachedResourceLoader::requestResource):
-        (WebCore::CachedResourceLoader::revalidateResource):
-        (WebCore::CachedResourceLoader::loadResource):
-        * loader/cache/CachedResourceLoader.h:
-        * loader/cache/CachedSVGDocument.cpp:
-        (WebCore::CachedSVGDocument::CachedSVGDocument):
-        * loader/cache/CachedSVGDocument.h:
-        * loader/cache/CachedScript.cpp:
-        (WebCore::CachedScript::CachedScript):
-        * loader/cache/CachedScript.h:
-        * loader/cache/CachedTextTrack.cpp:
-        (WebCore::CachedTextTrack::CachedTextTrack):
-        * loader/cache/CachedTextTrack.h:
-        * loader/cache/CachedXSLStyleSheet.cpp:
-        (WebCore::CachedXSLStyleSheet::CachedXSLStyleSheet):
-        * loader/cache/CachedXSLStyleSheet.h:
-        * loader/cache/MemoryCache.cpp:
-        (WebCore::MemoryCache::add):
-        (WebCore::MemoryCache::revalidationSucceeded):
-        (WebCore::MemoryCache::resourceForURL):
-        (WebCore::MemoryCache::resourceForRequest):
-        (WebCore::MemoryCache::addImageToCache):
-        (WebCore::MemoryCache::removeImageFromCache):
-        (WebCore::MemoryCache::evict):
-        (WebCore::MemoryCache::removeResourcesWithOrigin):
-        (WebCore::MemoryCache::getOriginsWithCache):
-        (WebCore::MemoryCache::removeUrlFromCache):
-        (WebCore::MemoryCache::removeRequestFromCache):
-        (WebCore::MemoryCache::removeRequestFromCacheImpl):
-        (WebCore::MemoryCache::crossThreadRemoveRequestFromCache):
-        (WebCore::MemoryCache::getStatistics):
-        (WebCore::MemoryCache::setDisabled):
-        * loader/cache/MemoryCache.h:
-        * platform/CrossThreadCopier.cpp:
-        * platform/CrossThreadCopier.h:
-        * platform/network/cf/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest):
-        * rendering/RenderSnapshottedPlugIn.cpp:
-        (WebCore::RenderSnapshottedPlugIn::updateSnapshot):
-        * testing/Internals.cpp:
-        (WebCore::Internals::isLoadingFromMemoryCache):
-
-2014-03-03  Sam Weinig  &lt;sam@webkit.org&gt;
-
-        Fix the iOS Simulator build.
-
-        * WebCore.exp.in:
-
-2014-03-03  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-
-        Space between double underlines does not scale with font size
-        https://bugs.webkit.org/show_bug.cgi?id=129521
-
-        Reviewed by Simon Fraser.
-
-        This patch moves the logic about how far to draw the second underline (when text-decoration-style: double
-        is specified) from InlineTextBox to GraphicsContext, because GraphicsContext is the authoritative source
-        about how thick underlines should be. The space between the two underlines is set to the thickness of
-        each of the underlines.
-
-        This patch also deletes some unused code in InlineTextBox that was never getting triggered, in addition
-        to unifying drawLineForText with drawLinesForText. This didn't have any performance impact in my testing.
-
-        Test: fast/css3-text/css3-text-decoration/text-decoration-style-double-space-scales.html
-
-        * platform/graphics/GraphicsContext.h: drawLineForText takes a boolean for if we should draw double
-        underlines.
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::drawLinesForText):
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::drawLineForText):
-        * platform/graphics/wince/GraphicsContextWinCE.cpp:
-        (WebCore::GraphicsContext::drawLineForText):
-        * rendering/InlineTextBox.cpp: Use new boolean argument
-        (WebCore::drawSkipInkUnderline):
-        (WebCore::InlineTextBox::paintDecoration):
-
-2014-02-28  Chris Fleizach  &lt;cfleizach@apple.com&gt;
-
-        AX: Support IOS Accessibility in WK2
-        https://bugs.webkit.org/show_bug.cgi?id=129527
-
-        Reviewed by Sam Weinig.
-
-        Update the iOS wrapper so that it can convert points to screen space in WebKit2.
-
-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
-        (-[WebAccessibilityObjectWrapper convertRectToScreenSpace:]):
-
-2014-03-03  Martin Hock  &lt;mhock@apple.com&gt;
-
-        Add support for sessions to MemoryCache.
-        https://bugs.webkit.org/show_bug.cgi?id=127794
-
-        Reviewed by Sam Weinig.
-
-        * WebCore.exp.in:
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI): Initialize CachedImage with sessionID.
-        * html/DOMURL.cpp:
-        (WebCore::DOMURL::revokeObjectURL): Remove URL from MemoryCache for all sessions.
-        * inspector/InspectorPageAgent.cpp:
-        (WebCore::InspectorPageAgent::cachedResource): Pass sessionID to MemoryCache.
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::replayXHR): Ditto.
-        * loader/DocumentLoader.cpp:
-        (WebCore::areAllLoadersPageCacheAcceptable): Ditto.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::tellClientAboutPastMemoryCacheLoads): Ditto.
-        * loader/ImageLoader.cpp:
-        (WebCore::ImageLoader::updateFromElement): Initialize CachedImage with sessionID.
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::create): Pass sessionID to MemoryCache.
-        * loader/cache/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet): Constructor takes sessionID.
-        * loader/cache/CachedCSSStyleSheet.h:
-        * loader/cache/CachedFont.cpp: Ditto.
-        (WebCore::CachedFont::CachedFont):
-        * loader/cache/CachedFont.h:
-        * loader/cache/CachedImage.cpp: Ditto.
-        (WebCore::CachedImage::CachedImage):
-        * loader/cache/CachedImage.h:
-        * loader/cache/CachedRawResource.cpp: Ditto.
-        (WebCore::CachedRawResource::CachedRawResource):
-        * loader/cache/CachedRawResource.h:
-        * loader/cache/CachedResource.cpp: Ditto.
-        (WebCore::CachedResource::CachedResource):
-        (WebCore::CachedResource::~CachedResource): Pass sessionID to MemoryCache.
-        * loader/cache/CachedResource.h:
-        (WebCore::CachedResource::sessionID):
-        * loader/cache/CachedResourceLoader.cpp:
-        (WebCore::createResource): Constructors take sessionID.
-        (WebCore::CachedResourceLoader::sessionID): Retrieve sessionID from page.
-        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Pass sessionID to MemoryCache.
-        (WebCore::CachedResourceLoader::requestResource): Initialize CachedCSSStyleSheet with sessionID.
-        (WebCore::CachedResourceLoader::revalidateResource): Initialize cached resource with sessionID.
-        (WebCore::CachedResourceLoader::loadResource): Pass sessionID to MemoryCache and initialize cached resource with sessionID.
-        * loader/cache/CachedResourceLoader.h:
-        * loader/cache/CachedSVGDocument.cpp: Constructor takes sessionID.
-        (WebCore::CachedSVGDocument::CachedSVGDocument):
-        * loader/cache/CachedSVGDocument.h:
-        * loader/cache/CachedScript.cpp: Ditto.
-        (WebCore::CachedScript::CachedScript):
-        * loader/cache/CachedScript.h:
-        * loader/cache/CachedTextTrack.cpp: Ditto.
-        (WebCore::CachedTextTrack::CachedTextTrack):
-        * loader/cache/CachedTextTrack.h:
-        * loader/cache/CachedXSLStyleSheet.cpp: Ditto.
-        (WebCore::CachedXSLStyleSheet::CachedXSLStyleSheet):
-        * loader/cache/CachedXSLStyleSheet.h:
-        * loader/cache/MemoryCache.cpp:
-        (WebCore::MemoryCache::getSessionMap): Retrieve CachedResourceMap based on sessionID.
-        (WebCore::MemoryCache::add): Use sessionID from CachedResource parameter.
-        (WebCore::MemoryCache::revalidationSucceeded): Add sessionID parameter.
-        (WebCore::MemoryCache::resourceForURL): Ditto.
-        (WebCore::MemoryCache::resourceForRequest): Ditto, also move impl into impl method.
-        (WebCore::MemoryCache::resourceForRequestImpl): Add CachedResourceMap parameter.
-        (WebCore::MemoryCache::addImageToCache): Use default sessionID.
-        (WebCore::MemoryCache::removeImageFromCache): Ditto.
-        (WebCore::MemoryCache::evict): Use sessionID from CachedResource parameter.
-        (WebCore::MemoryCache::removeResourcesWithOrigin): Iterate through all CachedResourceMaps.
-        (WebCore::MemoryCache::getOriginsWithCache): Ditto.
-        (WebCore::MemoryCache::removeUrlFromCache): Add sessionID parameter.
-        (WebCore::MemoryCache::removeRequestFromCache): Ditto.
-        (WebCore::MemoryCache::removeRequestFromCacheImpl): Ditto.
-        (WebCore::MemoryCache::removeRequestFromSessionCaches): Iterate through all CachedResourceMaps.
-        (WebCore::MemoryCache::crossThreadRemoveRequestFromCache): Add sessionID parameter.
-        (WebCore::MemoryCache::getStatistics): Iterate through all CachedResourceMaps.
-        (WebCore::MemoryCache::setDisabled): Ditto.
-        * loader/cache/MemoryCache.h: Create another level for cache.
-        * platform/CrossThreadCopier.cpp: Allow copying SessionIDs across threads.
-        (WebCore::SessionID&gt;::copy):
-        * platform/CrossThreadCopier.h:
-        * platform/network/cf/ResourceRequest.h:
-        (WebCore::ResourceRequest::ResourceRequest): Remove trailing whitespace.
-        * rendering/RenderSnapshottedPlugIn.cpp:
-        (WebCore::RenderSnapshottedPlugIn::updateSnapshot): Initialize CachedImage with sessionID.
-        * testing/Internals.cpp:
-        (WebCore::Internals::isLoadingFromMemoryCache): Pass sessionID to MemoryCache.
-
-2014-03-03  Andreas Kling  &lt;akling@apple.com&gt;
-
-        Remove unused DataView code from JSDOMBinding.h
-        &lt;https://webkit.org/b/129616&gt;
-
-        Reviewed by Antti Koivisto.
-
-        * bindings/js/JSDOMBinding.h:
-
-2014-03-03  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Allow overflow-scroll to be one-finger scrolled until we hook up UIScrollViews
-        https://bugs.webkit.org/show_bug.cgi?id=129621
-
-        Reviewed by Benjamin Poulain.
-
-        Temporary change to allow overflow:scroll to be scrolled in iOS WK2.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hasAcceleratedTouchScrolling):
-
-2014-03-03  Antti Koivisto  &lt;antti@apple.com&gt;
-
-        Find results on simple lines are not marked correctly
-        https://bugs.webkit.org/show_bug.cgi?id=129586
-
-        Reviewed by Andreas Kling.
-
-        Tests: editing/text-iterator/count-mark-lineboxes.html
-               editing/text-iterator/count-mark-simple-lines.html
-               
-        TextIterator operating on simple lines failed to take the end of the range into account.
-        This also causes performance issues on long documents as range traversals would miss the end
-        node and end up going through the entire document.
-
-        * editing/TextIterator.cpp:
-        (WebCore::TextIterator::handleTextNode):
</del><ins>+        Allow only one ShadowRoot per ElementShadow. Remove linked list handling.
</ins><span class="cx">         
</span><del>-            Stop when hitting the range end on simple text nodes.
-
-        (WebCore::SimplifiedBackwardsTextIterator::handleTextNode):
</del><ins>+        (WebCore::ElementShadow::removeAllShadowRoots):
+        (WebCore::ElementShadow::attach):
+        (WebCore::ElementShadow::detach):
+        (WebCore::ElementShadow::childNeedsStyleRecalc):
+        (WebCore::ElementShadow::needsStyleRecalc):
+        (WebCore::ElementShadow::recalcStyle):
+        (WebCore::ElementShadow::removeAllEventListeners):
+        * dom/ElementShadow.h:
+        (WebCore::ElementShadow::shadowRoot):
+        (ElementShadow):
+        (WebCore::ElementShadow::host):
+        (WebCore::Node::shadowRoot):
+        (WebCore):
+        * dom/Node.cpp:
+        (WebCore):
+        (WebCore::Node::showNodePathForThis):
+        (WebCore::traverseTreeAndMark):
+        (WebCore::showSubTreeAcrossFrame):
+        * dom/Node.h:
+        (Node):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::insertedInto):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
</ins><span class="cx">         
</span><del>-            Use hasRenderedText test instead of linebox-only firstTextBox.
-
</del><ins>+            Remove LinkedList base.
+        
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        (WebCore::TreeScopeAdopter::moveTreeToNewDocument):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::distribute):
+        (WebCore::ContentDistributor::invalidate):
+        (WebCore::ContentDistributor::ensureSelectFeatureSet):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * page/FocusController.cpp:
+        (WebCore::FocusNavigationScope::FocusNavigationScope):
+        (WebCore::FocusNavigationScope::focusNavigationScopeOwnedByShadowHost):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::uploadButton):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::updateReferencedText):
+        (WebCore::SVGTRefElement::detachTarget):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::clearResourceReferences):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree):
+        (WebCore::SVGUseElement::buildShadowTree):
</ins><span class="cx">         * testing/Internals.cpp:
</span><del>-        (WebCore::Internals::countMatchesForText):
</del><ins>+        (WebCore::Internals::ensureShadowRoot):
+        (WebCore::Internals::shadowRoot):
+        (WebCore):
</ins><span class="cx">         * testing/Internals.h:
</span><ins>+        (Internals):
</ins><span class="cx">         * testing/Internals.idl:
</span><del>-        
-            Add testing interface for counting and marking matches.
</del><span class="cx"> 
</span><del>-2014-03-03  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+2013-05-03  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        SelectorQuery failing RightMostWithIdMatch are compiling their selectors for each execution
-        https://bugs.webkit.org/show_bug.cgi?id=129601
</del><ins>+        Simplify the #ifdefs in GraphicsContext3D.h
+        https://bugs.webkit.org/show_bug.cgi?id=115568
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Reviewed by Daniel Bates.
</ins><span class="cx"> 
</span><del>-        This caused a regression after r164924 for documents in quirks mode. Since those always fail
-        selectorForIdLookup(), they ended up compiling the selector every time they were called.
</del><ins>+        * platform/graphics/GraphicsContext3D.h:
+        (GraphicsContext3D): Combine #ifdefs paths that have a common
+        implementation. This reduces the #ifdef paths from many to just three.
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+        (WebCore::GraphicsContext3D::platformTexture): Move the implementation
+        here to simplify the header.
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        (WebCore::GraphicsContext3D::platformTexture): Ditto.
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        * dom/SelectorQuery.cpp:
-        (WebCore::SelectorDataList::execute):
</del><ins>+2013-05-03  Brendan Long  &lt;b.long@cablelabs.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-01  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        [Qt] Build with --video-track fails because String(AtomicString) is ambiguous
+        https://bugs.webkit.org/show_bug.cgi?id=115551
</ins><span class="cx"> 
</span><del>-        [Mac] Crash in MediaPlayer::rateChanged()
-        https://bugs.webkit.org/show_bug.cgi?id=129548
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::configureTextTrackGroup):
+        Change String(textTrack-&gt;kind()) to textTrack-&gt;kind().string(), and same thing with language.
</ins><span class="cx"> 
</span><del>-        WTF::bind will automatically ref the parameters added to it. But MediaPlayerPrivate-
-        AVFoundation and -MediaSOurceAVFObjC are not RefCounted, so by the time the bound
-        function is called, the underlying objects may have been freed.
</del><ins>+2013-05-03  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace or augment callOnMainThread arguments with lambdas and weakPtrs so that
-        if the argument has been destroyed, its methods will not be called.
</del><ins>+        [GStreamer] GStreamer log crashes in MediaPlayerPrivateGStreamerBase because of uninitialized category
+        https://bugs.webkit.org/show_bug.cgi?id=115575
</ins><span class="cx"> 
</span><del>-        Make the MediaPlayerPrivateAVFoundation::Notification function type a std::function:
-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
-        (WebCore::MediaPlayerPrivateAVFoundation::Notification::Notification):
-        (WebCore::MediaPlayerPrivateAVFoundation::Notification::function):
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        Make createWeakPtr() public so that it can be called from non-class methods:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createWeakPtr): 
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::createWeakPtr): 
</del><ins>+        No new tests needed.
</ins><span class="cx"> 
</span><del>-        Use a weakPtr to abort callOnMainThread() if the object has been destroyed:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::CMTimebaseEffectiveRateChangedCallback):
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::play):
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::pause):
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekWithTolerance):
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        Using extern debug category.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
+        Declaring debug category as not static.
</ins><span class="cx"> 
</span><del>-2014-02-28  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2013-05-03  Brent Fulgham  &lt;bfulgham@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [MSE] YouTube videos fail to play
-        https://bugs.webkit.org/show_bug.cgi?id=129525
</del><ins>+        [WinCairo] Unreviewed VS2010 Build Correction.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Exclude CG-only
+        SubimageCacheWithTimer.cpp from WinCairo build.
</ins><span class="cx"> 
</span><del>-        Test: media/media-source/media-source-fudge-factor.html
</del><ins>+2013-05-03  Viatcheslav Ostapenko  &lt;viatchslav.o@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Add a very simple playability metric to SourceBuffer. Track the number of seconds buffered
-        and use that metric to determine whether the MediaSource has buffered enough data to play
-        through.
</del><ins>+        [Cairo] Anti-aliasing should not be always disabled for lines
+        https://bugs.webkit.org/show_bug.cgi?id=109535
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/MediaSource.cpp:
-        (WebCore::MediaSource::currentTime): Added simple accessor.
-        (WebCore::MediaSource::monitorSourceBuffers): Replace the functor-based iterators with lambdas.
-        (WebCore::MediaSource::addSourceBuffer): Drive-by fix; only add new source buffers to the
-            activeSourceBuffers list if those buffers are actually active.
-        * Modules/mediasource/MediaSource.h:
-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::SourceBuffer): Initialize new ivars.
-        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Measure the number of seconds buffered.
-        (WebCore::SourceBuffer::monitorBufferingRate): Use a simple Exponential moving average to
-            track the buffering rate.
-        (WebCore::SourceBuffer::hasCurrentTime): Return true if the current time is within 1/24 s
-            of a buffered range.
-        (WebCore::SourceBuffer::hasFutureTime): Moved from MediaSource.
-        (WebCore::SourceBuffer::canPlayThrough): Return true if the buffering rate is &gt; 1s per
-            second, or if the rate is sufficient to keep up over the remaining time.
-        * Modules/mediasource/SourceBuffer.h:
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-2014-03-03  Bear Travis  &lt;betravis@adobe.com&gt;
</del><ins>+        Don't disable antialiasing for text lines because it produces ugly picture if
+        page is scaled.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Serialize circle positions
-        https://bugs.webkit.org/show_bug.cgi?id=129404
</del><ins>+        Test: fast/css3-text/css3-text-decoration/text-decoration-line-scaled.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::drawLineOnCairoContext):
</ins><span class="cx"> 
</span><del>-        Circle positions should always be present when serialized, and should
-        only have the 2 or 4-valued form. Keywords are converted to percentages
-        and simplified where possible. This patch adds some additional processing
-        that converts the parsed position into the serialized format, before
-        converting it to text. See http://dev.w3.org/csswg/css-shapes/#basic-shape-serialization.
</del><ins>+2013-05-03  Daniel Bates  &lt;dbates@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Updated existing parsing tests.
</del><ins>+        Remove unnecessary include HTMLNames.h from RenderThemeGtk.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=115571
</ins><span class="cx"> 
</span><del>-        * css/CSSBasicShapes.cpp:
-        (WebCore::serializePositionOffset): Convert a position offset to a serialized string.
-        The offset must be a pair, as generated by buildSerializablePositionOffset.
-        (WebCore::buildSerializablePositionOffset): Generates a keyword + offset pair for each
-        position offset. The keywords may later be dropped during serialization.
-        (WebCore::CSSBasicShapeCircle::cssText): Use the new serialization methods.
-
-2014-03-03  Lorenzo Tilve  &lt;ltilve@igalia.com&gt;
-
-        Optimize StylePropertiesSet::findPropertyIndex() to improve CSS properties performance
-        https://bugs.webkit.org/show_bug.cgi?id=129605
-
-        Reviewed by Andreas Kling.
-
-        Merged from Blink (patch by Mikhail Pozdnyakov):
-        https://src.chromium.org/viewvc/blink?view=revision&amp;revision=167325
-
-        Avoid checking whether 'StylePropertiesSet' is mutable and accesing directly to its
-        data members to achieve performance improvements
-
-        Before the optimization applied:
-            mean: 3064.8337171934063 runs/s
-            median: 3097.5899379343855 runs/s
-            stdev: 66.89274074044187 runs/s
-            min: 2891.7479324362585 runs/s
-            max: 3113.288683440125 runs/s
-
-        After the optimization applied:
-            mean: 3343.8356114138105 runs/s
-            median: 3356.25682957446 runs/s
-            stdev: 36.297533087489036 runs/s
-            min: 3238.5468032264243 runs/s
-            max: 3368.664837531425 runs/s
-
-        Performance gain for the average value is approx. 9.1%, in the
-        range of the 10% - 8.2% for the min and max measured
-        values (Linux desktop x64).
-
-        * css/StyleProperties.cpp:
-        (WebCore::ImmutableStyleProperties::findPropertyIndex):
-        (WebCore::MutableStyleProperties::findPropertyIndex):
-        * css/StyleProperties.h:
-        (WebCore::toMutableStyleProperties):
-        (WebCore::toImmutableStyleProperties):
-        (WebCore::StyleProperties::findPropertyIndex):
-
-2014-03-03  Brian Burg  &lt;bburg@apple.com&gt;
-
-        Unreviewed build fix for Windows after r164986.
-
-        * WebCore.vcxproj/build-generated-files.sh: Export WebReplayScripts
-        so that the build system knows how to find CodeGeneratorReplayInputs.py.
-
-2014-03-03  Andrei Bucur  &lt;abucur@adobe.com&gt;
-
-        [CSS Regions] Overset computation is incorrect in some cases
-        https://bugs.webkit.org/show_bug.cgi?id=129032
-
-        Reviewed by Mihnea Ovidenie.
-
-        This patch reworks the way overset is computed for regions and named flows.
-
-        1. Regions overflow no longer trigger an overset changed event. This is because
-        the overflow of a box is contained within the region range of the box. The content
-        edge should be considered the logical bottom position of the content inside the
-        flow thread.
-
-        2. The regions events logic was moved from RenderFlowThread to RenderNamedFlowThread
-        and from RenderRegion to RenderNamedFlowFragment (including the regionOverset property).
-
-        3. The overset value of the named flow is no longer stored in the named flow. It is
-        extracted from the overset of the last region in the chain.
-
-        4. The regions overset is not computed every time the flow thread is laid out which
-        should improve performance for flows with many regions. With the patch, each region
-        computes the overset value during its layout when the flow thread is in the overflow
-        or the final layout phase.
-
-        5. The overset changed event is dispatched only at the end of the layout of the named flows,
-        after all the region overset changes have been considered. This means that the overset
-        event can't be dispatched in the middle of the auto-height processing algorithm that
-        requires multiple layout passes for the flow threads.
-
-        However, the region layout update event dispatch timing was not changed, it is dispatched
-        every time the flow thread has a layout. This preserves the current behavior of the event.
-
-        Tests: The old tests were modified to take into account the change.
-
-        * dom/Element.cpp:
-        (WebCore::Element::webkitRegionOverset):
-        * dom/WebKitNamedFlow.cpp:
-        (WebCore::WebKitNamedFlow::overset):
-        * inspector/InspectorCSSAgent.cpp:
-        (WebCore::InspectorCSSAgent::buildArrayForRegions):
-        * rendering/FlowThreadController.cpp:
-        (WebCore::FlowThreadController::updateFlowThreadsIntoMeasureContentPhase):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::computeOverflow):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::RenderFlowThread):
-        (WebCore::RenderFlowThread::layout):
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::layoutBlock):
-        (WebCore::RenderNamedFlowFragment::setRegionOversetState):
-        (WebCore::RenderNamedFlowFragment::regionOversetState):
-        (WebCore::RenderNamedFlowFragment::updateOversetState):
-        * rendering/RenderNamedFlowFragment.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::RenderNamedFlowThread):
-        (WebCore::RenderNamedFlowThread::computeOverflow):
-        (WebCore::RenderNamedFlowThread::layout):
-        (WebCore::RenderNamedFlowThread::dispatchNamedFlowEvents):
-        (WebCore::RenderNamedFlowThread::dispatchRegionLayoutUpdateEventIfNeeded):
-        (WebCore::RenderNamedFlowThread::dispatchRegionOversetChangeEventIfNeeded):
-        * rendering/RenderNamedFlowThread.h:
-        There's a new field called m_flowContentBottom that tracks the content bottom of the flow thread
-        after layout. This value is used to compute the overset value of the regions because it's not
-        affected by relative positioning or visual overflow such as shadows.
-        * rendering/RenderRegion.cpp:
-        * rendering/RenderRegion.h:
-
-2014-03-03  Tomas Popela  &lt;tpopela@redhat.com&gt;
-
-        [GTK] CodeGeneratorGObject.pm remove usage of undefined variable
-        https://bugs.webkit.org/show_bug.cgi?id=129602
-
</del><span class="cx">         Reviewed by Martin Robinson.
</span><span class="cx"> 
</span><del>-        Remove usage of undefined variable hdrPropIncludes in CodeGeneratorGObject.pm
</del><ins>+        * platform/gtk/RenderThemeGtk.cpp:
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorGObject.pm:
-        (WriteData):
</del><ins>+2013-05-03  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-03  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        [Mac] setMetadataURL incorrectly treats path bytes as Latin-1
+        https://bugs.webkit.org/show_bug.cgi?id=115557
</ins><span class="cx"> 
</span><del>-        Web Replay: upstream input storage, capture/replay machinery, and inspector domain
-        https://bugs.webkit.org/show_bug.cgi?id=128782
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher, Joseph Pecoraro, and Andreas Kling.
</del><ins>+        * platform/mac/FileSystemMac.mm: (WebCore::setMetaData): Use the correct constructor.
</ins><span class="cx"> 
</span><del>-        No new tests yet, as they rely on infrastructure tracked in https://webkit.org/b/129190.
</del><ins>+2013-05-03  Andrei Bucur  &lt;abucur@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Replayable executions are organized into ReplaySessions, which can
-        contain several ReplaySessionSegments that divide overall execution
-        at main frame navigation boundaries. NondeterministicInput subclasses
-        are stored in SegmentedInputStorage according to the input's InputQueue.
</del><ins>+        Move pixelSnappedLayoutOverflowRect and maxLayoutOverflow from RenderBox
+        https://bugs.webkit.org/show_bug.cgi?id=115550
</ins><span class="cx"> 
</span><del>-        Capture and playback are controlled at the page granularity by the Page's
-        ReplayController. The controller knows how to create new segments, replay to
-        arbitrary positions in the ReplaySession, and track the active InputCursor.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        The capturing and replaying input cursor subclasses encapsulate state for
-        storing new inputs and loading/dispatching saved inputs, respectively.
</del><ins>+        The patch moves pixelSnappedLayoutOverflowRect and maxLayoutOverflow out
+        of RenderBox somewhere logically closer to their usage place.
</ins><span class="cx"> 
</span><del>-        The ReplayAgent and associated inspector protocol domain is the friendly
-        public API for programmatically capturing and replaying sessions.
</del><ins>+        pixelSnappedLayoutOverflowRect - moved to RenderView because it's called only
+        for RenderView at this moment.
+        There are other places when the overflow rect is pixel snapped but only after
+        the rect is adjusted for writing modes or inflated.
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make: Add replay inputs code generation target. Add the
-        replay domain specification to the list of inspector domains.
</del><ins>+        maxLayoutOverflow - moved to RenderTreeAsText.cpp as a static function because
+        it's used only there.
</ins><span class="cx"> 
</span><del>-        * ForwardingHeaders/replay/EncodedValue.h: Added.
-        * WebCore.xcodeproj/project.pbxproj: Add many files, and export
-        `WebReplayScripts` environment variable to DerivedSources.make.
</del><ins>+        Tests: no new functional change.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorController.cpp: Add the replay agent.
-        (WebCore::InspectorController::InspectorController):
</del><ins>+        * rendering/RenderBox.h: The functions declarations are removed.
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::maxLayoutOverflow): 
+        * rendering/RenderView.h:
+        (WebCore::RenderView::pixelSnappedLayoutOverflowRect):
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorInstrumentation.cpp:
-        Add events for segment lifecycle events, and loading/unloading of sessions
-        and segments, and capture/replay progress events. The replay controller
-        also needs to know about detached and committed frames.
</del><ins>+2013-05-03  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::InspectorInstrumentation::frameDetachedFromParentImpl):
-        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
-        (WebCore::InspectorInstrumentation::sessionCreatedImpl):
-        (WebCore::InspectorInstrumentation::sessionLoadedImpl):
-        (WebCore::InspectorInstrumentation::sessionModifiedImpl):
-        (WebCore::InspectorInstrumentation::segmentCreatedImpl):
-        (WebCore::InspectorInstrumentation::segmentCompletedImpl):
-        (WebCore::InspectorInstrumentation::segmentLoadedImpl):
-        (WebCore::InspectorInstrumentation::segmentUnloadedImpl):
-        (WebCore::InspectorInstrumentation::captureStartedImpl):
-        (WebCore::InspectorInstrumentation::captureStoppedImpl):
-        (WebCore::InspectorInstrumentation::playbackStartedImpl):
-        (WebCore::InspectorInstrumentation::playbackPausedImpl):
-        (WebCore::InspectorInstrumentation::playbackHitPositionImpl):
-        (WebCore::InspectorInstrumentation::replayAgentEnabled):
-        * inspector/InspectorInstrumentation.h:
-        (WebCore::InspectorInstrumentation::replayAgentEnabled):
-        (WebCore::InspectorInstrumentation::sessionCreated):
-        (WebCore::InspectorInstrumentation::sessionLoaded):
-        (WebCore::InspectorInstrumentation::sessionModified):
-        (WebCore::InspectorInstrumentation::segmentCreated):
-        (WebCore::InspectorInstrumentation::segmentCompleted):
-        (WebCore::InspectorInstrumentation::segmentLoaded):
-        (WebCore::InspectorInstrumentation::segmentUnloaded):
-        (WebCore::InspectorInstrumentation::captureStarted):
-        (WebCore::InspectorInstrumentation::captureStopped):
-        (WebCore::InspectorInstrumentation::playbackStarted):
-        (WebCore::InspectorInstrumentation::playbackPaused):
-        (WebCore::InspectorInstrumentation::playbackHitPosition):
</del><ins>+        StyleResolver: Have &quot;list of matched rules&quot; API vend internal types instead of CSSOM wrappers.
+        &lt;http://webkit.org/b/115563&gt;
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorReplayAgent.cpp: Added.
-        (WebCore::buildInspectorObjectForPosition):
-        (WebCore::buildInspectorObjectForInput):
-        (WebCore::buildInspectorObjectForSession):
-        (WebCore::SerializeInputToJSONFunctor::SerializeInputToJSONFunctor):
-        (WebCore::SerializeInputToJSONFunctor::~SerializeInputToJSONFunctor):
-        (WebCore::SerializeInputToJSONFunctor::operator()):
-        (WebCore::SerializeInputToJSONFunctor::returnValue):
-        (WebCore::buildInspectorObjectForSegment):
-        (WebCore::InspectorReplayAgent::InspectorReplayAgent):
-        (WebCore::InspectorReplayAgent::~InspectorReplayAgent):
-        (WebCore::InspectorReplayAgent::sessionState):
-        (WebCore::InspectorReplayAgent::didCreateFrontendAndBackend):
-        (WebCore::InspectorReplayAgent::willDestroyFrontendAndBackend):
-        (WebCore::InspectorReplayAgent::frameNavigated):
-        (WebCore::InspectorReplayAgent::frameDetached):
-        (WebCore::InspectorReplayAgent::sessionCreated):
-        (WebCore::InspectorReplayAgent::sessionModified):
-        (WebCore::InspectorReplayAgent::sessionLoaded):
-        (WebCore::InspectorReplayAgent::segmentCreated):
-        (WebCore::InspectorReplayAgent::segmentCompleted):
-        (WebCore::InspectorReplayAgent::segmentLoaded):
-        (WebCore::InspectorReplayAgent::segmentUnloaded):
-        (WebCore::InspectorReplayAgent::captureStarted):
-        (WebCore::InspectorReplayAgent::captureStopped):
-        (WebCore::InspectorReplayAgent::playbackStarted):
-        (WebCore::InspectorReplayAgent::playbackPaused):
-        (WebCore::InspectorReplayAgent::playbackHitPosition):
-        (WebCore::InspectorReplayAgent::startCapturing):
-        (WebCore::InspectorReplayAgent::stopCapturing):
-        (WebCore::InspectorReplayAgent::replayToPosition):
-        (WebCore::InspectorReplayAgent::replayToCompletion):
-        (WebCore::InspectorReplayAgent::pausePlayback):
-        (WebCore::InspectorReplayAgent::cancelPlayback):
-        (WebCore::InspectorReplayAgent::switchSession):
-        (WebCore::InspectorReplayAgent::insertSessionSegment):
-        (WebCore::InspectorReplayAgent::removeSessionSegment):
-        Provide a public API for modifying sessions. This is the backend support
-        for user editing of replay sessions to add/remove specific segments.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        (WebCore::InspectorReplayAgent::findSession):
-        (WebCore::InspectorReplayAgent::findSegment):
-        (WebCore::InspectorReplayAgent::getAvailableSessions):
-        (WebCore::InspectorReplayAgent::getSerializedSession):
-        (WebCore::InspectorReplayAgent::getSerializedSegment):
-        Most of the replay protocol domain speaks in terms of sesssion and
-        segment identifiers. These functions return the actual data associated
-        with these identifiers.
</del><ins>+        Change styleRulesForElement() and pseudoStyleRulesForElement() to return Vectors of StyleRuleBase
+        instead of CSSRuleLists. This defers instantiating CSSOM wrappers until they're actually needed
+        for exposure to web API.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorReplayAgent.h: Added.
-        * inspector/InstrumentingAgents.cpp:
-        (WebCore::InstrumentingAgents::InstrumentingAgents):
-        (WebCore::InstrumentingAgents::reset):
-        * inspector/InstrumentingAgents.h:
-        (WebCore::InstrumentingAgents::inspectorReplayAgent): Added.
-        (WebCore::InstrumentingAgents::setInspectorReplayAgent): Added.
-        * inspector/protocol/Replay.json: Added.
</del><ins>+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::getMatchedCSSRules):
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * page/Page.h:
-        (WebCore::Page::replayController): Added.
-        * platform/Logging.h: Add WebReplay logging channel.
-        * replay/AllReplayInputs.h: Added. Simplifies importing all input definitions.
</del><ins>+            Create a StaticCSSRuleList and populate it with CSSOM wrappers for the matched rules.
+            This is the one place where we expose this functionality to the web.
</ins><span class="cx"> 
</span><del>-        * replay/CapturingInputCursor.cpp: Added.
-        (WebCore::CapturingInputCursor::CapturingInputCursor):
-        (WebCore::CapturingInputCursor::~CapturingInputCursor):
-        (WebCore::CapturingInputCursor::create):
-        (WebCore::CapturingInputCursor::storeInput):
-        (WebCore::CapturingInputCursor::loadInput):
-        (WebCore::CapturingInputCursor::uncheckedLoadInput):
-        * replay/CapturingInputCursor.h: Added.
</del><ins>+        * css/ElementRuleCollector.h:
+        * css/ElementRuleCollector.cpp:
+        (WebCore::ElementRuleCollector::matchedRuleList):
+        (WebCore::ElementRuleCollector::sortAndTransferMatchedRules):
</ins><span class="cx"> 
</span><del>-        * replay/EventLoopInput.h:
-        (WebCore::EventLoopInputBase::EventLoopInputBase):
-        (WebCore::EventLoopInputBase::timestamp):
-        (WebCore::EventLoopInputBase::setTimestamp): Support deserialization.
</del><ins>+            Collect internal StyleRuleBase pointers here instead of creating wrappers.
</ins><span class="cx"> 
</span><del>-        * replay/EventLoopInputDispatcher.cpp: Added. This class encapsulates the timers
-        and measurements used to dispatch event loop inputs during replay.
</del><ins>+        * css/StyleResolver.h:
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::styleRulesForElement):
+        (WebCore::StyleResolver::pseudoStyleRulesForElement):
</ins><span class="cx"> 
</span><del>-        (WebCore::EventLoopInputDispatcher::EventLoopInputDispatcher):
-        (WebCore::EventLoopInputDispatcher::run):
-        (WebCore::EventLoopInputDispatcher::pause):
-        (WebCore::EventLoopInputDispatcher::timerFired):
-        (WebCore::EventLoopInputDispatcher::dispatchInputSoon):
-        (WebCore::EventLoopInputDispatcher::dispatchInput):
-        * replay/EventLoopInputDispatcher.h: Added.
-        (WebCore::EventLoopInputDispatcherClient::EventLoopInputDispatcherClient):
-        (WebCore::EventLoopInputDispatcherClient::~EventLoopInputDispatcherClient):
</del><ins>+            Vend said pointers.
</ins><span class="cx"> 
</span><del>-        * replay/FunctorInputCursor.h: Added.
-        (WebCore::FunctorInputCursor::~FunctorInputCursor):
-        (WebCore::FunctorInputCursor::forEachInputInQueue):
-        (WebCore::FunctorInputCursor::FunctorInputCursor):
-        (WebCore::FunctorInputCursor::storeInput):
-        (WebCore::FunctorInputCursor::loadInput):
-        (WebCore::FunctorInputCursor::uncheckedLoadInput):
</del><ins>+        * editing/EditingStyle.cpp:
+        (WebCore::styleFromMatchedRulesForElement):
</ins><span class="cx"> 
</span><del>-        * replay/ReplayController.cpp: Added.
-        (WebCore::ReplayController::ReplayController):
-        (WebCore::ReplayController::switchSession):
-        (WebCore::ReplayController::createSegment):
-        (WebCore::ReplayController::completeSegment):
-        (WebCore::ReplayController::loadSegment):
-        (WebCore::ReplayController::unloadSegment):
-        (WebCore::ReplayController::startCapturing):
-        (WebCore::ReplayController::stopCapturing):
-        (WebCore::ReplayController::startPlayback):
-        (WebCore::ReplayController::pausePlayback):
-        (WebCore::ReplayController::cancelPlayback):
-        (WebCore::ReplayController::replayToPosition):
-        (WebCore::ReplayController::frameDetached):
-        (WebCore::ReplayController::frameNavigated):
-        (WebCore::ReplayController::loadedSession):
-        (WebCore::ReplayController::loadedSegment):
-        (WebCore::ReplayController::activeInputCursor):
-        (WebCore::ReplayController::dispatcher):
-        (WebCore::ReplayController::willDispatchInput):
-        (WebCore::ReplayController::didDispatchInput):
-        (WebCore::ReplayController::didDispatchFinalInput):
-        * replay/ReplayController.h: Added.
-        (WebCore::ReplayPosition::ReplayPosition):
-        (WebCore::ReplayPosition::operator&lt;):
-        (WebCore::ReplayPosition::operator==):
</del><ins>+            Dodge CSSOM wrapper instantiation (Woop woop!)
</ins><span class="cx"> 
</span><del>-        * replay/ReplayInputCreationMethods.cpp: Added.
-        Static factory implementations for inputs belong here.
-        (WebCore::InitialNavigation::createFromPage):
</del><ins>+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::buildObjectForRule):
</ins><span class="cx"> 
</span><del>-        * replay/ReplayInputDispatchMethods.cpp: Added.
-        All dispatch() implementations for generated replay inputs belong here.
-        (WebCore::BeginSegmentSentinel::dispatch):
-        (WebCore::EndSegmentSentinel::dispatch):
-        (WebCore::InitialNavigation::dispatch):
</del><ins>+            Split buildObjectForRule() into two versions, one for CSSStyleRule and one for StyleRule.
+            The CSSStyleRule one doesn't need a special path for parent-less rules, since those always
+            come in through the StyleRule interface instead. This factoring can be improved further
+            after this change.
</ins><span class="cx"> 
</span><del>-        * replay/ReplayInputTypes.cpp:
-        (WebCore::ReplayInputTypes::ReplayInputTypes):
-        * replay/ReplayInputTypes.h: Define strings for WebCore inputs.
</del><ins>+        (WebCore::InspectorCSSAgent::getMatchedStylesForNode):
+        (WebCore::InspectorCSSAgent::buildArrayForRuleList):
+        (WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):
</ins><span class="cx"> 
</span><del>-        * replay/ReplaySession.cpp: Added.
-        (WebCore::ReplaySession::create):
-        (WebCore::ReplaySession::ReplaySession):
-        (WebCore::ReplaySession::~ReplaySession):
-        (WebCore::ReplaySession::appendSegment):
-        (WebCore::ReplaySession::insertSegment):
-        (WebCore::ReplaySession::removeSegment):
-        * replay/ReplaySession.h: Added.
-        (WebCore::ReplaySession::identifier):
-        (WebCore::ReplaySession::timestamp):
-        (WebCore::ReplaySession::size):
-        (WebCore::ReplaySession::at):
-        (WebCore::ReplaySession::begin):
-        (WebCore::ReplaySession::end):
</del><ins>+            Tweaked for changes in StyleResolver API.
</ins><span class="cx"> 
</span><del>-        * replay/ReplaySessionSegment.cpp: Added.
-        (WebCore::ReplaySessionSegment::create):
-        (WebCore::ReplaySessionSegment::ReplaySessionSegment):
-        (WebCore::ReplaySessionSegment::~ReplaySessionSegment):
-        (WebCore::ReplaySessionSegment::createCapturingCursor):
-        (WebCore::ReplaySessionSegment::createReplayingCursor):
-        (WebCore::ReplaySessionSegment::createFunctorCursor):
-        * replay/ReplaySessionSegment.h: Added.
-        (WebCore::ReplaySessionSegment::identifier):
-        (WebCore::ReplaySessionSegment::timestamp):
</del><ins>+2013-05-03  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * replay/ReplayingInputCursor.cpp: Added.
-        (WebCore::ReplayingInputCursor::ReplayingInputCursor):
-        (WebCore::ReplayingInputCursor::~ReplayingInputCursor):
-        (WebCore::ReplayingInputCursor::create):
-        (WebCore::ReplayingInputCursor::storeInput):
-        (WebCore::ReplayingInputCursor::loadInput):
-        (WebCore::ReplayingInputCursor::uncheckedLoadInput):
-        * replay/ReplayingInputCursor.h: Added.
</del><ins>+        REGRESSION (r145042): Downloading a file sometimes results in could not create
+        a sandbox extension Console message and file stays as a .download file
+        https://bugs.webkit.org/show_bug.cgi?id=115559
+        &lt;rdar://problem/13785101&gt;
</ins><span class="cx"> 
</span><del>-        * replay/SegmentedInputStorage.cpp: Added.
-        (WebCore::queueTypeToLogPrefix):
-        (WebCore::jsonStringForInput):
-        (WebCore::offsetForInputQueue):
-        (WebCore::SegmentedInputStorage::SegmentedInputStorage):
-        (WebCore::SegmentedInputStorage::~SegmentedInputStorage):
-        (WebCore::SegmentedInputStorage::load):
-        (WebCore::SegmentedInputStorage::store):
-        (WebCore::SegmentedInputStorage::queueSize):
-        * replay/SegmentedInputStorage.h: Added.
-
-        * replay/SerializationMethods.cpp: Added.
-        Specializations of EncodingTraits for WebCore types belong here.
-
-        (JSC::EncodingTraits&lt;NondeterministicInputBase&gt;::encodeValue):
-        (JSC::EncodingTraits&lt;NondeterministicInputBase&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;SecurityOrigin&gt;::encodeValue):
-        (JSC::EncodingTraits&lt;SecurityOrigin&gt;::decodeValue):
-        (JSC::EncodingTraits&lt;URL&gt;::encodeValue):
-        (JSC::EncodingTraits&lt;URL&gt;::decodeValue):
-        * replay/SerializationMethods.h: Added.
-        * replay/WebInputs.json: Added.
-        In this inital patch, we define BeginSegmentSentinel,
-        EndSegmentSentinel, and InitialNavigation inputs.
-
-2014-03-03  Antoine Quint  &lt;graouts@webkit.org&gt;
-
-        Respect SVG fragment identifiers in &lt;img&gt; src attribute
-        https://bugs.webkit.org/show_bug.cgi?id=129387
-
-        Reviewed by Dirk Schulze.
-
-        Following Dirk Schulze's suggestion, we set the URL on the SVGImage itself and handle the URL's
-        fragment identifier at draw time in the SVGImage itself, which will provide a sounder base for
-        handling of fragment identifier in SVG resource URLs in CSS properties, and should also deal
-        with the crasher reported in http://webkit.org/b/129498 since there is a guaranteed Frame at the
-        time we call SVGImage::draw().
-
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::draw):
-        * svg/graphics/SVGImage.h:
-        * svg/graphics/SVGImageForContainer.cpp:
-        * svg/graphics/SVGImageForContainer.h:
-
-2014-03-03  Laszlo Vidacs  &lt;lvidacs.u-szeged@partner.samsung.com&gt;
-
-        Move function calls outside loop in dom
-        https://bugs.webkit.org/show_bug.cgi?id=126525
-
-        Reviewed by Csaba Osztrogonác.
-
-        Store the result of length() in a local variable and use it in each iteration.
-
-        * dom/DOMImplementation.cpp:
-        (WebCore::DOMImplementation::isXMLMIMEType):
-        * dom/ElementData.cpp:
-        (WebCore::UniqueElementData::UniqueElementData):
-        * dom/EventContext.cpp:
-        (WebCore::TouchEventContext::checkReachability):
-
-2014-03-03  Tomas Popela  &lt;tpopela@redhat.com&gt;
-
-        [GTK] webkit_dom_range_compare_boundary_points fails when 0 is passed as how parameter
-        https://bugs.webkit.org/show_bug.cgi?id=129145
-
-        Reviewed by Carlos Garcia Campos.
-
-        While generating GObject DOM API the generator should skip non pointer
-        types while generating the g_return_val_if_fail macro.
-        This will avoid the situation when Range.START_TO_START is defined as 0,
-        thus the webkit_dom_range_compare_boundary_points function will fail
-        everytime it is called with 0 as how value.
-
-        * bindings/scripts/CodeGeneratorGObject.pm:
-        (GenerateFunction):
-
-2014-03-03  Jozsef Berta  &lt;jberta.u-szeged@partner.samsung.com&gt;
-
-        [cmake] *Names.cpp file should be regenerated after touching StaticString.pm
-        https://bugs.webkit.org/show_bug.cgi?id=129031
-
-        Reviewed by Csaba Osztrogonác.
-
-        * CMakeLists.txt: Added make_names.pl dependencies: bindings/scripts/Hasher.pm and bindings/scripts/StaticString.pm
-
-2014-03-03  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
-
-        [GTK] Multimedia controls captions icon needs its own metaphor
-        https://bugs.webkit.org/show_bug.cgi?id=129091
-
-        Reviewed by Martin Robinson.
-
-        As we got the new icon created, we used it with a fallback to the
-        old icon to keep run-time compatibility.
-
-        No new tests, current ones suffice.
-
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::paintMediaToggleClosedCaptionsButton):
-        Replicated RenderThemeGtk::paintMediaButton to check for the
-        necessary icon first and do the fallback to the old and stock
-        icons.
-        * platform/gtk/RenderThemeGtk2.cpp:
-        (WebCore::getStockIconForWidgetType): Added ASSERT for non-empty
-        icon name.
-        (WebCore::getStockSymbolicIconForWidgetType): Check for non empty
-        icon name before calling getStockIconForWidgetType. Fixed coding
-        style.
-        * platform/gtk/RenderThemeGtk3.cpp:
-        (WebCore::getStockIconForWidgetType): Added ASSERT for non-empty
-        icon name.
-        (WebCore::getStockSymbolicIconForWidgetType): Check for non empty
-        icon name before calling getStockIconForWidgetType. Fixed coding
-        style.
-
-2014-03-02  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
-
-        Add a fallback path for compiling the remaining attribute checkers
-        https://bugs.webkit.org/show_bug.cgi?id=129580
-
-        Reviewed by Darin Adler.
-
-        The remaining attribute checkers appear to be less common than the simple value match.
-        This patch adds them to SelectorCompiler for completeness but no attempt is made at optimizing them,
-        they all default to function calls.
-
-        If the assumption that those selectors are not common turn out to be incorrect, we should see
-        the function calls in profiles and optimize them as needed.
-
-        * css/SelectorChecker.cpp:
-        (WebCore::attributeValueMatches):
-        If we get anything but attribute match here, something has gone horribly wrong. Update the code
-        to fail if that were to happen.
-
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        Add the missing match type to the selector fragment.
-
-        Begin, End, Contain cannot match an empty value per specification. We can test that at compile time
-        and fail immediately. See http://www.w3.org/TR/css3-selectors/#attribute-substrings
-
-        List has the extra requirement that a value containing a space does not match anything. It also cannot
-        match with an empty string. See http://www.w3.org/TR/css3-selectors/#attribute-representation
-
-        (WebCore::SelectorCompiler::attributeValueBeginsWith):
-        (WebCore::SelectorCompiler::attributeValueContains):
-        (WebCore::SelectorCompiler::attributeValueEndsWith):
-        (WebCore::SelectorCompiler::attributeValueMatchHyphenRule):
-        (WebCore::SelectorCompiler::attributeValueSpaceSeparetedListContains):
-        The slow fallbacks.
-
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeValueMatching):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeFunctionCallValueMatching):
-        A generic code generator making function call to match an attribute value.
-
-2014-02-25  Andreas Kling  &lt;akling@apple.com&gt;
-
-        JSDOMWindow::commonVM() should return a reference.
-        &lt;https://webkit.org/b/129293&gt;
-
-        Since this function always returns a VM and never null, make it
-        return a reference instead. There are more VM getters that never
-        return null, but I tried to keep the patch from snowballing.
-
-        Reviewed by Geoff Garen.
-
-2014-03-02  Timothy Hatcher  &lt;timothy@apple.com&gt;
-
-        Remove ASSERT in ~IDBRequest since it is firing during legitimate uses in Web Inspector.
-
-        Adding the ASSERT back is tracked by https://webkit.org/b/129593.
-
-        https://bugs.webkit.org/show_bug.cgi?id=129328
-
</del><span class="cx">         Reviewed by Sam Weinig.
</span><span class="cx"> 
</span><del>-        * Modules/indexeddb/IDBRequest.cpp:
-        (WebCore::IDBRequest::~IDBRequest):
</del><ins>+        CString is evil, it has two lengths which can be different - specifically, fileSystemRepresentation()
+        creates a string with maximum possible buffer size. This was confusing resolveSymlinksInPath().
</ins><span class="cx"> 
</span><del>-2014-03-02  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * platform/cf/FileSystemCF.cpp: (WebCore::fileSystemRepresentation):
+        Change fileSystemRepresentation to be less surprising. Really, we should rip apart
+        CString and update callers to use better defined semantics, but this is the one function
+        that repeatedly causes problems in practice.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r164961.
-        http://trac.webkit.org/changeset/164961
-        https://bugs.webkit.org/show_bug.cgi?id=129596
</del><ins>+2013-05-03  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Caused many assertion failures (Requested by ap on #webkit).
</del><ins>+        CSSRule style declarations getters shouldn't be const.
+        &lt;http://webkit.org/b/115572&gt;
</ins><span class="cx"> 
</span><del>-        * css/SelectorChecker.cpp:
-        (WebCore::attributeValueMatches):
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeValueMatching):
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-03-02  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Accessing the CSSStyleDeclaration for a CSSRule is a potentially mutating operation,
+        and should not be const.
</ins><span class="cx"> 
</span><del>-        Streamline use of TextIterator, cutting down includes and use of soon-to-be-deleted functions
-        https://bugs.webkit.org/show_bug.cgi?id=129592
</del><ins>+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::style):
+        * css/CSSFontFaceRule.h:
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::style):
+        * css/CSSPageRule.h:
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::style):
+        * css/CSSStyleRule.h:
+        (CSSStyleRule):
+        * css/WebKitCSSFilterRule.cpp:
+        (WebCore::WebKitCSSFilterRule::style):
+        * css/WebKitCSSFilterRule.h:
+        * css/WebKitCSSKeyframeRule.cpp:
+        (WebCore::WebKitCSSKeyframeRule::style):
+        * css/WebKitCSSKeyframeRule.h:
+        (WebKitCSSKeyframeRule):
+        * css/WebKitCSSViewportRule.cpp:
+        (WebCore::WebKitCSSViewportRule::style):
+        * css/WebKitCSSViewportRule.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2013-05-03  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Re-sorted this file. Not sure how it got unsorted.
</del><ins>+        Use NotNull tag for placement new in WebCore.
+        &lt;http://webkit.org/b/115569&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::stringForVisiblePositionRange): Call TextIterator::text
-        instead of TextIterator::length. Also removed unneeded special case for empty string
-        and exception code.
-        (WebCore::AccessibilityObject::lengthForVisiblePositionRange): Ditto.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.h: Include TextIteratorBehavior.h instead of
-        TextIterator.h.
</del><ins>+        Avoid emitting null checks where we use placement new to construct objects into safe locations.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityRenderObject.cpp: Include TextIterator.h.
</del><ins>+        * css/StylePropertySet.cpp:
+        (WebCore::ImmutableStylePropertySet::create):
+        * dom/Element.cpp:
+        (WebCore::ShareableElementData::createWithAttributes):
+        (WebCore::ShareableElementData::ShareableElementData):
+        (WebCore::UniqueElementData::makeShareableCopy):
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::init):
+        (WebCore::createQualifiedName):
+        * dom/make_names.pl:
+        (printNamesCppFile):
+        * platform/ThreadGlobalData.h:
+        (WebCore::threadGlobalData):
+        * platform/graphics/GlyphPage.h:
+        (WebCore::GlyphPage::createForMixedFontData):
</ins><span class="cx"> 
</span><del>-        * accessibility/mac/WebAccessibilityObjectWrapperBase.mm: Removed unneeded
-        TextIterator.h include.
</del><ins>+2013-01-11  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-        (-[WebAccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]): Call
-        TextIterator::text instead of TextIterator::length.
</del><ins>+        Simplify CSSSelectorList creation/adoption.
+        &lt;http://webkit.org/b/106649&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp: Include TextIterator.h.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * dom/Node.cpp: Include Range.h.
</del><ins>+        Remove the optimization that special-cased construction of CSSSelectorLists with a single entry.
+        This is in preparation for changing the way we store the selector lists on style rules.
</ins><span class="cx"> 
</span><del>-        * dom/Position.cpp:
-        (WebCore::Position::isCandidate): Cast to RenderBlockFlow since that's what the
-        type check above does. Use a return statement instead of an else for better flow.
-        (WebCore::Position::leadingWhitespacePosition): Call
-        deprecatedIsCollapsibleWhitespace by its new name (newly deprecated).
-        (WebCore::Position::trailingWhitespacePosition): Ditto.
</del><ins>+        * css/CSSParser.h:
+        * css/CSSSelector.h:
</ins><span class="cx"> 
</span><del>-        * dom/Range.cpp:
-        (WebCore::Range::firstNode): Added a FIXME about code that clearly does not
-        belong. This is something we really need to fix.
</del><ins>+            Remove move(PassOwnPtr&lt;CSSSelector&gt; from, CSSSelector* to), inlining it into
+            CSSSelectorList::adoptSelectorVector instead.
</ins><span class="cx"> 
</span><del>-        * editing/AlternativeTextController.cpp: Include TextIterator.h.
-        * editing/ApplyStyleCommand.cpp: Ditto.
</del><ins>+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::CSSSelectorList):
+        (WebCore::CSSSelectorList::deleteSelectors):
</ins><span class="cx"> 
</span><del>-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::prepareWhitespaceAtPositionForSplit): Call
-        deprecatedIsCollapsibleWhitespace by its new name (newly deprecated).
</del><ins>+            Handle all selector list lengths the same way.
</ins><span class="cx"> 
</span><del>-        * editing/Editor.h: Include TextIteratorBehavior.h instead of TextIterator.h.
</del><ins>+        (WebCore::CSSSelectorList::adoptSelectorVector):
</ins><span class="cx"> 
</span><del>-        * editing/HTMLInterchange.cpp:
-        (WebCore::convertHTMLTextToInterchangeFormat): Call
-        deprecatedIsCollapsibleWhitespace by its new name (newly deprecated).
</del><ins>+            Merge move() from CSSSelector.h into this code since it was the only call site.
+            Also some minor readability cleanups.
</ins><span class="cx"> 
</span><del>-        * editing/SpellingCorrectionCommand.cpp: Include TextIterator.h.
</del><ins>+2013-05-03  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/TextIterator.h: Moved isCollapsibleWhitespace from here into
-        htmlediting.h and renamed it deprecatedIsCollapsibleWhitespace.
</del><ins>+        Remove HTMLShadowElement
+        https://bugs.webkit.org/show_bug.cgi?id=115555
</ins><span class="cx"> 
</span><del>-        * editing/TextIterator.cpp: Call
-        deprecatedIsCollapsibleWhitespace by its new name (newly deprecated).
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * editing/TypingCommand.cpp: Include TextIterator.h.
</del><ins>+        This is not used internally.
</ins><span class="cx"> 
</span><del>-        * editing/VisibleUnits.cpp:
-        (WebCore::previousBoundary): Call TextIterator::text instead of
-        TextIterator::length.
-        (WebCore::nextBoundary): Ditto.
</del><ins>+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ComposedShadowTreeWalker.cpp:
+        * dom/NodeRenderingContext.cpp:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::distribute):
+        * html/shadow/HTMLShadowElement.cpp: Removed.
+        * html/shadow/HTMLShadowElement.h: Removed.
+        * html/shadow/HTMLShadowElement.idl: Removed.
+        * page/DOMWindow.idl:
</ins><span class="cx"> 
</span><del>-        * editing/htmlediting.cpp: Include TextIterator.h.
</del><ins>+2013-05-03  Mikhail Pozdnyakov  &lt;mikhail.pozdnyakov@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/htmlediting.h: Removed non-helpful section comments.
