<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[172170] branches/safari-537.78-branch/Source/WebCore/ChangeLog</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/172170">172170</a></dd>
<dt>Author</dt> <dd>dburkart@apple.com</dd>
<dt>Date</dt> <dd>2014-08-06 13:19:27 -0700 (Wed, 06 Aug 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Fixup ChangeLog from merge <a href="http://trac.webkit.org/projects/webkit/changeset/169475">r169475</a> -&gt; 171377</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari53778branchSourceWebCoreChangeLog">branches/safari-537.78-branch/Source/WebCore/ChangeLog</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari53778branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-537.78-branch/Source/WebCore/ChangeLog (172169 => 172170)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-537.78-branch/Source/WebCore/ChangeLog        2014-08-06 20:15:09 UTC (rev 172169)
+++ branches/safari-537.78-branch/Source/WebCore/ChangeLog        2014-08-06 20:19:27 UTC (rev 172170)
</span><span class="lines">@@ -1,5 +1,43 @@
</span><span class="cx"> 2014-07-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Merge r169475.
+
+    2014-05-28  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
+
+            Roll r168668 back in.
+
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=132621&gt;
+
+            Reviewed by Brent Fulgham.
+
+            Tests: fast/events/beforeload-assertion.html
+                   fast/events/beforeload-iframe-crash.html
+                   fast/events/beforeload-input-time-crash.html
+
+            * WebCore.exp.in:
+            * dom/Document.cpp:
+            (WebCore::Document::updateLayoutIgnorePendingStylesheets):
+            * dom/Document.h:
+            * html/HTMLAppletElement.cpp:
+            (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+            * html/HTMLEmbedElement.cpp:
+            (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
+            * html/HTMLObjectElement.cpp:
+            (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
+            * page/FrameView.cpp:
+            (WebCore::FrameView::FrameView):
+            (WebCore::FrameView::reset):
+            (WebCore::FrameView::updateEmbeddedObjectsTimerFired):
+            (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
+            (WebCore::FrameView::performPostLayoutTasks):
+            * page/FrameView.h:
+            * testing/Internals.cpp:
+            (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks):
+            * testing/Internals.h:
+            * testing/Internals.idl:
+
+2014-07-22  Dana Burkart  &lt;dburkart@apple.com&gt;
+
</ins><span class="cx">         Merge r152704.
</span><span class="cx"> 
</span><span class="cx">     2013-07-15  Kangil Han  &lt;kangil.han@samsung.com&gt;
</span><span class="lines">@@ -25,51342 +63,35767 @@
</span><span class="cx">             (WebCore::RenderIFrame::isSeamless):
</span><span class="cx">             (WebCore::RenderIFrame::flattenFrame):
</span><span class="cx"> 
</span><del>-2014-05-28  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Roll r168668 back in.
</del><ins>+        Merge r170946
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=132621&gt;
</del><ins>+    2014-07-08  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            Fix flaky loading tests
+            https://bugs.webkit.org/show_bug.cgi?id=133696
</ins><span class="cx"> 
</span><del>-        Tests: fast/events/beforeload-assertion.html
-               fast/events/beforeload-iframe-crash.html
-               fast/events/beforeload-input-time-crash.html
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * dom/Document.cpp:
-        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
-        * dom/Document.h:
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::reset):
-        (WebCore::FrameView::updateEmbeddedObjectsTimerFired):
-        (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
-        (WebCore::FrameView::performPostLayoutTasks):
-        * page/FrameView.h:
-        * testing/Internals.cpp:
-        (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks):
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+            In some cases, the Frame may be destroyed while the loader is
+            initializing. Make sure we don't delete it too early.
</ins><span class="cx"> 
</span><del>-2014-05-29  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::init):
</ins><span class="cx"> 
</span><del>-        Support -apple-system-font on OS X
-        https://bugs.webkit.org/show_bug.cgi?id=133382
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r170135
</ins><span class="cx"> 
</span><del>-        Guard on both family names: &quot;-apple-system-font&quot; and &quot;-webkit-system-font&quot;
</del><ins>+    2014-06-11  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: platform/mac/fast/text/systemFont.html
</del><ins>+            Fix flaky beforeload tests
+            https://bugs.webkit.org/show_bug.cgi?id=133685
</ins><span class="cx"> 
</span><del>-        * platform/mac/WebFontCache.mm:
-        (+[WebFontCache internalFontWithFamily:traits:weight:size:]):
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-2014-05-29  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::loadURL):
</ins><span class="cx"> 
</span><del>-        Loading &lt;object&gt; from WebArchive crashes
-        https://bugs.webkit.org/show_bug.cgi?id=133386
-        &lt;rdar://problem/13345509&gt;
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+        Merge r170513
</ins><span class="cx"> 
</span><del>-        Test: webarchive/loading/object.html
</del><ins>+    2014-06-26  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This (a) fixes the crash, and (b) avoids the crash.
</del><ins>+            [Win] Always NULL-terminate the string in createUTF8String()
+            &lt;http://webkit.org/b/134353&gt;
+            &lt;rdar://problem/17471783&gt;
</ins><span class="cx"> 
</span><del>-        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::continueAfterContentPolicy):
-        Some types of substitute data - such as WebArchive - don't contain HTTP result codes,
-        so let's not drop to &lt;object&gt; fallback content when status is 0.
-        And if the load somehow failed anyway, don't crash by trying to deliver substitute data
-        to a finished loader.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-05-29  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            * plugins/PluginView.cpp:
+            (WebCore::createUTF8String): Pull out CString length into local
+            variable.  Switch to use memcpy.  Always NULL-terminate the
+            string.
</ins><span class="cx"> 
</span><del>-        [iOS WebGL] Fix depth buffer clearing issue.
-        https://bugs.webkit.org/show_bug.cgi?id=133388
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+        Merge r170028
</ins><span class="cx"> 
</span><del>-        No new tests, but this fixes webgl/1.0.1/conformance/canvas/buffer-preserve-test.html.
</del><ins>+    2014-06-16  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/WebGLLayer.mm:
-        (-[WebGLLayer display]):
-        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
-        (WebCore::GraphicsContext3D::prepareTexture):
-        Moved marking the layer as composited from the mac-only prepareTexture to
-        the end of [WebGLLayer display] which is called by mac and iOS.
</del><ins>+            AX: Safari crashed once in WebCore::AccessibilityObject::ariaIsHidden
+            https://bugs.webkit.org/show_bug.cgi?id=133825
</ins><span class="cx"> 
</span><del>-2014-05-29  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        Perserve caption selection in fullscreen.
-        https://bugs.webkit.org/show_bug.cgi?id=133350
</del><ins>+            Sometimes asking accessibilityIsIgnored() will cause a newObject to be detached immediately after its created. 
+            The creation function holds a reference with RefPtr as long as it lives, but when that method returns, the object goes away.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            With that out of the way, I saw the same backtrace lead to updateLayoutIgnorePendingStylesheets being called while still inLayout.
</ins><span class="cx"> 
</span><del>-        Use the logic from the inline player to calculate the selected caption index.
</del><ins>+            I tried my best but could not create a reproducible layout test.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::mediaControlsHost):
-        Expose mediaControlsHost() for use by WebVideoFullscreenModelMediaElement.
</del><ins>+            * accessibility/AXObjectCache.cpp:
+            (WebCore::AXObjectCache::getOrCreate):
+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::AccessibilityObject::updateBackingStore):
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenModelMediaElement.mm:
-        (WebVideoFullscreenModelMediaElement::updateLegibleOptions):
-        Use logic from buildCaptionsMenu from mediaControlsApple.js.
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-29  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+        Merge r170026
</ins><span class="cx"> 
</span><del>-        Use correct version of requiresFullscreenForVideoPlayback().
-        https://bugs.webkit.org/show_bug.cgi?id=133331
</del><ins>+    2014-06-16  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            AX: Crash at WebCore::AXObjectCache::textChanged
+            https://bugs.webkit.org/show_bug.cgi?id=133873
</ins><span class="cx"> 
</span><del>-        Test: media/video-fullscreeen-only-controls.html
</del><ins>+            Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        Update the last place not yet using m_mediaSession-&gt;requiresFullscreenForVideoPlayback.
</del><ins>+            This looks like a very similar problem to 
+            https://bugs.webkit.org/show_bug.cgi?id=133825
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        switch to media session version for requriesFullscreenForVideoPlayback.
</del><ins>+            The object is being created and deallocated almost right away because calling accessibilityIsIgnored triggers
+            a deferred layout that invalidates the associated render element.
</ins><span class="cx"> 
</span><del>-2014-05-29  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            Despite my best efforts, I could not come up with a way to reproduce this in a layout test.
</ins><span class="cx"> 
</span><del>-        [GTK] Add support for HiDPI icons
-        https://bugs.webkit.org/show_bug.cgi?id=133377
</del><ins>+            * accessibility/AXObjectCache.cpp:
+            (WebCore::AXObjectCache::getOrCreate):
</ins><span class="cx"> 
</span><del>-        Reviewed by Martin Robinson.
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Use the GTK+ missing icon at 16 or 32 size depending on the device
-        scale factor.
</del><ins>+        Merge r169849
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::loadMissingImageIconFromTheme):
-        (WebCore::Image::loadPlatformResource):
</del><ins>+    2014-06-11  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-29  Owen Taylor  &lt;otaylor@redhat.com&gt;
</del><ins>+            WindowFeatures arguments shoud ignore invalid characters in values
+            &lt;http://webkit.org/b/133703&gt;
+            &lt;rdar://problem/17254118&gt;
</ins><span class="cx"> 
</span><del>-        [GTK] Add HighDPI support for non-accelerated compositing contents
-        https://bugs.webkit.org/show_bug.cgi?id=131562
</del><ins>+            Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Test: fast/dom/Window/window-property-invalid-characters-ignored.html
</ins><span class="cx"> 
</span><del>-        No new tests. This will be tested once we have the proper dependencies in the WebKit testing
-        JHBuild.
</del><ins>+            * page/WindowFeatures.cpp:
+            (WebCore::WindowFeatures::WindowFeatures): Set |length| based on
+            |buffer|, not |features|.  Switch to using a for loop.  Switch
+            to unsigned types since we are working with positive offsets
+            into a String.
</ins><span class="cx"> 
</span><del>-        * platform/cairo/WidgetBackingStore.h:
-        (WebCore::WidgetBackingStore::WidgetBackingStore): Accept a device scale argument.
-        * platform/cairo/WidgetBackingStoreCairo.cpp: Use the device scale argument to make the surface the proper size and set the surface device scale.
-        * platform/cairo/WidgetBackingStoreCairo.h: Accept a device scale argument.
-        * platform/graphics/cairo/CairoUtilities.cpp: Add a new helper to set the device scale if Cairo built against is new enough.
-        * platform/graphics/cairo/CairoUtilities.h:
-        * platform/gtk/GtkVersioning.h: Add the HAVE_GTK_SCALE_FACTOR macro.
-        * platform/gtk/WidgetBackingStoreGtkX11.cpp: Use the device scale argument to make the surface the proper size and set the surface device scale.
-        * platform/gtk/WidgetBackingStoreGtkX11.h: Accept a device scale argument.
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+        Merge r169848
</ins><span class="cx"> 
</span><del>-        Captions during HLS playback flash/are difficult to readily
-        https://bugs.webkit.org/show_bug.cgi?id=133365
-        &lt;rdar://problem/16584132&gt;
</del><ins>+    2014-06-11  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Viewport arguments should ignore invalid characters in values
+            &lt;http://webkit.org/b/133555&gt;
+            &lt;rdar://problem/17179650&gt;
</ins><span class="cx"> 
</span><del>-        Correct two problems:
-        1. Add new logic to handle cues that are identical to existing cues, except
-           that they cover a slightly later moment in playback. For example, a cue
-           encoding device might emit a cue at 24 fps, with many of the cues containing
-           the same content but covering only 1/24th of a second.
-           
-           Rather than hiding and displaying our cues at the cue encoding rate, we should
-           simply continue to display the same cue as long as the content is unchanged.
-        2. The cue &quot;isEqual&quot; logic for TextTrackCueGeneric improperly short-circuited the
-           VTTCue isEqual logic. This was done to avoid a false failure due to the cue
-           type being 'generic' rather than 'vtt', but incorrectly treated cues with
-           non-matching text as equal.
</del><ins>+            Reviewed by Daniel Bates.
</ins><span class="cx"> 
</span><del>-        * html/track/DataCue.cpp:
-        (WebCore::DataCue::cueContentsMatch): Move cue comparison code to new method that
-        doesn't check that the 'type' of the cue is identical.
-        (WebCore::DataCue::isEqual): Modified to use new 'cueContentsMatch' method.
-        (WebCore::DataCue::isStartOfCue): Confirms cues match except for start and end times.
-        * html/track/DataCue.h:
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::hasCue): Modify to check if a new cue is simply a continuation
-        of an existing cue.
-        * html/track/TextTrackCue.cpp:
-        (WebCore::TextTrackCue::cueContentsMatch): New method containing the equality code
-        that used to live in 'isEqual'.
-        (WebCore::TextTrackCue::isEqual): Modified to use new 'cueContentsMatch' method.
-        (WebCore::TextTrackCue::isStartOfCue): Confirms cues match except for start and
-        end times.
-        * html/track/TextTrackCue.h:
-        * html/track/TextTrackCueGeneric.cpp:
-        (WebCore::TextTrackCueGeneric::cueContentsMatch): New method containing the equality
-        code that used to live in 'isEqual'.
-        (WebCore::TextTrackCueGeneric::isEqual): Modified to use new 'cueContentsMatch' method.
-        (WebCore::TextTrackCueGeneric::isStartOfCue): Confirms cues match except for start and
-        end times.
-        * html/track/TextTrackCueGeneric.h:
-        * html/track/VTTCue.cpp:
-        (WebCore::VTTCue::cueContentsMatch): New method containing the equality code that
-        used to live in 'isEqual'.
-        (WebCore::VTTCue::isEqual): Modified to use new 'cueContentsMatch' method.
-        (WebCore::VTTCue::isStartOfCue): Confirms cues match except for start and end times.
-        * html/track/VTTCue.h:
</del><ins>+            Test: fast/viewport/viewport-warnings-7.html
</ins><span class="cx"> 
</span><del>-2014-05-28  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::processArguments): Set |length| based on
+            |buffer|, not |features|.  Switch to using a for loop.  Switch
+            to unsigned types since we are working with positive offsets
+            into a String.
</ins><span class="cx"> 
</span><del>-        Whoops, update bindings tests results.
</del><ins>+2014-07-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-28  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+        Merge r169726
</ins><span class="cx"> 
</span><del>-        Make DOM properties exposed as instance properties use the base object instead of |this|
-        https://bugs.webkit.org/show_bug.cgi?id=133353
</del><ins>+    2014-06-09  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            Properly reset UStringSearch object in SearchBuffer constructor.
+            https://bugs.webkit.org/show_bug.cgi?id=133662
+            &lt;rdar://problem/17240136&gt;
</ins><span class="cx"> 
</span><del>-        Make the bindings generator emit code that uses the base object for
-        a property, rather than the this object. This means that attributes
-        that we need to be treated as instance properties will match their old
-        instance-based behaviour.
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (InterfaceRequiresAttributesOnInstanceForCompatibility):
-        (InterfaceRequiresAttributesOnInstance):
-        (GetCastingHelperForBaseObject):
-        (GenerateImplementation):
-        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
-        (WebCore::jsTestActiveDOMObjectExcitingAttr):
-        * bindings/scripts/test/JS/JSTestException.cpp:
-        (WebCore::jsTestExceptionName):
-        * bindings/scripts/test/JS/JSTestInterface.cpp:
-        (WebCore::jsTestInterfaceImplementsStr3):
-        (WebCore::jsTestInterfaceSupplementalStr3):
-        (WebCore::setJSTestInterfaceConstructorImplementsStaticAttr):
-        (WebCore::setJSTestInterfaceImplementsStr2):
-        (WebCore::setJSTestInterfaceImplementsStr3):
-        (WebCore::setJSTestInterfaceImplementsNode):
-        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
-        (WebCore::setJSTestInterfaceSupplementalStr2):
-        (WebCore::setJSTestInterfaceSupplementalStr3):
-        (WebCore::setJSTestInterfaceSupplementalNode):
-        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
-        (WebCore::setJSTestNondeterministicNondeterministicWriteableAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicExceptionAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicGetterExceptionAttr):
-        (WebCore::setJSTestNondeterministicNondeterministicSetterExceptionAttr):
-        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
-        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
-        (WebCore::jsTestTypedefsConstructorTestSubObj):
-        (WebCore::setJSTestTypedefsUnsignedLongLongAttr):
-        (WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
-        (WebCore::setJSTestTypedefsAttrWithGetterException):
-        (WebCore::setJSTestTypedefsAttrWithSetterException):
-        (WebCore::setJSTestTypedefsStringAttrWithGetterException):
-        (WebCore::setJSTestTypedefsStringAttrWithSetterException):
</del><ins>+            * editing/TextIterator.cpp: (WebCore::SearchBuffer::~SearchBuffer):
</ins><span class="cx"> 
</span><del>-2014-05-28  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2014-07-18  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WK2] Improve behavior of position:fixed inside accelerated overflow-scroll
-        https://bugs.webkit.org/show_bug.cgi?id=133352
</del><ins>+        Merge r169318
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+    2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When adjusting layers inside accelerated overflow-scroll, pass a delta
-        down to descendant nodes. Fix behavior of sticky nodes inside fixed nodes
-        inside overflow scroll (sticky should only be affected if the parent node
-        is a scrolling node).
</del><ins>+            Crash in WebCore::TextResourceDecoder::checkForCSSCharset
+            &lt;http://webkit.org/b/133257&gt;
+            &lt;rdar://problem/17027109&gt;
</ins><span class="cx"> 
</span><del>-        * page/scrolling/mac/ScrollingTreeFixedNode.mm:
-        (WebCore::ScrollingTreeFixedNode::updateLayersAfterAncestorChange): Just remove
-        some .get()
-        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
-        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange): Remove .get()s.
-        We never care about the cumulative delta here, because sticky nodes only respond to
-        changes in their direct scrolling ancestors. Only adjust the layer if the parent
-        is a scrolling node.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-2014-05-27  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+            Test: fast/encoding/css-charset-missing-semi-colon-and-newline.html
</ins><span class="cx"> 
</span><del>-        AX: WebKit does not recognize ARIA 1.1 tables
-        https://bugs.webkit.org/show_bug.cgi?id=133163
</del><ins>+            * loader/TextResourceDecoder.cpp:
+            (WebCore::TextResourceDecoder::checkForCSSCharset): Add early
+            return.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-05-30  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The AXObjectCache code that determines which object to create based on the role needs to be token fallback aware.
</del><ins>+        Supplementary build fix for &lt;rdar://problem/16848509&gt;, borrowed from &lt;rdar://problem/16701806&gt;.
</ins><span class="cx"> 
</span><del>-        Test: accessibility/table-fallback-roles-expose-element-attributes.html
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        * accessibility/AXObjectCache.cpp:
-        (WebCore::nodeHasRole):
</del><ins>+2014-05-29  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-28  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Build fix for Mavericks
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): Invalid layout in multicol
-        https://bugs.webkit.org/show_bug.cgi?id=133322
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+2014-05-29  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        In some situations, deleting the line boxes of a multicol element causes the line to region
-        link to become invalid.
</del><ins>+        Build fix
</ins><span class="cx"> 
</span><del>-        Test: fast/multicol/newmulticol/multicol-inside-multicol.html
</del><ins>+        * WebCore.exp.in:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::clearLinesToRegionMap):
-        (WebCore::RenderFlowThread::deleteLines):
-        (WebCore::RenderFlowThread::willBeDestroyed):
-        * rendering/RenderFlowThread.h:
</del><ins>+2014-05-27  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-28  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        Workaround for &lt;rdar://problem/16848509&gt;
</ins><span class="cx"> 
</span><del>-        Remove DocumentThreadableLoaderClient.h
-        https://bugs.webkit.org/show_bug.cgi?id=133341
</del><ins>+        Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
</ins><span class="cx"> 
</span><del>-        DocumentThreadableLoaderClient is not used anymore.
</del><ins>+2014-05-27  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.order:
-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::redirectReceived):
-        * loader/DocumentThreadableLoaderClient.h: Removed.
-        * loader/ThreadableLoaderClient.h:
-        (WebCore::ThreadableLoaderClient::isDocumentThreadableLoaderClient): Deleted.
-
-2014-05-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
-
-        Unreviewed. Update GObject DOM bindings symbols file after r169017.
-
-        * bindings/gobject/webkitdom.symbols: Add webkit_dom_navigator_get_hardware_concurrency.
-
-2014-05-28  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
-
-        REGRESSION(r168868): [GTK] Element.offset* client* scroll* API changed
-        https://bugs.webkit.org/show_bug.cgi?id=133313
-
-        Reviewed by Philippe Normand.
-
-        Keep old API that uses long also for GObject bindings.
-
-        * dom/Element.idl:
-
-2014-05-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
-
-        Unreviewed, rolling out r169400.
-        https://bugs.webkit.org/show_bug.cgi?id=133338
-
-        Broke the iOS build in
-        LocalizedDateCache::calculateMaximumWidth() (Requested by smfr
-        on #webkit).
-
-        Reverted changeset:
-
-        &quot;SVG TextRuns do not always get RenderingContexts&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=133198
-        http://trac.webkit.org/changeset/169400
-
-2014-05-27  Timothy Horton  &lt;timothy_horton@apple.com&gt;
-
-        REGRESSION (Margin tiles): Background gradient on dom.spec.whatwg.org is very slow to render
-        https://bugs.webkit.org/show_bug.cgi?id=133335
-        &lt;rdar://problem/17011392&gt;
-
-        Reviewed by Simon Fraser.
-
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::drawTiled):
-        Make cross-platform and use some iOS code which avoids patterned drawing when the pattern buffer
-        would be very large. Instead, it calls draw() repeatedly over the pattern space, avoiding the allocation
-        of a huge (in the case of bug 133335, nearly 2GB) buffer.
-
-2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        [iOS WK2] Fix behavior of position:sticky inside accelerated overflow-scroll
-        https://bugs.webkit.org/show_bug.cgi?id=133334
-        &lt;rdar://problem/16462535&gt;
-
-        Reviewed by Tim Horton.
-
-        When the scroll position changes in an accelerated overflow-scroll element, we have
-        to update child nodes in the scrolling tree for position:sticky. That requires a
-        more generic ability to update the scrolling tree after some arbitrary zoom or
-        scroll. To do this, we need to know the current fixed position rect, rather than
-        having it passed in.
</del><ins>+        Fix for &lt;rdar://problem/17020210&gt;
+        Fix by Jon Honeycutt.
</ins><span class="cx">         
</span><del>-        So make the fixed position rect available from ScrollingTree, and make it possible
-        to get the current scrollPosition() from any ScrollingTreeScrollingNode.
-        
-        Also, implement updateLayersAfterDelegatedScroll() in ScrollingTreeOverflowScrollingNodeIOS,
-        and have it update descendant layers.
-        
-        Finally, fix ScrollingTreeOverflowScrollingNode to use the correct rectangle for its
-        constraints math, using the scroll position of the parent node if appropriate.
-
-        * page/scrolling/ScrollingTree.h:
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
-        * page/scrolling/ios/ScrollingTreeIOS.cpp:
-        (WebCore::ScrollingTreeIOS::fixedPositionRect):
-        * page/scrolling/ios/ScrollingTreeIOS.h:
-        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
-        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange):
-
-2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Do some renaming in the scrolling tree
-        https://bugs.webkit.org/show_bug.cgi?id=133333
-
-        Reviewed by Tim Horton.
-
-        Rename ScrollingTreeNode::parentScrollPositionDidChange() to updateLayersAfterAncestorChange()
-        since this goes deep and to indicate that it's about layer updating.
-        
-        Also rename the &quot;viewportRect&quot; parameter to &quot;fixedPositionRect&quot;, since on iOS
-        this is the custom fixed-position rect that changes on zooming.
-
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::viewportChangedViaDelegatedScrolling):
-        * page/scrolling/ScrollingTree.h:
-        * page/scrolling/ScrollingTreeFrameScrollingNode.h:
-        * page/scrolling/ScrollingTreeNode.h:
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h:
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterViewportChange):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
-        * page/scrolling/mac/ScrollingTreeFixedNode.h:
-        * page/scrolling/mac/ScrollingTreeFixedNode.mm:
-        (WebCore::ScrollingTreeFixedNode::updateLayersAfterAncestorChange):
-        (WebCore::ScrollingTreeFixedNode::parentScrollPositionDidChange): Deleted.
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
-        * page/scrolling/mac/ScrollingTreeStickyNode.h:
-        * page/scrolling/mac/ScrollingTreeStickyNode.mm:
-        (WebCore::ScrollingTreeStickyNode::updateLayersAfterAncestorChange):
-        (WebCore::ScrollingTreeStickyNode::parentScrollPositionDidChange): Deleted.
-
-2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Instantiate a ScrollingTreeMac on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=133332
-
-        Reviewed by Tim Horton.
-
-        Mac previously instantiated a ThreadedScrollingTree, but this has no platform
-        knowledge. To support future expansion, create a ScrollingTreeMac subclass and
-        instantiate that on Mac.
-        
-        Also protect ScrollingCoordinatorMac in PLATFORM(MAC) #ifdefs and remove it from the
-        EXCLUDED_SOURCE_FILE_NAMES list in the xcconfig file, following general trends.
-
-        * Configurations/WebCore.xcconfig:
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/scrolling/ThreadedScrollingTree.cpp:
-        (WebCore::ThreadedScrollingTree::create): Deleted.
-        * page/scrolling/ThreadedScrollingTree.h:
-        * page/scrolling/mac/ScrollingCoordinatorMac.h:
-        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
-        (WebCore::ScrollingCoordinatorMac::ScrollingCoordinatorMac):
-        * page/scrolling/mac/ScrollingTreeMac.cpp: Copied from Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h.
-        (ScrollingTreeMac::create):
-        (ScrollingTreeMac::ScrollingTreeMac):
-        * page/scrolling/mac/ScrollingTreeMac.h: Copied from Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.h.
-
-2014-05-27  Simon Fraser  &lt;simon.fraser@apple.com&gt;
-
-        Prepare for position:sticky support inside accelerated overflow-scroll with WK2
-        https://bugs.webkit.org/show_bug.cgi?id=133329
-
-        Reviewed by Tim Horton.
-
-        RenderLayerCompositor::computeStickyViewportConstraints() was always using
-        the viewport rect as the constraining rect for sticky position. This is not
-        correct when inside overflow:scroll.
-        
-        Refactor code in RenderBoxModelObject to make getting the rect easy, and use
-        it to compute the constraints.
-
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::constrainingRectForStickyPosition):
-        (WebCore::RenderBoxModelObject::stickyPositionOffset):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::computeStickyViewportConstraints):
-
-2014-05-27  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
-
-        vw/vh units used as font/line-height values don't scale with the viewport
-        https://bugs.webkit.org/show_bug.cgi?id=87846
-
-        Reviewed by Darin Adler.
-
-        This patch moves the resolution of viewport units to style recalc
-        time. Currently viewport units are left unresolved during style
-        recalcs, which leads to many problems with viewport units. Moving the
-        resolution will fix these problems, as well as reduce the plumbing
-        that goes on.
-
-        This patch touches a lot of files since the valueForLength functions
-        no longer need a RenderView. The interesting changes are in:
-
-        - CSSToLengthConversionData -&gt; CSSPrimitiveValue: for moving
-            resolution to style recalc time.
-        - Length / LengthFunctions: no longer needs to know about viewport
-            units.
-        - FrameView -&gt; Document -&gt; StyleResolver: for scheduling style recalcs
-            upon resize
-
-        Note that getComputedStyle will now return pixel values when viewport
-        units are used. This behavior matches Firefox and the css3-cascade
-        spec.
-
-        This is based on a Blink patch by timloh@chromium.org.
-
-        Tests: css3/viewport-percentage-lengths/viewport-percentage-lengths-anonymous-block.html
-               css3/viewport-percentage-lengths/viewport-percentage-lengths-calc.html
-               css3/viewport-percentage-lengths/viewport-percentage-lengths-percent-size-child.html
-               css3/viewport-percentage-lengths/viewport-percentage-lengths-relative-font-size.html
-               css3/viewport-percentage-lengths/viewport-percentage-lengths-resize.html
-
-        * WebCore.exp.in: Remove RenderView argument to floatValueForLength.
-        * accessibility/atk/WebKitAccessibleInterfaceText.cpp: 
-        (getAttributeSetForAccessibilityObject): Remove RenderView argument.
-        * css/BasicShapeFunctions.cpp:
-        (WebCore::convertToLength): Ditto.
-        (WebCore::floatValueForCenterCoordinate): Ditto.
-        * css/BasicShapeFunctions.h: Ditto.
-        * css/CSSCalculationValue.cpp:
-        (WebCore::unitCategory): Remove special handling for viewport units,
-            as they get resolved to pixels.
-        (WebCore::createCSS): Ditto.
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::positionOffsetValue): Remove RendewView argument.
-        (WebCore::getBorderRadiusCornerValues): Remove handling of viewport
-            units, as they are already resolve to pixels here.
-        (WebCore::getBorderRadiusCornerValue): Remove RenderView argument.
-        (WebCore::getBorderRadiusShorthandValue): Ditto.
-        (WebCore::specifiedValueForGridTrackBreadth): Remove handling of
-            viewport units, as they are already resolved to pixels here.
-        (WebCore::specifiedValueForGridTrackSize): Remove RenderView argument.
-        (WebCore::valueForGridTrackList): Ditto.
-        (WebCore::lineHeightFromStyle): Ditto.
-        (WebCore::ComputedStyleExtractor::propertyValue): Ditto.
-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSLinearGradientValue::createGradient): Pass RenderView to
-            CSSToLengthConversionData constructor.
-        (WebCore::CSSRadialGradientValue::createGradient): Ditto.
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::unitCategory): Remove handling of
-            viewport units, as they get resolved to pixels.
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Ditto.
-        (WebCore::CSSPrimitiveValue::init): Ditto.
-        (WebCore::CSSPrimitiveValue::computeLengthDouble): Resolve viewport
-            units to pixels.
-        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory): Remove
-        handling of viewport units, since they get resolved to pixels.
-        (WebCore::CSSPrimitiveValue::viewportPercentageLength): Deleted.
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::isLength): Remove special handling of
-            viewport units, since they get resolved to pixels.
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::convertToLength): Ditto.
-        * css/CSSToLengthConversionData.cpp:
-        (WebCore::CSSToLengthConversionData::viewportWidthFactor): Caclulate
-            conversion factor for viewport units to pixels. Note this does not
-            set hasViewportUnits on the RenderStyle if computing the font
-            size, because in the font size case, the RenderStyle is the
-            parent's style, not the current renderer's style.
-        (WebCore::CSSToLengthConversionData::viewportHeightFactor): Ditto.
-        (WebCore::CSSToLengthConversionData::viewportMinFactor): Ditto.
-        (WebCore::CSSToLengthConversionData::viewportMaxFactor): Ditto.
-        * css/CSSToLengthConversionData.h:
-        (WebCore::CSSToLengthConversionData::CSSToLengthConversionData): Add
-            RenderView parameter, and make RenderStyle non-const so that
-            hasViewportUnits can be set on the Style..
-        (WebCore::CSSToLengthConversionData::style): style is now non-const.
-        (WebCore::CSSToLengthConversionData::copyWithAdjustedZoom): Handle
-            RenderView argument.
-        * css/CSSToStyleMap.cpp:
-        (WebCore::CSSToStyleMap::mapFillXPosition): Remove handling of
-            viewport units, as they are already resolved to pixels here.
-        (WebCore::CSSToStyleMap::mapFillYPosition): Ditto.
-        * css/DeprecatedStyleBuilder.cpp:
-        (WebCore::ApplyPropertyLength::applyValue): Ditto.
-        (WebCore::ApplyPropertyBorderRadius::applyValue): Ditto.
-        (WebCore::ApplyPropertyComputeLength::applyValue): Ditto.
-        (WebCore::ApplyPropertyFontSize::applyValue): Ditto.
-        (WebCore::ApplyPropertyLineHeight::applyValue): Ditto.
-        (WebCore::ApplyPropertyLineHeightForIOSTextAutosizing::applyValue): Ditto.
-        (WebCore::ApplyPropertyWordSpacing::applyValue): Ditto.
-        (WebCore::ApplyPropertyVerticalAlign::applyValue): Ditto.
-        (WebCore::ApplyPropertyTextIndent::applyValue): Ditto.
-        * css/LengthFunctions.cpp:
-        (WebCore::minimumIntValueForLength): Remove RenderView argument.
-        (WebCore::intValueForLength): Remove RenderView argument and
-            roundPecentages.
-        (WebCore::minimumValueForLength): Remove RenderView argument, and
-            special handling of viewport units.
-        (WebCore::valueForLength): Ditto.
-        (WebCore::floatValueForLength): Ditto.
-        (WebCore::floatSizeForLengthSize): Remove RenderView argument.
-        * css/LengthFunctions.h: Ditto.
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::MediaQueryEvaluator::eval): Add RenderView argument for
-            CSSToLengthConversionData constuctor.
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::State::clear): Change to 0 arg constructor
-            for CSSToLengthConversionData.
-        (WebCore::StyleResolver::State::updateConversionData): In order to get
-            the RenderView, we need to have a valid Element set on the state.
-            Since this means that we need to set the conversion data in more
-            places, move the contruction of conversion data into this helper
-            method.
-        (WebCore::StyleResolver::State::initElement): Make sure conversion
-            data is up to date.
-        (WebCore::StyleResolver::State::initForStyleResolve): Ditto.
-        (WebCore::StyleResolver::State::setStyle): When the style is set, we
-            need to make sure to update the conversion data.
-        (WebCore::StyleResolver::styleForElement): If the style has viewport
-            units, flage the document so that we can make sure to recalc the
-            viewport unit values when the viewport is resized.
-        (WebCore::StyleResolver::pseudoStyleForElement): Ditto.
-        (WebCore::StyleResolver::updateFont): Make sure the font having
-            viewport units updates the style.
-        (WebCore::StyleResolver::convertToIntLength): Remove handling of
-        viewport units, as they are resolved to pixels.
-        (WebCore::StyleResolver::convertToFloatLength): Ditto.
-        (WebCore::StyleResolver::clearCachedPropertiesAffectedByViewportUnits):
-            Invalidate the matched properties cache for styles with viewport
-            units when the viewport is resized.
-        (WebCore::createGridTrackBreadth): Remove handling of viewport units,
-            as they are resolved to pixels.
-        (WebCore::StyleResolver::applyProperty): Ditto.
-        (WebCore::StyleResolver::hasMediaQueriesAffectedByViewportChange):
-            Rename to be less confusing, since it has nothing to do with
-            viewport units.
-        (WebCore::StyleResolver::createFilterOperations): Remove handling of
-            viewport units, as they are resolved to pixels.
-        (WebCore::StyleResolver::affectedByViewportChange): Deleted.
-        (WebCore::StyleResolver::viewportPercentageValue): Deleted.
-        * css/StyleResolver.h:
-        (WebCore::StyleResolver::State::State): C++11 cleanup: 0 -&gt; nullptr.
-        (WebCore::StyleResolver::State::setFontSizeHasViewportUnits): Set if
-            the font size is specified in viewport units.
-        (WebCore::StyleResolver::State::fontSizeHasViewportUnits): Ditto.
-        (WebCore::StyleResolver::State::setStyle): Deleted.
-        * css/TransformFunctions.cpp:
-        (WebCore::convertToFloatLength): Remove handling of viewport units,
-            since they are resolved to pixels.
-        * dom/Document.cpp:
-        (WebCore::Document::Document): Add flag to determine if some style in
-            the document has viewport units.
-        (WebCore::Document::pageSizeAndMarginsInPixels): Remove RenderView
-            argument.
-        (WebCore::Document::updateViewportUnitsOnResize): Mark elements with
-            viewport units for style recalc when the viewport size has
-            changed.
-        * dom/Document.h:
-        (WebCore::Document::setHasStyleWithViewportUnits): Flag to determine
-            if some style in the document has viewport units.
-        (WebCore::Document::hasStyleWithViewportUnits): Ditto.
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::getRegion): Remove RenderView argument.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout): When the viewport is resized, call
-            updateViewportUnitsOnResize on the document.
-        * platform/Length.h:
-        (WebCore::Length::isSpecified): Remove handling of viewport units,
-            since they are now resolved to pixels.
-        (WebCore::Length::viewportPercentageLength): Deleted.
-        (WebCore::Length::isViewportPercentage): Deleted.
-        * rendering/ClipPathOperation.h:
-        (WebCore::ShapeClipPathOperation::pathForReferenceRect): Remove
-            RenderView argument.
-        (WebCore::BoxClipPathOperation::pathForReferenceRect): Ditto.
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::updateBlockChildDirtyBitsBeforeLayout): Remove
-            handling of viewport units, since they get updated by
-            updateViewportUnitsOnResize when the viewport is resized.
-        (WebCore::RenderBlock::nodeAtPoint): Remove RenderView argument.
-        (WebCore::RenderBlock::lineHeight): Ditto.
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintBoxDecorations): Remove RenderView argument.
-        (WebCore::RenderBox::computeContentAndScrollbarLogicalHeightUsing):
-            Remove handling of viewport units, as they are resolved to pixels.
-        (WebCore::RenderBox::computePercentageLogicalHeight): Ditto.
-        (WebCore::RenderBox::computeReplacedLogicalWidthUsing): Ditto.
-        (WebCore::RenderBox::computeReplacedLogicalHeightUsing): Ditto.
-        (WebCore::RenderBox::hasViewportPercentageLogicalHeight): Deleted.
-        * rendering/RenderBox.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect): Remove
-            RenderView argument.
-        (WebCore::RenderBoxModelObject::calculateFillTileSize): Remove
-            handling of viewport units, as they are resolved to pixels.
-        (WebCore::computeBorderImageSide): Remove RenderView argument.
-        (WebCore::RenderBoxModelObject::paintNinePieceImage): Ditto.