-        Added FIXME about isWhitespace. Added deprecatedIsCollapsibleWhitespace,
-        formerly not deprecated and in TextIterator.h.
</del><ins>+        Remove WTF::ListRefPtr class
+        https://bugs.webkit.org/show_bug.cgi?id=115516
</ins><span class="cx"> 
</span><del>-        * editing/markup.cpp: Include TextIterator.h.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * html/HTMLTextAreaElement.cpp: Include TextIterator.h.
</del><ins>+        ListRefPtr was used only by FontFamily class, besides it strongly depended
+        on FontFamily class semantics which made it non-generic and inappropriate
+        for being present inside WTF.
</ins><span class="cx"> 
</span><del>-        * page/ContextMenuController.cpp:
-        (WebCore::selectionContainsPossibleWord): Call TextIterator::text
-        instead of TextIterator::length and TextIterator::characterAt.
</del><ins>+        This patch removes WTF::ListRefPtr class and moves its the functionality
+        into FontFamily class.
</ins><span class="cx"> 
</span><del>-        * page/EventHandler.cpp: Sorted conditional includes alphabetically by condition.
</del><ins>+        No new tests, no change in the behavior.
</ins><span class="cx"> 
</span><del>-        * platform/mac/HTMLConverter.mm:
-        (+[WebHTMLConverter editingAttributedStringFromRange:]): Call TextIterator::text
-        instead of TextIterator::length.
</del><ins>+        * page/FrameTree.h:
+        (FrameTree):
+        * platform/graphics/FontFamily.h:
+        (FontFamily):
+        (WebCore::FontFamily::~FontFamily):
+        (WebCore):
</ins><span class="cx"> 
</span><del>-2014-03-02  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+2013-05-03  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        Add a fallback path for compiling the remaining attribute checkers
-        https://bugs.webkit.org/show_bug.cgi?id=129580
</del><ins>+        Crash when calling QWebFrame::evaluateJavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=113434
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Simon Hausmann.
</ins><span class="cx"> 
</span><del>-        The remaining attribute checkers appear to be less common than the simple value match.
-        This patch adds them to SelectorCompiler for completeness but no attempt is made at optimizing them,
-        they all default to function calls.
</del><ins>+        We must take the JS API lock before accessing internal JS methods.
</ins><span class="cx"> 
</span><del>-        If the assumption that those selectors are not common turn out to be incorrect, we should see
-        the function calls in profiles and optimize them as needed.
</del><ins>+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::unwrapBoxedPrimitive):
+        (JSC::Bindings::getGregorianDateTimeUTC):
+        (JSC::Bindings::convertQVariantToValue):
</ins><span class="cx"> 
</span><del>-        * css/SelectorChecker.cpp:
-        (WebCore::attributeValueMatches):
-        If we get anything but attribute match here, something has gone horribly wrong. Update the code
-        to fail if that were to happen.
</del><ins>+2013-05-02  Xan Lopez  &lt;xlopez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        Add the missing match type to the selector fragment.
</del><ins>+        [GTK] Fine tune dependencies for glslang generated files
+        https://bugs.webkit.org/show_bug.cgi?id=115537
</ins><span class="cx"> 
</span><del>-        Begin, End, Contain cannot match an empty value per specification. We can test that at compile time
-        and fail immediately. See http://www.w3.org/TR/css3-selectors/#attribute-substrings
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-        List has the extra requirement that a value containing a space does not match anything. It also cannot
-        match with an empty string. See http://www.w3.org/TR/css3-selectors/#attribute-representation
</del><ins>+        Make glslang.* explictly depend on glslang_tab.*, since the
+        dependency does exist. Otherwise Make might decide to compile
+        things ahead of time and fail.
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::attributeValueBeginsWith):
-        (WebCore::SelectorCompiler::attributeValueContains):
-        (WebCore::SelectorCompiler::attributeValueEndsWith):
-        (WebCore::SelectorCompiler::attributeValueMatchHyphenRule):
-        (WebCore::SelectorCompiler::attributeValueSpaceSeparetedListContains):
-        The slow fallbacks.
</del><ins>+        * GNUmakefile.am:
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeValueMatching):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeFunctionCallValueMatching):
-        A generic code generator making function call to match an attribute value.
</del><ins>+2013-05-02  KyungTae Kim  &lt;ktf.kim@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-02  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        Fix build warnings on ResourceHandleClient.h
+        https://bugs.webkit.org/show_bug.cgi?id=115540
</ins><span class="cx"> 
</span><del>-        Fix build for case-sensitive file systems.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * platform/UserActivity.h: Runloop -&gt; RunLoop.
</del><ins>+        Comment out the parameter names for 'getOrCreateReadBuffer' to fix -Wunused-parameter build warnings.
</ins><span class="cx"> 
</span><del>-2014-03-02  Gavin Barraclough  &lt;barraclough@apple.com&gt;
</del><ins>+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::getOrCreateReadBuffer):
</ins><span class="cx"> 
</span><del>-        HysteresisTimer should use WebCore::Timer
-        https://bugs.webkit.org/show_bug.cgi?id=129587
</del><ins>+2013-05-02  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Following r149463, set Path for WebCore makefile as well.
</ins><span class="cx"> 
</span><del>-        * platform/HysteresisActivity.h:
-        (WebCore::HysteresisActivity::HysteresisActivity):
-        (WebCore::HysteresisActivity::hysteresisTimerFired):
-            - RunLoop::Timer -&gt; WebCore::Timer.
-        * platform/UserActivity.h:
</del><ins>+        * WebCore.vcxproj/WebCore.make:
</ins><span class="cx"> 
</span><del>-2014-03-02  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+2013-05-02  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Split TextIteratorBehavior into a separate header
-        https://bugs.webkit.org/show_bug.cgi?id=129578
</del><ins>+        Unreviewed fix for Mac Lion build after r149503.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.h:
+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.mm:
</ins><span class="cx"> 
</span><del>-        This is in preparation to greatly cut down on includes of TextIterator.h.
</del><ins>+2013-05-02  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * GNUmakefile.list.am: Added new header.
-        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
</del><ins>+        BUILD FIX: Move Mac-only symbols into the shared symbol list
</ins><span class="cx"> 
</span><del>-         * editing/FindOptions.h: Changed typedef to unsigned char;
-        there is no reason to store these in a 32-bit integer.
</del><ins>+        * WebCore.exp.in: Move symbols.
</ins><span class="cx"> 
</span><del>-         * editing/TextIterator.h: Added include of TextIteratorBehavior.h
-        and moved comments about the meanings of flag bits to their definition.
</del><ins>+2013-05-02  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/TextIteratorBehavior.h: Added.
</del><ins>+        Shadow DOM removal: Get rid of ContentSelectorQuery
+        https://bugs.webkit.org/show_bug.cgi?id=115533
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Updated for type changes.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-03-02  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        This is only used for Shadow DOM distribution. &lt;details&gt; element works fine without it.
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Form controls handling
-        https://bugs.webkit.org/show_bug.cgi?id=129344
-        &lt;rdar://problem/16053643&gt;
-
-        Reviewed by Simon Fraser.
-
-        Updates localizable strings and adds some exports.
-
-        * English.lproj/Localizable.strings:
-        * WebCore.exp.in:
</del><ins>+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><ins>+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ContentDistributor::distributeSelectionsTo):
+        * html/shadow/ContentSelectorQuery.cpp: Removed.
+        * html/shadow/ContentSelectorQuery.h: Removed.
+        * html/shadow/HTMLContentElement.cpp:
</ins><span class="cx"> 
</span><del>-2014-03-02  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-05-02  Arnaud Renevier  &lt;a.renevier@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Pages using tiled compositing layers allocate too many tiles on zoom
-        https://bugs.webkit.org/show_bug.cgi?id=129471
</del><ins>+        border-radius clipping a canvas does not always clip
+        https://bugs.webkit.org/show_bug.cgi?id=113343
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        A few issues with TileController were causing sublayers of the root layers
-        to tile incorrect surfaces on zoom.
</del><ins>+        clipToRect method clip context to clipRect, and then clip to rounded
+        rect if clipRect has a radius. But currently, clipToRect exit early if
+        clipToRect is equal to paintDirtyRect.
</ins><span class="cx"> 
</span><del>-        First, the exposedRect API was not updating the sublayers. The layers go correctly
-        into tiling mode, but the tiles cover the full document instead of the visible area.
</del><ins>+        This patch allows clipping to rounded corner ever if clipToRect is
+        equal to paintDirtyRect.
</ins><span class="cx"> 
</span><del>-        The other major issue was the margins being applied to the coverage size in document
-        coordinates. Since each margin is 512px, the total coverage size after zoom was
-        gigantic.
</del><ins>+        Test: fast/overflow/border-radius-clipping-2.html
</ins><span class="cx"> 
</span><del>-        To solve this, this patch switch from the exposedRect API to the generic concept
-        of VisibleExtentContentRect introduced for iOS WebKit1.
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clipToRect):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ScrollView.h:
-        Define a VisibleExtentContentRect on the scrollview itself when there is no
-        platformWidget().
-        The case with inside frame is untested due to stability issues :(.
-        (see &lt;rdar://problem/16199219&gt;)
</del><ins>+2013-05-02  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::computeTileCoverageRect):
-        Remove the margin from the tile coverage.
</del><ins>+        Caption menu does not include in-band captions
+        https://bugs.webkit.org/show_bug.cgi?id=111934
</ins><span class="cx"> 
</span><del>-        On iOS, m_tileCoverage is always zero at the moment. Previously, the tile coverage
-        was artificially extended by the margins. With the margins removed, I temporarily added
-        a factor of 1.5.
-        ViewUpdateDispatcher has all the information to compute a great tile coverage, I will need
-        a follow up patch to fix that.
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::visibleExtentContentRect):
-        (WebCore::ScrollView::setVisibleExtentContentRect):
</del><ins>+        No new tests, upated existing tests for these changes.
</ins><span class="cx"> 
</span><del>-2014-03-02  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * WebCore.xcodeproj/project.pbxproj: Add new files.
</ins><span class="cx"> 
</span><del>-        Sort Mac platform export files so they merge better
-        https://bugs.webkit.org/show_bug.cgi?id=129581
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_legacyWebKitClosedCaptionsVisible.
+        (WebCore::HTMLMediaElement::loadInternal): Clear the LoadMediaResource from m_pendingActionFlags
+            in case there is a pending async load.
+        (WebCore::HTMLMediaElement::configureTextTrackGroup): Always log the track score.
+        (WebCore::HTMLMediaElement::configureTextTracks): Call configureTextTrackDisplay so 
+            m_legacyWebKitClosedCaptionsVisible is always updated immediately.
+        (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): Use m_legacyWebKitClosedCaptionsVisible.
+        (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): Ditto.
+        * html/HTMLMediaElement.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        * page/CaptionUserPreferences.cpp:
+        (WebCore::CaptionUserPreferences::CaptionUserPreferences): Initialize m_displayMode to ForcedOnly
+            because it is no longer used for testing only.
+        (WebCore::CaptionUserPreferences::notify): Post notifications when not in testing-only mode.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Ran the new sort-export-file on this.
</del><ins>+        * page/CaptionUserPreferencesMac.h:
+        * page/CaptionUserPreferencesMac.mm:
+        (WebCore::CaptionUserPreferencesMac::textTrackSelectionScore): Calculate a track score when
+            webkitClosedCaptionsVisible has been set.
+        (WebCore::CaptionUserPreferencesMac::sortedTrackListForMenu): Don't filter track list when we
+            don't have the media accessibility framework. Make logging more informative.
+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h:
</ins><span class="cx"> 
</span><del>-2014-03-02  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
</ins><span class="cx"> 
</span><del>-        Add protected casting to FilterOperation classes.
-        https://bugs.webkit.org/show_bug.cgi?id=124062
</del><ins>+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.h:
+        (WebCore::InbandTextTrackPrivateAVFObjC::create): Take a AVFInbandTrackParent instead of a
+            MediaPlayerPrivateAVFoundationObjC.
+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.mm:
+        (WebCore::InbandTextTrackPrivateAVFObjC::InbandTextTrackPrivateAVFObjC): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.h: Added.
+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateLegacyAVFObjC.mm: Added.
</ins><span class="cx"> 
</span><del>-        Use the type cast macro generators to produce some toFilterOperation-style
-        functions, and then use them in our PlatformCA filter code.
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): We only have legible output when
+            HAVE_AVFOUNDATION_LEGIBLE_OUTPUT_SUPPORT is defined.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerItem): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Create a legacy CC track if
+            there are no media selection options and there is a CC AVAssetTrack.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::processLegacyCCTracks): New, process CC tracks.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::processNewAndRemovedTextTracks): New, refactored
+            common setup/cleanup code from processMediaSelectionOptions.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::processMediaSelectionOptions): Renamed from 
+            processTextTracks. Move common setup/cleanup code to processNewAndRemovedTextTracks.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::setCurrentTrack): Deal with legacy CC tracks.
</ins><span class="cx"> 
</span><del>-        Test: css3/filters/animation-from-initial-values-with-color-matrix.html
</del><ins>+2013-05-02  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/PlatformCAFiltersMac.mm: Use the toFilterOperation methods, in
-        some cases removing the unnecessary double cast.
-        (PlatformCAFilters::filterValueForOperation):
-        (PlatformCAFilters::colorMatrixValueForFilter):
-        * platform/graphics/filters/FilterOperation.cpp:
-        (WebCore::BasicColorMatrixFilterOperation::blend):
-        (WebCore::BasicColorMatrixFilterOperation::operator==): Move this to the .cpp file so it can use the casting methods.
-        (WebCore::BasicComponentTransferFilterOperation::blend):
-        (WebCore::BasicComponentTransferFilterOperation::operator==): Ditto.
-        * platform/graphics/filters/FilterOperation.h: Add the casting macros.
</del><ins>+        [Mac] caption track menu includes &quot;easy to read&quot; in-band tracks twice
+        https://bugs.webkit.org/show_bug.cgi?id=115529
</ins><span class="cx"> 
</span><del>-2014-03-02  Yoav Weiss  &lt;yoav@yoav.ws&gt;
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Fix srcset related bugs
-        https://bugs.webkit.org/show_bug.cgi?id=129539
</del><ins>+        * page/CaptionUserPreferencesMac.mm:
+        (WebCore::CaptionUserPreferencesMac::sortedTrackListForMenu): Check to see if a track is
+             easy-to-read after checking if it is forced only.
</ins><span class="cx"> 
</span><del>-        Fixed a bug reported against Blink's srcset implementation at https://code.google.com/p/chromium/issues/detail?id=347998
-        When both src and srcset had only 1x descriptors and the DPR was higher than 1, the src's resource was picked.
</del><ins>+2013-05-02  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Also fixed the invalid descriptor handling, which wasn't aligned with the spec, and therefore was not as forward compatible as it should be.
-        Invalid descriptors caused the entire resource to be ignored, rather than just the descriptors themselves.
</del><ins>+        Remove SiblingTraversalStrategies.h
+        https://bugs.webkit.org/show_bug.cgi?id=115532
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Tests: fast/hidpi/image-srcset-invalid-descriptor.html
-               fast/hidpi/image-srcset-src-selection-1x-both.html
-
-        * html/parser/HTMLParserIdioms.cpp:
-        (WebCore::parseDescriptors):
-        (WebCore::parseImagesWithScaleFromSrcsetAttribute):
-        (WebCore::bestFitSourceForImageAttributes):
-
-2014-03-01  Gavin Barraclough  &lt;barraclough@apple.com&gt;
-
-        Split UserActivity, simplify PageThrottler
-        https://bugs.webkit.org/show_bug.cgi?id=129551
-
-        Reviewed by Darin Adler.
-
-        The class UserActivity currently implements two things – a hysteresis mechanism, and
-        an abstraction of NSActivity controlled by that mechanism. PageThrottler implements
-        its own hysteresis mechanism, which directly controls DOM timer throttling and also
-        controls a couple of UserActivities, giving a total of 3 separate hysteresis mechanisms,
-        layered two deep.
-
-        Split UserActivity into three, with HysteresisActivity implementing an abstract hysteresis
-        mechanism, UserActivity::Impl controlling the NSActivity, and then UserActivity combining
-        these two back together. The interface to UserActivity is unchanged.
-
-        Remove PageThrottler's bespoke hysteresis, replacing it with a use of HysteresisActivity.
-        Replace the two UserActivities with a single UserActivity::Impl, so there are no longer
-        layered hysteresis mechanisms.
-
-        * WebCore.exp.in:
-            - exports changed.
</del><ins>+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-            - added HysteresisActivity.h.
-        * page/PageThrottler.cpp:
-        (WebCore::PageThrottler::PageThrottler):
-            - if the page starts visible, begin activity. If it starts hidden throttle DOM timers.
-        (WebCore::PageThrottler::hiddenPageDOMTimerThrottlingStateChanged):
-            - when the DOM timer throttling setting changes, make sure we update.
-        (WebCore::PageThrottler::incrementActivityCount):
-        (WebCore::PageThrottler::decrementActivityCount):
-            - when m_activityCount changes update the hysteresis state.
-        (WebCore::PageThrottler::updateHysteresis):
-        (WebCore::PageThrottler::setViewState):
-            - when IsVisuallyIdle changes update the hysteresis state.
-        (WebCore::PageThrottler::started):
-        (WebCore::PageThrottler::stopped):
-            - callbacks from HysteresisActivity, these control m_activity and DOM timer throttling.
-        * page/PageThrottler.h:
-        (WebCore::PageThrottler::didReceiveUserInput):
-        (WebCore::PageThrottler::pluginDidEvaluate):
-            - call impulse to temporarily enable the activity.
-        * platform/HysteresisActivity.h: Copied from Source/WebCore/platform/UserActivity.h.
-        (WebCore::HysteresisActivity::HysteresisActivity):
-            - constructor takes a delegate optionally a timeout.
-        (WebCore::HysteresisActivity::start):
-            - start activity immediately. If stopped, call started method on delegate. If in timeout period, cancel the timer.
-        (WebCore::HysteresisActivity::stop):
-            - stop activity after hysteresis. If started, initiate timeout period.
-        (WebCore::HysteresisActivity::impulse):
-            - ensure activity for at least the timeout period.
-        (WebCore::HysteresisActivity::hysteresisTimerFired):
-            - delayed stop - when the timer fires call stopped on the delegate.
-        * platform/UserActivity.cpp:
-        (WebCore::UserActivity::Impl::Impl):
-        (WebCore::UserActivity::Impl::beginActivity):
-        (WebCore::UserActivity::Impl::endActivity):
-            - nop implementation.
-        (WebCore::UserActivity::UserActivity):
-            - UserActivity maintains existing interface with hysteresis.
-        (WebCore::UserActivity::started):
-        (WebCore::UserActivity::stopped):
-            - callbacks from HysteresisTimer; forward to Impl.
-        * platform/UserActivity.h:
-        * platform/mac/UserActivityMac.mm:
-        (WebCore::UserActivity::Impl::Impl):
-            - UserActivity::Impl, abstraction for NSActivity without added hysteresis.
-        (WebCore::UserActivity::Impl::beginActivity):
-            - allocate NSActivity.
-        (WebCore::UserActivity::Impl::endActivity):
-            - release NSActivity.
</del><ins>+        * css/SiblingTraversalStrategies.h: Removed.
</ins><span class="cx"> 
</span><del>-2014-03-02  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+2013-05-02  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        DocumentLoader should keep maps of ResourceLoaders instead of sets
-        https://bugs.webkit.org/show_bug.cgi?id=129388
</del><ins>+        Shadow DOM removal: Make SelectorChecker non-generic
+        https://bugs.webkit.org/show_bug.cgi?id=115526
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        For web replay, we need to be able to pull a ResourceLoader instance by
-        identifier from the DocumentLoader. This is easy to do if we convert
-        ResourceLoaderSet to ResourceLoaderMap, keyed by the loader's identifier.
</del><ins>+        Without Shadow DOM distribution we don't need SiblingTraversalStrategies anymore.
</ins><span class="cx"> 
</span><del>-        Added assertions whenever adding or removing from the map to ensure
-        that we don't try to add duplicates or resources with zero identifiers.
</del><ins>+        * css/ElementRuleCollector.cpp:
+        (WebCore::ElementRuleCollector::ruleMatches):
+        * css/SelectorChecker.cpp:
+        (WebCore):
+        (WebCore::isFirstChildElement):
+        (WebCore::isLastChildElement):
+        (WebCore::isFirstOfType):
+        (WebCore::isLastOfType):
+        (WebCore::countElementsBefore):
+        (WebCore::countElementsOfTypeBefore):
+        (WebCore::countElementsAfter):
+        (WebCore::countElementsOfTypeAfter):
+        (WebCore::SelectorChecker::match):
+        (WebCore::SelectorChecker::checkOne):
+        * css/SelectorChecker.h:
+        (SelectorChecker):
+        * css/SiblingTraversalStrategies.h:
+        * css/StyleResolver.h:
+        (WebCore::checkRegionSelector):
+        * dom/SelectorQuery.cpp:
+        (WebCore::SelectorDataList::selectorMatches):
+        * html/shadow/ContentSelectorQuery.cpp:
+        (WebCore::ContentSelectorDataList::checkContentSelector):
</ins><span class="cx"> 
</span><del>-        No new tests required. No functionality was added.
</del><ins>+2013-05-02  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/DocumentLoader.cpp:
-        (WebCore::cancelAll):
-        (WebCore::setAllDefersLoading):
-        (WebCore::areAllLoadersPageCacheAcceptable):
-        (WebCore::DocumentLoader::addSubresourceLoader):
-        (WebCore::DocumentLoader::removeSubresourceLoader):
-        (WebCore::DocumentLoader::addPlugInStreamLoader):
-        (WebCore::DocumentLoader::removePlugInStreamLoader):
-        (WebCore::DocumentLoader::subresourceLoaderFinishedLoadingOnePart):
-        * loader/DocumentLoader.h:
-        * loader/NetscapePlugInStreamLoader.cpp:
-        (WebCore::NetscapePlugInStreamLoader::create): Only add the loader
-        to the document loader's map if it initialized successfully.
-        The old code was probably leaking resource loaders that failed to
-        initialize.
</del><ins>+        Simplify WebCoreObjCExtras by using WTF::bind
+        https://bugs.webkit.org/show_bug.cgi?id=115524
</ins><span class="cx"> 
</span><del>-        * loader/mac/DocumentLoaderMac.cpp:
-        (WebCore::scheduleAll):
-        (WebCore::unscheduleAll):
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-03-02  Dirkjan Ochtman  &lt;d.ochtman@activevideo.com&gt;
</del><ins>+        * platform/mac/WebCoreObjCExtras.mm:
+        (deallocCallback):
+        (WebCoreObjCScheduleDeallocateOnMainThread):
</ins><span class="cx"> 
</span><del>-        Support ENABLE_ENCRYPTED_MEDIA in cmake builds
-        https://bugs.webkit.org/show_bug.cgi?id=129575
</del><ins>+2013-05-02  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+        &lt;rdar://problem/13740375&gt; Non-ASCII downloaded file names are garbled when using NetworkProcess
+        https://bugs.webkit.org/show_bug.cgi?id=115520
</ins><span class="cx"> 
</span><del>-        No new tests, only fixes the build.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        Add support for ENABLE_ENCRYPTED_MEDIA.
-        * Modules/encryptedmedia/MediaKeySession.cpp:
-        (WebCore::MediaKeySession::close):
-        Assign nullptr instead of 0 to OwnPtr to appease gcc-4.7.
</del><ins>+        Covered by existing tests when using NetworkProcess.
</ins><span class="cx"> 
</span><del>-2014-03-01  Tim Horton  &lt;timothy_horton@apple.com&gt;
-
-        WebKit2 View Gestures (Smart Magnification): Support for iOS
-        https://bugs.webkit.org/show_bug.cgi?id=129146
-        &lt;rdar://problem/16032668&gt;
-
-        Reviewed by Benjamin Poulain.
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        Add an export.
</del><ins>+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::responseContentDispositionEncodingFallbackArray):
+        Added a getter for encoding fallback array.
</ins><span class="cx"> 
</span><del>-2014-03-01  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        Removed obsolete checks for presence of fallback array methods, they were available
+        since 10.6.8.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r164929 and r164934.
-        http://trac.webkit.org/changeset/164929
-        http://trac.webkit.org/changeset/164934
-        https://bugs.webkit.org/show_bug.cgi?id=129570
</del><ins>+2013-05-01  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Caused assertions on two srcset tests (Requested by ap on
-        #webkit).
</del><ins>+        text-combine: horizontal does not work properly for some fonts.
+        https://bugs.webkit.org/show_bug.cgi?id=115503.
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLParserIdioms.cpp:
-        (WebCore::isHTMLSpaceOrComma):
-        (WebCore::parseImagesWithScaleFromSrcsetAttribute):
-        (WebCore::bestFitSourceForImageAttributes):
</del><ins>+        Reviewed by Dave Hyatt.
</ins><span class="cx"> 
</span><del>-2014-03-01  Dan Bernstein  &lt;mitz@apple.com&gt;
</del><ins>+        For some fonts that don't have width variants, we fail to combine glyphs
+        because we believe they don't fit. That decision is made comparing the run width
+        with the font computed size multiplied by a margin factor.
+        I've increased the margin from 10% to 15%.
+         
+        Test: fast/text/text-combine-different-fonts.html
</ins><span class="cx"> 
</span><del>-        Build fix.
</del><ins>+        * rendering/RenderCombineText.cpp:
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLParserIdioms.cpp: Removed an unused function.
</del><ins>+2013-05-01  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-03-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Null check plugInClient earlier in snapshotting path
+        https://bugs.webkit.org/show_bug.cgi?id=115498
</ins><span class="cx"> 
</span><del>-        Ensure keySplines is valid in SMIL animations
-        &lt;http://webkit.org/b/129547&gt;
-        &lt;rdar://problem/15676128&gt;
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Merged from Blink (patch by Philip Rogers):
-        https://src.chromium.org/viewvc/blink?revision=156452&amp;view=revision
-        http://crbug.com/276111
</del><ins>+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn):
</ins><span class="cx"> 
</span><del>-            This patch fixes a crash in SMIL animations when keySplines are not
-            specified. The SMIL spec is clear on this:
-            http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncCalcMode
-            &quot;If there are any errors in the keyTimes specification (bad values,
-            too many or too few values), the animation will have no effect.&quot;
</del><ins>+2013-05-01  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-            This patch simply checks that keyTimes is not empty. Previously,
-            splinesCount was set to be m_keySplines.size() + 1 in
-            SVGAnimationElement.cpp; this patch changes splinesCount to be equal
-            to m_keySplines.size() to make the logic easier to follow and to
-            match other checks in SVGAnimationElement::startedActiveInterval.
</del><ins>+        Web Inspector: Fix check-inspector-strings script and fix localized strings
+        https://bugs.webkit.org/show_bug.cgi?id=115495
</ins><span class="cx"> 
</span><del>-        Test: svg/animations/animate-keysplines-crash.html
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::startedActiveInterval):
</del><ins>+        No new tests, because there is no change in behavior.
</ins><span class="cx"> 
</span><del>-2014-03-01  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        * English.lproj/localizedStrings.js:
</ins><span class="cx"> 
</span><del>-        Tighten minimumRegisterRequirements()
-        https://bugs.webkit.org/show_bug.cgi?id=129538
</del><ins>+2013-05-01  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        &lt;object data=&quot;&lt;some data URL&gt;&quot;&gt; MIME types aren't case-insensitive
+        https://bugs.webkit.org/show_bug.cgi?id=115494
</ins><span class="cx"> 
</span><del>-        Fix small things that made minimumRegisterRequirements() a little optimistic
-        when dealing with attributes.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/adjacent-descendant-tail-register-requirement.html
</del><ins>+        Test: fast/images/object-data-url-case-insensitivity.html
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        Attribute Set does not do value matching, the case sensitive value matching is irrelevant
-        The problem is that flag is also used by minimumRegisterRequirements()
-        to find if one more register is needed.
</del><ins>+        MIME types are defined to be case-insensitive, but many places in WebCore
+        only compare them against lower-case strings. Most entry points for MIME
+        types lower-case them, but mimeTypeFromDataURL doesn't, causing, for example,
+        data:image/png;... to work, but data:iMaGe/PNG;... to fail.
</ins><span class="cx"> 
</span><del>-        Set the flag to case sensitive to avoid reserving one extra register.
</del><ins>+        To fix this, lower-case the string returned from mimeTypeFromDataURL.
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::minimumRegisterRequirements):
-        Use a new backtrackingFlag to know if there is a descendant tail, thus a backtracking register
-        reserved.
-        This is better than using the backtracking action because the backtracking chain could be
-        an adjacent chain inside a descendant chain.
</del><ins>+        * platform/KURL.cpp:
+        (WebCore::mimeTypeFromDataURL):
</ins><span class="cx"> 
</span><del>-        The flags are designed for that, just set one for minimumRegisterRequirements().
</del><ins>+2013-05-01  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        The 2 extra registers for the attribute count and address become limited to all attributes
-        except the last one. We don't keep a copy for the last matching, those registers were not needed.
</del><ins>+        [Mac] Text replacement should use correction indicator
+        https://bugs.webkit.org/show_bug.cgi?id=115471
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
-
-2014-03-01  Pratik Solanki  &lt;psolanki@apple.com&gt;
-
-        [iOS] selectionImageForcingBlackText should return autoreleased object
-        https://bugs.webkit.org/show_bug.cgi?id=129437
-        &lt;rdar://problem/15810384&gt;
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        * bindings/objc/DOM.mm:
-        (-[DOMRange renderedImageForcingBlackText:renderedImageForcingBlackText:]):
</del><ins>+        Support autocorrection panel for text replacements by making AlternativeTextTypeCorrection
+        handle text replacements as well as automatic spelling correction.
</ins><span class="cx"> 
</span><del>-2014-03-01  Yoav Weiss  &lt;yoav@yoav.ws&gt;
</del><ins>+        No new tests. Unfortunately this feature is not testable as is. We need to provide some
+        internals or testRunner methods to make this feature testable in the long term.
</ins><span class="cx"> 
</span><del>-        Fix srcset related bugs
-        https://bugs.webkit.org/show_bug.cgi?id=129539
</del><ins>+        * editing/AlternativeTextController.cpp:
+        (WebCore::AlternativeTextController::timerFired): Trigger both TextCheckingTypeReplacement
+        and TextCheckingTypeShowCorrectionPanel.
</ins><span class="cx"> 
</span><del>-        Fixed a bug reported against Blink's srcset implementation at https://code.google.com/p/chromium/issues/detail?id=347998
-        When both src and srcset had only 1x descriptors and the DPR was higher than 1, the src's resource was picked.
</del><ins>+        * editing/Editor.cpp:
+        (WebCore::Editor::markAndReplaceFor): Autocorrection panel maybe used for both
+        TextCheckingTypeReplacement and TextCheckingTypeShowCorrectionPanel.
</ins><span class="cx"> 
</span><del>-        Also fixed the invalid descriptor handling, which wasn't aligned with the spec, and therefore was not as forward compatible as it should be.
-        Invalid descriptors caused the entire resource to be ignored, rather than just the descriptors themselves.
</del><ins>+2013-05-01  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Move knowledge of PDF/PostScript MIME types into MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=115487
</ins><span class="cx"> 
</span><del>-        Tests: fast/hidpi/image-srcset-invalid-descriptor.html
-               fast/hidpi/image-srcset-src-selection-1x-both.html
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLParserIdioms.cpp:
-        (WebCore::parseDescriptors):
-        (WebCore::parseImagesWithScaleFromSrcsetAttribute):
-        (WebCore::bestFitSourceForImageAttributes):
</del><ins>+        No new tests, just a refactoring.
</ins><span class="cx"> 
</span><del>-2014-03-01  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+        * WebCore.exp.in:
+        Export newly-added isPDFOrPostScriptMIMEType and getPDFAndPostScriptMIMETypes.
</ins><span class="cx"> 
</span><del>-        Improve &quot;bad parent&quot; and &quot;bad child list&quot; assertions in line boxes
-        https://bugs.webkit.org/show_bug.cgi?id=125656
</del><ins>+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        Adopt MIMETypeRegistry::isPDFOrPostScriptMIMEType instead of duplicating
+        the list of MIME types. The previous list did not include PostScript, but
+        it seems reasonable to put plugins ahead of built-in support for it in addition to PDF.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializePDFAndPostScriptMIMETypes): Added.
+        (WebCore::initializeMIMETypeRegistry): Call initializePDFAndPostScriptMIMETypes.
+        (WebCore::MIMETypeRegistry::isPDFOrPostScriptMIMEType):
+        Consult our new HashSet to see if the given MIME type is one of those used for PDF or PS.
</ins><span class="cx"> 
</span><del>-        My previous fix for this problem was incomplete. This continuation of that fix addresses
-        the flaw in the original and adds additional lifetime checking so problems can be seen in
-        debug builds without a memory debugger.
</del><ins>+        (WebCore::MIMETypeRegistry::getPDFAndPostScriptMIMETypes): Added.
+        * platform/MIMETypeRegistry.h:
+        (MIMETypeRegistry): Add isPDFOrPostScriptMIMEType and getPDFAndPostScriptMIMETypes.
</ins><span class="cx"> 
</span><del>-        * rendering/InlineBox.cpp:
-        (WebCore::InlineBox::assertNotDeleted): Added. Poor man's memory debugging helper.
-        (WebCore::InlineBox::~InlineBox): Refactored body into a new function named
-        invalidateParentChildList. Added code to update the deletion sentinel to record
-        that this object is deleted.
-        (WebCore::InlineBox::setHasBadParent): Moved here from header since this debug-only
-        feature does not need to be inlined. Added a call to assertNotDeleted.
-        (WebCore::InlineBox::invalidateParentChildList): Added. Refactored from the destructor,
-        this is used by RenderTextLineBoxes.
</del><ins>+2013-05-01  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/InlineBox.h: Added the deletion sentinel, and called it in the parent
-        function. Also changed the expansion/setExpansion functions to use the type name &quot;int&quot;,
-        since we don't use the type name &quot;signed&quot; in the WebKit coding style.
</del><ins>+        Implement LocalStorageDatabase::importItems
+        https://bugs.webkit.org/show_bug.cgi?id=115493
</ins><span class="cx"> 
</span><del>-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::~InlineFlowBox): Call setHasBadChildList rather than doing the
-        setHasBadParent work on children directly, to avoid code duplication.
-        (WebCore::InlineFlowBox::setHasBadChildList): Moved here from header. Added code to set
-        &quot;has bad parent&quot; on all children, something we previously did only on destruction. Also
-        added assertNotDeleted.
-        (WebCore::InlineFlowBox::checkConsistency): Added call to assertNotDeleted. Also tweaked
-        code style and variable names a little bit.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * rendering/InlineFlowBox.h: Moved setHasBadChildList out of the header when it's on.
-        The empty version for ASSERT_WITH_SECURITY_IMPLICATION_DISABLED is still in the header.
</del><ins>+        Export symbols needed by WebKit2.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTextLineBoxes.cpp:
-        (WebCore::RenderTextLineBoxes::invalidateParentChildLists): Call the new
-        InlineBox::invalidateParentChildList function instead of calling setHasBadChildList directly.
-        The new function checks m_hasBadParent, something we couldn't do here.
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-2014-03-01  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+2013-05-01  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Optimized querySelector(All) when selector contains #id
-        https://bugs.webkit.org/show_bug.cgi?id=116502
</del><ins>+        Begin work on loading items from the local storage database
+        https://bugs.webkit.org/show_bug.cgi?id=115489
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Test: fast/selectors/querySelector-id-filtering.html
</del><ins>+        Export symbols and SQLite headers needed.
</ins><span class="cx"> 
</span><del>-        The idea of this patch is to perform querySelector on a subtree
-        rooted at the last element with #id matching. For example, if we have the selector
-        &quot;#foobar div a&quot;, we start by looking for the element with ID foobar in the TreeScope
-        cache, and start matching the children from there.
</del><ins>+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-        The idea comes from Rune for
-        https://chromium.googlesource.com/chromium/blink/+/1cd83d3588973a02ab15d94b1b05a28620853624
-        but the code as diverged too much so it had to be reimplemented specifically for WebKit.
</del><ins>+2013-05-01  Hans Muller  &lt;hmuller@adobe.com&gt;
+        [CSS Exclusions] Programmatic layout tests fail when subpixel layout is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=115455
</ins><span class="cx"> 
</span><del>-        * css/CSSSelectorList.cpp:
-        (WebCore::CSSSelectorList::CSSSelectorList):
-        (WebCore::CSSSelectorList::operator=):
-        * css/CSSSelectorList.h:
-        (WebCore::CSSSelectorList::~CSSSelectorList):
-        * css/StyleRule.h:
-        (WebCore::StyleRule::wrapperAdoptSelectorList):
-        (WebCore::StyleRulePage::wrapperAdoptSelectorList):
-        * dom/SelectorQuery.cpp:
-        (WebCore::isSingleTagNameSelector):
-        (WebCore::isSingleClassNameSelector):
-        (WebCore::findIdMatchingType):
-        (WebCore::SelectorDataList::SelectorDataList):
-        (WebCore::filterRootById):
-        (WebCore::SelectorDataList::executeCompiledSimpleSelectorChecker):
-        (WebCore::SelectorDataList::execute):
-        (WebCore::SelectorQuery::SelectorQuery):
-        (WebCore::SelectorQueryCache::add):
-        * dom/SelectorQuery.h:
-        (WebCore::SelectorDataList::SelectorData::SelectorData):
</del><ins>+        First round of changes to restore platform/mac exclusion tests that started failing when
+        subpixel layout was turned off.
</ins><span class="cx"> 
</span><del>-2014-02-28  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-        Node::compareDocumentPosition leaks memory structure
-        https://bugs.webkit.org/show_bug.cgi?id=120244
</del><ins>+        * rendering/ExclusionPolygon.cpp:
+        (WebCore::appendArc): Ensure that the 3rd of 5 added vertices is in the center of the arc.
+        (WebCore::ExclusionPolygon::firstIncludedIntervalLogicalTop): Use ceiledLayoutUnit() for downwards-snapping first fit location.
+        * rendering/ExclusionRectangle.cpp:
+        (WebCore::ExclusionRectangle::firstIncludedIntervalLogicalTop): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+2013-05-01  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Node.cpp: (WebCore::Node::compareDocumentPosition): Don't do it.
</del><ins>+        Incorrect layout for blocks containing ideographs with -webkit-linebox-contain: glyphs, font, inline-box.
+        https://bugs.webkit.org/show_bug.cgi?id=115478.
</ins><span class="cx"> 
</span><del>-2014-03-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Reviewed by Dave Hyatt.
</ins><span class="cx"> 
</span><del>-        Fix lifetime handling of SVGPropertyTearOffs
-        &lt;http://webkit.org/b/129211&gt;
-        &lt;rdar://problem/15696025&gt;
</del><ins>+        Test: fast/block/lineboxcontain/block-with-ideographs.xhtml
</ins><span class="cx"> 
</span><del>-        Reviewed by Maciej Stachowiak.
</del><ins>+        When computing ascent and descent we need to take into account
+        the baseline type. RootInlineBox::ascentAndDescentForBox failed
+        to do that in few cases.
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by Ojan Vafai):
-        https://src.chromium.org/viewvc/blink?revision=157801&amp;view=revision
-        http://crbug.com/288771
</del><ins>+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::ascentAndDescentForBox):
</ins><span class="cx"> 
</span><del>-            -Replace SVGStaticPropertyWithParentTearOff with SVGMatrixTearOff
-            since it's only used in that one place. This means we can get rid
-            of the templatizing and the method pointer.
-            -Change SVGPropertyTearOff to keep track of it's child tearoffs
-            and call detachWrapper on its child tearoffs when it's destroyed
-            or when it's wrapper is detached.
-            -Have SVGPropertyTearOff hold WeakPtrs to the child tearoffs
-            to avoid having a cycle.
</del><ins>+2013-05-01  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: svg/transforms/svg-matrix-tearoff-crash.html
</del><ins>+        Add LocalStorageDatabase class
+        https://bugs.webkit.org/show_bug.cgi?id=115486
</ins><span class="cx"> 
</span><del>-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (NativeToJSValue):
-        * svg/properties/SVGMatrixTearOff.h: Renamed from Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h.
-        (WebCore::SVGMatrixTearOff::create):
-        (WebCore::SVGMatrixTearOff::commitChange):
-        (WebCore::SVGMatrixTearOff::SVGMatrixTearOff):
-        * svg/properties/SVGPropertyTearOff.h:
-        (WebCore::SVGPropertyTearOff::addChild):
-        (WebCore::SVGPropertyTearOff::detachChildren):
-
-2014-03-01  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
-
-        Unreviewed build fix after r164913.
-
-        * platform/CountedUserActivity.h: Some ports don't (yet) support forwarding headers for WebCore,
-        so UserActivity.h should be included as non-forwarding.
-
-2014-03-01  Gavin Barraclough  &lt;barraclough@apple.com&gt;
-
-        Change PageActivityAssertionToken to use a WeakPtr
-        https://bugs.webkit.org/show_bug.cgi?id=129526
-
</del><span class="cx">         Reviewed by Sam Weinig.
</span><span class="cx"> 
</span><del>-        PageThrottler effectively implements a bespoke weak pointer mechanism; remove this &amp; just use WeakPtr.
</del><ins>+        Export symbols needed by WebKit2.
</ins><span class="cx"> 
</span><del>-        * page/PageActivityAssertionToken.cpp:
-        (WebCore::PageActivityAssertionToken::PageActivityAssertionToken):
-        (WebCore::PageActivityAssertionToken::~PageActivityAssertionToken):
-            - addActivityToken-&gt;incrementActivityCount, removeActivityToken-&gt;decrementActivityCount
-        * page/PageActivityAssertionToken.h:
-            - removed invalidate, made m_throttler a WeakPtr
-        * page/PageThrottler.cpp:
-        (WebCore::PageThrottler::PageThrottler):
-            - initialize m_weakPtrFactory, m_activityCount.
-        (WebCore::PageThrottler::~PageThrottler):
-            - removed called to invalidate.
-        (WebCore::PageThrottler::startThrottleHysteresisTimer):
-            - m_activityTokens.size()-&gt;m_activityCount
-        (WebCore::PageThrottler::throttleHysteresisTimerFired):
-            - m_activityTokens.size()-&gt;m_activityCount
-        (WebCore::PageThrottler::incrementActivityCount):
-            - m_activityTokens.add-&gt;++
-        (WebCore::PageThrottler::decrementActivityCount):
-            - m_activityTokens.remove-&gt;--
-        * page/PageThrottler.h:
-        (WebCore::PageThrottler::weakPtr):
-            - replaced HashSet with WeakPtrFactory &amp; count.
-
-2014-03-01  Gavin Barraclough  &lt;barraclough@apple.com&gt;
-
-        Split UserActivity/CountedUserActivity
-        https://bugs.webkit.org/show_bug.cgi?id=129520
-
-        Reviewed by Sam Weinig.
-
-        UserActivity currently provides an interface allowing counted, nested calls to enable/disable.
-        In some cases it would be easier to use if it were a simpler boolean enabled/disabled interface.
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-            - beginActivity-&gt;start, endActivity-&gt;stop.
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/PageThrottler.cpp:
-        (WebCore::PageThrottler::PageThrottler):
-        (WebCore::PageThrottler::~PageThrottler):
-        (WebCore::PageThrottler::throttlePage):
-        (WebCore::PageThrottler::unthrottlePage):
-        (WebCore::PageThrottler::setIsVisuallyIdle):
-            - beginActivity-&gt;increment, endActivity-&gt;decrement.
-        * page/PageThrottler.h:
-            - UserActivity-&gt;CountedUserActivity for m_pageActivity
-        * platform/CountedUserActivity.h: Copied from Source/WebCore/platform/UserActivity.h.
-        (WebCore::CountedUserActivity::CountedUserActivity):
-        (WebCore::CountedUserActivity::increment):
-        (WebCore::CountedUserActivity::decrement):
-            - Added, provides counted interface to UserActivity.
-        * platform/UserActivity.cpp:
-        (WebCore::UserActivity::UserActivity):
-            - m_count removed
-        (WebCore::UserActivity::start):
-        (WebCore::UserActivity::stop):
-            - beginActivity-&gt;start, endActivity-&gt;stop, implentation now empty.
-        * platform/UserActivity.h:
-            - beginActivity-&gt;start, endActivity-&gt;stop, m_count moved to HAVE(NS_ACTIVITY)
-        * platform/mac/UserActivityMac.mm:
-        (WebCore::UserActivity::UserActivity):
-            - m_count-&gt;m_started
-        (WebCore::UserActivity::isValid):
-            - m_count-&gt;m_started
-        (WebCore::UserActivity::start):
-        (WebCore::UserActivity::stop):
-            - beginActivity-&gt;start, endActivity-&gt;stop, no longer nest
</del><span class="cx"> 
</span><ins>+2013-05-01  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-28  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        [Mac Lion] Assertion failure in MediaControlTextTrackContainerElement::updateDisplay()
+        https://bugs.webkit.org/show_bug.cgi?id=115289
</ins><span class="cx"> 
</span><del>-        Caller saved registers can be accidentally discarded when clearing the local stack
-        https://bugs.webkit.org/show_bug.cgi?id=129532
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        No new tests, this is a speculative fix for an infrequent assertion.
</ins><span class="cx"> 
</span><del>-        Tests: fast/selectors/tree-modifying-case-insensitive-selectors.html
-               fast/selectors/tree-modifying-selectors.html
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::textTrackRemoveCue): Mark the cue as inactive when it is removed
+            from the active set.
</ins><span class="cx"> 
</span><del>-        StackAllocator::discard() no longer make sense now that we can use caller saved regsiter.
-        We should instead discard everything up to the beginning of the local stack.
</del><ins>+2013-05-01  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
-        * cssjit/StackAllocator.h:
-        (WebCore::StackAllocator::popAndDiscardUpTo):
</del><ins>+        TextTrackMenu crashes in ports where MediaElement players are lazily created
+        https://bugs.webkit.org/show_bug.cgi?id=115485
</ins><span class="cx"> 
</span><del>-2014-02-28  Andy Estes  &lt;aestes@apple.com&gt;
</del><ins>+        Null check the player for ports, like iOS, that lazily create the player.
</ins><span class="cx"> 
</span><del>-        [iOS] FrameLoader has a NULL m_progressTracker when initialized with initForSynthesizedDocument()
-        https://bugs.webkit.org/show_bug.cgi?id=129534
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::platformTextTrackMenu):
+        (WebCore::HTMLMediaElement::closeCaptionTracksChanged):
</ins><span class="cx"> 
</span><del>-        No new tests because TestWebKitAPI does not yet support iOS. See &lt;http://webkit.org/b/129535&gt;.
</del><ins>+2013-05-01  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::initForSynthesizedDocument): Create a FrameProgressTracker.
</del><ins>+        Add FunctionDispatcher class and make RunLoop derive from it
+        https://bugs.webkit.org/show_bug.cgi?id=115480
</ins><span class="cx"> 
</span><del>-2014-02-28  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        ASSERT(isMainThread()) hit under platformUserPreferredLanguages() with WebKit1 and WebKit2 in the same process
-        https://bugs.webkit.org/show_bug.cgi?id=129528
</del><ins>+        Change RunLoop to be a subclass of FunctionDispatcher.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * platform/RunLoop.h:
+        (RunLoop):
</ins><span class="cx"> 
</span><del>-        * platform/mac/Language.mm:
-        (WebCore::preferredLanguagesMutex):
-        (WebCore::preferredLanguages):
-        (+[WebLanguageChangeObserver languagePreferencesDidChange:]):
-        (WebCore::httpStyleLanguageCode):
-        (WebCore::platformUserPreferredLanguages):
-        Add a mutex and do an isolated copy of the strings to allow this function to be called from multiple threads.
</del><ins>+2013-05-01  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-28  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        HTMLMediaElement::updateActiveTextTrackCues can do unnecessary work
+        https://bugs.webkit.org/show_bug.cgi?id=81856
</ins><span class="cx"> 
</span><del>-        Crash at ebay.com when viewing auction items at com.apple.WebCore: WebCore::GraphicsContext3D::getExtensions + 10
-        https://bugs.webkit.org/show_bug.cgi?id=129523
</del><ins>+        Reviewed by Jer Noble.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        No new tests, covered by existing tests.
</ins><span class="cx"> 
</span><del>-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::getSupportedExtensions): Early return if the
-        context is pending policy resolution.
</del><ins>+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::ignoreTrackDisplayUpdateRequests): Add an early return when there
+            is obviously no work to be done.
</ins><span class="cx"> 
</span><del>-2014-02-28  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-04-30  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Micro-optimize JSNodeOwner::isReachableFromOpaqueRoots().
-        &lt;https://webkit.org/b/129518&gt;
</del><ins>+        Closed caption lines overlap
+        https://bugs.webkit.org/show_bug.cgi?id=115438
+        &lt;rdar://problem/13351747&gt;
</ins><span class="cx"> 
</span><del>-        Only do image and audio element specific checks for element nodes.
-        Time spent in here goes from 0.8% to 0.5% on DYEB.
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Take the line-box padding into account when determining line hight by setting
+        the -webkit-line-box-contain property to include 'inline-box'.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::isReachableFromDOM):
</del><ins>+        * css/mediaControls.css:
+        (video::-webkit-media-text-track-container):
</ins><span class="cx"> 
</span><del>-2014-02-28  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</del><ins>+2013-05-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        JSC Assertion failure every time I start Safari (r164846)
-        https://bugs.webkit.org/show_bug.cgi?id=129510
</del><ins>+        BUILD FIX (r149410): CFRunLoopStop() doesn't know what to do with a RetainPtr&lt;CFRunLoopRef&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mark Hahnenberg.
</del><ins>+        Fixes the following build failure:
</ins><span class="cx"> 
</span><del>-        Take the lock before allocating objects because afterward is too late.
</del><ins>+            WebCore/platform/cf/RunLoopCF.cpp:82:5: error: no matching function for call to 'CFRunLoopStop'
+                CFRunLoopStop(m_runLoop);
+                ^~~~~~~~~~~~~
</ins><span class="cx"> 
</span><del>-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluateInWorld):
-        (WebCore::ScriptController::windowScriptNPObject):
-        (WebCore::ScriptController::jsObjectForPluginElement):
</del><ins>+        * platform/cf/RunLoopCF.cpp:
+        (WebCore::RunLoop::stop): Call RetainPtr::get().
</ins><span class="cx"> 
</span><del>-2014-02-28  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+2013-05-01  Per-Erik Brodin  &lt;per-erik.brodin@ericsson.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: ASSERT in WebCore::JSDOMWindowBase::supportsRichSourceInfo inspecting iOS
-        https://bugs.webkit.org/show_bug.cgi?id=129512
</del><ins>+        EventSource: Loss of reconnect time precision due to integer division
+        https://bugs.webkit.org/show_bug.cgi?id=115358
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Make sure precision is not lost when converting the reconnect time from milliseconds to seconds.
</ins><span class="cx"> 
</span><del>-        * page/PageDebuggable.cpp:
-        (WebCore::PageDebuggable::connect):
-        (WebCore::PageDebuggable::disconnect):
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-2014-02-28  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        Test: http/tests/eventsource/eventsource-retry-precision.html
</ins><span class="cx"> 
</span><del>-        VisitedLinkStore should be able to invalidate link styles for associated pages
-        https://bugs.webkit.org/show_bug.cgi?id=129515
</del><ins>+        * page/EventSource.cpp:
+        (WebCore::EventSource::scheduleReconnect):
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+2013-05-01  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Add the VisitedLinkStore if we have one.
</del><ins>+        REGRESSION(r149287): Assertion failure in fast/frames/flattening/iframe-flattening-crash.html
+        &lt;http://webkit.org/b/115386&gt;
+        &lt;rdar://problem/13769995&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::Page::~Page):
-        Remove the VisitedLinkStore if we have one.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        * page/VisitedLinkStore.cpp:
-        (WebCore::VisitedLinkStore::~VisitedLinkStore):
-        Assert that we don't have any pages.
</del><ins>+        Only send synchronous resize events for the main frame. Subframes change size during layout,
+        so it never really makes sense for them to use synchronous dispatch anyway.
</ins><span class="cx"> 
</span><del>-        (WebCore::VisitedLinkStore::addPage):
-        Add the page to the set.
-
-        (WebCore::VisitedLinkStore::removePage):
-        Remove the page from the set.
-
-        (WebCore::VisitedLinkStore::invalidateStylesForAllLinks):
-        Traverse all the pages and invalidate the style for all links.
-
-        (WebCore::VisitedLinkStore::invalidateStylesForLink):
-        Traverse all the pages and invalidate the style for a given link.
-
-        * page/VisitedLinkStore.h:
-        Add new members.
-
-2014-02-28  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
-
-        [iOS][WK2] highlight rects should never big bigger than the view
-        https://bugs.webkit.org/show_bug.cgi?id=129472
-
-        Reviewed by Enrica Casucci.
-
-        * WebCore.exp.in:
-
-2014-02-28  Beth Dakin  &lt;bdakin@apple.com&gt;
-
-        Turn off margin tiles on iOS
-        https://bugs.webkit.org/show_bug.cgi?id=129509
-        -and corresponding-
-        &lt;rdar://problem/16200383&gt;
-
-        Reviewed by Simon Fraser.
-
</del><span class="cx">         * page/FrameView.cpp:
</span><del>-        (WebCore::FrameView::needsExtendedBackgroundRectForPainting):
</del><ins>+        (WebCore::FrameView::dispatchResizeEvent):
</ins><span class="cx"> 
</span><del>-2014-02-28  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2013-05-01  Csaba Osztrogonác  &lt;ossy@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Add subpixel support to border type of double, groove, ridge, inset and outset.
-        https://bugs.webkit.org/show_bug.cgi?id=129226
</del><ins>+        Unreviewed trivial buildfix after r149432.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * testing/Internals.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        This is the conversion of double, inset, outset, groove and ridge border type
-        painting to support device pixel precision width/height.
</del><ins>+2013-05-01  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Regression is covered by existing tests.
</del><ins>+        Show a block cursor in overtype mode
+        https://bugs.webkit.org/show_bug.cgi?id=114819
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::drawLineForBoxSide):
-        * rendering/RenderObject.h:
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-02-28  Adenilson Cavalcanti  &lt;cavalcantii@gmail.com&gt;
</del><ins>+        Test: editing/selection/block-cursor-overtype-mode.html
</ins><span class="cx"> 
</span><del>-        Filters should test for area instead of single dimension
-        https://bugs.webkit.org/show_bug.cgi?id=123716
</del><ins>+        Overtype mode will use block cursor instead of a caret to
+        highlight the next character to be replaced. It will fully cover
+        the next character to be replaced (except at the end of a line
+        where the usual blinking caret will be shown).
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        This new block cursor is internally implemented as a selection
+        (not exposed to JavaScript) because the selection code knows how
+        to deal with bidi text.
</ins><span class="cx"> 
</span><del>-        A filtered SVG element with a sigle dimension bigger than 5000
-        (counting the margin/border) will fail to render. So an element
-        with 4000x4000 will render fine, while another with 5000x10
-        won't. This patch instead tests against the total element area,
-        which fixes such cases.
</del><ins>+        * WebCore.exp.in: Export symbols for testing purposes.
+        * WebCore.order: Ditto.
+        * editing/Editor.cpp:
+        (WebCore::Editor::toggleOverwriteModeEnabled): Added a call to
+        FrameLoader::setShouldShowBlockCursor.
+        (WebCore):
+        * editing/Editor.h:
+        (Editor):
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::FrameSelection):
+        (WebCore::FrameSelection::updateAppearance): Use a 1-character
+        long selection to paint the cursor in overtype mode.
+        (WebCore::FrameSelection::setShouldShowBlockCursor):
+        (WebCore):
+        * editing/FrameSelection.h:
+        (WebCore::FrameSelection::shouldShowBlockCursor):
+        (FrameSelection):
+        * testing/Internals.cpp:
+        (WebCore):
+        (WebCore::Internals::selectionBounds): Added a new method which
+        returns the IntRect issued by FrameSelection::bounds().
+        * testing/Internals.h: Ditto.
+        * testing/Internals.idl: Ditto.
</ins><span class="cx"> 
</span><del>-        It also fixes some layer violations where FilterEffectRenderer and
-        RenderSVGResourceFilter were directly accessing the maximum filter
-        size in FilterEffect. Since before a somewhat bigger filter would
-        be aborted, it required to change the maximum kernel size
-        for blur filter (some filters are slower to run than others for
-        bigger SVGs).
</del><ins>+2013-04-30  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: svg/filters/big-height-filter-expected.svg
-               svg/filters/big-height-filter.svg
-               svg/filters/big-width-filter-expected.svg
-               svg/filters/big-width-filter.svg
</del><ins>+        [Mac] Remove adoptNS/retain pairs, since the two cancel each other out
+        https://bugs.webkit.org/show_bug.cgi?id=115426
</ins><span class="cx"> 
</span><del>-        * platform/graphics/filters/FEGaussianBlur.cpp:
-        * platform/graphics/filters/FilterEffect.cpp:
-        (WebCore::FilterEffect::maxFilterArea): New function, returns the
-        maximum allowed element area (currently is 4096 x 4096).
-        (WebCore::FilterEffect::isFilterSizeValid): Now it tests for
-        element area instead of a single dimension. This code is reused by
-        FilterEffectRenderer.
-        * platform/graphics/filters/FilterEffect.h:
-        * rendering/FilterEffectRenderer.cpp:
-        (WebCore::FilterEffectRenderer::updateBackingStoreRect): Uses the
-        new function in FilterEffect to test for valid sizes.
-        (WebCore::FilterEffectRendererHelper::beginFilterEffect): Same case.
-        * rendering/svg/RenderSVGResourceFilter.cpp:
-        (WebCore::RenderSVGResourceFilter::fitsInMaximumImageSize): Test
-        for maximum area and properly changes the scale of transformed
-        element to fit.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-02-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (PlatformCAAnimation::PlatformCAAnimation):
+        * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
+        (PlatformCAFilters::filterValueForOperation):
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::nsURLResponse):
+        Remove adoptNS and release from code that is doing both.
</ins><span class="cx"> 
</span><del>-        [Mac, iOS] Incorrect ordering of construction arguments for out-of-band text elements
-        https://bugs.webkit.org/show_bug.cgi?id=129501
-        &lt;rdar://problem/16198587&gt;
</del><ins>+2013-04-29  Sam Weinig  &lt;sam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Add API to allow WebKit2 banners to get mouse events
+        https://bugs.webkit.org/show_bug.cgi?id=115395
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute): Correct order of arguments
-        to PlatformTextTrack.
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-2014-02-28  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        * WebCore.exp.in:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::rootViewToTotalContents):
+        * platform/ScrollView.h:
+        Add and expose rootViewToTotalContents().
</ins><span class="cx"> 
</span><del>-        Properly clear m_logicallyLastRun to remove use-after-free possibility
-        https://bugs.webkit.org/show_bug.cgi?id=129489
</del><ins>+2013-04-30  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Make RunLoop ref-counted
+        https://bugs.webkit.org/show_bug.cgi?id=115384
</ins><span class="cx"> 
</span><del>-        A use-after-free issue was caught in Blink because m_logicallyLastRun
-        is not cleared when the item it points to is deleted. Clearing it
-        turns the use-after-free into a segfault, and prevents any future
-        use-after-frees from happening.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * platform/text/BidiRunList.h:
-        (WebCore::BidiRunList&lt;Run&gt;::deleteRuns):
</del><ins>+        Add a RunLoop::Holder class which creates and holds the ref-counted RunLoop object.
</ins><span class="cx"> 
</span><del>-2014-02-28  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        * platform/RunLoop.cpp:
+        (RunLoop::Holder):
+        (WebCore::RunLoop::Holder::Holder):
+        (WebCore::RunLoop::Holder::runLoop):
+        (WebCore::RunLoop::current):
+        * platform/RunLoop.h:
</ins><span class="cx"> 
</span><del>-        [Mac] Disambiguate calls to [[window contentView] layer] and [... setLayer:]
-        https://bugs.webkit.org/show_bug.cgi?id=129491
</del><ins>+2013-04-30  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        Clean up RunLoop code
+        https://bugs.webkit.org/show_bug.cgi?id=115454
</ins><span class="cx"> 
</span><del>-        -[NSWindow contentView] returns a bare id, leading to ambiguity when calling
-        certain methods, including -layer and -setLayer:. Resolve the ambiguity by
-        explicitly casting the -contentView call to a NSView*.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * platform/mac/WebVideoFullscreenController.mm:
-        (-[WebVideoFullscreenController setupVideoOverlay:]):
-        (-[WebVideoFullscreenController windowDidLoad]):
-        (-[WebVideoFullscreenController windowDidExitFullscreen]):
</del><ins>+        Delete a couple of functions from RunLoopCF.cpp and just use the generic ones in RunLoop.cpp,
+        use RetainPtr instead of manual retain/release. Always use an AutoreleasePool when calling performWork or timers.
</ins><span class="cx"> 
</span><del>-2014-02-28  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        * platform/RunLoop.cpp:
+        (WebCore::RunLoop::setUseApplicationRunLoopOnMainRunLoop):
+        (WebCore):
+        * platform/RunLoop.h:
+        (TimerBase):
+        (RunLoop):
+        * platform/cf/RunLoopCF.cpp:
+        (WebCore::RunLoop::performWork):
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::wakeUp):
+        (WebCore::RunLoop::TimerBase::timerFired):
+        (WebCore::RunLoop::TimerBase::TimerBase):
+        (WebCore::RunLoop::TimerBase::start):
+        (WebCore::RunLoop::TimerBase::stop):
+        (WebCore::RunLoop::TimerBase::isActive):
+        * platform/mac/RunLoopMac.mm:
+        (WebCore::RunLoop::run):
+        (WebCore::RunLoop::stop):
</ins><span class="cx"> 
</span><del>-        MouseEvent.offsetX/Y should just return 0,0 for simulated clicks.
-        &lt;https://webkit.org/b/129477&gt;
</del><ins>+2013-04-30  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        There's no need to compute the exact target-relative coordinates for
-        simulated mouse events, e.g those fired by HTMLElement.click().
</del><ins>+        &lt;button&gt; ignores margin-bottom.
+        https://bugs.webkit.org/show_bug.cgi?id=114940
+        
+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        The offsetX/Y properties are not supported by Firefox.
</del><ins>+        Make sure that the inner block inside the &lt;button&gt; (flexbox) acts like it
+        establishes a block formatting context, i.e., it should refuse to collapse
+        its margins with its children. This causes margins to stay inside the &lt;button&gt;
+        and be honored, adding to the button's overall height.
+        
+        Basically we have to remove the restriction that anonymous blocks can't be
+        BFCs on the bottom margin.
</ins><span class="cx"> 
</span><del>-        Test: fast/events/relative-offset-of-simulated-click.html
</del><ins>+        Added fast/forms/content-with-margins-inside-button.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleAfterSideOfBlock):
</ins><span class="cx"> 
</span><del>-        * dom/MouseRelatedEvent.cpp:
-        (WebCore::MouseRelatedEvent::offsetX):
-        (WebCore::MouseRelatedEvent::offsetY):
</del><ins>+2013-04-30  Andrei Bucur  &lt;abucur@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-27  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        Cleanup HTMLOListElement&lt;-&gt;RenderListItem bridge
+        https://bugs.webkit.org/show_bug.cgi?id=115434
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Fix positioning grid items using named grid lines/areas
-        https://bugs.webkit.org/show_bug.cgi?id=129372
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        Our code was assuming that a &lt;custom-ident&gt; in
-        -webkit-grid-{column|row}-{start|end} and
-        -webkit-grid-{column|row} was always a grid area name. That's
-        wrong because the &lt;custom-ident&gt; could be also a explicitly named
-        grid line or the an implicitly named grid line created by a grid
-        area definition.
</del><ins>+        Refactor the way HTMLOListElement is accessing its list items. Instead
+        of exposing the nextListItem function, wrap the desiredfunctionality
+        in static methods on RenderListItem. This should make the code more readable.
+        I've also added more constness to some functions in RenderListItem.
</ins><span class="cx"> 
</span><del>-        The style resolution code was not correct either. This patch fixes
-        it so it now matches the spec, which means that:
-        - first we try to match any existing grid area.
-        - then if there is a named grid line with the name
-        &lt;custom-ident&gt;-{start|end} for -webkit-grid-{column|row}-{start|end}
-        defined before the grid area then we use it instead of the grid
-        area.
-        - otherwise if there is a named grid line we resolve to the first such line.
-        - otherwise we treat it as 'auto'.
</del><ins>+        Tests: No new tests, just refactoring.
</ins><span class="cx"> 
</span><del>-        Fixing this uncovered a bug in GridPosition, we were not using the
-        name of the stored grid area to check if two GridPositions were
-        the same.
</del><ins>+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::updateItemValues): Use updateItemValuesForOrderedList.
+        (WebCore::HTMLOListElement::recalculateItemCount): Use itemCountForOrderedList.
+        * rendering/RenderListItem.cpp:
+        (WebCore::isList): Add more constness.
+        (WebCore::nextListItem): Make local to the CPP and add constness.
+        (WebCore::previousListItem): Add constness.
+        (WebCore::RenderListItem::updateItemValuesForOrderedList): Called by OL elements.
+        (WebCore::RenderListItem::itemCountForOrderedList): Called by OL elements.
+        (WebCore::previousOrNextItem):
+        * rendering/RenderListItem.h: Add updateItemValuesForOrderedList and itemCountForOrderedList.
</ins><span class="cx"> 
</span><del>-        Tests: fast/css-grid-layout/grid-item-position-changed-dynamic.html
-               fast/css-grid-layout/named-grid-lines-with-named-grid-areas-resolution.html
</del><ins>+2013-04-30  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::gridLineDefinedBeforeGridArea): New function to check if
-        a given named grid line was defined before an implicit named grid
-        line created by a grid area definition.
-        (WebCore::StyleResolver::adjustNamedGridItemPosition): New
-        function that adjusts the position of a GridPosition parsed as a
-        grid area.
-        (WebCore::StyleResolver::adjustGridItemPosition): Use the new
-        function adjustNamedGridItemPosition to adjust the positions of
-        named grid lines.
-        * css/StyleResolver.h:
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::resolveNamedGridLinePositionFromStyle): Use GridPosition:: namespace.
-        (WebCore::RenderGrid::resolveGridPositionFromStyle): Ditto.
-        (WebCore::RenderGrid::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition): Ditto.
-        * rendering/RenderGrid.h:
-        * rendering/style/GridPosition.h:
-        (WebCore::GridPosition::adjustGridPositionForRowEndColumnEndSide): Moved from RenderGrid.cpp.
-        (WebCore::GridPosition::adjustGridPositionForSide): Ditto.
-        (WebCore::GridPosition::operator==): Use the named grid line to check equality.
</del><ins>+        More StorageTracker cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=115435
</ins><span class="cx"> 
</span><del>-2014-02-28  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Update line segments for ShapeInside only if the new line is wide enough
-        https://bugs.webkit.org/show_bug.cgi?id=129461
</del><ins>+        Use bind instead of &quot;onMainThread&quot; helper functions.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::deleteEmptyDatabase):
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::syncImportOriginIdentifiers):
+        (WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
+        (WebCore::StorageTracker::deleteOriginWithIdentifier):
+        * storage/StorageTracker.h:
+        (StorageTracker):
</ins><span class="cx"> 
</span><del>-        Shape-inside can make a line only narrower than the original line width, thus we don't need
-        to update the line/shape segments in fitBelowFloats for every single line inside shape-inside.
-        This patch adds a helper function, which updates the line segments, furthermore it updates the
-        line segments only when the content would fit without the shape.
</del><ins>+2013-04-30  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+        Objective-C JavaScriptCore API should publicly support bridging to C
+        https://bugs.webkit.org/show_bug.cgi?id=115447
</ins><span class="cx"> 
</span><del>-        * rendering/line/BreakingContextInlineHeaders.h: Use new helper.
-        (WebCore::updateSegmentsForShapes):
-        * rendering/line/LineWidth.cpp: Use new helper.
-        (WebCore::LineWidth::updateLineSegment): Add new helper.
-        (WebCore::LineWidth::fitBelowFloats):
</del><ins>+        Reviewed by Mark Hahnenberg.
</ins><span class="cx"> 
</span><del>-2014-02-28  Mario Sanchez Prada  &lt;mario.prada@samsung.com&gt;
</del><ins>+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::javaScriptContext):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject JSValue]):
</ins><span class="cx"> 
</span><del>-        paragraphs with different directionality in textarea with unicode-bidi: plaintext are aligned the same
-        https://bugs.webkit.org/show_bug.cgi?id=71194
</del><ins>+2013-04-30  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Fix an issue with JSPerformance.cpp in the WebCore.xcodeproj where
+        it was being recognized as a diretory rather than a file, introduced
+        in r149359.
+        
+        * WebCore.xcodeproj/project.pbxproj:
</ins><span class="cx"> 
</span><del>-        Merged from Blink r157263 by &lt;igor.o@sisa.samsung.com&gt;
-        &lt;https://src.chromium.org/viewvc/blink?revision=157263&amp;view=revision&gt;
</del><ins>+2013-04-30  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        In the css3-text spec (http://www.w3.org/TR/css3-text/#bidi-linebox):
</del><ins>+        Page::pageCount() is inaccurate when we allow the first paint in App Mode
+        https://bugs.webkit.org/show_bug.cgi?id=115442
+        -and corresponding-
+        &lt;rdar://problem/13758445&gt;
</ins><span class="cx"> 
</span><del>-        The start and end edges of a line box are determined by the inline
-        base direction of the line box. In most cases, this is given by
-        its containing block's computed ‘direction’. However if its
-        containing block has ‘unicode-bidi: plaintext’, the inline base
-        direction the line box must be determined by the base direction of
-        the bidi paragraph to which it belongs: that is, the bidi
-        paragraph for which the line box holds content.
</del><ins>+        Reviewed by Dave Hyatt.
</ins><span class="cx"> 
</span><del>-        This patch just implements the behavior described above modifying
-        updateLogicalWidthForAlignment and setting the bidi level of the
-        RootInlineBox.
</del><ins>+        We should set the height here all the time, even if it is the first layout.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::checkForPaginationLogicalHeightChange):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::updateLogicalWidthForAlignment):
-        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
-        (WebCore::RenderBlockFlow::createLineBoxesFromBidiRuns):
-        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
-        (WebCore::RenderBlockFlow::deleteEllipsisLineBoxes):
-        (WebCore::RenderBlockFlow::checkLinesForTextOverflow):
-        (WebCore::RenderBlockFlow::startAlignedOffsetForLine):
</del><ins>+2013-04-30  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-28  Jochen Eisinger  &lt;jochen@chromium.org&gt;
</del><ins>+        Don't create StyleResolvers just to invalidate them.
+        &lt;http://webkit.org/b/115436&gt;
</ins><span class="cx"> 
</span><del>-        Update meta-referrer behavior for invalid policies
-        https://bugs.webkit.org/show_bug.cgi?id=129475
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        This patch aligns the behavior with the CSP 1.1 referrer directive,
-        where the fallback for an invalid value is the &quot;never&quot; policy.
</del><ins>+        Renamed Document::styleResolver() to ensureStyleResolver() so it's clear that it never returns null.
+        Removed a bunch of unnecessary null-checks I spotted while doing this.
</ins><span class="cx"> 
</span><del>-        Original patch from Mike West: https://src.chromium.org/viewvc/blink?view=rev&amp;revision=165627
</del><ins>+        Also fixed Element::willModifyAttribute() and FrameView::setFrameRect() to not create a StyleResolver
+        and immediately invalidate it in some cases.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
-
-        Test: http/tests/security/referrer-policy-invalid.html
-
</del><ins>+        * css/FontLoader.cpp:
+        (WebCore::FontLoader::loadFont):
+        (WebCore::FontLoader::checkFont):
+        (WebCore::FontLoader::resolveFontStyle):
+        * css/MediaQueryMatcher.cpp:
+        (WebCore::MediaQueryMatcher::prepareEvaluator):
+        * css/StyleMedia.cpp:
+        (WebCore::StyleMedia::matchMedium):
</ins><span class="cx">         * dom/Document.cpp:
</span><del>-        (WebCore::Document::processReferrerPolicy):
-
-2014-02-28  Daniel Bates  &lt;dabates@apple.com&gt;
-
-        SubresourceLoader::didFinishLoading() should not assert when a decode error occurs
-        https://bugs.webkit.org/show_bug.cgi?id=127029
-
-        Reviewed by Darin Adler.
-
-        SubresourceLoader::didFinishLoading() can be called for a resource (e.g. an image) that
-        failed to be decoded or, in the case of an image, whose estimated decoded size exceeds
-        the maximum decoded size (Settings::maximumDecodedImageSize()).
-
-        Test: fast/images/decoded-size-exceeds-max-decoded-size.html
-
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::didFinishLoading):
-
-2014-02-28  Martin Hodovan  &lt;mhodovan@inf.u-szeged.hu&gt;
-
-        ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer
-        https://bugs.webkit.org/show_bug.cgi?id=119626
-
-        SVGRenderSupport::mapLocalToContainer() was trying to apply transforms
-        in the incorrect order. Specifically, it would attempt to apply its
-        localToParentTransform before its localToBorderBoxTransform. This
-        was causing an ASSERT to fail when the computed transforms didn't
-        match up to those computed by RenderGeometryMap.
-
-        Backported from Blink: https://codereview.chromium.org/143363004
-
-        Reviewed by Simon Fraser.
-
-        Test: svg/transforms/svg-geometry-crash.html
-
-        * rendering/svg/SVGRenderSupport.cpp:
-        (WebCore::SVGRenderSupport::mapLocalToContainer):
-
-2014-02-28  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
-
-        [CSSRegions] ASSERTION FAILED: !m_regionsInvalidated in RenderFlowThread::regionAtBlockOffset
-        https://bugs.webkit.org/show_bug.cgi?id=129371
-
-        Reviewed by Andrei Bucur.
-
-        regionAtBlockOffset method is meant to be used after the flow thread validated
-        its region chain, otherwise we cannot rely on regionAtBlockOffset to determine correctly
-        the target region based on the offset in flow thread coordinates.
-
-        When the video element is collected in a named flow and displayed in a region, we ensure
-        that the region's decorations are taken into account to properly position the video.
-        However, we have to do that only if the named flow regions are validated.
-
-        I changed the method cachedRegionForCompositedLayer to check only the &quot;cached&quot; region
-        for a layer and not update the layer to region mappings before returning the region.
-        Because method cachedRegionForCompositedLayer does not update the region - layer mappings,
-        the code does not call regionAtBlockOffset in situations where the region chain is not validated yet.
-
-        Test: compositing/regions/video-in-overflow-region.html
-
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::getLayerListForRegion): Make it a getter that relies on
-        cached information and refrain from updating the mappings. Make it const too.
-        (WebCore::RenderFlowThread::cachedRegionForCompositedLayer):
-        * rendering/RenderFlowThread.h:
-
-2014-02-28  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
-
-        [GTK] Finetune captions menu as per design team
-        https://bugs.webkit.org/show_bug.cgi?id=129432
-
-        Reviewed by Eric Carlson.
-
-        Some design fine tuning of the captions dialog was required.
-        
-        No new tests, current suffice.
-
-        * Modules/mediacontrols/mediaControlsApple.js:
-        Added out class.
-        * Modules/mediacontrols/mediaControlsGtk.js:
-        (ControllerGtk.prototype.buildCaptionMenu): Setting out class when
-        menu is going to show overlap the panel right border.
-        * css/mediaControlsGtk.css:
-        (video::-webkit-media-controls-closed-captions-container.out):
-        Setting all borders to 5px;
-        (video::-webkit-media-controls-closed-captions-container h3):
-        Reduced font size and increasing top padding.
-        (video::-webkit-media-controls-closed-captions-container ul):
-        Increased top padding.
-
-2014-02-27  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
-
-        Element::attributeChanged shouldn't do any work when attribute value didn't change
-        https://bugs.webkit.org/show_bug.cgi?id=129467
-
-        Reviewed by Geoffrey Garen.
-
-        Exit early in childrenChanged when the attribute value didn't change.
-
-        * dom/Attr.cpp:
-        (WebCore::Attr::setValue):
-        (WebCore::Attr::childrenChanged):
</del><ins>+        (WebCore::Document::styleForElementIgnoringPendingStylesheets):
+        (WebCore::Document::styleForPage):
+        * dom/Document.h:
+        (WebCore::Document::ensureStyleResolver):
+        * dom/DocumentStyleSheetCollection.cpp:
+        (WebCore::DocumentStyleSheetCollection::combineCSSFeatureFlags):
+        (WebCore::DocumentStyleSheetCollection::resetCSSFeatureFlags):
+        (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):
</ins><span class="cx">         * dom/Element.cpp:
</span><del>-        (WebCore::Element::setAttributeInternal):
-        (WebCore::Element::attributeChanged):
-        (WebCore::Element::parserSetAttributes):
-        (WebCore::Element::removeAttributeInternal):
-        (WebCore::Element::didAddAttribute):
-        (WebCore::Element::didModifyAttribute):
-        (WebCore::Element::didRemoveAttribute):
-        (WebCore::Element::cloneAttributesFromElement):
-        * dom/Element.h:
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::attributeChanged):
-        * dom/StyledElement.h:
</del><ins>+        (WebCore::StyleResolverParentPusher::push):
+        (WebCore::StyleResolverParentPusher::~StyleResolverParentPusher):
+        (WebCore::Element::styleForRenderer):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::willModifyAttribute):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::createRendererForTextIfNeeded):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::recalcStyle):
+        (WebCore::ShadowRoot::attach):
+        * dom/Text.cpp:
+        (WebCore::Text::recalcTextStyle):
+        * editing/EditingStyle.cpp:
+        (WebCore::styleFromMatchedRulesForElement):
+        * html/HTMLCanvasElement.cpp:
+        * html/HTMLCanvasElement.h:
</ins><span class="cx">         * html/HTMLInputElement.cpp:
</span><del>-        (WebCore::HTMLInputElement::updateType):
-        * mathml/MathMLElement.cpp:
-        (WebCore::MathMLElement::attributeChanged):
-        * mathml/MathMLElement.h:
-        * mathml/MathMLSelectElement.cpp:
-        (WebCore::MathMLSelectElement::attributeChanged):
-        * mathml/MathMLSelectElement.h:
</del><ins>+        (WebCore::HTMLInputElement::customStyleForRenderer):
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::updateNonRenderStyle):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::updateNonRenderStyle):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::customStyleForRenderer):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        * html/shadow/DateTimeEditElement.cpp:
+        (WebCore::DateTimeEditElement::customStyleForRenderer):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getMatchedStylesForNode):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::getMatchedCSSRules):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setFrameRect):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::fontSelector):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getUncachedPseudoStyle):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::checkRegionStyle):
+        (WebCore::RenderRegion::computeStyleInRegion):
+        * rendering/RenderSearchField.cpp:
+        (WebCore::RenderSearchField::fontSelector):
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeNewScaledFontForStyle):
</ins><span class="cx">         * svg/SVGElement.cpp:
</span><del>-        (WebCore::SVGElement::attributeChanged):
-        * svg/SVGElement.h:
</del><ins>+        (WebCore::SVGElement::customStyleForRenderer):
+        * svg/SVGElementRareData.h:
+        (WebCore::SVGElementRareData::overrideComputedStyle):
</ins><span class="cx"> 
</span><del>-2014-02-27  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+2013-04-30  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [EFL] Remove duplicated keyboard string key from keyMap
-        https://bugs.webkit.org/show_bug.cgi?id=129469
</del><ins>+        Cap max CALayer tree depth to avoid crashes
+        https://bugs.webkit.org/show_bug.cgi?id=115431
+        &lt;rdar://problem/13401861&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        Reviewed by Tim Horton.
+        
+        Core Animation can crash if fed deeply nested layer trees.
+        Avoid this by capping CALayer tree depth at some empirically-determined
+        level.
</ins><span class="cx"> 
</span><del>-        &quot;Down&quot; key is duplicated in keyMap().
</del><ins>+        Test: compositing/layer-creation/deep-tree.html
</ins><span class="cx"> 
</span><del>-        * platform/efl/EflKeyboardUtilities.cpp:
-        (WebCore::createKeyMap):
</del><ins>+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::CommitState::CommitState): Add treeDepth to the CommitState.
+        * platform/graphics/ca/GraphicsLayerCA.cpp: Set cMaxLayerTreeDepth to 250
+        (WebCore::GraphicsLayerCA::flushCompositingStateForThisLayerOnly): We need a dummy CommitState
+        here. It is not expected that flushCompositingStateForThisLayerOnly() will be called for
+        a layer in the middle of the hierarchy, only for custom-managed leaf layers, so we don't try
+        to compute the correct tree depth.
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges): Pass in the commitState. Since this is
+        copied for each frame, no need to decrement commitState.treeDepth.
+        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers): Increment treeDepth once or
+        twice. If we've reached max, be sure to set the ChildrenChanged flag. We delay tree truncation
+        until commitLayerChangesAfterSublayers() since ChildrenChanged can be set again when children
+        are being processed.
+        (WebCore::GraphicsLayerCA::commitLayerChangesAfterSublayers):
+        (WebCore::GraphicsLayerCA::updateSublayerList): If we've hit max depth, just set
+        empty sublayers.
</ins><span class="cx"> 
</span><del>-2014-02-27  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+2013-04-30  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unify the three call sites of SelectorQueryCache
-        https://bugs.webkit.org/show_bug.cgi?id=129249
</del><ins>+        Formatting tweaks
+        https://bugs.webkit.org/show_bug.cgi?id=115427
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        The three call sites of SelectorQueryCache were doing the exact same thing.
-        That code is mvoed to a new function Document::selectorQueryForString().
</del><ins>+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::GraphicsContext3D::ImageExtractor::extractImage): Fixed indenting to match
+        normal WebKit style.
</ins><span class="cx"> 
</span><del>-        Also use String instead of AtomicString for querySelector() and querySelectorAll().
-        This prevent the call sites from creating AtomicString just for the time of the call.
-        This causes a tiny slow down on microbenchmarks that continuously query the same string
-        but has no negative impact on realistic/good test cases (and the bindings are simplified).
</del><ins>+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::pinnedInDirection): Removed an excess &quot;+&quot; that is harmless
+        but strange.
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::querySelector):
-        (WebCore::ContainerNode::querySelectorAll):
-        * dom/ContainerNode.h:
-        * dom/Document.cpp:
-        (WebCore::Document::selectorQueryForString):
-        * dom/Document.h:
-        * dom/Element.cpp:
-        (WebCore::Element::webkitMatchesSelector):
-        * dom/SelectorQuery.cpp:
-        (WebCore::SelectorQueryCache::add):
-        * dom/SelectorQuery.h:
</del><ins>+        * platform/mac/SharedBufferMac.mm: Tweaked blank lines for better paragraphing.
</ins><span class="cx"> 
</span><del>-2014-02-27  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2013-04-30  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        JSC ignores the extra memory cost of HTMLCollection after a major GC
-        https://bugs.webkit.org/show_bug.cgi?id=129450
</del><ins>+        Simplify ContainerNode::removeChildren
+        https://bugs.webkit.org/show_bug.cgi?id=115398
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        Report the extra memory cost of HTMLCollection to JSC.
</del><ins>+        Back port https://chromium.googlesource.com/chromium/blink/+/b981f01cd065236b5ff7e3a8446d15b384c1b557
+        by Andrei Bucur, which includes both this and his r148754.
</ins><span class="cx"> 
</span><del>-        Unfortunately, the existing mechanism to report the extra memory cost in toJS is insufficient for
-        HTMLCollection since collection caches are populated later when HTMLCollection is accessed. Also,
-        the extra memory cost reported by Heap::reportExtraMemoryCost will be thrown away after a major GC.
</del><ins>+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
</ins><span class="cx"> 
</span><del>-        To work around this limitation, added a visitor.reportExtraMemoryUsage call inside visitChildren
-        for interfaces with a newly added ReportExtraMemoryCost IDL extension flag to report the extra cost.
</del><ins>+2013-04-30  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Since we may need to generate visitChildren when this flag is set, we can't automatically detect
-        and generate calls using C++ template as done in r148648.
</del><ins>+        [SOUP] Move default buffer handling from ResourceHandleClient to ResourceHandlesoup
+        https://bugs.webkit.org/show_bug.cgi?id=115364
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * Modules/webaudio/AudioBuffer.idl:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (InstanceNeedsVisitChildren):
-        (GenerateHeader):
-        (GenerateImplementation):
-        * bindings/scripts/IDLAttributes.txt:
-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestException.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestObj.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSattribute.cpp:
-        (WebCore::toJS):
-        * bindings/scripts/test/JS/JSreadonly.cpp:
-        (WebCore::toJS):
-        * dom/ChildNodeList.h:
-        * dom/CollectionIndexCache.cpp: Added.
-        (WebCore::reportExtraMemoryCostForCollectionIndexCache):
-        * dom/CollectionIndexCache.h:
-        (WebCore::CollectionIndexCache::memoryCost):
-        (WebCore::NodeType&gt;::CollectionIndexCache):
-        (WebCore::NodeType&gt;::nodeCount):
-        (WebCore::NodeType&gt;::computeNodeCountUpdatingListCache):
-        (WebCore::NodeType&gt;::nodeAt):
-        (WebCore::NodeType&gt;::invalidate):
-        * dom/DOMAllInOne.cpp:
-        * dom/LiveNodeList.cpp:
-        (WebCore::LiveNodeList::memoryCost):
-        * dom/LiveNodeList.h:
-        * dom/NodeList.h:
-        (WebCore::NodeList::memoryCost):
-        * dom/NodeList.idl:
-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::updateNamedElementCache):
-        * html/HTMLCollection.h:
-        (WebCore::CollectionNamedElementCache::didPopulate):
-        (WebCore::CollectionNamedElementCache::memoryCost):
-        (WebCore::CollectionNamedElementCache::find):
-        (WebCore::HTMLCollection::memoryCost):
-        * html/HTMLCollection.idl:
-        * html/HTMLFormControlsCollection.cpp:
-        (WebCore::HTMLFormControlsCollection::updateNamedElementCache):
</del><ins>+        Reviewed by Martin Robinson.
</ins><span class="cx"> 
</span><del>-2014-02-27  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        ResourceHandleClient that is cross-platform file is not the right
+        place for the default ResourceHandle read buffer. We can make
+        getBuffer return 0 by default and handle it in ResourceHandleSoup,
+        creating a default buffer when the client doesn't provide one.
</ins><span class="cx"> 
</span><del>-        Compile attribute value matching
-        https://bugs.webkit.org/show_bug.cgi?id=129228
</del><ins>+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (StreamingClient::getOrCreateReadBuffer): Adapt to API change.
+        * platform/network/ResourceHandle.h:
+        (ResourceHandle): Add ensureReadBuffer().
+        * platform/network/ResourceHandleClient.cpp:
+        (WebCore::ResourceHandleClient::~ResourceHandleClient): Remove
+        soup specific code.
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::getOrCreateReadBuffer): Rename
+        getBuffer() as getOrCreateReadBuffer() and use a reference for the
+        out parameter instead of a pointer.
+        (ResourceHandleClient): Remove soup specific code.
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal): Rename
+        m_buffer and m_bufferSize as m_readBufferPtr and m_readBufferSize
+        and add m_readBuffer to be used as default read buffer.
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::ensureReadBuffer): Helper function to
+        make usre we have a read buffer before a read operation. It first
+        checks if the client provides a buffer and if it doesn't it
+        creates or reuses the default buffer.
+        (WebCore::redirectSkipCallback): Call ensureReadBuffer() and adapt
+        to variable name changes.
+        (WebCore::cleanupSoupRequestOperation): Adapt to variable name
+        changes.
+        (WebCore::nextMultipartResponsePartCallback): Call
+        ensureReadBuffer() and adapt to variable name changes.
+        (WebCore::sendRequestCallback): Ditto.
+        (WebCore::readCallback): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2013-04-30  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add support for compiling value matching when matching attributes in Selector.
-        This patch only adds exact matching, the other cases will follow.
</del><ins>+        REGRESSION(r149287): Assertion failure in fast/frames/flattening/iframe-flattening-crash.html
+        &lt;http://webkit.org/b/115386&gt;
+        &lt;rdar://problem/13769995&gt;
</ins><span class="cx"> 
</span><del>-        There is a little infrastructure changes since FunctionCall now needs to support
-        calls taking 2 arguments. The fun begins when the arguments are not in the right
-        registers and need to be moved to the right place. Otherwise the code is straightforward.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        In SelectorCompiler, it is necessary to handle two different cases of matching: case sensitive
-        and case insensitive. The choice is done in part at compilation time by asking HTMLDocument
-        if the name filter can include case insensitive attribute. The other part is done at runtime
-        by querying the element for its type and document.
</del><ins>+        Put the resize event on the Document's event queue if it happens while layout is in progress.
+        This avoids re-entering layout while laying out flattened subframes.
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/case-insensitive-value-matching.html
</del><ins>+        Also move the little logic for the resize event from EventHandler to FrameView (the only client.)
</ins><span class="cx"> 
</span><del>-        * css/SelectorChecker.cpp:
-        (WebCore::attributeValueMatches): Null values matching should never happen, when an attribute
-        has no value, its value is empty.
</del><ins>+        * page/EventHandler.cpp:
+        * page/EventHandler.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::dispatchResizeEvent):
</ins><span class="cx"> 
</span><del>-        * cssjit/FunctionCall.h:
-        (WebCore::FunctionCall::FunctionCall):
-        Add support for calls with two arguments.
-        (WebCore::FunctionCall::setOneArgument):
-        (WebCore::FunctionCall::setTwoArguments):
-        (WebCore::FunctionCall::swapArguments):
-        Here we need to swap two registers, but we cannot allocate a new register (because the context
-        of the function call may have taken all the available registers already).
</del><ins>+2013-04-30  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        On x86, the solution is simple, we can swap the two registers without side effects.
</del><ins>+        Fix build.
</ins><span class="cx"> 
</span><del>-        On other platforms, it is a little more complex. If there is any available register, we can just
-        use it as a temporary to make the swap.
-        If there are no available registers, we know that all the registers are taken. Since swapArguments()
-        was called after pushing all the arguments on the stack, we can safely trash the value of any of those.
-        We take the first available register that is not a function argument and use it as a temporary.
</del><ins>+        * WebCore.exp.in:
+        * storage/StorageTracker.h:
+        (StorageTracker):
</ins><span class="cx"> 
</span><del>-        (WebCore::FunctionCall::prepareAndCall):
-        This is the fun part, we have two registers where the values must go before the function call. The values
-        can be in any combination of the allocated registers. The code here needs to move the two values to
-        their target register while avoiding conflicts.
</del><ins>+2013-04-30  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::AttributeMatchingInfo::AttributeMatchingInfo):
-        (WebCore::SelectorCompiler::AttributeMatchingInfo::canDefaultToCaseSensitiveValueMatch):
-        (WebCore::SelectorCompiler::AttributeMatchingInfo::selector):
-        The value of HTMLDocument::isCaseSensitiveAttribute is needed at compilation time to compute the number
-        of required registers. As a result, we need to keep it along in the selector fragment.
</del><ins>+        More StorageTracker cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=115429
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
-        (WebCore::SelectorCompiler::attributeNameTestingRequiresNamespaceRegister):
-        (WebCore::SelectorCompiler::attributeValueTestingRequiresExtraRegister):
-        (WebCore::SelectorCompiler::minimumRegisterRequirements):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::markParentElementIfResolvingStyle):
-        (WebCore::SelectorCompiler::canMatchStyleAttribute):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSynchronizeStyleAttribute):
-        (WebCore::SelectorCompiler::canMatchAnimatableSVGAttribute):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSynchronizeAllAnimatedSVGAttribute):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeMatching):
-        The matching code is moved in a local scope. This is done to recover the register of qualifiedNameImpl
-        before doing any value matching. That register can then be used to store the expected value when matching
-        an attribute value.
-        It is unfortunate there is so much register pressure in this part.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Value matching is done outside the loop. The idea is to keep the loop really small since in the vast majority
-        of cases, name matching fails.
-        If the value matching fails, we jump back into the tight loop.
</del><ins>+        Make a bunch of member functions private, and remove StorageTracker::syncLocalStorage.
</ins><span class="cx"> 
</span><del>-        This is not ideal in all situation. For example trivial name matching with trivial value matching should
-        be done in loop. There is a FIXME to improve those cases later.
</del><ins>+        * WebCore.exp.in:
+        * storage/StorageTracker.cpp:
+        * storage/StorageTracker.h:
+        (StorageTracker):
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeValueMatching):
-        (WebCore::SelectorCompiler::testIsHTMLClassOnDocument):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementAttributeValueExactMatching):
-        In the case sensitive branch, things are really simple. We have to AtomicStringImpl pointers, if they
-        don't match, it is a failure.
</del><ins>+2013-04-30  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The case sensitive branch start by comparing the pointers in case the values are equal. This is a common
-        case and it simplifies the cases for SVG, XHTML, etc.
-        If the two values are not equal, we must first find if the context requires case insensitive comparison
-        (HTMLElement in HTMLDocument). If the conditions require case insensitive matching, we then fall back
-        to a function call.
</del><ins>+        REGRESSION(r149313) Crash at WebCore::FrameView::setFrameRect() when navigating back to previous page while find banner is displayed.
+        &lt;http://webkit.org/b/115421&gt;
+        &lt;rdar://problem/13765739&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementFunctionCallTest):
-        * dom/Attribute.h:
-        (WebCore::Attribute::valueMemoryOffset):
-        * dom/Document.h:
-        (WebCore::Document::documentClassesMemoryOffset):
-        (WebCore::Document::isHTMLDocumentClassFlag):
-        * dom/Node.h:
-        (WebCore::Node::treeScopeMemoryOffset):
-        * dom/TreeScope.h:
-        (WebCore::TreeScope::documentScopeMemoryOffset):
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-02-27  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        Add missing null-checks for Document and StyleResolver when re-evaluating media queries due to viewport changes.
</ins><span class="cx"> 
</span><del>-        Build break when disabled CSS_GRID_LAYOUT
-        https://bugs.webkit.org/show_bug.cgi?id=129459
</del><ins>+        No layout test, since we can't show the find banner from WebCore, and I can't think of another way to
+        trigger a back navigation to a Document-less Frame that would also change the FrameView's size.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::setFrameRect):
</ins><span class="cx"> 
</span><del>-        * css/CSSValue.h: Added guards of CSS_GRID_LAYOUT for GridTemplateAreasClass.
</del><ins>+2013-04-30  Glenn Adams  &lt;glenn@skynav.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-17  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        The bison grammar for @supports should return 0 in case of an error
+        https://bugs.webkit.org/show_bug.cgi?id=115402
</ins><span class="cx"> 
</span><del>-        text-decoration-skip: ink does not skip over SVG fonts
-        https://bugs.webkit.org/show_bug.cgi?id=128936
-
</del><span class="cx">         Reviewed by Darin Adler.
</span><span class="cx"> 
</span><del>-        When drawing glyphs in an SVG font, the glyphs are converted to paths and then filled. This patch moves
-        the glyph -&gt; path conversion into a helper class, GlyphToPathTranslator, and creates an implementation
-        for the SVG drawing code. Once this helper class is created, it can be used to trace paths in order
-        to make underlines skip over SVG glyphs. This helper class also has an implementation for non-SVG glyphs,
-        which allows for the glyph tracing code to be paramaterized over the implementation of the helper class
-        rather than if the FontData itself is SVG or not.
</del><ins>+        Back ported from https://chromium.googlesource.com/chromium/blink/+/74399c27c8b93286bae03a1d6371735935b34d85.
</ins><span class="cx"> 
</span><del>-        Tests: fast/css3-text/css3-text-decoration/text-decoration-skip/text-decoration-skip-ink-svg.html
</del><ins>+        Test: css3/supports-crash.html
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Font.h:
-        (WebCore::GlyphToPathTranslator::~GlyphToPathTranslator): Virtual implementation of helper class
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::Path::Path): Created constructor that takes a RefPtr&lt;CGMutablePathRef&gt;
-        * platform/graphics/Path.h:
-        * platform/graphics/TextRun.h: Give RenderingContext a factory function to create the helper class
-        instance
-        * platform/graphics/mac/FontMac.mm: Implementation of helper class used for skipping underlines on
-        regular (CoreText) glyphs
-        (WebCore::MacGlyphToPathTranslator::MacGlyphToPathTranslator):
-        (WebCore::MacGlyphToPathTranslator::moveToNextValidGlyph):
-        (WebCore::MacGlyphToPathTranslator::incrementIndex):
-        (WebCore::Font::dashesForIntersectionsWithRect): Call the relevant factory function, and use it
-        to successively generate Paths
-        * rendering/svg/SVGTextRunRenderingContext.cpp: Implementation of helper class used for SVG fonts
-        (WebCore::SVGGlyphToPathTranslator::SVGGlyphToPathTranslator):
-        (WebCore::SVGGlyphToPathTranslator::moveToNextValidGlyph):
-        (WebCore::SVGGlyphToPathTranslator::incrementIndex):
-        (WebCore::SVGTextRunRenderingContext::createGlyphToPathTranslator):
-        (WebCore::SVGTextRunRenderingContext::drawSVGGlyphs): Use the above implementation
-        * rendering/svg/SVGTextRunRenderingContext.h: Factory function declaration
</del><ins>+        * css/CSSGrammar.y.in:
</ins><span class="cx"> 
</span><del>-2014-02-27  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+2013-04-30  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [WebRTC] Removing MediaConstraints argument from RTCPeerConnection addStream, updateIce methods and constructor
-        https://bugs.webkit.org/show_bug.cgi?id=129449
</del><ins>+        [CG] Over-release in MIME type registry code
+        https://bugs.webkit.org/show_bug.cgi?id=115423
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Eric Carlson.
</span><span class="cx"> 
</span><del>-        According to WebRTC editor's draft, MediaConstraints will no longer be an argument of those methods and
-        constructor.
</del><ins>+        Sam Weinig spotted these by code inspection. I don't know how to make a test demonstrating
+        the problem, but this is clearly an over-release.
</ins><span class="cx"> 
</span><del>-        Existing tests were updated.
</del><ins>+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes): Removed incorrect adoptCF call on a string we
+        are getting from a CFArray.
+        (WebCore::initializeSupportedImageMIMETypesForEncoding): Ditto.
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::RTCPeerConnection::create):
-        (WebCore::RTCPeerConnection::RTCPeerConnection):
-        (WebCore::RTCPeerConnection::updateIce):
-        (WebCore::RTCPeerConnection::addStream):
-        * Modules/mediastream/RTCPeerConnection.h:
-        * Modules/mediastream/RTCPeerConnection.idl:
-        * bindings/js/JSRTCPeerConnectionCustom.cpp:
-        (WebCore::JSRTCPeerConnectionConstructor::constructJSRTCPeerConnection):
-        * platform/mediastream/RTCPeerConnectionHandler.h:
-        * platform/mock/RTCPeerConnectionHandlerMock.cpp:
-        (WebCore::RTCPeerConnectionHandlerMock::initialize):
-        (WebCore::RTCPeerConnectionHandlerMock::updateIce):
-        (WebCore::RTCPeerConnectionHandlerMock::addStream):
-        * platform/mock/RTCPeerConnectionHandlerMock.h:
</del><ins>+2013-04-30  Mike Lattanzio  &lt;mlattanzio@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-27  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        [BlackBerry] ImageBuffer::copyImage leaking memory
+        https://bugs.webkit.org/show_bug.cgi?id=115359
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Move named-flow specific method decorationsClipRectForBoxInRegion to RenderNamedFlowThread
-        https://bugs.webkit.org/show_bug.cgi?id=129428
</del><ins>+        Reviewed by George Staikos.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Use a WebCore::Vector to ensure the temporary data is destroyed.
+        The TiledImage does not take ownership of the data.
</ins><span class="cx"> 
</span><del>-        Since the decorationsClipRectForBoxInRegion method is a named flow specific method, it makes
-        sense to be in the named flow specific class, RenderNamedFlowThread, instead of the more
-        generic RenderFlowThread.
</del><ins>+        * platform/graphics/blackberry/ImageBufferBlackBerry.cpp:
+        (WebCore::ImageBuffer::copyImage):
</ins><span class="cx"> 
</span><del>-        No new tests required. No new functionality.
</del><ins>+2013-04-30  Noam Rosenthal  &lt;noam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paintObject):
-        * rendering/RenderFlowThread.cpp:
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
-        * rendering/RenderNamedFlowThread.h:
</del><ins>+        [Texmap] Avoid using overlap/non-overlap region in cases where the overhead is bigger than the gain
+        https://bugs.webkit.org/show_bug.cgi?id=115226
</ins><span class="cx"> 
</span><del>-2014-02-27  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+        Reviewed by Allan Sandfeld Jensen.
</ins><span class="cx"> 
</span><del>-        Avoid calling logicalLeftOffsetForLine 2 times in LineWidth::fitBelowFloats
-        https://bugs.webkit.org/show_bug.cgi?id=129433
</del><ins>+        When there are several fragmeneted overlap regions, or when the overlap region is bigger than the
+        non-overlap region, it's more efficient to have a single intermediate surface rather than split
+        the rendering to overlap/non-overlap.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Covered by tests in compositing/overlap-blending.
</ins><span class="cx"> 
</span><del>-        This change updates fitBelowFloats and its helpers to call RenderBlock::logicalLeftOffsetForLine only once.
</del><ins>+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::shouldBlend):
+            Readability fix.
</ins><span class="cx"> 
</span><del>-        No new tests, no behavior change.
</del><ins>+        (WebCore::TextureMapperLayer::paintUsingOverlapRegions):
+            Consolidate to one overlap rect when one of the following occurs:
+            - The overlap region's area is larger than the non-overlap region area.
+            - There are many fragmented overlap regions and no non-overlap regions.
</ins><span class="cx"> 
</span><del>-        * rendering/line/LineWidth.cpp:
-        (WebCore::availableWidthAtOffset):
-        (WebCore::LineWidth::updateLineDimension):
-        (WebCore::LineWidth::wrapNextToShapeOutside):
-        (WebCore::LineWidth::fitBelowFloats):
-        * rendering/line/LineWidth.h:
</del><ins>+2013-04-30  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-27  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Stop using &quot;in&quot; keyword in IDL files
+        https://bugs.webkit.org/show_bug.cgi?id=115418
</ins><span class="cx"> 
</span><del>-        Micro-optimize elementAffectsDirectionality().
-        &lt;https://webkit.org/b/129444&gt;
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Tweak this function to skip an unnecessary bit check and use
-        fastHasAttribute() instead of hasAttribute() for looking up dirAttr.
</del><ins>+        Stop using &quot;in&quot; keyword in IDL files as this is no longer part of the
+        Web IDL specification and it brings no additional information.
</ins><span class="cx"> 
</span><del>-        ~1% speedup on DYEB/AngularJS.
</del><ins>+        For now, the IDL parser will still accept the &quot;in&quot; keyword for operation
+        argument to not break anything. However, we should remove support for it
+        later on.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        * html/HTMLElement.cpp:
-        (WebCore::elementAffectsDirectionality):
</del><ins>+        * Modules/battery/BatteryManager.idl:
+        * Modules/encryptedmedia/MediaKeySession.idl:
+        * Modules/encryptedmedia/MediaKeys.idl:
+        * Modules/filesystem/DOMWindowFileSystem.idl:
+        * Modules/filesystem/DirectoryEntry.idl:
+        * Modules/filesystem/DirectoryEntrySync.idl:
+        * Modules/filesystem/DirectoryReader.idl:
+        * Modules/filesystem/EntriesCallback.idl:
+        * Modules/filesystem/Entry.idl:
+        * Modules/filesystem/EntryArray.idl:
+        * Modules/filesystem/EntryArraySync.idl:
+        * Modules/filesystem/EntryCallback.idl:
+        * Modules/filesystem/EntrySync.idl:
+        * Modules/filesystem/ErrorCallback.idl:
+        * Modules/filesystem/FileCallback.idl:
+        * Modules/filesystem/FileEntry.idl:
+        * Modules/filesystem/FileSystemCallback.idl:
+        * Modules/filesystem/FileWriter.idl:
+        * Modules/filesystem/FileWriterCallback.idl:
+        * Modules/filesystem/FileWriterSync.idl:
+        * Modules/filesystem/MetadataCallback.idl:
+        * Modules/filesystem/WorkerContextFileSystem.idl:
+        * Modules/gamepad/GamepadList.idl:
+        * Modules/geolocation/Geolocation.idl:
+        * Modules/geolocation/PositionCallback.idl:
+        * Modules/geolocation/PositionErrorCallback.idl:
+        * Modules/indexeddb/IDBCursor.idl:
+        * Modules/indexeddb/IDBDatabase.idl:
+        * Modules/indexeddb/IDBFactory.idl:
+        * Modules/indexeddb/IDBIndex.idl:
+        * Modules/indexeddb/IDBKeyRange.idl:
+        * Modules/indexeddb/IDBObjectStore.idl:
+        * Modules/indexeddb/IDBRequest.idl:
+        * Modules/indexeddb/IDBTransaction.idl:
+        * Modules/mediasource/MediaSource.idl:
+        * Modules/mediasource/SourceBuffer.idl:
+        * Modules/mediasource/SourceBufferList.idl:
+        * Modules/mediastream/MediaStream.idl:
+        * Modules/mediastream/MediaStreamTrack.idl:
+        * Modules/mediastream/NavigatorMediaStream.idl:
+        * Modules/mediastream/NavigatorUserMediaErrorCallback.idl:
+        * Modules/mediastream/NavigatorUserMediaSuccessCallback.idl:
+        * Modules/mediastream/RTCDTMFSender.idl:
+        * Modules/mediastream/RTCDataChannel.idl:
+        * Modules/mediastream/RTCErrorCallback.idl:
+        * Modules/mediastream/RTCIceCandidate.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/mediastream/RTCSessionDescription.idl:
+        * Modules/mediastream/RTCSessionDescriptionCallback.idl:
+        * Modules/mediastream/RTCStatsCallback.idl:
+        * Modules/mediastream/RTCStatsReport.idl:
+        * Modules/mediastream/RTCStatsResponse.idl:
+        * Modules/navigatorcontentutils/NavigatorContentUtils.idl:
+        * Modules/networkinfo/NetworkInfoConnection.idl:
+        * Modules/notifications/Notification.idl:
+        * Modules/notifications/NotificationCenter.idl:
+        * Modules/notifications/NotificationPermissionCallback.idl:
+        * Modules/quota/StorageErrorCallback.idl:
+        * Modules/quota/StorageInfo.idl:
+        * Modules/quota/StorageQuota.idl:
+        * Modules/quota/StorageQuotaCallback.idl:
+        * Modules/quota/StorageUsageCallback.idl:
+        * Modules/speech/SpeechGrammarList.idl:
+        * Modules/speech/SpeechRecognition.idl:
+        * Modules/speech/SpeechRecognitionResult.idl:
+        * Modules/speech/SpeechRecognitionResultList.idl:
+        * Modules/speech/SpeechSynthesisUtterance.idl:
+        * Modules/vibration/NavigatorVibration.idl:
+        * Modules/webaudio/AnalyserNode.idl:
+        * Modules/webaudio/AudioBuffer.idl:
+        * Modules/webaudio/AudioBufferCallback.idl:
+        * Modules/webaudio/AudioBufferSourceNode.idl:
+        * Modules/webaudio/AudioContext.idl:
+        * Modules/webaudio/AudioListener.idl:
+        * Modules/webaudio/AudioNode.idl:
+        * Modules/webaudio/AudioParam.idl:
+        * Modules/webaudio/BiquadFilterNode.idl:
+        * Modules/webaudio/OfflineAudioContext.idl:
+        * Modules/webaudio/OscillatorNode.idl:
+        * Modules/webaudio/PannerNode.idl:
+        * Modules/webdatabase/DOMWindowWebDatabase.idl:
+        * Modules/webdatabase/Database.idl:
+        * Modules/webdatabase/DatabaseCallback.idl:
+        * Modules/webdatabase/DatabaseSync.idl:
+        * Modules/webdatabase/SQLResultSetRowList.idl:
+        * Modules/webdatabase/SQLStatementCallback.idl:
+        * Modules/webdatabase/SQLStatementErrorCallback.idl:
+        * Modules/webdatabase/SQLTransaction.idl:
+        * Modules/webdatabase/SQLTransactionCallback.idl:
+        * Modules/webdatabase/SQLTransactionErrorCallback.idl:
+        * Modules/webdatabase/SQLTransactionSync.idl:
+        * Modules/webdatabase/SQLTransactionSyncCallback.idl:
+        * Modules/webdatabase/WorkerContextWebDatabase.idl:
+        * Modules/websockets/WebSocket.idl:
+        * bindings/scripts/test/TestCallback.idl:
+        * bindings/scripts/test/TestCustomNamedGetter.idl:
+        * bindings/scripts/test/TestDomainSecurity.idl:
+        * bindings/scripts/test/TestEventTarget.idl:
+        * bindings/scripts/test/TestInterface.idl:
+        * bindings/scripts/test/TestMediaQueryListListener.idl:
+        * bindings/scripts/test/TestNamedConstructor.idl:
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/TestOverloadedConstructors.idl:
+        * bindings/scripts/test/TestSerializedScriptValueInterface.idl:
+        * bindings/scripts/test/TestSupplemental.idl:
+        * bindings/scripts/test/TestTypedArray.idl:
+        * bindings/scripts/test/TestTypedefs.idl:
+        * css/CSSHostRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSSupportsRule.idl:
+        * css/CSSValueList.idl:
+        * css/FontLoader.idl:
+        * css/MediaList.idl:
+        * css/MediaQueryList.idl:
+        * css/MediaQueryListListener.idl:
+        * css/StyleMedia.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSMatrix.idl:
+        * dom/CharacterData.idl:
+        * dom/ClientRectList.idl:
+        * dom/Clipboard.idl:
+        * dom/CompositionEvent.idl:
+        * dom/CustomEvent.idl:
+        * dom/DOMImplementation.idl:
+        * dom/DOMNamedFlowCollection.idl:
+        * dom/DOMStringList.idl:
+        * dom/DataTransferItem.idl:
+        * dom/DataTransferItemList.idl:
+        * dom/DeviceMotionEvent.idl:
+        * dom/DeviceOrientationEvent.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/Element.idl:
+        * dom/Event.idl:
+        * dom/EventListener.idl:
+        * dom/EventTarget.idl:
+        * dom/HashChangeEvent.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.idl:
+        * dom/MouseEvent.idl:
+        * dom/MutationEvent.idl:
+        * dom/MutationObserver.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeFilter.idl:
+        * dom/NodeList.idl:
+        * dom/OverflowEvent.idl:
+        * dom/PropertyNodeList.idl:
+        * dom/Range.idl:
+        * dom/RequestAnimationFrameCallback.idl:
+        * dom/ShadowRoot.idl:
+        * dom/StringCallback.idl:
+        * dom/Text.idl:
+        * dom/TextEvent.idl:
+        * dom/TouchEvent.idl:
+        * dom/TouchList.idl:
+        * dom/UIEvent.idl:
+        * dom/WebKitNamedFlow.idl:
+        * dom/WheelEvent.idl:
+        * fileapi/Blob.idl:
+        * fileapi/FileList.idl:
+        * fileapi/FileReader.idl:
+        * fileapi/FileReaderSync.idl:
+        * html/DOMFormData.idl:
+        * html/DOMTokenList.idl:
+        * html/DOMURL.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLAudioElement.idl:
+        * html/HTMLButtonElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLFieldSetElement.idl:
+        * html/HTMLFormControlsCollection.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLKeygenElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLOutputElement.idl:
+        * html/HTMLPropertiesCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/MediaController.idl:
+        * html/TimeRanges.idl:
+        * html/canvas/ArrayBuffer.idl:
+        * html/canvas/CanvasGradient.idl:
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/DOMPath.idl:
+        * html/canvas/DataView.idl:
+        * html/canvas/EXTDrawBuffers.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/OESVertexArrayObject.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * html/canvas/WebGLDebugShaders.idl:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/track/AudioTrackList.idl:
+        * html/track/TextTrack.idl:
+        * html/track/TextTrackCue.idl:
+        * html/track/TextTrackCueList.idl:
+        * html/track/TextTrackList.idl:
+        * html/track/TextTrackRegionList.idl:
+        * html/track/VideoTrackList.idl:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/JavaScriptCallFrame.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/Console.idl:
+        * page/Crypto.idl:
+        * page/DOMSecurityPolicy.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/EventSource.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/PagePopupController.idl:
+        * page/Performance.idl:
+        * page/PerformanceEntryList.idl:
+        * page/SpeechInputResultList.idl:
+        * plugins/DOMMimeTypeArray.idl:
+        * plugins/DOMPlugin.idl:
+        * plugins/DOMPluginArray.idl:
+        * storage/Storage.idl:
+        * storage/StorageEvent.idl:
+        * svg/ElementTimeControl.idl:
+        * svg/SVGAngle.idl:
+        * svg/SVGColor.idl:
+        * svg/SVGDocument.idl:
+        * svg/SVGElementInstanceList.idl:
+        * svg/SVGFEDropShadowElement.idl:
+        * svg/SVGFEGaussianBlurElement.idl:
+        * svg/SVGFEMorphologyElement.idl:
+        * svg/SVGFilterElement.idl:
+        * svg/SVGLength.idl:
+        * svg/SVGLengthList.idl:
+        * svg/SVGLocatable.idl:
+        * svg/SVGMarkerElement.idl:
+        * svg/SVGMatrix.idl:
+        * svg/SVGNumberList.idl:
+        * svg/SVGPaint.idl:
+        * svg/SVGPathElement.idl:
+        * svg/SVGPathSegList.idl:
+        * svg/SVGPoint.idl:
+        * svg/SVGPointList.idl:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGStringList.idl:
+        * svg/SVGStyledElement.idl:
+        * svg/SVGTests.idl:
+        * svg/SVGTextContentElement.idl:
+        * svg/SVGTransform.idl:
+        * svg/SVGTransformList.idl:
+        * testing/InternalSettings.idl:
+        * testing/Internals.idl:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
+        * workers/WorkerContext.idl:
+        * xml/DOMParser.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestUpload.idl:
+        * xml/XMLSerializer.idl:
+        * xml/XPathEvaluator.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XPathResult.idl:
+        * xml/XSLTProcessor.idl:
</ins><span class="cx"> 
</span><del>-2014-02-27  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+2013-04-30  Noam Rosenthal  &lt;noam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: model tests should use a special Test.html inspector page
-        https://bugs.webkit.org/show_bug.cgi?id=129190
</del><ins>+        [Texmap] Use fewer intermediate surfaces when compositing filters
+        https://bugs.webkit.org/show_bug.cgi?id=115224
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Reviewed by Allan Sandfeld Jensen.
</ins><span class="cx"> 
</span><del>-        Convert InspectorController::isUnderTest() into a flag, and expose an
-        Internals method so it can be set by the test before opening the inspector.
</del><ins>+        Until now, when rendering CSS filters, the filters were applied to the texture
+        and then the resulting texture would be composited to the target surface with
+        its transform/opacity.
+        This requires at least two intermediate surface passes for every filtered layer.
</ins><span class="cx"> 
</span><del>-        Test: inspector/test-harness-trivially-works.html
</del><ins>+        This patch makes it so that the last filter pass is applied together with the 
+        resulting surface's opacity and transform, during composition.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::evaluateForTestInFrontend):
-        * inspector/InspectorController.h:
-        * testing/Internals.cpp:
-        (WebCore::Internals::setInspectorIsUnderTest): Added.
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+        Tested by css3/filters tests, whichn now scroll/zoom a lot faster.
</ins><span class="cx"> 
</span><del>-2014-02-27  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::applyFilters):
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGLData::TextureMapperGLData):
+        (TextureMapperGLData):
+        (WebCore):
+        (WebCore::optionsForFilterType):
+        (WebCore::getPassesRequiredForFilter):
+        (WebCore::gauss):
+        (WebCore::gaussianKernel):
+        (WebCore::prepareFilterProgram):
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::TextureMapperGL::drawFiltered):
+        (WebCore::isCustomFilter):
+        * platform/graphics/texmap/TextureMapperGL.h:
+        (TextureMapperGL):
+        (BitmapTextureGL):
+        (FilterInfo):
+        * platform/graphics/texmap/TextureMapperImageBuffer.cpp:
+        (WebCore::BitmapTextureImageBuffer::applyFilters):
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (BitmapTextureImageBuffer):
+        (WebCore::BitmapTextureGL::FilterInfo::FilterInfo):
+        (WebCore::BitmapTextureGL::filterInfo):
+        (WebCore::BitmapTextureGL::applyFilters):
+            Modify TextureMapperGL to remember the last filter operation applied
+            to a BitmapTexture and apply it when the texture is composited.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r164824.