-        (WebCore::RenderBoxModelObject::paintBorder): Ditto.
-        (WebCore::RenderBoxModelObject::paintBoxShadow): Ditto.
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::repaintAfterLayoutIfNeeded): Ditto.
-        * rendering/RenderElement.h:
-        (WebCore::RenderElement::valueForLength): Remove unused
-            roundPercentages argument.
-        (WebCore::RenderElement::minimumValueForLength): Remove unused
-            RoundPercentages and RenderView arguments.
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::layoutGridItems): Remove handling of viewport
-            units as they are resolved to pixels.
-        * rendering/RenderInline.cpp:
-        (WebCore::computeMargin): Ditto.
-        (WebCore::RenderInline::lineHeight): Remove RenderView argument.
</del><span class="cx">         * rendering/RenderLayer.cpp:
</span><del>-        (WebCore::RenderLayer::setupClipPath): Ditto.
-        * rendering/RenderLineBreak.cpp:
-        (WebCore::RenderLineBreak::lineHeight): Ditto.
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::calcScrollbarThicknessUsing): Ditto.
-        (WebCore::RenderScrollbarPart::computeScrollbarWidth): Ditto.
-        (WebCore::RenderScrollbarPart::computeScrollbarHeight): Ditto.
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::convertStyleLogicalHeightToComputedHeight):
-            Remove handling of viewport units, since they are resolved to
-            pixels.
-        (WebCore::RenderTable::computePreferredLogicalWidths): Now that
-            viewport unit values are resolved to pixels at style recalc time,
-            no special checking is needed to handle them, so update the
-            comment to reflect that.
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::applyCommonButtonPaddingToStyle): Add RenderView argument to
-            CSSToLengthConversionData constructor.
-        (WebCore::RenderThemeIOS::adjustButtonStyle): Ditto.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Remove
-            RenderView argument.
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::layout): Remove handling of viewport units,
-            since they are resolved to pixels.
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::ascentAndDescentForBox): Remove RenderView
-            argument.
-        * rendering/shapes/Shape.cpp:
-        (WebCore::Shape::createShape): Remove RenderView argument.
-        * rendering/shapes/Shape.h:
-        * rendering/shapes/ShapeOutsideInfo.cpp:
-        (WebCore::ShapeOutsideInfo::computedShape): Ditto.
-        * rendering/style/BasicShapes.cpp:
-        (WebCore::BasicShapeCircle::floatValueForRadiusInBox): Ditto.
-        (WebCore::BasicShapeCircle::path): Ditto.
-        (WebCore::BasicShapeEllipse::floatValueForRadiusInBox): Ditto.
-        (WebCore::BasicShapeEllipse::path): Ditto.
-        (WebCore::BasicShapePolygon::path): Ditto.
-        (WebCore::floatSizeForLengthSize): Ditto.
-        (WebCore::BasicShapeInset::path): Ditto.
-        * rendering/style/BasicShapes.h:
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::calcRadiiFor): Ditto.
-        (WebCore::RenderStyle::getRoundedBorderFor): Ditto.
-        (WebCore::RenderStyle::computedLineHeight): Remove handling of
-            viewport units since they are resolved to pixels.
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::setHasViewportUnits): Set if this style has
-        a property set with viewport units.
-        (WebCore::RenderStyle::hasViewportUnits): Ditto.
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::resolveLengthAttributeForSVG): Remove RenderView argument.
-        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): Ditto.
-        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Ditto.
-        * rendering/svg/SVGRenderingContext.cpp:
-        (WebCore::SVGRenderingContext::prepareToRenderSVGContent): Ditto.
</del><ins>+        (WebCore::RenderLayer::filterNeedsRepaint):
</ins><span class="cx"> 
</span><del>-2014-05-27  Zoltan Horvath  &lt;zoltan@webkit.org&gt;
</del><ins>+2014-05-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] serialization of the computed value should omit the default radii
-        https://bugs.webkit.org/show_bug.cgi?id=132747
</del><ins>+    Rollout r169219
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-05-23  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        We should omit closest-side value, whereever is possible. Specification:
-        http://www.w3.org/TR/2014/CR-css-shapes-1-20140320/#basic-shape-computed-values 
-        This change aligns the behavior to the specification.
</del><ins>+        Merge r165862
</ins><span class="cx"> 
</span><del>-        Added new test cases for the shape-outside parsing tests.
</del><ins>+        2014-03-18  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSBasicShapes.cpp:
-        (WebCore::buildCircleString):
-        (WebCore::CSSBasicShapeCircle::cssText):
-        (WebCore::CSSBasicShapeEllipse::cssText):
</del><ins>+                Unify &lt;media&gt; element callback registration and unregistration
+                https://bugs.webkit.org/show_bug.cgi?id=130417
</ins><span class="cx"> 
</span><del>-2014-05-27  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+                Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r169399.
-        https://bugs.webkit.org/show_bug.cgi?id=133326
</del><ins>+                * html/HTMLMediaElement.cpp:
+                (WebCore::HTMLMediaElement::HTMLMediaElement):
+                (WebCore::HTMLMediaElement::~HTMLMediaElement):
+                (WebCore::HTMLMediaElement::registerWithDocument):
+                (WebCore::HTMLMediaElement::unregisterWithDocument):
+                (WebCore::HTMLMediaElement::didMoveToNewDocument):
+                * html/HTMLMediaElement.h:
</ins><span class="cx"> 
</span><del>-        Causes assertion failures in tests.  See
-        http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r169399%20(5622)/results.html
-        (Requested by mlam on #webkit).
</del><ins>+2014-05-23  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        Merge r160847
</ins><span class="cx"> 
</span><del>-        &quot;Caret's screen position does not update during an overflow
-        scroll&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=133256
-        http://trac.webkit.org/changeset/169399
</del><ins>+    2013-12-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+            overflowchanged event could cause a crash
+            https://bugs.webkit.org/show_bug.cgi?id=125978
</ins><span class="cx"> 
</span><del>-        Lists styled with SVG fonts are not rendered as expected
-        https://bugs.webkit.org/show_bug.cgi?id=133198
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Made the event asynchrnous by re-using Document's event queuing ability. Also removed
+            the infrastructure to queue up events in FrameView.
</ins><span class="cx"> 
</span><del>-        There were a couple places in RenderListMarker and RenderMenuList that were
-        implicitly creating TextRuns by passing a String to a function which
-        expected a TextRun. Because TextRun has a constructor which takes a single
-        String and isn't marked explicit, TextRuns were being created without
-        any of the associated code that initializes the TextRun (such as creating
-        a RenderingContext if necessary).
</del><ins>+            Test: fast/events/overflowchanged-inside-selection-collapse-crash.html
</ins><span class="cx"> 
</span><del>-        This patch marks the aforementioned constructor as &quot;explicit&quot; to discourage
-        such behavior in the future.
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::recalcStyle):
+            (WebCore::Document::enqueueOverflowEvent):
+            * dom/Document.h:
+            * page/FrameView.cpp:
+            (WebCore::FrameView::FrameView):
+            (WebCore::FrameView::~FrameView):
+            (WebCore::FrameView::layout):
+            (WebCore::FrameView::performPostLayoutTasks):
+            (WebCore::FrameView::updateOverflowStatus):
+            * page/FrameView.h:
+            * rendering/RenderBlock.cpp:
+            (WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
+            * rendering/RenderLayer.cpp:
+            (WebCore::RenderLayer::scrollRectToVisible):
+            * rendering/RenderMarquee.cpp:
+            (WebCore::RenderMarquee::start):
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/list-items-with-svg-font-family.html
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/TextRun.h:
-        (WebCore::TextRun::TextRun): Mark constructors as explicit.
-        * rendering/RenderListMarker.cpp:
-        (WebCore::RenderListMarker::computePreferredLogicalWidths): Call
-        RenderBlock::constructTextRun.
-        (WebCore::RenderListMarker::getRelativeMarkerRect): Ditto.
-        * rendering/RenderMenuList.cpp:
-        (RenderMenuList::updateOptionsWidth): Ditto.
</del><ins>+        Merge r168915
</ins><span class="cx"> 
</span><del>-2014-05-23  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+    2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Caret's screen position does not update during an overflow scroll
-        https://bugs.webkit.org/show_bug.cgi?id=133256
</del><ins>+            SVG element may reference arbitrary DOM element before running its insertion logic
+            https://bugs.webkit.org/show_bug.cgi?id=132757
+            &lt;rdar://problem/15703817&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        During a scroll, we set a flag which caret position is gated on, but we never
-        actually invalidate the caret's position. This patch does so.
</del><ins>+            Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
+            inserted in the tree.
</ins><span class="cx"> 
</span><del>-        Test: editing/input/caret-position-during-scroll.html
</del><ins>+            Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
+            element B it references (if any). If A is inserted before B and B has the same id as a later element in
+            the document then A can find B before B is notified that its been inserted into the document (i.e. before
+            Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
+            cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
+            processed their insertion-specific logic.
</ins><span class="cx"> 
</span><del>-        * editing/FrameSelection.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollTo):
</del><ins>+            Tests: svg/custom/reparent-animate-element.html
+                   svg/custom/reparent-feimage-element.html
+                   svg/custom/reparent-mpath-element.html
+                   svg/custom/reparent-textpath-element.html
+                   svg/custom/reparent-tref-element.html
+                   svg/custom/reparent-use-element.html
</ins><span class="cx"> 
</span><del>-2014-05-27  Timothy Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+            * svg/SVGFEImageElement.cpp:
+            (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
+            * svg/SVGFEImageElement.h:
+            * svg/SVGMPathElement.cpp:
+            (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
+            * svg/SVGMPathElement.h:
+            * svg/SVGTRefElement.cpp:
+            (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
+            * svg/SVGTRefElement.h:
+            * svg/SVGTextPathElement.cpp:
+            (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
+            * svg/SVGTextPathElement.h:
+            * svg/SVGUseElement.cpp:
+            (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
+            inserted.
+            (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
+            * svg/SVGUseElement.h:
+            * svg/animation/SVGSMILElement.cpp:
+            (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
+            we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
+            after the subtree we're in is inserted.
+            (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
+            * svg/animation/SVGSMILElement.h:
</ins><span class="cx"> 
</span><del>-        Turn on the LayerPool for iOS
-        https://bugs.webkit.org/show_bug.cgi?id=133299
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+        Merge r169007
</ins><span class="cx"> 
</span><del>-        * Configurations/WebCore.xcconfig:
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::platformReleaseMemory):
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::createTileLayer):
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::removeTiles):
-        Turn on the LayerPool for iOS.
-        We've used this on Mac for a long time, and the WebKit1
-        (&quot;legacy&quot;) iOS TileCache also had a similar pool.
-        This helps a good bit with flashiness while scrolling.
</del><ins>+    2014-05-17  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  David Hyatt  &lt;hyatt@apple.com&gt;
</del><ins>+            Don't attempt to update id or name for nodes that are already removed
+            https://bugs.webkit.org/show_bug.cgi?id=133041
</ins><span class="cx"> 
</span><del>-        REGRESSION: Audio volume scrubber does not show volume level thumb
-        &lt;rdar://problem/16902004&gt;
-        https://bugs.webkit.org/show_bug.cgi?id=133310
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            Tests: fast/dom/remove-element-with-id-that-was-inserted-on-DOMNodeRemoved.html
+                   fast/dom/remove-element-with-name-that-was-inserted-on-DOMNodeRemoved.html
</ins><span class="cx"> 
</span><del>-        This was just a silly mistake on my part with the setting of the pagination
-        layers. Layers inside transforms are supposed to clear out their pagination
-        status based off their ancestor containing block layers, and not off the
-        enclosing pagination layer.
-        
-        Added fast/multicol/pagination/nested-transforms.html
</del><ins>+            * dom/Element.cpp:
+            (WebCore::Element::removedFrom): Skip updating ids and names for an element not
+            in a treescope, as we already do for elements not in a document.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updatePagination):
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Merge r168636
</ins><span class="cx"> 
</span><del>-        [Mac] media controls should prevent 'click' events from reaching the page
-        https://bugs.webkit.org/show_bug.cgi?id=133268
</del><ins>+    2014-05-12  Martin Hock  &lt;mhock@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            Disallow drag and drop of non-displayable resources.
+            https://bugs.webkit.org/show_bug.cgi?id=132745
+            &lt;rdar://problem/10562662&gt;
</ins><span class="cx"> 
</span><del>-        Test: media/media-controls-cancel-events.html
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.js:
-        (Controller.prototype.handleEvent): Allow event handler to cancel event default action.
-        (Controller.prototype.handleRewindButtonClicked): Cancel event default.
-        (Controller.prototype.handlePlayButtonClicked): Ditto.
-        (Controller.prototype.handleMuteButtonClicked): Ditto.
-        (Controller.prototype.handleMinButtonClicked): Ditto.
-        (Controller.prototype.handleCaptionButtonClicked): Ditto.
-        (Controller.prototype.handleFullscreenButtonClicked): Ditto.
-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.handlePlayButtonTouchEnd): Ditto.
-        (ControllerIOS.prototype.handlePlayButtonTouchCancel): Ditto.
-        (ControllerIOS.prototype.handleFullscreenTouchEnd): Ditto.
-        (ControllerIOS.prototype.handleFullscreenTouchCancel): Ditto.
-        (ControllerIOS.prototype.handleStartPlaybackButtonTouchEnd): Ditto.
-        (ControllerIOS.prototype.handleStartPlaybackButtonTouchCancel): Ditto.
-        (ControllerIOS.prototype.handleWirelessPickerButtonClicked): Ditto.
</del><ins>+            Test: http/tests/security/drag-drop-local-file.html
</ins><span class="cx"> 
</span><del>-2014-05-27  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+            * page/DragController.cpp:
+            (WebCore::DragController::startDrag):
</ins><span class="cx"> 
</span><del>-        Fix Mavericks bots from r169383.
-        https://bugs.webkit.org/show_bug.cgi?id=133311
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+        Merge r166741
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h: Update #ifdef to check for ENABLE(MEDIA_SOURCE).
-        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm: Ditto.
</del><ins>+    2014-04-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            Harden FilterOperation type casting
+            https://bugs.webkit.org/show_bug.cgi?id=131142
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): Incorrect handling of multicol spanner
-        https://bugs.webkit.org/show_bug.cgi?id=133249
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            DefaultFilterOperation had an error-prone behavior where it set the base class
+            OperationType to the type of some other filter class, but overrode isDefault(). 
+            This made it very easy to write incorrect code that casted incorrectly based on type().
</ins><span class="cx"> 
</span><del>-        When removing the child of an object, the removeChild method should return the next element
-        following the one being deleted. This will ensure that proper iteration and destruction of
-        an object's children is possible.
</del><ins>+            Fix by making adding a DEFAULT filter operation type, and storing the represented
+            type on DefaultFilterOperation().
</ins><span class="cx"> 
</span><del>-        No new tests added. This is because the test that triggers this issue also triggers
-        another assertion, in RenderMultiColumnSet::requiresBalancing(). However, that is a totally
-        separate problem and will be handled in a separate bug: https://bugs.webkit.org/show_bug.cgi?id=133309
</del><ins>+            Also remove the OperationType argument for constructors of FilterOperations that
+            can only be of one type, to avoid possible mistakes.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::removeChild):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::removeChild):
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::removeChild):
-        * rendering/RenderButton.h:
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::removeChild):
-        (WebCore::RenderElement::removeChildInternal):
-        * rendering/RenderElement.h:
-        * rendering/RenderMenuList.cpp:
-        (RenderMenuList::removeChild):
-        * rendering/RenderMenuList.h:
-        * rendering/RenderMultiColumnFlowThread.cpp:
-        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
-        * rendering/RenderRuby.cpp:
-        (WebCore::RenderRubyAsInline::removeChild):
-        (WebCore::RenderRubyAsBlock::removeChild):
-        * rendering/RenderRuby.h:
-        * rendering/RenderRubyRun.cpp:
-        (WebCore::RenderRubyRun::removeChild):
-        * rendering/RenderRubyRun.h:
-        * rendering/mathml/RenderMathMLScripts.cpp:
-        (WebCore::RenderMathMLScripts::removeChildInternal):
-        (WebCore::RenderMathMLScripts::removeChild):
-        (WebCore::RenderMathMLScriptsWrapper::removeChildInternal):
-        (WebCore::RenderMathMLScriptsWrapper::removeChild):
-        * rendering/mathml/RenderMathMLScripts.h:
-        * rendering/svg/RenderSVGContainer.cpp:
-        (WebCore::RenderSVGContainer::removeChild):
-        * rendering/svg/RenderSVGContainer.h:
-        * rendering/svg/RenderSVGInline.cpp:
-        (WebCore::RenderSVGInline::removeChild):
-        * rendering/svg/RenderSVGInline.h:
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::removeChild):
-        * rendering/svg/RenderSVGRoot.h:
-        * rendering/svg/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::removeChild):
-        * rendering/svg/RenderSVGText.h:
</del><ins>+            Make the type cast macros a bit more normal, and use them in a few places.
</ins><span class="cx"> 
</span><del>-2014-05-27  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+            Fixed PlatformCAFiltersMac to handle the default filter case more cleanly.
</ins><span class="cx"> 
</span><del>-        Update ENABLE(MEDIA_SOURCE) on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=133141
</del><ins>+            * WebCore.exp.in:
+            * css/CSSComputedStyleDeclaration.cpp:
+            (WebCore::ComputedStyleExtractor::valueForFilter):
+            * css/StyleResolver.cpp:
+            (WebCore::StyleResolver::createFilterOperations):
+            * platform/graphics/ca/PlatformCAFilters.h:
+            * platform/graphics/ca/mac/PlatformCAFiltersMac.mm:
+            (PlatformCAFilters::filterValueForOperation):
+            (PlatformCAFilters::colorMatrixValueForFilter):
+            * platform/graphics/filters/FilterOperation.cpp:
+            (WebCore::DefaultFilterOperation::operator==):
+            (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
+            (WebCore::ReferenceFilterOperation::operator==):
+            (WebCore::BlurFilterOperation::operator==):
+            (WebCore::BlurFilterOperation::blend):
+            (WebCore::DropShadowFilterOperation::operator==):
+            (WebCore::DropShadowFilterOperation::blend):
+            * platform/graphics/filters/FilterOperation.h:
+            (WebCore::FilterOperation::blend):
+            (WebCore::FilterOperation::type):
+            (WebCore::FilterOperation::isBasicColorMatrixFilterOperation):
+            (WebCore::FilterOperation::isBasicComponentTransferFilterOperation):
+            (WebCore::FilterOperation::isSameType):
+            (WebCore::DefaultFilterOperation::create):
+            (WebCore::DefaultFilterOperation::representedType):
+            (WebCore::DefaultFilterOperation::DefaultFilterOperation):
+            (WebCore::ReferenceFilterOperation::create):
+            (WebCore::BlurFilterOperation::create):
+            (WebCore::BlurFilterOperation::BlurFilterOperation):
+            (WebCore::DropShadowFilterOperation::create):
+            (WebCore::DropShadowFilterOperation::DropShadowFilterOperation):
+            (WebCore::FilterOperation::isDefault): Deleted.
+            * platform/graphics/filters/FilterOperations.cpp:
+            (WebCore::FilterOperations::outsets):
+            * rendering/FilterEffectRenderer.cpp:
+            (WebCore::FilterEffectRenderer::build):
+            * rendering/RenderLayerFilterInfo.cpp:
+            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
</del><ins>+        Merge r167851
</ins><span class="cx"> 
</span><del>-2014-05-27  Tibor Meszaros  &lt;tmeszaros.u-szeged@partner.samsung.com&gt;
</del><ins>+    2014-04-26  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove BLOB guards
-        https://bugs.webkit.org/show_bug.cgi?id=132863
</del><ins>+            Frame and page lifetime fixes in WebCore::createWindow
+            https://bugs.webkit.org/show_bug.cgi?id=132089
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * Modules/websockets/WebSocketChannel.cpp:
-        (WebCore::WebSocketChannel::WebSocketChannel):
-        (WebCore::WebSocketChannel::didFail):
-        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
-        (WebCore::WebSocketChannel::abortOutgoingFrameQueue):
-        * Modules/websockets/WebSocketChannel.h:
-        * WebCore.exp.in:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * bindings/js/JSBlobCustom.cpp:
-        (WebCore::JSBlobConstructor::constructJSBlob):
-        * bindings/js/JSFileReaderCustom.cpp:
-        * dom/DOMExceptions.in:
-        * dom/EventTargetFactory.in:
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::publicURLManager):
-        * dom/ScriptExecutionContext.h:
-        * fileapi/AsyncFileStream.cpp:
-        * fileapi/AsyncFileStream.h:
-        * fileapi/Blob.cpp:
-        (WebCore::Blob::Blob):
-        * fileapi/Blob.h:
-        (WebCore::Blob::slice):
-        * fileapi/Blob.idl:
-        * fileapi/FileError.h:
-        * fileapi/FileError.idl:
-        * fileapi/FileException.cpp:
-        * fileapi/FileException.h:
-        * fileapi/FileException.idl:
-        * fileapi/FileReader.cpp:
-        * fileapi/FileReader.h:
-        * fileapi/FileReader.idl:
-        * fileapi/FileReaderLoader.cpp:
-        * fileapi/FileReaderLoader.h:
-        * fileapi/FileReaderLoaderClient.h:
-        * fileapi/FileReaderSync.cpp:
-        * fileapi/FileReaderSync.h:
-        * fileapi/FileReaderSync.idl:
-        * fileapi/FileThread.cpp:
-        * fileapi/FileThread.h:
-        * fileapi/ThreadableBlobRegistry.cpp:
-        (WebCore::ThreadableBlobRegistry::registerFileBlobURL): Deleted.
-        (WebCore::ThreadableBlobRegistry::registerBlobURL): Deleted.
-        (WebCore::ThreadableBlobRegistry::registerBlobURLForSlice): Deleted.
-        (WebCore::ThreadableBlobRegistry::unregisterBlobURL): Deleted.
-        (WebCore::ThreadableBlobRegistry::blobSize): Deleted.
-        (WebCore::ThreadableBlobRegistry::getCachedOrigin): Deleted.
-        * fileapi/WebKitBlobBuilder.cpp:
-        (WebCore::BlobBuilder::append):
-        * fileapi/WebKitBlobBuilder.h:
-        * html/DOMURL.cpp:
-        * html/DOMURL.h:
-        * html/DOMURL.idl:
-        * html/PublicURLManager.cpp:
-        * html/PublicURLManager.h:
-        * loader/LoaderStrategy.cpp:
-        (WebCore::LoaderStrategy::createBlobRegistry):
-        * loader/LoaderStrategy.h:
-        * page/DOMWindow.idl:
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::shouldUseInnerURL):
-        (WebCore::getCachedOrigin):
-        * platform/FileStream.cpp:
-        * platform/FileStream.h:
-        * platform/FileStreamClient.h:
-        * platform/SchemeRegistry.cpp:
-        (WebCore::canDisplayOnlyIfCanRequestSchemes):
-        * platform/network/BlobRegistry.cpp:
-        * platform/network/BlobRegistryImpl.cpp:
-        * platform/network/BlobResourceHandle.cpp:
-        * platform/network/BlobResourceHandle.h:
-        * platform/network/FormData.cpp:
-        (WebCore::FormData::deepCopy):
-        (WebCore::FormData::appendFile):
-        (WebCore::FormData::appendBlob):
-        (WebCore::FormData::appendKeyValuePairItems):
-        (WebCore::FormData::resolveBlobReferences):
-        (WebCore::encodeElement):
-        (WebCore::decodeElement):
-        * platform/network/FormData.h:
-        (WebCore::FormDataElement::FormDataElement):
-        (WebCore::operator==):
-        * platform/network/cf/FormDataStreamCFNet.cpp:
-        (WebCore::closeCurrentStream):
-        (WebCore::advanceCurrentStream):
-        (WebCore::formCreate):
-        (WebCore::formRead):
-        (WebCore::setHTTPBody):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::getFormElementsCount):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::addEncodedBlobToSoupMessageBody):
-        (WebCore::addFormElementsToSoupMessage):
-        * workers/WorkerGlobalScope.idl:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::send):
-        (WebCore::XMLHttpRequest::createRequest):
</del><ins>+            Speculative fix because I was unable to reproduce the crash that was
+            reported with the test case attached to this bug.
</ins><span class="cx"> 
</span><del>-2014-05-27  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+            * loader/FrameLoader.cpp:
+            (WebCore::createWindow): Changed code to remove the assumption that calls
+            out will not destroy the page or frame. Use RefPtr for the frame, and
+            added early exits if frame-&gt;page() becomes null at any point before we
+            use a page pointer.
</ins><span class="cx"> 
</span><del>-        Allow building CMake based ports with WEB_REPLAY
-        https://bugs.webkit.org/show_bug.cgi?id=133154
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Csaba Osztrogonác.
</del><ins>+        Merge r168641
</ins><span class="cx"> 
</span><del>-        * CMakeLists.txt:
</del><ins>+    2014-05-09  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-27  Adrian Perez de Castro  &lt;aperez@igalia.com&gt;
</del><ins>+            REGRESSION (r167818): editing/inserting/typing-space-to-trigger-smart-link.html fails on WebKit1 bots
</ins><span class="cx"> 
</span><del>-        [GStreamer] Add missing &lt;wtf/MathExtras.h&gt; header
-        https://bugs.webkit.org/show_bug.cgi?id=133236
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=132207&gt;
+            &lt;rdar://problem/16730393&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+            Reverts the previous workaround in favor of a more specific fix for the
+            null dereference.
</ins><span class="cx"> 
</span><del>-        In some configurations, not including &lt;wtf/MathExtras.h&gt; will cause
-        errors about undefined functions. In particular, this happens in
-        Linux with glibc 2.19 and compiling with Clang. Having the header
-        included is the correct thing to do anyway.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/GStreamerUtilities.cpp:
-        Include &lt;wtf/MathExtras.h&gt;
</del><ins>+            * editing/ApplyStyleCommand.cpp:
+            (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+            Check whether the run's start and end are still in the document, as
+            removeConflictingInlineStyleFromRun() may have removed them.
</ins><span class="cx"> 
</span><del>-2014-05-27  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+            * editing/CompositeEditCommand.cpp:
+            (WebCore::CompositeEditCommand::apply):
+            Reverted previous workaround.
+            (WebCore::ApplyEditCommand::ReentrancyGuard::isRecursiveCall): Deleted.
+            (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::Scope): Deleted.
+            (WebCore::ApplyEditCommand::ReentrancyGuard::Scope::~Scope): Deleted.
</ins><span class="cx"> 
</span><del>-        Setting up OrderIterator shouldn't require an extra Vector
-        https://bugs.webkit.org/show_bug.cgi?id=119061
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Merge r167635
</ins><span class="cx"> 
</span><del>-        From Blink r153971 by &lt;jchaffraix@chromium.org&gt;
</del><ins>+    2014-04-21  Dan Bernstein  &lt;mitz@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This patches reuse the OrderIterator's Vector. It provides a helper class OrderIteratorPopulator, used for
-        manipulating the Vector directly. Which allows to consolidate the code into a single implementation across
-        flexbox and grid.
</del><ins>+            WebCore part of &lt;rdar://problem/16631323&gt; Page::setDefersLoading doesn’t do anything when using the Network process
+            https://bugs.webkit.org/show_bug.cgi?id=131939
</ins><span class="cx"> 
</span><del>-        No new tests, already covered by current tests.
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        * rendering/OrderIterator.cpp:
-        (WebCore::OrderIteratorPopulator::~OrderIteratorPopulator): Reset OrderIterator and call
-        removeDuplicatedOrderValues().
-        (WebCore::OrderIteratorPopulator::removeDuplicatedOrderValues): Sorts the Vector and removes the duplicated
-        order values.
-        (WebCore::OrderIteratorPopulator::collectChild): Collect order value information from child.
-        (WebCore::OrderIterator::setOrderValues): Deleted.
-        * rendering/OrderIterator.h:
-        (WebCore::OrderIteratorPopulator::OrderIteratorPopulator): Add helper class to manipulate OrderValues Vector.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Remove unneeded code related to old OrderValues vector.
-        (WebCore::RenderFlexibleBox::prepareOrderIteratorAndMargins): Populate OrderIterator using collectChild().
-        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Deleted.
-        * rendering/RenderFlexibleBox.h: Rename computeMainAxisPreferredSizes() to prepareOrderIteratorAndMargins().
-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator): Populate OrderIterator using collectChild().
</del><ins>+            * WebCore.exp.in: Exported WebCore::ResourceHandle::setDefersLoading.
</ins><span class="cx"> 
</span><del>-2014-05-26  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+            * loader/ResourceLoadScheduler.cpp:
+            (WebCore::ResourceLoadScheduler::setDefersLoading): Added a no-op implementation.
+            * loader/ResourceLoadScheduler.h: Declared new virtual member function setDefersLoading.
</ins><span class="cx"> 
</span><del>-        [wk2] RemoteLayerBackingStore front buffers should be purgeable when unparented
-        https://bugs.webkit.org/show_bug.cgi?id=133020
-        &lt;rdar://problem/16521736&gt;
</del><ins>+            * loader/ResourceLoader.cpp:
+            (WebCore::ResourceLoader::setDefersLoading): Added a call to the above function.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/graphics/cg/IOSurfacePool.cpp:
-        (WebCore::IOSurfacePool::willAddSurface):
-        * platform/graphics/cocoa/IOSurface.h:
-        * platform/graphics/cocoa/IOSurface.mm:
-        (IOSurface::releaseGraphicsContext):
-        Rename clearGraphicsContext to releaseGraphicsContext for clarity.
</del><ins>+        Merge r167818
</ins><span class="cx"> 
</span><del>-2014-05-26  Philip Rogers  &lt;pdr@google.com&gt;
</del><ins>+    2014-04-23  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove special case for transparent SVG root layers
-        https://bugs.webkit.org/show_bug.cgi?id=116856
</del><ins>+            Crash applying editing commands from iframe onload event
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=132103&gt;
+            &lt;rdar://problem/15696351&gt;
</ins><span class="cx"> 
</span><del>-        This patch removes a special case from RenderLayer for root SVG layers
-        with opacity. Instead of checking whether a composited layer exists in
-        SVGRenderingContext::prepareToRenderSVGContent we now exclude the root
-        SVG renderobject from the opacity checks in prepareToRenderSVGContent.
</del><ins>+            This patch merges the Chromium bug workaround from
+            &lt;http://src.chromium.org/viewvc/blink?revision=162080&amp;view=revision&gt;,
+            which prevents reentrancy in CompositeEditCommand::apply().
</ins><span class="cx"> 
</span><del>-        This is a merge of https://src.chromium.org/viewvc/blink?view=rev&amp;revision=174102
-        by Philip Rogers &lt;pdr@chromium.org&gt;.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        No new tests as this is covered by svg/custom/composited-svg-with-opacity.html.
</del><ins>+            Test: editing/apply-style-iframe-crash.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::isTransparent): Deleted.
-        * rendering/RenderLayer.h:
-        * rendering/svg/SVGRenderingContext.cpp:
-        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
-            The opacity case for root svg renderers is now handled by
-            RenderLayer.
</del><ins>+            * editing/CompositeEditCommand.cpp:
+            (WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
+            (WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
+            (WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
+            (WebCore::CompositeEditCommand::apply):
+            If this is a recursive call, return early.
</ins><span class="cx"> 
</span><del>-2014-05-26  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        CSS JIT: Fix build error raised when CSS_SELECTOR_JIT_DEBUGGING is 1
-        https://bugs.webkit.org/show_bug.cgi?id=133266
</del><ins>+        Merge r167264
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+    2014-04-14  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When CSS_SELECTOR_JIT_DEBUGGING is 1, build erros occur on x86_64.
</del><ins>+            Use after free in WebCore::CachedResourceHandleBase::~CachedResourceHandleBase / WebCore::removeDetachedChildrenInContainer
+            https://bugs.webkit.org/show_bug.cgi?id=131169
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generatePrologue):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateEpilogue):
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-26  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
</del><ins>+            Invalidate the WebCoreAVFResourceLoader owned by MediaPlayerPrivateAVFoundationObjC
+            in its destructor, to prevent a private function being called in response to the
+            WebCoreAVFResourceLoader being stopped.
</ins><span class="cx"> 
</span><del>-        Fix the quirks mode selector matching of the pseudo classes :hover and :active
-        https://bugs.webkit.org/show_bug.cgi?id=133063
</del><ins>+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC):
+            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
+            * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
+            (WebCore::WebCoreAVFResourceLoader::invalidate):
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Our implementation of the quirks mode of :active and :hover was very wrong. The only
-        thing it was doing is verify the pseudo class is not the first selector of a fragment
-        (which was conveniently the only thing that was tested :)).
</del><ins>+        Merge r166628
</ins><span class="cx"> 
</span><del>-        Since those pseudo class were only checking for the order of the filters, something like
-            #target:hover
-        would succeed because :hover is not the first simple selector, while
-            :hover#target
-        would fail.
</del><ins>+    2014-04-13  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        That behavior is also a problem for the CSS JIT as it is an implementation detail of SelectorChecker
-        and compiling something like that with our out-of-order matching would be nonsense.
</del><ins>+            userVisibleString should not try to &quot;encode&quot; host names
+            https://bugs.webkit.org/show_bug.cgi?id=131587
+            rdar://problem/14686849
</ins><span class="cx"> 
</span><del>-        This patch update the implementation to follow http://quirks.spec.whatwg.org/#the-:active-and-:hover-quirk
-        Basically, the only cases that do not work in quirks mode are selectors composed only of &quot;*, :hover and :active&quot;.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        To implement this behavior, I needed to be able to inspect a complete selector fragment, including
-        what is before and after :hover/:active.
-        To do that, I replaced the boolean isSubSelector by a pointer to the first selector of the fragment.
-        When we need to match :active/:hover in quirks mode, we just go over all the selectors in the fragment
-        to find one of the qualifying match type.
</del><ins>+            * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.
</ins><span class="cx"> 
</span><del>-        Tests: fast/selectors/active-hover-quirks.html
-               fast/selectors/active-quirks.html
-               fast/selectors/hover-quirks.html
</del><ins>+            * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
+            Objective-C++ header compile in plain C++ files, which we never need to do.
+            Added missing argument name, baseURL, and changed mysterious CFIndex arguments
+            to the correct type, CFURLComponentType.
</ins><span class="cx"> 
</span><del>-        * css/SelectorChecker.cpp:
-        (WebCore::SelectorChecker::matchRecursively):
-        (WebCore::canMatchHoverOrActiveInQuirksMode):
-        (WebCore::SelectorChecker::checkOne):
-        * css/SelectorChecker.h:
-        (WebCore::SelectorChecker::SelectorCheckingContext::SelectorCheckingContext):
</del><ins>+            * platform/mac/WebCoreNSURLExtras.mm:
+            (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
+            more lookalike characters from the Mozilla list referenced here.
+            (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
+            (WebCore::dataForURLComponentType): Ditto.
+            (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
+            needed; no encoding here.
</ins><span class="cx"> 
</span><del>-2014-05-26  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Split the call to adjustForLocalZoom out into a separate expression.
-        https://bugs.webkit.org/show_bug.cgi?id=133286
</del><ins>+        Merge r166628
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+    2014-04-01  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This patch ensures that adjustForLocalZoom() always gets called before we look at
-        zoomFactor's value. (and not rely on the undefined behavior of the order of function argument evaluation)
</del><ins>+            Crash in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::offsetLeft):
-        (WebCore::Element::offsetTop):
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
+            &lt;rdar://problem/15073043&gt;
</ins><span class="cx"> 
</span><del>-2014-05-26  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Class name matching should use ASCII case-insensitive matching, not Unicode case folding
-        https://bugs.webkit.org/show_bug.cgi?id=133292
</del><ins>+            Test: svg/filters/first-letter-crash.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            * rendering/FilterEffectRenderer.cpp:
+            (WebCore::FilterEffectRenderer::buildReferenceFilter):
+            Added a null check to prevent crashes for anonymous RenderObjects.
</ins><span class="cx"> 
</span><del>-        Tests: fast/dom/getElementsByClassName/ASCII-case-insensitive.html
-               fast/dom/getElementsByClassName/case-sensitive.html
</del><ins>+            * rendering/RenderLayer.cpp:
+            (WebCore::RenderLayer::filterNeedsRepaint):
+            Get the enclosing element, if there is one, and recalculate its style.
+            We use the enclosing element so that we recalculate style for the
+            ancestor of an anonymous RenderElement.
+            (WebCore::RenderLayer::enclosingElement):
+            Remove an assertion; we may now reach this condition if loading a
+            cached SVG document results in RenderLayer::filterNeedsRepaint() being
+            called before the object has been inserted into the render tree.
</ins><span class="cx"> 
</span><del>-        * dom/SpaceSplitString.cpp:
-        (WebCore::hasNonASCIIOrUpper): Deleted.
-        (WebCore::tokenizeSpaceSplitString): Use a for loop instead of while.
-        (WebCore::spaceSplitStringTable): Renamed from sharedDataMap; the new name is supposed
-        to help us see the analogy with the atomic string table.
-        (WebCore::SpaceSplitString::set): Removed unneeded special case for null and preflight
-        since AtomicString::convertToASCIILowercase now handles both of those. Changed to call
-        convertToASCIILowercase instead of foldCase, since we don't want to fold non-ASCII.
-        (WebCore::SpaceSplitString::spaceSplitStringContainsValue): Ditto.
-        (WebCore::SpaceSplitStringData::create): Marked this inline since it's only called in
-        one place and that place is in this file. Also used auto a bit and used get instead of
-        find since the value type is a simple pointer.
-        (WebCore::SpaceSplitStringData::destroy): Removed unneeded check for null. We never
-        create any SpaceSplitStringData with empty strings, and a null is a kind of empty string.
</del><ins>+            * rendering/RenderLayerFilterInfo.cpp:
+            (WebCore::RenderLayer::FilterInfo::notifyFinished):
+            Tell the RenderLayer that the filter needs repainting.
+            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
+            Get the Element from the renderer rather than asking the renderer's
+            Element, which will be null for anonymous RenderObjects.