</del><ins>+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::paintIntoSurface):
+            Simplify the call to applyFilters, since now TextureMapperGL is responsible
+            for maintaining the content texture.
</ins><span class="cx"> 
</span><del>-        Accidentally re-added some code that was removed.
</del><span class="cx"> 
</span><del>-        * page/ContentSecurityPolicy.cpp:
</del><ins>+2013-04-30  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        [EFL] Enable scaled cursors
+        https://bugs.webkit.org/show_bug.cgi?id=106242
</ins><span class="cx"> 
</span><del>-        Compile fix when not using TEXTURE_MAPPER_GL.
-        https://bugs.webkit.org/show_bug.cgi?id=129417
</del><ins>+        Reviewed by Gyuyoung Kim.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Correctly copy WebCore::Cursor's m_imageScaleFactor
+        member in CursorEfl.cpp when MOUSE_CURSOR_SCALE is
+        enabled.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/texmap/TextureMapperGL.cpp:
-        Protect platformCreateAccelerated with USE(TEXTURE_MAPPER_GL).
</del><ins>+        No new tests, already covered by existing tests.
</ins><span class="cx"> 
</span><del>-2014-02-27  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        * platform/efl/CursorEfl.cpp:
+        (WebCore::Cursor::Cursor):
+        (WebCore::Cursor::operator=):
</ins><span class="cx"> 
</span><del>-        Web Inspector: JSContext inspection should report exceptions in the console
-        https://bugs.webkit.org/show_bug.cgi?id=128776
</del><ins>+2013-04-30  Thiago Marcos P. Santos  &lt;thiago.santos@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        CSSParser::parseFontFamily should allow the keyword &quot;default&quot; as part of a font name
+        https://bugs.webkit.org/show_bug.cgi?id=107231
</ins><span class="cx"> 
</span><del>-        Include some clean up of ConsoleMessage and ScriptCallStack construction.
</del><ins>+        Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+        Make sure that using the keyword &quot;default&quot; as font family doesn't
+        invalidate the whole declaration. It is also OK to use a font that
+        has &quot;default&quot; as part of a composite name (i.e. &quot;default foo&quot;).
+        This matches the behavior of Firefox and IE.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        Simplify code now that createStackTraceFromException handles it.
</del><ins>+        Test: fast/css/font-family-parse-keyword.html
</ins><span class="cx"> 
</span><del>-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::gatherSecurityPolicyViolationEventData):
-        (WebCore::ContentSecurityPolicy::reportViolation):
-        ScriptCallStack can give us the first non-native callframe.
</del><ins>+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFamily):
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::buildInitiatorObject):
-        * inspector/PageDebuggerAgent.cpp:
-        (WebCore::PageDebuggerAgent::breakpointActionLog):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createGenericRecord):
-        * page/Console.cpp:
-        (WebCore::internalAddMessage):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::timeEnd):
-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::gatherSecurityPolicyViolationEventData):
-        (WebCore::ContentSecurityPolicy::reportViolation):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessage):
</del><ins>+2013-04-30  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-27  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Animations fail to start on http://www.google.com/insidesearch/howsearchworks/thestory/
+        https://bugs.webkit.org/show_bug.cgi?id=111244
</ins><span class="cx"> 
</span><del>-        Remove FeatureObserver.
-        &lt;https://webkit.org/b/129439&gt;
</del><ins>+        Reviewed by David Kilzer.
+        
+        Enable performance.now() as a minimal subset of Web Timing API. 
+        It returns DOMHighResTimeStamp, a monotonically increasing value representing the 
+        number of milliseconds from the start of the navigation of the current document.
+        JS libraries use this API to check against the requestAnimationFrame() timestamp.
</ins><span class="cx"> 
</span><del>-        This code was only used by the Chromium port and nobody else is
-        making use of it.
</del><ins>+        Test: fast/dom/Window/web-timing-minimal-performance-now.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::fireEventListeners):
-        * dom/EventTarget.h:
-        * html/ColorInputType.cpp:
-        * html/ColorInputType.h:
-        * html/DateInputType.cpp:
-        * html/DateInputType.h:
-        * html/DateTimeInputType.cpp:
-        * html/DateTimeInputType.h:
-        * html/DateTimeLocalInputType.cpp:
-        * html/DateTimeLocalInputType.h:
-        * html/EmailInputType.cpp:
-        * html/EmailInputType.h:
-        * html/HTMLDataListElement.cpp:
-        (WebCore::HTMLDataListElement::create):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::parseAttribute):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseAttribute):
-        * html/HTMLTextFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::parseAttribute):
-        * html/InputType.cpp:
-        * html/InputType.h:
-        * html/MonthInputType.cpp:
-        * html/MonthInputType.h:
-        * html/NumberInputType.cpp:
-        * html/NumberInputType.h:
-        * html/RangeInputType.cpp:
-        * html/RangeInputType.h:
-        * html/SearchInputType.cpp:
-        * html/SearchInputType.h:
-        * html/TelephoneInputType.cpp:
-        * html/TelephoneInputType.h:
-        * html/TextInputType.cpp:
-        * html/TextInputType.h:
-        * html/TimeInputType.cpp:
-        * html/TimeInputType.h:
-        * html/URLInputType.cpp:
-        * html/URLInputType.h:
-        * html/WeekInputType.cpp:
-        * html/WeekInputType.h:
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::responseReceived):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions):
-        (WebCore::FrameLoader::dispatchDidCommitLoad):
-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::ContentSecurityPolicy::didReceiveHeader):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor):
-        * page/FeatureObserver.cpp: Removed.
-        * page/FeatureObserver.h: Removed.
-        * page/Page.h:
-        * rendering/RenderDeprecatedFlexibleBox.cpp:
-        (WebCore::RenderDeprecatedFlexibleBox::RenderDeprecatedFlexibleBox):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
-        * workers/SharedWorker.cpp:
-        (WebCore::SharedWorker::create):
-        * workers/Worker.cpp:
-        (WebCore::Worker::create):
</del><ins>+        * dom/EventTargetFactory.in:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::resetDOMWindowProperties):
+        (WebCore):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * page/DOMWindow.idl:
+        * page/Performance.cpp:
+        (WebCore):
+        * page/Performance.h:
+        (Performance):
+        * page/Performance.idl:
</ins><span class="cx"> 
</span><del>-2014-02-27  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+2013-04-30  Commit Queue  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        speechSynthesis.speak of a zero length utterance kills future speech
-        https://bugs.webkit.org/show_bug.cgi?id=129403
</del><ins>+        Unreviewed, rolling out r149338.
+        http://trac.webkit.org/changeset/149338
+        https://bugs.webkit.org/show_bug.cgi?id=115409
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+        Broke layout/perf/API tests on non-Mac:
+        ThreadSpecific&lt;RefPtr&lt;RunLoop&gt;&gt; does not initialize RunLoop
+        (Requested by rakuco on #webkit).
</ins><span class="cx"> 
</span><del>-        Empty length strings may choke a synthesizer and result in didFinishSpeaking not being called. 
-        The WebKit code should be proactive about screening out empty length strings.
</del><ins>+        * platform/RunLoop.cpp:
+        (WebCore::RunLoop::current):
+        * platform/RunLoop.h:
+        (RunLoop):
+        * platform/cf/RunLoopCF.cpp:
+        (WebCore::RunLoop::initializeMainRunLoop):
+        (WebCore::RunLoop::current):
+        (WebCore::RunLoop::~RunLoop):
+        * platform/efl/RunLoopEfl.cpp:
+        (WebCore::RunLoop::~RunLoop):
+        * platform/gtk/RunLoopGtk.cpp:
+        (WebCore::RunLoop::~RunLoop):
+        * platform/win/RunLoopWin.cpp:
+        (WebCore::RunLoop::~RunLoop):
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/fast/speechsynthesis/speech-synthesis-speak-empty-string.html
</del><ins>+2013-04-30  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/speech/SpeechSynthesis.cpp:
-        (WebCore::SpeechSynthesis::startSpeakingImmediately):
</del><ins>+        ImageBufferData: add BlackBerry header
+        https://bugs.webkit.org/show_bug.cgi?id=115408
</ins><span class="cx"> 
</span><del>-2014-02-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Reviewed by Carlos Garcia Campos.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r164783.
-        http://trac.webkit.org/changeset/164783
-        https://bugs.webkit.org/show_bug.cgi?id=129425
</del><ins>+        * platform/graphics/ImageBufferData.h:
</ins><span class="cx"> 
</span><del>-        Broke number of multicol tests (Requested by anttik on
-        #webkit).
</del><ins>+2013-04-30  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::containingColumnsBlock):
</del><ins>+        Replace &quot;Optional&quot; extended attribute by proper Web IDL &quot;optional&quot; keyword
+        https://bugs.webkit.org/show_bug.cgi?id=115380
</ins><span class="cx"> 
</span><del>-2014-02-27  Antoine Quint  &lt;graouts@webkit.org&gt;
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Respect SVG fragment identifiers in &lt;img&gt; src attribute
-        https://bugs.webkit.org/show_bug.cgi?id=129387
</del><ins>+        Replace [Optional] with standard WebIDL optional type prefix:
+        http://dev.w3.org/2006/webapi/WebIDL/#dfn-optional-argument
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        The default behavior now matches WebIDL: [Optional] =&gt; optional
</ins><span class="cx"> 
</span><del>-        Test: svg/css/svg-resource-fragment-identifier-img-src.html
</del><ins>+        Two cases where WebKit has extended bindings behavior still
+        require a non-standard IDL attribute:
+        [Optional=DefaultIsNullString] =&gt; [Default=NullString] optional
+        [Optional=DefaultIsUndefined] =&gt; [Default=Undefined] optional
</ins><span class="cx"> 
</span><del>-        When providing an SVG image for a given renderer, check that the URL used to load
-        that image is taken into account in case it featured a fragment identifier, ensuring
-        that the CSS :target pseudo-class is correctly handled for SVG resources. This patch
-        is specific to &lt;img&gt; elements, specific support will also need to be added for various
-        CSS properties that support SVG images.
</del><ins>+        Based on corresponding Blink patch from Joshua Bell for compatibility.
</ins><span class="cx"> 
</span><del>-        * svg/graphics/SVGImageCache.cpp:
-        (WebCore::SVGImageCache::imageForRenderer):
-        Check if the provided renderer is attached to an &lt;img&gt; element and, if so, pass the
-        resolved &lt;img&gt; source URL, taking into account srcset, to the SVGImageForContainer.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        * svg/graphics/SVGImageForContainer.cpp:
-        (WebCore::SVGImageForContainer::setURL):
-        Trigger the FrameView machinery to ensure that the :target pseudo-class is respected
-        should the provided URL feature a fragment identifier.
</del><ins>+        * Modules/battery/BatteryManager.idl:
+        * Modules/encryptedmedia/MediaKeySession.idl:
+        * Modules/encryptedmedia/MediaKeys.idl:
+        * Modules/filesystem/DOMWindowFileSystem.idl:
+        * Modules/filesystem/DirectoryEntry.idl:
+        * Modules/filesystem/DirectoryReader.idl:
+        * Modules/filesystem/Entry.idl:
+        * Modules/filesystem/FileEntry.idl:
+        * Modules/filesystem/FileWriter.idl:
+        * Modules/filesystem/WorkerContextFileSystem.idl:
+        * Modules/gamepad/GamepadList.idl:
+        * Modules/geolocation/Geolocation.idl:
+        * Modules/indexeddb/IDBCursor.idl:
+        * Modules/indexeddb/IDBDatabase.idl:
+        * Modules/indexeddb/IDBFactory.idl:
+        * Modules/indexeddb/IDBIndex.idl:
+        * Modules/indexeddb/IDBKeyRange.idl:
+        * Modules/indexeddb/IDBObjectStore.idl:
+        * Modules/indexeddb/IDBRequest.idl:
+        * Modules/indexeddb/IDBTransaction.idl:
+        * Modules/mediasource/MediaSource.idl:
+        * Modules/mediasource/SourceBufferList.idl:
+        * Modules/mediastream/MediaStream.idl:
+        * Modules/mediastream/MediaStreamTrack.idl:
+        * Modules/mediastream/NavigatorMediaStream.idl:
+        * Modules/mediastream/RTCDTMFSender.idl:
+        * Modules/mediastream/RTCDataChannel.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/mediastream/RTCStatsResponse.idl:
+        * Modules/networkinfo/NetworkInfoConnection.idl:
+        * Modules/notifications/Notification.idl:
+        * Modules/notifications/NotificationCenter.idl:
+        * Modules/quota/StorageInfo.idl:
+        * Modules/quota/StorageQuota.idl:
+        * Modules/speech/SpeechGrammarList.idl:
+        * Modules/speech/SpeechRecognition.idl:
+        * Modules/speech/SpeechSynthesisUtterance.idl:
+        * Modules/webaudio/AudioContext.idl:
+        * Modules/webaudio/AudioNode.idl:
+        * Modules/webdatabase/DOMWindowWebDatabase.idl:
+        * Modules/webdatabase/Database.idl:
+        * Modules/webdatabase/DatabaseSync.idl:
+        * Modules/webdatabase/SQLTransaction.idl:
+        * Modules/webdatabase/WorkerContextWebDatabase.idl:
+        * Modules/websockets/WebSocket.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GetFunctionLength):
+        (GenerateFunctionParametersCheck):
+        (GenerateArgumentsCountCheck):
+        (GenerateParametersCheck):
+        (GenerateConstructorDefinition):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/IDLParser.pm:
+        (parseOptionalOrRequiredArgument):
+        * bindings/scripts/test/TestEventTarget.idl:
+        * bindings/scripts/test/TestInterface.idl:
+        * bindings/scripts/test/TestNamedConstructor.idl:
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/TestSerializedScriptValueInterface.idl:
+        * bindings/scripts/test/TestTypedefs.idl: optional cannot be used in a typedef.
+        * css/CSSHostRule.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSSupportsRule.idl:
+        * css/CSSValueList.idl:
+        * css/FontLoader.idl:
+        * css/MediaList.idl:
+        * css/MediaQueryList.idl:
+        * css/MediaQueryListListener.idl:
+        * css/StyleMedia.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSMatrix.idl:
+        * dom/CharacterData.idl:
+        * dom/ClientRectList.idl:
+        * dom/Clipboard.idl:
+        * dom/CompositionEvent.idl:
+        * dom/CustomEvent.idl:
+        * dom/DOMImplementation.idl:
+        * dom/DOMStringList.idl:
+        * dom/DataTransferItem.idl:
+        * dom/DataTransferItemList.idl:
+        * dom/DeviceMotionEvent.idl:
+        * dom/DeviceOrientationEvent.idl:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Event.idl:
+        * dom/EventTarget.idl:
+        * dom/HashChangeEvent.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.idl:
+        * dom/MouseEvent.idl:
+        * dom/MutationEvent.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeFilter.idl:
+        * dom/NodeList.idl:
+        * dom/OverflowEvent.idl:
+        * dom/Range.idl:
+        * dom/ShadowRoot.idl:
+        * dom/Text.idl:
+        * dom/TextEvent.idl:
+        * dom/TouchEvent.idl:
+        * dom/UIEvent.idl:
+        * dom/WebKitNamedFlow.idl:
+        * dom/WheelEvent.idl:
+        * fileapi/Blob.idl:
+        * fileapi/FileReader.idl:
+        * fileapi/FileReaderSync.idl:
+        * html/DOMFormData.idl:
+        * html/DOMTokenList.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLAudioElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLFormControlsCollection.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/MediaController.idl:
+        * html/canvas/ArrayBuffer.idl:
+        * html/canvas/CanvasGradient.idl:
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/DOMPath.idl:
+        * html/canvas/DataView.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/OESVertexArrayObject.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * html/track/AudioTrackList.idl:
+        * html/track/TextTrack.idl:
+        * html/track/TextTrackCue.idl:
+        * html/track/TextTrackList.idl:
+        * html/track/VideoTrackList.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/EventSource.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/Performance.idl:
+        * plugins/DOMMimeTypeArray.idl:
+        * plugins/DOMPlugin.idl:
+        * plugins/DOMPluginArray.idl:
+        * storage/StorageEvent.idl:
+        * svg/ElementTimeControl.idl:
+        * svg/SVGDocument.idl:
+        * svg/SVGElementInstanceList.idl:
+        * svg/SVGFEDropShadowElement.idl:
+        * svg/SVGFEGaussianBlurElement.idl:
+        * svg/SVGFEMorphologyElement.idl:
+        * svg/SVGFilterElement.idl:
+        * svg/SVGLocatable.idl:
+        * svg/SVGMarkerElement.idl:
+        * svg/SVGPathElement.idl:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGStyledElement.idl:
+        * svg/SVGTests.idl:
+        * svg/SVGTextContentElement.idl:
+        * testing/Internals.idl:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
+        * workers/WorkerContext.idl:
+        * xml/DOMParser.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestUpload.idl:
+        * xml/XMLSerializer.idl:
+        * xml/XPathEvaluator.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XPathResult.idl:
+        * xml/XSLTProcessor.idl:
</ins><span class="cx"> 
</span><del>-        * svg/graphics/SVGImageForContainer.h:
-        Declare the new setURL() method.
</del><ins>+2013-04-30  Jocelyn Turcotte  &lt;jocelyn.turcotte@digia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-27  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+        Fix the USE(3D_GRAPHICS) build with the standard OpenGL on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=114684
</ins><span class="cx"> 
</span><del>-        [ATK] Fix style errors in enum members
-        https://bugs.webkit.org/show_bug.cgi?id=129421
</del><ins>+        Reviewed by Simon Hausmann.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+        Currently USE(3D_GRAPHICS) is only supported with OpenGLES through ANGLE
+        on Windows. Allow building with the stock opengl32.lib on Windows by adding
+        missing glCompressedTex* entries in OpenGLShims.
+        Those are used in Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+        and will be substituted by the preprocessor.
</ins><span class="cx"> 
</span><del>-        No new tests. No new functionality.
</del><ins>+        * platform/graphics/OpenGLShims.cpp:
+        (WebCore::initializeOpenGLShims):
+        * platform/graphics/OpenGLShims.h:
+        (_OpenGLFunctionTable):
</ins><span class="cx"> 
</span><del>-        Enum members should use InterCaps with an initial capital letter.
</del><ins>+2013-04-29  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
-        (getInterfaceMaskFromObject):
</del><ins>+        Remove all remaining Skia code
+        https://bugs.webkit.org/show_bug.cgi?id=115263
</ins><span class="cx"> 
</span><del>-2014-02-27  Mihai Tica  &lt;mitica@adobe.com&gt;
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Parse and implement the -webkit-isolation CSS property.
</del><ins>+        * html/HTMLCanvasElement.cpp:
+        (WebCore): Remove the MaxSkiaDim constant, which was a leftover
+        from r149193.
+        * platform/graphics/harfbuzz/FontHarfBuzz.cpp: Removed.
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp: Removed.
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h: Removed.
+        * platform/graphics/harfbuzz/HarfBuzzFaceSkia.cpp: Removed.
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=128958
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+        Fix build.
</ins><span class="cx"> 
</span><del>-        Parse and implement -webkit-isolation, part of the CSS Blending and Compositing spec.
-        This patch adds functionality for HTML and SVG.
-        -webkit-isolation: isolate restricts any child elements from blending with any of the content outside the isolated parent element.
</del><ins>+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::DerivedFontData::~DerivedFontData):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCompositeFontReferenceFontData):
</ins><span class="cx"> 
</span><del>-        Tests: css3/compositing/isolation-isolate-blended-child.html
-               css3/compositing/isolation-parsing.html
-               css3/compositing/svg-isolation-default.html
-               css3/compositing/svg-isolation-isolated-group.html
-               css3/compositing/svg-isolation-simple.html
</del><ins>+2013-04-29  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::isValidKeywordPropertyAndValue):
-        (WebCore::isKeywordPropertyID):
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator Isolation):
-        * css/CSSPropertyNames.in: Add -webkit-isolation.
-        * css/CSSValueKeywords.in: Add the isolate value.
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::adjustRenderStyle): Explicitly set isolation:isolate to create a stacking context.
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeRequiresLayerRepaint): Changing isolation should trigger a repaint.
-        * rendering/style/RenderStyle.h: Setters and getters for isolation.
-        * rendering/style/RenderStyleConstants.h: Add Isolation enum.
-        * rendering/style/StyleRareNonInheritedData.cpp: Add m_isolation.
-        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
-        (WebCore::StyleRareNonInheritedData::operator==):
-        * rendering/style/StyleRareNonInheritedData.h:
-        * rendering/svg/SVGRenderingContext.cpp:
-        (WebCore::SVGRenderingContext::prepareToRenderSVGContent): If isolated, paint in a transparency layer.
</del><ins>+        Don't do CGContext flipping when painting subframes in WebKit1 on post-MountainLion OSes
+        https://bugs.webkit.org/show_bug.cgi?id=115392
+        &lt;rdar://problem/13421519&gt;
</ins><span class="cx"> 
</span><del>-2014-02-27  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        [ATK] Utilize AtkTableCell to expose directly AccessibilityTableCell to AT
-        https://bugs.webkit.org/show_bug.cgi?id=129250
</del><ins>+        Sync up with AppKit behavior changes that could cause subviews to be flipped when
+        painted.
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint):
</ins><span class="cx"> 
</span><del>-        Test: accessibility/table-scope.html
</del><ins>+2013-04-29  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Exposing AtkTableCell to AT. Implementing possibility to get column headers and row headers
-        as an array of cells.
</del><ins>+        WEB SPEECH: need to identify the default voice per language
+        https://bugs.webkit.org/show_bug.cgi?id=115366
</ins><span class="cx"> 
</span><del>-        * GNUmakefile.list.am:
-        * PlatformEfl.cmake:
-        * accessibility/atk/WebKitAccessibleInterfaceTableCell.cpp: Added.
-        (convertToGPtrArray):
-        (core):
-        (webkitAccessibleTableCellGetColumnHeaderCells):
-        (webkitAccessibleTableCellGetRowHeaderCells):
-        (webkitAccessibleTableCellInterfaceInit):
-        * accessibility/atk/WebKitAccessibleInterfaceTableCell.h: Added.
-        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
-        (getInterfaceMaskFromObject):
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-2014-02-27  Renata Hodovan  &lt;rhodovan.u-szeged@partner.samsung.com&gt;
</del><ins>+        Use a WKSystemInterface method to determine which voice per language is the default voice.
</ins><span class="cx"> 
</span><del>-        Improving containing column block determination
-        https://bugs.webkit.org/show_bug.cgi?id=125449
</del><ins>+        When looking for a voice, there may not be a default at all, so we need to search until we
+        find a default.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        * WebCore.exp.in:
+        * platform/mac/PlatformSpeechSynthesizerMac.mm:
+        (-[WebSpeechSynthesisWrapper speakUtterance:WebCore::]):
+        (WebCore::PlatformSpeechSynthesizer::initializeVoiceList):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
</ins><span class="cx"> 
</span><del>-        Making sure that the containing column block of any elements
-        can not be oneself.
</del><ins>+2013-04-29  James Craig  &lt;james@cookiecrook.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/css/crash-on-column-splitting.html
</del><ins>+        Settings.in selectionIncludesAltImageText should default to true, due to update in HTML spec.
+        https://bugs.webkit.org/show_bug.cgi?id=115283
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::containingColumnsBlock):
-        (WebCore::RenderBlock::splitFlow):
</del><ins>+        Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-2014-02-27  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</del><ins>+        Config change due to this spec update:
+        https://www.w3.org/Bugs/Public/show_bug.cgi?id=21403
+        http://html5.org/tools/web-apps-tracker?from=7854&amp;to=7855
</ins><span class="cx"> 
</span><del>-        [GTK] Improve JavaScript multimedia controls
-        https://bugs.webkit.org/show_bug.cgi?id=129044
</del><ins>+        Updated existing test coverage.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        * page/Settings.in:
</ins><span class="cx"> 
</span><del>-        After webkit.org/b/123097 a follow up was needed to improve
-        accessibily and some other cosmetic problems, like cleaner CSS and
-        new missing baselines.
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        No new tests because of no new functionality.
</del><ins>+        Make RunLoop ref-counted
+        https://bugs.webkit.org/show_bug.cgi?id=115384
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.js:
-        Added hiding class name.
-        * Modules/mediacontrols/mediaControlsGtk.js:
-        (ControllerGtk.prototype.createControls): Set remaining time as
-        hidden by default and turned volumebox hidden into hiding.
-        (ControllerGtk.prototype.updateTime): Simplified the hiding and
-        showing by removing the show class and using hidden only.
-        (ControllerGtk.prototype.handleMuteButtonMouseOver):
-        (ControllerGtk.prototype.handleVolumeBoxMouseOut): Turned hidden
-        into hiding.
-        (ControllerGtk.prototype.updateReadyState): Changed coding style
-        and added down class for the panel too.
-        (ControllerGtk.prototype.updatePlaying): Change for coding style
-        coherence.
-        (ControllerGtk.prototype.handleCaptionButtonClicked): Call
-        handleCaptionButtonShowMenu.
-        (ControllerGtk.prototype.handleCaptionButtonMouseOver): Call
-        handleCaptionButtonShowMenu.
-        (ControllerGtk.prototype.handleCaptionButtonShowMenu): Created
-        with the former behavior of handleCaptionButtonMouseOver.
-        * css/mediaControlsGtk.css:
-        (.hidden): Set display none for all objects with hidden class.
-        (audio::-webkit-media-controls-panel *:focus):
-        (audio::-webkit-media-controls-panel.down *:focus): Added gradient
-        for the active and focus status.
-        (audio::-webkit-media-controls-time-remaining-display)
-        (video::-webkit-media-controls-time-remaining-display): Set
-        display block.
-        (audio::-webkit-media-controls-volume-slider-container)
-        (video::-webkit-media-controls-volume-slider-container): Set
-        display flex.
-        (video::-webkit-media-controls-volume-slider-container.hiding):
-        Changed from hidden.
-        (video::-webkit-media-controls-panel .hiding.down): Changed from
-        hidden.
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::paintMediaButton): Returning true to
-        allow CSS painting the gradient.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-2014-02-27  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        This is a step towards creating a shared base class that both RunLoop and WorkQueue will derive from.
</ins><span class="cx"> 
</span><del>-        Unreviewed. Fixing the GTK build fix after r164757.
</del><ins>+        * platform/RunLoop.cpp:
+        (WebCore::RunLoop::current):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore):
+        * platform/RunLoop.h:
+        (RunLoop):
+        * platform/cf/RunLoopCF.cpp:
+        (WebCore::RunLoop::initializeMainRunLoop):
+        (WebCore::RunLoop::current):
+        (WebCore::RunLoop::~RunLoop):
</ins><span class="cx"> 
</span><del>-        * platform/network/NetworkStateNotifier.cpp: r164757 introduced a layering violation by including
-        the Settings.h header. The use of that class is guarded by PLATFORM(IOS), so the header inclusion
-        should be guarded as well.
</del><ins>+2013-04-29  Brent Fulgham  &lt;bfulgham@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        [Windows, WinCairo] Remove link and include directives for pthread.
+        https://bugs.webkit.org/show_bug.cgi?id=115381
</ins><span class="cx"> 
</span><del>-        Extract named items caches in HTMLCollection as a class
-        https://bugs.webkit.org/show_bug.cgi?id=129365
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        Update various VS2005 and VS2010 property sheets to remove
+        reference to the pthreads Include path and instructions to
+        link to the pthreads library.
</ins><span class="cx"> 
</span><del>-        Extracted CollectionNamedElementCache, like CollectionIndexCache, out of HTMLCollection.
-        We can move more named item related functions into this class in the future.
</del><ins>+        * WebCore.vcproj/QTMovieWinCommon.vsprops:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreDebug.vsprops:
+        * WebCore.vcproj/WebCoreDebugAll.vsprops:
+        * WebCore.vcproj/WebCoreProduction.vsprops:
+        * WebCore.vcproj/WebCorePthreads.vsprops: Removed.
+        * WebCore.vcproj/WebCoreRelease.vsprops:
+        * WebCore.vcxproj/WebCoreCommon.props:
+        * WebCore.vcxproj/WebCoreDebug.props:
+        * WebCore.vcxproj/WebCoreDebugWinCairo.props:
+        * WebCore.vcxproj/WebCoreProduction.props:
+        * WebCore.vcxproj/WebCorePthreads.props: Removed.
+        * WebCore.vcxproj/WebCoreRelease.props:
+        * WebCore.vcxproj/WebCoreReleaseWinCairo.props:
</ins><span class="cx"> 
</span><del>-        HTMLCollection's member variables m_isNameCacheValid, m_idCache, and m_nameCache were replaced by
-        a single unique_ptr that holds an instance of CollectionNamedElementCache since this object rarely
-        exists in most HTMLCollections.
</del><ins>+2013-04-29  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Also removed m_isItemRefElementsCacheValid since it was only used by Microdata API removed in r153772
-        and renamed a whole bunch of member functions and variables for consistency.
</del><ins>+        Do not allocate Static Strings for Notification::permissionString
+        https://bugs.webkit.org/show_bug.cgi?id=115316
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::collectionCachedIdNameMap):
-        (WebCore::Document::collectionWillClearIdNameMap):
-        * dom/Document.h:
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::adoptDocument):
-        * html/HTMLAllCollection.cpp:
-        (WebCore::HTMLAllCollection::namedItemWithIndex):
-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::HTMLCollection):
-        (WebCore::HTMLCollection::~HTMLCollection):
-        (WebCore::HTMLCollection::invalidateCache):
-        (WebCore::HTMLCollection::invalidateNamedElementCache): Renamed from invalidateIdNameCacheMaps.
-        (WebCore::HTMLCollection::namedItem):
-        (WebCore::HTMLCollection::updateNamedElementCache): Renamed from updateNameCache.
-        (WebCore::HTMLCollection::namedItems):
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * html/HTMLCollection.h:
-        (WebCore::CollectionNamedElementCache::findElementsWithId): Renamed from HTMLCollection::idCache.
-        (WebCore::CollectionNamedElementCache::findElementsWithName): Renamed from HTMLCollection::nameCache.
-        (WebCore::CollectionNamedElementCache::appendIdCache): Moved from HTMLCollection.
-        (WebCore::CollectionNamedElementCache::appendNameCache): Ditto.
-        (WebCore::CollectionNamedElementCache::find): Ditto.
-        (WebCore::CollectionNamedElementCache::append): Ditto.
</del><ins>+        The code is not nearly hot enough to justify keeping this memory around.
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLCollection::invalidateCache):
-        (WebCore::HTMLCollection::hasNamedElementCache): Renamed from hasIdNameCache.
-        (WebCore::HTMLCollection::createNameItemCache): Added.
-        (WebCore::HTMLCollection::namedItemCaches): Added.
</del><ins>+        * Modules/notifications/Notification.cpp:
+        (WebCore::Notification::permission):
+        (WebCore::Notification::permissionString):
+        * Modules/notifications/Notification.h:
+        (Notification):
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormControlsCollection.cpp:
-        (WebCore::HTMLFormControlsCollection::updateNamedElementCache):
-        * html/HTMLFormControlsCollection.h:
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Remove StorageTracker::originsLoaded
+        https://bugs.webkit.org/show_bug.cgi?id=115382
</ins><span class="cx"> 
</span><del>-        Indenting an indented image element resulted in an extra indentation
-        https://bugs.webkit.org/show_bug.cgi?id=129201
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+        Remove m_finishedImportingOriginIdentifiers.
</ins><span class="cx"> 
</span><del>-        The bug was caused by endOfParagraph returning a position at the beginning of a block when the position
-        passed into the function was at the beginning of the block. Consider the following DOM:
-        &lt;blockquote&gt;&lt;img&gt;&lt;/blockquote&gt;
</del><ins>+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::StorageTracker):
+        (WebCore::StorageTracker::finishedImportingOriginIdentifiers):
+        * storage/StorageTracker.h:
+        (StorageTracker):
</ins><span class="cx"> 
</span><del>-        When endOfParagraph is called on (blockquote, 0), the condition r-&gt;isBR() || isBlock(n) in endOfParagraph
-        matches immediately on startNode and it returns (blockquote, 0) again.
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This resulted in moveParagraphWithClones invoked by indentIntoBlockquote to erroneously clone the inner
-        blockquote. Worked around this bug in ApplyBlockElementCommand::formatSelection by checking this specific
-        condition and moving the position to the end of the block. Unfortunately, a lot of existing code depends
-        on the current behavior of endOfParagraph so fixing the function itself was not possible.
</del><ins>+        Get rid of StorageTracker::setClient
+        https://bugs.webkit.org/show_bug.cgi?id=115376
</ins><span class="cx"> 
</span><del>-        There was another bug in indentIntoBlockquote to incorrectly insert a new blockquote into the existing
-        blockquote due to the code introduced in r99594 to avoid inserting before the root editable element.
-        Since this happens only if outerBlock is the root editable element, which is nodeToSplitTo or an ancestor
-        of nodeToSplitTo, explicitly look for this condition.
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Test: editing/execCommand/indent-img-twice.html
</del><ins>+        * WebCore.exp.in:
+        * storage/StorageTracker.cpp:
+        * storage/StorageTracker.h:
+        (StorageTracker):
</ins><span class="cx"> 
</span><del>-        * editing/ApplyBlockElementCommand.cpp:
-        (WebCore::ApplyBlockElementCommand::formatSelection):
-        (WebCore::isNewLineAtPosition):
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
-        * editing/VisibleUnits.cpp:
-        (WebCore::endOfParagraph): Added a FIXME.
</del><ins>+2013-04-22  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Change approach to third-party blocking for LocalStorage
+        https://bugs.webkit.org/show_bug.cgi?id=115004
</ins><span class="cx"> 
</span><del>-        Fix two assertions/crashes in compositing code
-        https://bugs.webkit.org/show_bug.cgi?id=129414
</del><ins>+        Reviewed by Maciej Stachowiak.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Instead of outright blocking LocalStorage that's used in a third-party
+        context, silently partition it based on the origin of the top context.
+        These partitions are then discarded when the page group is unloaded.
</ins><span class="cx"> 
</span><del>-        Fix two issues introduced in r164759.
</del><ins>+        No new tests; modified existing tests to account for changes.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::removeFromScrollCoordinatedLayers): Don't call
-        ourselves recursively!
-        (WebCore::RenderLayerCompositor::detachScrollCoordinatedLayer): We call this
-        function unconditionally on layer teardown, so this assertion is bogus.
</del><ins>+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        (WebCore):
+        (WebCore::PageGroup::transientLocalStorage):
+        * page/PageGroup.h:
+        (PageGroup):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canAccessStorage):
</ins><span class="cx"> 
</span><del>-2014-02-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-04-29  Yi Shen  &lt;max.hong.shen@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix the build with some compiler configurations.
</del><ins>+        HTML Editing: Insertion point jumps when using link detection
+        https://bugs.webkit.org/show_bug.cgi?id=82198
</ins><span class="cx"> 
</span><del>-        * platform/mac/ScrollAnimatorMac.mm:
-        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
-        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
-        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
-
-2014-02-26  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
-
-        Ranges given to createMarkupInternal might not be canonicalized
-        https://bugs.webkit.org/show_bug.cgi?id=129408
-
</del><span class="cx">         Reviewed by Ryosuke Niwa.
</span><span class="cx"> 
</span><del>-        When WebKit clients (such as Mail) call WKWebArchiveCreateFromRange() with a range,
-        that range is not necessarily canonicalized. Therefore, comparing it for equality
-        with a canonicalized range might return a false negative. Instead, we should compare
-        canonicalized ranges.
</del><ins>+        Add links should be done only when typing a word separator (e.g. space or dot) which 
+        breaks the text into two parts - the link and the rest of the text. Reflected in 
+        code, we should only add link when the caret position is at the right end location of 
+        TextChecking result. Otherwise, the text on the right of a word separator could be
+        highlighted as a link and the insertion point jumps unexpectedly.
</ins><span class="cx"> 
</span><del>-        No new tests because this codepath will only be reached via SPI.
</del><ins>+        Tests: update editing/inserting/typing-space-to-trigger-smart-link.html
</ins><span class="cx"> 
</span><del>-        * editing/markup.cpp:
-        (WebCore::createMarkupInternal):
</del><ins>+        * editing/Editor.cpp:
+        (WebCore::Editor::markAndReplaceFor):
</ins><span class="cx"> 
</span><del>-2014-02-26  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+2013-04-29  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Form controls handling: implement date and time controls.
-        https://bugs.webkit.org/show_bug.cgi?id=129344
</del><ins>+        Need a LayoutMilestone to fire when we have done our first paint after suppressing 
+        incremental layout
+        https://bugs.webkit.org/show_bug.cgi?id=115330
+        -and corresponding-
+        &lt;rdar://problem/12722365&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser and Joseph Pecoraro.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Adding one localizable string.
</del><ins>+        To meet the needs of all of our clients, we really need two milestones. One 
+        indicating that a layout has happened after setVisualUpdatesAllowed(true), and 
+        another indicating that painting has happened.
</ins><span class="cx"> 
</span><del>-        * English.lproj/Localizable.strings:
</del><ins>+        If layout is needed when setVisualUpdatesAllowed(true) is called, we need to 
+        update it so that we can guarantee the first paint is really happening at this 
+        time. Also fire the DidFirstLayoutAfterSuppressedIncrementalRendering milestone, 
+        and call add DidFirstPaintAfterSuppressedIncrementalRendering to the FrameView's 
+        pending paint milestones. 
+        up the painting milestone.
+        * dom/Document.cpp:
+        (WebCore::Document::setVisualUpdatesAllowed):
</ins><span class="cx"> 
</span><del>-2014-02-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        FrameView now stores m_milestonesPendingPaint. We'll send and clear them once we 
+        have painted.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::addPaintPendingMilestones):
+        (WebCore::FrameView::firePaintRelatedMilestones):
+        * page/FrameView.h:
+        (WebCore::FrameView::milestonesPendingPaint):
</ins><span class="cx"> 
</span><del>-        Prepare for overflow scrolling nodes in the scrolling tree
-        https://bugs.webkit.org/show_bug.cgi?id=129398
</del><ins>+        Two new milestones.
+        * page/LayoutMilestones.h:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
-
-        Lay some groundwork for overflow:scrolling nodes in the scrolling tree.
-        Change terminology to refer to &quot;scroll-coordinatored&quot; layers now, not just viewport-constrained
-        layers.
-        
-        A given layer can be both viewport-constrained and overflow-scrolling (e.g. position:fixed,
-        overflow:scroll), so handle that in RenderLayerBacking, and use some &quot;reason&quot; flags
-        in RenderLayerCompositor.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollLayerID): Rename
-        * page/scrolling/ScrollingStateTree.cpp:
-        (WebCore::ScrollingStateTree::attachNode): Remove invalid assertion.
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::RenderLayerBacking):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        (WebCore::RenderLayerBacking::updateScrollingLayers): Simplify the logic with
-        an early return.
-        (WebCore::RenderLayerBacking::detachFromScrollingCoordinator):
-        Allow a layer to play both viewport-constrained and scrolling roles
-        in the scrolling tree.
-        * rendering/RenderLayerBacking.h:
-        (WebCore::RenderLayerBacking::viewportConstrainedNodeID):
-        (WebCore::RenderLayerBacking::setViewportConstrainedNodeID):
-        (WebCore::RenderLayerBacking::scrollingNodeID):
-        (WebCore::RenderLayerBacking::setScrollingNodeID):
-        (WebCore::RenderLayerBacking::scrollingNodeIDForChildren):
</del><ins>+        We don't need m_headerLayerAwaitingFirstFlush anymore since we can use FrameView's 
+        pending paint milestones instead.
</ins><span class="cx">         * rendering/RenderLayerCompositor.cpp:
</span><ins>+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
</ins><span class="cx">         (WebCore::RenderLayerCompositor::flushPendingLayerChanges):
</span><del>-        (WebCore::RenderLayerCompositor::didFlushChangesForLayer):
-        (WebCore::RenderLayerCompositor::updateBacking):
-        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
-        (WebCore::RenderLayerCompositor::fixedRootBackgroundLayerChanged):
-        (WebCore::RenderLayerCompositor::clearBackingForLayerIncludingDescendants):
-        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
-        (WebCore::RenderLayerCompositor::requiresOwnBackingStore):
-        (WebCore::RenderLayerCompositor::reasonsForCompositing):
-        (WebCore::RenderLayerCompositor::requiresCompositingForScrolling):
-        (WebCore::isViewportConstrainedFixedOrStickyLayer):
-        (WebCore::isMainFrameScrollingOrOverflowScrolling):
-        (WebCore::RenderLayerCompositor::rootLayerAttachmentChanged):
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedStatus):
-        (WebCore::RenderLayerCompositor::removeFromScrollCoordinatedLayers):
-        (WebCore::nearestScrollCoordinatedAncestor):
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
-        (WebCore::RenderLayerCompositor::detachScrollCoordinatedLayer):
-        (WebCore::RenderLayerCompositor::registerAllViewportConstrainedLayers):
-        (WebCore::RenderLayerCompositor::willRemoveScrollingLayer):
-        (WebCore::RenderLayerCompositor::didAddScrollingLayer):
</del><ins>+        (WebCore::RenderLayerCompositor::updateLayerForHeader):
</ins><span class="cx">         * rendering/RenderLayerCompositor.h:
</span><ins>+        (RenderLayerCompositor):
</ins><span class="cx"> 
</span><del>-2014-02-26  Andy Estes  &lt;aestes@apple.com&gt;
</del><ins>+2013-04-29  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS] Support network state notification using CPNetworkObserver
-        https://bugs.webkit.org/show_bug.cgi?id=129358
</del><ins>+        [Mac] Links can't be hovered or clicked with overlay scrollbars hidden.
+        https://bugs.webkit.org/show_bug.cgi?id=99379
+        
+        This is also &lt;rdar://problem/10929565&gt; Overlay scrollbars prevent hit-testing on
+        content underneath them, even when hidden
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-        Add iOS support for navigator.onLine and online/offline events. Since
-        it can be expensive to query CPNetworkObserver, wait to do so until
-        someone calls NetworkStateObserver::onLine() or
-        NetworkStateObserver::addNetworkStateChangeListener(). For clients that
-        don't wish to observe network reachability at all, add a global opt-out.
-        These clients will only pay the cost of CPNetworkObserver if they load
-        a page that explicitly accesses navigator.onLine.
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::verticalScrollbarWidth):
+        (WebCore::RenderLayer::horizontalScrollbarHeight):
</ins><span class="cx"> 
</span><del>-        No new tests. Covered by existing tests.
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Stopped exporting NetworkStateNotifier::setIsOnLine()
-        and started exporting Settings::gShouldOptOutOfNetworkStateObservation.
-        * WebCore.xcodeproj/project.pbxproj: Renamed NetworkStateNotifierIOS.cpp
-        to NetworkStateNotifierIOS.mm.
-        * page/Settings.cpp: Defaulted gShouldOptOutOfNetworkStateObservation
-        to false.
-        * page/Settings.h:
-        (WebCore::Settings::setShouldOptOutOfNetworkStateObservation):
-        (WebCore::Settings::shouldOptOutOfNetworkStateObservation):
-        * platform/network/NetworkStateNotifier.cpp:
-        (WebCore::NetworkStateNotifier::addNetworkStateChangeListener): Ignored
-        the listener if Settings::shouldOptOutOfNetworkStateObservation().
-        Called registerObserverIfNecessary() and added the listener otherwise.
-        (WebCore::NetworkStateNotifier::notifyNetworkStateChange): Const qualified.
-        * platform/network/NetworkStateNotifier.h
-        (NetworkStateNotifier::onLine):
-        * platform/network/ios/NetworkStateNotifierIOS.cpp: Removed.
-        * platform/network/ios/NetworkStateNotifierIOS.mm: Added.
-        (-[NetworkStateObserver initWithNotifier:WebCore::]): Registered self
-        as a network reachable observer on CPNetworkObserver.
-        (-[NetworkStateObserver dealloc]): Removed self as a network reachable
-        observer.
-        (-[NetworkStateObserver networkStateChanged:]): Called setOnLine() on
-        the web thread, passing the reachability value from the notification.
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-        (WebCore::NetworkStateNotifier::~NetworkStateNotifier): Cleared
-        m_observer's pointer back to us.
-        (WebCore::NetworkStateNotifier::registerObserverIfNecessary): Initialized
-        m_observer if necessary.
-        (WebCore::NetworkStateNotifier::onLine): Called
-        registerObserverIfNecessary() and set an initial value for m_isOnLine
-        if m_isOnLineInitialized is false. Returned m_isOnLine.
-        (WebCore::setOnLine): Set m_isOnLine and called
-        notifyNetworkStateChange() if needed. Unconditionally set
-        m_isOnLineInitialized to true.
</del><ins>+        Begin cleaning up StorageTracker
+        https://bugs.webkit.org/show_bug.cgi?id=115373
</ins><span class="cx"> 
</span><del>-2014-02-26  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix for !ENABLE(CONTEXT_MENUS).
</del><ins>+        Rename Mutexes to use &quot;Mutex&quot; and not &quot;Guard&quot;.
+        Don't use static locals for &quot;.localstorage&quot; and &quot;*.localstorage&quot; strings.
+        Put end iterator declarations together with begin declarations.
</ins><span class="cx"> 
</span><del>-        I forgot to add guards to handleContextMenuEvent().
</del><ins>+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::setDatabaseDirectoryPath):
+        (WebCore::StorageTracker::trackerDatabasePath):
+        (WebCore::StorageTracker::openTrackerDatabase):
+        (WebCore::StorageTracker::finishedImportingOriginIdentifiers):
+        (WebCore::StorageTracker::syncImportOriginIdentifiers):
+        (WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::syncSetOriginDetails):
+        (WebCore::StorageTracker::origins):
+        (WebCore::StorageTracker::deleteAllOrigins):
+        (WebCore::StorageTracker::syncDeleteAllOrigins):
+        (WebCore::StorageTracker::deleteOrigin):
+        (WebCore::StorageTracker::syncDeleteOrigin):
+        (WebCore::StorageTracker::willDeleteAllOrigins):
+        (WebCore::StorageTracker::willDeleteOrigin):
+        (WebCore::StorageTracker::canDeleteOrigin):
+        (WebCore::StorageTracker::cancelDeletingOrigin):
+        (WebCore::StorageTracker::setClient):
+        (WebCore::StorageTracker::databasePathForOrigin):
+        (WebCore::StorageTracker::diskUsageForOrigin):
+        * storage/StorageTracker.h:
+        (StorageTracker):
</ins><span class="cx"> 
</span><del>-        * replay/UserInputBridge.cpp:
-        * replay/UserInputBridge.h:
</del><ins>+2013-04-29  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Don't check for @media rules affected by viewport changes in every layout.
+        &lt;http://webkit.org/b/115370&gt;
+        &lt;rdar://problem/13765739&gt;
</ins><span class="cx"> 
</span><del>-        [WebGL] Only skip context error retrieval if a pending context
-        https://bugs.webkit.org/show_bug.cgi?id=129397
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Move the logic that checks if any @media rules are affected by a change in the viewport
+        size to FrameView::setFrameRect(). This way it's no longer necessary to do the style
+        recalc synchronously, which allows us to coalesce multiple updates in some cases.
</ins><span class="cx"> 
</span><del>-        A lost context should still ask the GC3D what the error is. Only
-        a pending context should return early.
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::setFrameRect):
+        (WebCore::FrameView::layout):
</ins><span class="cx"> 
</span><del>-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::getError):
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Brian Burg  &lt;bburg@apple.com&gt;
</del><ins>+        Remove the last StorageSyncManager function
+        https://bugs.webkit.org/show_bug.cgi?id=115371
</ins><span class="cx"> 
</span><del>-        Web Replay: route through UserInputBridge when delivering user inputs to WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=128150
</del><ins>+        Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Move the import scheduling to the StorageAreaSync constructor. Remove code to set m_importComplete to true
+        since that could only happen if the StorageSyncManager's thread is null which doesn't make any sense.
</ins><span class="cx"> 
</span><del>-        Add an UserInputBridge instance to each Page. WebKit2 routes a page's user inputs through
-        the WebCore page's user input bridge so that the inputs can be selectively captured, filtered,
-        and replayed using instrumentation inside the UserInputBridge.
</del><ins>+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::create):
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+        (StorageSyncManager):
</ins><span class="cx"> 
</span><del>-        For now, the routing methods of UserInputBridge have no replay-specific code paths, and just
-        put the input delivery code inside WebCore rather than its external clients. Replay-specific
-        code paths will be added once https://bugs.webkit.org/show_bug.cgi?id=128782 is fixed. However,
-        once complete the code will work as follows:
</del><ins>+2013-04-29  Daker Fernandes Pinheiro  &lt;daker.pinheiro@openbossa.org&gt;
</ins><span class="cx"> 
</span><del>-        - When neither capturing or replaying, behavior is unchanged.
</del><ins>+        Remove unused method RenderMeter::valueRatio()
+        https://bugs.webkit.org/show_bug.cgi?id=115266
</ins><span class="cx"> 
</span><del>-        - When capturing user inputs, each external input is saved into a replay log as it crosses
-        the bridge from outside WebCore.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        - When replaying, the bridge closes and user inputs from WebKit2 are not accepted. Instead,
-        the saved inputs from the replay log are re-dispatched as if they had crossed the bridge.
</del><ins>+        The removed method is not used anywhere.
+        No new tests are required.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * GNUmakefile.list.am:
-        * WebCore.exp.in: Add symbols for input routing methods.
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/Page.cpp:
-        (WebCore::Page::Page): Initialize the owned UserInputBridge in the Page constructor.
-        * page/Page.h:
-        (WebCore::Page::inputBridge): Added a by-reference getter.
-        * replay/UserInputBridge.cpp: Added.
-        (WebCore::UserInputBridge::UserInputBridge):
-        (WebCore::UserInputBridge::~UserInputBridge):
-        (WebCore::UserInputBridge::handleContextMenuEvent):
-        (WebCore::UserInputBridge::handleMousePressEvent):
-        (WebCore::UserInputBridge::handleMouseReleaseEvent):
-        (WebCore::UserInputBridge::handleMouseMoveEvent):
-        (WebCore::UserInputBridge::handleMouseMoveOnScrollbarEvent):
-        (WebCore::UserInputBridge::handleKeyEvent):
-        (WebCore::UserInputBridge::handleAccessKeyEvent):
-        (WebCore::UserInputBridge::handleWheelEvent):
-        (WebCore::UserInputBridge::focusSetActive):
-        (WebCore::UserInputBridge::focusSetFocused):
-        (WebCore::UserInputBridge::scrollRecursively):
-        (WebCore::UserInputBridge::logicalScrollRecursively):
-        (WebCore::UserInputBridge::loadRequest):
-        (WebCore::UserInputBridge::reloadFrame):
-        (WebCore::UserInputBridge::stopLoadingFrame):
-        (WebCore::UserInputBridge::tryClosePage):
-        * replay/UserInputBridge.h: Added.
</del><ins>+        * rendering/RenderMeter.cpp:
+        * rendering/RenderMeter.h:
+        (RenderMeter):
</ins><span class="cx"> 
</span><del>-2014-02-26  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [WebGL] Protect more WebGL entry points for pending contexts
-        https://bugs.webkit.org/show_bug.cgi?id=129386
</del><ins>+        Remove two more StorageSyncManager wrapper functions
+        https://bugs.webkit.org/show_bug.cgi?id=115367
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        There are entry points into a WebGLRenderingContext that don't
-        come from the web-exposed API directly, such as drawImage with
-        the WebGL canvas. Protect these by returning early if we're
-        a pending context.
</del><ins>+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
</ins><span class="cx"> 
</span><del>-        Also a bunch of drive-by 0 -&gt; nullptr changes.
</del><ins>+2013-04-29  Stephen Chenney  &lt;schenney@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::markLayerComposited):
-        (WebCore::WebGLRenderingContext::paintRenderingResultsToCanvas):
-        (WebCore::WebGLRenderingContext::paintRenderingResultsToImageData):
-        (WebCore::WebGLRenderingContext::reshape):
-        (WebCore::WebGLRenderingContext::createBuffer):
-        (WebCore::WebGLRenderingContext::createFramebuffer):
-        (WebCore::WebGLRenderingContext::createTexture):
-        (WebCore::WebGLRenderingContext::createProgram):
-        (WebCore::WebGLRenderingContext::createRenderbuffer):
-        (WebCore::WebGLRenderingContext::createShader):
-        (WebCore::WebGLRenderingContext::getActiveAttrib):
-        (WebCore::WebGLRenderingContext::getActiveUniform):
-        (WebCore::WebGLRenderingContext::getContextAttributes):
-        (WebCore::WebGLRenderingContext::getError):
-        (WebCore::WebGLRenderingContext::getExtension):
-        (WebCore::WebGLRenderingContext::getShaderPrecisionFormat):
-        (WebCore::WebGLRenderingContext::getUniformLocation):
-        (WebCore::WebGLRenderingContext::drawImageIntoBuffer):
-        (WebCore::WebGLRenderingContext::videoFrameToImage):
-        (WebCore::WebGLRenderingContext::validateBufferDataParameters):
-        (WebCore::WebGLRenderingContext::LRUImageBufferCache::imageBuffer):
</del><ins>+        SVGElement destructor can use invalid iterator
+        https://bugs.webkit.org/show_bug.cgi?id=115361
</ins><span class="cx"> 
</span><del>-2014-02-26  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</del><ins>+        Reviewed by Philip Rogers.
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] inset and inset-rectangle trigger assert with replaced element and large percentage dimension
-        https://bugs.webkit.org/show_bug.cgi?id=129060
</del><ins>+        When an SVGElement object has rare data, its destructor gets a
+        hash map iterator for the rare data, uses it to clear resources,
+        then uses the iterator to delete the rare data. However, the resource
+        cleanup can delete other SVG elements, thus modifying the hash map
+        from which the iterator came and hence invalidating the iterator
+        itself.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        The fix is to re-get the iterator before deleting the rare data.
</ins><span class="cx"> 
</span><del>-        A bounds check was omitted when computing the width and height for inset
-        rectangles, making it possible for the width or height to end up being
-        negative. This patch adds in that check for both. It seems that only
-        replaced elements like iframe and img trigger this problem.
</del><ins>+        Test: svg/custom/svg-element-destructor-iteration-crash.html
</ins><span class="cx"> 
</span><del>-        Tests: fast/shapes/shape-outside-floats/shape-outside-floats-img-inset-negative-width-crash.html
-               fast/shapes/shape-outside-floats/shape-outside-floats-img-inset-rectangle-negative-width-crash.html
</del><ins>+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::~SVGElement): Get a new iterator after clearing rare data.
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createShape):
</del><ins>+2013-04-29  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        REGRESSION: We see authentication challenge sheets for favicon requests.
+        &lt;rdar://problem/13753470&gt; and https://bugs.webkit.org/show_bug.cgi?id=115288
</ins><span class="cx"> 
</span><del>-        Underlines are too thick when zoomed in
-        https://bugs.webkit.org/show_bug.cgi?id=129352
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        No new tests (Not in a tested config, might fix existing test).
</ins><span class="cx"> 
</span><del>-        The input to the underline drawing code is in user-space, not device-space.
-        The underlines were getting scaled twice, once in InlineTextBox and the other
-        in GraphicsContext.
</del><ins>+        Rename ClientCrossOriginCredentialPolicy to ClientCredentialPolicy, make it be three options.
+        and move it to ResourceHandleTypes where it belongs:
+        * loader/ResourceLoaderOptions.h:
+        * platform/network/ResourceHandleTypes.h:
</ins><span class="cx"> 
</span><del>-        Test: fast/css3-text/css3-text-decoration/text-decoration-scaled.html
</del><ins>+        Expose the ClientCredentialPolicy the ResourceLoader was created with:
+        * loader/ResourceLoader.h:
+        (WebCore::ResourceLoader::clientCredentialPolicy):
</ins><span class="cx"> 
</span><del>-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintDecoration):
</del><ins>+        Rework the “should ask client” clause for the new values of ClientCredentialPolicy:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
</ins><span class="cx"> 
</span><del>-2014-02-26  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Rework loadResourceSynchronously() to include a ClientCredentialPolicy argument:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/FrameLoader.h:
+        * loader/LoaderStrategy.cpp:
+        (WebCore::LoaderStrategy::loadResourceSynchronously):
+        * loader/LoaderStrategy.h:
</ins><span class="cx"> 
</span><del>-        Remove unused InspectorCounters.
-        &lt;https://webkit.org/b/129367&gt;
</del><ins>+        Never ask the client for credentials for icon loads:
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::startLoading):
</ins><span class="cx"> 
</span><del>-        The InspectorCounters code was only used to implement two layout test
-        APIs (window.internals.numberOfLive{Nodes,Documents}) yet it had hooks
-        in crazy places like Node construction and destruction.
</del><ins>+        Update all other users of ClientCredentialPolicy to the appropriate new value,
+        and update all users of loadResourceSynchronously to the new function signature:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::loadResourceSynchronously):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::startLoadingMainResource):
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/FrameLoader.h:
+        (FrameLoader):
+        * loader/LoaderStrategy.cpp:
+        (WebCore::LoaderStrategy::loadResourceSynchronously):
+        * loader/LoaderStrategy.h:
+        (LoaderStrategy):
+        * loader/NetscapePlugInStreamLoader.cpp:
+        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
+        (WebCore::CachedResourceLoader::defaultCachedResourceOptions):
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::docLoaderFunc):
+        * xml/parser/XMLDocumentParserLibxml2.cpp:
+        (WebCore::openFunc):
</ins><span class="cx"> 
</span><del>-        Rewrote the internals APIs to iterate over all live Documents instead,
-        totaling up their referencing Node count. Added a process-global
-        Document::allDocuments() HashSet to make this whole thing possible.
-
-        Reviewed by Sam Weinig.
-
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSEventListener.cpp:
-        * dom/Document.cpp:
-        (WebCore::Document::allDocuments):
-        (WebCore::Document::Document):
-        (WebCore::Document::~Document):
-        * dom/Document.h:
-        (WebCore::Node::Node):
-        * dom/Node.cpp:
-        (WebCore::Node::~Node):
-        * inspector/InspectorAllInOne.cpp:
-        * inspector/InspectorCounters.cpp: Removed.
-        * inspector/InspectorCounters.h: Removed.
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::start):
-        (WebCore::InspectorTimelineAgent::innerAddRecordToTimeline):
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        * inspector/InspectorTimelineAgent.h:
-        * inspector/protocol/Timeline.json:
-        * platform/ThreadGlobalData.cpp:
-        * testing/Internals.cpp:
-        (WebCore::Internals::numberOfLiveNodes):
-        (WebCore::Internals::numberOfLiveDocuments):
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><span class="cx"> 
</span><del>-2014-02-26  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Web Inspector: Remove console.profiles from window.console API
-        https://bugs.webkit.org/show_bug.cgi?id=116883
</del><ins>+        Add a StorageSyncManager::dispatch helper function
+        https://bugs.webkit.org/show_bug.cgi?id=115365
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        console.profiles has been removed or never implemented by other
-        browsers. We should remove it as well. However, since tests
-        rely on it, keep it as window.internals.consoleProfiles.
</del><ins>+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::dispatch):
+        (WebCore):
+        (WebCore::StorageSyncManager::close):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        (WebCore::StorageSyncManager::scheduleDeleteEmptyDatabase):
+        * storage/StorageSyncManager.h:
+        (StorageSyncManager):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/Console.idl:
-        * testing/Internals.cpp:
-        (WebCore::Internals::consoleProfiles):
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+2013-04-29  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+        Re-indent StorageSyncManager and remove SecurityOrigin forward declaration.
</ins><span class="cx"> 
</span><del>-        Create SessionID value-style class for session IDs.
-        https://bugs.webkit.org/show_bug.cgi?id=129141
</del><ins>+        Rubber-stamped by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        * storage/StorageSyncManager.h:
</ins><span class="cx"> 
</span><del>-        * GNUmakefile.list.am:
-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/Page.cpp: Add SessionID member.
-        (WebCore::Page::Page):
-        (WebCore::Page::sessionID): Retrieve sessionID or use settings if not set.
-        * page/Page.h:
-        (WebCore::Page::isSessionIDSet):
-        (WebCore::Page::setSessionID):
-        * page/SessionID.h: Session ID class consisting solely of its uint64_t session ID.
-        (WebCore::SessionID::SessionID):
-        (WebCore::SessionID::isValid): Not empty.
-        (WebCore::SessionID::isEphemeral):
-        (WebCore::SessionID::sessionID):
-        (WebCore::SessionID::operator==): Value-based equality.
-        (WebCore::SessionID::operator!=):
-        (WebCore::SessionID::emptySessionID): Zero value also used for HashTraits emptyValue.
-        (WebCore::SessionID::defaultSessionID):
-        (WebCore::SessionID::legacyPrivateSessionID):
-        * page/SessionIDHash.h:
-        (WTF::SessionIDHash::hash): Just the casted session ID (low order bytes)
-        (WTF::SessionIDHash::equal):
-        (WTF::HashTraits&lt;WebCore::SessionID&gt;::emptyValue): Equal to emptySessionID.
-        (WTF::HashTraits&lt;WebCore::SessionID&gt;::constructDeletedValue): -1 value.
-        (WTF::HashTraits&lt;WebCore::SessionID&gt;::isDeletedValue):
</del><ins>+2013-04-27  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-26  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Get rid of StorageTask
+        https://bugs.webkit.org/show_bug.cgi?id=115313
</ins><span class="cx"> 
</span><del>-        Fix builds that don't define IMAGE_CONTROLS.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * page/ContextMenuContext.cpp:
-        (WebCore::ContextMenuContext::ContextMenuContext):
-
-2014-02-26  Eric Carlson  &lt;eric.carlson@apple.com&gt;
-
-        Build fix for OS X after r164720.
-
-        * page/ContextMenuContext.cpp:
-
-2014-02-26  Brady Eidson  &lt;beidson@apple.com&gt;
-
-        Pipe experimental image controls menu up to WebKit2
-        https://bugs.webkit.org/show_bug.cgi?id=129339
-
-        Reviewed by Simon Fraser.
-
-        Handle events for the image control, starting down the context menu code path if appropriate:
-        * html/shadow/mac/ImageControlsRootElementMac.cpp:
-        (WebCore::ImageControlsRootElementMac::defaultEventHandler):
-        * html/shadow/mac/ImageControlsRootElementMac.h:
-
-        Add a class to hold a HitTestResult and addition info about the current ContextMenu invocation:
-        * page/ContextMenuContext.cpp: Added.
-        (WebCore::ContextMenuContext::ContextMenuContext):
-        * page/ContextMenuContext.h: Added.
-        (WebCore::ContextMenuContext::hitTestResult):
-        (WebCore::ContextMenuContext::isImageControl):
-
-        Update ContextMenuController to work with ContextMenuContext instead of HitTestResult directly:
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::showContextMenu):
-        (WebCore::ContextMenuController::createContextMenu):
-        (WebCore::ContextMenuController::contextMenuItemSelected):
-        (WebCore::ContextMenuController::populate):
-        (WebCore::ContextMenuController::addInspectElementItem):
-        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
-        (WebCore::ContextMenuController::showImageControlsMenu):
-        * page/ContextMenuController.h:
-        (WebCore::ContextMenuController::contextMenu):
-        (WebCore::ContextMenuController::setContextMenuContext):
-        (WebCore::ContextMenuController::context):
-        (WebCore::ContextMenuController::hitTestResult):
-
</del><span class="cx">         * CMakeLists.txt:
</span><span class="cx">         * GNUmakefile.list.am:
</span><ins>+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
</ins><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><ins>+        * WebCore.vcxproj/WebCore.vcxproj.filters:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><ins>+        * storage/StorageSyncManager.cpp:
+        * storage/StorageTask.cpp: Removed.
+        * storage/StorageTask.h: Removed.
+        * storage/StorageThread.cpp:
+        (WebCore::StorageThread::threadEntryPoint):
+        (WebCore::StorageThread::dispatch):
+        (WebCore::StorageThread::terminate):
+        * storage/StorageThread.h:
+        (StorageThread):
+        * storage/StorageTracker.cpp:
</ins><span class="cx"> 
</span><del>-2014-02-26  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+2013-04-29  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION(r162947): Document::topDocument() returns an incorrect reference for cached Documents
-        https://bugs.webkit.org/show_bug.cgi?id=128175
</del><ins>+        Add branch-prediction hint to FAST_RETURN_IF_NO_FRONTENDS.
+        &lt;http://webkit.org/b/115357&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::topDocument): Fall back to pre-r162947 way of determining the top document
-        when the Document is in page cache or is in the middle of having its render tree destroyed.
-        In the first case, the determined top document is actually the document currently loaded in the
-        Frame to which the cached document is still connected, which is obviously not desired. In the
-        second case the top document is similarly incorrectly deduced, leading to non-deletion of the
-        proper top document's AXObjectCache. Because of this AccessibilityRenderObjects are not detached
-        which results in assertions in RenderObject destructor where the objects are found to be still
-        flagged as in use by the AX cache.
</del><ins>+        Since this macro is used in some very hot code paths, give the compiler an extra hint
+        to try and minimize the impact it has when the inspector is not active.
</ins><span class="cx"> 
</span><del>-2014-02-26  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        * inspector/InspectorInstrumentation.h:
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Remove unused method RenderFlowThread::updateLayerToRegionMappings()
-        https://bugs.webkit.org/show_bug.cgi?id=129368
</del><ins>+2013-04-29  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        [WIN] Add WTF_USE_IMLANG_FONT_LINK2
+        https://bugs.webkit.org/show_bug.cgi?id=115198
</ins><span class="cx"> 
</span><del>-        Remove unused code, no new tests.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.h:
</del><ins>+        Add this new define to have a central place for switching
+        the IMLangFontLinkType and adop all usages of the type.
+        This makes the usage of the code easier on desktop pcs.
</ins><span class="cx"> 
</span><del>-2014-02-26  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</del><ins>+        * platform/graphics/FontCache.h:
+        (WebCore):
+        * platform/graphics/wince/FontCacheWinCE.cpp:
+        (WebCore::currentFontContainsCharacter):
+        (WebCore::createMLangFont):
+        (WebCore::FontCache::getFontDataForCharacters):
+        * platform/graphics/wince/SimpleFontDataWinCE.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
</ins><span class="cx"> 
</span><del>-        [GTK] Regression when showing the captions menu
-        https://bugs.webkit.org/show_bug.cgi?id=129106
</del><ins>+2013-04-29  Noam Rosenthal  &lt;noam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+        Get rid of &quot;non-composited contents&quot; in CoordinatedLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=110355
</ins><span class="cx"> 
</span><del>-        In some cases, when clicking the captions button the menu was not
-        shown.
</del><ins>+        Reviewed by Jocelyn Turcotte.
</ins><span class="cx"> 
</span><del>-        Updated test: media/video-controls-captions-trackmenu.html
</del><ins>+        When in force compositing mode, always assume that the main layer needs
+        a backing store. Make setVisibleContentRectTrajectoryVector and accumulatedCoverRect
+        recursive so that they don't rely on a specialized layer.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsGtk.js:
-        (ControllerGtk.prototype.buildCaptionMenu):
-        (ControllerGtk.prototype.showCaptionMenu): Specify sizes in
-        pixels.
</del><ins>+        No new testable behavior, changes to coverRect and trajectory vector only
+        affect tiling latency in rare cases that are not trivial to test.
</ins><span class="cx"> 
</span><del>-2014-02-26  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
+        (WebCore::CoordinatedGraphicsLayer:setVisibleContentRectTrajectoryVector):
+            Make the trajectory vector recursive, though limited only to layers with
+            translate/identity. This allows us to keep the trajectory vector while removing
+            the non-composited contents specialization.
</ins><span class="cx"> 
</span><del>-        Avoid unnecessary HTML Collection invalidations for id and name attribute changes
-        https://bugs.webkit.org/show_bug.cgi?id=129361
</del><ins>+        (WebCore::CoordinatedGraphicsLayer::accumulatedCoverRect):
+            Added accumulatedCoverRect, so that the coverRect calculations for the UI process
+            are not bound to the non-composited contents layer.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        (WebCore::CoordinatedGraphicsLayer::findDescendantWithContentsRecursively):
+            Instead of saving a reference to the non-composited contents layer, we assume that
+            the first layer we found recursively which has contents is the one to be used for
+            coverRect/trajectory calculations.
</ins><span class="cx"> 
</span><del>-        Before this patch, setting id and name attributes resulted in traversing all the ancestors to invalidate
-        HTML collections on those nodes whenever we had more than one HTMLCollection alive.
</del><ins>+        (WebCore):
+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
+        (CoordinatedGraphicsLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintsIntoWindow):
+            Always create a layer for the non-composited contents when in forceCompositing mode.
</ins><span class="cx"> 
</span><del>-        Avoid the traversal when HTMLCollections don't have any valid id and name map caches by making each
-        HTMLCollection explicitly call collectionCachedIdNameMap and collectionWillClearIdNameMap when it caches
-        or clears the id and name map.
</del><ins>+2013-04-29  Dirk Schulze  &lt;krit@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Inspired by https://chromium.googlesource.com/chromium/blink/+/5b06b91b79098f7d42e480f85be32198315d2440
</del><ins>+        Animate clip rect() between different Length types
+        https://bugs.webkit.org/show_bug.cgi?id=115336
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::registerCollection): Takes a boolean to indicate whether collection has a valid cache
-        for the id and name map.
-        (WebCore::Document::unregisterCollection): Ditto.
-        (WebCore::Document::collectionCachedIdNameMap): Added.
-        (WebCore::Document::collectionWillClearIdNameMap): Added.
-        * dom/Document.h:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::adoptDocument): Call invalidateCache on HTML collections after, not before,
-        calling unregisterCollection and registerCollection since collections' owner nodes have already been
-        moved to the new document here and invalidateCache uses owner node's document to call
-        collectionWillClearIdNameMap. So calling invalidateCache before calling unregister/registerCollection
-        would result in collectionWillClearIdNameMap getting called on a wrong document.
</del><ins>+        At the moment the animation for the 'clip' property
+        has an early return if the type of two Length values
+        does not match. This patch removes this early return.
</ins><span class="cx"> 
</span><del>-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::HTMLCollection):
-        (WebCore::HTMLCollection::~HTMLCollection):
-        (WebCore::HTMLCollection::invalidateCache):
-        (WebCore::HTMLCollection::invalidateIdNameCacheMaps): Added the code to uncount itself from the number
-        of live node lists and HTML collections that need to be invalidated upon id and name attribute changes.
-        (WebCore::HTMLCollection::updateNameCache):
</del><ins>+        Modified existing tests to cover the changes.
</ins><span class="cx"> 
</span><del>-        * html/HTMLCollection.h:
-        (WebCore::HTMLCollection::invalidateCache):
-        (WebCore::HTMLCollection::hasIdNameCache): Renamed from hasNameCache.
-        (WebCore::HTMLCollection::setHasIdNameCache): Renamed from setHasIdNameCache.
</del><ins>+        * page/animation/CSSPropertyAnimation.cpp:
+        (WebCore::blendFunc):
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormControlsCollection.cpp:
-        (WebCore::HTMLFormControlsCollection::updateNameCache):
</del><ins>+2013-04-29  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-25  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        When updating geometry, send JavaScript resize before before layout/paint.
+        &lt;http://webkit.org/b/115199&gt;
+        &lt;rdar://problem/13735535&gt;
</ins><span class="cx"> 
</span><del>-        Add support for minsize/maxsize attributes.
-        https://bugs.webkit.org/show_bug.cgi?id=122567
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Make the &quot;resize&quot; event synchronous and dispatch it before doing any automatic
+        resize-induced layout. This avoids unnecessary work in cases where an event handler
+        does something that dirties style.
</ins><span class="cx"> 
</span><del>-        This change implements the minsize/maxsize attributes of the mo element.
-        We also switch stretch sizes from int to LayoutUnit to improve accuracy.
</del><ins>+        It also avoids a kind of JS-side FOUC that happens if we drop out to the runloop
+        and paint before the resize event handler runs; for example, when viewing a popup
+        on &lt;http://lokeshdhakar.com/projects/lightbox2/&gt; and resizing the window, the dark
+        overlay sometimes resizes out of sync with the web view, since a paint may happen
+        between automatic layout and the resize event.
</ins><span class="cx"> 
</span><del>-        Tests: mathml/presentation/stretchy-minsize-maxsize-dynamic.html
-               mathml/presentation/stretchy-minsize-maxsize.html
-
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::SetOperatorProperties):
-        (WebCore::RenderMathMLOperator::stretchTo):
-        * rendering/mathml/RenderMathMLOperator.h:
-        * rendering/mathml/RenderMathMLRow.cpp:
-        (WebCore::RenderMathMLRow::layout):
-
-2014-02-25  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
-
-        [CSSRegions] Small clean-up of flow threads accelerated compositing code
-        https://bugs.webkit.org/show_bug.cgi?id=129312
-
-        Reviewed by Andrei Bucur.
-
-        Some clean-up for the code used for regions in accelerated compositing functionality:
-        1. Rename updateRenderFlowThreadLayersIfNeeded -&gt; updateFlowThreadsLayerToRegionMappingsIfNeeded
-        as the function updates the mapping between the flow threads layers and their corresponding regions
-        2. Remove RenderLayerCompositor::updateRenderFlowThreadLayersIfNeeded and move the code in place
-        at call site since the function body does not require a dedicated function.
-
-        No new functionality, no new tests.
-
-        * rendering/FlowThreadController.cpp:
-        (WebCore::FlowThreadController::updateFlowThreadsLayerToRegionMappingsIfNeeded):
-        Now that the regions are always layers, we do not need to iterate backwards.
-        * rendering/FlowThreadController.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateCompositingLayers):
-        * rendering/RenderLayerCompositor.h:
-
-2014-02-25  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Subpixel rendering: Ensure consistent border painting width.
-        https://bugs.webkit.org/show_bug.cgi?id=129259
-
-        Reviewed by Simon Fraser.
-
-        Border edges are painted as (semi)independent rectangles. When snapping an edge rectangle
-        to device pixels, its painted dimensions depend on its size and its fractional position.
-        Specific combination of position and border width can result in painting edges sized differently.
-        Using device snapped border width to calculate inner/outer rectangles helps to maintain
-        uniform border width.
-
-        Currently not testable.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::BorderEdge::BorderEdge):
-        (WebCore::BorderEdge::shouldRender):
-        (WebCore::BorderEdge::presentButInvisible):
-        (WebCore::BorderEdge::widthForPainting):
-        (WebCore::BorderEdge::getDoubleBorderStripeWidths):
-        (WebCore::RenderBoxModelObject::paintOneBorderSide):
-        (WebCore::calculateSideRect):
-        (WebCore::RenderBoxModelObject::paintBorderSides):
-        (WebCore::RenderBoxModelObject::paintBorder):
-        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
-        (WebCore::calculateSideRectIncludingInner):
-
-2014-02-25  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Subpixel layout: Remove explicit static_cast&lt;LayoutUnit&gt; conversions.
-        https://bugs.webkit.org/show_bug.cgi?id=129359
-
-        Reviewed by Simon Fraser.
-
-        No testable change in behavior.
-
-        * css/LengthFunctions.cpp:
-        (WebCore::minimumValueForLength):
</del><ins>+        * page/EventHandler.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchResizeEvent):
+        * page/FrameView.h:
</ins><span class="cx">         * page/FrameView.cpp:
</span><del>-        (WebCore::FrameView::forceLayoutForPagination):
-        * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::paintFillLayer):
-        * rendering/InlineFlowBox.h:
-        (WebCore::InlineFlowBox::logicalLeftVisualOverflow):
-        (WebCore::InlineFlowBox::logicalRightVisualOverflow):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::isSelected):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::computeColumnCountAndWidth):
-        (WebCore::getBPMWidth):
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::adjustForBorderFit):
-        * rendering/RenderDeprecatedFlexibleBox.cpp:
-        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::paintBoxDecorations):
-        * rendering/RenderTable.h:
-        (WebCore::RenderTable::borderSpacingInRowDirection):
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::preferredContentLogicalWidth):
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::preferredContentLogicalWidth):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::beforeAnnotationsAdjustment):
-        (WebCore::RootInlineBox::ascentAndDescentForBox):
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::resolveLengthAttributeForSVG):
</del><ins>+        (WebCore::FrameView::dispatchResizeEvent):
</ins><span class="cx"> 
</span><del>-2014-02-25  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+            Renamed sendResizeEvent() to dispatchResizeEvent() and made it dispatch the event
+            synchronously instead of adding it to the DocumentEventQueue.
</ins><span class="cx"> 
</span><del>-        Build fixes.
</del><ins>+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::setFrameRect):
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
</del><ins>+            Dispatch the &quot;resize&quot; event right when the new frame rect is set.
</ins><span class="cx"> 
</span><del>-2014-02-25  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+2013-04-29  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Build fix for OS X after r164690
</del><ins>+        Remove OS(WINCE) from (Render|Scrollbar)ThemeWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=115348
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-02-25  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        Compile DIBPixelData.cpp on Windows CE too, which allows us
+        to get rid of a few #if OS(WINCE) in other code parts.
</ins><span class="cx"> 
</span><del>-        Rename WebCore::VisitedLinkProvider to WebCore::VisitedLinkStore
-        https://bugs.webkit.org/show_bug.cgi?id=129357
</del><ins>+        * PlatformWinCE.cmake:
+        * platform/graphics/win/DIBPixelData.cpp:
+        (WebCore::DIBPixelData::setRGBABitmapAlpha):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintTrackPiece):
+        (WebCore::ScrollbarThemeWin::paintButton):
+        (WebCore::ScrollbarThemeWin::paintThumb):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::drawControl):
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2013-04-29  Eli Fidler  &lt;efidler@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/VisitedLinkState.cpp:
-        (WebCore::VisitedLinkState::determineLinkStateSlowCase):
-        * loader/HistoryController.cpp:
-        (WebCore::addVisitedLink):
-        * page/DefaultVisitedLinkStore.cpp: Renamed from Source/WebCore/page/DefaultVisitedLinkProvider.cpp.
-        (WebCore::DefaultVisitedLinkStore::create):
-        (WebCore::DefaultVisitedLinkStore::DefaultVisitedLinkStore):
-        (WebCore::DefaultVisitedLinkStore::~DefaultVisitedLinkStore):
-        (WebCore::DefaultVisitedLinkStore::isLinkVisited):
-        (WebCore::DefaultVisitedLinkStore::addVisitedLink):
-        * page/DefaultVisitedLinkStore.h: Renamed from Source/WebCore/page/DefaultVisitedLinkProvider.h.
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::visitedLinkStore):
-        * page/Page.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::visitedLinkStore):
-        * page/PageGroup.h:
-        * page/VisitedLinkStore.cpp: Renamed from Source/WebCore/page/VisitedLinkProvider.cpp.
-        (WebCore::VisitedLinkStore::VisitedLinkStore):
-        (WebCore::VisitedLinkStore::~VisitedLinkStore):
-        * page/VisitedLinkStore.h: Renamed from Source/WebCore/page/VisitedLinkProvider.h.
</del><ins>+        [BlackBerry] Fake-bold monospace fonts need to use non-fake-bold advances
+        https://bugs.webkit.org/show_bug.cgi?id=115280
</ins><span class="cx"> 
</span><del>-2014-02-25  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        Reviewed by George Staikos.
</ins><span class="cx"> 
</span><del>-        [WebKit2] Form controls handling.
-        https://bugs.webkit.org/show_bug.cgi?id=129344
-        &lt;rdar://problem/16053643&gt;
</del><ins>+        BlackBerry PR 330864
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser and Joseph Pecoraro.
</del><ins>+        Tested by fast/css/css3-ch-unit.html
</ins><span class="cx"> 
</span><del>-        Adding some exports.
-        
-        * WebCore.exp.in:
</del><ins>+        * platform/graphics/blackberry/FontPlatformDataBlackBerry.cpp:
+        (WebCore::FontPlatformData::applyState):
+        (WebCore::FontPlatformData::isFixedPitch):
+        * platform/graphics/blackberry/ITypeUtils.h:
+        * platform/graphics/blackberry/SimpleFontDataBlackBerry.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
</ins><span class="cx"> 
</span><del>-2014-02-25  Samuel White  &lt;samuel_white@apple.com&gt;
</del><ins>+2013-04-29  ChangSeok Oh  &lt;changseok.oh@collabora.com&gt;
</ins><span class="cx"> 
</span><del>-        Add accessibility search predicate support for AXOutlines
-        https://bugs.webkit.org/show_bug.cgi?id=123748
</del><ins>+        [GTK][AC] Clean up code related with the children management stuff for clutter based AC
+        https://bugs.webkit.org/show_bug.cgi?id=114260
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Reviewed by Gustavo Noronha Silva.
</ins><span class="cx"> 
</span><del>-        Added new AXOutlineSearchKey to support finding elements with aria role=tree.
</del><ins>+        Remove unused or usless code for children management stuff.
</ins><span class="cx"> 
</span><del>-        No new tests, updated existing search-predicate.html test to cover AXOutlineSearchKey.
</del><ins>+        No new tests since no functionality changed.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::isAccessibilityObjectSearchMatchAtIndex):
-        * accessibility/AccessibilityObject.h:
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-        (createAccessibilitySearchKeyMap):
</del><ins>+        * platform/graphics/clutter/GraphicsLayerActor.cpp:
+        (_GraphicsLayerActorPrivate):
+        (graphics_layer_actor_class_init):
+        (graphicsLayerActorAllocate):
+        (graphicsLayerActorDraw):
+        (graphicsLayerActorNew):
+        (graphicsLayerActorSetSublayers):
+        * platform/graphics/clutter/GraphicsLayerActor.h:
+        * platform/graphics/clutter/GraphicsLayerClutter.cpp:
+        (WebCore::idleDestroy):
+        (WebCore::GraphicsLayerClutter::ensureStructuralLayer):
+        (WebCore::GraphicsLayerClutter::updateLayerDrawsContent):
</ins><span class="cx"> 
</span><del>-2014-02-25  Mark Lam  &lt;mark.lam@apple.com&gt;
</del><ins>+2013-04-29  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Need to initialize VM stack data even when the VM is on an exclusive thread.
-        &lt;https://webkit.org/b/129265&gt;
</del><ins>+        [WIN] Guard cfHDropFormat() with USE(CF) instead of OS(WINCE)
+        https://bugs.webkit.org/show_bug.cgi?id=115195
</ins><span class="cx"> 
</span><del>-        Not reviewed.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        USE(CF) is the correct guard, which works on desktop pcs too.
</ins><span class="cx"> 
</span><del>-        Relanding r164627 now that &lt;https://webkit.org/b/129341&gt; is fixed.
</del><ins>+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+        * platform/win/DragDataWin.cpp:
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::numberOfFiles):
+        (WebCore::DragData::asFilenames):
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::commonVM):
</del><ins>+2013-04-29  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-25  Mark Lam  &lt;mark.lam@apple.com&gt;
</del><ins>+        Unreviewed. Fix make distcheck.
</ins><span class="cx"> 
</span><del>-        JSDOMPromise methods should acquire VM lock before calling into JS.
-        &lt;https://webkit.org/b/129341&gt;
</del><ins>+        * GNUmakefile.am: Add missing scripts to EXTRA_DIST.
+        * GNUmakefile.list.am: Add missing files to compilation.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2013-04-29  Noam Rosenthal  &lt;noam@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        [Qt] fast/canvas/webgl/webgl-composite-modes.html broken after r148433.
+        https://bugs.webkit.org/show_bug.cgi?id=115243
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMPromise.h:
-        (WebCore::DeferredWrapper::resolve):
-        (WebCore::DeferredWrapper::reject):
-        (WebCore::DeferredWrapper::resolve&lt;String&gt;):
-        (WebCore::DeferredWrapper::resolve&lt;bool&gt;):
-        (WebCore::char&gt;&gt;):
-        (WebCore::DeferredWrapper::reject&lt;String&gt;):
</del><ins>+        Reviewed by Jocelyn Turcotte.
</ins><span class="cx"> 
</span><del>-2014-02-25  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        When compositing a layer with a canvas or directly composited image, it is
+        wrong to use TextureMapperLayer::setBackingStore. Instead, setContentsLayer
+        should be used, which allows for the layer to have both a backing store and
+        a contents layer.
</ins><span class="cx"> 
</span><del>-        Simplify visited link style invalidation
-        https://bugs.webkit.org/show_bug.cgi?id=129340
</del><ins>+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::paintSelf):
+        * platform/graphics/texmap/TextureMapperLayer.h:
+        (State):
+        (WebCore::TextureMapperLayer::State::State):
+        * platform/graphics/texmap/coordinated/CoordinatedGraphicsScene.cpp:
+        (WebCore::CoordinatedGraphicsScene::createCanvasIfNeeded):
+        (WebCore::CoordinatedGraphicsScene::destroyCanvasIfNeeded):
+        (WebCore::CoordinatedGraphicsScene::assignImageBackingToLayer):
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+2013-04-29  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Get rid of the static Page::allVisitedStateChanged and Page::visitedStateChanged
-        member functions and add functions to invalidate all styles on a single page or the style
-        for a single link hash on a single page.
</del><ins>+        Unreviewed build fix.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/Page.cpp:
-        (WebCore::Page::invalidateStylesForAllLinks):
-        (WebCore::Page::invalidateStylesForLink):
-        * page/Page.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addVisitedLink):
-        (WebCore::PageGroup::removeVisitedLink):
-        (WebCore::PageGroup::removeVisitedLinks):
</del><ins>+        * bindings/js/WorkerScriptDebugServer.cpp: Added missing header.
</ins><span class="cx"> 
</span><del>-2014-02-25  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2013-04-29  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Remove unused ThreadSpecificInspectorCounters.
-        &lt;https://webkit.org/b/129337&gt;
</del><ins>+        Unreviewed build fix.
</ins><span class="cx"> 
</span><del>-        We were keeping count of all the JS event listeners in every thread
-        to support an old Chromium feature that's no longer relevant.
</del><ins>+        * platform/graphics/wince/FontWinCE.cpp:
+        (WebCore::generateComponents):
</ins><span class="cx"> 
</span><del>-        Removing this gets rid of expensive thread-local storage lookups.
</del><ins>+2013-04-29  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Remove OS(WINCE) from HTMLSelectElement.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=115194
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::~JSEventListener):
-        * inspector/InspectorCounters.cpp:
-        * inspector/InspectorCounters.h:
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::setDOMCounters):
-        * inspector/protocol/Timeline.json:
-        * platform/ThreadGlobalData.cpp:
-        (WebCore::ThreadGlobalData::ThreadGlobalData):
-        (WebCore::ThreadGlobalData::destroy):
-        * platform/ThreadGlobalData.h:
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-02-25  Laszlo Vidacs  &lt;lvidacs.u-szeged@partner.samsung.com&gt;
</del><ins>+        Use the same files like the the other PLATFORM(WIN) ports use.
</ins><span class="cx"> 
</span><del>-        display:table with padding and/or borders in border-box calculates height incorrectly
-        https://bugs.webkit.org/show_bug.cgi?id=126576
</del><ins>+        * PlatformWinCE.cmake:
+        * html/HTMLSelectElement.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+2013-04-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Based on blink issue https://codereview.chromium.org/25206002/
</del><ins>+        StaticHashSetNodeList is unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=115219
</ins><span class="cx"> 
</span><del>-        Tests: fast/box-sizing/css-table-collapse.html
-               fast/box-sizing/css-table-no-collapse.html
-               fast/box-sizing/table-collapse.html
-               fast/box-sizing/table-no-collapse.html
</del><ins>+        Reviewed by Antonio Gomes.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
</del><ins>+        Moved Document::nodesFromRect into Internals::nodesFromRect per
+        https://chromium.googlesource.com/chromium/blink/+/78207c5c34383fbb807bb9347deb67168f09bb04.
</ins><span class="cx"> 
</span><del>-2014-02-25  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        Also made TouchAdjustment functions use HashListSet directly instead of wrapping it inside
+        a StaticHashSetNodeList since there was no need to use the latter.
</ins><span class="cx"> 
</span><del>-        Get rid of VisitedLinkStrategy
-        https://bugs.webkit.org/show_bug.cgi?id=129324
</del><ins>+        With these two changes, I deleted StaticHashSetNodeList.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
-
</del><span class="cx">         * GNUmakefile.list.am:
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
</del><ins>+        * Target.pri:
+        * WebCore.exp.in:
</ins><span class="cx">         * WebCore.xcodeproj/project.pbxproj:
</span><del>-        * platform/PlatformStrategies.h:
-        (WebCore::PlatformStrategies::PlatformStrategies):
-        * platform/VisitedLinkStrategy.h: Removed.
</del><ins>+        * dom/Document.cpp:
+        (WebCore):
+        * dom/Document.h:
+        (Document):
+        * dom/StaticHashSetNodeList.cpp: Removed.
+        * dom/StaticHashSetNodeList.h: Removed.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::bestClickableNodeForTouchPoint):
+        (WebCore::EventHandler::bestContextMenuNodeForTouchPoint):
+        (WebCore::EventHandler::bestZoomableAreaForTouchPoint):
+        * page/TouchAdjustment.cpp:
+        (WebCore::TouchAdjustment::compileSubtargetList):
+        (WebCore::TouchAdjustment::compileZoomableSubtargets):
+        (WebCore::findBestClickableCandidate):
+        (WebCore::findBestContextMenuCandidate):
+        (WebCore::findBestZoomableArea):
+        * page/TouchAdjustment.h:
+        (WebCore):
+        * testing/Internals.cpp:
+        (WebCore::Internals::nodesFromRect):
</ins><span class="cx"> 
</span><del>-2014-02-25  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2013-04-28  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Rolling out http://trac.webkit.org/changeset/164611, because it broke
-        WebKit2.PrivateBrowsingPushStateNoHistoryCallback API test
</del><ins>+        [Mac] Disable canvas backing store scaling (HIGH_DPI_CANVAS)
+        https://bugs.webkit.org/show_bug.cgi?id=115310
</ins><span class="cx"> 
</span><del>-        The change was for:
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=129141
-        Create SessionID class
</del><ins>+        Disable the automatic pixel doubling in canvas backing stores on high
+        dpi devices. This will potentially make canvases look worse of high dpi
+        displays, but only if they were ignoring devicePixelRatio. Since the
+        majority of high dpi displays *do not* auto-double (including mobile
+        devices and other desktop browsers), this provides consistency and less
+        chance of unnecessary memory use.
</ins><span class="cx"> 
</span><del>-2014-02-25  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        * Configurations/FeatureDefines.xcconfig: Remove ENABLE_HIGH_DPI_CANVAS_macosx.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r164627.
-        http://trac.webkit.org/changeset/164627
-        https://bugs.webkit.org/show_bug.cgi?id=129325
</del><ins>+2013-04-28  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Broke SubtleCrypto tests (Requested by ap on #webkit).
</del><ins>+        Get rid of [Callback] IDL extended attribute for parameters
+        https://bugs.webkit.org/show_bug.cgi?id=115250
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::commonVM):
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-2014-02-25  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        Remove the WebKit-specific [Callback] extended attribute and make the bindings
+        generator smart enough to know when a parameter is of callback type on its
+        own.
</ins><span class="cx"> 
</span><del>-        DefaultVisitedLinkProvider can just call into the page group directly
-        https://bugs.webkit.org/show_bug.cgi?id=129320
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        * DerivedSources.make: Use WebCore/Modules as IDL include path instead of using
+        subdirs. The generator will search recursively anyway and the list of subdirs was
+        incomplete.
+        * Modules/filesystem/DOMWindowFileSystem.idl:
+        * Modules/filesystem/DirectoryEntry.idl:
+        * Modules/filesystem/DirectoryReader.idl:
+        * Modules/filesystem/Entry.idl:
+        * Modules/filesystem/FileEntry.idl:
+        * Modules/filesystem/WorkerContextFileSystem.idl:
+        * Modules/mediastream/NavigatorMediaStream.idl:
+        * Modules/mediastream/RTCPeerConnection.idl:
+        * Modules/notifications/Notification.idl:
+        * Modules/notifications/NotificationCenter.idl:
+        * Modules/quota/StorageInfo.idl:
+        * Modules/quota/StorageQuota.idl:
+        * Modules/webaudio/AudioContext.idl:
+        * Modules/webdatabase/DOMWindowWebDatabase.idl:
+        * Modules/webdatabase/Database.idl:
+        * Modules/webdatabase/DatabaseSync.idl:
+        * Modules/webdatabase/SQLTransaction.idl:
+        * Modules/webdatabase/WorkerContextWebDatabase.idl:
+        * bindings/gobject/GNUmakefile.am: Add missing IDL include dirs.
+        * bindings/scripts/CodeGenerator.pm:
+        (IsWrapperType):
+        (IsCallbackInterface):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (SkipFunction):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateParametersCheckExpression):
+        (GenerateParametersCheck):
+        * bindings/scripts/IDLAttributes.txt: Remove &quot;Callback&quot; extended attribute.
+        * bindings/scripts/test/CPP/WebDOMTestCallback.cpp:
+        (WebDOMTestCallback::callbackWithArrayParam):
+        (WebDOMTestCallback::callbackWithSerializedScriptValueParam):
+        (WebDOMTestCallback::callbackWithNonBoolReturnType):
+        (WebDOMTestCallback::callbackRequiresThisToPass):
+        * bindings/scripts/test/CPP/WebDOMTestCallback.h:
+        (WebDOMTestCallback):
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        (WebDOMTestObj::convert1):
+        (WebDOMTestObj::convert2):
+        (WebDOMTestObj::convert4):
+        (WebDOMTestObj::convert5):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.cpp:
+        (WebDOMTestSerializedScriptValueInterface::acceptTransferList):
+        (WebDOMTestSerializedScriptValueInterface::multiTransferList):
+        * bindings/scripts/test/CPP/WebDOMTestSerializedScriptValueInterface.h:
+        (WebDOMTestSerializedScriptValueInterface):
+        * bindings/scripts/test/CPP/WebDOMTestTypedefs.cpp:
+        (WebDOMTestTypedefs::multiTransferList):
+        * bindings/scripts/test/CPP/WebDOMTestTypedefs.h:
+        (WebDOMTestTypedefs):
+        * bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp:
+        (webkit_dom_test_callback_callback_with_array_param):
+        (webkit_dom_test_callback_callback_with_serialized_script_value_param):
+        (webkit_dom_test_callback_callback_with_non_bool_return_type):
+        (webkit_dom_test_callback_callback_requires_this_to_pass):
+        * bindings/scripts/test/GObject/WebKitDOMTestCallback.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_convert1):
+        (webkit_dom_test_obj_convert2):
+        (webkit_dom_test_obj_convert4):
+        (webkit_dom_test_obj_convert5):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.cpp:
+        (webkit_dom_test_serialized_script_value_interface_accept_transfer_list):
+        (webkit_dom_test_serialized_script_value_interface_multi_transfer_list):
+        * bindings/scripts/test/GObject/WebKitDOMTestSerializedScriptValueInterface.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestTypedefs.cpp:
+        (webkit_dom_test_typedefs_multi_transfer_list):
+        * bindings/scripts/test/GObject/WebKitDOMTestTypedefs.h:
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithArrayParam):
+        (WebCore::JSTestCallback::callbackWithSerializedScriptValueParam):
+        (WebCore::JSTestCallback::callbackRequiresThisToPass):
+        * bindings/scripts/test/JS/JSTestCallback.h:
+        (JSTestCallback):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjPrototypeFunctionConvert1):
+        (WebCore::jsTestObjPrototypeFunctionConvert2):
+        (WebCore::jsTestObjPrototypeFunctionConvert4):
+        (WebCore::jsTestObjPrototypeFunctionConvert5):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::constructJSTestSerializedScriptValueInterface):
+        (WebCore::jsTestSerializedScriptValueInterfacePrototypeFunctionAcceptTransferList):
+        (WebCore::jsTestSerializedScriptValueInterfacePrototypeFunctionMultiTransferList):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::jsTestTypedefsPrototypeFunctionMultiTransferList):
+        * bindings/scripts/test/ObjC/DOMTestCallback.h:
+        * bindings/scripts/test/ObjC/DOMTestCallback.mm:
+        (-[DOMTestCallback callbackWithArrayParam:]):
+        (-[DOMTestCallback callbackWithSerializedScriptValueParam:strArg:]):
+        (-[DOMTestCallback callbackWithNonBoolReturnType:]):
+        (-[DOMTestCallback callbackRequiresThisToPass:testNodeParam:]):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj convert1:]):
+        (-[DOMTestObj convert2:]):
+        (-[DOMTestObj convert4:]):
+        (-[DOMTestObj convert5:]):
+        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.h:
+        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.mm:
+        (-[DOMTestSerializedScriptValueInterface acceptTransferList:transferList:]):
+        (-[DOMTestSerializedScriptValueInterface multiTransferList:tx:second:txx:]):
+        * bindings/scripts/test/ObjC/DOMTestTypedefs.h:
+        * bindings/scripts/test/ObjC/DOMTestTypedefs.mm:
+        (-[DOMTestTypedefs multiTransferList:tx:second:txx:]):
+        * bindings/scripts/test/TestCallback.idl: Use valid types instead of Class1, Class2, ...
+        so that the bindings generator does not complain about not being able to resolve
+        them.
+        * bindings/scripts/test/TestObj.idl: Use valid parameter types instead of 'a', 'b', 'd', 'e'
+        so that the bindings generator does not complain about them.
+        * bindings/scripts/test/TestSerializedScriptValueInterface.idl:
+        * bindings/scripts/test/TestTypedefs.idl:
+        * css/FontLoader.idl:
+        * dom/DataTransferItem.idl:
+        * page/DOMWindow.idl:
</ins><span class="cx"> 
</span><del>-        * page/DefaultVisitedLinkProvider.cpp:
-        (WebCore::DefaultVisitedLinkProvider::isLinkVisited):
-        (WebCore::DefaultVisitedLinkProvider::addVisitedLink):
</del><ins>+2013-04-27  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-25  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Move from constructor and member function adoptCF/NS to free function adoptCF/NS.
+        https://bugs.webkit.org/show_bug.cgi?id=115307
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r164638.
-        http://trac.webkit.org/changeset/164638
-        https://bugs.webkit.org/show_bug.cgi?id=129321
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Broke Windows build. (Requested by bfulgham on #webkit).
</del><ins>+        This change was done by a global replace followed by compiling and inspecting for
+        cases that needed to be tweaked by hand.
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.h:
-        (WebCore::ChildNodesLazySnapshot::takeSnapshot):
-        (WebCore::ChildNodesLazySnapshot::hasSnapshot):
-        * dom/Element.cpp:
-        (WebCore::ensureAttrNodeListForElement):
-        (WebCore::Element::attributes):
-        * dom/ElementIteratorAssertions.h:
-        (WebCore::ElementIteratorAssertions::ElementIteratorAssertions):
-        * dom/ElementRareData.h:
-        (WebCore::ElementRareData::create):
-        (WebCore::ElementRareData::setAttributeMap):
-        * dom/MutationObserverRegistration.cpp:
-        (WebCore::MutationObserverRegistration::create):
-        (WebCore::MutationObserverRegistration::observedSubtreeNodeWillDetach):
-        (WebCore::MutationObserverRegistration::clearTransientRegistrations):
-        (WebCore::MutationObserverRegistration::addRegistrationNodesToSet):
-        * dom/MutationObserverRegistration.h:
-        * dom/NamedNodeMap.h:
-        (WebCore::NamedNodeMap::create):
-        (WebCore::NamedNodeMap::NamedNodeMap):
-        * dom/Node.cpp:
-        (WebCore::Node::ensureRareData):
-        (WebCore::Node::didMoveToNewDocument):
-        (WebCore::Node::ensureEventTargetData):
-        (WebCore::Node::mutationObserverRegistry):
-        (WebCore::Node::registerMutationObserver):
-        (WebCore::Node::unregisterMutationObserver):
-        (WebCore::Node::notifyMutationObserversNodeWillDetach):
-        * dom/Node.h:
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::create):
-        (WebCore::NodeListsNodeData::NodeListsNodeData):
-        (WebCore::NodeMutationObserverData::create):
-        (WebCore::NodeMutationObserverData::NodeMutationObserverData):
-        (WebCore::NodeRareData::create):
-        (WebCore::NodeRareData::clearNodeLists):
-        (WebCore::NodeRareData::ensureNodeLists):
-        (WebCore::NodeRareData::ensureMutationObserverData):
-        (WebCore::NodeRareData::NodeRareData):
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::rebuildPresentationAttributeStyle):
-
-2014-02-25  Eric Carlson  &lt;eric.carlson@apple.com&gt;
-
-        [iOS] Show status image when playing video to external device
-        https://bugs.webkit.org/show_bug.cgi?id=129277
-
-        Reviewed by Jer Noble.
-
-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller.prototype.handleEvent): Restructure the code so it is possible to handle events
-            that target the video element which aren't in the HandledVideoEvents array.
-
-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.currentPlaybackTargetIsWireless): webkitCurrentPlaybackTargetIsWireless
-            is an attribute, not a function.
-        (ControllerIOS.prototype.updateWirelessPlaybackStatus): Fix style.
-        (ControllerIOS.prototype.updateWirelessTargetAvailable): Ditto.
-        (ControllerIOS.prototype.updateProgress): Ditto.
-        (ControllerIOS.prototype.handleWrapperTouchStart): Show the controls if the wireless status
-            display is touched.
-        (ControllerIOS.prototype.handleFullscreenButtonClicked): Fix style
-        (ControllerIOS.prototype.handleWirelessPlaybackChange): Ditto.
-        (ControllerIOS.prototype.handleWirelessTargetAvailableChange):
-        (ControllerIOS.prototype.handleWirelessPickerButtonClicked): Ditto. Stop even propagation.
-
-        Move &quot;playback target&quot; logic into HTMLMediaSession.
</del><ins>+        * accessibility/ios/AXObjectCacheIOS.mm:
+        (WebCore::AXObjectCache::attachWrapper):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::attachWrapper):
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::methodNamed):
+        (JSC::Bindings::ObjcClass::fieldNamed):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::ObjcField):
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::fontAttributesForSelectionStart):
+        * history/cf/HistoryPropertyList.cpp:
+        (WebCore::HistoryPropertyListWriter::releaseData):
</ins><span class="cx">         * html/HTMLMediaElement.cpp:
</span><del>-        (WebCore::HTMLMediaElement::~HTMLMediaElement): Call media session.
-        (WebCore::HTMLMediaElement::loadResource): Tell media session to apply media player
-            restrictions now that it has a url.
-        (WebCore::HTMLMediaElement::invalidateCachedTime): Only log when cached time is not 
-            already invalie.
-        (WebCore::HTMLMediaElement::webkitShowPlaybackTargetPicker): Call media session.
-        (WebCore::HTMLMediaElement::webkitCurrentPlaybackTargetIsWireless): Ditto.
-        (WebCore::HTMLMediaElement::mediaPlayerCurrentPlaybackTargetIsWirelessChanged): Ditto.
-        (WebCore::HTMLMediaElement::addEventListener): Ditto.
-        (WebCore::HTMLMediaElement::removeEventListen): Ditto.
-        (WebCore::HTMLMediaElement::enqueuePlaybackTargetAvailabilityChangedEvent): Ditto.
-        (WebCore::HTMLMediaElement::createMediaPlayer): Ditto.
</del><ins>+        (WebCore::createFileURLForApplicationCacheResource):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createPropertyListRepresentation):
+        (WebCore::LegacyWebArchive::create):
+        (WebCore::LegacyWebArchive::rawDataRepresentation):
+        * loader/archive/cf/LegacyWebArchiveMac.mm:
+        (WebCore::LegacyWebArchive::createPropertyListRepresentation):
+        * loader/mac/ResourceLoaderMac.mm:
+        (WebCore::ResourceLoader::willCacheResponse):
+        * page/CaptionUserPreferencesMac.mm:
+        (WebCore::CaptionUserPreferencesMac::userPrefersCaptions):
+        (WebCore::CaptionUserPreferencesMac::userPrefersSubtitles):
+        (WebCore::CaptionUserPreferencesMac::captionsWindowCSS):
+        (WebCore::CaptionUserPreferencesMac::captionsBackgroundCSS):
+        (WebCore::CaptionUserPreferencesMac::captionsTextColor):
+        (WebCore::CaptionUserPreferencesMac::captionsDefaultFontCSS):
+        (WebCore::CaptionUserPreferencesMac::preferredLanguages):
+        (WebCore::trackDisplayName):
+        * platform/Language.cpp:
+        (WebCore::displayNameForLanguageLocale):
+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::imageTitle):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/audio/mac/AudioFileReaderMac.cpp:
+        (WebCore::AudioFileReader::AudioFileReader):
+        * platform/cf/KURLCFNet.cpp:
+        (WebCore::KURL::fileSystemPath):
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerItem):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+        * platform/graphics/ca/mac/LayerFlushSchedulerMac.cpp:
+        (WebCore::LayerFlushScheduler::schedule):
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (PlatformCAAnimation::PlatformCAAnimation):
+        * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
+        (PlatformCAFilters::filterValueForOperation):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::PlatformCALayer):
+        (PlatformCALayer::addAnimationForKey):
+        (PlatformCALayer::setBackgroundColor):
+        (PlatformCALayer::setBorderColor):
+        * platform/graphics/cg/BitmapImageCG.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::BitmapImage::getCGImageArray):
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::cachedCGColor):
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::GraphicsContext3D::ImageExtractor::extractImage):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::createIOSurface):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::copyImage):
+        (WebCore::ImageBuffer::draw):
+        (WebCore::ImageBuffer::clip):
+        (WebCore::ImageBuffer::putByteArray):
+        (WebCore::CGImageEncodeToData):
+        (WebCore::CGImageToDataURL):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageDataToDataURL):
+        * platform/graphics/cg/ImageBufferDataCG.cpp:
+        (WebCore::ImageBufferData::getData):
+        (WebCore::ImageBufferData::putData):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::imageWithColorSpace):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::orientationAtIndex):
+        (WebCore::ImageSource::getHotSpot):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::createScratchContext):
+        (WebCore::Path::contains):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::setFont):
+        (WebCore::createFeatureSettingDictionary):
+        (WebCore::cascadeToLastResortFontDescriptor):
+        (WebCore::cascadeToLastResortAndDisableSwashesFontDescriptor):
+        (WebCore::FontPlatformData::ctFont):
+        (WebCore::FontPlatformData::description):
+        * platform/graphics/gpu/mac/DrawingBufferMac.mm:
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
+        (-[WebCascadeList objectAtIndex:]):
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::linearRGBColorSpaceRef):
+        * platform/graphics/mac/ImageMac.mm:
+        (WebCore::BitmapImage::getTIFFRepresentation):
+        (WebCore::BitmapImage::getNSImage):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::MediaPlayerPrivateQTKit):
+        (WebCore::MediaPlayerPrivateQTKit::createQTMovie):
+        (WebCore::MediaPlayerPrivateQTKit::createQTMovieView):
+        (WebCore::MediaPlayerPrivateQTKit::createQTVideoRenderer):
+        (WebCore::MediaPlayerPrivateQTKit::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivateQTKit::setPreservesPitch):
+        (WebCore::addFileTypesToCache):
+        * platform/graphics/mac/SimpleFontDataCoreText.cpp:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::fontHasVerticalGlyphs):
+        (WebCore::SimpleFontData::getCompositeFontReferenceFontData):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::canRenderCombiningCharacterSequence):
+        * platform/graphics/mac/WebGLLayer.mm:
+        (-[WebGLLayer copyImageSnapshotWithColorSpace:]):
+        * platform/mac/ContentFilterMac.mm:
+        (WebCore::ContentFilter::ContentFilter):
+        * platform/mac/ContextMenuItemMac.mm:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        * platform/mac/CursorMac.mm:
+        (WebCore::createCustomCursor):
+        (WebCore::createNamedCursor):
+        * platform/mac/DisplaySleepDisabler.cpp:
+        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
+        * platform/mac/DragImageMac.mm:
+        (WebCore::dissolveDragImageToFraction):
+        (WebCore::createDragImageFromImage):
+        * platform/mac/HTMLConverter.mm:
+        (+[WebHTMLConverter editingAttributedStringFromRange:]):
+        * platform/mac/Language.mm:
+        (WebCore::httpStyleLanguageCode):
+        (WebCore::platformUserPreferredLanguages):
+        * platform/mac/LocalizedStringsMac.cpp:
+        (WebCore::localizedString):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::getDataSelection):
+        (WebCore::Pasteboard::writeSelectionForTypes):
+        (WebCore::fragmentFromWebArchive):
+        * platform/mac/PlatformClockCM.mm:
+        (PlatformClockCM::PlatformClockCM):
+        (PlatformClockCM::initializeWithTimingSource):
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::addTypes):
+        (WebCore::PlatformPasteboard::setTypes):
+        (WebCore::PlatformPasteboard::setPathnamesForType):
+        * platform/mac/PlatformSpeechSynthesizerMac.mm:
+        (WebCore::PlatformSpeechSynthesizer::speak):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenuMac::populate):
+        (WebCore::PopupMenuMac::show):
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[WebScrollbarPainterDelegate setUpAlphaAnimation:scrollerPainter:part:WebCore::animateAlphaTo:duration:]):
+        (-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
+        (-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
+        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
+        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
+        * platform/mac/SharedBufferMac.mm:
+        (WebCore::SharedBuffer::createCFData):
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringEncodingForResource):
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::ProtectionSpace::receivesCredentialSecurely):
+        * platform/network/SynchronousLoaderClient.cpp:
+        (WebCore::SynchronousLoaderClient::platformBadResponseError):
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::platformProxyIsEnabledInSystemPreferences):
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+        (WebCore::advanceCurrentStream):
+        * platform/network/cf/NetworkStorageSessionCFNet.cpp:
+        (WebCore::overrideCookieStorage):
+        * platform/network/cf/ProxyServerCFNet.cpp:
+        (WebCore::proxyAutoConfigurationResultCallback):
+        (WebCore::processProxyServers):
+        (WebCore::addProxyServersForURL):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::platformLazyInit):
+        (WebCore::ResourceError::cfError):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::createCFURLConnection):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::handleDataArray):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformHTTPBody):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::setStorageSession):
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::cfURLResponse):
+        (WebCore::ResourceResponse::platformLazyInit):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::executePACFileURL):
+        (WebCore::SocketStreamHandle::chooseProxy):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::SocketStreamHandle::addCONNECTCredentials):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::reportErrorToClient):
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):
+        (WebCore::AuthenticationChallenge::setAuthenticationClient):
+        * platform/network/mac/CookieJarMac.mm:
+        (WebCore::filterCookies):
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::createNSErrorFromResourceErrorBase):
+        (WebCore::ResourceError::nsError):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::createNSURLConnection):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::updateNSURLRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformHTTPBody):
+        (WebCore::ResourceRequest::setStorageSession):
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::initNSURLResponse):
+        (WebCore::ResourceResponse::nsURLResponse):
+        (WebCore::ResourceResponse::platformLazyInit):
+        * platform/network/mac/UTIUtilities.mm:
+        (WebCore::mimeTypeFromUTITree):
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::adjustMIMETypeIfNecessary):
+        * platform/text/cf/HyphenationCF.cpp:
+        (WebCore::::createValueForNullKey):
+        (WebCore::lastHyphenLocation):
+        * platform/text/mac/HyphenationMac.mm:
+        (WebCore::::createValueForKey):
+        (WebCore::lastHyphenLocation):
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::determineLocale):
+        (WebCore::LocaleMac::LocaleMac):
+        (WebCore::LocaleMac::initializeLocaleData):
+        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
+        (WebCore::textBreakLocalePreference):
+        (WebCore::canonicalLanguageIdentifier):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::RenderThemeMac):
+        (WebCore::RenderThemeMac::levelIndicatorFor):
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeMac::paintSliderTrack):
+        (WebCore::RenderThemeMac::popupButton):
+        (WebCore::RenderThemeMac::search):
+        (WebCore::RenderThemeMac::searchMenuTemplate):
+        (WebCore::RenderThemeMac::sliderThumbHorizontal):
+        (WebCore::RenderThemeMac::sliderThumbVertical):
+        (WebCore::RenderThemeMac::textField):
+        Use adoptNS and adoptCF free functions.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaSession.cpp:
-        (WebCore::restrictionName): Log new WirelessVideoPlaybackDisabled restriction.
-        (WebCore::HTMLMediaSession::showingPlaybackTargetPickerPermitted): Return false if there
-            is no page, or if wireless playback is disabled.
-        (WebCore::HTMLMediaSession::currentPlaybackTargetIsWireless): New, logic from HTMLMediaElement.
-        (WebCore::HTMLMediaSession::showPlaybackTargetPicker): Ditto.
-        (WebCore::HTMLMediaSession::hasWirelessPlaybackTargets): Ditto.
-        (WebCore::HTMLMediaSession::wirelessVideoPlaybackDisabled): Ditto.
-        (WebCore::HTMLMediaSession::setWirelessVideoPlaybackDisabled): Ditto.
-        (WebCore::HTMLMediaSession::setHasPlaybackTargetAvailabilityListeners): Ditto.
-        (WebCore::HTMLMediaSession::applyMediaPlayerRestrictions): New, apply media player specific
-            restriction.
-        * html/HTMLMediaSession.h:
</del><ins>+2013-04-27  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Move &quot;playback target&quot; logic into HTMLMediaSession.
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::parseAttribute): Call media session.
-        (WebCore::HTMLVideoElement::webkitWirelessVideoPlaybackDisabled): Call media session.
</del><ins>+        Pressing mouse button inside a dragstart event causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=115296
</ins><span class="cx"> 
</span><del>-        * platform/audio/MediaSessionManager.h:
-        (WebCore::MediaSessionManager::showPlaybackTargetPicker): New method, does nothing in base class.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * platform/audio/ios/MediaSessionManagerIOS.h:
-        * platform/audio/ios/MediaSessionManagerIOS.mm:
-        (WebCore::MediaSessionManageriOS::showPlaybackTargetPicker): Add non-functional stub.
</del><ins>+        Add a missing null pointer check. We should better encapsulate the states in DragState in the long term
+        but this is good enough for now.
</ins><span class="cx"> 
</span><del>-        Implement wireless playback control and status API.
-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification): Dispatch TargetIsWirelessChanged.
-        (WebCore::MediaPlayerPrivateAVFoundation::playbackTargetIsWirelessChanged): Pass through to
-            media element.
-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
</del><ins>+        Test: fast/events/mousedown-inside-dragstart-should-not-cause-crash.html
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): Initialize
-            m_allowsWirelessVideoPlayback.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Remove &quot;externalPlaybackActive&quot; observer.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): Fix broken logging.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): Add &quot;externalPlaybackActive&quot; observer,
-            set initial wireless playback.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):  Fix broken logging.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::languageOfPrimaryAudioTrack): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::isCurrentPlaybackTargetWireless): New.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::wirelessVideoPlaybackDisabled): New.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::setWirelessVideoPlaybackDisabled): New.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::playbackTargetIsWirelessDidChange): New.
-        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]): Deal with 
-            externalPlaybackActive.
</del><ins>+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag):
</ins><span class="cx"> 
</span><del>-2014-02-24  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2013-04-27  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        [Win] Gracefully recover from missing 'naturalSize' parameter for media
-        https://bugs.webkit.org/show_bug.cgi?id=129278
</del><ins>+        Unreviewed build fix when disabling video and video-track.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Add declaration for
-        missing function call.
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundationCF::assetStatus): Don't treat missing 'naturalSize'
-        as a fatal error.
-        (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged): Handle case of asset track
-        not being available yet. 
-        (WebCore::MediaPlayerPrivateAVFoundationCF::sizeChanged): If the 'naturalSize' is empty,
-        use the Player Item's 'presentationSize' instead.
-        (WebCore::AVFWrapper::processNotification): Add missing handler for duration changed.
</del><ins>+2013-04-27  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-25  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        WebGL shouldn't allocate a &quot;length&quot; Identifier just to move some numbers around
+        https://bugs.webkit.org/show_bug.cgi?id=115317
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Add ENABLE flag
-        https://bugs.webkit.org/show_bug.cgi?id=129153
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Saw this while debugging an ammo.js bug.
</ins><span class="cx"> 
</span><del>-        Added ENABLE_CSS_GRID_LAYOUT feature flag.