</ins><span class="cx"> 
</span><del>-        * dom/SpaceSplitString.h: Removed some unneeded includes and some unneeded uses of the
-        inline keyword. Changed types from size_t to unsigned in a couple places; we had a mix
-        of the types and there was no reason to use size_t there.
</del><ins>+            * rendering/RenderLayerFilterInfo.h:
+            Removed declaration for the old workaround function, layerElement().
</ins><span class="cx"> 
</span><del>-2014-05-26  Javier Fernandez  &lt;jfernandez@igalia.com&gt;
</del><ins>+2014-05-22  Dana Burkart  &lt;dburkart@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Implementation of the &quot;grid&quot; shorthand.
-        https://bugs.webkit.org/show_bug.cgi?id=132122
</del><ins>+        Merge r165206
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+    2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The grid property is a shorthand that sets all of the explicit
-        grid properties (grid-template-rows, grid-template-columns, and
-        grid-template-areas) as well as all the implicit grid properties
-        (grid-auto-rows, grid-auto-columns, and grid-auto-flow) in a
-        single declaration
</del><ins>+            Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</ins><span class="cx"> 
</span><del>-        Notice that either explicit or implicit grid can be specified,
-        assigning the initial values to the omitted properties.
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
+            &lt;rdar://problem/15073043&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/grid-shorthand-get-set.html
</del><ins>+            Clang appears to be optimizing out a branch in RenderObject::node()
+            when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
+            We'll work around this by factoring out the code in question into a
+            separate member function marked NEVER_INLINE.
</ins><span class="cx"> 
</span><del>-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::ComputedStyleExtractor::propertyValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        (WebCore::CSSParser::parseGridShorthand):
-        * css/CSSParser.h:
-        * css/CSSPropertyNames.in:
-        * css/StylePropertyShorthand.cpp:
-        (WebCore::webkitGridShorthand):
-        * css/StylePropertyShorthand.h:
</del><ins>+            No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</ins><span class="cx"> 
</span><del>-2014-05-26  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        Subpixel layout: Legacy Element.offset* client* return values are invalid in certain cases.
-        https://bugs.webkit.org/show_bug.cgi?id=133272
</del><ins>+            * rendering/RenderLayerFilterInfo.cpp:
+            (WebCore::RenderLayer::FilterInfo::layerElement):
+            Code moved from updateReferenceFilterClients(). Returns the Element*
+            for m_layer.
+            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
+            Use layerElement().
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            * rendering/RenderLayerFilterInfo.h:
+            Declared layerElement().
</ins><span class="cx"> 
</span><del>-        Element.offset* client* functions applied various rounding strategies on the return values before r168868.
-        (for example, offsetLeft/Top either floored through implicit integer arithmetics or rounded explicitly depending
-        whether the zoom scale was 1. see http://trac.webkit.org/changeset/168868/trunk/Source/WebCore/dom/Element.cpp for details)
-        This patch mimics the legacy behavior by either rounding or flooring the return value.
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Not testable (legacy switch is not exposed)
</del><ins>+        Merge r164950
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::adjustForLocalZoom):
-        (WebCore::convertToNonSubpixelValueIfNeeded):
-        (WebCore::Element::offsetLeft):
-        (WebCore::Element::offsetTop):
</del><ins>+    2014-03-02  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-26  Michał Pakuła vel Rutka  &lt;m.pakula@samsung.com&gt;
</del><ins>+            Add protected casting to FilterOperation classes.
+            https://bugs.webkit.org/show_bug.cgi?id=124062
</ins><span class="cx"> 
</span><del>-        [EFL] Input fields and text areas are not rendered correctly after r167771
-        https://bugs.webkit.org/show_bug.cgi?id=133181
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+            Use the type cast macro generators to produce some toFilterOperation-style
+            functions, and then use them in our PlatformCA filter code.
</ins><span class="cx"> 
</span><del>-        r167771 changed arguments of RenderTheme two virtual method arguments which were not reflected
-        in changes in derived classes, which caused parent method to be called. Arguments in derived class
-        were updated, also 'override' specifiers were added to all virtual methods to prevent similar errors.
</del><ins>+            Test: css3/filters/animation-from-initial-values-with-color-matrix.html
</ins><span class="cx"> 
</span><del>-        Already covered by fast/forms/textarea-placeholder-wrapping.html
</del><ins>+            * platform/graphics/ca/mac/PlatformCAFiltersMac.mm: Use the toFilterOperation methods, in
+            some cases removing the unnecessary double cast.
+            (PlatformCAFilters::filterValueForOperation):
+            (PlatformCAFilters::colorMatrixValueForFilter):
+            * platform/graphics/filters/FilterOperation.cpp:
+            (WebCore::BasicColorMatrixFilterOperation::blend):
+            (WebCore::BasicColorMatrixFilterOperation::operator==): Move this to the .cpp file so it can use the casting methods.
+            (WebCore::BasicComponentTransferFilterOperation::blend):
+            (WebCore::BasicComponentTransferFilterOperation::operator==): Ditto.
+            * platform/graphics/filters/FilterOperation.h: Add the casting macros.
</ins><span class="cx"> 
</span><del>-        * platform/efl/RenderThemeEfl.cpp:
-        (WebCore::RenderThemeEfl::paintTextField):
-        (WebCore::RenderThemeEfl::paintTextArea):
-        * platform/efl/RenderThemeEfl.h:
-        (WebCore::RenderThemeEfl::supportsHover):
-        (WebCore::RenderThemeEfl::supportsControlTints):
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Sergio Villar Senin  &lt;svillar@igalia.com&gt;
</del><ins>+        Merge r157816
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Children of grid containers must be turned into grid items
-        https://bugs.webkit.org/show_bug.cgi?id=132991
</del><ins>+    2013-10-22  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            GammaFilterOperation seems to be dead code
+            https://bugs.webkit.org/show_bug.cgi?id=123173
</ins><span class="cx"> 
</span><del>-        From Blink r150472 by &lt;jchaffraix@chromium.org&gt;
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        According to specs each child of a grid container must become a
-        grid item meaning that grid items are grid level boxes and thus,
-        do not participate in the block formatting context but in the grid
-        formatting one.
</del><ins>+            * platform/graphics/filters/FilterOperation.cpp:
+            * platform/graphics/filters/FilterOperation.h:
+            Remove dead code.
</ins><span class="cx"> 
</span><del>-        This change updates the grid items' 'display' property after style
-        resolution so that we match the specification (see section 4. Grid
-        Items). The spec basically instructs us to compute the value of
-        'display' by applying the table in CSS2.1 Chapter 9.7
-        http://www.w3.org/TR/CSS2/visuren.html#dis-pos-flo
</del><ins>+2014-05-22  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/css-grid-layout/grid-item-display.html
</del><ins>+        Merge r155315
</ins><span class="cx"> 
</span><del>-        * css/StyleResolver.cpp:
-        (WebCore::isDisplayGridBox):
-        (WebCore::StyleResolver::adjustRenderStyle):
</del><ins>+    2013-09-08  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-26  Zan Dobersek  &lt;zdobersek@igalia.com&gt;
</del><ins>+            FrameView::scheduleEvent() is over-engineered.
+            &lt;https://webkit.org/b/121004&gt;
</ins><span class="cx"> 
</span><del>-        Remove Vector copies in ShorthandPropertyWrapper implementation and use
-        https://bugs.webkit.org/show_bug.cgi?id=133265
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Remove gratuitous FrameActionScheduler class that was really only being used
+            to defer the occassional &quot;overflowchanged&quot; event until layout had finished.
</ins><span class="cx"> 
</span><del>-        * page/animation/CSSPropertyAnimation.cpp:
-        (WebCore::ShorthandPropertyWrapper::ShorthandPropertyWrapper): Move the passed-in Vector
-        into the member variable instead of using Vector&lt;&gt;::swap().
-        (WebCore::ShorthandPropertyWrapper::propertyWrappers): Return a const reference of the member
-        variable instead of a const value.
-        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap): Move the Vector
-        object into the ShorthandProperthyWrapper constructor.
-        (WebCore::gatherEnclosingShorthandProperties): Deploy a range-based for-loop.
</del><ins>+            * CMakeLists.txt:
+            * GNUmakefile.list.am:
+            * Target.pri:
+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj.filters:
+            * WebCore.xcodeproj/project.pbxproj:
+            * page/FrameActionScheduler.cpp:
+            * page/FrameActionScheduler.h:
</ins><span class="cx"> 
</span><del>-2014-05-26  Tanay C  &lt;tanay.c@samsung.com&gt;
</del><ins>+                Removed FrameActionScheduler.
</ins><span class="cx"> 
</span><del>-        [EFL] Fix build error in blob.cpp after r168435
-        https://bugs.webkit.org/show_bug.cgi?id=132678
</del><ins>+            * page/FrameView.h:
+            * page/FrameView.cpp:
+            (WebCore::FrameView::FrameView):
+            (WebCore::FrameView::~FrameView):
+            (WebCore::FrameView::layout):
+            (WebCore::FrameView::ScheduledEvent::ScheduledEvent):
+            (WebCore::FrameView::scheduleEvent):
+            (WebCore::FrameView::pauseScheduledEvents):
+            (WebCore::FrameView::resumeScheduledEvents):
+            (WebCore::FrameView::performPostLayoutTasks):
+            (WebCore::FrameView::updateOverflowStatus):
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+                Replaced it with a Vector&lt;ScheduledEvent&gt; and a suppression counter.
+                A ScheduledEvent is just a { Node, Event } pair.
</ins><span class="cx"> 
</span><del>-        * fileapi/Blob.cpp:
-        (WebCore::Blob::size): Using isInBound to check range of local var
-        actualsize to resolve build error
</del><ins>+2014-05-19  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-25  Ryuan Choi  &lt;ryuan.choi@samsung.com&gt;
</del><ins>+        erge r169098
</ins><span class="cx"> 
</span><del>-        [EFL] Remove TileCairo and TiledBackingStoreBackendCairo
-        https://bugs.webkit.org/show_bug.cgi?id=133274
</del><ins>+    2013-09-19  Bear Travis  &lt;betravis@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gyuyoung Kim.
</del><ins>+            CSS_SHAPES not supported on AppleWin port
+            https://bugs.webkit.org/show_bug.cgi?id=118810
</ins><span class="cx"> 
</span><del>-        Now, TiledBackingStore is only used for CoordinatedGraphics and the EFL port.
-        CoordinatedGraphics does not use TileCairo and TiledBackingStoreBackendCairo.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        This patch removed them and refactored related files.
</del><ins>+            Enabling fast/shapes on windows.
</ins><span class="cx"> 
</span><del>-        * PlatformEfl.cmake:
-        * PlatformGTK.cmake:
-        * WebCore.vcxproj/WebCore.vcxproj:
-        * WebCore.vcxproj/WebCore.vcxproj.filters:
-        * platform/graphics/TiledBackingStore.cpp:
-        (WebCore::TiledBackingStore::TiledBackingStore): Deleted.
-        * platform/graphics/TiledBackingStore.h:
-        * platform/graphics/TiledBackingStoreBackend.h:
-        * platform/graphics/cairo/TileCairo.cpp: Removed.
-        * platform/graphics/cairo/TiledBackingStoreBackendCairo.cpp: Removed.
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add missing shape includes.
+            * WebCore.vcxproj/WebCoreCommon.props: Include shapes source folder.
+            * WebCore.vcxproj/copyForwardingHeaders.cmd: Copy shapes headers.
+            * css/CSSPropertyNames.in: Tweak to ensure shapes properties are regenerated.
</ins><span class="cx"> 
</span><del>-2014-05-25  Jinwoo Song  &lt;jinwoo7.song@samsung.com&gt;
</del><ins>+2014-05-08  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        setData() of DataTransfer has a void return type
-        https://bugs.webkit.org/show_bug.cgi?id=133108
</del><ins>+        Rollout r168034.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+2014-05-07  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        According to HTML5 spec, setData() of DataTranfer interface does not return value.
-        http://www.w3.org/TR/html/editing.html#the-datatransfer-interface
</del><ins>+    Rollout r168104
</ins><span class="cx"> 
</span><del>-        Test: editing/pasteboard/set_data_typeof_return.html
</del><ins>+2014-05-05  Andy Estes  &lt;aestes@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/DataTransfer.cpp:
-        (WebCore::DataTransfer::setData):
-        * dom/DataTransfer.h:
-        * dom/DataTransfer.idl:
-        * platform/Pasteboard.h:
-        * platform/efl/PasteboardEfl.cpp:
-        (WebCore::Pasteboard::writeString):
-        * platform/gtk/PasteboardGtk.cpp:
-        (WebCore::Pasteboard::writeString):
-        * platform/ios/PasteboardIOS.mm:
-        (WebCore::Pasteboard::writeString):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::Pasteboard::writeString):
-        * platform/win/PasteboardWin.cpp:
-        (WebCore::Pasteboard::writeString):
</del><ins>+        Fix the Mountain Lion build.
</ins><span class="cx"> 
</span><del>-2014-05-25  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+        Some versions of Clang on Mountain Lion do not set __cplusplus to 201103L when compiling with -std=gnu++11,
+        which causes CF_ENUMs to be weakly-typed. Detect this case and export the correct symbols.
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Use ScrollView's scrollOffset as the unobscuredContentRect
-        https://bugs.webkit.org/show_bug.cgi?id=133262
</del><ins>+        On Lion, CFURLComponentType is not defined using CF_ENUM, so it will always be a weakly-typed enum.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
-
-        Since VisibleContentRect was fixed, we were no longer sending scroll events when updating the scrollOffset
-        when updating the visible content rects. The reason is that the scrollOffset was defined as the top left of the
-        VisibleContentRect, and as such was already at the end position after updating the unobscured rect.
-
-        This patch split the unobscuredContentRect in unobscuredContentSize (updated live on zoom) and the position defined
-        by the ScrollView's scrollOffset (updated when scrolling).
-
</del><span class="cx">         * WebCore.exp.in:
</span><del>-        * platform/ScrollView.h:
-        * platform/ios/ScrollViewIOS.mm:
-        (WebCore::ScrollView::unobscuredContentRect):
-        (WebCore::ScrollView::setUnobscuredContentSize):
-        (WebCore::ScrollView::setUnobscuredContentRect): Deleted.
</del><span class="cx"> 
</span><del>-2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+2014-05-03  Babak Shafiei  &lt;bshafiei@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add type-checked casts for TransformOperations
-        &lt;http://webkit.org/b/133217&gt;
</del><ins>+        Follow-up fix for the merge of r167480.
+        
+        Rubber stamped by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        * platform/KURL.cpp:
+        (WebCore::KURL::host): Return empty string instead of null string.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayer.cpp:
-        (WebCore::GraphicsLayer::validateTransformOperations):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::getTransformFunctionValue):
-        - Switch to type-checked casts.
</del><ins>+2014-05-02  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/IdentityTransformOperation.h:
-        * platform/graphics/transforms/Matrix3DTransformOperation.h:
-        * platform/graphics/transforms/MatrixTransformOperation.h:
-        * platform/graphics/transforms/PerspectiveTransformOperation.h:
-        * platform/graphics/transforms/RotateTransformOperation.h:
-        * platform/graphics/transforms/ScaleTransformOperation.h:
-        * platform/graphics/transforms/SkewTransformOperation.h:
-        * platform/graphics/transforms/TranslateTransformOperation.h:
-        - Add 'final' to class declaration.
-        - Add 'override' to overridden methods.
-        - Add type-checked cast via TRANSFORMOPERATION_TYPE_CASTS macro.
-        - Move implementation of operator==(const TransformOperation&amp;)
-          from header to source file so it is able to use a type-checked
-          cast, and switch back to using a reference instead of a
-          pointer.
-        - Add or update ASSERT in private constructor to check for
-          correct OperationType in classes that represent multiple
-          types.
</del><ins>+        Merge r166420.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
</del><ins>+    2014-03-28  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
+    
+            Clear SVGInlineTextBox fragments when the text changes.
+            https://bugs.webkit.org/show_bug.cgi?id=130879
+    
+            Reviewed by Darin Adler.
+    
+            Ported from Blink: https://src.chromium.org/viewvc/blink?revision=150456&amp;view=revision
+    
+            This patch modifies SVGInlineTextBox::dirtyLineBoxes to clear all
+            following text boxes when invoked. Typically this method is called
+            when the underlying text string changes, and that change needs to
+            be propagated to all the boxes that use the text beyond the point
+            where the text is first modified.
+            
+            Also cleans up final function keywords for SVGRootInlineBox.
+    
+            Test: svg/custom/unicode-in-tspan-multi-svg-crash.html
+    
+            * rendering/InlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
+            (WebCore::InlineTextBox::dirtyOwnLineBoxes): Calls dirtyLineBoxes()
+            * rendering/svg/SVGInlineTextBox.h: Added (non-recursive) dirtyOwnLineBoxes() function
+            (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes):
+            * rendering/svg/SVGInlineTextBox.cpp:
+            (WebCore::SVGInlineTextBox::dirtyOwnLineBoxes): Non-recursive part of dirtyLineBoxes()
+            (WebCore::SVGInlineTextBox::dirtyLineBoxes): Calls dirtyOwnLineBoxes() in a loop
+            * rendering/svg/SVGRootInlineBox.h:
+    
+2014-05-02  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/MatrixTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::MatrixTransformOperation::blend):
-        - Switch to type-checked casts and use a reference.
</del><ins>+        Merge r165053.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::PerspectiveTransformOperation::blend):
-        * platform/graphics/transforms/RotateTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::RotateTransformOperation::blend):
-        * platform/graphics/transforms/ScaleTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::ScaleTransformOperation::blend):
-        * platform/graphics/transforms/SkewTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::SkewTransformOperation::blend):
-        * platform/graphics/transforms/TranslateTransformOperation.cpp:
-        (WebCore::Matrix3DTransformOperation::operator==): Added.
-        (WebCore::TranslateTransformOperation::blend):
-        - Switch to type-checked casts.
</del><ins>+    2014-03-03  David Kilzer  &lt;ddkilzer@apple.com&gt;
+    
+            SVGPropertyTearOffs should detachChildren before deleting its value.
+            &lt;http://webkit.org/b/129618&gt;
+            &lt;rdar://problem/15661617&gt;
+    
+            Reviewed by Maciej Stachowiak.
+    
+            Merged from Blink (patch by kouhei@chromium.org):
+            https://src.chromium.org/viewvc/blink?revision=158563&amp;view=revision
+            http://crbug.com/296276
+    
+            Test: svg/transforms/svg-matrix-tearoff-crash.html
+    
+            NOTE: The test does not reproduce a crash on WebKit using
+            JavaScriptCore.
+    
+            * svg/properties/SVGPropertyTearOff.h:
+            (WebCore::SVGPropertyTearOff::setValue):
+            (WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
+            - Call detachChildren() if m_value is a copy.  The original
+              Blink patch did not modify the destructor code path, although
+              that seems obvious via code inspection.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/transforms/TransformOperation.h:
-        (WebCore::TransformOperation::isRotateTransformOperationType):
-        (WebCore::TransformOperation::isScaleTransformOperationType):
-        (WebCore::TransformOperation::isSkewTransformOperationType):
-        (WebCore::TransformOperation::isTranslateTransformOperationType):
-        - Add type-checking methods used in constructors and type-checked
-          casts.
-        - Define TRANSFORMOPERATION_TYPE_CASTS macro used by subclasses.
</del><ins>+        Merge r164917.
</ins><span class="cx"> 
</span><del>-2014-05-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</del><ins>+    2014-03-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
+    
+            Fix lifetime handling of SVGPropertyTearOffs
+            &lt;http://webkit.org/b/129211&gt;
+            &lt;rdar://problem/15696025&gt;
+    
+            Reviewed by Maciej Stachowiak.
+    
+            Merged from Blink (patch by Ojan Vafai):
+            https://src.chromium.org/viewvc/blink?revision=157801&amp;view=revision
+            http://crbug.com/288771
+    
+                -Replace SVGStaticPropertyWithParentTearOff with SVGMatrixTearOff
+                since it's only used in that one place. This means we can get rid
+                of the templatizing and the method pointer.
+                -Change SVGPropertyTearOff to keep track of it's child tearoffs
+                and call detachWrapper on its child tearoffs when it's destroyed
+                or when it's wrapper is detached.
+                -Have SVGPropertyTearOff hold WeakPtrs to the child tearoffs
+                to avoid having a cycle.
+    
+            Test: svg/transforms/svg-matrix-tearoff-crash.html
+    
+            * GNUmakefile.list.am:
+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj.filters:
+            * WebCore.xcodeproj/project.pbxproj:
+            * bindings/scripts/CodeGeneratorJS.pm:
+            (NativeToJSValue):
+            * svg/properties/SVGMatrixTearOff.h: Renamed from Source/WebCore/svg/properties/SVGStaticPropertyWithParentTearOff.h.
+            (WebCore::SVGMatrixTearOff::create):
+            (WebCore::SVGMatrixTearOff::commitChange):
+            (WebCore::SVGMatrixTearOff::SVGMatrixTearOff):
+            * svg/properties/SVGPropertyTearOff.h:
+            (WebCore::SVGPropertyTearOff::addChild):
+            (WebCore::SVGPropertyTearOff::detachChildren):
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Crash in WebCore::TextResourceDecoder::checkForCSSCharset
-        &lt;http://webkit.org/b/133257&gt;
-        &lt;rdar://problem/17027109&gt;
</del><ins>+        Merge r167295.
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+    2014-04-14  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
+    
+            Assertion failure under FEImage::determineAbsolutePaintRect()
+    
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=131660&gt;
+            &lt;rdar://problem/15669294&gt;
+    
+            This patch merges Chromium r149536 (see
+            &lt;https://chromiumcodereview.appspot.com/14701012&gt;), which moves
+            m_absoluteTransform out of SVGFilter and into the base Filter class, so
+            that it isn't necessary to cast a Filter to SVGFilter to get the
+            absolute transform.
+    
+            Reviewed by Geoffrey Garen.
+    
+            Test: svg/filters/feImage-filter-assertion.html
+    
+            * platform/graphics/filters/Filter.h:
+            (WebCore::Filter::Filter):
+            Changed to take the absolute transform.
+            (WebCore::Filter::absoluteTransform):
+            Moved from SVGFilter.
+            (WebCore::Filter::mapAbsolutePointToLocalPoint):
+            Ditto.
+    
+            * rendering/FilterEffectRenderer.cpp:
+            (WebCore::FilterEffectRenderer::FilterEffectRenderer):
+            Pass a default AffineTransform() to the Filter base class.
+    
+            * svg/graphics/filters/SVGFEImage.cpp:
+            (WebCore::FEImage::determineAbsolutePaintRect):
+            Use the Filter without casting it to SVGFilter.
+            (WebCore::FEImage::platformApplySoftware):
+            Ditto.
+    
+            * svg/graphics/filters/SVGFilter.cpp:
+            (WebCore::SVGFilter::SVGFilter):
+            Pass the transform to the base class, and remove initialization of a
+            removed member var.
+    
+            * svg/graphics/filters/SVGFilter.h:
+            Member var moved to Filter.h.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/encoding/css-charset-missing-semi-colon-and-newline.html
</del><ins>+        Merge r166736.
</ins><span class="cx"> 
</span><del>-        * loader/TextResourceDecoder.cpp:
-        (WebCore::TextResourceDecoder::checkForCSSCharset): Add early
-        return.
</del><ins>+    2014-04-03  David Hyatt  &lt;hyatt@apple.com&gt;
+    
+            Continuations casting issue.
+            https://bugs.webkit.org/show_bug.cgi?id=130057
+            &lt;rdar://problem/16283406&gt;
+    
+            Reviewed by Simon Fraser.
+    
+            The code to update relative positioned anonymous block continuations should not
+            have assumed that all siblings were RenderBlocks. Make the code smarter and
+            make it bail when it hits something that isn't part of the block continuation
+            chain.
+    
+            Added fast/block/continuation-crash.html
+    
+            * rendering/RenderInline.cpp:
+            (WebCore::updateStyleOfAnonymousBlockContinuations):
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-24  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Merge r167480.
</ins><span class="cx"> 
</span><del>-        [Mac] preload AVAssetTrack properties before asking for them
-        https://bugs.webkit.org/show_bug.cgi?id=133240
</del><ins>+    2014-04-17  Darin Adler  &lt;darin@apple.com&gt;
+    
+            origin spoofing possible (HTTP Origin, postMessage event.origin) due to inappropriate URL escape sequence decoding
+            https://bugs.webkit.org/show_bug.cgi?id=131837
+            rdar://problem/15211936
+    
+            Reviewed by Anders Carlsson and Dave Hyatt.
+    
+            Tests: fast/dom/DOMURL/parsing.html
+                   fast/dom/HTMLAnchorElement/anchor-element-href-parsing.html
+    
+            * platform/URL.cpp:
+            (WebCore::URL::host): Removed unnecessary call to decodeURLEscapeSequences, which caused
+            problems and was not needed.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        Merge r167524.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::assetTrackMetadataKeyNames): Add preferredTransform and naturalSize to the list
-            of properties we preload.
</del><ins>+    2014-04-18  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
+    
+            Harden RenderInline::inlineElementContinuation()
+    
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=131858&gt;
+    
+            Reviewed by Sam Weinig.
+    
+            No new tests, as there are no known cases of this happening.
+    
+            * rendering/RenderInline.cpp:
+            (WebCore::RenderInline::inlineElementContinuation):
+            Return nullptr if the continuation is neither a RenderInline nor a
+            RenderBlock.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-24  Zsolt Borbely  &lt;zsborbely.u-szeged@partner.samsung.com&gt;
</del><ins>+        Merge r167672.
</ins><span class="cx"> 
</span><del>-        Remove one of the CSSProperty constructor
-        https://bugs.webkit.org/show_bug.cgi?id=131094
</del><ins>+    2014-04-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
+    
+            Check (rather than assume) element is a RenderTableSection before using it
+            https://bugs.webkit.org/show_bug.cgi?id=121858
+    
+            Reviewed by David Kilzer.
+    
+            Test: fast/table/table-insert-object-before-td-crash.html
+    
+            * rendering/RenderTable.cpp:
+            (WebCore::RenderTable::addChild): Check that lastBox is a table section before
+            using the node as if it was one.
+    
+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+        Merge r167569 (committing on behalf of Dana Burkart.)
</ins><span class="cx"> 
</span><del>-        Remove one of the CSSProperty constructor, because it is obsolete.
</del><ins>+    2014-04-19  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSProperty.h:
-        (WebCore::CSSProperty::CSSProperty): Deleted.
-        * css/StyleProperties.h:
-        (WebCore::StyleProperties::PropertyReference::toCSSProperty):
</del><ins>+            Crashes in HTMLFormElement::submit.
+            https://bugs.webkit.org/show_bug.cgi?id=131910
+            &lt;rdar://problem/15661790&gt;
</ins><span class="cx"> 
</span><del>-2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Based on a patch by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        Rename ScrollingTreeScrollingNode's m_scrollPosition to make it clear that it's the value committed from the state tree
-        https://bugs.webkit.org/show_bug.cgi?id=133254
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Tests: fast/forms/form-submission-crash-2.html
+                  fast/forms/form-submission-crash.html
</ins><span class="cx"> 
</span><del>-        Make ScrollingTreeScrollingNode::scrollPosition() pure virtual, and rename
-        the member variable and associated getter to make it clear that they relate
-        to the last committed scroll position.
</del><ins>+            Code that executes arbitrary JS needs to protect objects that it uses afterwards.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingTreeScrollingNode.cpp:
-        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        (WebCore::ScrollingTreeScrollingNode::lastCommittedScrollPosition):
-        (WebCore::ScrollingTreeScrollingNode::scrollPosition): Deleted.
</del><ins>+            * html/HTMLFormElement.cpp:
+            (WebCore::HTMLFormElement::prepareForSubmission):
+            (WebCore::HTMLFormElement::submit):
+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::submitForm):
</ins><span class="cx"> 
</span><del>-2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2014-05-01  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Share some more ScrollingTreeScrollingNode code
-        https://bugs.webkit.org/show_bug.cgi?id=133248
</del><ins>+        Merge r166650.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+    2014-04-02  David Kilzer  &lt;ddkilzer@apple.com&gt;
+    
+            Use outermost containing isolate when constructing bidi runs
+            &lt;http://webkit.org/b/131107&gt;
+            &lt;rdar://problem/15690021&gt;
+    
+            Reviewed by Darin Adler.
+    
+            Merged from Blink (patch by jww@chromium.org):
+            https://src.chromium.org/viewvc/blink?revision=157268&amp;view=revision
+            http://crbug.com/279277
+    
+                Update containingIsolate to go back all the way to top
+                isolate from current root, rather than stopping at the first
+                isolate it finds. This works because the current root is
+                always updated with each isolate run.
+    
+            Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
+                   fast/text/international/unicode-bidi-isolate-nested-with-removes.html
+    
+            * rendering/InlineIterator.h:
+            (WebCore::highestContainingIsolateWithinRoot):
+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::constructBidiRunsForSegment):
+    
+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Push scrollBy(), scrollByWithoutContentEdgeConstraints() and setScrollPosition()
-        down to ScrollingTreeFrameScrollingNode.
-        
-        This requires that scrollPosition() return the right thing for each class, so make
-        it virtual. Future patches will reduce the confusion between the committed scroll
-        position and the one derived from layers.
</del><ins>+    Rollout r168020.
+    This causes build failures on Lion/ML.  
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp:
-        (WebCore::ScrollingTreeFrameScrollingNode::scrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNode::scrollByWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNode::setScrollPosition):
-        * page/scrolling/ScrollingTreeFrameScrollingNode.h:
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        (WebCore::ScrollingTreeScrollingNode::scrollPosition):
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h:
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPosition): Deleted.
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollBy): Deleted.
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollByWithoutContentEdgeConstraints): Deleted.
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollByWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollBy): Deleted.
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollByWithoutContentEdgeConstraints): Deleted.
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Merge r166049
</ins><span class="cx"> 
</span><del>-        AX: fix coordinate mapping for iOS accessibility
-        https://bugs.webkit.org/show_bug.cgi?id=133188
</del><ins>+    2014-03-21  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            HTMLFrameOwnerElement should obey the SubframeLoadingDisabler when creating subframes
+            &lt;rdar://problem/15675780&gt;
</ins><span class="cx"> 
</span><del>-        Make WebCore aware of the accessibility point/rect conversion methods.
</del><ins>+            Merge Blink r156744 by Adam Klein.
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
-        (-[WebAccessibilityObjectWrapper convertRectToScreenSpace:]):
-        * loader/EmptyClients.h:
-        * page/Chrome.cpp:
-        (WebCore::Chrome::accessibilityScreenToRootView):
-        (WebCore::Chrome::rootViewToAccessibilityScreen):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * platform/HostWindow.h:
</del><ins>+            Test: fast/frames/set-iframe-src-in-pagehide-crash.html
</ins><span class="cx"> 
</span><del>-2014-05-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            * loader/SubframeLoader.cpp:
+            (WebCore::SubframeLoader::loadSubframe):
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Non-compositing transforms with subpixel coordinates paint to wrong position.
-        https://bugs.webkit.org/show_bug.cgi?id=133184
-        &lt;rdar://problem/16745606&gt;
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r167278
</ins><span class="cx"> 
</span><del>-        Snapping relative negative coordinate values should produce the same position as if they were
-        positive absolute coordinates.
-        When a child box gets positioned off of its containers towards top/left, its relative coordinates
-        become negative. Pixel snapping those negative values should produce the same
-        final painting position as if the child box was fixed positioned with positive coordinates.
-        Since halfway values always round away from zero, negative and positive halfway values
-        produce opposite rounding direction.
-        This patch ensures that negative halfway values round to the direction as if they were positive.  
</del><ins>+    2014-04-14  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/layers/hidpi-floor-negative-coordinate-values-to-maintain-rounding-direction.html
</del><ins>+            Assertion failure !node || node-&gt;isElementNode() in
+            WebCore::RenderBlock::inlineElementContinuation
</ins><span class="cx"> 
</span><del>-        * platform/LayoutUnit.h:
-        (WebCore::roundToDevicePixel):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
</del><ins>+            https://bugs.webkit.org/show_bug.cgi?id=108829
+            &lt;rdar://problem/13666405&gt;
</ins><span class="cx"> 
</span><del>-2014-05-24  Frédéric Wang  &lt;fred.wang@free.fr&gt;
</del><ins>+            I can't reproduce this assertion failure, but there seems to be an
+            invalid assumption in RenderBlock::inlineElementContinuation() that
+            anything with the &quot;isInline()&quot; bit set is a RenderInline.
</ins><span class="cx"> 
</span><del>-        Use size variants and glyph assembly from the MATH data.
-        https://bugs.webkit.org/show_bug.cgi?id=130322
</del><ins>+            No new test because the test case in the bug does not repro for me.
</ins><span class="cx"> 
</span><del>-        Reviewed by Chris Fleizach.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        This patch modifies the RenderMathMLOperator code to use the MATH table
-        when one is provided in the current font on the &lt;math&gt; tag. More
-        precisely, the MathVariants table is used to draw a size variant or
-        a glyph assembly. The displaystyle attribute is not supported yet, so
-        for now large operators are always assumed to be in display style. The
-        MATH support does not work well with all platforms+fonts, so at the
-        moment the default font-family on the &lt;math&gt; is not changed.
</del><ins>+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::inlineElementContinuation):
+            Dave Hyatt says that this function should only return RenderInline
+            objects (not non-RenderInline inline objects), so update the checks
+            from isInline() to isRenderInline() before casting with
+            toRenderInline().
</ins><span class="cx"> 
</span><del>-        Tests: mathml/opentype/large-operators-LatinModern.html
-               mathml/opentype/opentype-stretchy.html
-               mathml/opentype/vertical-LatinModern.html
</del><ins>+            * rendering/RenderInline.cpp:
+            (WebCore::RenderInline::inlineElementContinuation):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        * css/mathml.css: We only specify the default font-family on the math root, so that people can easily style the mathematics.
-        For now, old fonts without the MATH table are still used as the default.
-        (math):
-        (math, mfenced &gt; *): Deleted.
-        (mo, mfenced): Deleted.
-        * platform/graphics/SimpleFontData.cpp: don't return the math data if the font is loading.
-        (WebCore::SimpleFontData::mathData):
-        * platform/graphics/opentype/OpenTypeMathData.cpp: update #ifdef so that disabling ENABLE_OPENTYPE_MATH won't lead to errors with unused parameters.
-        (WebCore::OpenTypeMathData::OpenTypeMathData):
-        (WebCore::OpenTypeMathData::getMathConstant):
-        (WebCore::OpenTypeMathData::getItalicCorrection):
-        (WebCore::OpenTypeMathData::getMathVariants):
-        * rendering/mathml/RenderMathMLOperator.cpp:
-        (WebCore::RenderMathMLOperator::boundsForGlyph):
-        (WebCore::RenderMathMLOperator::heightForGlyph):
-        (WebCore::RenderMathMLOperator::advanceForGlyph):
-        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): We handle preferred width of size variants.
-        (WebCore::RenderMathMLOperator::shouldAllowStretching): This function now only returns whether the operator will stretch and no longer has side effect.
-        (WebCore::RenderMathMLOperator::getGlyphAssemblyFallBack): We add a function to convert from the MathVariant table data to the format supported by RenderMathMLOperator.
-        (WebCore::RenderMathMLOperator::getDisplayStyleLargeOperator): We add a function to get the glyph that will be used for large operators in display style.
-        (WebCore::RenderMathMLOperator::findStretchyData): We make this function handle size variants.
-        (WebCore::RenderMathMLOperator::updateStyle): We handle size variants.
-        (WebCore::RenderMathMLOperator::paint): We handle size variants.
-        * rendering/mathml/RenderMathMLOperator.h:
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-23  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+        Merge r167211
</ins><span class="cx"> 
</span><del>-        REGRESSION (iOS WebKit2): requestAnimationFrame fires more than once between layer tree commits
-        https://bugs.webkit.org/show_bug.cgi?id=132794
-        &lt;rdar://problem/16877909&gt;
</del><ins>+    2014-04-13  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            userVisibleString should not try to &quot;encode&quot; host names
+            https://bugs.webkit.org/show_bug.cgi?id=131587
+            rdar://problem/14686849
</ins><span class="cx"> 
</span><del>-        Virtualize DisplayRefreshMonitor so that WebKit2 can implement its own DisplayRefreshMonitor for UI-side compositing views.
-        This allows the synchronization of requestAnimationFrame callbacks with UI-side compositing painting.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::graphicsLayerFactory):
-        (WebCore::ChromeClient::createDisplayRefreshMonitor):
-        * platform/graphics/DisplayRefreshMonitorFactory.h: Added.
-        * platform/graphics/GraphicsLayerUpdater.cpp:
-        (WebCore::GraphicsLayerUpdater::createDisplayRefreshMonitor):
-        * platform/graphics/GraphicsLayerUpdater.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::createDisplayRefreshMonitor):
-        * rendering/RenderLayerCompositor.h:
-        Give the ChromeClient a chance to provide us with a custom DisplayRefreshMonitor.
-        If it does not, we'll fall back to making a DisplayRefreshMonitorMac or
-        DisplayRefreshMonitorIOS depending on the platform.
</del><ins>+            * WebCore.exp.in: Updated for WebCoreNSURLExtras argument type changes.
</ins><span class="cx"> 
</span><del>-        * dom/ScriptedAnimationController.cpp:
-        * dom/ScriptedAnimationController.h:
-        * platform/graphics/DisplayRefreshMonitor.cpp:
-        * platform/graphics/DisplayRefreshMonitor.h:
-        * platform/graphics/DisplayRefreshMonitorClient.cpp: Added.
-        * platform/graphics/DisplayRefreshMonitorClient.h: Added.
-        * platform/graphics/DisplayRefreshMonitorManager.cpp: Added.
-        * platform/graphics/DisplayRefreshMonitorManager.h: Added.
-        Split DisplayRefreshMonitor.cpp into one file per class.
-        Use references in a few places.
-        Remove some useless comments.