</del><ins>+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore::setWebGLArrayWithTypedArrayArgument):
+        (WebCore::setWebGLArrayHelper):
+        (WebCore::constructArrayBufferViewWithTypedArrayArgument):
+        (WebCore::constructArrayBufferView):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toVector): Use the pre-computed &quot;length&quot; identifier instead of
+        allocating a new one for each vector operation. There are lots more
+        optimizations we could do here. This is a start.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::isLayoutDependent):
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * css/CSSGridTemplateAreasValue.cpp:
-        * css/CSSGridTemplateAreasValue.h:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParserContext::CSSParserContext):
-        (WebCore::operator==):
-        (WebCore::isValidKeywordPropertyAndValue):
-        (WebCore::isKeywordPropertyID):
-        (WebCore::CSSParser::parseValue):
-        * css/CSSParser.h:
-        * css/CSSParserMode.h:
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        * css/CSSPropertyNames.in:
-        * css/CSSValue.cpp:
-        (WebCore::CSSValue::equals):
-        (WebCore::CSSValue::cssText):
-        (WebCore::CSSValue::destroy):
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
-        * css/StyleProperties.cpp:
-        (WebCore::StyleProperties::getPropertyValue):
-        * css/StylePropertyShorthand.cpp:
-        (WebCore::shorthandForProperty):
-        (WebCore::matchingShorthandsForLonghand):
-        * css/StyleResolver.cpp:
-        (WebCore::equivalentBlockDisplay):
-        (WebCore::StyleResolver::adjustRenderStyle):
-        (WebCore::StyleResolver::applyProperty):
-        * css/StyleResolver.h:
-        * dom/Document.cpp:
-        * dom/Document.h:
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::createFor):
-        * rendering/RenderGrid.cpp:
-        * rendering/RenderGrid.h:
-        * rendering/style/GridCoordinate.h:
-        * rendering/style/GridLength.h:
-        * rendering/style/GridPosition.h:
-        * rendering/style/GridTrackSize.h:
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeRequiresLayout):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/RenderStyleConstants.h:
-        * rendering/style/StyleAllInOne.cpp:
-        * rendering/style/StyleGridData.cpp:
-        * rendering/style/StyleGridData.h:
-        * rendering/style/StyleGridItemData.cpp:
-        * rendering/style/StyleGridItemData.h:
-        * rendering/style/StyleRareNonInheritedData.cpp:
-        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
-        (WebCore::StyleRareNonInheritedData::operator==):
-        * rendering/style/StyleRareNonInheritedData.h:
</del><ins>+2013-04-27  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-25  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Remove two more StorageTask types
+        https://bugs.webkit.org/show_bug.cgi?id=115312
</ins><span class="cx"> 
</span><del>-        [EME][Mac] Fix a few issues in CDMSessionMediaSourceAVFObjC.
-        https://bugs.webkit.org/show_bug.cgi?id=129310
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        * storage/StorageTask.cpp:
+        (WebCore::StorageTask::performTask):
+        * storage/StorageTask.h:
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::deleteOrigin):
+        * storage/StorageTracker.h:
</ins><span class="cx"> 
</span><del>-        Only send a 'keyerror' event if an actual error code was returned, not just
-        when no key was added:
-        * Modules/encryptedmedia/MediaKeySession.cpp:
-        (WebCore::MediaKeySession::addKeyTimerFired):
</del><ins>+2013-04-27  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The 'length' parameter to a typed ArrayBufferView is the number of entries
-        in the array, not the byte length:
-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
-        (WebCore::CDMSessionMediaSourceAVFObjC::generateKeyRequest):
</del><ins>+        Get rid of more uses of StorageTask
+        https://bugs.webkit.org/show_bug.cgi?id=115311
</ins><span class="cx"> 
</span><del>-        The return value of streamingContentKeyRequestDataForApp:contentIdentifier:trackId:options:error
-        is autoreleased; do not wrap it in an adoptNS:
-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
-        (WebCore::CDMSessionMediaSourceAVFObjC::update):
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-02-25  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+        Make StorageAreaSync derive from ThreadSafeRefCounted as well, since it's passed between threads.
</ins><span class="cx"> 
</span><del>-        [MediaStream] Adding mock implementation of UserMediaClient
-        https://bugs.webkit.org/show_bug.cgi?id=129274
</del><ins>+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        (WebCore::StorageSyncManager::scheduleDeleteEmptyDatabase):
+        * storage/StorageTask.cpp:
+        (WebCore::StorageTask::StorageTask):
+        (WebCore::StorageTask::performTask):
+        * storage/StorageTask.h:
+        (StorageTask):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-04-27  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mock/UserMediaClientMock.h: Added.
-        (WebCore::UserMediaClientRequestNotifier::UserMediaClientRequestNotifier):
-        * testing/Internals.cpp:
-        (WebCore::Internals::Internals):
</del><ins>+        Indent StorageAreaSync to match the style guidelines.
</ins><span class="cx"> 
</span><del>-2014-02-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Rubber-stamped by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Tighten bitfields in live NodeLists and HTMLCollections
-        https://bugs.webkit.org/show_bug.cgi?id=129300
</del><ins>+        * storage/StorageAreaSync.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2013-04-27  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reduce the number of bits used for m_rootType and m_type in LiveNodeList.
-        Also use enum class for LiveNodeList types. We keep &quot;Type&quot; suffix not to
-        confuse old-ish compilers.
</del><ins>+        Replace uses of StorageTask with StorageThread::dispatch and WTF::bind
+        https://bugs.webkit.org/show_bug.cgi?id=115309
</ins><span class="cx"> 
</span><del>-        * dom/ClassNodeList.cpp:
-        (WebCore::ClassNodeList::ClassNodeList):
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::getElementsByTagName):
-        (WebCore::ContainerNode::getElementsByName):
-        (WebCore::ContainerNode::getElementsByClassName):
-        (WebCore::ContainerNode::radioNodeList):
-        * dom/LiveNodeList.cpp:
-        (WebCore::LiveNodeList::collectionFirst):
-        (WebCore::LiveNodeList::collectionTraverseForward):
-        * dom/LiveNodeList.h:
-        (WebCore::LiveNodeList::LiveNodeList):
-        * dom/NameNodeList.cpp:
-        (WebCore::NameNodeList::NameNodeList):
-        * dom/NameNodeList.h:
-        (WebCore::NameNodeList::create):
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::namedNodeListKey):
-        * dom/TagNodeList.cpp:
-        (WebCore::HTMLTagNodeList::HTMLTagNodeList):
-        * dom/TagNodeList.h:
-        (WebCore::TagNodeList::create):
-        (WebCore::HTMLTagNodeList::create):
-        * html/HTMLCollection.h:
-        * html/LabelableElement.cpp:
-        (WebCore::LabelableElement::labels):
-        * html/LabelsNodeList.cpp:
-        (WebCore::LabelsNodeList::LabelsNodeList):
-        * html/LabelsNodeList.h:
-        * html/RadioNodeList.cpp:
-        (WebCore::RadioNodeList::RadioNodeList):
-        * html/RadioNodeList.h:
-        (WebCore::RadioNodeList::create):
-
-2014-02-24  Anders Carlsson  &lt;andersca@apple.com&gt;
-
-        Make it possible to set the visited link provider on a per page basis
-        https://bugs.webkit.org/show_bug.cgi?id=129288
-
</del><span class="cx">         Reviewed by Andreas Kling.
</span><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Export symbols needed by WebKit2.
</del><ins>+        * storage/StorageTask.cpp:
+        (WebCore::StorageTask::StorageTask):
+        (WebCore::StorageTask::performTask):
+        * storage/StorageTask.h:
+        * storage/StorageThread.cpp:
+        (WebCore::StorageThread::terminate):
+        (WebCore::StorageThread::releaseFastMallocFreeMemoryInAllThreads):
+        * storage/StorageThread.h:
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::importOriginIdentifiers):
+        (WebCore::StorageTracker::deleteAllOrigins):
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        Make VisitedLinkProvider a private header.
</del><ins>+2013-04-27  Anders Carlsson  &lt;andersca@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Take the visited link provider from the PageClients object.
</del><ins>+        Add StorageThread::dispatch
+        https://bugs.webkit.org/show_bug.cgi?id=115308
</ins><span class="cx"> 
</span><del>-        (WebCore::Page::visitedLinkProvider):
-        If the page has a visited link provider set, return it.
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * page/Page.h:
-        Add VisitedLinkProvider to Page and PageClients.
</del><ins>+        StorageThread::dispatch takes a Function&lt;void ()&gt; and runs it on the storage thread. This will be used to eventually get rid of StorageTask.
</ins><span class="cx"> 
</span><del>-2014-02-25  Morten Stenshorne  &lt;mstensho@opera.com&gt;
</del><ins>+        * storage/StorageTask.cpp:
+        (WebCore::StorageTask::StorageTask):
+        (WebCore::StorageTask::performTask):
+        * storage/StorageTask.h:
+        (WebCore::StorageTask::createDispatch):
+        * storage/StorageThread.cpp:
+        (WebCore::StorageThread::dispatch):
+        * storage/StorageThread.h:
+        (StorageThread):
</ins><span class="cx"> 
</span><del>-        [New Multicolumn] -webkit-column-break-inside:avoid doesn't work
-        https://bugs.webkit.org/show_bug.cgi?id=129299
</del><ins>+2013-04-27  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        REGRESSION (r147261): Audio controls background not displayed after loading audio file
+        https://bugs.webkit.org/show_bug.cgi?id=115221
</ins><span class="cx"> 
</span><del>-        adjustForUnsplittableChild() simply forgot to check whether we
-        were inside flow thread based multicol.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Test: fast/multicol/newmulticol/avoid-column-break-inside.html
</del><ins>+        As in r147261, set a flex-shrink: 0 to avoid shrinking the media controls panel
+        below the specified height.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::adjustForUnsplittableChild):
</del><ins>+        No new tests; fixes the media/media-document-audio-repaint.html test.
</ins><span class="cx"> 
</span><del>-2014-02-25  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+        * css/mediaControlsQuickTime.css:
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
</ins><span class="cx"> 
</span><del>-        [CSSRegions] Remove unused function RenderFlowThread::regionForCompositedLayer
-        https://bugs.webkit.org/show_bug.cgi?id=129303
</del><ins>+2013-04-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        Video playback has corruption on the edges of the video
+        https://bugs.webkit.org/show_bug.cgi?id=115216
</ins><span class="cx"> 
</span><del>-        Cleanup, no funtionality change, no new tests.
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.h:
</del><ins>+        Test: media/video-poster-background.html
</ins><span class="cx"> 
</span><del>-2014-02-25  Mihai Tica  &lt;mitica@adobe.com&gt;
</del><ins>+        RenderImage correctly answers foregroundIsKnownToBeOpaqueInRect() method
+        when a poster image is displayed, but once the video begins playing and
+        the poster image is no longer displayed, RenderImage will continue to
+        answer 'true' even when the video does not occupy the entire render box.
+        Override foregroundIsKnownToBeOpaqueInRect() in order to more correctly
+        answer the question for the video layer.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] -webkit-mix-blend-mode should force transform-style: flat.
-        https://bugs.webkit.org/show_bug.cgi?id=126158
</del><ins>+        * rendering/RenderImage.h: Make foregroundIsKnownToBeOpaqueInRect() protected
+            (vs. private).
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::foregroundIsKnownToBeOpaqueInRect): Added. Return
+            true if the rect parameter is entirely contained by the video box.
+        * rendering/RenderVideo.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+2013-04-26  Hans Muller  &lt;hmuller@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        As stated in the http://www.w3.org/TR/css3-transforms/#propdef-transform-style, an element with blending
-        should force transform-style: flat.
</del><ins>+        [CSS Exclusions] ExclusionShape bounding box methods should return LayoutRects
+        https://bugs.webkit.org/show_bug.cgi?id=115117
</ins><span class="cx"> 
</span><del>-        Test: css3/compositing/blend-mode-transform-style.html
</del><ins>+        Reviewed by Dirk Schulze.
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::adjustRenderStyle): If blending is detected, set transform-style to flat.
</del><ins>+        Redefined the ExclusionShape API in terms of LayoutUnits, instead of floats: all of the
+        ExclusionShape methods now have LayoutUnit parameters and return LayoutUnit values.
+        This is more natural, since the callers work exclusively in LayoutUnits.
</ins><span class="cx"> 
</span><del>-2014-02-25  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+        This is strictly a refactoring, no new tests were needed.
</ins><span class="cx"> 
</span><del>-        Move to using std::unique_ptr for Element, Node and related classes
-        https://bugs.webkit.org/show_bug.cgi?id=129058
</del><ins>+        * rendering/ExclusionPolygon.cpp:
+        (WebCore::ExclusionPolygon::getExcludedIntervals):
+        (WebCore::ExclusionPolygon::getIncludedIntervals):
+        (WebCore::ExclusionPolygon::firstIncludedIntervalLogicalTop):
+        * rendering/ExclusionPolygon.h:
+        * rendering/ExclusionRectangle.cpp:
+        (WebCore::ExclusionRectangle::getExcludedIntervals):
+        (WebCore::ExclusionRectangle::getIncludedIntervals):
+        (WebCore::ExclusionRectangle::firstIncludedIntervalLogicalTop):
+        * rendering/ExclusionRectangle.h:
+        * rendering/ExclusionShape.cpp:
+        (WebCore::ExclusionShape::createExclusionShape):
+        * rendering/ExclusionShape.h:
+        (LineSegment):
+        (ExclusionShape):
+        * rendering/ExclusionShapeInfo.cpp:
+        (WebCore):
+        (WebCore::::computedShape):
+        * rendering/ExclusionShapeInfo.h:
+        (WebCore):
+        (WebCore::ExclusionShapeInfo::shapeLogicalTop):
+        (WebCore::ExclusionShapeInfo::shapeLogicalBottom):
+        (ExclusionShapeInfo):
+        * rendering/ExclusionShapeInsideInfo.cpp:
+        (WebCore::ExclusionShapeInsideInfo::adjustLogicalLineTop):
+        * rendering/ExclusionShapeInsideInfo.h:
+        * rendering/ExclusionShapeOutsideInfo.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+2013-04-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace uses of OwnPtr and PassOwnPtr in Element, Node and the related
-        classes with std::unique_ptr and move semantics.
</del><ins>+        Nil-check the results of -[AVPlayerItemVideoOutput copyPixelBufferForItemTime:itemTimeForDisplay:].
+        https://bugs.webkit.org/show_bug.cgi?id=115265
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.h:
-        (WebCore::ChildNodesLazySnapshot::takeSnapshot):
-        (WebCore::ChildNodesLazySnapshot::hasSnapshot):
-        * dom/Element.cpp:
-        (WebCore::ensureAttrNodeListForElement):
-        (WebCore::Element::attributes):
-        * dom/ElementIteratorAssertions.h:
-        (WebCore::ElementIteratorAssertions::ElementIteratorAssertions):
-        * dom/ElementRareData.h:
-        (WebCore::ElementRareData::setAttributeMap):
-        * dom/MutationObserverRegistration.cpp:
-        (WebCore::MutationObserverRegistration::observedSubtreeNodeWillDetach):
-        (WebCore::MutationObserverRegistration::clearTransientRegistrations):
-        (WebCore::MutationObserverRegistration::addRegistrationNodesToSet):
-        * dom/MutationObserverRegistration.h:
-        * dom/NamedNodeMap.h:
-        (WebCore::NamedNodeMap::NamedNodeMap):
-        * dom/Node.cpp:
-        (WebCore::Node::ensureRareData):
-        (WebCore::Node::didMoveToNewDocument):
-        (WebCore::Node::ensureEventTargetData):
-        (WebCore::Node::mutationObserverRegistry):
-        (WebCore::Node::registerMutationObserver):
-        (WebCore::Node::unregisterMutationObserver):
-        (WebCore::Node::notifyMutationObserversNodeWillDetach):
-        * dom/Node.h:
-        * dom/NodeRareData.h:
-        (WebCore::NodeListsNodeData::NodeListsNodeData):
-        (WebCore::NodeRareData::NodeRareData):
-        (WebCore::NodeRareData::clearNodeLists):
-        (WebCore::NodeRareData::ensureNodeLists):
-        (WebCore::NodeRareData::ensureMutationObserverData):
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::rebuildPresentationAttributeStyle):
</del><ins>+        Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-02-25  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        copyPixelBufferForItemTime:itemTimeForDisplay: can return nil, even
+        when hasNewPixelBufferForItemTime: returns YES. Check the results
+        before passing the buffer on to VTPixelTransferSessionTransferImage()
+        which does not NULL-check its parameters.
</ins><span class="cx"> 
</span><del>-        Prune dead code for Web Inspector memory instrumentation.
-        &lt;https://webkit.org/b/129286&gt;
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
</ins><span class="cx"> 
</span><del>-        This was leftover code from Chromium's inspector. It's not used by
-        today's WebKit inspector.
</del><ins>+2013-04-26  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Uninflate caret rect.
+        http://bugs.webkit.org/show_bug.cgi?id=114997.
+        &lt;rdar://problem/12629007&gt;.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * inspector/InspectorAllInOne.cpp:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        * inspector/InspectorController.h:
-        * inspector/InspectorMemoryAgent.cpp: Removed.
-        * inspector/InspectorMemoryAgent.h: Removed.
-        * inspector/InspectorTimelineAgent.cpp:
-        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
-        * inspector/InspectorTimelineAgent.h:
-        * inspector/WorkerInspectorController.cpp:
-        (WebCore::WorkerInspectorController::WorkerInspectorController):
-        * inspector/protocol/Memory.json: Removed.
</del><ins>+        Reviewed by Timothy Horton.
</ins><span class="cx"> 
</span><del>-2014-02-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Inflation was causing painting errors with focus rings.
+        It is no longer needed after disabling subpixel layout.
</ins><span class="cx"> 
</span><del>-        AX: Support abbr, acronym
-        https://bugs.webkit.org/show_bug.cgi?id=128860
</del><ins>+        * editing/FrameSelection.cpp:
+        (WebCore::repaintCaretForLocalRect):
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+2013-04-26  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Expose the data in &lt;abbr&gt;, &lt;acronym&gt; and &lt;th abbr=&quot;&quot;&gt; as an 
-        alternateTextValue() parameter.
</del><ins>+        Unreviewed build fix.
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/accessibility/abbr-acronym-tags.html
</del><ins>+        * platform/LayoutUnit.h:
+        (WebCore::LayoutUnit::LayoutUnit):
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::hasTagName):
-        * accessibility/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::alternateTextValue):
-        (WebCore::AccessibilityObject::supportsAlternateTextValue):
-        * accessibility/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::alternateTextValue):
-        (WebCore::AccessibilityRenderObject::supportsAlternateTextValue):
-        * accessibility/AccessibilityRenderObject.h:
-        * accessibility/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::alternateTextValue):
-        (WebCore::AccessibilityTableCell::supportsAlternateTextValue):
-        * accessibility/AccessibilityTableCell.h:
-        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
-        (AXAttributeStringSetAlternateTextValue):
-        (AXAttributedStringAppendText):
-        (-[WebAccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
-        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
</del><ins>+2013-04-26  Michael Saboff  &lt;msaboff@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-24  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</del><ins>+        WebCore ObjC bridge is missing support for bool type
+        https://bugs.webkit.org/show_bug.cgi?id=115276
</ins><span class="cx"> 
</span><del>-        [GTK] generate-gtkdoc should not generate documentation for source files for unbuilt source files
-        https://bugs.webkit.org/show_bug.cgi?id=128417
-
-        Reviewed by Carlos Garcia Campos.
-
-        * bindings/gobject/GNUmakefile.am: Generate a config file for webkitdom documentation generation.
-
-2014-02-24  Mark Lam  &lt;mark.lam@apple.com&gt;
-
-        Need to initialize VM stack data even when the VM is on an exclusive thread.
-        &lt;https://webkit.org/b/129265&gt;
-
</del><span class="cx">         Reviewed by Geoffrey Garen.
</span><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        Added code to handle conversion between ObjC and JS booleans.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        - Added an assertion to ensure that we are holding the JSLock.
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::commonVM):
-        - Updated to use the new VM::setExclusiveThread().
</del><ins>+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeObjcMethod):
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertObjcValueToValue):
+        (JSC::Bindings::objcValueTypeForType):
</ins><span class="cx"> 
</span><del>-2014-02-24  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+2013-04-26  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add a DefaultVisitedLinkProvider and route visited link actions through it
-        https://bugs.webkit.org/show_bug.cgi?id=129285
</del><ins>+        Make Apple Windows VS2010 build results into and get dependencies from __32 suffixed folders.
+        Make the DebugSuffix configuration use _debug dependencies.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
-
-        DefaultVisitedLinkProvider currently just forwards everything to the visited link strategy,
-        but will soon take over the responsibilities of visited link handling from PageGroup.
-        
-        * CMakeLists.txt:
-        * GNUmakefile.list.am:
</del><ins>+        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinCairoDebug.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinCairoRelease.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinCommon.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinDebug.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinPostBuild.cmd:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinProduction.props:
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinRelease.props:
+        * WebCore.vcxproj/WebCore.make:
</ins><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj:
</span><span class="cx">         * WebCore.vcxproj/WebCore.vcxproj.filters:
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/VisitedLinkState.cpp:
-        (WebCore::VisitedLinkState::determineLinkStateSlowCase):
-        * loader/HistoryController.cpp:
-        (WebCore::addVisitedLink):
-        (WebCore::HistoryController::updateForStandardLoad):
-        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
-        (WebCore::HistoryController::updateForClientRedirect):
-        (WebCore::HistoryController::updateForSameDocumentNavigation):
-        (WebCore::HistoryController::pushState):
-        (WebCore::HistoryController::replaceState):
-        * page/DefaultVisitedLinkProvider.cpp: Copied from Source/WebCore/page/VisitedLinkProvider.h.
-        (WebCore::DefaultVisitedLinkProvider::create):
-        (WebCore::DefaultVisitedLinkProvider::DefaultVisitedLinkProvider):
-        (WebCore::DefaultVisitedLinkProvider::~DefaultVisitedLinkProvider):
-        (WebCore::DefaultVisitedLinkProvider::isLinkVisited):
-        (WebCore::DefaultVisitedLinkProvider::addVisitedLink):
-        * page/DefaultVisitedLinkProvider.h: Copied from Source/WebCore/page/VisitedLinkProvider.h.
-        * page/Page.cpp:
-        (WebCore::Page::visitedLinkProvider):
-        * page/Page.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::PageGroup):
-        (WebCore::PageGroup::visitedLinkProvider):
-        * page/PageGroup.h:
-        * page/VisitedLinkProvider.h:
</del><ins>+        * WebCore.vcxproj/WebCoreCommon.props:
+        * WebCore.vcxproj/WebCoreDebug.props:
+        * WebCore.vcxproj/WebCoreDebugWinCairo.props:
+        * WebCore.vcxproj/WebCoreGenerated.make:
+        * WebCore.vcxproj/WebCoreGenerated.vcxproj:
+        * WebCore.vcxproj/WebCoreGeneratedCommon.props:
+        * WebCore.vcxproj/WebCoreGeneratedDebug.props:
+        * WebCore.vcxproj/WebCoreGeneratedDebugWinCairo.props:
+        * WebCore.vcxproj/WebCoreGeneratedProduction.props:
+        * WebCore.vcxproj/WebCoreGeneratedRelease.props:
+        * WebCore.vcxproj/WebCoreGeneratedReleaseWinCairo.props:
+        * WebCore.vcxproj/WebCoreProduction.props:
+        * WebCore.vcxproj/WebCoreRelease.props:
+        * WebCore.vcxproj/WebCoreReleaseWinCairo.props:
+        * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
+        * WebCore.vcxproj/build-generated-files.sh:
+        * WebCore.vcxproj/copyForwardingHeaders.cmd:
+        * WebCore.vcxproj/copyWebCoreResourceFiles.cmd:
</ins><span class="cx"> 
</span><del>-2014-02-24  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+2013-04-26  Roger Fong  &lt;roger_fong@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        WK2 AVKit fullscreen doesn't display video.
-        https://bugs.webkit.org/show_bug.cgi?id=128564
</del><ins>+        Disable sub-pixel layout on mac.
+        https://bugs.webkit.org/show_bug.cgi?id=114999.
</ins><span class="cx"> 
</span><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Export WebCore::PlatformCALayer::platformCALayer()
</del><ins>+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.exp.in: 
+        Export symbol needed to be added for IntRect(const LayoutRect&amp;) constructor, 
+        which is now being used in pixelSnappedIntRect(const LayoutRect&amp;) in LayoutRect.h after disabling sub-pixel layout.
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterface.h:
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
-        Remove SetVideoLayerID(). 
</del><ins>+2013-04-26  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (WebVideoFullscreenInterfaceAVKit::setVideoLayer):
-        Wrap make video layer look like an AVAVPlayerLayer with WebAVPlayerLayer
</del><ins>+        Layer-backed WebViews don't repaint content outside the visible area
+        https://bugs.webkit.org/show_bug.cgi?id=115275
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::setMediaElement):
-        Pass along the videoLayer before borrowing it so the interface will be ready to
-        catch the transaction that removes it.
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-2014-02-24  Samuel White  &lt;samuel_white@apple.com&gt;
</del><ins>+        Export ScrollView::setPaintsEntireContents(bool).
</ins><span class="cx"> 
</span><del>-        AX: AccessibilityObject::findMatchingObjects should never include 'this' in results.
-        https://bugs.webkit.org/show_bug.cgi?id=129243
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+2013-04-26  Daker Fernandes Pinheiro  &lt;daker.pinheiro@openbossa.org&gt;
</ins><span class="cx"> 
</span><del>-        Fix removes the container object from the search results when searching backwards. This
-        makes backwards &amp; forwards search results consistent with each other.
</del><ins>+        Change RenderMeter::valueRatio() visibility to public
+        https://bugs.webkit.org/show_bug.cgi?id=115266
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/accessibility/search-predicate-container-not-included.html
</del><ins>+        This function is currently unused.
+        However, it is necessary to implement a RenderTheme capable of rendering Meter elements.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::findMatchingObjects):
</del><ins>+        Reviewed by Alexis Menard.
</ins><span class="cx"> 
</span><del>-2014-02-24  Samuel White  &lt;samuel_white@apple.com&gt;
</del><ins>+        No new tests, because no behaviour is changed.
</ins><span class="cx"> 
</span><del>-        AX: findMatchingObjects backwards start position inconsistent with forwards start position when startObject == nullptr.
-        https://bugs.webkit.org/show_bug.cgi?id=129266
</del><ins>+        * rendering/RenderMeter.h:
+        (RenderMeter):
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+2013-04-26  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When searching forward with no start object, the first thing considered is the first child of
-        the container. However, when searching backwards with no start object nothing in the container
-        is considered; this basically negates the search. This patch makes backwards searching without
-        a start object start from the last child of the container to match forward search expectations.
</del><ins>+        Add Runtime.parse to the Inspector protocol.
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/accessibility/search-predicate-start-not-specified.html
</del><ins>+        This will be used to parse console expressions for errors
+        before evaluating them fully.
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::findMatchingObjects):
</del><ins>+        https://webkit.org/b/115242
</ins><span class="cx"> 
</span><del>-2014-02-24  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+        Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        Prune dead code for Web Inspector canvas instrumentation.
-        &lt;https://webkit.org/b/129269&gt;
</del><ins>+        * ForwardingHeaders/parser/ParserError.h: Added.
+        * inspector/Inspector.json:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::parse):
+        * inspector/InspectorRuntimeAgent.h:
+        (InspectorRuntimeAgent):
</ins><span class="cx"> 
</span><del>-        This was leftover code from Chromium's inspector. It's not used by
-        today's WebKit inspector.
</del><ins>+2013-04-26  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Fix the copyright years after r149057
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSHTMLCanvasElementCustom.cpp:
-        (WebCore::JSHTMLCanvasElement::getContext):
-        * inspector/InjectedScriptCanvasModule.cpp: Removed.
-        * inspector/InjectedScriptCanvasModule.h: Removed.
-        * inspector/InspectorAllInOne.cpp:
-        * inspector/InspectorCanvasAgent.cpp: Removed.
-        * inspector/InspectorCanvasAgent.h: Removed.
-        * inspector/InspectorCanvasInstrumentation.h: Removed.
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::didBeginFrame):
-        * inspector/InspectorInstrumentation.cpp:
-        (WebCore::InspectorInstrumentation::frameDetachedFromParentImpl):
-        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
-        * inspector/InspectorInstrumentation.h:
-        * inspector/InstrumentingAgents.cpp:
-        (WebCore::InstrumentingAgents::InstrumentingAgents):
-        (WebCore::InstrumentingAgents::reset):
-        * inspector/InstrumentingAgents.h:
</del><ins>+        * page/DiagnosticLoggingKeys.cpp: I accidentally removed a year from
+        the copyright in r149057.
</ins><span class="cx"> 
</span><del>-2014-02-24  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+2013-04-26  Konrad Piascik  &lt;kpiascik@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] Adjust lineTop position to the next available wrapping location at shape-outsides
-        https://bugs.webkit.org/show_bug.cgi?id=128693
</del><ins>+        Web Inspector: Crash due to null items from getDOMStorageItems
+        https://bugs.webkit.org/show_bug.cgi?id=115176
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-        When we don't have space next to the floating container, but we have space inside the floating-container next
-        to the defined shape-outside, we should wrap around the shape-outside. This patch fixes the behavior both for
-        cases when there is no space to fit at the first line, and for the additional lines cases.
</del><ins>+        findStorageArea was returning a null storageArea causing the items
+        input paramater to not be set.  This was happening without any error
+        being set at all.  Set an error to prevent a crash when we try to
+        convert the result to a JSON string.
</ins><span class="cx"> 
</span><del>-        Test: fast/shapes/shape-outside-floats/shape-outside-floats-linetop-adjustment.html
</del><ins>+        Added tests to check if session and local storage are empty that
+        they are still functional.
</ins><span class="cx"> 
</span><del>-        * rendering/line/BreakingContextInlineHeaders.h:
-        (WebCore::BreakingContext::handleText):
-        (WebCore::BreakingContext::commitAndUpdateLineBreakIfNeeded):
-        * rendering/line/LineWidth.cpp:
-        (WebCore::availableWidthAtOffset):
-        (WebCore::LineWidth::updateLineDimension): Added new helper.
-        (WebCore::isWholeLineFit): Added new helper.
-        (WebCore::LineWidth::wrapNextToShapeOutside): Added new helper.
-        (WebCore::LineWidth::fitBelowFloats): Add optional parameter for the function.
-        * rendering/line/LineWidth.h:
</del><ins>+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::getDOMStorageItems):
</ins><span class="cx"> 
</span><del>-2014-02-24  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+2013-04-26  Martin Robinson  &lt;mrobinson@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Create SessionID value-style class for session IDs.
-        https://bugs.webkit.org/show_bug.cgi?id=129141
</del><ins>+        Remove the remaining Skia #ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=114886
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        * GNUmakefile.list.am:
-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/Page.cpp: Add SessionID member.
-        (WebCore::Page::Page):
-        (WebCore::Page::sessionID): Retrieve sessionID or use settings if not set.
-        * page/Page.h:
-        (WebCore::Page::setSessionID):
-        * page/SessionID.h: Session ID class consisting solely of its uint64_t session ID.
-        (WebCore::SessionID::SessionID):
-        (WebCore::SessionID::isValid): Not empty.
-        (WebCore::SessionID::isEphemeral):
-        (WebCore::SessionID::sessionID):
-        (WebCore::SessionID::operator==): Value-based equality.
-        (WebCore::SessionID::operator!=):
-        (WebCore::SessionID::emptySessionID): Zero value also used for HashTraits emptyValue.
-        (WebCore::SessionID::defaultSessionID):
-        (WebCore::SessionID::legacyPrivateSessionID):
-        * page/SessionIDHash.h:
-        (WTF::SessionIDHash::hash): Just the casted session ID (low order bytes)
-        (WTF::SessionIDHash::equal):
-        (WTF::HashTraits&lt;WebCore::SessionID&gt;::emptyValue): Equal to emptySessionID.
-        (WTF::HashTraits&lt;WebCore::SessionID&gt;::constructDeletedValue): -1 value.
-        (WTF::HashTraits&lt;WebCore::SessionID&gt;::isDeletedValue):
</del><ins>+        * html/HTMLCanvasElement.cpp: Remove Skia #ifdef references.
+        * platform/graphics/BitmapImage.cpp: Ditto.
+        * platform/graphics/FloatPoint.h: Ditto.
+        * platform/graphics/FloatRect.h: Ditto.
+        * platform/graphics/FontCache.h: Ditto.
+        * platform/graphics/Gradient.cpp: Ditto.
+        * platform/graphics/Gradient.h: Ditto.
+        * platform/graphics/GraphicsContext.cpp: Ditto.
+        * platform/graphics/GraphicsContext.h: Ditto.
+        * platform/graphics/GraphicsContext3D.h: Ditto.
+        * platform/graphics/ImageBuffer.cpp: Ditto.
+        * platform/graphics/ImageBuffer.h: Ditto.
+        * platform/graphics/ImageBufferData.h: Ditto.
+        * platform/graphics/IntPoint.h: Ditto.
+        * platform/graphics/IntRect.h: Ditto.
+        * platform/graphics/NativeImagePtr.h: Ditto.
+        * platform/graphics/Path.h: Ditto.
+        * platform/graphics/Pattern.cpp: Ditto.
+        * platform/graphics/Pattern.h: Ditto.
+        * platform/graphics/filters/FEBlend.h: Ditto.
+        * platform/graphics/filters/FEColorMatrix.h: Ditto.
+        * platform/graphics/filters/FEComponentTransfer.h: Ditto.
+        * platform/graphics/filters/FEComposite.h: Ditto.
+        * platform/graphics/filters/FEConvolveMatrix.h: Ditto.
+        * platform/graphics/filters/FEDisplacementMap.h: Ditto.
+        * platform/graphics/filters/FEGaussianBlur.h: Ditto.
+        * platform/graphics/filters/FELighting.h: Ditto.
+        * platform/graphics/filters/FEMorphology.h: Ditto.
+        * platform/graphics/filters/FEOffset.h: Ditto.
+        * platform/graphics/filters/FilterEffect.cpp: Ditto.
+        * platform/graphics/filters/FilterEffect.h: Ditto.
+        * platform/graphics/transforms/AffineTransform.h: Ditto.
+        * platform/graphics/transforms/TransformationMatrix.h: Ditto.
+        * platform/image-decoders/ImageDecoder.cpp: Ditto.
+        * platform/image-decoders/ImageDecoder.h: Ditto.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Ditto.
+        * platform/image-decoders/webp/WEBPImageDecoder.cpp: Ditto.
+        * platform/mac/LocalCurrentGraphicsContext.h: Ditto.
+        * platform/mac/LocalCurrentGraphicsContext.mm: Ditto.
+        * rendering/svg/RenderSVGResourceSolidColor.cpp: Ditto.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        * svg/graphics/SVGImage.h: Ditto.
</ins><span class="cx"> 
</span><del>-2014-02-24  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
</del><ins>+2013-04-26  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] handle undefined RemainingSpace in computeUsedBreadthOfGridTracks algorithm
-        https://bugs.webkit.org/show_bug.cgi?id=128372
</del><ins>+        Assert in JSC::Heap::unprotect when closing facebook.com web site
+        https://bugs.webkit.org/show_bug.cgi?id=115058
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        From Blink r165692 by &lt;svillar@igalia.com&gt;
</del><ins>+        Grab a JSLock before calling RootObject::invalidate().
</ins><span class="cx"> 
</span><del>-        The spec defines a different code path for the computeUsedBreadthOfGridTracks algorithm
-        http://dev.w3.org/csswg/css-grid/#function-ComputeUsedBreadthOfGridTracks.
</del><ins>+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
</ins><span class="cx"> 
</span><del>-        Basically the track breadth is different when the available size is undefined and thus,
-        cannot be taken into account during the computations.
-        The available size is undefined whenever the height is auto or the grid element has a
-        shrink-to-fit behavior.
</del><ins>+2013-04-26  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        It was also renamed the function to match the specs so the function name starts with
-        'compute' instead of 'computed'.
</del><ins>+        [Mac] in-band cues sometimes have incorrect duration
+        https://bugs.webkit.org/show_bug.cgi?id=115200
</ins><span class="cx"> 
</span><del>-        No new tests, but added new cases to some of them.
-
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::computeIntrinsicLogicalWidths):
-        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
-        (WebCore::gridElementIsShrinkToFit):
-        (WebCore::RenderGrid::computeNormalizedFractionBreadth):
-        (WebCore::RenderGrid::layoutGridItems):
-        * rendering/RenderGrid.h:
-
-2014-02-24  Roger Fong  &lt;roger_fong@apple.com&gt;
-
-        [Windows] Unreviewed pre-emptive build fix.
-
-        * WebCore.vcxproj/WebCoreCommon.props: Add replay directory to include path.
-
-2014-02-24  Brady Eidson  &lt;beidson@apple.com&gt;
-
-        Break out ImageControls style into an external stylesheet
-        https://bugs.webkit.org/show_bug.cgi?id=129273
-
</del><span class="cx">         Reviewed by Jer Noble.
</span><span class="cx"> 
</span><del>-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        No new tests, this is not possible to test in DRT.
</ins><span class="cx"> 
</span><del>-        * css/CSSDefaultStyleSheets.cpp:
-        (WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement):
-        * css/CSSDefaultStyleSheets.h:
</del><ins>+        * html/track/InbandTextTrack.cpp:
+        (WebCore::InbandTextTrack::addGenericCue): Don't add completed cues to the map.
+        (WebCore::InbandTextTrack::removeGenericCue): Log when a cue is removed from the track.
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/ImageControlsRootElementMac.cpp:
-        (WebCore::ImageControlsRootElementMac::maybeCreate):
</del><ins>+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
+        (WebCore::InbandTextTrackPrivateAVF::InbandTextTrackPrivateAVF): Initialize m_pendingCueStatus.
+        (WebCore::InbandTextTrackPrivateAVF::processCue): Never call update() on a cue that is delivered
+            while seeking.
+        (WebCore::InbandTextTrackPrivateAVF::beginSeeking): Flush all incomplete cues, remember that 
+            we are seeking.
+        (WebCore::InbandTextTrackPrivateAVF::resetCueValues): 
+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h:
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/imageControlsMac.css:
-        (.x-webkit-imagemenu):
-        (.x-webkit-imagemenu:hover):
</del><ins>+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::seek): Call track-&gt;beginSeeking() instead of resetCueValues().
+        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted): Call track-&gt;endSeeking().
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::mediaControlsScript):
-        (WebCore::RenderTheme::imageControlsStyleSheet):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::imageControlsStyleSheet):
</del><ins>+        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.mm:
+        (WebCore::InbandTextTrackPrivateAVFObjC::kind): Include class name in Kind enum values to 
+            avoid compile error.
</ins><span class="cx"> 
</span><del>-2014-02-24  Thiago de Barros Lacerda  &lt;thiago.lacerda@openbossa.org&gt;
</del><ins>+2013-04-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [WebRTC] Validating RTCConfiguration according to the spec
-        https://bugs.webkit.org/show_bug.cgi?id=129182
</del><ins>+        Remove wxWebKit from WebCore.
+        &lt;http://webkit.org/b/115255&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Spec states that:
-            - iceServers should not be an empty list
-            - the entry in the configuration dictionary is &quot;urls&quot;, instead of &quot;url&quot;
-            - urls can be either a list or a string
-        Fixing all that in RTCConfiguration validation when creating a RTCPeerConnection
</del><ins>+        * DerivedSources.make:
+        * WebCorePrefix.h:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::port):
+        * config.h:
+        * html/HTMLFormElement.cpp:
+        * platform/ContextMenu.h:
+        (ContextMenu):
+        * platform/ContextMenuItem.h:
+        * platform/Cursor.h:
+        * platform/DragData.h:
+        * platform/DragImage.h:
+        * platform/FileSystem.h:
+        * platform/PlatformExportMacros.h:
+        * platform/PlatformKeyboardEvent.h:
+        (PlatformKeyboardEvent):
+        * platform/PlatformMenuDescription.h:
+        * platform/PlatformMouseEvent.h:
+        (PlatformMouseEvent):
+        * platform/PlatformWheelEvent.h:
+        (PlatformWheelEvent):
+        * platform/ScrollView.cpp:
+        * platform/ScrollView.h:
+        (ScrollView):
+        * platform/Widget.h:
+        * platform/win/SharedTimerWin.cpp:
</ins><span class="cx"> 
</span><del>-        Existing tests were updated.
</del><ins>+2013-04-26  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/RTCPeerConnection.cpp:
-        (WebCore::appendIceServer): Added.
-        (WebCore::processIceServer): Added.
-        (WebCore::RTCPeerConnection::parseConfiguration):
</del><ins>+        use-after-free removing a frame from its parent in a beforeload event of an OBJECT element
+        https://bugs.webkit.org/show_bug.cgi?id=113964
</ins><span class="cx"> 
</span><del>-2014-02-24  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Object elements have the tendecny to modify or even fully remove 
+        the containing Document inside beforeload callback. While Document is removed, 
+        RenderArena gets destroyed. Retained RenderWidgets fails to function with NULL arena.
+        
+        Protect RendereArena from getting wiped out, when Document is removed 
+        during FrameView::updateWidget(). 
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Relative positioned elements overflowing the region do not get painted into the next tile
-        https://bugs.webkit.org/show_bug.cgi?id=129254
-
</del><span class="cx">         Reviewed by Antti Koivisto.
</span><span class="cx"> 
</span><del>-        The painting of the region's layer should not be aborted so early if the region's fragment shouldn't be painted
-        because that would prevent all the layer's children from being painted.
</del><ins>+        Test: fast/frames/crash-remove-iframe-during-object-beforeload.html
</ins><span class="cx"> 
</span><del>-        Another problem this patch addresses is that clipping should also be performed when the clip rect is empty,
-        which is what happens when painting in a tile in which the flowed element would normally be painted
-        if it wasn't clipped by the region.
-
-        Test: fast/regions/content-relative-next-tile.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintFlowThreadIfRegionForFragments):
-
-2014-02-24  Renata Hodovan  &lt;rhodovan.u-szeged@partner.samsung.com&gt;
-        
-        Get rid of the unused 'immediate' parameters from repaint related functions
-        https://bugs.webkit.org/show_bug.cgi?id=129111
-
-        Reviewed by Simon Fraser.
-
-        Removing the 'immediate' parameters from repaint related functions - accoring
-        to the FIXME in RenderView::repaintViewRectangle() - since they have no effect.
-
-        No new tests are necessary because there is no behavior change
-
-        * dom/Element.cpp:
-        (WebCore::Element::setActive):
-        * loader/EmptyClients.h:
-        * page/Chrome.cpp:
-        (WebCore::Chrome::invalidateRootView):
-        (WebCore::Chrome::invalidateContentsAndRootView):
-        (WebCore::Chrome::invalidateContentsForSlowScroll):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/Frame.cpp:
-        (WebCore::Frame::tiledBackingStorePaintEnd):
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        * dom/Document.h:
+        (Document):
</ins><span class="cx">         * page/FrameView.cpp:
</span><del>-        (WebCore::FrameView::invalidateRect):
-        (WebCore::FrameView::scrollContentsFastPath):
-        (WebCore::FrameView::repaintContentRectangle):
-        (WebCore::FrameView::shouldUpdate):
-        * page/FrameView.h:
-        * platform/HostWindow.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollContents):
-        (WebCore::ScrollView::scrollContentsSlowPath):
-        (WebCore::ScrollView::repaintContentRectangle):
-        (WebCore::ScrollView::updateOverhangAreas):
-        (WebCore::ScrollView::addPanScrollIcon):
-        (WebCore::ScrollView::removePanScrollIcon):
-        (WebCore::ScrollView::platformRepaintContentRectangle):
-        * platform/ScrollView.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::repaintLayerRectsForImage):
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::repaintRectangleInRegions):
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::setFilterBackendNeedsRepaintingInRect):
-        * rendering/RenderLayer.h:
-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::repaintFlowThreadContent):
-        * rendering/RenderMultiColumnSet.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::repaintUsingContainer):
-        (WebCore::RenderObject::repaint):
-        (WebCore::RenderObject::repaintRectangle):
-        (WebCore::RenderObject::repaintSlowRepaintObject):
-        * rendering/RenderObject.h:
-        * rendering/RenderRegion.cpp:
-        (WebCore::RenderRegion::repaintFlowThreadContent):
-        (WebCore::RenderRegion::repaintFlowThreadContentRectangle):
-        * rendering/RenderRegion.h:
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::repaintViewRectangle):
-        (WebCore::RenderView::flushAccumulatedRepaintRegion):
-        (WebCore::RenderView::repaintRectangleInViewAndCompositedLayers):
-        * rendering/RenderView.h:
-        * svg/graphics/SVGImageChromeClient.h:
</del><ins>+        (WebCore::FrameView::updateWidgets):
+        * rendering/RenderArena.h:
+        (RenderArena):
+        (WebCore::RenderArena::create):
</ins><span class="cx"> 
</span><del>-2014-02-24  Tamas Gergely  &lt;tgergely.u-szeged@partner.samsung.com&gt;
</del><ins>+2013-04-26  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        Code cleanup: remove leftover ENABLE(WORKERS) macros and support.
-        https://bugs.webkit.org/show_bug.cgi?id=129255
</del><ins>+        Optimize function and interface object length computation in bindings generator
+        https://bugs.webkit.org/show_bug.cgi?id=115247
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        ENABLE_WORKERS macro was removed in r159679, but r161589 added back some occurrences.
-        Support is now also removed from xcconfig files.
</del><ins>+        Introduce new GetFunctionLength() function that efficiently compute the length
+        of a function (i.e. its number of mandatory parameters).
</ins><span class="cx"> 
</span><del>-        No new tests needed.
</del><ins>+        We now call GetFunctionLength() instead of GenerateFunctionParametersCheck()
+        whenever we care only interested in the function length and not the actual
+        expression for checking the parameters. This is much more efficient as
+        GenerateFunctionParametersCheck() does a lot more processing than we need in
+        this case.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * platform/ThreadGlobalData.cpp:
-        * platform/ThreadGlobalData.h:
-        * platform/Timer.h:
-        (WebCore::TimerBase::isActive):
-        * platform/ios/wak/WebCoreThread.mm:
-        (RunWebThread):
-        (StartWebThread):
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-02-24  Tibor Meszaros  &lt;tmeszaros.u-szeged@partner.samsung.com&gt;
</del><ins>+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GetFunctionLength):
+        (GenerateImplementation):
+        (GenerateConstructorHelperMethods):
</ins><span class="cx"> 
</span><del>-        [CMake] Get rid of &quot;FIXME: The Blackberry port ...&quot; from WebCore/CmakeLists.txt
-        https://bugs.webkit.org/show_bug.cgi?id=129152
</del><ins>+2013-04-26  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        Web Audio: Remove reduplicative addInput() in AnalyserNode.
+        &lt;http://webkit.org/b/115244&gt;
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
</del><ins>+        From Blink r149155 by &lt;james.wei@intel.com&gt;:
</ins><span class="cx"> 
</span><del>-2014-02-24  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        The parent class BasicInspectorNode already called addInput() and addOutput().
+        So it is reduplicative to call them in AnalyserNode.
</ins><span class="cx"> 
</span><del>-        Remove redundant setting in FeatureDefines.xcconfig
</del><ins>+        * Modules/webaudio/AnalyserNode.cpp:
+        (WebCore::AnalyserNode::AnalyserNode):
+        * Modules/webaudio/AudioBasicInspectorNode.cpp:
+        (WebCore::AudioBasicInspectorNode::AudioBasicInspectorNode):
+        * Modules/webaudio/AudioBasicInspectorNode.h:
+        (AudioBasicInspectorNode):
+        * Modules/webaudio/MediaStreamAudioDestinationNode.cpp:
+        (WebCore::MediaStreamAudioDestinationNode::MediaStreamAudioDestinationNode):
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
</del><ins>+2013-04-26  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-24  Mihai Tica  &lt;mitica@adobe.com&gt;
</del><ins>+        Mouseenter and mouseleave events not supported
+        https://bugs.webkit.org/show_bug.cgi?id=18930
</ins><span class="cx"> 
</span><del>-        [CSS Blending] An element having -webkit-mix-blend-mode should only blend with the contents of the parent stacking context
-        https://bugs.webkit.org/show_bug.cgi?id=129154
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Implements mouseenter and mouseleave events from W3C DOM Level 3 Events.
+        These event are already supported by all other major browsers.
</ins><span class="cx"> 
</span><del>-        The blending operation of an element having -webkit-mix-blend-mode should be restricted to the parent stacking context.
-        This change isolates blending, preventing it from blending with other underlying elements besides the parent stacking context.
</del><ins>+        To avoid performance regressions the new events are only dispatched when
+        there are event listeners for them.
</ins><span class="cx"> 
</span><del>-        Tests: css3/compositing/blend-mode-isolated-group-1.html
-               css3/compositing/blend-mode-isolated-group-2.html
-               css3/compositing/blend-mode-isolated-group-3.html
</del><ins>+        Tests: fast/events/mouseenter-mouseleave-capture.html
+               fast/events/mouseenter-mouseleave.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::RenderLayer): Initialize added members to false.
-        (WebCore::RenderLayer::updateBlendMode): Check if a blend mode was set or unset. If so, set the m_updateParentStackingContextShouldIsolateBlendingDirty to true.
-        (WebCore::RenderLayer::updateParentStackingContextShouldIsolateBlending): Traverse to the parent stacking context and update the
-        m_isolatesBlending member accordingly.
-        * rendering/RenderLayer.h:
-        - Add isolatesBlending() as a condition for creating a transparency layer in the paintsWithTransparency method.
-        - Add m_updateParentStackingContextShouldIsolateBlendingDirty member.
-        - Add m_isolatesBlending member and getter.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Call updateParentStackingContextShouldIsolateBlending. 
</del><ins>+        * bindings/scripts/CodeGenerator.pm:
+        * dom/Document.cpp:
+        (WebCore::Document::prepareMouseEvent):
+        (WebCore::Document::updateHoverActiveState):
+        * dom/Document.h:
+        (Document):
+        * dom/Document.idl:
+        * dom/Element.h:
+        (Element):
+        * dom/Element.idl:
+        * dom/EventListenerMap.cpp:
+        (WebCore::EventListenerMap::containsCapturing):
+        * dom/EventListenerMap.h:
+        (EventListenerMap):
+        * dom/EventNames.h:
+        * dom/EventTarget.h:
+        (EventTarget):
+        (WebCore::EventTarget::hasCapturingEventListeners):
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEvent::create):
+        (WebCore::MouseEvent::toElement):
+        (WebCore::MouseEvent::fromElement):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::eventNameForAttributeName):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * page/DOMWindow.idl:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseAttribute):
+        * svg/SVGElementInstance.h:
+        (SVGElementInstance):
+        * svg/SVGElementInstance.idl:
</ins><span class="cx"> 
</span><del>-2014-02-24  Krzysztof Czech  &lt;k.czech@samsung.com&gt;
</del><ins>+2013-04-26  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        [ATK] Wrong selected element at a given index in a list box.
-        https://bugs.webkit.org/show_bug.cgi?id=129039
</del><ins>+        Add support for Web IDL partial interfaces to the bindings generator
+        https://bugs.webkit.org/show_bug.cgi?id=115228
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/select-element-at-index.html
</del><ins>+        Add support for Web IDL partial interfaces to the bindings generator:
+        http://dev.w3.org/2006/webapi/WebIDL/#dfn-partial-interface
</ins><span class="cx"> 
</span><del>-        The selected element at a given index was wrong. One should be considered among the
-        all children of a list box, not only selected ones.
</del><ins>+        Also drop support for the the WebKit-specific [Supplemental] extended
+        attribute and use partial interfaces instead in existing IDL files.
</ins><span class="cx"> 
</span><del>-        * accessibility/atk/WebKitAccessibleInterfaceSelection.cpp:
-        (core):
-        (listObjectForSelection):
-        (optionFromList):
-        (optionFromSelection):
-        (webkitAccessibleSelectionRefSelection):
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-2014-02-23  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        * Modules/battery/NavigatorBattery.idl:
+        * Modules/filesystem/DOMWindowFileSystem.idl:
+        * Modules/filesystem/DataTransferItemFileSystem.idl:
+        * Modules/filesystem/HTMLInputElementFileSystem.idl:
+        * Modules/filesystem/WorkerContextFileSystem.idl:
+        * Modules/gamepad/NavigatorGamepad.idl:
+        * Modules/geolocation/NavigatorGeolocation.idl:
+        * Modules/indexeddb/DOMWindowIndexedDatabase.idl:
+        * Modules/indexeddb/WorkerContextIndexedDatabase.idl:
+        * Modules/mediastream/DOMWindowMediaStream.idl:
+        * Modules/mediastream/NavigatorMediaStream.idl:
+        * Modules/navigatorcontentutils/NavigatorContentUtils.idl:
+        * Modules/networkinfo/NavigatorNetworkInfoConnection.idl:
+        * Modules/notifications/DOMWindowNotifications.idl:
+        * Modules/notifications/WorkerContextNotifications.idl:
+        * Modules/quota/DOMWindowQuota.idl:
+        * Modules/quota/NavigatorStorageQuota.idl:
+        * Modules/quota/WorkerNavigatorStorageQuota.idl:
+        * Modules/speech/DOMWindowSpeech.idl:
+        * Modules/speech/DOMWindowSpeechSynthesis.idl:
+        * Modules/vibration/NavigatorVibration.idl:
+        * Modules/webaudio/DOMWindowWebAudio.idl:
+        * Modules/webdatabase/DOMWindowWebDatabase.idl:
+        * Modules/webdatabase/WorkerContextWebDatabase.idl:
+        * Modules/websockets/DOMWindowWebSocket.idl:
+        * Modules/websockets/WorkerContextWebSocket.idl:
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/IDLParser.pm:
+        (parsePartialDefinition):
+        * bindings/scripts/generate-bindings.pl:
+        * bindings/scripts/preprocess-idls.pl:
+        (getPartialInterfaceNameFromIDLFile):
+        * bindings/scripts/test/TestSupplemental.idl:
+        * page/DOMWindowPagePopup.idl:
</ins><span class="cx"> 
</span><del>-        [WebGL] Allow ANGLE to initialize unused varyings
-        https://bugs.webkit.org/show_bug.cgi?id=129240
-        &lt;rdar://problem/15203342&gt;
</del><ins>+2013-04-25  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        [CSS Regions] Hit testing is broken for absolutely positioned regions that have overflow: hidden
+        https://bugs.webkit.org/show_bug.cgi?id=113874
</ins><span class="cx"> 
</span><del>-        Covered by: conformance/glsl/misc/shaders-with-varyings.html
</del><ins>+        Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
-        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE):
-        Add SH_INIT_VARYINGS_WITHOUT_STATIC_USE to compiler flags.
</del><ins>+        Test: fast/regions/hit-test-abspos-overflow-region.html
</ins><span class="cx"> 
</span><del>-2014-02-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        When a region is an out-of-flow positioned object with an overflow clip, we need
+        to make sure that hit testing works also for cases other than foreground (content)
+        hit testing. This patch moves the previous hit testing code, that delegated foreground
+        hit testing to the region's flow thread hit testing, into the hitTestContent method,
+        now that RenderRegion is RenderBlock based.
</ins><span class="cx"> 
</span><del>-        Update FeatureDefines.xcconfig
</del><ins>+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::hitTestContents):
+        * rendering/RenderRegion.h:
+        (RenderRegion):
</ins><span class="cx"> 
</span><del>-        Rubber-stamped by Anders Carlsson.
</del><ins>+2013-04-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
</del><ins>+        Copy and paste can strip !important CSS rules due to a bug in mergeStyleFromRules
+        https://bugs.webkit.org/show_bug.cgi?id=115217
</ins><span class="cx"> 
</span><del>-2014-02-23  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Sort the project file with sort-Xcode-project-file.
</del><ins>+        The bug was caused by mergeStyleFromRules overriding &quot;important&quot; style rules with &quot;unimportant&quot; inline styles.
+        Fixed the bug by using addParsedProperty, which respects !important, in MutableStylePropertySet's
+        mergeAndOverrideOnConflict, which was only used in editing code. Now that we've fixed this function, we can use
+        it in ViewportStyleResolver::addViewportRule as well.
</ins><span class="cx"> 
</span><del>-        Rubber-stamped by Sam Weinig.
</del><ins>+        Test: editing/pasteboard/copy-paste-with-important-rules.html
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        * css/StylePropertySet.cpp:
+        (WebCore::MutableStylePropertySet::mergeAndOverrideOnConflict): Fixed to respect !important.
+        * css/ViewportStyleResolver.cpp:
+        (WebCore::ViewportStyleResolver::addViewportRule): Use mergeAndOverrideOnConflict now that the code is identical.
</ins><span class="cx"> 
</span><del>-2014-02-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+2013-04-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix incorrectly commented out code.
</del><ins>+        StylePropertySet::getPropertyShorthand() should return a String.
+        &lt;http://webkit.org/b/115213&gt;
</ins><span class="cx"> 
</span><del>-        * platform/TelephoneNumberDetector.h:
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-2014-02-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        Return a String directly from getPropertyShorthand() instead of forcing clients
+        to call getPropertyNameString().
</ins><span class="cx"> 
</span><del>-        Extract platform specific parts of telephone number detection 
-        https://bugs.webkit.org/show_bug.cgi?id=129238
</del><ins>+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::getPropertyShorthand):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2013-04-25  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        Add new files.
</del><ins>+        WEB SPEECH: language support does not work as expected
+        https://bugs.webkit.org/show_bug.cgi?id=115119
</ins><span class="cx"> 
</span><del>-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::HTMLTreeBuilder::linkifyPhoneNumbers):
-        (WebCore::HTMLTreeBuilder::processCharacterBufferForInBody):
-        * platform/TelephoneNumberDetector.h: Added.
-        * platform/cocoa/TelephoneNumberDetectorCocoa.cpp: Added.
-        (WebCore::TelephoneNumberDetector::phoneNumbersScanner):
-        (WebCore::TelephoneNumberDetector::isSupported):
-        (WebCore::TelephoneNumberDetector::find):
-        Move code to TelephoneNumberDetector.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-2014-02-23  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+        Make the Mac platform synthesizer have access to all the voices installed on the system.