</del><ins>+            * platform/mac/WebCoreNSURLExtras.h: Removed unneeded code to make this
+            Objective-C++ header compile in plain C++ files, which we never need to do.
+            Added missing argument name, baseURL, and changed mysterious CFIndex arguments
+            to the correct type, CFURLComponentType.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/DisplayRefreshMonitor.cpp:
-        (WebCore::DisplayRefreshMonitor::displayDidRefresh):
-        Use takeAny() and remove a FIXME about it not existing.
</del><ins>+            * platform/mac/WebCoreNSURLExtras.mm:
+            (WebCore::isLookalikeCharacter): Removed the inline keyword from this, and added
+            more lookalike characters from the Mozilla list referenced here.
+            (WebCore::URLByTruncatingOneCharacterBeforeComponent): Updated argument type.
+            (WebCore::dataForURLComponentType): Ditto.
+            (WebCore::userVisibleString): Only call mapHostNames if host name decoding is
+            needed; no encoding here.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/DisplayRefreshMonitorClient.cpp: Added.
-        (WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded):
-        Use an early return instead of having the whole function body in an if().
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ios/DisplayRefreshMonitorIOS.h: Added.
-        * platform/graphics/ios/DisplayRefreshMonitorIOS.mm:
-        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
-        * platform/graphics/mac/DisplayRefreshMonitorMac.h: Added.
-        Virtualize DisplayRefreshMonitorIOS and DisplayRefreshMonitorMac,
-        and move things specific to each of them out of DisplayRefreshMonitor itself.
</del><ins>+        Merge r167167
</ins><span class="cx"> 
</span><del>-2014-05-23  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</del><ins>+    2014-04-11  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        CSS JIT: Apply backtracking optimization to adjacent backtracking
-        https://bugs.webkit.org/show_bug.cgi?id=132951
</del><ins>+            Assertion failure changing select element size during focus event
+            dispatch
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=131566&gt;
+            &lt;rdar://problem/16400735&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-        Apply the backtracking optimization to the adjacent backtracking.
-        This optimization is already done for the descendant backtracking.
-        We apply this to the adjacent backtracking similarly.
</del><ins>+            Test: fast/forms/select-change-size-during-focus.html
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/backtracking-adjacent-optimized.html
</del><ins>+            * html/HTMLSelectElement.cpp:
+            (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+            Adopt the fix from Chromium r171216; check that the renderer is still
+            of the expected type, and return early if it is not.
</ins><span class="cx"> 
</span><del>-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorFragment::SelectorFragment):
-        (WebCore::SelectorCompiler::solveAdjacentBacktrackingActionForDirectAdjacent):
-        (WebCore::SelectorCompiler::solveBacktrackingAction):
-        (WebCore::SelectorCompiler::computeBacktrackingStartOffsetInChain):
-        (WebCore::SelectorCompiler::computeBacktrackingHeightFromDescendant):
-        (WebCore::SelectorCompiler::computeBacktrackingWidthFromIndirectAdjacent):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::linkFailures):
-        (WebCore::SelectorCompiler::computeBacktrackingStartHeightFromDescendant): Deleted.
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-23  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Merge r167135
</ins><span class="cx"> 
</span><del>-        Make CSS JIT run on ARM64.
-        https://bugs.webkit.org/show_bug.cgi?id=133156
</del><ins>+    2014-04-10  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Heap-use-after-free in WebCore::SpeechSynthesisUtterance::startTime
+            https://bugs.webkit.org/show_bug.cgi?id=131482
</ins><span class="cx"> 
</span><del>-        * cssjit/FunctionCall.h:
-        (WebCore::FunctionCall::saveAllocatedRegisters):
-        (WebCore::FunctionCall::restoreAllocatedRegisters):
-        Use StackAllocator's new push and pop functions to push and pop a vector instead of iterating it.
-        * cssjit/RegisterAllocator.h:
-        (WebCore::RegisterAllocator::reserveCalleeSavedRegisters):
-        (WebCore::RegisterAllocator::restoreCalleeSavedRegisters):
-        Return a vector of registers to allocate instead of doing the allocation to make the RegisterAllocator
-        not need to know about the StackAllocator and to use the new vector push and pop functions.
-        (WebCore::RegisterAllocator::~RegisterAllocator):
-        Store RegisterIDs instead of StackReferences to avoid needing to know about the stack.
-        * cssjit/SelectorCompiler.cpp:
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::compile):
-        Removed the requirement for assert to be disabled to print disassembly when debugging css jit.
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generatePrologue):
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateEpilogue):
-        Added to correctly push the link register and frame pointer.
-        This is required if the jit code calls a function on arm64 and helpful for debugging tools on x86_64.
-        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
-        Generate the prologue and epilogue which respectively push and pop
-        the link register, frame pointer, and callee saved registers if needed.
-        * cssjit/StackAllocator.h:
-        (WebCore::StackAllocator::push):
-        (WebCore::StackAllocator::pop):
-        Added new vector push and pop functions to use stp and ldb instructions on arm64.
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-2014-05-23  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+            Hold onto the utterance until it has time to fire, in case other references have been removed.
</ins><span class="cx"> 
</span><del>-        Hide fullscreen immediately when switching tabs.
-        https://bugs.webkit.org/show_bug.cgi?id=133239
</del><ins>+            Merged from Blink r171077 by &lt;dmazzoni@chromium.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Test: platform/mac/fast/speechsynthesis/speech-synthesis-gc-utterance-crash.html
</ins><span class="cx"> 
</span><del>-        This change allows fullscreen to disappear immediately while still cleaning
-        up fullscreen normally.
</del><ins>+            * Modules/speech/SpeechSynthesis.cpp:
+            (WebCore::SpeechSynthesis::handleSpeakingCompleted):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ios/WebVideoFullscreenControllerAVKit.h:
-        renamed function to requestHideAndExitFullscreen
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
-        renamed function to requestHideAndExitFullscreen
</del><ins>+        Merge r167093
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController requestHideAndExitFullscreen]):
-        rename of requestExitFullscreen that also hides.
</del><ins>+    2014-04-08  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (-[WebVideoFullscreenController requestExitFullscreen]): Deleted.
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.h: declare requestHideAndExitFullscreen()
-        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
-        (WebVideoFullscreenInterfaceAVKit::requestHideAndExitFullscreen):
-        this hides the window before requesting exitfullscreen from the model.
</del><ins>+            Assertion failure in WebCore::FlexBoxIterator::next()
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=117176&gt;
+            &lt;rdar://problem/14054549&gt;
</ins><span class="cx"> 
</span><del>-2014-05-23  Tim Horton  &lt;timothy_horton@apple.com&gt;
</del><ins>+            Code added in r115687 began removing anonymous wrappers when children
+            become inline. However, there are some objects, like
+            RenderDeprecatedFlexBox, whose children should always be blocks.
</ins><span class="cx"> 
</span><del>-        [iOS] WKPDFView should have a page indicator
-        https://bugs.webkit.org/show_bug.cgi?id=133109
-        &lt;rdar://problem/16383003&gt;
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            * rendering/RenderBlock.h:
+            (WebCore::RenderBlock::canCollapseAnonymousBlockChild):
+            Made public.
</ins><span class="cx"> 
</span><del>-        * English.lproj/Localizable.strings:
</del><ins>+            * rendering/RenderObject.cpp:
+            (WebCore::RenderObject::removeAnonymousWrappersForInlinesIfNecessary):
+            Return early if we can't collapse anonymous block children.
</ins><span class="cx"> 
</span><del>-2014-05-23  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Remove invalid ASSERT in wordRangeForPosition.
-        https://bugs.webkit.org/show_bug.cgi?id=133232
</del><ins>+        Merge r167092
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+    2014-04-07  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        In WK2 for iOS this function is called on every selection change.
-        The selection could be set by Javascript in an element that is not visible.
-        In that case we won't be able to create a VisiblePosition therefore wordRangeForPosition
-        should not ASSERT that the VisiblePosition is not null, but rather
-        perform an early return if it is null.
</del><ins>+            Assertion failure, !node || node-&gt;isElementNode(), in
+            WebCore::RenderBlock::clone()
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=110489&gt;
+            &lt;rdar://problem/13666425&gt;
</ins><span class="cx"> 
</span><del>-        * editing/VisibleUnits.cpp:
-        (WebCore::wordRangeFromPosition):
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-2014-05-23  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+            We're ending up in RenderBlock::splitBlocks() with |this| ==
+            |fromBlock|.  We then try to climb the ancestor block chain from
+            this-&gt;parent() to |fromBlock|, but this-&gt;parent() is already above
+            |fromBlock|, so we end up climbing up to the RenderView and trying to
+            clone it, causing the assertion failure.
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Use gridRowCount() and gridColumnCount() when possible
-        https://bugs.webkit.org/show_bug.cgi?id=133213
</del><ins>+            Adopt Chromium's mitigation for this from
+            &lt;https://codereview.chromium.org/13852041&gt;. This is not intended as a
+            fix for the underlying issue.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sergio Villar Senin.
</del><ins>+            Also, fix another issue that occurs with this fuzzed test case that's
+            not handled by the Chromium fix.
</ins><span class="cx"> 
</span><del>-        Use gridRowCount() and gridColumnCount() instead of m_grid.size() and
-        m_grid[0].size() to make the code more descriptive and easier to
-        understand.
</del><ins>+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::splitBlocks):
+            Ensure while we're in the loop that |curr| is a descendant of
+            |fromBlock|. From the Chromium patch:
</ins><span class="cx"> 
</span><del>-        No new tests (No change in behavior).
</del><ins>+                We need to check in every iteration of the loop because
+                moveChildrenTo could have moved |curr|. This is a mitigation and
+                not really a fix against a class of tree craziness.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderGrid.cpp:
-        (WebCore::RenderGrid::growGrid):
-        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
</del><ins>+            Finally, before moving children from |fromBlock| to |toBlock|, ensure
+            that the children are children of |fromBlock|. If we never entered the
+            loop, they will be siblings of |fromBlock|, not children.
</ins><span class="cx"> 
</span><del>-2014-05-23  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r153917): Chart for the Category Explorer within Quicken Essentials
-        does not draw until you force a redraw
-        https://bugs.webkit.org/show_bug.cgi?id=133228
-        &lt;rdar://problem/15221231&gt;
</del><ins>+        Merge r166601
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2014-04-01  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/RuntimeApplicationChecks.cpp: (WebCore::applicationIsQuickenEssentials):
-        * platform/RuntimeApplicationChecks.h:
-        Added a check for Quicken Essentials.
</del><ins>+            RenderQuote must destroy remaining text renderer before first letter renderer
+            https://bugs.webkit.org/show_bug.cgi?id=78023
+            &lt;rdar://problem/10830009&gt;
</ins><span class="cx"> 
</span><del>-        * platform/mac/WidgetMac.mm: (WebCore::Widget::paint): Don't do an early return
-        for Quicken Essentials, it depends on drawing to update its layer.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-2014-05-23  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+            Merged from Blink (patch by Abhishek Arya):
+            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=151270
</ins><span class="cx"> 
</span><del>-        REGRESSION(r169105): fast/regions/cssom/region-range-for-box-crash.html is more crashy than before
-        https://bugs.webkit.org/show_bug.cgi?id=133124
</del><ins>+            Following the fix for &lt;https://bugs.webkit.org/show_bug.cgi?id=114586&gt;, a
+            RenderQuote may have child render objects for the first letter of its text
+            and everything following the first letter so as to support the CSS first-
+            letter property. The latter renderer is responsible for destroying the former
+            on destruction. It's sufficient to reverse the destruction of the children of
+            RenderQuote to ensure that we destroy the remaining text renderer before we
+            destroy the first letter renderer.
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            Test: fast/css-generated-content/quote-first-letter-crash.html
</ins><span class="cx"> 
</span><del>-        When adjusting the end points of a subtree selection in the case of a document
-        with named flows, we have to make sure that we pass the computed end
-        points to the visible selection algorithm only if the end points are
-        part of the same subtree, otherwise assume a selection clear behavior.
</del><ins>+            * rendering/RenderQuote.cpp:
+            (WebCore::RenderQuote::updateText):
</ins><span class="cx"> 
</span><del>-        The test fast/regions/cssom/region-range-for-box-crash.html is used to
-        test this behavior.
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/SelectionSubtreeRoot.cpp:
-        (WebCore::SelectionSubtreeRoot::adjustForVisibleSelection):
-        (WebCore::SelectionSubtreeRoot::selectionStartEndPositions): Moved to header file.
-        * rendering/SelectionSubtreeRoot.h:
-        (WebCore::SelectionSubtreeRoot::selectionStartEndPositions):
</del><ins>+        Merge r166457
</ins><span class="cx"> 
</span><del>-2014-05-23  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+    2014-03-29  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        reset m_havePreparedToPlay when changing media engines.
-        https://bugs.webkit.org/show_bug.cgi?id=133199
</del><ins>+            Preserve selection end positions in directionOfSelection
+            &lt;http://webkit.org/b/104813&gt;
+            &lt;rdar://problem/13666417&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        If a play request comes in before the media player is created, m_havePreparedToPlay
-        is set to true. But when the player is created, this prevents the new player from
-        getting the prepare call.
</del><ins>+            Merged from Blink (patch by kenrb@chromium.org):
+            https://src.chromium.org/viewvc/blink?revision=150621&amp;view=revision
+            http://crbug.com/164263
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::mediaPlayerEngineUpdated): set m_havePreparedToPlay false.
</del><ins>+                VisibleSelection::visibleStart() and VisibleSelection::visibleEnd()
+                can both cause layouts, which has the potential to invalidate any
+                rendertree-based objects. This was causing a problem in
+                FrameSelection::directionOfSelection(), where a reference to a
+                lineBox was being held across a call to visibleEnd().
</ins><span class="cx"> 
</span><del>-2014-05-23  Oliver Hunt  &lt;oliver@apple.com&gt;
</del><ins>+                This patch ensures that the any layout is completed before linebox
+                references are retrieved.
</ins><span class="cx"> 
</span><del>-        Navigator object needs to have properties directly on the instance object
-        https://bugs.webkit.org/show_bug.cgi?id=133221
</del><ins>+            Test: editing/selection/layout-during-move-selection-crash.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Mark Lam.
</del><ins>+            * editing/FrameSelection.cpp:
+            (WebCore::FrameSelection::directionOfSelection):
</ins><span class="cx"> 
</span><del>-        Flag the Navigator object as requiring properties to be on the instance
-        as there were a few compatibility issues when on the prototype.
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/scripts/CodeGeneratorJS.pm:
-        (InterfaceRequiresAttributesOnInstance):
</del><ins>+        Merge r166428
</ins><span class="cx"> 
</span><del>-2014-05-23  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+    2014-03-28  Radu Stavila  &lt;stavila@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        Switch CSSGradientValue to use more references
-        https://bugs.webkit.org/show_bug.cgi?id=133206
</del><ins>+            In some situations, partial layouts of floating elements produce incorrect results.
+            https://bugs.webkit.org/show_bug.cgi?id=122668
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Switch from pointers to references in various places.
</del><ins>+            When performing partial layout of float elements and checking if other float
+            elements are encountered, incorrect results were obtained by not checking
+            the size of the existing floats vector.
</ins><span class="cx"> 
</span><del>-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::image):
-        (WebCore::CSSGradientValue::addStops):
-        (WebCore::positionFromValue):
-        (WebCore::CSSGradientValue::computeEndPoint):
-        (WebCore::CSSLinearGradientValue::createGradient):
-        (WebCore::CSSRadialGradientValue::resolveRadius):
-        (WebCore::CSSRadialGradientValue::createGradient):
-        * css/CSSGradientValue.h:
</del><ins>+            Test: fast/block/float/floats-in-clean-line-crash.html
</ins><span class="cx"> 
</span><del>-2014-05-23  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::RenderBlockFlow::checkFloatsInCleanLine):
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Make webkit-box-shadow painting subpixel aware.
-        https://bugs.webkit.org/show_bug.cgi?id=133201
-        &lt;rdar://problem/16072830&gt;
</del><ins>+2014-04-30  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Merge r166236
</ins><span class="cx"> 
</span><del>-        This patch enables webkit-box-shadow to be painted on a subpixel position. However, we
-        still truncate -webkit-box-shadow property values. Tracked here: http://webkit.org/b/133202
</del><ins>+    2014-03-25  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/box-shadow/hidpi-webkit-box-shadow-subpixel-position.html
</del><ins>+            Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
+            &lt;http://webkit.org/b/130713&gt;
+            &lt;rdar://problem/15661876&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/FloatRoundedRect.cpp:
-        (WebCore::FloatRoundedRect::inflateWithRadii): same as in from RoundedRect.
-        (WebCore::FloatRoundedRect::adjustRadii): same as in from RoundedRect.
-        * platform/graphics/FloatRoundedRect.h:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintBoxShadow):
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-2014-05-22  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</del><ins>+            Merged from Blink (patch by Ian Beer):
+            http://crbug.com/303657
+            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=158938
</ins><span class="cx"> 
</span><del>-        [Curl] Crash when exceeding maximum cache limit.
-        https://bugs.webkit.org/show_bug.cgi?id=133185
</del><ins>+            Test: fast/forms/form-submission-crash-successful-submit-button.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            * html/HTMLFormElement.cpp:
+            (WebCore::HTMLFormElement::submit):
</ins><span class="cx"> 
</span><del>-        When the maximum cache limit is exceeded, I get a crash.
-        This happens when deleting cache entries, because a reference to the url string object in the LRU list
-        is used as a parameter to invalidateCacheEntry(), when called from makeRoomForNewEntry().
-        When the string is removed from the LRU list in makeRoomForNewEntry(), the string is deleted.
-        Next, the string is accessed again to remove the url from the index, and we crash.
</del><ins>+2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This can be fixed by removing the string from the LRU list after it is removed from the index.
</del><ins>+        Merge r160010.
</ins><span class="cx"> 
</span><del>-        Fixing the crash also revealed an infinite loop problem.
-        If the url for some reason only exist in the LRU list, and not in the index,
-        we will inifitely loop in makeRoomForNewEntry(), trying to remove this url from the cache, but never succeeding.
-        This can be fixed by removing the url from the LRU list, also when it's not in the index.
</del><ins>+    2013-12-03  László Langó  &lt;lango@inf.u-szeged.hu&gt;
</ins><span class="cx"> 
</span><del>-        * platform/network/curl/CurlCacheManager.cpp:
-        (WebCore::CurlCacheManager::makeRoomForNewEntry): Avoid infinite loop by checking if there are more cache entries to remove.
-        (WebCore::CurlCacheManager::invalidateCacheEntry): Avoid crash and infinite loop by removing url from LRU list last.
</del><ins>+            ASSERTION FAILED: !value || (value-&gt;isPrimitiveValue()) in WebCore::StyleProperties::getLayeredShorthandValue.
+            https://bugs.webkit.org/show_bug.cgi?id=125146
</ins><span class="cx"> 
</span><del>-2014-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Make viewport units work in CSS gradients
-        https://bugs.webkit.org/show_bug.cgi?id=133204
-        &lt;rdar://problem/17012259&gt;
-        
-        Reviewed by Tim Horton.
-        
-        Make viewport percentage lengths work in gradients.
</del><ins>+            Do not presume that |yValue| is primitive if |value| is implicit in StylePropertySerializer.
+            An implicit y-value can become explicit if specified as a separate longhand.
+            At the same time, its new value can be non-primitive.
</ins><span class="cx"> 
</span><del>-        Test: fast/gradients/viewport-units-gradient.html
</del><ins>+            Backported from Blink:
+            http://src.chromium.org/viewvc/blink?view=rev&amp;rev=153678
</ins><span class="cx"> 
</span><del>-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::addStops):
-        (WebCore::CSSLinearGradientValue::createGradient):
-        (WebCore::CSSRadialGradientValue::createGradient):
-        * css/CSSGradientValue.h:
</del><ins>+            Test: fast/css/webkit-mask-crash-implicit.html
</ins><span class="cx"> 
</span><del>-2014-05-22  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+            * css/StyleProperties.cpp:
+            (WebCore::StyleProperties::getLayeredShorthandValue):
</ins><span class="cx"> 
</span><del>-        [iOS][WK2] Add support for minimal-ui viewports
-        https://bugs.webkit.org/show_bug.cgi?id=133162
</del><ins>+2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+        Remove extraneous ! from merge of r166304.
</ins><span class="cx"> 
</span><del>-        Add support for minimal-ui directly into the Viewport configuration.
</del><ins>+2014-03-26  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        ViewportConfiguration knows about two kinds of layout size in scrollview coordinates:
-        -normal size
-        -minimal ui size.
</del><ins>+        Merge r166304.
</ins><span class="cx"> 
</span><del>-        Initially, the page is initialized with resetMinimalUI() and starts with a normal layout.
</del><ins>+    2014-03-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        At any time before the main resource is loaded, the Web page can update its viewport meta tag
-        to include minimal-ui. The viewport configuration is updated immediately to reflect the minimal-ui
-        layout size. Any layout after that takes minimal-ui into account.
</del><ins>+            REGRESSION(r162679): Poster image visible under the video
+            https://bugs.webkit.org/show_bug.cgi?id=130783
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * css/LengthFunctions.cpp:
-        (WebCore::minimumValueForLength):
-        (WebCore::floatValueForLength):
-        * css/StyleResolver.cpp:
-        (WebCore::StyleResolver::viewportPercentageValue):
-        * dom/ViewportArguments.h:
-        (WebCore::ViewportArguments::operator==):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::setViewportSizeForCSSViewportUnits):
-        (WebCore::FrameView::viewportSizeForCSSViewportUnits):
-        (WebCore::FrameView::setViewportSize): Deleted.
-        (WebCore::FrameView::viewportSize): Deleted.
-        * page/FrameView.h:
-        * page/ViewportConfiguration.cpp:
-        (WebCore::ViewportConfiguration::ViewportConfiguration):
-        (WebCore::ViewportConfiguration::setMinimumLayoutSize):
-        (WebCore::ViewportConfiguration::setMinimumLayoutSizeForMinimalUI):
-        (WebCore::ViewportConfiguration::activeMinimumLayoutSizeInScrollViewCoordinates):
-        (WebCore::ViewportConfiguration::resetMinimalUI):
-        (WebCore::ViewportConfiguration::pageWillRenderFirstFrame):
-        (WebCore::ViewportConfiguration::initialScale):
-        (WebCore::ViewportConfiguration::minimumScale):
-        (WebCore::ViewportConfiguration::updateConfiguration):
-        (WebCore::ViewportConfiguration::layoutWidth):
-        (WebCore::ViewportConfiguration::layoutHeight):
-        (WebCore::ViewportConfiguration::description):
-        * page/ViewportConfiguration.h:
-        (WebCore::ViewportConfiguration::minimumLayoutSizeForMinimalUI):
-        (WebCore::ViewportConfiguration::usesMinimalUI):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::viewportSizeForCSSViewportUnits):
-        (WebCore::RenderView::viewportSize): Deleted.
-        * rendering/RenderView.h:
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-05-22  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</del><ins>+            In the listed revision, we started checking for isRenderImage()
+            instead of isImage(). RenderMedias return 'true' for the first
+            but 'false' for the second. Change the if() statement to check
+            for isRenderMedia() in addition to !isRenderImage().
</ins><span class="cx"> 
</span><del>-        Can't type in status in facebook.com on iOS Safari because keyboard disappears
-        https://bugs.webkit.org/show_bug.cgi?id=133196
</del><ins>+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2014-03-24  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fixed the bug by rolling out r156252.
</del><ins>+        Remove a commented line of code introduced by r166104.
</ins><span class="cx"> 
</span><del>-        When the user taps on the status on facebook.com, the page focuses a textarea,
-        which is then made momentarily invisible by setting display:none.
-        The page then removes display:none later and expects the textarea to be still focused.
</del><ins>+        Reviewed by Babak Shafiei.
</ins><span class="cx"> 
</span><del>-        With r156252, the focus is removed after the page sets display:none and the keyboard disappears.
-        Since the focus is never reset on the textarea, the user can never type in anything.
</del><ins>+        A line was commented out when it should have been deleted. This patch
+        corrects that oversight.
</ins><span class="cx"> 
</span><del>-        The specification may need to change here given that this (rather odd) behavior/expectation exists
-        on one of the most popular websites on the Web.
</del><ins>+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
</ins><span class="cx"> 
</span><del>-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::recalcStyle):
-        (WebCore::Document::updateLayout):
-        (WebCore::Document::resetHiddenFocusElementSoon): Deleted.
-        (WebCore::Document::resetHiddenFocusElementTimer): Deleted.
-        * dom/Document.h:
</del><ins>+2014-03-22  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</del><ins>+        Finish merge of r160065. The changes from Source/WebCore/rendering/RenderView.cpp were incorrectly
+        omitted from the original merge in r165142.
</ins><span class="cx"> 
</span><del>-        http/tests/security/xss-DENIED-xsl-document-redirect.xml fails with NetworkProcess
-        https://bugs.webkit.org/show_bug.cgi?id=132523
</del><ins>+    2013-12-03  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
+    
+            Potential crash in RenderView::selectionBounds and RenderView::repaintSelection
+            https://bugs.webkit.org/show_bug.cgi?id=125207
+    
+            Reviewed by Simon Fraser.
+            
+            Merge https://chromium.googlesource.com/chromium/blink/+/f9e6e288a5aa959f05c374806121aaf0fc52d440
+    
+            Update style in FrameSelection instead of RenderView's member functions. These are the last two
+            member functions of RenderView that updates the style.
+    
+            * editing/FrameSelection.cpp:
+            (WebCore::FrameSelection::focusedOrActiveStateChanged):
+            (WebCore::FrameSelection::bounds):
+            * rendering/RenderView.cpp:
+            (WebCore::RenderView::selectionBounds):
+            (WebCore::RenderView::repaintSelection):
+    
+2014-03-21  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        Merge r166090.
</ins><span class="cx"> 
</span><del>-        We should not manufacture a response in the event of an error during a
-        synchronous XHR. In addition, this test removes two places that are
-        sensitive to such a manufactured response.
</del><ins>+    2014-03-21  Oliver Hunt  &lt;oliver@apple.com&gt;
+    
+            Fix a crash when assigning an object to document.location
+            https://bugs.webkit.org/show_bug.cgi?id=130213
+    
+            Reviewed by Geoffrey Garen.
+    
+            Convert location to string before we make use the document.
+            This prevents us from attempting to navigate a frame that
+            has already been removed.
+    
+            Test: fast/dom/navigation-with-sideeffects-crash.html
+    
+            * bindings/js/JSDocumentCustom.cpp:
+            (WebCore::JSDocument::location):
+            (WebCore::JSDocument::setLocation):
+    
+2014-03-20  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Updates test expectations.
</del><ins>+        Merge r165821.
</ins><span class="cx"> 
</span><del>-        * loader/DocumentThreadableLoader.cpp:
-        (WebCore::DocumentThreadableLoader::loadRequest): Don't inspect a
-        loader response if there is an error
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Do not
-        manufacture a response
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::platformLoadResourceSynchronously): Do not
-        manufacture a response
-        * xml/XSLTProcessorLibxslt.cpp:
-        (WebCore::docLoaderFunc): Only use the response's URL if no error
-        occurred.
</del><ins>+    2014-03-18  Antti Koivisto  &lt;antti@apple.com&gt;
+    
+            Mutating rules returned by getMatchedCSSRules can result in crash
+            https://bugs.webkit.org/show_bug.cgi?id=130209
+    
+            Reviewed by Andreas Kling.
+            
+            The non-standard getMatchedCSSRules API returns CSSStyleRule objects that don't
+            have parent stylesheet pointer (as we don't know which sheet the rule originated from).
+            Mutating the rule via such wrapper can lead to crashes later as we fail to invalidate
+            the underlying stylesheet.
+            
+            Fix by disallowing mutation of style rules that don't have parent sheet pointer. CSSStyleRule
+            has two mutable properties selectorText and style. The latter gives back CSSStyleDeclaration.
+            This patch disallows mutations in both cases for CSSStyleRules that don't have parent stylesheet
+            pointer.
+            
+            While it is technically possible to have CSSRules that are legitimately disconnected
+            from stylesheet (by removing rule from sheet while holding a reference to it) it never
+            makes sense to mutate such rule as there is no way to do anything with it afterwards.
+    
+            Tests: fast/css/getMatchedCSSProperties-rule-mutation.html
+                   fast/css/getMatchedCSSRules-crash.html
+    
+            * css/CSSStyleRule.cpp:
+            (WebCore::CSSStyleRule::setSelectorText):
+    
+                Bail out if parent stylesheet is null.
+    
+            * css/PropertySetCSSStyleDeclaration.cpp:
+            (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+            (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+            (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+            (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+            
+                Allow StyleRuleCSSStyleDeclaration subclass cancel the mutation via
+                boolean return value from willMutate.
+    
+            (WebCore::StyleRuleCSSStyleDeclaration::willMutate):
+            
+                Disallow mutation if the owning CSSStyleRule is null or has null stylesheet.
+    
+            (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
+            
+                We never get here with null rule or stylesheet anymore.
+    
+            * css/PropertySetCSSStyleDeclaration.h:
+            (WebCore::PropertySetCSSStyleDeclaration::willMutate):
+    
+2014-03-20  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</del><ins>+        Merge r165921.
</ins><span class="cx"> 
</span><del>-        Unreviewed typo fix.
</del><ins>+    2014-03-19  Antti Koivisto  &lt;antti@apple.com&gt;
+    
+            Crash with long selector list
+            https://bugs.webkit.org/show_bug.cgi?id=123006
+    
+            Reviewed by Andreas Kling.
+    
+            Test: fast/css/long-selector-list-crash.html
+    
+            * css/CSSSelectorList.cpp:
+            (WebCore::CSSSelectorList::CSSSelectorList):
+            (WebCore::CSSSelectorList::adoptSelectorVector):
+            (WebCore::CSSSelectorList::operator=):
+            * css/StyleRule.cpp:
+            (WebCore::StyleRule::create):
+    
+                Add a bunch of asserts.
+    
+            (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):
+            
+                This could produce a zero-length selector list.
+    
+2014-03-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by NOBODY.
</del><ins>+        Unreviewed Win64 build fix; explicit operators are not valid in VS2010.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        With the 'explicit bool' operator removed, just test weakThis.get() explicitly.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/mac/FontMac.mm:
-        (WebCore::Font::dashesForIntersectionsWithRect): Accidentally said run.length() instead of glyphBuffer.size().
</del><ins>+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):
</ins><span class="cx"> 
</span><del>-2014-05-22  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+2014-03-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [iOS WebKit2] Web process should try to shrink its memory footprint when going into background.
-        &lt;https://webkit.org/b/133197&gt;
-        &lt;rdar://problem/17011561&gt;
</del><ins>+        Merge r165478.
</ins><span class="cx"> 
</span><del>-        Make releaseMemory() public so we can call it from the process-will-suspend callback.
</del><ins>+    2014-03-12  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+            [Mac] Crash when running media/fallback.html test in MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification()
+            https://bugs.webkit.org/show_bug.cgi?id=130136
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/MemoryPressureHandler.h:
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-22  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            MediaPlayerPrivateAVFoundation is trying to lock its m_queueMutex from an async thread after
+            while being destroyed in the main thread. To resolve this race condition, redispatch from
+            the async thread to the main thread, and use a WeakPtr to determine whether the object has
+            been destroyed or not.
</ins><span class="cx"> 
</span><del>-        Hook up a setting for showing detailed logging during memory pressure relief.
-        &lt;https://webkit.org/b/133194&gt;
</del><ins>+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::checkPlayability):
</ins><span class="cx"> 
</span><del>-        Make the pressure relief logger opt-in. Also make it flush memory back to the
-        OS (for both malloc and FastMalloc) to get more accurate numbers at each step.
</del><ins>+2014-03-18  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Gavin Barraclough.
</del><ins>+        Follow-up fix for the merge of r163579.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/MemoryPressureHandler.cpp:
-        * platform/MemoryPressureHandler.h:
-        (WebCore::MemoryPressureHandler::ReliefLogger::ReliefLogger):
-        (WebCore::MemoryPressureHandler::ReliefLogger::~ReliefLogger):
-        (WebCore::MemoryPressureHandler::ReliefLogger::setLoggingEnabled):
-        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
-        (WebCore::MemoryPressureHandler::ReliefLogger::platformMemoryUsage):
</del><ins>+    2014-03-17  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+            Merge parts from Blink CLs 169865acce3b6bc85ac1adf07b2798aaf9aad67a and 04f613e7f0c35f444d5a9bd42da55c69df65cf64 that weren't merged to trunk
+            &lt;rdar://problem/16307742&gt;
</ins><span class="cx"> 
</span><del>-        Don't scan for phone numbers in editable regions
-        &lt;rdar://problem/16949846&gt; and https://bugs.webkit.org/show_bug.cgi?id=133192
</del><ins>+            Unreviewed Layout Test fix.
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+            * html/parser/HTMLConstructionSite.cpp:
+            (WebCore::insert):
+            (WebCore::executeInsertTask):
+            (WebCore::executeReparentTask):
+            (WebCore::executeInsertAlreadyParsedChildTask):
</ins><span class="cx"> 
</span><del>-        No new tests (Currently untested WK2-only feature)
</del><ins>+2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * editing/Editor.cpp:
-        (WebCore::Editor::scanRangeForTelephoneNumbers): Skip the range if the Node is editable.
</del><ins>+        Merge r165753.
</ins><span class="cx"> 
</span><del>-2014-05-22  Jeremy Jones  &lt;jeremyj@apple.com&gt;
</del><ins>+    2014-03-16  Brent Fulgham  &lt;bfulgham@apple.com&gt;
+    
+            Provide preference to enable additional AVFoundation options
+            https://bugs.webkit.org/show_bug.cgi?id=130275
+    
+            Reviewed by Eric Carlson.
+    
+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::doesHaveAttribute): Added.
+            * html/HTMLMediaElement.h:
+            * page/Settings.in: Add new attribute.
+            * platform/graphics/MediaPlayer.cpp:
+            (WebCore::MediaPlayer::doesHaveAttribute): Added stub to call private player object's
+            implementation of doesHaveAttribute.
+            * platform/graphics/MediaPlayer.h:
+            (WebCore::MediaPlayerClient::doesHaveAttribute):
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::MediaPlayerPrivateAVFoundationCF::AVFWrapper::createAssetForURL): Check the &lt;media&gt; object,
+            and notify AVFoundationCF to use URI option if relevant.
+            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+            (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Check the &lt;media&gt; object,
+            and notify AVFoundation to use URI option if relevant.
+    
+2014-03-17  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Captions layout incorrectly in fullscreen.
-        https://bugs.webkit.org/show_bug.cgi?id=133175
</del><ins>+        Merge r165583.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+    2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When doing layout for fullscreen, geometry should be absolute so it is not influenced
-        by the rest of the page. This change adds style for CSSPropertyPosition, CSSPropertyLeft,
-        and CSSPropertyTop.
</del><ins>+            Web Inspector: Network.loadResource should include the response status code
+            https://bugs.webkit.org/show_bug.cgi?id=130216
</ins><span class="cx"> 
</span><del>-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::updateDisplay):
-        Refactor style changes into updateStyleForTextTrackRepresentation().
-        (WebCore::MediaControlTextTrackContainerElement::updateTimerFired):
-        Refactor style changes into updateStyleForTextTrackRepresentation().
-        (WebCore::MediaControlTextTrackContainerElement::clearTextTrackRepresentation):
-        Refactor style changes into updateStyleForTextTrackRepresentation().
-        (WebCore::MediaControlTextTrackContainerElement::updateStyleForTextTrackRepresentation):
-        Consolidate style changes here. Include the two existing and three new style changes.
-        * html/shadow/MediaControlElements.h:
-        Declare updateStyleForTextTrackRepresentation().
</del><ins>+            Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-2014-05-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * inspector/InspectorResourceAgent.cpp:
+            Record and send the http status code.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r155977): Very stuttery 3D css animation on jtechcommunications.com
-        https://bugs.webkit.org/show_bug.cgi?id=133179
-        &lt;rdar://problem/16864666&gt;
</del><ins>+            * inspector/protocol/Network.json:
+            Include status code property in the success callback.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+2014-03-17  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Revert code added in r155977 to try to pick a good contentsScale for layers
-        based on a root-relative transform. This resulted in pages with too much 
-        backing store, and too many cases where layers repainted during animations,
-        causing stutter.
</del><ins>+        Merge r165582.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
-        (WebCore::GraphicsLayerCA::flushCompositingState):
-        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
-        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
-        (WebCore::GraphicsLayerCA::updateContentsOpaque):
-        (WebCore::GraphicsLayerCA::updateAnimations):
-        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
-        (WebCore::GraphicsLayerCA::setTransformAnimationEndpoints):
-        (WebCore::GraphicsLayerCA::setTransformAnimationKeyframes):
-        (WebCore::GraphicsLayerCA::updateContentsScale):
-        (WebCore::clampedContentsScaleForScale): Deleted.
-        (WebCore::maxScaleFromTransform): Deleted.
-        (WebCore::GraphicsLayerCA::updateRootRelativeScale): Deleted.
-        (WebCore::GraphicsLayerCA::getTransformFromAnimationsWithMaxScaleImpact): Deleted.
-        * platform/graphics/ca/GraphicsLayerCA.h:
</del><ins>+    2014-03-13  Joseph Pecoraro  &lt;pecoraro@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+            Web Inspector: Network.loadResource XHR crash if page reloaded while request is ongoing
+            https://bugs.webkit.org/show_bug.cgi?id=130211
</ins><span class="cx"> 
</span><del>-        [iOS] Enable -apple-system- styled elements to respond to system font size changes.
-        https://bugs.webkit.org/show_bug.cgi?id=133186
-        &lt;rdar://problem/16583782&gt;
</del><ins>+            Reviewed by Timothy Hatcher.
</ins><span class="cx"> 
</span><del>-        Reviewed by Enrica Casucci.