</ins><span class="cx"> 
</span><del>-        Change a url parameter type with URL in NavigatorContentUtils
-        https://bugs.webkit.org/show_bug.cgi?id=129202
</del><ins>+        * WebCore.exp.in:
+        * platform/mac/PlatformSpeechSynthesizerMac.mm:
+        (WebCore::PlatformSpeechSynthesizer::initializeVoiceList):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2013-04-25  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        It would be good if we use *URL* for url parameters instead of using String.
</del><ins>+        &lt;meter&gt; element not exposed to accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=109023
+        rdar://problem/13658964
</ins><span class="cx"> 
</span><del>-        Merge from blink. https://src.chromium.org/viewvc/blink?view=rev&amp;revision=165458.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
-        (WebCore::verifyCustomHandlerURL):
-        (WebCore::NavigatorContentUtils::registerProtocolHandler):
-        (WebCore::NavigatorContentUtils::isProtocolHandlerRegistered):
-        (WebCore::NavigatorContentUtils::unregisterProtocolHandler):
-        * Modules/navigatorcontentutils/NavigatorContentUtilsClient.h:
</del><ins>+        Makes the &lt;meter&gt; element appear in the AX tree by reusing the
+        AccessibilityProgressIndicator element to handle either progress or meter
+        elements.
</ins><span class="cx"> 
</span><del>-2014-02-23  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Test: accessibility/meter-element.html
</ins><span class="cx"> 
</span><del>-        Update ANGLE to 836bd2176e5607b14846cf1fbc5932dbc91318f4
-        https://bugs.webkit.org/show_bug.cgi?id=129232
</del><ins>+        * accessibility/AXObjectCache.cpp:
+        (WebCore::createFromRenderer):
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::canHaveChildren):
+        (WebCore::AccessibilityNodeObject::visibleText):
+        * accessibility/AccessibilityProgressIndicator.cpp:
+        (WebCore::AccessibilityProgressIndicator::AccessibilityProgressIndicator):
+        (WebCore::AccessibilityProgressIndicator::create):
+        (WebCore::AccessibilityProgressIndicator::valueForRange):
+        (WebCore::AccessibilityProgressIndicator::maxValueForRange):
+        (WebCore::AccessibilityProgressIndicator::minValueForRange):
+        (WebCore::AccessibilityProgressIndicator::progressElement):
+        (WebCore::AccessibilityProgressIndicator::meterElement):
+        * accessibility/AccessibilityProgressIndicator.h:
+        (AccessibilityProgressIndicator):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::firstChild):
+        (WebCore::AccessibilityRenderObject::lastChild):
+            These methods are modified to handle when there is no rendered children, but there are Node
+            children. The node children are desired when calculating text within a node, for example.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+2013-04-25  Qiankun Miao  &lt;qiankun.miao@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        New files added, derived sources compiled directly, and generated
-        steps removed for both EFL and GTK, with much-needed help from
-        Sergio Correia.
</del><ins>+        [CSS Shaders] Remove the meshType from the CustomFilterOperation
+        https://bugs.webkit.org/show_bug.cgi?id=102529
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * GNUMakefile.am:
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-2014-02-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        No new tests, no new functionality.
</ins><span class="cx"> 
</span><del>-        Move RenderMathMLMenclose.h/cpp to the right place in the Xcode project and sort.
</del><ins>+        MeshType can be accessed from program, so remove the m_meshType
+        related code in CustomFilterOperation.
</ins><span class="cx"> 
</span><del>-        Rubber-stamped by Anders Carlsson.
</del><ins>+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createCustomFilterOperationWithInlineSyntax):
+        * platform/graphics/filters/CustomFilterOperation.cpp:
+        (WebCore::CustomFilterOperation::CustomFilterOperation):
+        (WebCore::CustomFilterOperation::blend):
+        * platform/graphics/filters/CustomFilterOperation.h:
+        (WebCore::CustomFilterOperation::create):
+        (WebCore::CustomFilterOperation::meshType):
+        (CustomFilterOperation):
+        (WebCore::CustomFilterOperation::operator==):
+        * platform/graphics/texmap/coordinated/CoordinatedCustomFilterOperation.h:
+        (WebCore::CoordinatedCustomFilterOperation::CoordinatedCustomFilterOperation):
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+2013-04-25  Kent Tamura  &lt;tkent@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-2014-02-23  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        Ignore invalid regular expressions for input[pattern].
+        https://bugs.webkit.org/show_bug.cgi?id=115204
</ins><span class="cx"> 
</span><del>-        Move telephone number detection behind its own ENABLE macro
-        https://bugs.webkit.org/show_bug.cgi?id=129236
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        According to the specification, we should not proceed regular expression
+        matching if a pattern attribute value is an invalid regular
+        expression. We had a bug that invalid expressions such as
+        pattern=&quot;)foo(&quot; made RegularExpression objects successfully.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        Add ENABLE_TELEPHONE_NUMBER_DETECTION.
</del><ins>+        http://www.whatwg.org/specs/web-apps/current-work/multipage/common-input-element-attributes.html#the-pattern-attribute
+        &gt; If an input element has a pattern attribute specified, and the
+        &gt; attribute's value, when compiled as a JavaScript regular expression with
+        &gt; the global, ignoreCase, and multiline flags disabled (see ECMA262
+        &gt; Edition 5, sections 15.10.7.2 through 15.10.7.4), compiles successfully,
+        &gt; then the resulting regular expression is the element's compiled pattern
+        &gt; regular expression. If the element has no such attribute, or if the
+        &gt; value doesn't compile successfully, then the element has no compiled
+        &gt; pattern regular expression.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        * dom/Document.h:
-        * html/parser/HTMLConstructionSite.h:
-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::HTMLTreeBuilder::processCharacterBufferForInBody):
-        * html/parser/HTMLTreeBuilder.h:
-        Use ENABLE(TELEPHONE_NUMBER_DETECTION).
</del><ins>+        This imports a part of Blink r148951.
</ins><span class="cx"> 
</span><del>-        * platform/mac/SoftLinking.h:
-        Remove PLATOFORM(IOS) from SOFT_LINK_PRIVATE_FRAMEWORK_OPTIONAL, it is not iOS specific.
</del><ins>+        Tests: Update fast/forms/ValidityState-patternMismatch.html
</ins><span class="cx"> 
</span><del>-2014-02-23  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        * html/BaseTextInputType.cpp:
+        (WebCore::BaseTextInputType::patternMismatch):
+        Check correctness of pattern attribute value before wrapping with parentheses.
+        * platform/text/RegularExpression.cpp:
+        (WebCore::RegularExpression::isValid): Added.
+        * platform/text/RegularExpression.h:
+        (RegularExpression): Declare isValid.
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Fix bleed avoidance subpixel calculation.
-        https://bugs.webkit.org/show_bug.cgi?id=129225
</del><ins>+2013-04-25  Antoine Quint  &lt;graouts@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
-        
-        static_cast&lt;LayoutUnit&gt;(int value) only produces the desired result when subpixel is off.
</del><ins>+        Glyphs may fail to render when using SVG font
+        https://bugs.webkit.org/show_bug.cgi?id=115193
</ins><span class="cx"> 
</span><del>-        Currently not testable.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect):
-        (WebCore::shrinkRectByOneDevicePixel):
-        (WebCore::RenderBoxModelObject::borderInnerRectAdjustedForBleedAvoidance):
-        (WebCore::RenderBoxModelObject::backgroundRoundedRectAdjustedForBleedAvoidance):
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-
-2014-02-23  Zalan Bujtas  &lt;zalan@apple.com&gt;
-
-        Subpixel rendering: Add devicepixel based computation to BorderEdge class.
-        https://bugs.webkit.org/show_bug.cgi?id=129224
-
</del><span class="cx">         Reviewed by Simon Fraser.
</span><span class="cx"> 
</span><del>-        To produce correct width (and type) results, BorderEdge class needs to take device pixel ratio into account.
</del><ins>+        Calling SimpleFontData::applyTransforms() when the font used is
+        an SVG font makes little sense since Core Text doesn’t know or
+        understand SVG fonts and would be passed some other, unrelated
+        platform font.
</ins><span class="cx"> 
</span><del>-        Currently not testable.
</del><ins>+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::applyTransforms):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::BorderEdge::BorderEdge):
-        (WebCore::BorderEdge::obscuresBackgroundEdge):
-        (WebCore::BorderEdge::getDoubleBorderStripeWidths): this does not always produce the same
-        result as before, but the sum of inner and outer is not different.
-        (WebCore::BorderEdge::borderWidthInDevicePixel):
-        (WebCore::RenderBoxModelObject::getBorderEdgeInfo):
</del><ins>+2013-04-25  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-22  Dan Bernstein  &lt;mitz@apple.com&gt;
</del><ins>+        Media elements shouldn't resume playback when a page is restored from the back/forward cache if the WKView isn't in a window
+        https://bugs.webkit.org/show_bug.cgi?id=115191
</ins><span class="cx"> 
</span><del>-        REGRESSION (r164507): Crash beneath JSGlobalObjectInspectorController::reportAPIException at facebook.com, twitter.com, youtube.com
-        https://bugs.webkit.org/show_bug.cgi?id=129227
-
</del><span class="cx">         Reviewed by Eric Carlson.
</span><span class="cx"> 
</span><del>-        Reverted r164507.
</del><ins>+        If a page is suspended, then resumed when its WebView or WKView has been removed from a window,
+        the page's media elements will unpause. Check whether media is allowed to start during resume()
+        via Page::canMediaStart() and if not, register for mediaCanStart notifications. Then, in 
+        mediaCanStart() if the media is force-paused, unpause it.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::buildInitiatorObject):
-        * inspector/PageDebuggerAgent.cpp:
-        (WebCore::PageDebuggerAgent::breakpointActionLog):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createGenericRecord):
-        * page/Console.cpp:
-        (WebCore::internalAddMessage):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::timeEnd):
-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::gatherSecurityPolicyViolationEventData):
-        (WebCore::ContentSecurityPolicy::reportViolation):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessage):
-
-2014-02-22  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
-
-        Remove some unreachable code (-Wunreachable-code)
-        https://bugs.webkit.org/show_bug.cgi?id=129220
-
-        Reviewed by Eric Carlson.
-
-        * html/parser/HTMLTreeBuilder.cpp:
-        (WebCore::HTMLTreeBuilder::processCharacterBuffer):
-        (WebCore::HTMLTreeBuilder::processEndTag):
-        The only tricky case. Here there was a break inside the
-        #if, but not the #else, and a break after the #endif.
-        Remove the break inside the #if, and always use the
-        break after the #endif.
-
-        * Modules/indexeddb/IDBTransaction.cpp:
-        (WebCore::IDBTransaction::modeToString):
-        * bindings/js/JSTrackCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSWebGLRenderingContextCustom.cpp:
-        (WebCore::functionForUniform):
-        * css/SelectorChecker.cpp:
-        (WebCore::SelectorChecker::checkOne):
</del><span class="cx">         * html/HTMLMediaElement.cpp:
</span><del>-        (WebCore::HTMLMediaElement::parseAttribute):
-        * page/CaptionUserPreferencesMediaAF.cpp:
-        (WebCore::CaptionUserPreferencesMediaAF::captionDisplayMode):
</del><ins>+        (WebCore::HTMLMediaElement::suspend):
+        (WebCore::HTMLMediaElement::resume):
+        (WebCore::HTMLMediaElement::mediaCanStart):
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::pageConsentRequiredForResume):
</ins><span class="cx"> 
</span><del>-2014-02-22  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+2013-04-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Letterpress effect disabled for synthetic italic
-        https://bugs.webkit.org/show_bug.cgi?id=129218
-        &lt;rdar://problem/15997846&gt;
</del><ins>+        Remove ENABLE(PARSED_STYLE_SHEET_CACHING) and make it always-on.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dan Bernstein.
</del><ins>+        Rubber-stamped by Anders Koivisto.
</ins><span class="cx"> 
</span><del>-        There was no need to guard against synthetic italics and letterpress.
</del><ins>+        * PlatformWinCE.cmake:
+        * accessibility/AccessibilityObject.h:
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::drawGlyphs): Remove !useLetterpressEffect from conditional.
</del><ins>+2013-04-25  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-02-21  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+        Remove OS(WINCE) from AccessibilityObject.h
+        https://bugs.webkit.org/show_bug.cgi?id=115192
</ins><span class="cx"> 
</span><del>-        Expose phase and momentum phase as SPI on DOMWheelEvent
-        &lt;rdar://problem/16110871&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=129184
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Use the same files like the the other PLATFORM(WIN) ports use.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Export core(DOMWheelEvent).
</del><ins>+        * PlatformWinCE.cmake:
+        * accessibility/AccessibilityObject.h:
+        (AccessibilityObject):
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        Make DOMWheelEventInternal.h available in WebKit.
</del><ins>+2013-04-25  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::dispatchWheelEvent):
-        * dom/WheelEvent.cpp:
-        (WebCore::determineDeltaMode):
-        (WebCore::WheelEvent::WheelEvent):
-        (WebCore::WheelEvent::initWheelEvent):
-        (WebCore::WheelEvent::initWebKitWheelEvent):
-        Move PlatformWheelEvent -&gt; DOMWheelEvent conversion to DOMWheelEvent.
</del><ins>+        Add definition of GlyphBufferGlyph for BlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=115183
</ins><span class="cx"> 
</span><del>-        * dom/WheelEvent.h:
-        (WebCore::WheelEvent::create):
-        (WebCore::WheelEvent::phase):
-        (WebCore::WheelEvent::momentumPhase):
-        Store phase and momentumPhase on the WheelEvent.
</del><ins>+        Reviewed by Xan Lopez.
</ins><span class="cx"> 
</span><del>-2014-02-22  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        BlackBerry uses an unsigned int.
</ins><span class="cx"> 
</span><del>-        Rename JWK key_ops values from wrap/unwrap to wrapKey/unwrapKey
-        https://bugs.webkit.org/show_bug.cgi?id=129121
</del><ins>+        * platform/graphics/GlyphBuffer.h:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2013-04-25  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSCryptoKeySerializationJWK.cpp:
-        (WebCore::JSCryptoKeySerializationJWK::reconcileUsages): Updated to newer names.
-        (WebCore::addUsagesToJSON): Ditto.
-        (WebCore::JSCryptoKeySerializationJWK::serialize): rsa-oaep-key-manipulation test
-        started ot fail, because RSA-OAEP with 2048 bit key and sha-1 can only encrypt
-        214 bytes, and the new longer names made JSON serialization slightly longer.
-        Compensate by not doing any indentation in JSON.
</del><ins>+        ScriptExecutionContext log exception should include a column number
+        https://bugs.webkit.org/show_bug.cgi?id=114315
</ins><span class="cx"> 
</span><del>-2014-02-22  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        Only skip stretchy operators when determining the stretch height.
-        https://bugs.webkit.org/show_bug.cgi?id=126842
</del><ins>+        Test: inspector/console/console-exception-stack-traces.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        * bindings/js/ScriptCallStackFactory.h:
+        * bindings/js/ScriptCallStackFactory.cpp:
+        (WebCore::createScriptCallStackFromException):
+        Generate a ScriptCallStack from an exception. Use the vm.exceptionStack
+        if available, and fallback to the exception object where needed.
</ins><span class="cx"> 
</span><del>-        The MathML code only takes into account non-mo children for the computation of the stretch size. This change includes non-stretchy mo in that computation. A new test is added into mathml/presentation/stretchy-depth-height.html.
</del><ins>+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException):
+        Always include a non-empty call stack with exceptions.
+        Where not provided, fallback to the exception object.
</ins><span class="cx"> 
</span><del>-        * rendering/mathml/RenderMathMLRow.cpp:
-        (WebCore::RenderMathMLRow::layout):
</del><ins>+        * dom/Document.h:
+        * dom/Document.cpp:
+        (WebCore::Document::logExceptionToConsole):
+        * dom/ScriptExecutionContext.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::PendingException::PendingException):
+        (ScriptExecutionContext::PendingException):
+        (WebCore::ScriptExecutionContext::reportException):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::logExceptionToConsole):
+        * workers/SharedWorkerContext.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::logExceptionToConsole):
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        Plumb columnNumber through as needed.
</ins><span class="cx"> 
</span><del>-2014-02-22  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+2013-04-25  Gregg Tavares  &lt;gman@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Implement asymmetric/symmetric stretching of vertical operators.
-        https://bugs.webkit.org/show_bug.cgi?id=124827.
</del><ins>+        Fix build files so WebGLDebugXXX extensions can be used if enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=113976
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        The MathML code stretches vertical operators asymmetrically by default. This patch takes into account the symmetric attribute or the symmetric property of the operator dictionary to stretch operators symmetrically.
</del><ins>+        No new tests as no new functionality.
</ins><span class="cx"> 
</span><del>-        Test: mathml/presentation/stretchy-depth-height-symmetric.html
</del><ins>+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
</ins><span class="cx"> 
</span><del>-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::stretchTo):
-        (WebCore::RenderMathMLOperator::updateFromElement):
-        (WebCore::RenderMathMLOperator::updateStyle):
</del><ins>+2013-04-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-02-22  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        cloneChildNodes looks for deleteButtonController in each level of recursion
+        https://bugs.webkit.org/show_bug.cgi?id=115146
</ins><span class="cx"> 
</span><del>-        Bug 119043 - Large stretch size error for MathML operators.
-        https://bugs.webkit.org/show_bug.cgi?id=119043
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+        Obtain the delete button controller upfront, and shallow copy descendents of each child
+        so that we don't look for the delete button controller inside cloneNode called on each child.
</ins><span class="cx"> 
</span><del>-        The MathML code used some arbitrary gOperatorExpansion factor for the
-        stretch size and 2/3 1/2 constants for the baseline. This change tries
-        to consider height/depth of siblings of the stretchy operator so that
-        the stretchy operator now matches its target.
</del><ins>+        Performance Tests: DOM/CloneNodes.html
</ins><span class="cx"> 
</span><del>-        Test: mathml/presentation/stretchy-depth-height.html
</del><ins>+        * dom/ContainerNode.cpp:
+        (WebCore::cloneChildNodesAvoidingDeleteButon): Extracted.
+        (WebCore::ContainerNode::cloneChildNodes):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isRenderMathMLTable):
-        * rendering/mathml/RenderMathMLBlock.h:
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::RenderMathMLOperator):
-        (WebCore::RenderMathMLOperator::stretchTo):
-        (WebCore::RenderMathMLOperator::findAcceptableStretchyCharacter):
-        (WebCore::RenderMathMLOperator::updateStyle):
-        (WebCore::RenderMathMLOperator::firstLineBaseline):
-        (WebCore::RenderMathMLOperator::computeLogicalHeight):
-        * rendering/mathml/RenderMathMLOperator.h:
-        * rendering/mathml/RenderMathMLRow.cpp:
-        (WebCore::RenderMathMLRow::layout):
</del><ins>+2013-04-25  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-02-22  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        HTMLOptionsCollection's namedItem and name getter should return the first item
+        https://bugs.webkit.org/show_bug.cgi?id=115150
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r164534.
-        http://trac.webkit.org/changeset/164534
-        https://bugs.webkit.org/show_bug.cgi?id=119043
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        missing tests
</del><ins>+        Following the resolution in http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-December/038355.html,
+        the spefication has been updated to only return the first item when there are multiple items of the same name
+        in HTMLOptionsCollection; this new behavior matches that of Firefox and Opera (Presto).
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.h:
-        * rendering/mathml/RenderMathMLBlock.h:
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::RenderMathMLOperator):
-        (WebCore::RenderMathMLOperator::expandedStretchHeight):
-        (WebCore::RenderMathMLOperator::stretchToHeight):
-        (WebCore::RenderMathMLOperator::findAcceptableStretchyCharacter):
-        (WebCore::RenderMathMLOperator::updateStyle):
-        (WebCore::RenderMathMLOperator::firstLineBaseline):
-        (WebCore::RenderMathMLOperator::computeLogicalHeight):
-        * rendering/mathml/RenderMathMLOperator.h:
-        * rendering/mathml/RenderMathMLRow.cpp:
-        (WebCore::RenderMathMLRow::layout):
</del><ins>+        Implement this new behavior to remove the custom binding code and use the fast path in namedItem and name
+        getter of HTMLOptionsCollection. (Obtaining all items for a given name is expensive!).
</ins><span class="cx"> 
</span><del>-2014-02-22  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+        Tests: fast/dom/HTMLSelectElement/named-options.html
+               fast/dom/html-collections-named-getter.html
</ins><span class="cx"> 
</span><del>-        Bug 119043 - Large stretch size error for MathML operators.
-        https://bugs.webkit.org/show_bug.cgi?id=119043
</del><ins>+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore): Removed the custom bindings for name getter and namedItem.
+        * html/HTMLOptionsCollection.idl:
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+2013-04-25  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The MathML code used some arbitrary gOperatorExpansion factor for the
-        stretch size and 2/3 1/2 constants for the baseline. This change tries
-        to consider height/depth of siblings of the stretchy operator so that
-        the stretchy operator now matches its target.
</del><ins>+        Web Inspector: ConsoleMessage should include line and column number where possible
+        https://bugs.webkit.org/show_bug.cgi?id=114929
</ins><span class="cx"> 
</span><del>-        Test: mathml/presentation/stretchy-depth-height.html
</del><ins>+          - adds &quot;m_column&quot; to WebCore::ConsoleMessage
+          - adds &quot;column&quot; to Console.ConsoleMessage in the inspector protocol
+          - set the column number for console.* functions (Console.cpp)
+          - set the column number for XSLT errors (XSLTProcessor)
+          - plumb columnNumber everywhere else it is needed, set it to 0 and file
+            bugs for all cases missing columnNumber that could provide it.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::isRenderMathMLTable):
-        * rendering/mathml/RenderMathMLBlock.h:
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::RenderMathMLOperator):
-        (WebCore::RenderMathMLOperator::stretchTo):
-        (WebCore::RenderMathMLOperator::findAcceptableStretchyCharacter):
-        (WebCore::RenderMathMLOperator::updateStyle):
-        (WebCore::RenderMathMLOperator::firstLineBaseline):
-        (WebCore::RenderMathMLOperator::computeLogicalHeight):
-        * rendering/mathml/RenderMathMLOperator.h:
-        * rendering/mathml/RenderMathMLRow.cpp:
-        (WebCore::RenderMathMLRow::layout):
</del><ins>+        Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-2014-02-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Test: inspector/console/console-url-line-column.html
+              inspector/console/console-messages-stack-traces.html
</ins><span class="cx"> 
</span><del>-        REGRESSION(r164412): Pixel cracks when zooming in to any web content.
-        https://bugs.webkit.org/show_bug.cgi?id=129195
</del><ins>+        * inspector/ConsoleMessage.h:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::autogenerateMetadata):
+        (WebCore::ConsoleMessage::addToFrontend):
+        (WebCore::ConsoleMessage::isEqual):
+        Add m_column and set it where appropriate.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * inspector/Inspector.json:
+        Add column property to Console.ConsoleMessage.
</ins><span class="cx"> 
</span><del>-        Integral clipping of the repaint rect was prematurely removed in RenderLayerBacking::paintContents().
-        Repaint rects needs a uniform, device pixel precise clipping across the painting flow including RenderLayer,
-        RenderView and TileController.
</del><ins>+        * page/Console.cpp:
+        (WebCore::internalAddMessage):
+        (WebCore::Console::profile):
+        Set columnNumber like lineNumber from the last stack frame.
+        (WebCore::Console::groupEnd):
+        Line and column are unused in this message type, set both to 0.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::paintContents):
-        (WebCore::RenderLayerBacking::compositedBoundsIncludingMargin):
</del><ins>+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::XSLTProcessor::parseErrorFunc):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTMessageHandler::handleMessage):
+        Add real column numbers, the XSLT handlers already had it available.
</ins><span class="cx"> 
</span><del>-2014-02-21  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::logError):
+        * dom/ScriptExecutionContext.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::addConsoleMessage):
+        * dom/Document.cpp:
+        (WebCore::Document::logExceptionToConsole):
+        (WebCore::Document::addMessage):
+        * dom/Document.h:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::addMessageToConsole):
+        (WebCore::InspectorConsoleAgent::stopTiming):
+        (WebCore::InspectorConsoleAgent::didFinishXHRLoading):
+        (WebCore::InspectorConsoleAgent::didReceiveResponse):
+        (WebCore::InspectorConsoleAgent::didFailLoading):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorConsoleInstrumentation.h:
+        (WebCore::InspectorInstrumentation::addMessageToConsole):
+        (WebCore::InspectorInstrumentation::addStartProfilingMessageToConsole):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::addMessageToConsoleImpl):
+        (WebCore::InspectorInstrumentation::addStartProfilingMessageToConsoleImpl):
+        (WebCore::InspectorInstrumentation::addProfileImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::addProfile):
+        (WebCore::InspectorProfilerAgent::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorProfilerAgent::addStartProfilingMessageToConsole):
+        (WebCore::InspectorProfilerAgent::start):
+        (WebCore::InspectorProfilerAgent::stop):
+        * inspector/InspectorProfilerAgent.h:
+        (InspectorProfilerAgent):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::addMessageToConsole):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::addMessageToConsole):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::logToConsole):
+        * page/PageConsole.cpp:
+        (WebCore::PageConsole::addMessage):
+        * page/PageConsole.h:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (SharedWorkerProxy):
+        (WebCore::postExceptionTask):
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        (WebCore::postConsoleMessageTask):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::logExceptionToConsole):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::logExceptionToConsole):
+        (WebCore::WorkerContext::addConsoleMessage):
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::addMessageToWorkerConsole):
+        * workers/WorkerContext.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::create):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        (WorkerExceptionTask):
+        (WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
+        (WebCore::postConsoleMessageTask):
+        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
+        * workers/WorkerMessagingProxy.h:
+        (WorkerMessagingProxy):
+        * workers/WorkerReportingProxy.h:
+        (WorkerReportingProxy):
+        Plumb columnNumber through where appropriate. File bugs where missing.
</ins><span class="cx"> 
</span><del>-        Unreviewed Mac build fix after r164529.
</del><ins>+2013-04-25  Allan Sandfeld Jensen  &lt;allan.jensen@digia.com&gt;
</ins><span class="cx"> 
</span><del>-        Replace the string-to-array algorithm with a archictecture-independant
-        one.
</del><ins>+        [Qt] Animated opacity does not trigger accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=115107
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
-        (WebCore::CDMSessionMediaSourceAVFObjC::generateKeyRequest):
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-02-21  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Add extra option to also trigger compositing on animated opacity.
</ins><span class="cx"> 
</span><del>-        [EME] Add a CDMSession for MediaPlayerPrivateMediaSourceAVFObjC
-        https://bugs.webkit.org/show_bug.cgi?id=129166
</del><ins>+        * page/ChromeClient.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-04-25  Lamarque V. Souza  &lt;Lamarque.Souza@basyskom.com&gt;
</ins><span class="cx"> 
</span><del>-        Add a new CDMSession, cerated by MediaPlayerPrivateMediaSourceAVFObjC allowing
-        media-source-backed media elements to play protected content.
</del><ins>+        Sec-WebSocket-Extensions header field must not appear more than once in an HTTP response.
+        https://bugs.webkit.org/show_bug.cgi?id=115128
</ins><span class="cx"> 
</span><del>-        Add a new CDMSessionMediaSourceAVFObjC class:
-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h: Added.
-        (WebCore::CDMSessionMediaSourceAVFObjC::~CDMSessionMediaSourceAVFObjC):
-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm: Added.
-        (WebCore::CDMSessionMediaSourceAVFObjC::CDMSessionMediaSourceAVFObjC):
-        (WebCore::CDMSessionMediaSourceAVFObjC::generateKeyRequest): Do not actually generate a
-            key request until the certificate data has been added via update();
-        (WebCore::CDMSessionMediaSourceAVFObjC::releaseKeys): No-op.
-        (WebCore::CDMSessionMediaSourceAVFObjC::update): If no certificate data has yet been
-            added, assume the incoming message contains it.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::registerMediaEngine): Add supportsKeySystem.
-        (WebCore::keySystemIsSupported): Use &quot;com.apple.fps.2_0&quot; to distinguish from the not-media-source scheme.
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::supportsType): Check the keySystem type.
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::supportsKeySystem): Added.
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::createSession): Added, pass through to MediaSourcePrivate.
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        (WebCore::MediaSourcePrivateAVFObjC::createSession): Added.
-        (WebCore::MediaSourcePrivateAVFObjC::sourceBufferKeyNeeded): Pass through to MediaPlayer.
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]):
-            Added, pass through to SourceBufferPrivate.
-        (WebCore::SourceBufferPrivateAVFObjC::SourceBufferPrivateAVFObjC):
-        (WebCore::SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID): Remember
-            which track is requesting the key, and pass the request to MediaSourcePrivate.
</del><ins>+        According to WebSocket specification Sec-WebSocket-Extensions header field
+        must not appear more than once in an HTTP response. It is ok if it appears
+        more than once in client request. Also add a check for invalid UTF-8
+        characters when parsing Sec-WebSocket-Extensions quoted string.
</ins><span class="cx"> 
</span><del>-        Add new files to the project.
-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        Test: http/tests/websocket/tests/hybi/handshake-fail-by-more-extensions-header.html
</ins><span class="cx"> 
</span><del>-2014-02-21  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        * Modules/websockets/WebSocketExtensionParser.cpp:
+        (WebCore::WebSocketExtensionParser::consumeQuotedString): Return false if there is
+        invalid character in the quoted string being parsed.
+        * Modules/websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readHTTPHeaders): Check if Sec-WebSocket-Extensions
+        appears more than once in header response. Abort handshake if it does.
</ins><span class="cx"> 
</span><del>-        CryptoAlgorithmRSASSA_PKCS1_v1_5::platformVerify contains seemingly accidental unreachable code
-        https://bugs.webkit.org/show_bug.cgi?id=129193
</del><ins>+2013-04-25  Raphael Kubo da Costa  &lt;raphael.kubo.da.costa@intel.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+        REGRESSION(r148758): Remove WTFLogAlways call from IconLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=115182
</ins><span class="cx"> 
</span><del>-        * crypto/mac/CryptoAlgorithmRSASSA_PKCS1_v1_5Mac.cpp:
-        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformVerify): Fix the accidental code.
</del><ins>+        Reviewed by Dan Bernstein.
</ins><span class="cx"> 
</span><del>-2014-02-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        The call added in r148758 was apparently a leftover from some debugging
+        session, and it makes the Interactive/window-resize.html performance
+        test randomly fail on Qt and EFL due to WTFLogAlways writing to stderr.
</ins><span class="cx"> 
</span><del>-        Extend media support for WebVTT sources
-        https://bugs.webkit.org/show_bug.cgi?id=129156
</del><ins>+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::notifyFinished):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-04-25  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig: Add new feature define for AVF_CAPTIONS
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::outOfBandTrackSources): Added.
-        * html/HTMLMediaElement.h:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::outOfBandTrackSources): Added.
-        * platform/graphics/MediaPlayer.h:
-        (WebCore::MediaPlayerClient::outOfBandTrackSources): Added.
-        * platform/graphics/PlatformTextTrack.h:
-        (WebCore::PlatformTextTrack::create): Update for new constructor signature.
-        (WebCore::PlatformTextTrack::createOutOfBand): Added.
-        (WebCore::PlatformTextTrack::url): Added.
-        (WebCore::PlatformTextTrack::isDefault): Added.
-        (WebCore::PlatformTextTrack::PlatformTextTrack): Revised to take new URL and
-        'isDefault' arguments.
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::mediaDescriptionForKind): Added.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Tell AVFoundation about any
-        WebVTT tracks supplied by the web page.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::processMediaSelectionOptions): Filter out any out-of-band
-        WebVTT tracks returned by the media engine to avoid double-counting tracks.
</del><ins>+        Add support for Web IDL callback interfaces to the bindings generator
+        https://bugs.webkit.org/show_bug.cgi?id=115179
</ins><span class="cx"> 
</span><del>-2014-02-21  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Reviewed by Kentaro Hara.
</ins><span class="cx"> 
</span><del>-        Inner text element should not use -webkit-user-modify
-        https://bugs.webkit.org/show_bug.cgi?id=129035
</del><ins>+        Add support in the bindings generator for Web IDL callback interfaces:
+        http://dev.w3.org/2006/webapi/WebIDL/#dfn-callback-interface
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Drop support for the WebKit-specific [Callback] extended attributes
+        on Web IDL interfaces and update existing IDL files to use proper
+        callback interfaces instead.
</ins><span class="cx"> 
</span><del>-        To eliminate the internal use of -webkit-user-modify, use contenteditable attribute in the inner text elements
-        instead of manually inspecting disabled-ness and readonly-ness in RenderTextControl.
</del><ins>+        No new tests, no behavior change.
</ins><span class="cx"> 
</span><del>-        Unfortunately, we still have to manually set UserModify value in RenderTextControl::adjustInnerTextStyle since
-        RenderTextControl::styleDidChange creates RenderStyle for its inner text from scratch via createInnerTextStyle.    
</del><ins>+        * Modules/filesystem/EntriesCallback.idl:
+        * Modules/filesystem/EntryCallback.idl:
+        * Modules/filesystem/ErrorCallback.idl:
+        * Modules/filesystem/FileCallback.idl:
+        * Modules/filesystem/FileSystemCallback.idl:
+        * Modules/filesystem/FileWriterCallback.idl:
+        * Modules/filesystem/MetadataCallback.idl:
+        * Modules/geolocation/PositionCallback.idl:
+        * Modules/geolocation/PositionErrorCallback.idl:
+        * Modules/mediastream/NavigatorUserMediaErrorCallback.idl:
+        * Modules/mediastream/NavigatorUserMediaSuccessCallback.idl:
+        * Modules/mediastream/RTCErrorCallback.idl:
+        * Modules/mediastream/RTCSessionDescriptionCallback.idl:
+        * Modules/mediastream/RTCStatsCallback.idl:
+        * Modules/notifications/NotificationPermissionCallback.idl:
+        * Modules/quota/StorageErrorCallback.idl:
+        * Modules/quota/StorageQuotaCallback.idl:
+        * Modules/quota/StorageUsageCallback.idl:
+        * Modules/webaudio/AudioBufferCallback.idl:
+        * Modules/webdatabase/DatabaseCallback.idl:
+        * Modules/webdatabase/SQLStatementCallback.idl:
+        * Modules/webdatabase/SQLStatementErrorCallback.idl:
+        * Modules/webdatabase/SQLTransactionCallback.idl:
+        * Modules/webdatabase/SQLTransactionErrorCallback.idl:
+        * Modules/webdatabase/SQLTransactionSyncCallback.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateInterface):
+        * bindings/scripts/IDLParser.pm:
+        (parseCallbackRestOrInterface):
+        * bindings/scripts/test/TestCallback.idl:
+        * dom/RequestAnimationFrameCallback.idl:
+        * dom/StringCallback.idl:
+        * html/VoidCallback.idl:
</ins><span class="cx"> 
</span><del>-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::disabledStateChanged): Don't use childrenOfType iterator which asserts that DOM
-        isn't mutated during the traversal since we now set contenteditable attribute inside disabledStateChanged via
-        updateFromControlElementsAncestorDisabledStateUnder.
</del><ins>+2013-04-25  Adrian Perez de Castro  &lt;aperez@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::parseAttribute): Extracted readOnlyAttributeChanged out of this function so
-        that HTMLTextFormControl could override it to call updateInnerTextElementEditability.
-        (WebCore::HTMLFormControlElement::readOnlyAttributeChanged): Ditto.
-        * html/HTMLFormControlElement.h:
</del><ins>+        [GStreamer] Add audio/speex MIME type as supported
+        https://bugs.webkit.org/show_bug.cgi?id=115032
</ins><span class="cx"> 
</span><del>-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::didAddUserAgentShadowRoot): Call updateInnerTextElementEditability after creating
-        shadow DOM for the current input type.
-        (WebCore::HTMLInputElement::updateType): Ditto.
-        (WebCore::HTMLInputElement::parseAttribute): Ditto.
</del><ins>+        Reviewed by Philippe Normand.
</ins><span class="cx"> 
</span><del>-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::didAddUserAgentShadowRoot): Call updateInnerTextElementEditability.
</del><ins>+        GStreamer has support for the Speex codec (http://www.speex.org).
+        Speex streams may be embedded in a Ogg container, or standalone.
+        The case of the Ogg container is already covered by the &quot;*/ogg&quot;
+        MIME types declared as supported by the GStreamer media playing
+        code, but for standalone streams to work, &quot;audio/speex&quot; has to
+        be added.
</ins><span class="cx"> 
</span><del>-        * html/HTMLTextFormControlElement.cpp:
-        (WebCore::HTMLTextFormControlElement::disabledStateChanged): Added to update contenteditable attribute since
-        the editability of the inner text element depends on disabled-ness of the element.
-        (WebCore::HTMLTextFormControlElement::readOnlyAttributeChanged): Ditto for the readonly-ness of the element.
-        (WebCore::HTMLTextFormControlElement::updateInnerTextElementEditability): Added.
-        * html/HTMLTextFormControlElement.h:
</del><ins>+        With this, and the needed GStreamer plugin installed, the GTK+
+        launcher is able to correctly play Speex streams served with
+        &quot;Content-type: audio/speex&quot;.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::adjustInnerTextStyle): Use the inner text element's presentationAttributeStyle() to
-        compute the appropriate EUserModify value instead of hard-coding it here.
-        * rendering/RenderTextControl.h:
</del><ins>+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
</ins><span class="cx"> 
</span><del>-2014-02-21  ChangSeok Oh  &lt;changseok.oh@collabora.com&gt;
</del><ins>+2013-04-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Support WEBGL_draw_buffers extension.
-        https://bugs.webkit.org/show_bug.cgi?id=129143
</del><ins>+        Add FINAL decorators to the InlineBox class hierarchy.
+        &lt;http://webkit.org/b/115177&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Support the WEBGL_draw_buffers WebGL extension for gtk port. Relevant opengl APIs
-        are exposed for WebGLRenderingContext to access them properly.
</del><ins>+        From Blink r148628 by &lt;cevans@chromium.org&gt;:
</ins><span class="cx"> 
</span><del>-        Covered by fast/canvas/webgl/webgl-draw-buffers.html
</del><ins>+        FINAL is a macro in wtf/Compiler.h that does the correct thing if the compiler does not support &quot;final&quot;)
+        The approach used is as simple as possible whilst being thorough.
+        So, leaf classes have FINAL applied to the whole class whereas intermediary classes have FINAL applied to relevant methods.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/OpenGLShims.cpp:
-        (WebCore::initializeOpenGLShims):
-        * platform/graphics/OpenGLShims.h:
-        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
-        (WebCore::Extensions3DOpenGL::supportsExtension):
-        (WebCore::Extensions3DOpenGL::drawBuffersEXT):
</del><ins>+        FINAL allows a compiler to devirtualize call sites and turn them into direct calls. As you might expect, this is perf positive:
+        (clang on Linux):
+        - line_layout.html goes from 120 runs/s -&gt; 123 runs/2, +2.5%
+        - html5-full-render.html goes from 3176ms -&gt; 3162ms, +0.4%
</ins><span class="cx"> 
</span><del>-2014-02-21  ChangSeok Oh  &lt;changseok.oh@collabora.com&gt;
</del><ins>+        I have confidence that the former result is statistically significant (as the numbers are very very stable) but not the latter.
</ins><span class="cx"> 
</span><del>-        Mac port uses ANGLE_instanced_arrays related apis through those in GraphicsContext3DCommon.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=128803
</del><ins>+        * rendering/EllipsisBox.h:
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.h:
+        * rendering/RootInlineBox.h:
+        * rendering/TrailingFloatsRootInlineBox.h:
+        * rendering/svg/SVGInlineFlowBox.h:
+        * rendering/svg/SVGInlineTextBox.h:
+        * rendering/svg/SVGRootInlineBox.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2013-04-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge mac port implementation of ANGLE_instanced_arrays into common code.
</del><ins>+        CSS parser: Add error recovery while parsing @-webkit-keyframes key values.
+        &lt;http://webkit.org/b/115175&gt;
</ins><span class="cx"> 
</span><del>-        No new tests, no functionality changed.
</del><ins>+        From Blink r148714 by &lt;apavlov@chromium.org&gt;:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/GraphicsContext3DMac.mm:
-        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
-        (WebCore::Extensions3DOpenGL::drawArraysInstanced):
-        (WebCore::Extensions3DOpenGL::drawElementsInstanced):
-        (WebCore::Extensions3DOpenGL::vertexAttribDivisor):
-        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
-        (WebCore::GraphicsContext3D::vertexAttribDivisor):
</del><ins>+        If not a percentage, &quot;from&quot;, or &quot;to&quot; value is used in a key list, the rule is erroneous,
+        and due to the absense of recovery, the parser skips the following, valid CSS rule.
</ins><span class="cx"> 
</span><del>-2014-02-21  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        On a related note, keyframes, whose selectors contain invalid keys, should be discarded
+        altogether, according to &lt;http://www.w3.org/TR/css3-animations/#keyframes&gt;
</ins><span class="cx"> 
</span><del>-        After copy and paste, cursor may appear to be above the bottom of content
-        https://bugs.webkit.org/show_bug.cgi?id=129167
</del><ins>+        Tests: animations/keyframes-invalid-keys.html
+               fast/css/webkit-keyframes-errors.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        * css/CSSGrammar.y.in:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::rewriteSpecifiers):
</ins><span class="cx"> 
</span><del>-        Adding a clear:both to the end of content.
</del><ins>+2013-04-25  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        I can't handle the case of the cursor appearing above the bottom of
-        absolutely positioned divs (of the case of floats inside absolutely
-        positioned divs) because you can't know where the bottom of a div
-        will end up being rendered (it is affected by things like browser
-        window width and text size settings). Therefore, the only case I
-        can handle is the case where there is a floating div in the same
-        level as the document itself.
</del><ins>+        REGRESSION (r147797): Animations slideshows of images on www.thesuperficial.com are slow
+        https://bugs.webkit.org/show_bug.cgi?id=115172
</ins><span class="cx"> 
</span><del>-        Test: editing/pasteboard/copy-paste-inserts-clearing-div.html
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * editing/EditingStyle.cpp:
-        (WebCore::EditingStyle::isFloating):
-        * editing/EditingStyle.h:
-        * editing/markup.cpp:
-        (WebCore::StyledMarkupAccumulator::StyledMarkupAccumulator):
-        (WebCore::StyledMarkupAccumulator::appendElement):
-        (WebCore::createMarkupInternal):
</del><ins>+        On this page ads dynamically loaded to subframes on slideshow navigation switch us to state where we throttle layer flushes.
+        
+        Fix by ignoring any subframe-originated loads when determining throttling.
</ins><span class="cx"> 
</span><del>-2014-02-21  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadProgressingStatusChanged):
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::isMainLoadProgressing):
+        
+            Rename, ignore subframe originated loads. Subframe loads that are initiated during the main load still count.
</ins><span class="cx"> 
</span><del>-        [iOS Media] Wireless target UI
-        https://bugs.webkit.org/show_bug.cgi?id=129189
-        &lt;rdar://problem/15349928&gt;
-        &lt;rdar://problem/16100060&gt;
</del><ins>+        * loader/ProgressTracker.h:
+        (ProgressTracker):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateLayerFlushThrottlingInAllFrames):
+        * page/FrameView.h:
+        (FrameView):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::computeTileCoverage):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2013-04-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Implement a prototype UI for wireless playback targets. The UI
-        doesn't currently work, but can be simulated via a class variable
-        in ControllerIOS.
</del><ins>+        SVG: Fix viewBox animations on shapes with non-scaling-stroke.
+        &lt;http://webkit.org/b/115173&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsiOS.css:
-        (audio::-webkit-media-controls-panel button): Reset the default style of
-        button elements, to avoid getting a border.
-        (audio::-webkit-media-controls-wireless-playback-status): Holds the UI showing
-        the user that the media is playing on another target.
-        (audio::-webkit-media-controls-wireless-playback-status.hidden):
-        (audio::-webkit-media-controls-wireless-playback-picker-button): The button to
-        trigger selection of targets.
-        (audio::-webkit-media-controls-wireless-playback-picker-button.active):
-        (audio::-webkit-media-controls-panel): This needs to be position absolute for
-        the wireless playback status to fill the viewport.
-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS): Check for targets.
-        (ControllerIOS.prototype.addVideoListeners):
-        (ControllerIOS.prototype.removeVideoListeners):
-        (ControllerIOS.prototype.UIString): New method to return localized strings (with
-        a FIXME).
-        (ControllerIOS.prototype.shouldHaveAnyUI): Needs to display if there is a wireless
-        target.
-        (ControllerIOS.prototype.currentPlaybackTargetIsWireless):
-        (ControllerIOS.prototype.updateWirelessPlaybackStatus): Create the status content,
-        replacing the device name if it is available.
-        (ControllerIOS.prototype.updateWirelessTargetAvailable):
-        (ControllerIOS.prototype.createControls):
-        (ControllerIOS.prototype.configureInlineControls):
-        (ControllerIOS.prototype.handleWirelessPlaybackChange):
-        (ControllerIOS.prototype.handleWirelessTargetAvailableChange):
-        (ControllerIOS.prototype.handleWirelessPickerButtonClicked):
</del><ins>+        From Blink r149058 by &lt;pdr@chromium.org&gt;:
</ins><span class="cx"> 
</span><del>-2014-02-21  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Previously hasAttribute() to determine if a viewBox was set in the transform
+        code for non-scaling-strokes. hasAttribute() should not be used in this case,
+        as it will return false if the attribute is not set but the value is animating.
</ins><span class="cx"> 
</span><del>-        Make a generic CDMPrivateMediaPlayer and move its CDMSession into platform/.
-        https://bugs.webkit.org/show_bug.cgi?id=129164
</del><ins>+        This patch switches to checking if the viewBox is empty instead of checking for
+        the presence of the attribute.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Test: svg/stroke/animated-non-scaling-stroke.html
</ins><span class="cx"> 
</span><del>-        Move the session created by CDMPrivateAVFoundation into platform, and rename
-        CDMPrivateAVFoundation to CDMPrivateMediaPlayer. Future media engines who want
-        to support a keysystem from within the media engine can create their own
-        CDMSession as part of the MediaPlayerPrivate interface.
</del><ins>+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::localCoordinateSpaceTransform):
+        * svg/SVGSVGElement.h:
+        (WebCore::SVGSVGElement::hasEmptyViewBox):
</ins><span class="cx"> 
</span><del>-        * Modules/encryptedmedia/CDM.cpp:
-        (WebCore::installedCDMFactories):
-        (WebCore::CDM::createSession):
-        * Modules/encryptedmedia/CDM.h:
-        * Modules/encryptedmedia/CDMPrivate.h:
-        * Modules/encryptedmedia/MediaKeySession.cpp:
-        * Modules/encryptedmedia/MediaKeySession.h:
-        * Modules/encryptedmedia/CDMPrivateAVFoundation.mm: Removed.
-        * Modules/encryptedmedia/CDMPrivateMediaPlayer.cpp: Renamed from Source/WebCore/Modules/encryptedmedia/CDMPrivateAVFoundation.cpp.
-        (WebCore::CDMPrivateMediaPlayer::supportsKeySystem):
-        (WebCore::CDMPrivateMediaPlayer::supportsKeySystemAndMimeType):
-        (WebCore::CDMPrivateMediaPlayer::supportsMIMEType):
-        (WebCore::CDMPrivateMediaPlayer::createSession):
-        * Modules/encryptedmedia/CDMPrivateMediaPlayer.h: Renamed from Source/WebCore/Modules/encryptedmedia/CDMPrivateAVFoundation.h.
-        (WebCore::CDMPrivateMediaPlayer::create):
-        (WebCore::CDMPrivateMediaPlayer::~CDMPrivateMediaPlayer):
-        (WebCore::CDMPrivateMediaPlayer::cdm):
-        (WebCore::CDMPrivateMediaPlayer::CDMPrivateMediaPlayer):
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/CDMSession.h: Extracted from CDMPrivateAVFoundation.h.
-        (WebCore::CDMSessionClient::~CDMSessionClient):
-        (WebCore::CDMSession::CDMSession):
-        (WebCore::CDMSession::~CDMSession):
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::createSession):
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
-        (WebCore::MediaPlayerPrivateInterface::createSession):
-        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h: Renamed from Source/WebCore/Modules/encryptedmedia/CDMPrivateAVFoundation.h.
-        (WebCore::CDMSessionAVFoundationObjC::~CDMSessionAVFoundationObjC):
-        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm: Renamed from Source/WebCore/Modules/encryptedmedia/CDMPrivateAVFoundation.mm.
-        (WebCore::CDMSessionAVFoundationObjC::CDMSessionAVFoundationObjC):
-        (WebCore::CDMSessionAVFoundationObjC::generateKeyRequest):
-        (WebCore::CDMSessionAVFoundationObjC::releaseKeys):
-        (WebCore::CDMSessionAVFoundationObjC::update):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createSession):
-        * testing/MockCDM.cpp:
-        (WebCore::MockCDMSession::setClient):
-        (WebCore::MockCDM::createSession):
-        * testing/MockCDM.h:
</del><ins>+2013-04-25  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-21  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+        Remove isPluginElement hack in Document::setFocusedNode()
+        &lt;http://webkit.org/b/115171&gt;
</ins><span class="cx"> 
</span><del>-        Add a supportsKeySystem media engine factory parameter.
-        https://bugs.webkit.org/show_bug.cgi?id=129161
</del><ins>+        From Blink r148800 by &lt;tkent@chromium.org&gt;:
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        This hack is no longer necessary because r147591 made isFocusable for plugin
+        elements work correctly.
</ins><span class="cx"> 
</span><del>-        Add a new parameter to the MediaPlayerFactory to allow registered media
-        engines to be queried for keySystem support:
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayerFactory::MediaPlayerFactory):
-        (WebCore::MediaPlayer::supportsKeySystem):
-        * platform/graphics/MediaPlayer.h:
</del><ins>+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
</ins><span class="cx"> 
</span><del>-        Support this new field in MediaPlayerPrivateAVFoundationObjC:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::registerMediaEngine):
-        (WebCore::keySystemIsSupported):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsKeySystem):
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::shouldWaitForLoadingOfResource):
</del><ins>+2013-04-25  Per-Erik Brodin  &lt;per-erik.brodin@ericsson.com&gt;
</ins><span class="cx"> 
</span><del>-        Add an empty field for SupportsKeySystem to the remaining media engines:
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundationCF::registerMediaEngine):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::registerMediaEngine):
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::registerMediaEngine):
-        * platform/graphics/ios/MediaPlayerPrivateIOS.mm:
-        (WebCore::MediaPlayerPrivateIOS::registerMediaEngine):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivateQTKit::registerMediaEngine):
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
-        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::registerMediaEngine):
-        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
-        (WebCore::MockMediaPlayerMediaSource::registerMediaEngine):
</del><ins>+        EventSource: Synchronous loader callback not handled properly
+        https://bugs.webkit.org/show_bug.cgi?id=115104
</ins><span class="cx"> 
</span><del>-2014-02-21  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        When attempting a cross-origin request towards a non-HTTP URL, an early verification
+        of the protocol scheme will cause didFailAccessControlCheck to be called synchronously
+        before the loader has even finished being created. This special case was not handled
+        properly, since we tried to cancel a non-existing loader, which resulted in a crash.
+        In addition to checking whether a request is in flight before trying to cancel it,
+        this change also schedules the initial creation of the loader to happen asynchronously
+        when an EventSource is constructed, so that a script can register for the error event
+        before it is dispatched (as a result of passing a non-HTTP URL to the constructor).
</ins><span class="cx"> 
</span><del>-        Fix WebCore's internals after r164505
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp:
-        (WebCore::Internals::findEditingDeleteButton): The call became ambiguous after r164505.
</del><ins>+        Test: http/tests/eventsource/eventsource-cors-non-http.html
</ins><span class="cx"> 
</span><del>-2014-02-21  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        * page/EventSource.cpp:
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::create):
+        (WebCore::EventSource::scheduleInitialConnect):
+        (WebCore):
+        (WebCore::EventSource::scheduleReconnect):
+        (WebCore::EventSource::connectTimerFired):
+        (WebCore::EventSource::close):
+        (WebCore::EventSource::abortConnectionAttempt):
+        * page/EventSource.h:
+        (EventSource):
</ins><span class="cx"> 
</span><del>-        Web Inspector: JSContext inspection should report exceptions in the console
-        https://bugs.webkit.org/show_bug.cgi?id=128776
</del><ins>+2013-04-25  Patrick Gansterer  &lt;paroga@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Unreviewed WinCE build fix after r148545.
</ins><span class="cx"> 
</span><del>-        Include some clean up of ConsoleMessage and ScriptCallStack construction.
</del><ins>+        * page/wince/FrameWinCE.cpp:
</ins><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+2013-04-24  Kent Tamura  &lt;tkent@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        Simplify code now that createStackTraceFromException handles it.
</del><ins>+        Back references don't work in pattern attribute
+        https://bugs.webkit.org/show_bug.cgi?id=105875
</ins><span class="cx"> 
</span><del>-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::gatherSecurityPolicyViolationEventData):
-        (WebCore::ContentSecurityPolicy::reportViolation):
-        ScriptCallStack can give us the first non-native callframe.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::buildInitiatorObject):
-        * inspector/PageDebuggerAgent.cpp:
-        (WebCore::PageDebuggerAgent::breakpointActionLog):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createGenericRecord):
-        * page/Console.cpp:
-        (WebCore::internalAddMessage):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::timeEnd):
-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::gatherSecurityPolicyViolationEventData):
-        (WebCore::ContentSecurityPolicy::reportViolation):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessage):
</del><ins>+        This imports a part of Blink r148951.
</ins><span class="cx"> 
</span><del>-2014-02-21  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+        Tests: Update fast/forms/ValidityState-patternMismatch.html
</ins><span class="cx"> 
</span><del>-        jsDocumentPrototypeFunctionGetElementById should not create an AtomicString for the function argument
-        https://bugs.webkit.org/show_bug.cgi?id=128893
</del><ins>+        * html/BaseTextInputType.cpp:
+        (WebCore::BaseTextInputType::patternMismatch):
+        Don't use capturing parentheses. They affected back references in
+        pattern attribute values.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2013-04-24  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The declaration of TreeScope::getElementById() was taking an AtomicString as the parameter.
-        Because of this, all the call sites manipulating String were creating and keeping alive an AtomicString
-        to make the call.
</del><ins>+        PDFPlugin: Cursor should become an i-beam when over selectable text
+        https://bugs.webkit.org/show_bug.cgi?id=115018
+        &lt;rdar://problem/12645012&gt;
</ins><span class="cx"> 
</span><del>-        This had two negative consequences:
-        -The call sites were ref-ing the ID's atomic string for no reason.
-        -When there is no ID associated with the input string, an atomic string was created for the sole
-         purpose of failing the query. Since IDs are stored as AtomicString, if there is not an existing
-         AtomicString for the input, there is no reason to query anything.
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::findAtomicString): Update this after the rename.
</del><ins>+        * WebCore.exp.in: Export the I-beam and arrow cursors.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorObjC.pm:
-        (GenerateImplementation):
-        * bindings/scripts/IDLAttributes.txt:
-        Now that there are two overloads for TreeScope::getElementById(), the conversion from NSString*
-        is ambiguous. I add the keyword ObjCExplicitAtomicString to force an explicit conversion to AtomicString.
</del><ins>+2013-04-24  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Document.idl:
-        * dom/TreeScope.cpp:
-        (WebCore::TreeScope::getElementById):
-        When getting an AtomicString, the case of a empty string is not important, use isNull() instead.
-        When getting a String, get the corresponding AtomicString if any and use that for getting the element.
</del><ins>+        Garbage at the top of http://www.technologyreview.com after scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=114825
</ins><span class="cx"> 
</span><del>-        * dom/TreeScope.h:
-        * html/FTPDirectoryDocument.cpp:
-        (WebCore::FTPDirectoryDocumentParser::loadDocumentTemplate):
-        Solve the ambiguous call.
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler):
-        This is a wonderful candidate for substringSharingImpl. The substring does not survive the call since
-        the new getElementById never create any AtomicString.
</del><ins>+        Garbage pixels are caused by GraphicsLayerCA setting a layer to be opaque,
+        but then not painting anything into it. On this page, the element is
+        toggled to be visibility:hidden on scrolling, but RenderLayer::backgroundIsKnownToBeOpaqueInRect()
+        failed to consider that as something that can cause backgrounds not to be opaque.
+        
+        For the bug to happen, some subtle interactions with r142012 come into play
+        for the layer to remain visible, hence the slightly complex testcase.
+        
+        Test: compositing/contents-opaque/visibility-hidden.html
</ins><span class="cx"> 
</span><del>-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::getElementById):
-        It looks like there are opportunities to get faster here, Ryosuke should have a look.
</del><ins>+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::backgroundIsKnownToBeOpaqueInRect):
</ins><span class="cx"> 
</span><del>-        * svg/SVGSVGElement.h:
-        * xml/XMLTreeViewer.cpp:
-        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
-        Unrelated cleanup: noStyleMessage was useless.
</del><ins>+2013-04-24  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-21  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Dump layer opaqueness in the Compositing log output
+        https://bugs.webkit.org/show_bug.cgi?id=115132
</ins><span class="cx"> 
</span><del>-        COL element in table has 0 for offsetWidth
-        https://bugs.webkit.org/show_bug.cgi?id=15277
</del><ins>+        Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        It's useful to see whether we consider layers to be opaque in the Compositing
+        log channel output, so dump it.
</ins><span class="cx"> 
</span><del>-        Implements offset{Left, Top, Width, Height} for table columns and column groups
-        per section Extensions to the HTMLElement Interface of the CSSOM View spec,
-        &lt;http://www.w3.org/TR/cssom-view/#extensions-to-the-htmlelement-interface&gt; (Draft 17 December 2013).
</del><ins>+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::logLayerInfo):
</ins><span class="cx"> 
</span><del>-        For now, we fail almost all of the offset{Height, Top} sub-tests in the included test
-        for the separate border model as we need to fix &lt;https://bugs.webkit.org/show_bug.cgi?id=128988&gt;.
</del><ins>+2013-04-24  Seokju Kwon  &lt;seokju.kwon@gmail.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/table/col-and-colgroup-offsets.html
</del><ins>+        Add efl to JSInspectorFrontendHost::port()
+        https://bugs.webkit.org/show_bug.cgi?id=115137
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::RenderTable): Initialize cached column offset top and offset height.