</del><ins>+            Merged from Blink with changes, (patch by vsevik@chromium.org):
+            http://src.chromium.org/viewvc/blink?view=revision&amp;revision=152712
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/RenderThemeIOS.h:
-        * rendering/RenderThemeIOS.mm:
-        (WebCore::_contentSizeCategory):
-        (WebCore::RenderThemeIOS::contentSizeCategory):
-        (WebCore::RenderThemeIOS::setContentSizeCategory):
</del><ins>+            Using an XMLHttpRequest to download resources had a few issues. Being an
+            Active DOM Object the load could be paused. Without an extra retain,
+            when the load was cancelled (e.g. a page reload) the XHR would get
+            destructed and could cause a crash if the list of active DOM objects
+            was actively being iterated.
</ins><span class="cx"> 
</span><del>-2014-05-22  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Switch to a DocumentThreadableLoader to manage the load ourselves.
+            This still uses the Memory cache, but we have a little more control.
</ins><span class="cx"> 
</span><del>-        [MSE] Stored samples are not freed when SourceBuffer is removed from MediaSource
-        https://bugs.webkit.org/show_bug.cgi?id=133174
</del><ins>+            * inspector/InspectorResourceAgent.h:
+            * inspector/InspectorResourceAgent.cpp:
+            (WebCore::InspectorResourceAgent::InspectorResourceAgent):
+            (WebCore::InspectorResourceAgent::loadResource):
+            Switch from XHR to DocumentThreadableLoader.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            * xml/XMLHttpRequest.h:
+            * xml/XMLHttpRequest.cpp:
+            (WebCore::XMLHttpRequest::XMLHttpRequest):
+            (WebCore::XMLHttpRequest::createRequest):
+            (WebCore::XMLHttpRequest::sendForInspector):
+            Remove the now unnecessary XHR sendForInspector path.
</ins><span class="cx"> 
</span><del>-        Clear out stored MediaSamples from SourceBuffer's TrackBuffer storage when
-        aborting loading. Also, report the memory cost of those samples, so that the
-        SourceBuffer will be GCd more readily.
</del><ins>+2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Add a mechanism for reporting the size of a MediaSample:
-        * Modules/mediasource/SourceBuffer.h:
-        * platform/MediaSample.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
</del><ins>+        Merge r165548.
</ins><span class="cx"> 
</span><del>-        Track the memory usage of a SampleMap when adding and removing samples, as well
-        as allowing the SampleMap to be cleared wholesale:
-        * Modules/mediasource/SampleMap.cpp:
-        (WebCore::SampleMap::clear): Release all stored MediaSamples.
-        (WebCore::SampleMap::addSample): Update m_totalSize.
-        (WebCore::SampleMap::removeSample): Ditto.
-        * Modules/mediasource/SampleMap.h:
-        (WebCore::SampleMap::SampleMap): Initialize m_totalSize.
-        (WebCore::SampleMap::sizeInBytes): Simple accessor.
</del><ins>+    2014-03-13  Andreas Kling  &lt;akling@apple.com&gt;
+    
+            Don't send synchronous resize events when FrameView has auto-sizing enabled.
+            &lt;https://webkit.org/b/130198&gt;
+            &lt;rdar://problem/15991333&gt;
+    
+            Reviewed by Dan Bernstein.
+    
+            * page/FrameView.cpp:
+            (WebCore::FrameView::sendResizeEventIfNeeded):
+    
+2014-03-17  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Clear the stored samples when loading is aborted, and report the extra memory
-        cost
-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::SourceBuffer): Initialize m_reportedExtraMemoryCost.
-        (WebCore::SourceBuffer::removedFromMediaSource): Clear all stored samples.
-        (WebCore::SourceBuffer::sourceBufferPrivateAppendComplete): Call reportExtraMemoryCost().
-        (WebCore::SourceBuffer::reportExtraMemoryCost): Inform the vm of the new
-            extra memory cost incurred by the object.
</del><ins>+        Reverse merge r165286.
</ins><span class="cx"> 
</span><del>-2014-05-22  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+    2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (WebKit2): Keyboard should have Search button in duckduckgo.com.
-        https://bugs.webkit.org/show_bug.cgi?id=133183
-        &lt;rdar://problem/17004207&gt;
</del><ins>+            Merge r165206.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoff Garen.
</del><ins>+        2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Adding new export.
</del><ins>+                Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+                &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
+                &lt;rdar://problem/15073043&gt;
</ins><span class="cx"> 
</span><del>-2014-05-22  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+                Clang appears to be optimizing out a branch in RenderObject::node()
+                when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
+                We'll work around this by factoring out the code in question into a
+                separate member function marked NEVER_INLINE.
</ins><span class="cx"> 
</span><del>-        REGRESSION(r163712): [GTK] Misspelling and grammar underline marks are no longer drawn
-        https://bugs.webkit.org/show_bug.cgi?id=133047
</del><ins>+                No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+                Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-        Change two conditions changed by mistake in r163712.
</del><ins>+                * rendering/RenderLayerFilterInfo.cpp:
+                (WebCore::RenderLayer::FilterInfo::layerElement):
+                Code moved from updateReferenceFilterClients(). Returns the Element*
+                for m_layer.
+                (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
+                Use layerElement().
</ins><span class="cx"> 
</span><del>-        * editing/TextCheckingHelper.cpp:
-        (WebCore::findMisspellings): Enter the loop also when wordStart is 0.
-        (WebCore::TextCheckingHelper::findFirstMisspelling): Skip the work
-        when the text is a single character. Also reworked it to use a for
-        loop to improve the readability.
</del><ins>+                * rendering/RenderLayerFilterInfo.h:
+                Declared layerElement().
</ins><span class="cx"> 
</span><del>-2014-05-22  Piotr Grad  &lt;p.grad@samsung.com&gt;
</del><ins>+2014-03-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Video is resumed with old playback rate.
-        https://bugs.webkit.org/show_bug.cgi?id=132905
</del><ins>+        Merge r165331.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+    2014-03-10  Timothy Hatcher  &lt;timothy@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Setting '0' playback rate is causing pipeline to pause.
-        GStreamer player impl. exposed this information to upper layers but it should not.
-        Solution is to hidden such situation behind m_playbackRatePause flag.
</del><ins>+            Load source maps and their resources asynchronously.
</ins><span class="cx"> 
</span><del>-        Test: media/video-paused-0-rate.html
</del><ins>+            https://bugs.webkit.org/show_bug.cgi?id=112071
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
-        (WebCore::MediaPlayerPrivateGStreamer::play):
-        (WebCore::MediaPlayerPrivateGStreamer::pause):
-        (WebCore::MediaPlayerPrivateGStreamer::doSeek):
-        (WebCore::MediaPlayerPrivateGStreamer::updatePlaybackRate):
-        (WebCore::MediaPlayerPrivateGStreamer::paused):
-        (WebCore::MediaPlayerPrivateGStreamer::setRate):
-        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
</del><ins>+            Reviewed by Joseph Pecoraro.
</ins><span class="cx"> 
</span><del>-2014-05-22  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+            * inspector/InspectorPageAgent.cpp:
+            (WebCore::InspectorPageAgent::buildObjectForFrameTree):
+            Honor the hiddenFromInspector flag.
</ins><span class="cx"> 
</span><del>-        Text markers don't paint on simple lines
-        https://bugs.webkit.org/show_bug.cgi?id=133177
</del><ins>+            * inspector/InspectorResourceAgent.cpp:
+            (WebCore::InspectorResourceAgent::willSendRequest):
+            (WebCore::InspectorResourceAgent::markResourceAsCached):
+            (WebCore::InspectorResourceAgent::didReceiveResponse):
+            (WebCore::InspectorResourceAgent::didReceiveData):
+            (WebCore::InspectorResourceAgent::didFinishLoading):
+            (WebCore::InspectorResourceAgent::didFailLoading):
+            (WebCore::InspectorResourceAgent::replayXHR):
+            (WebCore::InspectorResourceAgent::loadResource):
+            * inspector/InspectorResourceAgent.h:
+            Honor the hiddenFromInspector flag by keeping track of
+            hidden identifiers in a HashSet.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
-        
-        Marker painting code does not yet support simple lines.
</del><ins>+            * inspector/protocol/Network.json:
+            (Network.loadResource): Added.
</ins><span class="cx"> 
</span><del>-        Tests: fast/text/mark-matches-rendering-simple-lines.html
-               fast/text/mark-matches-rendering.html
</del><ins>+            * platform/network/ResourceRequestBase.h:
+            (WebCore::ResourceRequestBase::hiddenFromInspector): Added.
+            (WebCore::ResourceRequestBase::setHiddenFromInspector): Added.
+            (WebCore::ResourceRequestBase::ResourceRequestBase):
+            Add a flag to hide the request from the Inspector.
</ins><span class="cx"> 
</span><del>-        * dom/DocumentMarkerController.cpp:
-        (WebCore::DocumentMarkerController::addMarker):
-        
-            Force text blocks with markers to use line boxes.
</del><ins>+            * xml/XMLHttpRequest.cpp:
+            (WebCore::XMLHttpRequest::XMLHttpRequest):
+            (WebCore::XMLHttpRequest::sendForInspector): Added.
+            (WebCore::XMLHttpRequest::sendForInspectorXHRReplay): Renamed.
+            (WebCore::XMLHttpRequest::createRequest):
+            * xml/XMLHttpRequest.h:
+            Make Inspector loads allow cross-origins and hide their request
+            from the Inspector itself.
</ins><span class="cx"> 
</span><del>-        * testing/Internals.cpp:
-        (WebCore::Internals::setMarkedTextMatchesAreHighlighted):
-        
-            Expose this so we can make reftests for marker rendering.
</del><ins>+2014-03-10  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+        [Win] Build fix after r165379.
</ins><span class="cx"> 
</span><del>-2014-05-22  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</del><ins>+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::SerializedScriptValue): Revert to older-style C++ iteration
+        for Windows compatibility. This can be reverted when we use VS2013 on this branch.
</ins><span class="cx"> 
</span><del>-        [CSS Grid Layout] Guard RenderObject::isRenderGrid() method
-        https://bugs.webkit.org/show_bug.cgi?id=132380
</del><ins>+2014-03-07  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+        Merge r162972 and r163007.
</ins><span class="cx"> 
</span><del>-        Guard RenderObject::isRenderGrid() method under ENABLE_CSS_GRID_LAYOUT compilation flag.
</del><ins>+    2014-03-07  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeLogicalWidthInRegion):
-        * rendering/RenderObject.h:
</del><ins>+            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
+            https://bugs.webkit.org/show_bug.cgi?id=114586
</ins><span class="cx"> 
</span><del>-2014-05-21  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+            Reviewed by Dave Hyatt.
</ins><span class="cx"> 
</span><del>-        REGRESSION(r167870): Crash in simple line layout code with :after
-        https://bugs.webkit.org/show_bug.cgi?id=133155
-        &lt;rdar://problem/16977696&gt;
</del><ins>+            Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
-        
-        Fix https://bugs.webkit.org/show_bug.cgi?id=132241 in a safer way.
-        The underline behavior is tested by the existing fast/text/simple-lines-hover-underline.html
</del><ins>+            If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
+            Instead, we should make it a subclass of RenderElement, so that it can be split properly.
</ins><span class="cx"> 
</span><del>-        Test: fast/text/simple-lines-hover-after.html
</del><ins>+            Test: fast/css-generated-content/quote-first-letter.html
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::invalidateLineLayoutPath): Deleted.
</del><ins>+            * dom/PseudoElement.cpp:
+            (WebCore::PseudoElement::didRecalcStyle):
+            * rendering/RenderQuote.cpp:
+            (WebCore::RenderQuote::RenderQuote):
+            (WebCore::RenderQuote::willBeDestroyed):
+            (WebCore::RenderQuote::willBeRemovedFromTree):
+            (WebCore::RenderQuote::styleDidChange):
+            (WebCore::RenderQuote::updateText):
+            (WebCore::RenderQuote::computeText):
+            (WebCore::RenderQuote::updateDepth):
+            * rendering/RenderQuote.h:
+            * rendering/style/ContentData.cpp:
+            (WebCore::QuoteContentData::createContentRenderer):
</ins><span class="cx"> 
</span><del>-            Move to RenderBlockFlow.
</del><ins>+2014-03-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::invalidateLineLayoutPath):
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::styleDidChange):
-        
-            Invalidate layout if style changes in a manner that makes us ineligible to use the simple line layout path.
</del><ins>+        Merge r165339.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBlockFlow::invalidateLineLayoutPath):
-        
-            Drop the simple line layout on path invalidation if it exists. It may not be valid anymore.
-            Also invalidate the layout if this happens so we'll reconstruct the lines later.
</del><ins>+    2014-03-08  Oliver Hunt  &lt;oliver@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderBlockFlow::simpleLineLayout): Deleted.
-        (WebCore::RenderBlockFlow::ensureLineBoxes):
-        (WebCore::RenderBlockFlow::createLineBoxes): Deleted.
-                
-            Revert some of the changes made it r167870.
</del><ins>+            SerializedScriptValue may move Identifiers between worlds
+            https://bugs.webkit.org/show_bug.cgi?id=129979
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.h:
-        (WebCore::RenderBlockFlow::simpleLineLayout):
-        
-            Add strong validity assert.
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-05-21  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+            Test: fast/workers/worker-copy-shared-blob-url.html
</ins><span class="cx"> 
</span><del>-        [iOS] two media control button strings are not localized
-        https://bugs.webkit.org/show_bug.cgi?id=133160
</del><ins>+            Don't use Strings to store blob URLs as String's may be Identifiers
+            and they can only exist in one world/thread at a time.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            * Modules/indexeddb/IDBObjectStore.cpp:
+            (WebCore::IDBObjectStore::put):
+            * bindings/js/SerializedScriptValue.cpp:
+            (WebCore::CloneDeserializer::deserializeString):
+            (WebCore::SerializedScriptValue::addBlobURL):
+            (WebCore::SerializedScriptValue::SerializedScriptValue):
+            * bindings/js/SerializedScriptValue.h:
</ins><span class="cx"> 
</span><del>-        * English.lproj/mediaControlsLocalizedStrings.js:
</del><ins>+2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-21  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Merge r165138.
</ins><span class="cx"> 
</span><del>-        [iOS] Update some of the media controls buttons to be bigger
-        https://bugs.webkit.org/show_bug.cgi?id=133158
-        &lt;rdar://problem/16475828&gt;
</del><ins>+    2014-03-05  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement()
+            &lt;http://webkit.org/b/129751&gt;
+            &lt;rdar://problem/16237965&gt;
</ins><span class="cx"> 
</span><del>-        The buttons in the media controls on iOS are too small
-        to be comfortably pressed. Make them the size of the controls
-        panel and the expected iOS button size (44x44px).
</del><ins>+            Reviewed by Jon Honeycutt.
</ins><span class="cx"> 
</span><del>-        The artwork for the buttons now includes the padding. I've
-        added a file from which you can edit the artwork, then
-        copy it into the CSS (because editing directly in CSS is
-        a huge pain).
</del><ins>+            Merged from Blink (patch by Yuta Kitamura):
+            https://src.chromium.org/viewvc/blink?revision=168160&amp;view=revision
+            http://crbug.com/345005
</ins><span class="cx"> 
</span><del>-        So far just the play/pause and fullscreen button have been
-        updated. There will be a follow-up patch to fix the remaining
-        buttons and the scrubber.
</del><ins>+                The root cause is CompositeEditCommand::moveParagraphWithClones() passing
+                two positions |start| and |end| which do not follow the document order,
+                i.e. in some situations |start| is located after |end| because of
+                the difference in affinity.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/assets-apple-iOS.svg: Added.
-        * Modules/mediacontrols/mediaControlsiOS.css:
-        (audio::-webkit-media-controls-panel):
-        (audio::-webkit-media-controls-fullscreen-button):
-        (audio::-webkit-media-controls-play-button):
-        (audio::-webkit-media-controls-play-button:active):
-        (audio::-webkit-media-controls-play-button.paused):
-        (audio::-webkit-media-controls-fullscreen-button:active):
-        (@media only screen and (-webkit-min-device-pixel-ratio: 2)): Deleted.
</del><ins>+                This patch fixes this crash by normalizing |end| to |start| in such situations.
+                It also adds an ASSERT that checks the relationship between |start| and |end|.
</ins><span class="cx"> 
</span><del>-2014-05-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Test: editing/execCommand/format-block-crash.html
</ins><span class="cx"> 
</span><del>-        Garbage when rubber-banding at the right edge of a page zoomed to non-integral scale.
-        https://bugs.webkit.org/show_bug.cgi?id=133139
-        &lt;rdar://problem/16503353&gt;
</del><ins>+            * editing/CompositeEditCommand.cpp:
+            (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+            (WebCore::CompositeEditCommand::moveParagraphWithClones):
+            * editing/CompositeEditCommand.h:
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Do not pixel align the root content layer. The alignment code expands the graphics's layer size
-        which makes the right and bottom tiles bigger than the content.
-        Painting the body's background color produces pixel cracks, because the content can not
-        fill the expanded tiles completely.
</del><ins>+        Merge r164876.
</ins><span class="cx"> 
</span><del>-        Not testable.
</del><ins>+    2014-02-28  Bem Jones-Bey  &lt;bjonesbe@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/GraphicsLayerClient.h:
-        (WebCore::GraphicsLayerClient::needsPixelAligment):
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::updateGeometry):
-        (WebCore::GraphicsLayerCA::computePixelAlignment):
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::rectForTileIndex):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::needsPixelAligment):
-        * rendering/RenderLayerBacking.h:
</del><ins>+            Properly clear m_logicallyLastRun to remove use-after-free possibility
+            https://bugs.webkit.org/show_bug.cgi?id=129489
</ins><span class="cx"> 
</span><del>-2014-05-21  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r168046): Invalid layout in WebCore::RenderBox::containingBlockLogicalWidthForPositioned
-        https://bugs.webkit.org/show_bug.cgi?id=132933
</del><ins>+            A use-after-free issue was caught in Blink because m_logicallyLastRun
+            is not cleared when the item it points to is deleted. Clearing it
+            turns the use-after-free into a segfault, and prevents any future
+            use-after-frees from happening.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * platform/text/BidiRunList.h:
+            (WebCore::BidiRunList&lt;Run&gt;::deleteRuns):
</ins><span class="cx"> 
</span><del>-        Invalid layout is performed when calling containingBlockLogicalWidthForPositioned for a RenderTableSection object.
</del><ins>+2014-03-07  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/multicol/newmulticol/table-section-crash.html
</del><ins>+        Merge r165206.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
</del><ins>+    2014-03-05  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-21  Simon Pena  &lt;simon.pena@samsung.com&gt;
</del><ins>+            Invalid cast in WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients()
</ins><span class="cx"> 
</span><del>-        [EFL] Ensure EGLOffScreenContext::initialize calls platformMakeCurrent on the surface
-        https://bugs.webkit.org/show_bug.cgi?id=124832
</del><ins>+            &lt;https://bugs.webkit.org/show_bug.cgi?id=121887&gt;
+            &lt;rdar://problem/15073043&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antonio Gomes.
</del><ins>+            Clang appears to be optimizing out a branch in RenderObject::node()
+            when compiling RenderLayer::FilterInfo::updateReferenceFilterClients().
+            We'll work around this by factoring out the code in question into a
+            separate member function marked NEVER_INLINE.
</ins><span class="cx"> 
</span><del>-        The original code was only calling platformMakeCurrent when the
-        GL_EXT_robustness extension is supported: the alternate code path
-        would only create a context, but it wouldn't make that context
-        current. This patch ensures platformMakeCurrent is also called for
-        the alternate code path, and, if it fails to make the context
-        current, will destroy the context. Effectively, this makes both
-        code paths behave in the same way.
</del><ins>+            No test possible due to &lt;https://bugs.webkit.org/show_bug.cgi?id=129757&gt;.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/surfaces/egl/EGLContext.cpp:
-        (WebCore::EGLOffScreenContext::initialize):
</del><ins>+            Reviewed by David Kilzer.
</ins><span class="cx"> 
</span><del>-2014-05-20  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+            * rendering/RenderLayerFilterInfo.cpp:
+            (WebCore::RenderLayer::FilterInfo::layerElement):
+            Code moved from updateReferenceFilterClients(). Returns the Element*
+            for m_layer.
+            (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients):
+            Use layerElement().
</ins><span class="cx"> 
</span><del>-        [Mac] DataCues do not work properly when rewinding video
-        https://bugs.webkit.org/show_bug.cgi?id=133138
-        &lt;rdar://problem/16979086&gt;
</del><ins>+            * rendering/RenderLayerFilterInfo.h:
+            Declared layerElement().
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Make the TrackPrivateBase responsible for knowing if a type of track needs a non-zero
-        startTimeVariance value.
</del><ins>+        Merge r164249.
</ins><span class="cx"> 
</span><del>-        Also, correct a bug in the equality test for DataCue objects.
</del><ins>+    2014-02-17  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/track/DataCue.cpp:
-        (WebCore::DataCue::isEqual): Handle the JSValue data types consistently, so that we don't attempt
-        to compare a JSNull against a default JSValue object.
-        * html/track/InbandTextTrack.cpp:
-        (WebCore::InbandTextTrack::startTimeVariance): Added.
-        * html/track/InbandTextTrack.h:
-        * html/track/TextTrack.cpp:
-        (WebCore::TextTrack::hasCue): Use new startTimeVariance method location.
-        * html/track/TextTrack.h:
-        (WebCore::TextTrack::startTimeVariance): Added.
-        * html/track/TextTrackCue.cpp:
-        (WebCore::TextTrackCue::hasEquivalentStartTime): Use new startTimeVariance location.
-        * html/track/TextTrackCue.h:
-        (WebCore::TextTrackCue::startTimeVariance): Deleted.
-        * html/track/TextTrackCueGeneric.h:
-        * platform/graphics/TrackPrivateBase.h:
-        (WebCore::TrackPrivateBase::startTimeVariance): Added.
-        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h:
</del><ins>+            AX: Invalid cast in WebCore::AccessibilityTable::isDataTable (CRBug 280352)
+            &lt;https://webkit.org/b/128925&gt;
+            &lt;rdar://problem/16087351&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+            Merged from Blink (patch by Dominic Mazzoni):
+            https://src.chromium.org/viewvc/blink?revision=159711&amp;view=revision
</ins><span class="cx"> 
</span><del>-        Watchdog timer should be lazily allocated
-        https://bugs.webkit.org/show_bug.cgi?id=133135
</del><ins>+            Reviewed by Oliver Hunt.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            Don't cast to a table cell element unless we are sure it is one.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+            Test: accessibility/display-table-cell-causes-crash.html
</ins><span class="cx"> 
</span><del>-        We incur a noticeable amount of overhead on some benchmarks due to checking if the Watchdog ever fired. 
-        There is no reason to do this checking if we never activated the Watchdog, which can only be done through 
-        JSContextGroupSetExecutionTimeLimit or JSContextGroupClearExecutionTimeLimit. 
</del><ins>+            * accessibility/AccessibilityTable.cpp:
+            (WebCore::AccessibilityTable::isDataTable):
</ins><span class="cx"> 
</span><del>-        By allocating the Watchdog lazily on the VM we can avoid all of the associated overhead when we don't use 
-        these two API functions (which is true of most clients).
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSEventListener::handleEvent):
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        (WebCore::WorkerScriptController::scheduleExecutionTermination):
-        (WebCore::WorkerScriptController::isExecutionTerminating):
</del><ins>+        Merge r159489.
</ins><span class="cx"> 
</span><del>-2014-05-20  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+    2013-11-19  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] Allow popup menus to override default appearance
-        https://bugs.webkit.org/show_bug.cgi?id=133129
</del><ins>+            Add more assertions with security implications in DocumentOrderedMap
+            https://bugs.webkit.org/show_bug.cgi?id=124559
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        WebKitSystemInterface's WKPopupMenu has a flag to hide
-        the arrows at the end of a popup-menu (e.g. &lt;select&gt;).
-        Expose that via adding a hasDefaultAppearance flag to
-        PopupMenuStyle, which then passes it on to WKSI.
</del><ins>+            Assert that newly added elements and existing elements in the document ordered map are in the same tree scope
+            as the document ordered map. Also exit early if we're about to add an element in a wrong document to the map.
+            We don't exit early in get() because the damage has already been done at that point (the element may have been
+            deleted already).
</ins><span class="cx"> 
</span><del>-        * platform/PopupMenuStyle.h:
-        (WebCore::PopupMenuStyle::PopupMenuStyle): New flag in constructor.
-        (WebCore::PopupMenuStyle::hasDefaultAppearance): New flag.
-        * platform/mac/WebCoreSystemInterface.h: wkPopupMenu signature has changed to accept
-        the new flag.
-        * platform/mac/WebCoreSystemInterface.mm: Ditto.
-        * rendering/RenderMenuList.cpp:
-        (RenderMenuList::itemStyle): Pass in true as default appearance when creating
-        the PopupMenuStyle. We don't need it.
-        (RenderMenuList::menuStyle): In this case we pass in the negated value of
-        style().hasAppearance(), which indicates if we are overriding the built-in drawing.
-        * rendering/RenderSearchField.cpp:
-        (WebCore::RenderSearchField::menuStyle): Use true as the default value.
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::addImageElementByLowercasedUsemap):
+            * dom/DocumentOrderedMap.cpp:
+            (WebCore::DocumentOrderedMap::add): Assert that the newly added element is in the current tree scope.
+            Also exit early if either the element is not in the tree scope or not in the right document.
+            While this doesn't make the function completely fault safe, it'll catch when we try to add a detached node.
+            (WebCore::DocumentOrderedMap::remove): Convert existing assertions to ones with security implication.
+            (WebCore::DocumentOrderedMap::get): Assert with security implication that the element we're about to return
+            is in the current tree scope. The element may have already been deleted if we ever hit these assertions.
+            (WebCore::DocumentOrderedMap::getAllElementsById):  Convert an existing assertion to an assertion with security
+            implication.
+            * dom/DocumentOrderedMap.h:
+            * dom/TreeScope.cpp:
+            (WebCore::TreeScope::addElementById):
+            (WebCore::TreeScope::addElementByName):
+            (WebCore::TreeScope::addImageMap):
+            (WebCore::TreeScope::addLabel):
+            * html/HTMLDocument.cpp:
+            (WebCore::HTMLDocument::addDocumentNamedItem):
+            (WebCore::HTMLDocument::addWindowNamedItem):
+            * html/HTMLImageElement.cpp:
+            (WebCore::HTMLImageElement::insertedInto): Set InTreeScope flag before calling addImageElementByLowercasedUsemap.
+            * html/HTMLMapElement.cpp:
+            (WebCore::HTMLMapElement::insertedInto): Ditto for addImageMap.
</ins><span class="cx"> 
</span><del>-2014-05-20  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] do not deactivate an audio session that has running I/O
-        https://bugs.webkit.org/show_bug.cgi?id=133127
</del><ins>+        Merge r165145.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+    2014-03-05  Daniel Bates  &lt;dabates@apple.com&gt;
+                And Alexey Proskuryakov  &lt;ap@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/Settings.h:
-        (WebCore::Settings::setShouldManageAudioSessionCategory): Renamed from setShouldManageAudioSession.
-        (WebCore::Settings::shouldManageAudioSessionCategory): Renamed from shouldManageAudioSession.
-        (WebCore::Settings::setShouldManageAudioSession): Deleted.
-        (WebCore::Settings::shouldManageAudioSession): Deleted.
</del><ins>+            ASSERT(newestManifest) fails in WebCore::ApplicationCacheGroup::didFinishLoadingManifest()
+            https://bugs.webkit.org/show_bug.cgi?id=129753
+            &lt;rdar://problem/12069835&gt;
</ins><span class="cx"> 
</span><del>-        * platform/audio/mac/MediaSessionManagerMac.cpp:
-        (MediaSessionManager::updateSessionState): Don't deactivate the session if there are any
-            Video or Audio sessions.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::assetStatus): Drive-by change to log errors 
-            returned by -statusOfValueForKey:error: in debug builds.
</del><ins>+            Fixes an issue where an assertion failure would occur when visiting a web site whose on-disk
+            app cache doesn't contain a manifest resource.
</ins><span class="cx"> 
</span><del>-2014-05-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            For some reason an app cache for a web site may be partially written to disk. In particular, the
+            app cache may only contain a CacheGroups entry. That is, the manifest resource and origin records
+            may not be persisted to disk. From looking over the code, we're unclear how such a situation can occur
+            and hence have been unable to create such an app cache. We were able to reproduce this issue using
+            an app cache database file that was provided by a person that was affected by this issue.
</ins><span class="cx"> 
</span><del>-        REGRESSION: All non-mainframe scrollbars don't paint after r169065
-        https://bugs.webkit.org/show_bug.cgi?id=133132
-        -and corresponding-
-        &lt;rdar://problem/16968850&gt;
</del><ins>+            No test included because it's not straightforward to write a test for this change.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoff Garen.
</del><ins>+            * loader/appcache/ApplicationCacheGroup.cpp:
+            (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Assert that m_cacheBeingUpdated-&gt;manifestResource()
+            is non-null. Currently we only document this assumption in a code comment. Also separated a single assertion
+            expression into two assertion expressions to make it straightforward to identify the failing sub-expression
+            on failure.
+            * loader/appcache/ApplicationCacheStorage.cpp:
+            (WebCore::ApplicationCacheStorage::store): Modified to call ApplicationCacheStorage::deleteCacheGroupRecord()
+            to remove a cache group and associated cache records (if applicable) before inserting a cache group entry.
+            This replacement approach will ultimately repair incomplete app cache data for people affected by this bug.
+            (WebCore::ApplicationCacheStorage::loadCache): Log an error and return nullptr if the cache we loaded doesn't
+            have a manifest resource.
+            (WebCore::ApplicationCacheStorage::deleteCacheGroupRecord): Added.
+            (WebCore::ApplicationCacheStorage::deleteCacheGroup): Extracted deletion logic for cache group record into
+            ApplicationCacheStorage::deleteCacheGroupRecord().
+            * loader/appcache/ApplicationCacheStorage.h:
</ins><span class="cx"> 
</span><del>-        We should not universally return true here. This feature will only work for 
-        scrollbars with layers.
-        * platform/ScrollableArea.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::supportsUpdateOnSecondaryThread):
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Merge r156716.
</ins><span class="cx"> 
</span><del>-        Element within flattened frame may update its scroll state during the layout phase of the wrong RenderView
-        https://bugs.webkit.org/show_bug.cgi?id=133013
-        &lt;rdar://problem/16760154&gt;
</del><ins>+    2013-10-01  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            Center misspelling dots across width of word
+            https://bugs.webkit.org/show_bug.cgi?id=122046
</ins><span class="cx"> 
</span><del>-        Fixes an issue where the scroll state of an element may be updated during the layout of the wrong
-        RenderView. In particular, the scroll state of an element inside a CSS flex box in a flattened
-        frame f is updated during the layout of the RenderView associated with the parent frame of f instead
-        of during the layout of the RenderView associated with f.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        The layout machinery assumes that the scroll state of each scrollable element is updated before the
-        completion of layout for its associated RenderView. Currently we have logic to defer updating the scroll
-        state of a scrollable element until completion of recursive layout. For a page with a flattened frame, we
-        defer such updates until completion of layout for all RenderViews along the ancestor frame hierarchy of
-        each flattened frame regardless of the RenderView associated with the element that originated the
-        deferred scroll state request. Instead, only the RenderView associated with the element that deferred its
-        scroll state update should dispatch the scroll state update.
</del><ins>+            Test: editing/spelling/spelling.html
</ins><span class="cx"> 
</span><del>-        Tests: fast/frames/flattening/scrollable-flexbox-inside-iframe-with-zero-height-and-needs-full-repaint-crash.html
-               fast/frames/flattening/scrollable-flexbox-inside-iframe-with-zero-height-assertion-failure.html
</del><ins>+            * platform/graphics/GraphicsContext.h:
+            * platform/graphics/mac/GraphicsContextMac.mm:
+            (WebCore::GraphicsContext::drawLineForDocumentMarker):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp: Removed WTF::-prefix in typedef definition for ContinuationOutlineTableMap.
-        (WebCore::UpdateScrollInfoAfterLayoutTransaction::UpdateScrollInfoAfterLayoutTransaction): Added; a struct
-        that represents a RenderView v, nested transaction count, and a list of RenderBlocks in v that will need
-        to have their scroll state updated.
-        (WebCore::updateScrollInfoAfterLayoutTransactionStack): Added; returns the global stack of transactions.
-        (WebCore::RenderBlock::willBeDestroyed): Call removeFromUpdateScrollInfoAfterLayoutTransaction(), which
-        was formerly named as removeFromDelayedUpdateScrollInfoSet.
-        (WebCore::currentUpdateScrollInfoAfterLayoutTransaction): Added; returns the top-most transaction in the
-        global stack.
-        (WebCore::RenderBlock::beginUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to make use
-        of the global stack of transactions; formerly named startDelayUpdateScrollInfo.
-        (WebCore::RenderBlock::endAndCommitUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to
-        make use of the global stack of transactions; formerly named finishDelayUpdateScrollInfo.
-        (WebCore::RenderBlock::removeFromUpdateScrollInfoAfterLayoutTransaction): Modified as appropriate to make
-        use of the global stack of transactions; formerly named removeFromDelayedUpdateScrollInfoSet.
-        (WebCore::RenderBlock::updateScrollInfoAfterLayout): Modified as appropriate to make use of the global
-        stack of transactions.
-        (WebCore::RenderBlock::layout): Ditto.
-        (WebCore::RenderBlock::startDelayUpdateScrollInfo): Deleted.
-        (WebCore::RenderBlock::finishDelayUpdateScrollInfo): Deleted.
-        (WebCore::RenderBlock::removeFromDelayedUpdateScrollInfoSet): Deleted.
-        * rendering/RenderBlock.h:
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::willBeDestroyed): Call removeFromUpdateScrollInfoAfterLayoutTransaction(), which
-        was formerly named removeFromDelayedUpdateScrollInfoSet.
-        * rendering/RenderDeprecatedFlexibleBox.cpp:
-        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox): Call {begin, end}UpdateScrollInfoAfterLayoutTransaction(),
-        which was formerly named {start, end}DelayUpdateScrollInfo.
-        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): Ditto.
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock): Ditto.
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Merge r153788.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r169065): Mountain Lion run-api-tests failures: ASSERTION FAILED: 
-        Uncaught exception - -[NSRegularLegacyScrollerImp setPresentationValue:]: 
-        unrecognized selector sent to instance 0x7ff51aa38000
-        https://bugs.webkit.org/show_bug.cgi?id=133121
</del><ins>+    2013-08-07  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            2.5% regression on page cycler moz
+            https://bugs.webkit.org/show_bug.cgi?id=102822
</ins><span class="cx"> 
</span><del>-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::setPaintCharacteristicsForScrollbar):
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache() triggers a style recalc for quirks mode
+            documents in the beginning of document parsing via Document::setCompatibilityMode. This often coalesces 
+            with style recalc triggered by stylesheet loading. However on very simple documents it can generate genuinely
+            unnecessary work.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r169063) Fixed and sticky nodes misplaced on scrolling sometimes
-        https://bugs.webkit.org/show_bug.cgi?id=133106
-        &lt;rdar://problem/16967648&gt;
</del><ins>+            * dom/DocumentStyleSheetCollection.cpp:
+            (WebCore::DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache):
+            
+                Check that we actually have cached injected stylesheets before triggering style recalc.
+                
+            * page/PageGroup.cpp:
+            (WebCore::PageGroup::addUserStyleSheetToWorld):
+            (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+            (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+            (WebCore::PageGroup::removeAllUserContent):
+            
+                Fix a misspelling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            (WebCore::PageGroup::invalidateInjectedStyleSheetCacheInAllFrames):
+            
+                Always invalidate style when user sheets change since we don't do that in
+                DocumentStyleSheetCollection::invalidateInjectedStyleSheetCache anymore.
</ins><span class="cx"> 
</span><del>-        Fix regression from r169063. That commit removed scrolledContentsLayers from 
-        frame scrolling nodes, but they do actually use them.
-        
-        So put them back; not in the base class, because they have a somewhat different
-        meaning for overflow scrolling and frame scrolling.
</del><ins>+            * page/PageGroup.h:
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
-        (WebCore::AsyncScrollingCoordinator::updateFrameScrollingNode):
-        * page/scrolling/AsyncScrollingCoordinator.h:
-        * page/scrolling/ScrollingCoordinator.h:
-        (WebCore::ScrollingCoordinator::updateFrameScrollingNode):
-        * page/scrolling/ScrollingStateFrameScrollingNode.cpp:
-        (WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
-        (WebCore::ScrollingStateFrameScrollingNode::setScrolledContentsLayer):
-        * page/scrolling/ScrollingStateFrameScrollingNode.h:
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
</del><ins>+2014-03-06  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Merge r155071.
</ins><span class="cx"> 
</span><del>-        REGRESSION: [CSS Regions] Content flowed directly into the flow thread that ends up in the second region is not properly repainted
-        https://bugs.webkit.org/show_bug.cgi?id=133111
</del><ins>+    2013-09-04  Pratik Solanki  &lt;psolanki@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+            Document::updateHoverActiveState() should allow for deferred style recalcs
+            https://bugs.webkit.org/show_bug.cgi?id=120700
</ins><span class="cx"> 
</span><del>-        When computing the repaint rect of an element flowed into a flow thread, if the element is flowed directly into
-        the flow thread (meaning its containing block is the flow thread itself), the region's position within the flow
-        must no longer be taken into consideration, because its already included in the element's |topLeft|.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/hover-element-flowed-second-region.html
</del><ins>+            Add an extra argument to Document::updateHoverActiveState() to specify if a style recalc
+            should be done. The default value keeps the current behavior of doing a style recalc. iOS
+            touch handling code will pass in DeferRecalcStyleIfNeeded to avoid the work.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeRectForRepaint):
</del><ins>+            No new tests because no functional changes.
</ins><span class="cx"> 
</span><del>-2014-05-20  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::updateHoverActiveState):
+            * dom/Document.h:
</ins><span class="cx"> 
</span><del>-        Fix web timing assertion failure.
-        https://bugs.webkit.org/show_bug.cgi?id=133094
-        &lt;rdar://problem/16966032&gt;
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        Merge r158802.
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getConnectionTimingData):
-        Set requestStart and responseStart to 0 instead of -1 to match the 
-        ResourceLoadTiming constructor and prevent the assertion failure in
-        PerformanceTiming::responseStart.
</del><ins>+    2013-11-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  Prashant Hiremath  &lt;hiremathprashants@gmail.com&gt;
</del><ins>+            Crash in SliderThumbElement::dragFrom
+            https://bugs.webkit.org/show_bug.cgi?id=123873
</ins><span class="cx"> 
</span><del>-        Only set title on SVG documents
-        https://bugs.webkit.org/show_bug.cgi?id=133068
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            Moved Ref.
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/html_document_set_title.html
</del><ins>+            * html/RangeInputType.cpp:
+            (WebCore::RangeInputType::handleMouseDownEvent):
+            * html/shadow/SliderThumbElement.cpp:
+            (WebCore::SliderThumbElement::dragFrom):
</ins><span class="cx"> 
</span><del>-        * svg/SVGTitleElement.cpp:
-        (WebCore::SVGTitleElement::insertedInto):
-        (WebCore::SVGTitleElement::removedFrom):
-        (WebCore::SVGTitleElement::childrenChanged):
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-20  peavo@outlook.com  &lt;peavo@outlook.com&gt;
</del><ins>+        Merge r158724.
</ins><span class="cx"> 
</span><del>-        [Curl] Invalid content in cache file, causes broken rendering.
-        https://bugs.webkit.org/show_bug.cgi?id=133069
</del><ins>+    2013-11-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham.
</del><ins>+            Use-after-free in SliderThumbElement::dragFrom
+            https://bugs.webkit.org/show_bug.cgi?id=123873
</ins><span class="cx"> 
</span><del>-        When data for a url is received as multiple parts, the cache file for the url is truncated when opened for writing,
-        and will only contain the last part of data received.
-        This is fixed by only opening the file once, and close it after all data has been received.
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        * platform/network/curl/CurlCacheEntry.cpp:
-        (WebCore::CurlCacheEntry::CurlCacheEntry): Initialize cache file handle member.
-        (WebCore::CurlCacheEntry::~CurlCacheEntry): Close cache file.
-        (WebCore::CurlCacheEntry::saveCachedData): Only open cache file once to avoid truncating.
-        (WebCore::CurlCacheEntry::didFail): Close cache file.
-        (WebCore::CurlCacheEntry::didFinishLoading): Ditto.
-        (WebCore::CurlCacheEntry::openContentFile): Added method to open cache file.
-        (WebCore::CurlCacheEntry::closeContentFile): Added method to close cache file.
-        * platform/network/curl/CurlCacheEntry.h: Added file handle member, and methods to open and close cache file.
</del><ins>+            Ref the SliderThumbElement since it could go away inside dragFrom.
</ins><span class="cx"> 
</span><del>-2014-05-20  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+            Test: fast/forms/range/range-type-change-onchange-2.html
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Block incorrectly sized when containing an unsplittable box
-        https://bugs.webkit.org/show_bug.cgi?id=132601
</del><ins>+            * html/RangeInputType.cpp:
+            (WebCore::RangeInputType::handleMouseDownEvent):
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When laying out elements in a region, when an inline element is encountered
-        the size of its parent must not be increased beyond the bottom of the current region,
-        unless if its the last region. This will ensure that the next sibling of the
-        inline element is correctly laid out at the top of the next region, instead
-        of leaving an empty space equal to the height of the overflow, as it did until now.
</del><ins>+        Merge r163599.
</ins><span class="cx"> 
</span><del>-        Tests: fast/regions/inline-block-inside-anonymous-overflow.html
-               fast/regions/inline-block-overflow.html
</del><ins>+    2014-02-06  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::adjustLinePositionForPagination):
-        (WebCore::RenderBlockFlow::hasNextPage):
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
-        (WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
-        (WebCore::RenderBlockFlow::determineStartPosition):
-        (WebCore::RenderBlockFlow::checkPaginationAndFloatsAtEndLine):
</del><ins>+            loadSubframe can return null in SubframeLoader::loadOrRedirectSubframe
+            https://bugs.webkit.org/show_bug.cgi?id=128344
</ins><span class="cx"> 
</span><del>-2014-05-20  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Crash while painting block selection gaps in regions
-        https://bugs.webkit.org/show_bug.cgi?id=132720
</del><ins>+            * loader/SubframeLoader.cpp:
+            (WebCore::SubframeLoader::loadOrRedirectSubframe):
</ins><span class="cx"> 
</span><del>-        Reviewed by David Hyatt.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The fix for WebKit bug https://bugs.webkit.org/show_bug.cgi?id=131511
-        allowed selection highlight to match the DOM selection when the start
-        and end point of the selection were in different flow threads. In order
-        to enable that, the selection was performed separately on view and
-        render flow threads, considered selection subtrees.
</del><ins>+        Merge r164170.
</ins><span class="cx"> 
</span><del>-        However, the start and end points for each selection subtree were computed
-        by means of Range class but it is not always possible to construct a valid
-        Range from two pairs of RenderObjects and offsets.
</del><ins>+    2014-02-15  Renata Hodovan  &lt;rhodovan.u-szeged@partner.samsung.com&gt;
</ins><span class="cx"> 
</span><del>-        This patch keeps the substrees approach but instead of storing the endpoints
-        for each subtree in a Range and continuously extending the Range, it stores them
-        using the already available SelectionSubtreeRoot class. After the end points are
-        computed for each subtree and before processing the subtree selection, the end points
-        are adjusted in a similar fashion as the one used in FrameSelection::updateAppearance(),
-        to make sure we are passing the same expected information to the method implementing
-        the visible selection processing.
</del><ins>+            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
+            https://bugs.webkit.org/show_bug.cgi?id=128810
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/selection-gaps-paint-crash.html
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::splitSelectionBetweenSubtrees):
-        * rendering/SelectionSubtreeRoot.cpp:
-        (WebCore::SelectionSubtreeRoot::adjustForVisibleSelection):
-        * rendering/SelectionSubtreeRoot.h:
-        (WebCore::SelectionSubtreeRoot::selectionClear):
</del><ins>+            Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
+            doesn't contain |start|.
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
+            ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
+            patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
+            |outerNode| only if |outerNode| contains |start| position.
</ins><span class="cx"> 
</span><del>-        Scrolling pages with large TiledBacking content layers creates way too many tiles
-        https://bugs.webkit.org/show_bug.cgi?id=133101
</del><ins>+            Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&amp;view=revision by yosin@chromium.org.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Test: editing/execCommand/indent-with-uneditable-crash.html
</ins><span class="cx"> 
</span><del>-        Fix the GraphicsLayerCA::adjustTiledLayerVisibleRect() logic to avoid making giant rects if the old
-        and new visible rects don't overlap.
</del><ins>+            * editing/CompositeEditCommand.cpp:
+            (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
</ins><span class="cx"> 
</span><del>-        * platform/graphics/TiledBacking.h:
-        * platform/graphics/ca/GraphicsLayerCA.cpp:
-        (WebCore::GraphicsLayerCA::adjustTiledLayerVisibleRect):
-        * platform/graphics/ca/mac/TileController.h:
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+        Merge r160065.
</ins><span class="cx"> 
</span><del>-        Correctly maintain the &quot;isInWindow&quot; state for all TiledBackings
-        https://bugs.webkit.org/show_bug.cgi?id=133095
</del><ins>+    2013-12-03  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
-        
-        We never updated the &quot;isInWindow&quot; state for TiledBacking that wasn't the RenderView's
-        backing. Fix it by having RenderLayerCompositor::setIsInWindow() recurse through all
-        layers (if necessary), updating their state. Also set the state on newly created
-        TiledBackings.
</del><ins>+            Potential crash in RenderView::selectionBounds and RenderView::repaintSelection
+            https://bugs.webkit.org/show_bug.cgi?id=125207
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::layerTiledBackingUsageChanged):
-        (WebCore::RenderLayerCompositor::setIsInWindowForLayerIncludingDescendants):
-        (WebCore::RenderLayerCompositor::setIsInWindow):
-        (WebCore::RenderLayerCompositor::pageTiledBacking): Deleted.
-        * rendering/RenderLayerCompositor.h:
</del><ins>+            Reviewed by Simon Fraser.
+            
+            Merge https://chromium.googlesource.com/chromium/blink/+/f9e6e288a5aa959f05c374806121aaf0fc52d440
</ins><span class="cx"> 
</span><del>-2014-05-19  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+            Update style in FrameSelection instead of RenderView's member functions. These are the last two
+            member functions of RenderView that updates the style.
</ins><span class="cx"> 
</span><del>-        [iOS] Use status display for live streams
-        https://bugs.webkit.org/show_bug.cgi?id=133097
</del><ins>+            * editing/FrameSelection.cpp:
+            (WebCore::FrameSelection::focusedOrActiveStateChanged):
+            (WebCore::FrameSelection::bounds):
+            * rendering/RenderView.cpp:
+            (WebCore::RenderView::selectionBounds):
+            (WebCore::RenderView::repaintSelection):
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Follow-on from https://bugs.webkit.org/show_bug.cgi?id=131390
-        Allow the iOS controls to use the status display field.
</del><ins>+        Merge r164367.
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsiOS.js:
-        (ControllerIOS.prototype.configureInlineControls): Live streams should
-        not have a timeline or rewind button.
</del><ins>+    2014-02-19  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</del><ins>+            Do not dispatch change event twice in single step action
+            https://bugs.webkit.org/show_bug.cgi?id=116936
+            &lt;rdar://problem/16086828&gt;
</ins><span class="cx"> 
</span><del>-        Text decorations do not contribute to visual overflow
-        https://bugs.webkit.org/show_bug.cgi?id=132773
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Merged from Blink (patch by Kent Tamura):
+            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=151175
</ins><span class="cx"> 
</span><del>-        This patch creates a function, visualOverflowForDecorations, which computes
-        how much visual overflow to add around a text box due to text decorations. Most of the time,
-        text decorations are fully contained within the text box, so the result is usually 0.
</del><ins>+            Test: fast/forms/number/number-type-update-by-change-event.html
</ins><span class="cx"> 
</span><del>-        This function exists within style/InlineTextBoxStyle.cpp, which is an added file. This is
-        so that it can be called from setLogicalWidthForTextRun() inside RenderBlockLineLayout.cpp
-        and from RenderStyle::changeAffectsVisualOverflow(). The former case passes in the full
-        InlineTextBox and the latter case just passes in a RenderStyle (because the InlineTextBox
-        is unavailable.)
</del><ins>+            * html/InputType.cpp:
+            (WebCore::InputType::stepUpFromRenderer):
</ins><span class="cx"> 
</span><del>-        This patch also modifies RenderTableSection::spannedColumns() to fix an off-by-one error
-        that was causing table borders to not be drawn when they existed right on the edge of
-        a repaint rect.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/css3-text/css3-text-decoration/repaint/underline-outside-of-layout-rect.html
-        Tests: fast/repaint/border-collapse-table-off-by-one-expected.html
</del><ins>+        Merge r164204.
</ins><span class="cx"> 
</span><del>-        * WebCore.vcxproj/WebCore.vcxproj: Adding reference to new InlineTextBoxStyle.cpp file
-        * WebCore.vcxproj/WebCore.vcxproj.filters: Adding reference to new InlineTextBoxStyle files
-        * WebCore.xcodeproj/project.pbxproj: Adding reference to new InlineTextBoxStyle files
-        * rendering/InlineTextBox.cpp:
-        (WebCore::computeUnderlineOffset): Moved to InlineTextBox.cpp
-        (WebCore::getWavyStrokeParameters): Moved to InlineTextBox.cpp
-        (WebCore::InlineTextBox::paintDecoration): Update to use newly refactored functions
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::setLogicalWidthForTextRun): Call visualOverflowForDecorations()
-        * rendering/RenderTableSection.cpp:
-        * rendering/RenderTableSelection.cpp: Fix off-by-one error when the boundary of a repaint
-        rect lies exactly on top of a table column position
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeAffectsVisualOverflow): Inspects shadows and text decorations
-        (WebCore::RenderStyle::changeRequiresLayout): Calls changeAffectsVisualOverflow()
-        (WebCore::RenderStyle::changeRequiresRepaintIfTextOrBorderOrOutline): Moved code from here
-        to changeAffectsVisualOverflow().
-        * rendering/style/RenderStyle.h: Function signature
-        * style/InlineTextBoxStyle.cpp: Added.
-        (WebCore::computeUnderlineOffset): Moved from InlineTextBox.cpp
-        (WebCore::getWavyStrokeParameters): Moved from InlineTextBox.cpp
-        (WebCore::extendIntToFloat): Convenience function for dealing with the fact that
-        underline bounding boxes use floats and GlyphOverflow uses ints
-        (WebCore::visualOverflowForDecorations): Given
-        vertical overflow bounds, possibly extend those to include location of
-        decorations.
-        * style/InlineTextBoxStyle.h: Added. Function signatures.
-        (WebCore::textDecorationStrokeThickness): Refactored from InlineTextBox.cpp
-        (WebCore::wavyOffsetFromDecoration): Refactored from InlineTextBox.cpp
-        * platform/graphics/Font.h:
-        (WebCore::GlyphOverflow::isEmpty): Convenience function
-        (WebCore::GlyphOverflow::extendTo): Convenience function
</del><ins>+    2014-02-16  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Ensure that removing an iframe from the DOM tree disconnects its Frame.
+            &lt;https://webkit.org/b/128889&gt;
+            &lt;rdar://problem/15671221&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r169082
</del><ins>+            Merged from Blink (patch by Adam Klein):
+            https://src.chromium.org/viewvc/blink?revision=156174&amp;view=revision
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandle.h:
-        Added NSDictionary declaration.
</del><ins>+            SubframeLoadingDisabler wasn't catching the case when an &lt;iframe&gt; was,
+            in its unload handler, removed and re-added to the same parent.
+            Fix this by using a count of SubframeLoadingDisablers that are on the
+            stack for a given root, rather than a simple boolean.
</ins><span class="cx"> 
</span><del>-2014-05-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            Test: fast/frames/reattach-in-unload.html
</ins><span class="cx"> 
</span><del>-        REGRESSION: Standalone images need to take topContentInset into account
-        https://bugs.webkit.org/show_bug.cgi?id=133092
-        -and corresponding-
-        &lt;rdar://problem/16945791&gt;
</del><ins>+            * html/HTMLFrameOwnerElement.h:
+            (WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The FrameView’s size is accurate in terms of the NSWindow size, but that is not 
-        really what the ImageDocument code is looking for here. The ImageDocument wants to 
-        know the size of the unobscured viewport area. We should use visibleSize() for 
-        that.
-        * html/ImageDocument.cpp:
-        (WebCore::ImageDocument::scale):
-        (WebCore::ImageDocument::imageFitsInWindow):
-        (WebCore::ImageDocument::imageClicked):
</del><ins>+        Merge r157957.
</ins><span class="cx"> 
</span><del>-2014-05-19  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+    2013-10-24  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Collect web timing data on iOS.
-        https://bugs.webkit.org/show_bug.cgi?id=133075
</del><ins>+            Crash in WebCore::NavigationScheduler::startTimer()
+            https://bugs.webkit.org/show_bug.cgi?id=123288
+            &lt;rdar://problem/14055644&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            Reviewed by Alexey Proskuryakov.
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandle.h:
-        Added setCollectsTimingData wrapper and getConnectionTimingData declarations.
-        getConnectionTimingData with a dictionary parameter is a private helper function.
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::ResourceHandle::start):
-        Call setCollectsTimingData wrapper when creating a connection to ensure that timing data is collected.
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.cpp:
-        (WebCore::ResourceHandleCFURLConnectionDelegate::didReceiveResponseCallback):
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.h:
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
-        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
-        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.h:
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
-        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveResponse):
-        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.h:
-        Pass the CFURLConnectionRef to didReceiveResponse to get timing data from.
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getConnectionTimingData):
-        Moved from getTimingData to compile regardless of using CFNetwork and added wrapper with CFDictionaryRef.
-        (WebCore::ResourceHandle::setCollectsTimingData):
-        Added wrapper to call objc function from c++.
-        (WebCore::ResourceHandle::getTimingData):
-        Renamed to getConnectionTimingData.
-        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
-        Updated function name from getTimingData to getConnectionTimingData.
</del><ins>+            Currently NavigationScheduler::startTimer() synchronously notifies the client
+            before the Web Inspector of a scheduled redirect. If a client cancels this
+            redirect then NavigationScheduler::m_redirect will become null and we'll
+            subsequently crash when informing the Web Inspector of this formerly scheduled
+            redirect. Instead, NavigationScheduler::startTimer() should notify the Web
+            Inspector before it notifies the client of a scheduled redirect.
</ins><span class="cx"> 
</span><del>-2014-05-19  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+            As a side benefit of this change, the Web Inspector is notified of a scheduled
+            redirect before being notified of it being canceled when a client chooses to cancel
+            a scheduled redirect.
</ins><span class="cx"> 
</span><del>-        AX: VoiceOver sees the WebArea out of order when topContentInset is used
-        https://bugs.webkit.org/show_bug.cgi?id=133091
</del><ins>+            * loader/NavigationScheduler.cpp:
+            (WebCore::NavigationScheduler::startTimer):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Modify the scroll view's frame so that it recognizes the content inset.
-        This is needed so that when VoiceOver sorts elements to create an ordering,
-        the web area is not ordered at the top of the screen.
</del><ins>+        Merge r153829
</ins><span class="cx"> 
</span><del>-        Test: platform/mac-wk2/accessibility/content-inset-scrollview-frame.html
</del><ins>+    2013-08-08  Andreas Kling  &lt;akling@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * accessibility/AccessibilityScrollView.cpp:
-        (WebCore::AccessibilityScrollView::elementRect):
</del><ins>+            Inserting multiple rules into an empty style sheet should avoid style recalc if possible.
+            &lt;http://webkit.org/b/119568&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        Scrollbars display incorrectly after switching between fast and slow scrolling 
-        mode, affects Find and real sites
-        https://bugs.webkit.org/show_bug.cgi?id=133077
-        -and corresponding-
-        &lt;rdar://problem/16888608&gt;
</del><ins>+            As a follow-up to &lt;http://webkit.org/b/119475&gt;, where I added a hack for inserting
+            a single rule into an empty style sheet, this broadens the optimization to support
+            any number of rules.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            This optimizes the scenario where a style sheet is added to the DOM and then populated
+            rule-by-rule via CSSOM insertRule()/addRule() calls. Previously we'd do a full style
+            recalc for this case, but now we'll treat it the same as a full sheet added at once.
</ins><span class="cx"> 
</span><del>-        We should always return true here when updating on the secondary thread is 
-        supported. It does not need to be gated on whether we are actively taking 
-        advantage of that support at this moment.
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::supportsUpdateOnSecondaryThread):
</del><ins>+            * css/CSSStyleSheet.h:
+            * css/CSSStyleSheet.cpp:
+            (WebCore::CSSStyleSheet::willMutateRules):
</ins><span class="cx"> 
</span><del>-        Always update the presentationValue whenever we update the doubleValue just to 
-        keep them in sync.
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::setPaintCharacteristicsForScrollbar):
</del><ins>+                Made willMutateRules() return whether the style sheet contents were cloned by the
+                copy-on-write mechanism.
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * dom/Document.h:
+            (WebCore::CSSStyleSheet::didMutateRules):
+            (WebCore::CSSStyleSheet::insertRule):
</ins><span class="cx"> 
</span><del>-        Split scrolling tree ScrollingNodes into FrameScrollingNodes and OverflowScrollingNodes
-        https://bugs.webkit.org/show_bug.cgi?id=133022
</del><ins>+                Replaced the InsertionIntoEmptySheet mutation type by a general RuleInsertion.
+                The mutation callback checks if we're inserting into a rule that's not (yet) part
+                of the document's active sheet set. In that case, we defer doing the style sheet
+                until all the insertions are done (or something forces us to style+layout.)
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+                Note that this optimization only happens if the style sheet had a single client.
+                Shared style sheets that just got cloned before mutation may have pointers into
+                them from the Document's StyleResolver, so we're forced to do an immediate sheet
+                update in that case.
</ins><span class="cx"> 
</span><del>-        In both the scrolling state tree and the scrolling tree, split the &quot;scrolling nodes&quot;
-        into FrameScrolling and OverflowScrolling nodes.
-        
-        Move what was the &quot;viewportSize&quot; property onto the base class for the scrolling
-        nodes, calling it &quot;scrollableAreaSize&quot;.
-        
-        Make minimum/maximumScrollPosition() virtual so we can share more code (and there
-        is more code sharing to be done in future).
</del><ins>+            (WebCore::CSSStyleSheet::RuleMutationScope::RuleMutationScope):
+            (WebCore::CSSStyleSheet::RuleMutationScope::~RuleMutationScope):
</ins><span class="cx"> 
</span><del>-        * Configurations/WebCore.xcconfig: Remove ScrollingStateScrollingNodeMac.mm and ScrollingTreeScrollingNodeMac.mm
-        from the list, using #ifdefs in the file instead.
-        * WebCore.exp.in: Lots of exports.
-        * WebCore.xcodeproj/project.pbxproj: New files.
-        * page/scrolling/AsyncScrollingCoordinator.cpp:
-        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated):
-        (WebCore::AsyncScrollingCoordinator::frameViewRootLayerDidChange):
-        (WebCore::AsyncScrollingCoordinator::updateFrameScrollingNode):
-        (WebCore::AsyncScrollingCoordinator::updateOverflowScrollingNode):
-        (WebCore::AsyncScrollingCoordinator::recomputeWheelEventHandlerCountForFrameView):
-        (WebCore::AsyncScrollingCoordinator::updateScrollingNode): Deleted.
-        (WebCore::AsyncScrollingCoordinator::setScrollbarPaintersFromScrollbarsForNode): Deleted.
-        This tiny function didn't need to exist.
-        * page/scrolling/AsyncScrollingCoordinator.h:
-        * page/scrolling/ScrollingCoordinator.h:
-        (WebCore::ScrollingCoordinator::updateFrameScrollingNode):
-        (WebCore::ScrollingCoordinator::updateOverflowScrollingNode):
-        (WebCore::ScrollingCoordinator::updateScrollingNode): Deleted.
-        * page/scrolling/ScrollingStateFrameScrollingNode.cpp: Copied from Source/WebCore/page/scrolling/ScrollingStateScrollingNode.cpp.
-        (WebCore::ScrollingStateFrameScrollingNode::create):
-        (WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
-        (WebCore::ScrollingStateFrameScrollingNode::~ScrollingStateFrameScrollingNode):
-        (WebCore::ScrollingStateFrameScrollingNode::clone):
-        (WebCore::ScrollingStateFrameScrollingNode::setFrameScaleFactor):
-        (WebCore::ScrollingStateFrameScrollingNode::setNonFastScrollableRegion):
-        (WebCore::ScrollingStateFrameScrollingNode::setWheelEventHandlerCount):
-        (WebCore::ScrollingStateFrameScrollingNode::setSynchronousScrollingReasons):
-        (WebCore::ScrollingStateFrameScrollingNode::setScrollBehaviorForFixedElements):
-        (WebCore::ScrollingStateFrameScrollingNode::setHeaderHeight):
-        (WebCore::ScrollingStateFrameScrollingNode::setFooterHeight):
-        (WebCore::ScrollingStateFrameScrollingNode::setTopContentInset):
-        (WebCore::ScrollingStateFrameScrollingNode::setCounterScrollingLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setInsetClipLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setContentShadowLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setHeaderLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setFooterLayer):
-        (WebCore::ScrollingStateFrameScrollingNode::setScrollbarPaintersFromScrollbars):
-        (WebCore::ScrollingStateFrameScrollingNode::dumpProperties):
-        * page/scrolling/ScrollingStateFrameScrollingNode.h: Copied from Source/WebCore/page/scrolling/ScrollingStateScrollingNode.h.
-        * page/scrolling/ScrollingStateNode.h:
-        (WebCore::LayerRepresentation::layerID):
-        (WebCore::ScrollingStateNode::isFrameScrollingNode):
-        (WebCore::ScrollingStateNode::isOverflowScrollingNode):
-        * page/scrolling/ScrollingStateOverflowScrollingNode.cpp: Added.
-        (WebCore::ScrollingStateOverflowScrollingNode::create):
-        (WebCore::ScrollingStateOverflowScrollingNode::ScrollingStateOverflowScrollingNode):
-        (WebCore::ScrollingStateOverflowScrollingNode::~ScrollingStateOverflowScrollingNode):
-        (WebCore::ScrollingStateOverflowScrollingNode::clone):
-        (WebCore::ScrollingStateOverflowScrollingNode::setScrolledContentsLayer):
-        (WebCore::ScrollingStateOverflowScrollingNode::dumpProperties):
-        * page/scrolling/ScrollingStateOverflowScrollingNode.h: Copied from Source/WebCore/page/scrolling/mac/ScrollingStateScrollingNodeMac.mm.
-        (WebCore::ScrollingStateOverflowScrollingNode::scrolledContentsLayer):
-        * page/scrolling/ScrollingStateScrollingNode.cpp:
-        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
-        (WebCore::ScrollingStateScrollingNode::setScrollableAreaSize):
-        (WebCore::ScrollingStateScrollingNode::setTotalContentsSize):
-        (WebCore::ScrollingStateScrollingNode::dumpProperties):
-        (WebCore::ScrollingStateScrollingNode::create): Deleted.
-        (WebCore::ScrollingStateScrollingNode::clone): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setViewportSize): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setFrameScaleFactor): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setNonFastScrollableRegion): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setWheelEventHandlerCount): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setSynchronousScrollingReasons): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setScrollBehaviorForFixedElements): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setHeaderHeight): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setFooterHeight): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setTopContentInset): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setScrolledContentsLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setCounterScrollingLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setInsetClipLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setContentShadowLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setHeaderLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setFooterLayer): Deleted.
-        (WebCore::ScrollingStateScrollingNode::setScrollbarPaintersFromScrollbars): Deleted.
-        * page/scrolling/ScrollingStateScrollingNode.h:
-        (WebCore::ScrollingStateScrollingNode::scrollableAreaSize):
-        (WebCore::ScrollingStateScrollingNode::totalContentsSize):
-        * page/scrolling/ScrollingStateTree.cpp:
-        (WebCore::ScrollingStateTree::attachNode):
-        (WebCore::ScrollingStateTree::commit):
-        * page/scrolling/ScrollingStateTree.h:
-        (WebCore::ScrollingStateTree::rootStateNode):
-        (WebCore::ScrollingStateTree::setRootStateNode):
-        * page/scrolling/ScrollingTree.cpp:
-        (WebCore::ScrollingTree::commitNewTreeState):
-        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp: Added.
-        (WebCore::ScrollingTreeFrameScrollingNode::ScrollingTreeFrameScrollingNode):
-        (WebCore::ScrollingTreeFrameScrollingNode::~ScrollingTreeFrameScrollingNode):
-        (WebCore::ScrollingTreeFrameScrollingNode::updateBeforeChildren):
-        * page/scrolling/ScrollingTreeFrameScrollingNode.h: Copied from Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h.
-        (WebCore::ScrollingTreeFrameScrollingNode::updateLayersAfterDelegatedScroll):
-        (WebCore::ScrollingTreeFrameScrollingNode::synchronousScrollingReasons):
-        (WebCore::ScrollingTreeFrameScrollingNode::shouldUpdateScrollLayerPositionSynchronously):
-        (WebCore::ScrollingTreeFrameScrollingNode::frameScaleFactor):
-        (WebCore::ScrollingTreeFrameScrollingNode::headerHeight):
-        (WebCore::ScrollingTreeFrameScrollingNode::footerHeight):
-        (WebCore::ScrollingTreeFrameScrollingNode::topContentInset):
-        (WebCore::ScrollingTreeFrameScrollingNode::scrollBehaviorForFixedElements):
-        * page/scrolling/ScrollingTreeNode.h:
-        (WebCore::ScrollingTreeNode::isFrameScrollingNode):
-        (WebCore::ScrollingTreeNode::isOverflowScrollingNode):
-        * page/scrolling/ScrollingTreeOverflowScrollingNode.cpp: Copied from Source/WebKit2/UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.h.
-        (WebCore::ScrollingTreeOverflowScrollingNode::ScrollingTreeOverflowScrollingNode):
-        (WebCore::ScrollingTreeOverflowScrollingNode::~ScrollingTreeOverflowScrollingNode):
-        * page/scrolling/ScrollingTreeOverflowScrollingNode.h: Copied from Source/WebKit2/UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.h.
-        * page/scrolling/ScrollingTreeScrollingNode.cpp:
-        (WebCore::ScrollingTreeScrollingNode::ScrollingTreeScrollingNode):
-        (WebCore::ScrollingTreeScrollingNode::updateBeforeChildren):
-        (WebCore::ScrollingTreeScrollingNode::updateAfterChildren):
-        (WebCore::ScrollingTreeScrollingNode::setScrollPosition):
-        (WebCore::ScrollingTreeScrollingNode::setScrollPositionWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeScrollingNode::minimumScrollPosition):
-        (WebCore::ScrollingTreeScrollingNode::maximumScrollPosition):
-        * page/scrolling/ScrollingTreeScrollingNode.h:
-        (WebCore::ScrollingTreeScrollingNode::scrollableAreaSize):
-        (WebCore::ScrollingTreeScrollingNode::totalContentsSize):
-        (WebCore::ScrollingTreeScrollingNode::totalContentsSizeForRubberBand):
-        (WebCore::ScrollingTreeScrollingNode::setTotalContentsSizeForRubberBand):
-        (WebCore::ScrollingTreeScrollingNode::synchronousScrollingReasons): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::shouldUpdateScrollLayerPositionSynchronously): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::viewportSize): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::frameScaleFactor): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::headerHeight): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::footerHeight): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::scrollBehaviorForFixedElements): Deleted.
-        (WebCore::ScrollingTreeScrollingNode::topContentInset): Deleted.
-        * page/scrolling/ios/ScrollingCoordinatorIOS.mm:
-        (WebCore::ScrollingCoordinatorIOS::createScrollingTreeNode):
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.h: Renamed from Source/WebCore/page/scrolling/ios/ScrollingTreeScrollingNodeIOS.h.
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollLayer):
-        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm: Renamed from Source/WebCore/page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm.
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::create):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::ScrollingTreeFrameScrollingNodeIOS):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::~ScrollingTreeFrameScrollingNodeIOS):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateBeforeChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateAfterChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollPositionWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollLayerPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterViewportChange):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateLayersAfterDelegatedScroll):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::minimumScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::maximumScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollByWithoutContentEdgeConstraints):
-        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
-        (WebCore::ScrollingCoordinatorMac::createScrollingTreeNode):
-        * page/scrolling/mac/ScrollingStateFrameScrollingNodeMac.mm: Renamed from Source/WebCore/page/scrolling/mac/ScrollingStateScrollingNodeMac.mm.
-        (WebCore::ScrollingStateFrameScrollingNode::setScrollbarPaintersFromScrollbars):
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h: Renamed from Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.h.
-        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm: Renamed from Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm.
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::create):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::ScrollingTreeFrameScrollingNodeMac):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateAfterChildren):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::handleWheelEvent):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::allowsHorizontalStretching):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::allowsVerticalStretching):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::stretchAmount):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::pinnedInDirection):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::canScrollHorizontally):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::canScrollVertically):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::shouldRubberBandInDirection):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::absoluteScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollByWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::startSnapRubberbandTimer):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::stopSnapRubberbandTimer):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPositionWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateLayersAfterViewportChange):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::minimumScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::maximumScrollPosition):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollBy):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollByWithoutContentEdgeConstraints):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateMainFramePinState):
-        (WebCore::ScrollingTreeFrameScrollingNodeMac::logExposedUnfilledArea):
-        (WebCore::logThreadedScrollingMode):
-        (WebCore::logWheelEventHandlerCountChanged):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):
</del><ins>+                Moved these out-of-line.
</ins><span class="cx"> 
</span><del>-2014-05-19  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            (WebCore::CSSStyleSheet::didMutateRuleFromCSSStyleDeclaration):
+            * css/PropertySetCSSStyleDeclaration.cpp:
+            (WebCore::StyleRuleCSSStyleDeclaration::didMutate):
</ins><span class="cx"> 
</span><del>-        Images missing sometimes with composited clipping layers
-        https://bugs.webkit.org/show_bug.cgi?id=133065
-        &lt;rdar://problem/15224559&gt;
</del><ins>+                Made a separate mutation callback for CSSStyleDeclaration since its needs are
+                so simple compared to the mutation callback from CSSStyleSheet. Seems better
+                than adding yet another mode to the enum.
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
-        
-        When support for solid colors on layers was added, a layer was considered a candidate
-        for the solid color optimization without regard to whether it had descendent layers
-        with &quot;paintsIntoCompositedAncestor&quot; requirements.
-        
-        Fix hasVisibleNonCompositingDescendantLayers(), renaming it to isPaintDestinationForDescendentLayers()
-        and having it take into account whether descendent layers need to paint into an
-        ancestor.
-        
-        Also, this test has to happen after those descendent layers have had their
-        compositing state updated, so move the isSimpleContainerCompositingLayer() to
-        a new updateAfterDescendents() function which is called from the various
-        places we do compositing-udpate-tree-walks.
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::Document):
+            (WebCore::Document::recalcStyle):
+            (WebCore::Document::styleResolverChanged):
+            (WebCore::Document::optimizedStyleSheetUpdateTimerFired):
+            (WebCore::Document::scheduleOptimizedStyleSheetUpdate):
</ins><span class="cx"> 
</span><del>-        Test: compositing/backing/solid-color-with-paints-into-ancestor.html
</del><ins>+                Added mechanism to defer doing a RecalcStyleIfNeeded.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateGeometry):
-        (WebCore::RenderLayerBacking::updateAfterDescendents):
-        (WebCore::RenderLayerBacking::paintsChildren):
-        (WebCore::compositedWithOwnBackingStore):
-        (WebCore::descendentLayerPaintsIntoAncestor):
-        (WebCore::RenderLayerBacking::isPaintDestinationForDescendentLayers):
-        (WebCore::hasVisibleNonCompositingDescendant): Deleted.
-        (WebCore::RenderLayerBacking::hasVisibleNonCompositingDescendantLayers): Deleted.
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
</del><ins>+            (WebCore::Document::updateStyleIfNeeded):
</ins><span class="cx"> 
</span><del>-2014-05-19  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+                Synchronize the optimized style sheet update if there's one scheduled.
+                This ensures that stuff like layout-dependent property access won't operate
+                on stale style.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r133351, sub-pixel layout): Right-to-left block with text-overflow: ellipsis truncates prematurely (breaks facebook.com Hebrew UI)
-        https://bugs.webkit.org/show_bug.cgi?id=112227
</del><ins>+            * dom/DocumentStyleSheetCollection.h:
+            (WebCore::DocumentStyleSheetCollection::pendingUpdateType):
+            (WebCore::DocumentStyleSheetCollection::setPendingUpdateType):
+            (WebCore::DocumentStyleSheetCollection::flushPendingUpdates):
+            * dom/DocumentStyleSheetCollection.cpp:
+            (WebCore::DocumentStyleSheetCollection::DocumentStyleSheetCollection):
+            (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):
</ins><span class="cx"> 
</span><del>-        Reviewed by Maciej Stachowiak.
</del><ins>+                Have DSSC track the kind of style sheet update it needs to do (instead of just
+                a boolean &quot;needs update.&quot;) This is used by Document::recalcStyle() to make sure
+                the right kind of update happens if there's one scheduled.
</ins><span class="cx"> 
</span><del>-        This patch removes unnecessary integral snapping of inlines at layout time.
</del><ins>+            (WebCore::DocumentStyleSheetCollection::activeStyleSheetsContains):
</ins><span class="cx"> 
</span><del>-        The general rule of thumb of using round/floor/ceil at layout time is to not use them.

-        When some computed values (x, y, width, height) get snapped during layout, while others don't,
-        intersecting/measuring mismatches could occur and they could end up producing visual artifacts such as truncations.
-        This patch also enables iframe content to be positioned on odd device pixel positions on retina displays.
-        
-        Tests: fast/frames/hidpi-position-iframe-on-device-pixel.html
-               fast/inline/hidpi-rtl-text-does-not-fit-line-and-gets-cut-off.html
</del><ins>+                Added helper to check if a CSSStyleSheet is part of the active set.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.h:
-        (WebCore::RenderBlock::logicalLeftOffsetForLine):
-        (WebCore::RenderBlock::pixelSnappedLogicalLeftOffsetForLine): Deleted.
-        (WebCore::RenderBlock::pixelSnappedLogicalRightOffsetForLine): Deleted.
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::updateLogicalInlinePositions):
-        (WebCore::RenderBlockFlow::deleteEllipsisLineBoxes):
-        (WebCore::RenderBlockFlow::checkLinesForTextOverflow):
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-18  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</del><ins>+        Merge r159970.
</ins><span class="cx"> 
</span><del>-        AX: iOS: using AXAttributeCacheEnabler is too slow for every accessibilityElementAtIndex:
-        https://bugs.webkit.org/show_bug.cgi?id=133043
</del><ins>+    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mario Sanchez Prada.
</del><ins>+            Add more CachedPage null checks
+            https://bugs.webkit.org/show_bug.cgi?id=125106
</ins><span class="cx"> 
</span><del>-        iOS Accessibility code tries to improve performance by caching attributes when accessing
-        elements through the platform API. However, those API calls can be used very frequently when 
-        iterating elements. Creating the AXAttributeCacheEnabler object and tearing it down is proving
-        to be the hottest code path in samples for accessibility access.
</del><ins>+            Reviewed by Sam Weinig.
</ins><span class="cx"> 
</span><del>-        We need to move the logic for enabling/disabling the attribute cache to a level that can make
-        a more informed decision about when to enable/disable.
</del><ins>+            Only some functions in PageCache.cpp null-check the CachedPages in HistoryItems.