-        We cache these offsets since they are the same for all columns in the table.
-        (WebCore::RenderTable::invalidateCachedColumns): Clear cached effective column index map.
-        (WebCore::RenderTable::invalidateCachedColumnOffsets): Added.
-        (WebCore::RenderTable::layout): Invalidate cached column offsets as the location or height
-        of one or more sections may have changed.
-        (WebCore::RenderTable::updateColumnCache): Modified to build effective column index map.
-        (WebCore::RenderTable::effectiveIndexOfColumn): Added.
-        (WebCore::RenderTable::offsetTopForColumn): Added.
-        (WebCore::RenderTable::offsetLeftForColumn): Added.
-        (WebCore::RenderTable::offsetWidthForColumn): Added.
-        (WebCore::RenderTable::offsetHeightForColumn): Added.
-        * rendering/RenderTable.h: Make isTableColumnGroupWithColumnChildren() const.
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::offsetLeft): Added; turns around and calls RenderTable::offsetLeftForColumn().
-        (WebCore::RenderTableCol::offsetTop): Added; turns around and calls RenderTable::offsetTopForColumn().
-        (WebCore::RenderTableCol::offsetWidth): Added; turns around and calls RenderTable::offsetWidthForColumn().
-        (WebCore::RenderTableCol::offsetHeight): Added; turns around and calls RenderTable::offsetHeightForColumn().
-        * rendering/RenderTableCol.h:
</del><ins>+        Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-2014-02-21  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+        No new tests, because there is no change in behavior.
</ins><span class="cx"> 
</span><del>-        Build fix for iOS after r164498.
</del><ins>+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::port):
</ins><span class="cx"> 
</span><del>-        Unreviewed.
</del><ins>+2013-04-24  Kangil Han  &lt;kangil.han@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ios/MediaPlayerPrivateIOS.mm:
-        (WebCore::MediaPlayerPrivateIOS::buffered):
</del><ins>+        Function parameter quotePair can be passed by reference
+        https://bugs.webkit.org/show_bug.cgi?id=115089
</ins><span class="cx"> 
</span><del>-2014-02-21  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        Disallow the use of -webkit-user-modify on shadow pseudo elements
-        https://bugs.webkit.org/show_bug.cgi?id=129144
</del><ins>+        Minor performance patch.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        * rendering/style/QuotesData.cpp:
+        (WebCore::QuotesData::addPair):
+        * rendering/style/QuotesData.h:
+        (QuotesData):
</ins><span class="cx"> 
</span><del>-        Completely disallow -webkit-user-modify on user agent (builtin) pseudo elements.
</del><ins>+2013-04-24  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        We've already had rules to do this in html.css but just hard code it into the engine
-        in order to eliminate the all uses of -webkit-user-modify in html.css.
</del><ins>+        Implementors of CachedResource subclasses should be forced to decide if encoded data can be replaced.
+        https://bugs.webkit.org/show_bug.cgi?id=115140
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::adjustRenderStyle):
-        * css/html.css:
-        (input::-webkit-textfield-decoration-container):
-        (input::-webkit-clear-button):
-        (input[type=&quot;search&quot;]::-webkit-search-cancel-button):
-        (input[type=&quot;search&quot;]::-webkit-search-decoration):
-        (input[type=&quot;search&quot;]::-webkit-search-results-decoration):
-        (input[type=&quot;search&quot;]::-webkit-search-results-button):
-        (input::-webkit-inner-spin-button):
-        (input::-webkit-input-speech-button):
-        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder):
-        (input[type=&quot;file&quot;]::-webkit-file-upload-button):
-        (input[type=&quot;range&quot;]::-webkit-slider-container, input[type=&quot;range&quot;]::-webkit-media-slider-container):
-        (input[type=&quot;range&quot;]::-webkit-slider-runnable-track):
-        (input[type=&quot;range&quot;]::-webkit-slider-thumb, input[type=&quot;range&quot;]::-webkit-media-slider-thumb):
-        (input[type=&quot;color&quot;]::-webkit-color-swatch-wrapper):
-        (input[type=&quot;color&quot;]::-webkit-color-swatch):
-        (::-webkit-validation-bubble):
-        (::-webkit-validation-bubble-message):
-        (::-webkit-validation-bubble-text-block):
-        (::-webkit-validation-bubble-heading):
-        (::-webkit-validation-bubble-arrow):
-        (::-webkit-validation-bubble-arrow-clipper):
-        (meter::-webkit-meter-inner-element):
-        (meter::-webkit-meter-bar):
-        (meter::-webkit-meter-optimum-value):
-        (meter::-webkit-meter-suboptimum-value):
-        (meter::-webkit-meter-even-less-good-value):
-        (progress::-webkit-progress-inner-element):
-        (progress::-webkit-progress-bar):
-        (progress::-webkit-progress-value):
</del><ins>+        Reviewed by Beth Dakin.
</ins><span class="cx"> 
</span><del>-2014-02-21  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        No new tests (No behavior change).
</ins><span class="cx"> 
</span><del>-        Fix TimeRanges layering violations
-        https://bugs.webkit.org/show_bug.cgi?id=128717
</del><ins>+        This makes mayTryReplaceEncodedData() return false in CachedResource, but overrides to true
+        in all CachedResource subclasses besides CachedFont (which already has an implementation).
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        * loader/cache/CachedCSSStyleSheet.h:
+        * loader/cache/CachedImage.h:
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedSVGDocument.h:
+        * loader/cache/CachedScript.h:
+        * loader/cache/CachedShader.h:
+        * loader/cache/CachedTextTrack.h:
+        * loader/cache/CachedXSLStyleSheet.h:
</ins><span class="cx"> 
</span><del>-        No new tests, no functionality changed.
</del><ins>+2013-04-24  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * GNUmakefile.list.am: Add PlatformTimeRanges.
</del><ins>+        Once a custom font is cached to disk, it starts failing to render until the page is refreshed.
+        &lt;rdar://problem/13622998&gt; and https://bugs.webkit.org/show_bug.cgi?id=115131
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/MediaSource.cpp:
-        (WebCore::MediaSource::buffered): TimeRanges -&gt; PlatformTimeRanges.
-        * Modules/mediasource/MediaSource.h:
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): TimeRanges* -&gt; TimeRanges&amp;.
</del><ins>+        No new tests (Not a tested config, nor are disk cache issues currently testable).
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Update for signature changes.
</del><ins>+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource:: mayTryReplaceEncodedData): Allow subclasses to refuse encoded data replacement.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj: Add PlatformTimeRanges.
</del><ins>+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::tryReplaceEncodedData): Only try if shouldTryReplaceEncodedData() is true.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::percentLoaded): Create TimeRanges from PlatformTimeRanges.
-        (WebCore::HTMLMediaElement::buffered): Ditto.
-        (WebCore::HTMLMediaElement::seekable): Ditto.
</del><ins>+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::mayTryReplaceEncodedData): Return false if the custom font data has ever been created.
+        * loader/cache/CachedFont.h:
</ins><span class="cx"> 
</span><del>-        * html/MediaController.cpp:
-        (MediaController::buffered): TimeRanges* -&gt; TimeRanges&amp;.
-        (MediaController::seekable): Ditto.
-        (MediaController::played): Ditto.
</del><ins>+2013-04-24  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Move all of the logic into PlatformTimeRanges. Change API to take TimeRanges&amp; instead of TimeRanges*.
-        * html/TimeRanges.cpp:
-        (WebCore::TimeRanges::create): Move to .cpp from .h.
-        (WebCore::TimeRanges::TimeRanges): Initialize the PlatformTimeRanges member variable.
-        (WebCore::TimeRanges::start): Passthrough to PlatformTimeRanges.
-        (WebCore::TimeRanges::end): Ditto.
-        (WebCore::TimeRanges::invert): Ditto.
-        (WebCore::TimeRanges::copy): Ditto.
-        (WebCore::TimeRanges::intersectWith): Ditto.
-        (WebCore::TimeRanges::unionWith): Ditto.
-        (WebCore::TimeRanges::length): Ditto.
-        (WebCore::TimeRanges::add): Ditto.
-        (WebCore::TimeRanges::contain): Ditto.
-        (WebCore::TimeRanges::find): Ditto.
-        (WebCore::TimeRanges::nearest): Ditto.
-        (WebCore::TimeRanges::totalDuration): Ditto.
-        * html/TimeRanges.h:
</del><ins>+        Vertical overlay scrollbar in iframes fades in and out rapidly when you scroll in 
+        a circle
+        https://bugs.webkit.org/show_bug.cgi?id=115124
+        -and corresponding-
+        &lt;rdar://problem/13168957&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::NullMediaPlayerPrivate::buffered): TimeRanges -&gt; PlatformTimeRanges.
-        (WebCore::MediaPlayer::buffered): Ditto.
-        (WebCore::MediaPlayer::seekable): Ditto.
-        * platform/graphics/MediaPlayer.h:
-        * platform/graphics/MediaPlayerPrivate.h:
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/MediaSourcePrivateClient.h:
</del><ins>+        With http://trac.webkit.org/changeset/119834 we started calling 
+        ScrollbarPainterController's contentAreaScrolled/contentAreaScrolledInDirection 
+        API on a zero-delay timer instead of calling it right away. This prevented some 
+        crashes that we saw whenever this was called during a layout. However, that delay, 
+        combined with the particulars of contentAreaScrolledInDirection cause this bug 
+        where sometimes the scrollbars in an iframe will fade out very noticeably when 
+        scrolling in a circle.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/PlatformTimeRanges.cpp: Added.
-        * platform/graphics/PlatformTimeRanges.h: Added.
</del><ins>+        This change makes it so we will only use the zero-delay timer if the 
+        ScrollableArea is not currently handling a wheel event. If it IS handling a wheel 
+        event, then we will send the notifications to AppKit right away. I confirmed that 
+        this change did not reintroduce the old crashes. 
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundation::buffered): TimeRanges -&gt; PlatformTimeRanges.
-        (WebCore::MediaPlayerPrivateAVFoundation::loadedTimeRangesChanged): Drive-by fix to log
-            FunctionType notifications. ASSERT when passed an unknown notification.
-
-        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::MediaPlayerPrivateAVFoundationCF::platformBufferedTimeRanges):  TimeRanges -&gt; PlatformTimeRanges.
-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::currentTime): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformBufferedTimeRanges): Ditto.
-
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekable): Ditto.
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::buffered): Ditto.
-
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::buffered): Ditto.
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
-
-        * platform/graphics/ios/MediaPlayerPrivateIOS.h:
-        * platform/graphics/ios/MediaPlayerPrivateIOS.mm:
-        (WebCore::MediaPlayerPrivateIOS::buffered): Ditto.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivateQTKit::buffered): Ditto.
-
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
-        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::buffered): Ditto.
-        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
-
-        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
-
-        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
-        (WebCore::MockMediaPlayerMediaSource::buffered): Ditto.
-        (WebCore::MockMediaPlayerMediaSource::advanceCurrentTime): Ditto.
-        * platform/mock/mediasource/MockMediaPlayerMediaSource.h:
-
-2014-02-21  Enrica Casucci  &lt;enrica@apple.com&gt;
-
-        Support WebSelections in WK2 on iOS.
-        https://bugs.webkit.org/show_bug.cgi?id=127015
-        &lt;rdar://problem/15211964&gt;
-
-        Reviewed by Benjamin Poulain.
-
-        Adding some exports.
-
-        * WebCore.exp.in:
-
-2014-02-21  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
-
-        'mouseenter' mouse compat event not fired when listeners for touch events
-        https://bugs.webkit.org/show_bug.cgi?id=128534
-
-        Reviewed by Andreas Kling.
-
-        The code dispatching mouseenter and mouseleave events was making the assumption that
-        only mouse move would cause Document::updateHoverActiveState.
-
-        This is not true in some cases. In the case of this bug, the first touch handler sets
-        the hover state. From there, the code handling enter/leave is in an inconsistent state.
-
-        This patch changes the delivery of mouse enter/leave events to be done through the regular
-        processing of mouse events. The update is done with the mouseover and mouseout events.
-
-        * dom/Document.cpp:
-        (WebCore::Document::prepareMouseEvent):
-        (WebCore::Document::updateHoverActiveState):
-        * dom/Document.h:
</del><ins>+        Keep track of whether we are currently handling a wheel event with the new member 
+        variable m_isHandlingWheelEvent.
</ins><span class="cx">         * page/EventHandler.cpp:
</span><del>-        (WebCore::nearestCommonHoverAncestor):
-        (WebCore::hierarchyHasCapturingEventListeners):
-        (WebCore::EventHandler::updateMouseEventTargetNode):
</del><ins>+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        (WebCore::EventHandler::isHandlingWheelEvent):
+        (EventHandler):
</ins><span class="cx"> 
</span><del>-2014-02-21  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+        To prevent layering violations, the ScrollableArea sub-classes will have to access 
+        this information from the EventHandler.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::isHandlingWheelEvent):
+        * page/FrameView.h:
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::isHandlingWheelEvent):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::isHandlingWheelEvent):
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::isHandlingWheelEvent):
+        * rendering/RenderListBox.h:
</ins><span class="cx"> 
</span><del>-        Crash reloading page with position: fixed content
-        https://bugs.webkit.org/show_bug.cgi?id=129119
-        &lt;rdar://problem/16127090&gt;
</del><ins>+        sendContentAreaScrolledSoon() can be private. Also add new function 
+        sendContentAreaScrolled().
+        * platform/mac/ScrollAnimatorMac.h:
+        (ScrollAnimatorMac):
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        If the ScrollableArea is handling a wheel event, call 
+        sendContentAreaScrolled(), otherwise call sendContentAreaScrolledSoon()
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::notifyContentAreaScrolled):
+        (WebCore::ScrollAnimatorMac::sendContentAreaScrolled):
</ins><span class="cx"> 
</span><del>-        Test: platform/mac-wk2/tiled-drawing/crash-reloading-with-position-fixed-content.html
</del><ins>+        Re-factored to use sendContentAreaScrolled()
+        (WebCore::ScrollAnimatorMac::sendContentAreaScrolledTimerFired):
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::removeDestroyedNodes):
-        Check the node's ID against the latched node's ID before the node is
-        removed from the tree.
</del><ins>+2013-04-24  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-02-21  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        Fix a merge error in r149007 (was missing a null check added in r148777).
</ins><span class="cx"> 
</span><del>-        Revert r164486, causing a number of test failures.
</del><ins>+        * rendering/LogicalSelectionOffsetCaches.h:
+        (WebCore::containingBlockForAbsolutePosition):
</ins><span class="cx"> 
</span><del>-        Unreviewed rollout.
</del><ins>+2013-04-24  Otto Derek Cheung  &lt;otcheung@rim.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-21  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+        Battery API won't return updated battery status until client calls didChangeBatteryStatus
+        https://bugs.webkit.org/show_bug.cgi?id=114891
</ins><span class="cx"> 
</span><del>-        StyleResolver::loadPendingImage() should take a reference to StylePendingImage
-        &lt;http://webkit.org/b/129021&gt;
</del><ins>+        Reviewed by Rob Buis.
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+        The BatteryStatus object in BatteryManager won't get updated until BatteryClient calls
+        didChangeBatteryStatus in BatteryController. Any attempts to call webkitBattery.charged()
+        or other get functions will always return the default values until the next battery status
+        change object gets passed to the controller.
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::loadPendingImage): Change pendingImage
-        parameter to a reference.
-        (WebCore::StyleResolver::loadPendingShapeImage): Update to use
-        references.
-        (WebCore::StyleResolver::loadPendingImages): Ditto.
-        * css/StyleResolver.h:
-        (WebCore::StyleResolver::loadPendingImage): Change pendingImage
-        parameter to a reference.
</del><ins>+        We need to update the manager when we attach it to the controller, and update all
+        existing managers when the controller receives it's first battery status object.
</ins><span class="cx"> 
</span><del>-2014-02-21  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        * Modules/battery/BatteryController.cpp:
+        (WebCore::BatteryController::addListener):
+        (WebCore::BatteryController::updateBatteryStatus):
+        * Modules/battery/BatteryManager.cpp:
+        (WebCore::BatteryManager::didChangeBatteryStatus):
+        (WebCore::BatteryManager::updateBatteryStatus):
+        (WebCore):
+        * Modules/battery/BatteryManager.h:
+        (BatteryManager):
</ins><span class="cx"> 
</span><del>-        Web Inspector: JSContext inspection should report exceptions in the console
-        https://bugs.webkit.org/show_bug.cgi?id=128776
</del><ins>+2013-04-24  Jacky Jiang  &lt;zhajiang@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Clean up unused code in ViewportArguments.h
+        https://bugs.webkit.org/show_bug.cgi?id=115121
</ins><span class="cx"> 
</span><del>-        Include some clean up of ConsoleMessage and ScriptCallStack construction.
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Covered by existing tests.
</del><ins>+        The target-densityDPI emulation implementation has been removed by
+        r147893, so clean up the remaining code as well.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        Simplify code now that createStackTraceFromException handles it.
</del><ins>+        * dom/ViewportArguments.h:
</ins><span class="cx"> 
</span><del>-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::gatherSecurityPolicyViolationEventData):
-        (WebCore::ContentSecurityPolicy::reportViolation):
-        ScriptCallStack can give us the first non-native callframe.
</del><ins>+2013-04-24  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::InspectorResourceAgent::buildInitiatorObject):
-        * inspector/PageDebuggerAgent.cpp:
-        (WebCore::PageDebuggerAgent::breakpointActionLog):
-        * inspector/TimelineRecordFactory.cpp:
-        (WebCore::TimelineRecordFactory::createGenericRecord):
-        * page/Console.cpp:
-        (WebCore::internalAddMessage):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::timeEnd):
-        * page/ContentSecurityPolicy.cpp:
-        (WebCore::gatherSecurityPolicyViolationEventData):
-        (WebCore::ContentSecurityPolicy::reportViolation):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessage):
</del><ins>+        ElementData should use 'unsigned' attribute indices.
+        &lt;http://webkit.org/b/115103&gt;
</ins><span class="cx"> 
</span><del>-2014-02-21  Martin Hodovan  &lt;mhodovan@inf.u-szeged.hu&gt;
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Fixing the !ENABLE(SVG_FONTS) build
-        https://bugs.webkit.org/show_bug.cgi?id=129150
</del><ins>+        Switch to using 'unsigned' for attribute indices. This gives consistent behavior
+        on 32/64-bit, and the underlying storage is already limited by Vector's 32-bit capacity.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        Added an ElementData::attributeNotFound constant (-1) since we can't use WTF::notFound.
</ins><span class="cx"> 
</span><del>-        No new tests required.
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::detachAttribute):
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setSynchronizedLazyAttribute):
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::setAttributeNode):
+        (WebCore::Element::removeAttributeNode):
+        (WebCore::Element::removeAttributeInternal):
+        (WebCore::UniqueElementData::removeAttribute):
+        (WebCore::ElementData::getAttributeItemIndexSlowCase):
+        * dom/Element.h:
+        (ElementData):
+        (UniqueElementData):
+        (Element):
+        (WebCore::Element::getAttributeItemIndex):
+        (WebCore::Element::attributeCount):
+        (WebCore::ElementData::length):
+        (WebCore::ElementData::getAttributeItem):
+        (WebCore::ElementData::getAttributeItemIndex):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItemNS):
+        (WebCore::NamedNodeMap::length):
+        * dom/NamedNodeMap.h:
+        (NamedNodeMap):
</ins><span class="cx"> 
</span><del>-        * svg/SVGAltGlyphElement.cpp:
-        * svg/SVGAltGlyphElement.h:
-        * svg/svgtags.in:
</del><ins>+2013-04-24  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-21  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        ElementData::attributeItem() should bounds-check the index.
+        &lt;http://webkit.org/b/115076&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Use the named-flow-specific object RenderNamedFlowFragment instead of the generic RenderRegion whenever possible
-        https://bugs.webkit.org/show_bug.cgi?id=128599
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+        Switch the ASSERT_WITH_SECURITY_IMPLICATION to a RELEASE_ASSERT.
</ins><span class="cx"> 
</span><del>-        Use the named flow specific RenderNamedFlowFragment instead of the generic RenderRegion, whenever possible.
-        Move named flow specific methods from RenderRegion to RenderNamedFlowFragment.
-
-        No new tests required.
-
-        * dom/Element.cpp:
-        (WebCore::Element::renderNamedFlowFragment):
-        (WebCore::Element::webkitRegionOverset):
-        (WebCore::Element::webkitGetRegionFlowRanges):
</del><span class="cx">         * dom/Element.h:
</span><del>-        * inspector/InspectorCSSAgent.cpp:
-        (WebCore::InspectorCSSAgent::buildArrayForRegions):
-        * rendering/PaintInfo.h:
-        (WebCore::PaintInfo::PaintInfo):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::paintObject):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::pushContentsClip):
-        (WebCore::RenderBox::layoutOverflowRectForPropagation):
-        * rendering/RenderBox.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderInline.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paint):
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::paintLayerContents):
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
-        (WebCore::RenderLayer::updatePaintingInfoForFragments):
-        (WebCore::RenderLayer::paintTransformedLayerIntoFragments):
-        (WebCore::RenderLayer::paintBackgroundForFragments):
-        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
-        (WebCore::RenderLayer::paintOutlineForFragments):
-        (WebCore::RenderLayer::paintMaskForFragments):
-        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderNamedFlowFragment.cpp:
-        (WebCore::RenderNamedFlowFragment::getRanges):
-        * rendering/RenderNamedFlowFragment.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::updateWritingMode):
-        (WebCore::compareRenderNamedFlowFragments):
-        (WebCore::addFragmentToList):
-        (WebCore::RenderNamedFlowThread::addFragmentToNamedFlowThread):
-        (WebCore::RenderNamedFlowThread::addRegionToThread):
-        (WebCore::RenderNamedFlowThread::removeRegionFromThread):
-        (WebCore::RenderNamedFlowThread::computeOversetStateForRegions):
-        (WebCore::RenderNamedFlowThread::checkInvalidRegions):
-        (WebCore::RenderNamedFlowThread::getRanges):
-        (WebCore::RenderNamedFlowThread::checkRegionsWithStyling):
-        (WebCore::RenderNamedFlowThread::clearRenderObjectCustomStyle):
-        * rendering/RenderNamedFlowThread.h:
-        * rendering/RenderRegion.cpp:
-        * rendering/RenderRegion.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::paint):
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::paintReplaced):
</del><ins>+        (WebCore::ElementData::attributeItem):
</ins><span class="cx"> 
</span><del>-2014-02-21  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+2013-04-23  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Regions don't paint correctly in new-multicol elements
-        https://bugs.webkit.org/show_bug.cgi?id=120711
</del><ins>+        Setting an inline style property to &quot;&quot; shouldn't cause style recalc unless the property was present.
+        &lt;http://webkit.org/b/115122&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+        Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        This patch implements basic support for regions inside multi-column elements.
-        Currently, the painting and hit-testing logic of CSS Regions is not aware of
-        enclosing multi-column elements. The change is integrated at a layer level by
-        making use of the pre-computed layer fragments during the painting and hit-testing
-        phases for regions.
</del><ins>+        StylePropertySet::setProperty() handles empty strings by removing the property entirely.
+        If there was no property to remove, it shouldn't claim that it changed something, as that
+        will cause the CSSOM wrapper to mark the element for style recalc.
</ins><span class="cx"> 
</span><del>-        There are limitations such that self painting layers found inside the named flow
-        thread layer will not be correctly processed because they don't go through the
-        layer fragment collection step. This is not trivial to implement because the enclosing
-        pagination layer provided by the multi-column element is not visibile from inside
-        the named flow thread layer and they reside in different coordinate systems.
</del><ins>+        A common idiom that triggers this is excessive use of { element.style.display = ''; }
</ins><span class="cx"> 
</span><del>-        A side effect of this patch is the fix of regions incorrect clipping in certain
-        cases (when both a region and its container clip their overflow, the region's
-        content is visible outside the container).
</del><ins>+        * css/StylePropertySet.cpp:
+        (WebCore::MutableStylePropertySet::setProperty):
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/region-clipping.html
-               fast/regions/regions-in-multicol-bt.html
-               fast/regions/regions-in-multicol-hover-overflow.html
-               fast/regions/regions-in-multicol-hover.html
-               fast/regions/regions-in-multicol-lr.html
-               fast/regions/regions-in-multicol-rl.html
-               fast/regions/regions-in-multicol.html
</del><ins>+2013-04-23  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayerContents):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::paintFlowThreadIfRegionForFragments):
-        (WebCore::RenderLayer::hitTestFlowThreadIfRegionForFragments):
-        * rendering/RenderLayer.h:
</del><ins>+        Moving word boundaries backwards fails when there is a text node starting with an apostrophe
+        https://bugs.webkit.org/show_bug.cgi?id=115070
</ins><span class="cx"> 
</span><del>-2014-02-21  Mihai Tica  &lt;mitica@adobe.com&gt;
</del><ins>+        Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        [CSS Blending] Refactor -webkit-blend-mode to -webkit-mix-blend-mode
-        https://bugs.webkit.org/show_bug.cgi?id=128805
</del><ins>+        The bug was caused by previousBoundary erroneously assuming that we don't need any more context if a word
+        boundary is found at the beginning of a string. For example, when &quot;I'll&quot; is split into two text nodes,
+        &quot;I&quot; and &quot;'ll&quot;, there is a word boundary between &quot;'&quot; and &quot;ll&quot; in &quot;'ll&quot; so we need to examine the whole &quot;I'll&quot;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Fixed the bug by obtaining more context when the character starts exactly at offset 1 in a text node to
+        work around this bug. In the long term, we probably need to provide Foundation of the entire context since in
+        languages like Hebrew and some of European languages, there could be many accents and combining characters
+        between split into multiple text nodes as one variant is seen in the newly added test case.
</ins><span class="cx"> 
</span><del>-        The spec defines the mix-blend-mode property. This means that the
-        prefixed version should be -webkit-mix-blend-mode, instead of
-        -webkit-blend-mode.
</del><ins>+        Test: editing/selection/previous-word-boundary-across-text-nodes.html
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::isValidKeywordPropertyAndValue):
-        (WebCore::isKeywordPropertyID):
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPropertyNames.in:
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::DeprecatedStyleBuilder::DeprecatedStyleBuilder):
</del><ins>+        * editing/VisibleUnits.cpp:
+        (WebCore::previousBoundary):
</ins><span class="cx"> 
</span><del>-2014-02-21  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2013-04-24  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Bindings tests rebaseline after r164473.
</del><ins>+        Do not use static string in DiagnosticLoggingKeys
+        https://bugs.webkit.org/show_bug.cgi?id=115093
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/test/ObjC/DOMTestObj.mm:
-        (-[DOMTestObj mutablePoint]):
-        (-[DOMTestObj immutablePoint]):
-        (-[DOMTestObj mutablePointFunction]):
-        (-[DOMTestObj immutablePointFunction]):
-        * bindings/scripts/test/ObjC/DOMTestTypedefs.mm:
-        (-[DOMTestTypedefs immutablePointFunction]):
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-02-21  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        The code is not hot enough to justify keeping the memory around.
+        This removes 3kb from the binary on x86_64.
</ins><span class="cx"> 
</span><del>-        Remove removed symbol from exports list.
</del><ins>+        * page/DiagnosticLoggingKeys.cpp:
+        (WebCore::DiagnosticLoggingKeys::mediaLoadedKey):
+        (WebCore::DiagnosticLoggingKeys::mediaLoadingFailedKey):
+        (WebCore::DiagnosticLoggingKeys::pluginLoadedKey):
+        (WebCore::DiagnosticLoggingKeys::pluginLoadingFailedKey):
+        (WebCore::DiagnosticLoggingKeys::pageContainsPluginKey):
+        (WebCore::DiagnosticLoggingKeys::pageContainsAtLeastOnePluginKey):
+        (WebCore::DiagnosticLoggingKeys::pageContainsMediaEngineKey):
+        (WebCore::DiagnosticLoggingKeys::pageContainsAtLeastOneMediaEngineKey):
+        (WebCore::DiagnosticLoggingKeys::passKey):
+        (WebCore::DiagnosticLoggingKeys::failKey):
+        (WebCore::DiagnosticLoggingKeys::noopKey):
+        * page/DiagnosticLoggingKeys.h:
+        (DiagnosticLoggingKeys):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+2013-04-24  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-02-20  ChangSeok Oh  &lt;changseok.oh@collabora.com&gt;
</del><ins>+        Remove wxWebKit #ifdefs from WebCore/platform/graphics
+        https://bugs.webkit.org/show_bug.cgi?id=115081
</ins><span class="cx"> 
</span><del>-        Rename EXT_draw_buffers to WEBGL_draw_buffers
-        https://bugs.webkit.org/show_bug.cgi?id=128894
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        * platform/graphics/BitmapImage.h:
+        (BitmapImage):
+        * platform/graphics/Color.h:
+        (Color):
+        * platform/graphics/FloatRect.h:
+        (FloatRect):
+        * platform/graphics/FloatSize.h:
+        (FloatSize):
+        * platform/graphics/FontPlatformData.h:
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore):
+        (WebCore::GlyphBuffer::glyphAt):
+        (WebCore::GlyphBuffer::add):
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::drawTiled):
+        * platform/graphics/ImageBufferData.h:
+        * platform/graphics/IntPoint.h:
+        (IntPoint):
+        * platform/graphics/IntRect.h:
+        * platform/graphics/IntSize.h:
+        (IntSize):
+        * platform/graphics/NativeImagePtr.h:
+        (WebCore):
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/SimpleFontData.h:
+        (SimpleFontData):
+        (WebCore::SimpleFontData::widthForGlyph):
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::collectComplexTextRuns):
+        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
+        * platform/graphics/transforms/AffineTransform.h:
+        (AffineTransform):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (TransformationMatrix):
</ins><span class="cx"> 
</span><del>-        I noticed the related spec has changed. Accordingly chromium also changed its implementation
-        to meet the spec. So here I'd like to apply it to webkit as well.
</del><ins>+2013-04-24  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Merged from Blink (patch by bajones):
-        https://src.chromium.org/viewvc/blink?revision=152065&amp;view=revision
</del><ins>+        Remove wxWebKit #ifdefs from WebCore/plugins
+        https://bugs.webkit.org/show_bug.cgi?id=115080
</ins><span class="cx"> 
</span><del>-        Test: fast/canvas/webgl/webgl-draw-buffers.html
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
-        * DerivedSources.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.list.am:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSWebGLRenderingContextCustom.cpp:
-        (WebCore::toJS):
-        * html/canvas/EXTDrawBuffers.idl: Removed.
-        * html/canvas/WebGLDrawBuffers.cpp: Renamed from Source/WebCore/html/canvas/EXTDrawBuffers.cpp.
-        (WebCore::WebGLDrawBuffers::WebGLDrawBuffers):
-        (WebCore::WebGLDrawBuffers::~WebGLDrawBuffers):
-        (WebCore::WebGLDrawBuffers::getName):
-        (WebCore::WebGLDrawBuffers::create):
-        (WebCore::WebGLDrawBuffers::supported):
-        (WebCore::WebGLDrawBuffers::drawBuffersWEBGL):
-        (WebCore::WebGLDrawBuffers::satisfiesWebGLRequirements):
-        * html/canvas/WebGLDrawBuffers.h: Renamed from Source/WebCore/html/canvas/EXTDrawBuffers.h.
-        * html/canvas/WebGLDrawBuffers.idl: Added.
-        * html/canvas/WebGLExtension.h:
-        * html/canvas/WebGLFramebuffer.cpp:
-        (WebCore::WebGLFramebuffer::drawBuffersIfNecessary):
-        * html/canvas/WebGLRenderingContext.cpp:
-        (WebCore::WebGLRenderingContext::getExtension):
-        (WebCore::WebGLRenderingContext::getParameter):
-        (WebCore::WebGLRenderingContext::getSupportedExtensions):
-        (WebCore::WebGLRenderingContext::validateFramebufferFuncParameters):
-        (WebCore::WebGLRenderingContext::supportsDrawBuffers):
-        * html/canvas/WebGLRenderingContext.h:
</del><ins>+        * plugins/PluginView.h:
+        (PluginView):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::snapshot):
</ins><span class="cx"> 
</span><del>-2014-02-20  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+2013-04-24  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        m_ancestorDisabledState should never be unknown
-        https://bugs.webkit.org/show_bug.cgi?id=129084
</del><ins>+        Remove wxWebKit #ifdefs from WebCore/page
+        https://bugs.webkit.org/show_bug.cgi?id=115079
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        In order to resolve the bug 129035, a text form control elements needs to synchronously change
-        its inner text element's editability by setting or unsetting contenteditable content attribute.
-        Before this patch, we could not do this because editability of a text form control dependent on
-        its disabled-ness which was only computed lazily via updateAncestorDisabledState().
</del><ins>+        * page/FrameView.cpp:
+        (WebCore::FrameView::wheelEvent):
+        * page/Settings.cpp:
+        (WebCore):
+        * page/Settings.h:
+        (Settings):
</ins><span class="cx"> 
</span><del>-        This patch makes HTMLFieldSetElement and HTMLFormControlElement update this state synchronously.
-        To avoid O(k) DOM traversal, where k is the depth of the tree, in insertedInto and removedFrom of
-        HTMLFormControlElement on most pages, a new document-level flag, m_disabledFieldsetElementsCount,
-        has been added to indicate whether the document contains any disabled fieldset or not.
</del><ins>+2013-04-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Also renamed the misleadingly named disabledAttributeChanged to disabledStateChanged, and added
-        new function of the same name (disabledAttributeChanged) to be used by HTMLFieldSetElement
-        for keeping the document-level flag up-to-date upon disabled attribute changes.
</del><ins>+        AX: WAI-ARIA landmarks no longer speak type of landmark on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=114547
</ins><span class="cx"> 
</span><del>-        Tests: fast/forms/fieldset/fieldset-disabled-2.html
</del><ins>+        Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::Document): Initializes newly added m_disabledFieldsetElementsCount.
-        (WebCore::Document::~Document): Assert that we've done house keeping right.
-        * dom/Document.h:
-        (WebCore::Document::hasDisabledFieldsetElement): Added.
-        (WebCore::Document::addDisabledFieldsetElement): Added.
-        (WebCore::Document::removeDisabledFieldsetElement): Added.
</del><ins>+        We want iOS to speak the landmark type.
+        I've moved the landmark role description to the base Mac class and exposed
+        these localized strings to iOS (the ones used to return landmark descriptions).
</ins><span class="cx"> 
</span><del>-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::~HTMLFieldSetElement): Removes itself from the owner document.
</del><ins>+        I've also updated the accessibilityLabel to account for landmark type, but also
+        handle multiple label sources more gracefully by appending commas, which changed a few
+        tests in minor ways.
</ins><span class="cx"> 
</span><del>-        (WebCore::updateFromControlElementsAncestorDisabledStateUnder): Added. Updates startNode and
-        its descendants' ancestor disabled flag. We don't update controls under another disabled
-        fieldset element since disabled-ness of those controls aren't affected by startNode.
</del><ins>+        Test: platform/iphone-simulator/accessibility/landmark-type.html
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFieldSetElement::disabledAttributeChanged): Call addDisabledFieldsetElement and
-        removeDisabledFieldsetElement to update the owner document's flag.
</del><ins>+        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityLabel]):
+        * accessibility/mac/WebAccessibilityObjectWrapperBase.h:
+        * accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
+        (-[WebAccessibilityObjectWrapperBase ariaLandmarkRoleDescription]):
+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+        (-[WebAccessibilityObjectWrapper roleDescription]):
+        * platform/LocalizedStrings.cpp:
+        (WebCore):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXMenuListPopupActionVerb):
+        (WebCore::AXMenuListActionVerb):
+        * platform/LocalizedStrings.h:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFieldSetElement::disabledStateChanged): Renamed from disabledAttributeChanged. 
-        Enable form control elements under the first legend element and disable or enable other
-        descendent form controls in accordance with the presence of disabled content attribute.
</del><ins>+2013-04-24  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFieldSetElement::childrenChanged): Update disabled-ness of form controls under
-        child legend elements because controls aren't disabled in the first legend element, and adding
-        or removing child elements may have changed the first legend element.
</del><ins>+        CSS attribute selectors cause unnecessary style recalc when setting attribute to same value.
+        &lt;http://webkit.org/b/115116&gt;
+        &lt;rdar://problem/13727709&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFieldSetElement::didMoveToNewDocument): Update the flag on the owner document.
-        * html/HTMLFieldSetElement.h:
</del><ins>+        Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
-        (WebCore::HTMLFormControlElement::computeIsDisabledByFieldsetAncestor): Returns boolean instead of
-        updating m_ancestorDisabledState internally. Also renamed from updateAncestorDisabledState.
</del><ins>+        The logic that dirties the style if there's a relevant attribute selector in the document
+        shouldn't run if the attribute is being overwritten with an identical value.
+        Move this into willModifyAttribute() instead, since we need access to both the old and the new value.
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFormControlElement::setAncestorDisabled): Replaced ancestorDisabledStateWasChanged.
-        This function updates m_disabledByAncestorFieldset and calls disabledAttributeChanged as needed.
</del><ins>+        This reduces unnecessary style recalculation in Mac App Store content.
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFormControlElement::disabledAttributeChanged): Added. Calls disabledStateChanged.
-        (WebCore::HTMLFormControlElement::disabledStateChanged): Renamed from disabledAttributeChanged.
</del><ins>+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        (WebCore::Element::willModifyAttribute):
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFormControlElement::insertedInto): Update m_disabledByAncestorFieldset if there is
-        a possibility (i.e. the document contains any disabled fieldset element) that this form control
-        is inserted under a disabled fieldset element.
</del><ins>+2013-04-24  Jonathan Feldstein &lt;jfeldstein@blackberry.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFormControlElement::removedFrom): If this form control element is not disabled by
-        a fieldset ancestor, then there is nothing to do. If it is, then check to see if the element is
-        still disabled now that we've lost some ancestors.
</del><ins>+        [BlackBerry] Fixes the San Angeles demo on khronos.org
+        https://bugs.webkit.org/show_bug.cgi?id=115106
</ins><span class="cx"> 
</span><del>-        (WebCore::HTMLFormControlElement::isDisabledFormControl): No longer updates m_ancestorDisabledState
-        lazily since m_disabledByAncestorFieldset is never ambiguous now.
</del><ins>+        Reviewed by Rob Buis
+        Internally Reviewed by Jeremy Nicholl and Arvid Nilsson
</ins><span class="cx"> 
</span><del>-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::disabledByAncestorFieldset): Added.
</del><ins>+        Fixes a bug in which the currently bound vertex array object's vertex array
+        state was being modified as opposed to the default vertex array state.
</ins><span class="cx"> 
</span><del>-2014-02-20  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        * platform/graphics/blackberry/EGLImageLayerWebKitThread.cpp:
+        (EGLImageLayerWebKitThread::blitToFrontBuffer):
</ins><span class="cx"> 
</span><del>-        Remove redundant deviceScaleFactor() functions and make callers use Document::deviceScaleFactor() when accessible.
-        https://bugs.webkit.org/show_bug.cgi?id=129137
</del><ins>+2013-04-24  Nico Weber  &lt;thakis@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Fold RenderThemeMacShared into RenderThemeMac
+        https://bugs.webkit.org/show_bug.cgi?id=115086
</ins><span class="cx"> 
</span><del>-        No change in behavior.
</del><ins>+        Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI):
-        * page/Page.cpp:
-        * page/Page.h:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::GraphicsContext):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::platformInit):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::imageSizeForError):
-        (WebCore::RenderImage::paintReplaced):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::drawPlatformResizerImage):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::drawLineForBoxSide):
</del><ins>+        No intended functionality change.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderThemeMac.h:
+        (RenderThemeMac):
+        (WebCore::RenderThemeMac::supportsControlTints):
+        (WebCore::RenderThemeMac::scrollbarControlSizeForPart):
+        (WebCore::RenderThemeMac::supportsSelectionForegroundColors):
+        (WebCore::RenderThemeMac::supportsClosedCaptioning):
+        (WebCore::RenderThemeMac::updateActiveState):
</ins><span class="cx">         * rendering/RenderThemeMac.mm:
</span><ins>+        (-[WebCoreRenderThemeNotificationObserver initWithTheme:WebCore::]):
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
+        (-[WebCoreTextFieldCell _coreUIDrawOptionsWithFrame:inView:includeFocus:]):
+        (WebCore::RenderThemeMac::RenderThemeMac):
+        (WebCore::RenderThemeMac::~RenderThemeMac):
+        (WebCore::RenderThemeMac::platformActiveSelectionBackgroundColor):
+        (WebCore):
+        (WebCore::RenderThemeMac::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeMac::platformActiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeMac::platformFocusRingColor):
+        (WebCore::RenderThemeMac::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::toFontWeight):
+        (WebCore::RenderThemeMac::systemFont):
+        (WebCore::convertNSColorToColor):
+        (WebCore::menuBackgroundColor):
+        (WebCore::RenderThemeMac::platformColorsDidChange):
+        (WebCore::RenderThemeMac::systemColor):
+        (WebCore::RenderThemeMac::usesTestModeFocusRingColor):
+        (WebCore::RenderThemeMac::isControlStyled):
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        (WebCore::RenderThemeMac::inflateRect):
+        (WebCore::RenderThemeMac::convertToPaintingRect):
+        (WebCore::RenderThemeMac::updateCheckedState):
+        (WebCore::RenderThemeMac::updateEnabledState):
+        (WebCore::RenderThemeMac::updateFocusedState):
+        (WebCore::RenderThemeMac::updatePressedState):
+        (WebCore::RenderThemeMac::controlSupportsTints):
+        (WebCore::RenderThemeMac::controlSizeForFont):
+        (WebCore::RenderThemeMac::setControlSize):
+        (WebCore::RenderThemeMac::sizeForFont):
+        (WebCore::RenderThemeMac::sizeForSystemFont):
+        (WebCore::RenderThemeMac::setSizeFromFont):
+        (WebCore::RenderThemeMac::setFontFromControlSize):
+        (WebCore::RenderThemeMac::controlSizeForSystemFont):
+        (WebCore::RenderThemeMac::paintTextField):
+        (WebCore::RenderThemeMac::adjustTextFieldStyle):
+        (WebCore::RenderThemeMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeMac::paintTextArea):
+        (WebCore::RenderThemeMac::adjustTextAreaStyle):
+        (WebCore::RenderThemeMac::popupButtonMargins):
+        (WebCore::RenderThemeMac::popupButtonSizes):
+        (WebCore::RenderThemeMac::popupButtonPadding):
+        (WebCore::RenderThemeMac::paintMenuList):
+        (WebCore::RenderThemeMac::meterSizeForBounds):
+        (WebCore::RenderThemeMac::paintMeter):
+        (WebCore::RenderThemeMac::supportsMeter):
+        (WebCore::RenderThemeMac::levelIndicatorStyleFor):
+        (WebCore::RenderThemeMac::levelIndicatorFor):
+        (WebCore::RenderThemeMac::progressBarSizes):
+        (WebCore::RenderThemeMac::progressBarMargins):
+        (WebCore::RenderThemeMac::minimumProgressBarHeight):
+        (WebCore::RenderThemeMac::animationRepeatIntervalForProgressBar):
+        (WebCore::RenderThemeMac::animationDurationForProgressBar):
+        (WebCore::RenderThemeMac::adjustProgressBarStyle):
</ins><span class="cx">         (WebCore::RenderThemeMac::paintProgressBar):
</span><del>-        * rendering/svg/SVGRenderingContext.cpp:
-        (WebCore::SVGRenderingContext::calculateTransformationToOutermostCoordinateSystem):
</del><ins>+        (WebCore::TopGradientInterpolate):
+        (WebCore::BottomGradientInterpolate):
+        (WebCore::MainGradientInterpolate):
+        (WebCore::TrackGradientInterpolate):
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        (WebCore::menuListButtonSizes):
+        (WebCore::RenderThemeMac::adjustMenuListStyle):
+        (WebCore::RenderThemeMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeMac::setPopupButtonCellState):
+        (WebCore::RenderThemeMac::menuListSizes):
+        (WebCore::RenderThemeMac::minimumMenuListSize):
+        (WebCore::RenderThemeMac::adjustSliderTrackStyle):
+        (WebCore::RenderThemeMac::paintSliderTrack):
+        (WebCore::RenderThemeMac::adjustSliderThumbStyle):
+        (WebCore::RenderThemeMac::paintSliderThumb):
+        (WebCore::RenderThemeMac::paintSearchField):
+        (WebCore::RenderThemeMac::setSearchCellState):
+        (WebCore::RenderThemeMac::searchFieldSizes):
+        (WebCore::RenderThemeMac::setSearchFieldSize):
+        (WebCore::RenderThemeMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeMac::cancelButtonSizes):
+        (WebCore::RenderThemeMac::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeMac::resultsButtonSizes):
+        (WebCore::RenderThemeMac::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeMac::paintSearchFieldDecoration):
+        (WebCore::RenderThemeMac::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeMac::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeMac::paintSnapshottedPluginOverlay):
+        (WebCore::RenderThemeMac::sliderTickSize):
+        (WebCore::RenderThemeMac::sliderTickOffsetFromTrackCenter):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeMac::shouldShowPlaceholderWhenFocused):
+        (WebCore::RenderThemeMac::popupButton):
+        (WebCore::RenderThemeMac::search):
+        (WebCore::RenderThemeMac::searchMenuTemplate):
+        (WebCore::RenderThemeMac::sliderThumbHorizontal):
+        (WebCore::RenderThemeMac::sliderThumbVertical):
+        (WebCore::RenderThemeMac::textField):
+        (WebCore::RenderThemeMac::fileListNameForWidth):
+        * rendering/RenderThemeMacShared.h: Removed.
+        * rendering/RenderThemeMacShared.mm: Removed.
</ins><span class="cx"> 
</span><del>-2014-02-20  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2013-04-24  ChangSeok Oh  &lt;changseok.oh@collabora.com&gt;
</ins><span class="cx"> 
</span><del>-        Stop generating Objective-C bindings for the SVG DOM
-        &lt;http://webkit.org/b/129107&gt;
</del><ins>+        [GTK][AC] Visible rect doesn't update after resizing a window.
+        https://bugs.webkit.org/show_bug.cgi?id=115096
</ins><span class="cx"> 
</span><del>-        Reviewed by Timothy Hatcher.
</del><ins>+        Reviewed by Gustavo Noronha Silva.
</ins><span class="cx"> 
</span><del>-        Bug 114076 stopped compiling the Objective-C bindings for the
-        SVG DOM, but we continued to generate the header and source
-        files after that landed in r147822.  This patch also stops
-        generating the unused header and source files.
</del><ins>+        Once we set actor's a clip rect, we should update the rect when resizing the actor.
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make:
-        - Split BINDING_IDLS into NON_SVG_BINDING_IDLS and
-          SVG_BINDING_IDLS so that they may operated on separately.
-        - Define BINDING_IDLS again as the full list of IDL files.
-        - Rename DOM_CLASSES to JS_DOM_CLASSES so that JavaScript
-          bindings are still generated for all IDL files.
-        - Add OBJC_DOM_CLASSES so that Objective-C bindings are only
-          generated for non-SVG IDL files.
</del><ins>+        No new tests since no new functionality.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorObjC.pm:
-        (GetBaseClass):
-        (GetPropertyAttributes):
-        (AddIncludesForType):
-        (GenerateHeader):
-        (GenerateImplementation):
-        - Remove support for SVG classes.
</del><ins>+        * platform/graphics/clutter/GraphicsLayerClutter.cpp:
+        (WebCore::GraphicsLayerClutter::setSize):
</ins><span class="cx"> 
</span><del>-2014-02-20  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-04-24  ChangSeok Oh  &lt;changseok.oh@collabora.com&gt;
</ins><span class="cx"> 
</span><del>-        RenderBox::updateShapeOutsideInfoAfterStyleChange shows up on profiles
-        https://bugs.webkit.org/show_bug.cgi?id=129075
</del><ins>+        [GTK][AC] Fix unexpected clear of ClutterContent.
+        https://bugs.webkit.org/show_bug.cgi?id=115099
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Reviewed by Gustavo Noronha Silva.
</ins><span class="cx"> 
</span><del>-        updateShapeOutsideInfoAfterStyleChange() showed up on profiles in content
-        with no shapes. Avoid calling this if no style has shapeOutside().
</del><ins>+        adoptGRef doesn't increase a reference count. So if a actor has a valid ClutterContent,
+        it would be cleared unexpectedly by smart pointer when escaping a function.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::styleDidChange):
</del><ins>+        No new tests, no functionality changed.
</ins><span class="cx"> 
</span><del>-2014-02-20  ChangSeok Oh  &lt;changseok.oh@collabora.com&gt;
</del><ins>+        * platform/graphics/clutter/GraphicsLayerActor.cpp:
+        (graphicsLayerActorUpdateTexture):
</ins><span class="cx"> 
</span><del>-        Remove unused chromium stuff in Extensions3D
-        https://bugs.webkit.org/show_bug.cgi?id=129086
</del><ins>+2013-04-24  Alberto Garcia  &lt;agarcia@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+        DOMFileSystemBase: fix multiple definitions in the BlackBerry port
+        https://bugs.webkit.org/show_bug.cgi?id=114950
</ins><span class="cx"> 
</span><del>-        Remove GL_CHROMIUM_copy_texture and GL_CHROMIUM_flipy interfaces since they are used nowhere.
</del><ins>+        Reviewed by Xan Lopez.
</ins><span class="cx"> 
</span><del>-        No new tests since no functionality changed.
</del><ins>+        The following  methods are already defined in DOMFileSystemBlackBerry.cpp:
</ins><span class="cx"> 
</span><del>-        * platform/graphics/Extensions3D.h:
-        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
-        * platform/graphics/opengl/Extensions3DOpenGL.h:
-        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
-        * platform/graphics/opengl/Extensions3DOpenGLES.h:
</del><ins>+        crackFileSystemURL()
+        createFileSystemURL()
+        isValidType()
+        supportsToURL()
</ins><span class="cx"> 
</span><del>-2014-02-20  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</del><ins>+        * Modules/filesystem/DOMFileSystemBase.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        [iOS] Assert / crash trying to draw empty checked input
-        https://bugs.webkit.org/show_bug.cgi?id=129138
</del><ins>+2013-04-24  George Staikos  &lt;gstaikos@rim.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        [BlackBerry] Add support for JPEG image quality during encoding.
+        https://bugs.webkit.org/show_bug.cgi?id=105773
</ins><span class="cx"> 
</span><del>-        Test: fast/forms/checkbox-empty-size.html
</del><ins>+        Reviewed by Xan Lopez.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeIOS.mm:
-        (WebCore::shortened):
-        Avoid a divide by 0, but checking for the condition upfront.
</del><ins>+        PR 271611
+        Internally reviewed by Liam Quinn.
</ins><span class="cx"> 
</span><del>-2014-02-20  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Pass the quality flag into the encoder, with a default of 65
</ins><span class="cx"> 
</span><del>-        Start fixing the view states driven by the WKScrollView
-        https://bugs.webkit.org/show_bug.cgi?id=129140
</del><ins>+        Covered by existing tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton and Simon Fraser.
</del><ins>+        * platform/image-encoders/JPEGImageEncoder.cpp:
+        (WebCore::compressRGBABigEndianToJPEG):
+        * platform/image-encoders/JPEGImageEncoder.h:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::scaledExposedRect):
-        That comment was more confusing than helping. FrameView-relative coordinates should not need
-        scaling.
</del><ins>+2013-04-24  Csaba Osztrogonác  &lt;ossy@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-02-20  Gyuyoung Kim  &lt;gyuyoung.kim@samsung.com&gt;
</del><ins>+        Fix cast-align WebCore/platform/graphics/GraphicsContext3D.cpp on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=115036
</ins><span class="cx"> 
</span><del>-        Start to use std::unique_ptr for DragImageLoader
-        https://bugs.webkit.org/show_bug.cgi?id=129078
</del><ins>+        Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore):
</ins><span class="cx"> 
</span><del>-        As a step to use std::unique_ptr, this patch replace uses of OwnPtr and PassOwnPtr
-        in the DragImageLoader class with std::unique_ptr. Besides DragImageLoader is set to
-        non-copyable class.
</del><ins>+2013-04-24  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Clipboard.cpp:
-        (WebCore::Clipboard::setDragImage):
-        * dom/Clipboard.h:
</del><ins>+        Remove unnecessary MutableStylePropertySet casts.
+        &lt;http://webkit.org/b/115075&gt;
</ins><span class="cx"> 
</span><del>-2014-02-20  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        Move the image controls setting to Settings.in
-        https://bugs.webkit.org/show_bug.cgi?id=129126
</del><ins>+        Get rid of some now-unneeded static_casts that were left from the StylePropertySet
+        refactoring last weekend.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        * css/StylePropertySet.cpp:
+        (WebCore::MutableStylePropertySet::setProperty):
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::triStateOfStyle):
+        (WebCore::EditingStyle::removeStyleFromRulesAndContext):
</ins><span class="cx"> 
</span><del>-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        * page/Settings.h:
-        * page/Settings.in:
</del><ins>+2013-04-24  Kangil Han  &lt;kangil.han@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-2014-02-20  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+        [Minor code cleanup] Remove duplicated condition check
+        https://bugs.webkit.org/show_bug.cgi?id=115082
</ins><span class="cx"> 
</span><del>-        Add very basic image control rendering
-        https://bugs.webkit.org/show_bug.cgi?id=129080
</del><ins>+        Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        areRectsPartiallyAligned() has duplicated condition check, so remove it.
</ins><span class="cx"> 
</span><del>-        Test: fast/images/image-controls-basic.html
</del><ins>+        * page/SpatialNavigation.cpp:
+        (WebCore::areRectsPartiallyAligned):
</ins><span class="cx"> 
</span><del>-        This patch is groundwork that adds a very basic image control that can render on top of images.
</del><ins>+2013-04-24  Krzysztof Wolanski  &lt;k.wolanski@samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/Node.h:
-        (WebCore::Node:: isImageControlsRootElement): Returns false, unless you are an ImageControls object.
-        * html/HTMLAttributeNames.in:
</del><ins>+        [EFL] Fix build warnings caused by missing images attributes for default buttons
+        https://bugs.webkit.org/show_bug.cgi?id=114955
</ins><span class="cx"> 
</span><del>-        Teach HTMLImageElement how to understand an experimental attribute to install controls,
-        how to actually build the DOM to attach to the shadow root, how to tear that DOM down,
-        and how to make sure that Renderers are created for that DOM:
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::HTMLImageElement):
-        (WebCore::HTMLImageElement::parseAttribute):
-        (WebCore::HTMLImageElement::didAttachRenderers):
-        (WebCore::HTMLImageElement::updateImageControls):
-        (WebCore::HTMLImageElement::createImageControls):
-        (WebCore::HTMLImageElement::destroyImageControls):
-        (WebCore::HTMLImageElement::hasImageControls):
-        (WebCore::HTMLImageElement::childShouldCreateRenderer):
-        * html/HTMLImageElement.h:
-        (WebCore::HTMLImageElement::hasShadowControls): For RenderImage to query when it is constructed. 
</del><ins>+        Reviewed by Gyuyoung Kim.
</ins><span class="cx"> 
</span><del>-        Add a generic, platform independent ImageControls root element that does nothing:
-        * html/shadow/ImageControlsRootElement.cpp: Added.
-        (WebCore::ImageControlsRootElement::maybeCreate):
-        (WebCore::ImageControlsRootElement::ImageControlsRootElement):
-        (WebCore::ImageControlsRootElement::~ImageControlsRootElement):
-        * html/shadow/ImageControlsRootElement.h: Added.
</del><ins>+        Added default image for each button from mediacontrol catalog.
</ins><span class="cx"> 
</span><del>-        Add a Mac-specific ImageControls root element that renders a 20x20 red box (for now):
-        * html/shadow/mac/ImageControlsRootElementMac.cpp: Added.
-        (WebCore::ImageControlsRootElementMac::ImageControlsRootElementMac):
-        (WebCore::ImageControlsRootElementMac::~ImageControlsRootElementMac):
-        (WebCore::ImageControlsRootElement::maybeCreate):
-        (WebCore::ImageControlsRootElementMac::maybeCreate):
-        * html/shadow/mac/ImageControlsRootElementMac.h: Added.
</del><ins>+        No new tests, because there is no change in behavior.
</ins><span class="cx"> 
</span><del>-        Since much of the RenderMedia::layout() method is now required for RenderImage as well,
-        move the logic to RenderImage. The extra work is controlled by a bool flag that will always
-        be set for RenderMedias but will only be set for certain RenderImages:
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::RenderImage):
-        (WebCore::RenderImage::canHaveChildren):
-        (WebCore::RenderImage::layout):
-        (WebCore::RenderImage::layoutShadowControls):
-        * rendering/RenderImage.h:
-        (WebCore::RenderImage::setHasShadowControls):
-        (WebCore::RenderImage::shadowControlsNeedCustomLayoutMetrics):
</del><ins>+        * platform/efl/DefaultTheme/widget/mediacontrol/fullscreenbutton/fullscreen_button.edc:
+        * platform/efl/DefaultTheme/widget/mediacontrol/mutebutton/mute_button.edc:
+        * platform/efl/DefaultTheme/widget/mediacontrol/playpausebutton/playpause_button.edc:
+        * platform/efl/DefaultTheme/widget/mediacontrol/seekbackwardbutton/seekbackward_button.edc:
+        * platform/efl/DefaultTheme/widget/mediacontrol/seekforwardbutton/seekforward_button.edc:
+        * platform/efl/DefaultTheme/widget/mediacontrol/togglecaptionsbutton/toggle_captions_button.edc:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::RenderMedia):
-        * rendering/RenderMedia.h:
-        (WebCore::RenderMedia::shadowControlsNeedCustomLayoutMetrics):
</del><ins>+2013-04-24  Christophe Dumez  &lt;ch.dumez@sisa.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+        Unreviewed build fix with gstreamer 0.10.x after r147555.
</ins><span class="cx"> 
</span><del>-== Rolled over to ChangeLog-2014-02-20 ==
</del><ins>+        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
+        (webKitWebAudioSrcLoop):
+
+== Rolled over to ChangeLog-2013-04-24 ==
</ins><span class="cx">\ No newline at end of file
</span></span></pre>
</div>
</div>

</body>
</html>