</ins><span class="cx"> 
</span><del>-        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
-        (-[WebAccessibilityObjectWrapper enableAttributeCaching]):
-        (-[WebAccessibilityObjectWrapper disableAttributeCaching]):
-        (-[WebAccessibilityObjectWrapper accessibilityElementCount]):
-        (-[WebAccessibilityObjectWrapper accessibilityElementAtIndex:]):
-        (-[WebAccessibilityObjectWrapper indexOfAccessibilityElement:]):
</del><ins>+            Every part that manipulates the CachedPage should.
</ins><span class="cx"> 
</span><del>-2014-05-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * history/PageCache.cpp:
+            (WebCore::PageCache::markPagesForVistedLinkStyleRecalc):
+            (WebCore::PageCache::markPagesForFullStyleRecalc):
+            (WebCore::PageCache::markPagesForDeviceScaleChanged):
+            (WebCore::PageCache::markPagesForCaptionPreferencesChanged):
</ins><span class="cx"> 
</span><del>-        Use RenderStyle&amp; in more places in RenderLayerBacking
-        https://bugs.webkit.org/show_bug.cgi?id=133061
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+        Merge r159986.
</ins><span class="cx"> 
</span><del>-        Convert several member functions to use references to RenderStyle rather
-        than pointers. Move canCreateTiledImage() higher in the file (no code
-        changes). Other minor cleanup.
</del><ins>+    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt; 
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer):
-        (WebCore::RenderLayerBacking::updateOpacity):
-        (WebCore::RenderLayerBacking::updateTransform):
-        (WebCore::RenderLayerBacking::updateFilters):
-        (WebCore::RenderLayerBacking::updateBlendMode):
-        (WebCore::RenderLayerBacking::updateGeometry):
-        (WebCore::hasBoxDecorations):
-        (WebCore::canCreateTiledImage):
-        (WebCore::hasBoxDecorationsOrBackgroundImage):
-        (WebCore::hasPerspectiveOrPreserves3D):
-        (WebCore::supportsDirectBoxDecorationsComposition):
-        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
-        (WebCore::RenderLayerBacking::contentChanged):
-        (WebCore::RenderLayerBacking::startTransition):
-        * rendering/RenderLayerBacking.h:
</del><ins>+            Possible crash in ProgressTracker::progressHeartbeatTimerFired(Timer&lt;ProgressTracker&gt;*) 
+            https://bugs.webkit.org/show_bug.cgi?id=125110 
</ins><span class="cx"> 
</span><del>-2014-05-17  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Darin Adler. 
</ins><span class="cx"> 
</span><del>-        Rename some RenderLayerBacking member functions
-        https://bugs.webkit.org/show_bug.cgi?id=133030
</del><ins>+            FrameLoader::loadProgressingStatusChanged() might be called while the Frame has a null FrameView. 
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            It’s unclear how to reproduce, but there’s no harm in a null check. 
</ins><span class="cx"> 
</span><del>-        Remove &quot;GraphicsLayer&quot; from some member function names on RenderLayerBacking.
-        
-        No behavior change.
</del><ins>+            * loader/FrameLoader.cpp: 
+            (WebCore::FrameLoader::loadProgressingStatusChanged): 
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
-        (WebCore::AVFWrapper::createAVCFVideoLayer):
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivateQTKit::createQTMovieLayer):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateAfterLayout):
-        (WebCore::RenderLayerBacking::updateConfiguration):
-        (WebCore::RenderLayerBacking::updateGeometry):
-        (WebCore::RenderLayerBacking::contentChanged):
-        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Deleted.
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Deleted.
-        * rendering/RenderLayerBacking.h:
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
-        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
-        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
-        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
-        (WebCore::RenderLayerCompositor::attachRootLayer):
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-19  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Merge r159974.
</ins><span class="cx"> 
</span><del>-        Fix assertion failure with simple line layout debug borders enabled.
</del><ins>+    2013-12-02  Brady Eidson  &lt;beidson@apple.com&gt; 
</ins><span class="cx"> 
</span><del>-        Rubber-stamped by Andreas Kling.
</del><ins>+            Possible crash in ProgressTracker::progressHeartbeatTimerFired(Timer&lt;ProgressTracker&gt;*) 
+            https://bugs.webkit.org/show_bug.cgi?id=125110 
</ins><span class="cx"> 
</span><del>-        * rendering/SimpleLineLayoutFunctions.cpp:
-        (WebCore::SimpleLineLayout::paintDebugBorders): We shoudn't try to paint empty rects.
</del><ins>+            Reviewed by Darin Adler. 
</ins><span class="cx"> 
</span><del>-2014-05-18  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            It’s possible to have a null m_originatingProgressFrame when the heartbeat timer fires. 
</ins><span class="cx"> 
</span><del>-        Reduce constructor copypasta in RenderText and RenderElement.
-        &lt;https://webkit.org/b/133056&gt;
</del><ins>+            On the surface this seems impossible because the only time m_originatingProgressFrame is cleared 
+            out the heartbeat timer is also stopped. 
</ins><span class="cx"> 
</span><del>-        Use delegating constructors to remove duplicated initializer lists
-        from the constructors of RenderText and RenderElement.
</del><ins>+            But there’s likely still a race condition in multi-threaded environments. 
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            There’s no harm in null-checking m_originatingProgressFrame before accessing its loader. 
</ins><span class="cx"> 
</span><del>-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::RenderElement):
-        * rendering/RenderElement.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::RenderText):
-        * rendering/RenderText.h:
</del><ins>+            * loader/ProgressTracker.cpp: 
+            (WebCore::ProgressTracker::progressHeartbeatTimerFired): 
</ins><span class="cx"> 
</span><del>-2014-05-18  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Crash during scroll when latched
-        https://bugs.webkit.org/show_bug.cgi?id=133064
</del><ins>+        Merge r162063.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+    2014-01-15  Antti Koivisto  &lt;antti@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::platformPrepareForWheelEvents): Prevent dereference of NULL
-        wheelEventTarget argument.
</del><ins>+            Suspend resource requests during computedStyle
+            https://bugs.webkit.org/show_bug.cgi?id=127034
</ins><span class="cx"> 
</span><del>-2014-05-18  Svetlana Redchenko  &lt;redchenko@yandex-team.ru&gt;
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Input ::selection pseudo class does not work leading to hidden selection
-        https://bugs.webkit.org/show_bug.cgi?id=38943
</del><ins>+            We have some cases where getting computed style leads to crashes in loadPendingImages. 
+            This is probably caused by load callbacks resulting in re-entering WebKit and killing the StyleResolver.
+            
+            As a speculative fix suspend resource loads (and so callbacks) when getting the computed style.
+            We do similar suspension during style recalc for the same reason.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * dom/Document.cpp:
+            (WebCore::Document::styleForElementIgnoringPendingStylesheets):
+            * loader/ResourceLoadScheduler.h:
+            (WebCore::ResourceLoadScheduler::Suspender::Suspender):
+            (WebCore::ResourceLoadScheduler::Suspender::~Suspender):
</ins><span class="cx"> 
</span><del>-        Test: fast/selectors/input-with-selection-pseudo-element.html
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When text is selected inside input element, it should change the
-        color and background color according to the ::selection pseudo element.
</del><ins>+        Merge r158697.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::selectionBackgroundColor):
-        (WebCore::RenderObject::selectionColor):
-        (WebCore::RenderObject::selectionPseudoStyle):
-        * rendering/RenderObject.h:
</del><ins>+    2013-11-05  Enrica Casucci  &lt;enrica@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-18  Sam Weinig  &lt;sam@webkit.org&gt;
</del><ins>+            Full width semicolon is wrong in vertical text.
+            https://bugs.webkit.org/show_bug.cgi?id=123814
+            &lt;rdar://problem/15312541&gt;
</ins><span class="cx"> 
</span><del>-        [WebKit2] Implement ScriptMessageHandlers
-        https://bugs.webkit.org/show_bug.cgi?id=133053
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            The full width semicolon should always be upright.
+            Adding it to the list of characters that should
+            ignore rotation.
</ins><span class="cx"> 
</span><del>-        * DerivedSources.make:
-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::finishCreation):
-        * bindings/js/JSUserMessageHandlersNamespaceCustom.cpp: Added.
-        (WebCore::JSUserMessageHandlersNamespace::getOwnPropertySlotDelegate):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::shouldHaveWebKitNamespaceForWorld):
-        (WebCore::DOMWindow::webkitNamespace):
-        * page/DOMWindow.h:
-        * page/UserContentController.cpp:
-        (WebCore::UserContentController::addUserMessageHandlerDescriptor):
-        (WebCore::UserContentController::removeUserMessageHandlerDescriptor):
-        * page/UserContentController.h:
-        (WebCore::UserContentController::userMessageHandlerDescriptors):
-        * page/UserMessageHandler.cpp: Added.
-        (WebCore::UserMessageHandler::UserMessageHandler):
-        (WebCore::UserMessageHandler::~UserMessageHandler):
-        (WebCore::UserMessageHandler::postMessage):
-        (WebCore::UserMessageHandler::name):
-        (WebCore::UserMessageHandler::world):
-        * page/UserMessageHandler.h: Added.
-        (WebCore::UserMessageHandler::create):
-        * page/UserMessageHandler.idl: Added.
-        * page/UserMessageHandlerDescriptor.cpp: Added.
-        (WebCore::UserMessageHandlerDescriptor::UserMessageHandlerDescriptor):
-        (WebCore::UserMessageHandlerDescriptor::~UserMessageHandlerDescriptor):
-        (WebCore::UserMessageHandlerDescriptor::name):
-        (WebCore::UserMessageHandlerDescriptor::world):
-        * page/UserMessageHandlerDescriptor.h: Added.
-        (WebCore::UserMessageHandlerDescriptor::Client::~Client):
-        (WebCore::UserMessageHandlerDescriptor::create):
-        (WebCore::UserMessageHandlerDescriptor::client):
-        * page/UserMessageHandlerDescriptorTypes.h: Added.
-        * page/UserMessageHandlersNamespace.cpp: Added.
-        (WebCore::UserMessageHandlersNamespace::UserMessageHandlersNamespace):
-        (WebCore::UserMessageHandlersNamespace::~UserMessageHandlersNamespace):
-        (WebCore::UserMessageHandlersNamespace::handler):
-        * page/UserMessageHandlersNamespace.h: Added.
-        (WebCore::UserMessageHandlersNamespace::create):
-        * page/UserMessageHandlersNamespace.idl: Added.
-        * page/WebKitNamespace.cpp: Added.
-        (WebCore::WebKitNamespace::WebKitNamespace):
-        (WebCore::WebKitNamespace::~WebKitNamespace):
-        (WebCore::WebKitNamespace::messageHandlers):
-        * page/WebKitNamespace.h: Added.
-        (WebCore::WebKitNamespace::create):
-        * page/WebKitNamespace.idl: Added.
</del><ins>+            * platform/graphics/FontGlyphs.cpp:
+            (WebCore::shouldIgnoreRotation):
</ins><span class="cx"> 
</span><del>-2014-05-18  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (r156546): Default media controls are laid out incorrectly when media element is styled with direction:rtl
-        https://bugs.webkit.org/show_bug.cgi?id=132531
-        &lt;rdar://problem/16806267&gt;
-        
-        Reviewed by Mark Rowe.
</del><ins>+        Merge r163465.
</ins><span class="cx"> 
</span><del>-        This was already tested by the media/video-rtl.htm reftest, now unskipped.
</del><ins>+    2014-02-04  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediacontrols/mediaControlsApple.css:
-        (audio::-webkit-media-controls-panel): Add missing direction: ltr
</del><ins>+            Move characterAt index checks from InlineIterator to RenderText
+            https://bugs.webkit.org/show_bug.cgi?id=128224
</ins><span class="cx"> 
</span><del>-2014-05-18  Rik Cabanier  &lt;cabanier@adobe.com&gt;
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        support for navigator.hardwareConcurrency
-        https://bugs.webkit.org/show_bug.cgi?id=132588
</del><ins>+            Move characterAt index checks from InlineIterator to RenderText
+            so that all RenderText calls are covered. Few safe instances are
+            now covered with uncheckedCharacterAt.
</ins><span class="cx"> 
</span><del>-        Reviewed by Filip Pizlo.
</del><ins>+            Merged from Blink:
+            http://src.chromium.org/viewvc/blink?view=revision&amp;revision=150830
</ins><span class="cx"> 
</span><del>-        Added a new API that returns the number of CPU cores up to 8.
</del><ins>+            Test: fast/text/character-at-crash.html
</ins><span class="cx"> 
</span><del>-        Test: fast/dom/navigator-hardwareConcurrency.html
</del><ins>+            * rendering/InlineIterator.h:
+            (WebCore::InlineIterator::characterAt):
+            * rendering/RenderText.cpp:
+            (WebCore::RenderText::computePreferredLogicalWidths):
+            * rendering/RenderText.h:
+            (WebCore::RenderText::operator[]):
+            (WebCore::RenderText::uncheckedCharacterAt):
+            (WebCore::RenderText::characterAt):
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * page/Navigator.cpp:
-        (WebCore::Navigator::hardwareConcurrency):
-        * page/Navigator.h:
-        * page/Navigator.idl:
</del><ins>+2014-03-05  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-18  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+        Merge r164933.
</ins><span class="cx"> 
</span><del>-        Fix iOS build.
</del><ins>+    2014-03-01  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Move UserContentController symbols to the right place.
</del><ins>+        Ensure keySplines is valid in SMIL animations
+        &lt;http://webkit.org/b/129547&gt;
+        &lt;rdar://problem/15676128&gt;
</ins><span class="cx"> 
</span><del>-2014-05-18  Jon Lee  &lt;jonlee@apple.com&gt;
</del><ins>+        Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Build fix for r169006.
</del><ins>+        Merged from Blink (patch by Philip Rogers):
+        https://src.chromium.org/viewvc/blink?revision=156452&amp;view=revision
+        http://crbug.com/276111
</ins><span class="cx"> 
</span><del>-        Unreviewed.
</del><ins>+            This patch fixes a crash in SMIL animations when keySplines are not
+            specified. The SMIL spec is clear on this:
+            http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncCalcMode
+            &quot;If there are any errors in the keyTimes specification (bad values,
+            too many or too few values), the animation will have no effect.&quot;
</ins><span class="cx"> 
</span><del>-        * loader/ResourceLoader.h: Return didCreateQuickLookHandle() to public.
</del><ins>+            This patch simply checks that keyTimes is not empty. Previously,
+            splinesCount was set to be m_keySplines.size() + 1 in
+            SVGAnimationElement.cpp; this patch changes splinesCount to be equal
+            to m_keySplines.size() to make the logic easier to follow and to
+            match other checks in SVGAnimationElement::startedActiveInterval.
</ins><span class="cx"> 
</span><del>-2014-05-18  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Test: svg/animations/animate-keysplines-crash.html
</ins><span class="cx"> 
</span><del>-        REGRESSION (r160259): text-combine glyphs are not rendered
-        https://bugs.webkit.org/show_bug.cgi?id=127324
</del><ins>+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
-        
-        The original text gets overwritten by a change that is supposed to affect rendered text only.
-        Fixed by giving the text update functions well-defined purposes.
</del><ins>+2014-03-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/text/text-combine-rendering.html
</del><ins>+        Unreviewed build fix after bad merge of r154146.
+        &lt;rdar://problem/16223155&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderCombineText.cpp:
-        (WebCore::RenderCombineText::styleDidChange):
-        (WebCore::RenderCombineText::setRenderedText):
-        (WebCore::RenderCombineText::combineText):
-        (WebCore::RenderCombineText::setTextInternal): Deleted.
-        * rendering/RenderCombineText.h:
-        * rendering/RenderCounter.cpp:
-        (WebCore::RenderCounter::computePreferredLogicalWidths):
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::setRenderedText):
-        
-            This function now updates the rendered text but does not change the original.
-            Get the original text by calling originalText().
</del><ins>+        Two files were ommitted from the prior commit.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderText::setText):
-        
-            This the only place original text now changes.
</del><ins>+        * platform/win/WebCoreBundleWin.cpp: Added.
+        (WebCore::createWebKitBundle):
+        (WebCore::webKitBundle):
+        * platform/win/WebCoreBundleWin.h: Added.
</ins><span class="cx"> 
</span><del>-        (WebCore::RenderText::setTextInternal): Deleted.
-        
-            Renamed to setRenderedText.
</del><ins>+2014-03-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderText.h:
-        * rendering/svg/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::setRenderedText):
-        (WebCore::RenderSVGInlineText::setTextInternal): Deleted.
-        * rendering/svg/RenderSVGInlineText.h:
</del><ins>+        Unreviewed build fix.
+        &lt;rdar://problem/16197002&gt;
</ins><span class="cx"> 
</span><del>-2014-05-17  Maciej Stachowiak  &lt;mjs@apple.com&gt;
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Exclude 64-bit assembly code when building
+        32-bit DebugSuffix target.
</ins><span class="cx"> 
</span><del>-        Don't attempt to update id or name for nodes that are already removed
-        https://bugs.webkit.org/show_bug.cgi?id=133041
</del><ins>+2014-02-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Unreviewed build fix.
+        &lt;rdar://problem/16197002&gt;
</ins><span class="cx"> 
</span><del>-        Tests: fast/dom/remove-element-with-id-that-was-inserted-on-DOMNodeRemoved.html
-               fast/dom/remove-element-with-name-that-was-inserted-on-DOMNodeRemoved.html
</del><ins>+        * WebCore.vcxproj/WebCore.proj: Remove trailing
+        slash from path names, as this was causing multiple arguments
+        to be concatenated together (the whitespace was getting escaped
+        by the slash.)
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::Element::removedFrom): Skip updating ids and names for an element not
-        in a treescope, as we already do for elements not in a document.
</del><ins>+2014-02-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-17  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Merge r164660
</ins><span class="cx"> 
</span><del>-        REGRESSION (NetworkProcess): Trying to use appcache fallback crashes in ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache
-        https://bugs.webkit.org/show_bug.cgi?id=133007
-        &lt;rdar://problem/13702706&gt;
</del><ins>+    2014-02-25  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        appcache tests often fail on the Mac WebKit2 bot
-        https://bugs.webkit.org/show_bug.cgi?id=82061
</del><ins>+            [Win] Gracefully recover from missing 'naturalSize' parameter for media
+            https://bugs.webkit.org/show_bug.cgi?id=129278
</ins><span class="cx"> 
</span><del>-        Reviewed by Maciej Stachowiak.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Covered by existing tests, which this patch enables.
</del><ins>+            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Add declaration for
+            missing function call.
+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::createMetadataKeyNames):
+            (WebCore::MediaPlayerPrivateAVFoundationCF::assetStatus): Don't treat missing 'naturalSize'
+            as a fatal error.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::tracksChanged): Handle case of asset track
+            not being available yet.
+            (WebCore::MediaPlayerPrivateAVFoundationCF::sizeChanged): If the 'naturalSize' is empty,
+            use the Player Item's 'presentationSize' instead.
+            (WebCore::AVFWrapper::processNotification): Add missing handler for duration changed.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export ResourceLoader::cancel(const ResourceError&amp;). It used
-        to be virtual, but marking subclasses final has resulted in the compiler calling
-        it directly from WebKitLegacy framework. Seeing that no subclass overrides it,
-        I then made it non-virtual.
-        Also export ApplicationCacheHost functions that are now used from WebKit2.
</del><ins>+2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/ResourceLoader.h: Made the class abstract (as I didn't realize at first
-        that it's always either a SubresourceLoader or a NetscapePlugInStreamLoader).
-        Made ResourceHandleClient functions private, as they should never be called other
-        than via a ResourceHandleClient pointer.
</del><ins>+        Merge r163579.
</ins><span class="cx"> 
</span><del>-        * loader/NetscapePlugInStreamLoader.h:
-        * loader/SubresourceLoader.h:
-        Marked these final.
</del><ins>+    2014-02-04  Jeffrey Pfau  &lt;jpfau@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/ResourceLoader.cpp: (WebCore::ResourceLoader::willSwitchToSubstituteResource):
-        Added a function to be called when switching to a substitute resource. We still
-        need a ResourceLoader at this point, as substitute resource will be delivered through
-        it, but we don't want it to continue its current load.
</del><ins>+            Make adoption agency use the task queue
+            https://bugs.webkit.org/show_bug.cgi?id=109445
</ins><span class="cx"> 
</span><del>-        * loader/appcache/ApplicationCacheHost.cpp:
-        (WebCore::ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache):
-        Call the ResourceLoader function instead of using handle, which is null when
-        using out of process networking.
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            Tests: fast/parser/adoption-agency-crash-01.html
+                   fast/parser/adoption-agency-crash-02.html
+                   fast/parser/adoption-agency-crash-03.html
</ins><span class="cx"> 
</span><del>-        We shouldn't make a ScrollingThread on iOS.
-        &lt;https://webkit.org/b/133038&gt;
-        &lt;rdar://problem/16947589&gt;
</del><ins>+            * html/parser/HTMLConstructionSite.cpp:
+            (WebCore::insert):
+            (WebCore::executeInsertTask):
+            (WebCore::executeReparentTask):
+            (WebCore::executeInsertAlreadyParsedChildTask):
+            (WebCore::executeTakeAllChildrenTask):
+            (WebCore::executeTask):
+            (WebCore::HTMLConstructionSite::attachLater):
+            (WebCore::HTMLConstructionSite::executeQueuedTasks):
+            (WebCore::HTMLConstructionSite::insertTextNode):
+            (WebCore::HTMLConstructionSite::reparent):
+            (WebCore::HTMLConstructionSite::insertAlreadyParsedChild):
+            (WebCore::HTMLConstructionSite::takeAllChildren):
+            (WebCore::HTMLConstructionSite::fosterParent):
+            * html/parser/HTMLConstructionSite.h:
+            (WebCore::HTMLConstructionSiteTask::HTMLConstructionSiteTask):
+            (WebCore::HTMLConstructionSiteTask::oldParent):
+            * html/parser/HTMLTreeBuilder.cpp:
+            (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
</ins><span class="cx"> 
</span><del>-        Don't call ScrollingThred::dispatch() from the pressure relief
-        code on iOS since that will end up instantiating a scrolling thread
-        which we'd otherwise never have.
</del><ins>+2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+        Merge r162820.
</ins><span class="cx"> 
</span><del>-        * platform/MemoryPressureHandler.cpp:
-        (WebCore::MemoryPressureHandler::releaseMemory):
</del><ins>+    2014-01-26  David Kilzer  &lt;ddkilzer@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-17  Piotr Grad  &lt;p.grad@samsung.com&gt;
</del><ins>+            Part 2: Assertion failure in WebCore::PseudoElement::didRecalcStyle()
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=126761&gt;
+            &lt;rdar://problem/15793540&gt;
</ins><span class="cx"> 
</span><del>-        Setting playback rate on video with media controller is not ignored.
-        https://bugs.webkit.org/show_bug.cgi?id=129048
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+            * bindings/objc/DOM.mm:
+            (-[DOMElement image]):
+            (-[DOMElement _imageTIFFRepresentation]):
+            * platform/gtk/PasteboardGtk.cpp:
+            (WebCore::Pasteboard::writeImage):
+            * platform/win/PasteboardWin.cpp:
+            (WebCore::Pasteboard::writeImage):
+            (WebCore::getCachedImage):
+            * rendering/HitTestResult.cpp:
+            (WebCore::HitTestResult::image):
+            - More places where toRenderImage() should be used instead of
+              toImage().
+            - Fixed last two places where static_cast&lt;WebCore::RenderImage*&gt;
+              was being used instead of toRenderImage().
</ins><span class="cx"> 
</span><del>-        Replaced queries for m_playbackRate with effectivePlaybackRate()
-        which includes media controller playback rate.
</del><ins>+2014-02-12  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: media/video-controller-child-rate.html
</del><ins>+        Merge r162679.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
-        * html/HTMLMediaElement.h:
</del><ins>+    2014-01-23  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-16  Anders Carlsson  &lt;andersca@apple.com&gt;
</del><ins>+            Assertion failure in WebCore::PseudoElement::didRecalcStyle()
+            &lt;https://bugs.webkit.org/show_bug.cgi?id=126761&gt;
+            &lt;rdar://problem/15793540&gt;
</ins><span class="cx"> 
</span><del>-        Expose WKUserScript as API
-        https://bugs.webkit.org/show_bug.cgi?id=133017
-        &lt;rdar://problem/16948059&gt;
</del><ins>+            Reviewed by Andy Estes.
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            Test: fast/images/animate-list-item-image-assertion.html
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Export symbols.
</del><ins>+            * dom/PseudoElement.cpp:
+            (WebCore::PseudoElement::didRecalcStyle):
+            Check isRenderImage() rather than isImage() before casting to
+            RenderImage.
</ins><span class="cx"> 
</span><del>-        * WebCore.xcodeproj/project.pbxproj:
-        Change UserContentController.h to be a private header.
</del><ins>+            * editing/ios/EditorIOS.mm:
+            (WebCore::getImage):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        Set m_userContentController from the page configuration and add it if it's not null.
</del><ins>+            * editing/mac/EditorMac.mm:
+            (WebCore::getImage):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        * page/Page.h:
-        Add UserContentController to PageClients.
</del><ins>+            * html/HTMLImageElement.cpp:
+            (WebCore::HTMLImageElement::parseAttribute):
+            (WebCore::HTMLImageElement::didAttachRenderers):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::addPage):
-        Only try to add a user content controller if the page doesn't already have one.
</del><ins>+            * loader/ImageLoader.cpp:
+            (WebCore::ImageLoader::renderImageResource):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        (WebCore::PageGroup::removePage):
-        Only try to remove the user content controller if it's the group one.
</del><ins>+            * page/DragController.cpp:
+            (WebCore::getCachedImage):
+            Ditto.
</ins><span class="cx"> 
</span><del>-2014-05-17  Andreas Kling  &lt;akling@apple.com&gt;
</del><ins>+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
+            (WebCore::RenderLayerBacking::updateImageContents):
+            Ditto.
</ins><span class="cx"> 
</span><del>-        REGRESSION (r166422): All RenderBox objects grew 104 bytes from adding repaint timers.
-        &lt;https://webkit.org/b/133027&gt;
-        &lt;rdar://problem/16867410&gt;
</del><ins>+2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Instead of storing a rarely-used repaint timer on every RenderBox, store one
-        on the RenderView, and keep a hash set of renderers needing repaint.
</del><ins>+        Merge r161925.
</ins><span class="cx"> 
</span><del>-        Renderers get a flag tracking whether they have a pending lazy repaint.
-        This way we can avoid hash lookups in the common case.
</del><ins>+    2014-01-13  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Also added a static assertion to catch RenderBox growing in the future.
</del><ins>+            Highlighting password field then making a Sticky Note via Safari Services exposes password
+            https://bugs.webkit.org/show_bug.cgi?id=126946
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Reviewed by Enrica Casucci.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBox.cpp:
-        (WebCore::SameSizeAsRenderBox::~SameSizeAsRenderBox):
-        (WebCore::RenderBox::RenderBox):
-        (WebCore::RenderBox::~RenderBox):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::layoutOverflowRectForPropagation):
-        * rendering/RenderBox.h:
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::RenderElement):
-        * rendering/RenderElement.h:
-        (WebCore::RenderElement::setRenderBoxNeedsLazyRepaint):
-        (WebCore::RenderElement::renderBoxNeedsLazyRepaint):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::RenderView):
-        (WebCore::RenderView::scheduleLazyRepaint):
-        (WebCore::RenderView::unscheduleLazyRepaint):
-        (WebCore::RenderView::lazyRepaintTimerFired):
-        * rendering/RenderView.h:
</del><ins>+            Using the Services menu has a slightly different codepath than Editor::copy() does. This
+            patch duplicates the canCopy() check that Editor::copy() does.
</ins><span class="cx"> 
</span><del>-2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Testing is not possible because the Services menu is not accessible to our tests.
</ins><span class="cx"> 
</span><del>-        [Mac][MSE] setCurrentTime() goes down fastSeek path in MediaPlayerPrivateMediaSourceAVFObjC.
-        https://bugs.webkit.org/show_bug.cgi?id=133023
</del><ins>+            * editing/mac/EditorMac.mm:
+            (WebCore::Editor::stringSelectionForPasteboard):
+            (WebCore::Editor::stringSelectionForPasteboardWithImageAltText):
+            (WebCore::Editor::dataSelectionForPasteboard):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When seeking a MSE video, do not go down the fastSeekForMediaTime() path if the
-        seek resulted from a setCurrentTime() call. The logic can lead to attempted seeks
-        before buffered ranges.
</del><ins>+        Merge r158739.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekInternal):
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        (WebCore::MediaSourcePrivateAVFObjC::seekToTime):
</del><ins>+    2013-11-06  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-2014-05-16  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+            Notify nodes removal to Range/Selection after dispatching blur and mutation event
+            https://bugs.webkit.org/show_bug.cgi?id=123880
</ins><span class="cx"> 
</span><del>-        [iOS] ScrollView::visibleContentRectInternal is bypassing the iOS code for unobscuredContentRect
-        https://bugs.webkit.org/show_bug.cgi?id=133008
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/b60576a0560d14f8757e58d55d37b7cefa48a6ac
</ins><span class="cx"> 
</span><del>-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::visibleContentRectInternal):
-        ScrollView::visibleContentRectInternal() was calling the internal implementation of visibleContentRect().
-        That was skipping the iOS implementation and getting the framerect directly. That size is invalid on iOS
-        when the exposed rect and unobscured rect are not the same.
</del><ins>+            In willRemoveChildren in ContainerNode.cpp, call Document::nodeChildrenWillBeRemoved after instead of
+            before dispatching mutation events because we need to update ranges created by those mutation event
+            listeners. willRemoveChild was fixed in r115686.
</ins><span class="cx"> 
</span><del>-2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+            Tests: editing/selection/selection-change-in-blur-event-by-remove-children.html
+                   editing/selection/selection-change-in-mutation-event-by-remove-children.html
+                   fast/dom/Range/range-created-during-remove-children.html
</ins><span class="cx"> 
</span><del>-        [Mac] naturalSize not updated when preload=metadata
-        https://bugs.webkit.org/show_bug.cgi?id=132994
</del><ins>+            * dom/ContainerNode.cpp:
+            (WebCore::willRemoveChildren):
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: media/video-load-preload-metadata-naturalsize.html
</del><ins>+        Merge r158719.
</ins><span class="cx"> 
</span><del>-        When preload=metadata, we never create an AVPlayerItem, and therefore never receive a
-        presentationSize KVO. When an AVAsset informs us that its tracks have changed, and there
-        is no AVPlayerItem, recalculate presentation size based on the first video track's natural
-        size.
</del><ins>+    2013-11-05  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged):
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
-        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekInternal):
</del><ins>+            Protect DOM nodes in IndentOutdentCommand::tryIndentingAsListItem()
+            https://bugs.webkit.org/show_bug.cgi?id=123861
</ins><span class="cx"> 
</span><del>-2014-05-16  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Remove &quot;region-based columns&quot; prefs
-        https://bugs.webkit.org/show_bug.cgi?id=133006
-        &lt;rdar://problem/16945824&gt;
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/297442eb539a2b764fdad323de79099a70179186 partially.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dave Hyatt.
</del><ins>+            * editing/IndentOutdentCommand.cpp:
+            (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Make selectedListItem, previousList, and nextList
+            RefPtr since they're are used after calling insertNodeBefore.
</ins><span class="cx"> 
</span><del>-        Remove &quot;region-based columns&quot; prefs and related code, since this is only
-        way to render columns now.
</del><ins>+2014-02-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * page/Settings.in:
</del><ins>+        Merge r158058.
</ins><span class="cx"> 
</span><del>-2014-05-16  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+    2013-10-25  Mark Lam  &lt;mark.lam@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Link search area for touch events is too large in some cases
-        https://bugs.webkit.org/show_bug.cgi?id=132988
-        &lt;rdar://problem/16917843&gt;
</del><ins>+            DatabaseManager's ProposedDatabases need to be thread-safe.
+            https://bugs.webkit.org/show_bug.cgi?id=123313.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Geoffrey Garen.
</ins><span class="cx"> 
</span><del>-        * page/ios/FrameIOS.mm:
-        (WebCore::Frame::qualifyingNodeAtViewportLocation):
-        
-            - Adjust the search area to screen ppi.
-            - Remove cut-off at scale 1. This made us pick physically far-away elements when zoomed in.
-            
-        * platform/PlatformScreen.h:
-        * platform/ios/PlatformScreenIOS.mm:
-        (WebCore::mobileGestaltFloatValue):
-        (WebCore::screenPPIFactor):
</del><ins>+            No new tests.
</ins><span class="cx"> 
</span><del>-            Figure out screens physical PPI relative to a base.
</del><ins>+            * Modules/webdatabase/DatabaseManager.cpp:
+            (WebCore::DatabaseManager::DatabaseManager):
+            (WebCore::DatabaseManager::existingDatabaseContextFor):
+            (WebCore::DatabaseManager::registerDatabaseContext):
+            (WebCore::DatabaseManager::unregisterDatabaseContext):
+            (WebCore::DatabaseManager::didConstructDatabaseContext):
+            (WebCore::DatabaseManager::didDestructDatabaseContext):
+            (WebCore::DatabaseManager::openDatabaseBackend):
+            (WebCore::DatabaseManager::addProposedDatabase):
+            (WebCore::DatabaseManager::removeProposedDatabase):
+            (WebCore::DatabaseManager::fullPathForDatabase):
+            (WebCore::DatabaseManager::detailsForNameAndOrigin):
+            * Modules/webdatabase/DatabaseManager.h:
</ins><span class="cx"> 
</span><del>-2014-05-16  Jer Noble  &lt;jer.noble@apple.com&gt;
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [MSE] Crash at  WebCore::SourceBuffer::~SourceBuffer + 110
-        https://bugs.webkit.org/show_bug.cgi?id=132973
</del><ins>+        Merge r162486
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+    2014-01-21  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Change SourceBuffer::m_private into a Ref&lt;&gt;, and add an assertion to
-        SourceBufferPrivateAVFObjC's destructor if its client has not been cleared.
</del><ins>+            REGRESSION (r161580): Some PDFs render outside their &lt;img&gt;
+            https://bugs.webkit.org/show_bug.cgi?id=127381
+            &lt;rdar://problem/15872168&gt;
</ins><span class="cx"> 
</span><del>-        Eliminate unnecessary churn in MediaSourcePrivateAVFObjC by having the predicate
-        functor take bare pointers, rather than a PassRefPtr.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        The underlying problem seems to be in WebAVStreamDataParserListener. RefPtrs were
-        being created off the main thread to a non-thread safe ref counted class. In some
-        situations, this would result in double decrementing the ref, which would cause an
-        early destruction of the underlying object. Instead replace these RefPtr strong
-        pointers with explicit weak ones. Ensure the parser and its delegate are not freed
-        before the append operation completes by passing strong pointers into the async
-        append operation lambda.
</del><ins>+            * platform/graphics/cg/PDFDocumentImage.cpp:
+            (WebCore::transformContextForPainting):
+            Only try to make the scale uniform if it isn't already, and use the minimum
+            of the two original scales when doing so, so that it is absolutely certain
+            to fit inside space allocated for the image during layout.
</ins><span class="cx"> 
</span><del>-        There were a few places where we weren't null checking m_mediaSource before using it,
-        and at least one place where we weren't clearing m_mediaSource.
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * Modules/mediasource/SourceBuffer.cpp:
-        (WebCore::SourceBuffer::SourceBuffer): Use Ref instead of RefPtr.
-        (WebCore::SourceBuffer::appendBufferTimerFired): Ditto.
-        * Modules/mediasource/SourceBuffer.h:
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        (WebCore::MediaSourcePrivateAVFObjCHasAudio): Take a bare pointer, instead of a PassRefPtr.
-        (WebCore::MediaSourcePrivateAVFObjCHasVideo): Ditto.
-        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
-        (WebCore::MediaSourcePrivateAVFObjC::removeSourceBuffer): Clear the back pointer when removing a buffer.
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
-        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
-        (-[WebAVStreamDataParserListener initWithParser:parent:WebCore::]): Use WeakPtr instead of RefPtr.
-        (-[WebAVStreamDataParserListener invalidate]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]): Ditto.
-        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]): Ditto.
-        (WebCore::SourceBufferPrivateAVFObjC::~SourceBufferPrivateAVFObjC):
-        (WebCore::SourceBufferPrivateAVFObjC::append): Ditto.
</del><ins>+        Merge r158870
</ins><span class="cx"> 
</span><del>-2014-05-16  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+    2013-11-07  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Subpixel rendering: Push named flows in region to device pixel when painting.
-        https://bugs.webkit.org/show_bug.cgi?id=132986
</del><ins>+            Crash in HTMLMediaElement::contextDestroyed
+            https://bugs.webkit.org/show_bug.cgi?id=123963
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Remove integral rounding when named flow sets the painting offset on the graphics context.
-        Use device pixel snapping instead to ensure that we can paint on odd device pixel positions on retina displays. 
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/177999cdb34b707465670f0feff723922939f278
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/hidpi-region-with-auto-margin-on-subpixel-position.html
</del><ins>+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::~HTMLMediaElement):
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::calculateClipRects):
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-16  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Merge r154036
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Add ASSERT to make sure using the flowThread cache does not return incorrect results
-        https://bugs.webkit.org/show_bug.cgi?id=132906
</del><ins>+    2013-08-12  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Fix orphan needsLayout state in RenderTextControlSingleLine
+            https://bugs.webkit.org/show_bug.cgi?id=119726
</ins><span class="cx"> 
</span><del>-        If flowThreadContainingBlock() is called on an object which is in a different
-        flow thread than the one currently being laid out, this method will return an incorrect
-        result. I added an assertion for that to make sure we catch and treat any such scenarios.
-        For the moment, this assertion is only validated for regions, as multicol still has some issues.
</del><ins>+            Reviewed by Kent Tamura.
</ins><span class="cx"> 
</span><del>-        No new tests required.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/c0aec52ef348b2be0c882f8646fe3cf537831f59
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::locateFlowThreadContainingBlockNoCache):
-        (WebCore::RenderObject::locateFlowThreadContainingBlock):
-        * rendering/RenderObject.h:
</del><ins>+            We should mark the renderer for containerElement, which wraps innerTextElement and innerBlockElement
+            in cases of input[type=search] and input[type=number], dirty.
</ins><span class="cx"> 
</span><del>-2014-05-16  Martin Hock  &lt;mhock@apple.com&gt;
</del><ins>+            * rendering/RenderTextControlSingleLine.cpp:
+            (WebCore::setNeedsLayoutOnAncestors):
+            (WebCore::RenderTextControlSingleLine::layout):
</ins><span class="cx"> 
</span><del>-        MemoryCache::addImageToCache should return the result of add().
-        https://bugs.webkit.org/show_bug.cgi?id=132928
-        &lt;rdar://problem/16651547&gt;
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+        Merge r156082
</ins><span class="cx"> 
</span><del>-        API test: WebKit1.MemoryCacheADdImageToCache (MemoryCacheAddImageToCacheIOS.mm)
</del><ins>+    2013-09-18  Mihnea Ovidenie  &lt;mihnea@adobe.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/cache/MemoryCache.cpp:
-        (WebCore::MemoryCache::addImageToCache):
</del><ins>+            [CSSRegions] Failed to retrieve named flow ranges for content with inline svg
+            https://bugs.webkit.org/show_bug.cgi?id=121489
</ins><span class="cx"> 
</span><del>-2014-05-16  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Reduce the RenderRegion invasiveness in rendering code
-        https://bugs.webkit.org/show_bug.cgi?id=132121
</del><ins>+            The inline SVG element behaves like a replaced element in HTML context. When computing the ranges
+            that are displayed inside a region for a named flow that contains an inline SVG element, we have
+            to treat the SVG as a replaced and run the checks only for the SVG root element, skipping the
+            other SVG elements inside.
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Test: fast/regions/get-region-flow-ranges-inline-svg.html
</ins><span class="cx"> 
</span><del>-        Remove the RenderRegion / RenderNamedFlowFragment parameters and fields from
-        the painting / hit testing data structures and use a stateful approach to
-        correctly handle regions.
</del><ins>+            * rendering/RenderNamedFlowThread.cpp:
+            (WebCore::nextNodeInsideContentNode): Add function to retrieve the next node in traversal
+            under the contentNode subtree that should be used for getRanges inspection.
+            (WebCore::RenderNamedFlowThread::getRanges): Replace NodeTravesal::next with nextNodeInsideContentNode.
</ins><span class="cx"> 
</span><del>-        When painting or hit testing, the current flow thread is saved along the current
-        region. They are accessed through the |currentRenderNamedFlowFragment| helper
-        method on RenderObject or RenderLayer.
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The patch also changes a bunch of 0s to nullptrs.
</del><ins>+        Merge r153507
</ins><span class="cx"> 
</span><del>-        Tests: No new tests, no functional change.
</del><ins>+    2013-07-30  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
-        * rendering/HitTestLocation.cpp:
-        (WebCore::HitTestLocation::HitTestLocation):
-        (WebCore::HitTestLocation::operator=):
-        * rendering/HitTestLocation.h:
-        (WebCore::HitTestLocation::region): Deleted.
-        * rendering/HitTestResult.h:
-        * rendering/PaintInfo.h:
-        (WebCore::PaintInfo::PaintInfo):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::paintObject):
-        (WebCore::RenderBlock::selectionGaps):
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::nodeAtPoint):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::pushContentsClip):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paint):
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::paintLayerContents):
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
-        (WebCore::RenderLayer::collectFragments):
-        (WebCore::RenderLayer::updatePaintingInfoForFragments):
-        (WebCore::RenderLayer::paintTransformedLayerIntoFragments):
-        (WebCore::RenderLayer::paintBackgroundForFragments):
-        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
-        (WebCore::RenderLayer::paintOutlineForFragments):
-        (WebCore::RenderLayer::paintMaskForFragments):
-        (WebCore::RenderLayer::hitTest):
-        (WebCore::RenderLayer::hitTestFixedLayersInNamedFlows):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::hitTestTransformedLayerInFragments):
-        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::addToOverlapMap):
-        (WebCore::RenderLayerCompositor::clippedByAncestor):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::currentRenderNamedFlowFragment):
-        * rendering/RenderObject.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::nodeAtPoint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::nodeAtPoint):
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::writeLayers):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::paint):
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::paintReplaced):
</del><ins>+            Don't post accessibility notification on object in detached document.
+            https://bugs.webkit.org/show_bug.cgi?id=119286
</ins><span class="cx"> 
</span><del>-2014-05-16  Kiran  &lt;kiran.guduru@samsung.com&gt;
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        RTCDtmfSender default values need to be updated.
-        https://bugs.webkit.org/show_bug.cgi?id=132952
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/ef9fc9e70202dcf33e5cf2f0f0a2135945ffe17e%5E%21/#F0
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            Don't post accessibility notification on object in detached document.
</ins><span class="cx"> 
</span><del>-        The default ToneDuration and ToneGap values are modified in the updated spec.
-        So these values need to be updated.
</del><ins>+            This can happen if an accessibility notification is queued on a node,
+            then that node is reparented to a different document that's not attached
+            anywhere before the accessibility notification is fired.
</ins><span class="cx"> 
</span><del>-        Test: fast/mediastream/RTCPeerConnection-dtmf.html.
</del><ins>+            * accessibility/AXObjectCache.cpp:
+            (WebCore::AXObjectCache::notificationPostTimerFired):
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/RTCDTMFSender.cpp:
</del><ins>+2014-02-10  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+        Merge r158676
</ins><span class="cx"> 
</span><del>-        Attempt to fix the Apple Mavericks Release, Apple MountainLion Release,
-        Apple MountainLion Release (32-bit Build), EFL, and GTK builds following
-        &lt;http://trac.webkit.org/changeset/168921&gt; (https://bugs.webkit.org/show_bug.cgi?id=132669)
</del><ins>+    2013-11-05  Daniel Bates  &lt;dabates@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp: Include SVGElement.h for the definition of Node::hasTagName(const SVGQualifiedName&amp;).
</del><ins>+            XSSAuditor should catch reflected srcdoc properties even without a &lt;frame&gt; tag injection
</ins><span class="cx"> 
</span><del>-2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+            From Blink r160615 by &lt;tsepez@chromium.org&gt;
+            https://src.chromium.org/viewvc/blink?view=rev&amp;revision=160615
</ins><span class="cx"> 
</span><del>-        ASSERT_NOT_REACHED() in DocumentOrderedMap::get() when removing SVG subtree
-        https://bugs.webkit.org/show_bug.cgi?id=132669
-        &lt;rdar://problem/14931432&gt;
</del><ins>+            Test: http/tests/security/xssAuditor/iframe-srcdoc-property-blocked.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Brent Fulgham and Ryosuke Niwa.
</del><ins>+            * html/parser/XSSAuditor.cpp:
+            (WebCore::XSSAuditor::filterIframeToken):
</ins><span class="cx"> 
</span><del>-        Fixes an assertion failure when removing an SVG element with a duplicate id.
</del><ins>+2014-02-05  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        When removing an SVG element with id A we synchronously instruct each element that references A
-        to find the first element with id A, call this N, from the document root and register itself to
-        either receive subsequent notifications from N (say, there is another element with id A) or as
-        waiting for an element with id A (say, N = nullptr; =&gt; we removed the last element with id A from
-        the document). Because the elements that reference A perform this operation synchronously when
-        removing an element they consult an transient state of the DocumentOrderedMap when querying for the
-        element with id A.
-    
-        Without loss of generality, let E, E_1, E_2, and E_3 be elements, where E_1, E_2, E_3 are children
-        of E in that order and E_1.id = E_2.id = A and E_3.href = #A (that is, it references an element
-        with id A). Suppose we remove E then we remove E_1, update DocumentOrderedMap to decrement its count
-        for id A, and notify E_3 to look for an element with id A. This leads to an assertion failure since
-        DocumentOrderedMap expects to find an element with id A, E_2, but cannot find such an element when
-        traversing from the document root because E was unlinked from the document root (i.e. E_2 is in a
-        disjoint subtree).
</del><ins>+        Merge r154146, r155828, r156145
</ins><span class="cx"> 
</span><del>-        Tests: svg/custom/change-id-of-use-during-removal.html
-               svg/custom/remove-subtree-including-path-with-duplicate-id-referenced-by-later-textpath.html
-               svg/custom/remove-subtree-including-text-with-duplicate-id-referenced-by-later-tref.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-earlier-use.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-animate.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-feimage.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-mpath.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-use.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-later-use2.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-use-in-different-subtree.html
-               svg/custom/remove-subtree-including-use-with-duplicate-id-referenced-by-use-with-duplicate-id-in-different-subtree.html
-               svg/custom/remove-use-with-duplicate-id-referenced-by-later-use.html
</del><ins>+    2013-08-15  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::removeChild): Call SVGDocumentExtensions::rebuildElements() after we remove
-        a DOM subtree so that applicable SVG elements can update their referenced element when the DocumentOrderedMap
-        is in a stable-state.
-        (WebCore::ContainerNode::removeChildren): Ditto.
-        * svg/SVGDocumentExtensions.cpp:
-        (WebCore::SVGDocumentExtensions::rebuildElements): Added; notifies SVG elements that their href attribute
-        changed so that they query the DocumentOrderedMap for the element they reference by id in their href attribute.
-        (WebCore::SVGDocumentExtensions::clearTargetDependencies): Added; Called from removing
-        an SVG element S from the DOM. Appends all elements that reference the id of S to the end of a Vector of
-        elements to be rebuilt (when SVGDocumentExtensions::rebuildElements() is called) and notifies these elements
-        that have been marked to be rebuilt so that they can invalidate their state (e.g. stop animating).
-        (WebCore::SVGDocumentExtensions::rebuildAllElementReferencesForTarget): Changed to take its argument by reference
-        (since it's always non-null) and simplified logic to synchronously notify SVG updates that their referenced element
-        may have changed. Calling SVGElement::svgAttributeChanged() on an element E should at most remove the dependencies
-        of E.
-        * svg/SVGDocumentExtensions.h:
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::~SVGElement): Substitute &quot;*this&quot; for &quot;this&quot; as SVGDocumentExtensions::rebuildAllElementReferencesForTarget()
-        now takes a reference instead of a pointer.
-        (WebCore::SVGElement::removedFrom): Modified to call SVGDocumentExtensions::clearTargetDependencies().
-        (WebCore::SVGElement::attributeChanged): Substitute &quot;*this&quot; for &quot;this&quot; as SVGDocumentExtensions::rebuildAllElementReferencesForTarget()
-        now takes a reference instead of a pointer.
-        * svg/SVGElement.h:
-        (WebCore::SVGElement::callClearTarget): Added; calls through to private virtual SVGElement::clearTarget().
-        (WebCore::SVGElement::clearTarget): Added.
-        * svg/SVGTRefElement.cpp:
-        (WebCore::SVGTRefElement::clearTarget): Added.
-        * svg/SVGTRefElement.h:
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::SVGSMILElement::clearTarget): Added.
-        * svg/animation/SVGSMILElement.h:
</del><ins>+            [Windows] Consolidate WebKit Bundle Handling 
+            https://bugs.webkit.org/show_bug.cgi?id=119869 
</ins><span class="cx"> 
</span><del>-2014-05-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Reviewed by Tim Horton. 
</ins><span class="cx"> 
</span><del>-        [iOS WK2] When zoomed, fixed elements jump at the start of a scroll, and jump back at the end.
-        https://bugs.webkit.org/show_bug.cgi?id=132978
-        &lt;rdar://problem/16894428&gt;
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add new WebCoreBundleWin files. 
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto. 
+            * platform/network/curl/ResourceHandleManager.cpp: 
+            (WebCore::certificatePath): Use correct bundle handling logic. 
+            * platform/win/LocalizedStringsWin.cpp: Move bundle implementation to 
+            new WebCoreBundleWin.cpp file. 
+            * platform/win/WebCoreBundleWin.cpp: Added. 
+            (WebCore::createWebKitBundle): 
+            (WebCore::webKitBundle): 
+            * platform/win/WebCoreBundleWin.h: Added. 
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+2014-02-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This was the actual cause of the bug; r168560 changed the rect passed in here
-        to be the customFixedPositionRect rather than the unobscured rect, but we
-        used it to call FrameView::rectForViewportConstrainedObjects() which gave back
-        another bogus rect. So just use the rect passed in.
</del><ins>+        Build fix after last branch merge.
</ins><span class="cx"> 
</span><del>-        * page/scrolling/ios/ScrollingTreeScrollingNodeIOS.mm:
-        (WebCore::ScrollingTreeScrollingNodeIOS::updateLayersAfterViewportChange):
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Correct bad merge of media build steps.
</ins><span class="cx"> 
</span><del>-2014-05-15  Daniel Bates  &lt;dabates@apple.com&gt;
</del><ins>+2014-02-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        SVG element may reference arbitrary DOM element before running its insertion logic
-        https://bugs.webkit.org/show_bug.cgi?id=132757
-        &lt;rdar://problem/15703817&gt;
</del><ins>+        Unreviewed build fix after r162860.
</ins><span class="cx"> 
</span><del>-        Reviewed by Ryosuke Niwa.
</del><ins>+        * platform/graphics/MediaPlayer.cpp: Prevent 64-bit build from using QuickTime SDK.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp: Ditto.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h: Ditto.
</ins><span class="cx"> 
</span><del>-        Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
-        inserted in the tree.
</del><ins>+2014-01-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
-        element B it references (if any). If A is inserted before B and B has the same id as a later element in
-        the document then A can find B before B is notified that its been inserted into the document (i.e. before
-        Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
-        cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
-        processed their insertion-specific logic.
</del><ins>+        Merge r162723.
</ins><span class="cx"> 
</span><del>-        Tests: svg/custom/reparent-animate-element.html
-               svg/custom/reparent-feimage-element.html
-               svg/custom/reparent-mpath-element.html
-               svg/custom/reparent-textpath-element.html
-               svg/custom/reparent-tref-element.html
-               svg/custom/reparent-use-element.html
</del><ins>+    2014-01-24  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
-        * svg/SVGFEImageElement.h:
-        * svg/SVGMPathElement.cpp:
-        (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
-        * svg/SVGMPathElement.h:
-        * svg/SVGTRefElement.cpp:
-        (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
-        * svg/SVGTRefElement.h:
-        * svg/SVGTextPathElement.cpp:
-        (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
-        * svg/SVGTextPathElement.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
-        inserted.
-        (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
-        * svg/SVGUseElement.h:
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
-        we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
-        after the subtree we're in is inserted.
-        (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
-        * svg/animation/SVGSMILElement.h:
</del><ins>+            [Win] Convert some NMake files to MSBuild project files 
+            https://bugs.webkit.org/show_bug.cgi?id=127579 
</ins><span class="cx"> 
</span><del>-2014-05-15  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+            Reviewed by Tim Horton.
</ins><span class="cx"> 
</span><del>-        JSDOMWindow should not claim HasImpureGetOwnPropertySlot
-        https://bugs.webkit.org/show_bug.cgi?id=132918
</del><ins>+            * WebCore.vcxproj/WebCore.make: Removed.
+            * WebCore.vcxproj/WebCore.proj: Added.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+2014-01-27  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: js/cached-window-properties.html
-               js/cached-window-prototype-properties.html
</del><ins>+        Unreviewed build fix after r162631.
</ins><span class="cx"> 
</span><del>-        We now correctly handle the impurity of JSDOMWindow's custom getOwnPropertySlot without needing the 
-        blanket HasImpureGetOwnPropertySlot. We do this through the use of watchpoints and by explicitly forbidding
-        any caching beyond a certain point using PropertySlot::disableCaching. Getting rid of this flag will allow 
-        us to cache many properties/methods on both the JSDOMWindow and its prototype, which are very commonly used 
-        across the web.
</del><ins>+        * WebCore.vcxproj/WebCore.submit.sln: Do not build QTMovieWin for 64-bit architecture.
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertySlot):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (HasComplexGetOwnProperty):
-        (InterfaceRequiresAttributesOnInstance):
-        (InstanceOverridesGetOwnPropertySlot):
-        (GenerateHeader):
</del><ins>+2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-15  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</del><ins>+        Merge r154470.
</ins><span class="cx"> 
</span><del>-        NetworkProcess crashes at ResourceHandle::continueDidReceiveResponse
-        https://bugs.webkit.org/show_bug.cgi?id=132966
-        &lt;rdar://problem/16373694&gt;
</del><ins>+    2013-08-22  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+            compositing/geometry/bounds-ignores-hidden-dynamic.html has incorrect initial rendering
+            https://bugs.webkit.org/show_bug.cgi?id=119825
</ins><span class="cx"> 
</span><del>-        Covered by many fast/files tests.
</del><ins>+            Reviewed by Tim Horton.
+            
+            r137526 and some earlier commits attempted to avoid unconditionally
+            repainting layers when their size changes, because this was causing
+            TiledBacking layers to repaint when the document size changed.
+            
+            However, the approach required that we have good information about
+            whether size changes require a repaint, which in some cases is hard
+            to determine, especially when RenderLayer changes affect our
+            decisions about which layers are composited.
+            
+            Fix by pushing the decision about whether to repaint on size change
+            into GraphicsLayer. The default is to repaint on size change,
+            but GraphicsLayer provides a function that can be overridden to
+            modify this behavior; GraphicsLayerCA does so to avoid repaints
+            when layers with TiledBackings get resized.
</ins><span class="cx"> 
</span><del>-        * platform/network/BlobResourceHandle.cpp: (WebCore::BlobResourceHandle::continueDidReceiveResponse):
-        * platform/network/BlobResourceHandle.h:
-        * platform/network/ResourceHandle.h:
-        Don't call delegate's continueDidReceiveResponse when loading a blob:// URL,
-        the delegate is null. On the Mac, we used to lazily create it, which was also wrong,
-        but at least not observable.
</del><ins>+            Test: compositing/repaint/repaint-on-layer-grouping-change.html
</ins><span class="cx"> 
</span><del>-2014-05-15  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+            * WebCore.exp.in: WebKit2 needs GraphicsLayer::setSize, which is no longer inline.
+            * platform/graphics/GraphicsLayer.cpp:
+            (WebCore::GraphicsLayer::setOffsetFromRenderer):
+            (WebCore::GraphicsLayer::setSize):
+            * platform/graphics/GraphicsLayer.h:
+            (WebCore::GraphicsLayer::shouldRepaintOnSizeChange):
+            * platform/graphics/ca/GraphicsLayerCA.cpp:
+            (WebCore::GraphicsLayerCA::shouldRepaintOnSizeChange):
+            * platform/graphics/ca/GraphicsLayerCA.h:
+            * rendering/RenderLayerBacking.h: No longer need m_boundsConstrainedByClipping
+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::RenderLayerBacking):
+            (WebCore::RenderLayerBacking::updateCompositedBounds):
+            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): setSize takes
+            care of repainting for us now, so we can remove all the conditional code.
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168899.
-        https://bugs.webkit.org/show_bug.cgi?id=132965
</del><ins>+2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Broke some compositing regions tests on Mavericks (Requested
-        by mihnea___ on #webkit).
</del><ins>+        Unreviewed build fix after last commit. We haven't completely removed
+        QTMovieWin uses.
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Build for 32-bit.
+        * WebCore.vcxproj/WebCore.submit.sln: Build QTMovieWin for 32-bit.
</ins><span class="cx"> 
</span><del>-        &quot;[CSS Regions] Reduce the RenderRegion invasiveness in
-        rendering code&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132121
-        http://trac.webkit.org/changeset/168899
</del><ins>+2014-01-23  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-15  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Merge r162621
</ins><span class="cx"> 
</span><del>-        Add pointer lock to features without enabling it.
-        https://bugs.webkit.org/show_bug.cgi?id=132961
</del><ins>+    2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Sam Weinig.
</del><ins>+            [Win] Update project and solution files for 64-bit builds
+            https://bugs.webkit.org/show_bug.cgi?id=127457
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        Added ENABLE_POINTER_LOCK to list of features.
-        * WebCore.exp.in:
-        Added linker symbols which differ with pointer lock enabled.
-        * WebCore.xcodeproj/project.pbxproj:
-        Added PointerLockController.cpp to build.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-15  Mark Hahnenberg  &lt;mhahnenberg@apple.com&gt;
</del><ins>+            * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Specify v100 target
+            * WebCore.vcxproj/WebCore.submit.sln: Add x64 targets
+            * WebCore.vcxproj/WebCore.vcxproj: Specify v100 target for all builds
+            on this branch. Also exclude 32-bit specific assembly when building
+            64-bit target, and correct bad merge from branch.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Correct branch merge
+            * config.h: Handle 64-bit type definitions.
+            * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+            (PlatformCAAnimation::setFromValue): Use CGFloat to support 64-bit builds
+            (PlatformCAAnimation::setToValue): Ditto
+            (PlatformCAAnimation::setValues): Ditto
+            * platform/graphics/win/FontCustomPlatformData.cpp:
+            (WebCore::FontCustomPlatformData::fontPlatformData): Add cast to
+            support 32- and 64-bit targets.
+            * platform/graphics/win/GraphicsContextCGWin.cpp:
+            (WebCore::GraphicsContext::drawLineForDocumentMarker): Use CGFloat to
+            support 64-bit builds.
+            * platform/win/PasteboardWin.cpp:
+            (WebCore::Pasteboard::writeURLToDataObject): Specialize std::min to
+            work on 32- and 64-bit code.
+            (WebCore::createGlobalImageFileDescriptor): Ditto
+            * platform/win/StructuredExceptionHandlerSuppressor.cpp:
+            (WebCore::StructuredExceptionHandlerSuppressor::StructuredExceptionHandlerSuppressor):
+            Comment out 32-bit inline assembly.
+            (WebCore::StructuredExceptionHandlerSuppressor::~StructuredExceptionHandlerSuppressor):
+            Ditto
</ins><span class="cx"> 
</span><del>-        Move subframe name getter lookup later in JSDOMWindow::getOwnPropertySlot
-        https://bugs.webkit.org/show_bug.cgi?id=132922
</del><ins>+2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+        Unreviewed build fix for branch.
</ins><span class="cx"> 
</span><del>-        No new tests.
</del><ins>+        * WebCore.vcxproj/WebCore.vcxproj: Correct merged files.
+        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
+        * platform/graphics/cg/GraphicsContextCG.cpp: Remove work-around implementation (from branch)
+        now that WKSI provides the method.
</ins><span class="cx"> 
</span><del>-        In JSDOMWindow::getOwnPropertySlot, we currently look for the property on the JSDOMWindow, 
-        then we search the window's subframes for name getters, then we look in the window's prototype 
-        chain. Apparently we were doing the lookup in this order to be compatible with Mozilla, but 
-        Mozilla no longer implements this behavior. Instead, they do the lookup on the prototype before 
-        looking for subframe name getters. We should change this to match Mozilla. This has the convenient 
-        side effect of allowing us to cache lookups in the window's prototype chain.
</del><ins>+2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getOwnPropertySlot):
</del><ins>+        Merge r154526
</ins><span class="cx"> 
</span><del>-2014-05-15  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+    2014-01-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [UI-side compositing] Fix copying animations between layers, and pausing them
-        https://bugs.webkit.org/show_bug.cgi?id=132943
-        &lt;rdar://problem/16906369&amp;16906541&gt;
</del><ins>+            [Windows] Unreviewed build correction. Need to force environment variable
+            to be escaped when running nmake command.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            * WebCore.vcxproj/WebCoreGenerated.make:
</ins><span class="cx"> 
</span><del>-        Pass the animation key back to animationStarted(), though this isn't used
-        when animations are running in-process.
</del><ins>+2014-01-09  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/PlatformCALayer.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.h:
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (-[WebAnimationDelegate animationDidStart:]):
-        (PlatformCALayerMac::animationStarted):
-        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
-        (PlatformCALayerWin::animationStarted):
-        * platform/graphics/ca/win/PlatformCALayerWin.h:
</del><ins>+        Merge r161568: &lt;rdar://problem/15784802&gt;
</ins><span class="cx"> 
</span><del>-2014-05-15  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+    2014-01-09  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Reduce the RenderRegion invasiveness in rendering code
-        https://bugs.webkit.org/show_bug.cgi?id=132121
</del><ins>+            PDFDocumentImage can be very slow to do the initial paint
+            https://bugs.webkit.org/show_bug.cgi?id=126633
+            &lt;rdar://problem/15770980&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        Remove the RenderRegion / RenderNamedFlowFragment parameters and fields from
-        the painting / hit testing data structures and use a stateful approach to
-        correctly handle regions.
</del><ins>+            * platform/graphics/cg/PDFDocumentImage.cpp:
+            (WebCore::PDFDocumentImage::PDFDocumentImage):
+            (WebCore::PDFDocumentImage::size):
+            (WebCore::transformContextForPainting):
+            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
+            (WebCore::applyRotationForPainting):
+            (WebCore::PDFDocumentImage::drawPDFPage):
+            * platform/graphics/cg/PDFDocumentImage.h:
+            * platform/graphics/mac/PDFDocumentImageMac.mm:
+            (WebCore::PDFDocumentImage::computeBoundsForCurrentPage):
+            Store rotation from the PDF in degrees, since it can
+            only be 0, 90, 180, or 270, and don't do any trig to
+            perform the rotation, to avoid introducing minor rounding
+            issues in the size.
</ins><span class="cx"> 
</span><del>-        When painting or hit testing, the current flow thread is saved along the current
-        region. They are accessed through the |currentRenderNamedFlowFragment| helper
-        method on RenderObject or RenderLayer.
</del><ins>+            Once we're going to paint, if the difference between the
+            computed scale for each axis is due only to integer rounding
+            of the image size, use the same scale for both axes, to avoid
+            a CG slow-path which occurs whenever the scale is nonuniform.
</ins><span class="cx"> 
</span><del>-        The patch also changes a bunch of 0s to nullptrs.
</del><ins>+2014-01-07  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tests: No new tests, no functional change.
</del><ins>+        Merge r160479
</ins><span class="cx"> 
</span><del>-        * html/shadow/MediaControlElements.cpp:
-        (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
-        * rendering/HitTestLocation.cpp:
-        (WebCore::HitTestLocation::HitTestLocation):
-        (WebCore::HitTestLocation::operator=):
-        * rendering/HitTestLocation.h:
-        (WebCore::HitTestLocation::region): Deleted.
-        * rendering/HitTestResult.h:
-        * rendering/PaintInfo.h:
-        (WebCore::PaintInfo::PaintInfo):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paint):
-        (WebCore::RenderBlock::paintObject):
-        (WebCore::RenderBlock::selectionGaps):
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::nodeAtPoint):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::pushContentsClip):
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
-        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paint):
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::paintLayerContents):
-        (WebCore::RenderLayer::paintLayerByApplyingTransform):
-        (WebCore::RenderLayer::collectFragments):
-        (WebCore::RenderLayer::updatePaintingInfoForFragments):
-        (WebCore::RenderLayer::paintTransformedLayerIntoFragments):
-        (WebCore::RenderLayer::paintBackgroundForFragments):
-        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
-        (WebCore::RenderLayer::paintOutlineForFragments):
-        (WebCore::RenderLayer::paintMaskForFragments):
-        (WebCore::RenderLayer::hitTest):
-        (WebCore::RenderLayer::hitTestFixedLayersInNamedFlows):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::hitTestTransformedLayerInFragments):
-        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
-        (WebCore::RenderLayer::calculateClipRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::addToOverlapMap):
-        (WebCore::RenderLayerCompositor::clippedByAncestor):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::currentRenderNamedFlowFragment):
-        * rendering/RenderObject.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::shouldPaint):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::nodeAtPoint):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::nodeAtPoint):
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::writeLayers):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::paint):
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::paintReplaced):
</del><ins>+    2013-12-11  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            StylePendingImage needs to correctly manage the CSSValue pointer lifetime
+            https://bugs.webkit.org/show_bug.cgi?id=125468
</ins><span class="cx"> 
</span><del>-        Clean up &quot;has non-zero begin time&quot; terminology in animations
-        https://bugs.webkit.org/show_bug.cgi?id=132942
</del><ins>+            Reviewed by Andreas Kling.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Test: fast/css/pending-image-crash.xhtml
</ins><span class="cx"> 
</span><del>-        Change the &quot;non-zero beginTime&quot; terminology in the platform CA animations
-        code to &quot;explicit beginTime&quot;: this flag really means that we explicitly set
-        the beginTime of the animation, rather than let CA set the beginTime when
-        committing the animation. This flag is used for animations with negative
-        delay, and when pausing.
-        
-        The WKNonZeroBeginTimeFlag key was spread across PlatformCALayerMac and PlatformCAAnimationMac,
-        so hide it behind getter/setter functions.
-        
-        Remove lots of m_layer.get() in PlatformCAAnimationMac.
</del><ins>+            Disconnect the reference counted StylePendingImage from the CSSValue that owns
+            it when it's not needed any more, otherwise we could end up using a pointer
+            that might no longer be valid.
</ins><span class="cx"> 
</span><del>-        * platform/graphics/ca/mac/PlatformCAAnimationMac.h:
-        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
-        (WebCore::hasExplicitBeginTime):
-        (WebCore::setHasExplicitBeginTime):
-        (PlatformCAAnimationMac::copy):
-        (PlatformCAAnimationMac::keyPath):
-        (PlatformCAAnimationMac::beginTime):
-        (PlatformCAAnimationMac::setBeginTime):
-        (PlatformCAAnimationMac::duration):
-        (PlatformCAAnimationMac::setDuration):
-        (PlatformCAAnimationMac::speed):
-        (PlatformCAAnimationMac::setSpeed):
-        (PlatformCAAnimationMac::timeOffset):
-        (PlatformCAAnimationMac::setTimeOffset):
-        (PlatformCAAnimationMac::repeatCount):
-        (PlatformCAAnimationMac::setRepeatCount):
-        (PlatformCAAnimationMac::autoreverses):
-        (PlatformCAAnimationMac::setAutoreverses):
-        (PlatformCAAnimationMac::fillMode):
-        (PlatformCAAnimationMac::setFillMode):
-        (PlatformCAAnimationMac::setTimingFunction):
-        (PlatformCAAnimationMac::copyTimingFunctionFrom):
-        (PlatformCAAnimationMac::isRemovedOnCompletion):
-        (PlatformCAAnimationMac::setRemovedOnCompletion):
-        (PlatformCAAnimationMac::isAdditive):
-        (PlatformCAAnimationMac::setAdditive):
-        (PlatformCAAnimationMac::valueFunction):
-        (PlatformCAAnimationMac::setValueFunction):
-        (hasNonZeroBeginTimeFlag): Deleted.
-        (setNonZeroBeginTimeFlag): Deleted.
-        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
-        (-[WebAnimationDelegate animationDidStart:]):
</del><ins>+            * css/CSSCursorImageValue.cpp:
+            (WebCore::CSSCursorImageValue::detachPendingImage): Added. Calls detachFromCSSValue
+            on the current image if it is a StylePendingImage.
+            (WebCore::CSSCursorImageValue::~CSSCursorImageValue): Call detachPendingImage.
+            (WebCore::CSSCursorImageValue::cachedImage): Call detachPendingImage before changing
+            m_image to a new value.
+            (WebCore::CSSCursorImageValue::clearCachedImage): Ditto.
+            * css/CSSCursorImageValue.h: Added detachPendingImage.
</ins><span class="cx"> 
</span><del>-2014-05-15  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+            * css/CSSImageSetValue.cpp:
+            (WebCore::CSSImageSetValue::detachPendingImage): Added. Calls detachFromCSSValue
+            on the current image set if it is a StylePendingImage.
+            (WebCore::CSSImageSetValue::~CSSImageSetValue): Call detachPendingImage.
+            (WebCore::CSSImageSetValue::cachedImageSet): Call detachPendingImage before changing
+            m_imageSet to a new value.
+            * css/CSSImageSetValue.h: Added detachPendingImage.
</ins><span class="cx"> 
</span><del>-        [GTK] Compile all installed resources as GResources
-        https://bugs.webkit.org/show_bug.cgi?id=131099
</del><ins>+            * css/CSSImageValue.cpp:
+            (WebCore::CSSImageValue::detachPendingImage): Added. Calls detachFromCSSValue on the
+            current image if it is a StylePendingImage.
+            (WebCore::CSSImageValue::~CSSImageValue): Call detachPendingImage.
+            (WebCore::CSSImageValue::cachedImage): Call detachPendingImage before changing m_image
+            to a new value.
+            * css/CSSImageValue.h: Added detachPendingImage.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+            * rendering/style/StylePendingImage.h:
+            (WebCore::StylePendingImage::cssImageValue): Added a null check.
+            (WebCore::StylePendingImage::cssImageGeneratorValue): Added a null check.
+            (WebCore::StylePendingImage::cssCursorImageValue): Added a null check.
+            (WebCore::StylePendingImage::cssImageSetValue): Added a null check.
+            (WebCore::StylePendingImage::detachFromCSSValue): Added. Sets m_value to null since
+            the style is no longer using this StylePendingImage.
+            (WebCore::StylePendingImage::data): Changed to use the &quot;this&quot; pointer since all we
+            need is some arbitrary pointer uniquely identifying the image. Before loading the image,
+            we have no suitable weak identifier, so it suffices to use the unique pointer to each
+            StylePendingImage object. This function is used only in a limited way; it would be nice
+            to find a way to make the code less strange long term.
</ins><span class="cx"> 
</span><del>-        * PlatformGTK.cmake: Do not install the resources.
-        * platform/audio/gtk/AudioBusGtk.cpp:
-        (WebCore::AudioBus::loadPlatformResource): Load the audio resource
-        from GResources and use createBusFromInMemoryAudioFile().
-        * platform/graphics/Image.h: Remove unsued function loadPlatformThemeIcon.
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::loadImageFromGResource): Load the given icon name from GResources.
-        (WebCore::loadResourceSharedBuffer): Use char* instead of CString.
-        (WebCore::loadMissingImageIconFromTheme): Try to load the missing
-        icon from the current GTK icon theme.
-        (WebCore::Image::loadPlatformResource): Call
-        loadMissingImageIconFromTheme for missing icon or
-        loadImageFromGResource for any other icon name.
-        (WebCore::getPathToImageResource): Deleted.
-        (WebCore::getThemeIconFileName): Deleted.
-        (WebCore::loadImageFromFile): Deleted.
-        (WebCore::Image::loadPlatformThemeIcon): Deleted.
</del><ins>+2013-12-23  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Merge 161050: &lt;rdar://problem/15754482&gt;
</ins><span class="cx"> 
</span><del>-        Tiled scrolling indicator needs to take topContentInset into account
-        https://bugs.webkit.org/show_bug.cgi?id=132940
</del><ins>+    2013-12-23  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            Crash in ReplaceSelectionCommand
+            https://bugs.webkit.org/show_bug.cgi?id=126107
</ins><span class="cx"> 
</span><del>-        The tiled scrolling indicator needs to move down by the value of the 
-        topContentInset. This patch makes that happen by caching the topContentInset in 
-        the TileController. This does feel a little silly since there is already a 
-        function called setTiledScrollingIndicatorPosition() on TiledBacking. However, it 
-        was often the case that calling that function had no effect because m_coverageMap 
-        had not yet been created, and then the information was lost. So instead, we cache 
-        the value.
</del><ins>+            Reviewed by Benjamin Poulain.
</ins><span class="cx"> 
</span><del>-        Set TiledBacking’s copy of topContentInset whenever it changes for the FrameView.
-        * page/FrameView.cpp:
-        (WebCore::FrameView::topContentInsetDidChange):
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/c1ebe5c1e808daf9db5e348a8d0ab32570b9f7a5
+            except the test since it doesn't reproduce the crash in WebKit.
</ins><span class="cx"> 
</span><del>-        New function to set the inset. Use the inset to position the coverage map.
-        * platform/graphics/TiledBacking.h:
-        * platform/graphics/ca/mac/TileController.h:
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::TileController):
-        (WebCore::TileController::setTopContentInset):
</del><ins>+            * editing/ReplaceSelectionCommand.cpp:
+            (WebCore::ReplaceSelectionCommand::doApply):
</ins><span class="cx"> 
</span><del>-        When the coverage map is created, consult the value of the inset.
-        * platform/graphics/ca/mac/TileCoverageMap.mm:
-        (WebCore::TileCoverageMap::TileCoverageMap):
</del><ins>+2013-12-23  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Once the backing has been ensured, set the inset.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::updateBacking):
</del><ins>+        Merge 161003: &lt;rdar://problem/15719584&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</del><ins>+    2013-12-23  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r1267628 from branch.
-        &lt;rdar://problem/15751219&gt;
</del><ins>+            &lt;rdar://problem/15682948&gt; Update copyright strings
</ins><span class="cx"> 
</span><del>-            Pratik Solanki  &lt;psolanki@apple.com&gt;
</del><ins>+            Reviewed by Dan Bernstein
</ins><span class="cx"> 
</span><del>-            Reviewed by Simon Fraser.&quot;,
</del><ins>+            * Info.plist:
</ins><span class="cx"> 
</span><del>-            TileController relied on the tiling mode in TileCache to determine if it should use low-res
-            tiles when zooming. Unfortunately, sometimes the tiling mode gets set to Zooming even though
-            it's actually a pan. Thus we can end up with blurry tiles. Fix this by adding a new flag on
-            TileCache that controls this behavior and have UIKit set it only when we have an actual zoom
-            operation.

-        * platform/ios/LegacyTileCache.h:
-        (WebCore::LegacyTileCache::tileControllerShouldUseLowScaleTiles):
-        (WebCore::LegacyTileCache::setTileControllerShouldUseLowScaleTiles):
-        * platform/ios/LegacyTileCache.mm:
-        (WebCore::LegacyTileCache::LegacyTileCache):
-        * platform/ios/wak/WAKWindow.h:
-        * platform/ios/wak/WAKWindow.mm:
-        (-[WAKWindow setTileControllerShouldUseLowScaleTiles:]):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::contentsScaleMultiplierForNewTiles):
</del><ins>+2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Merge r160898: &lt;rdar://problems/15709940&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168750.
-        https://bugs.webkit.org/show_bug.cgi?id=132935
</del><ins>+    2013-12-19  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Caused repaint bugs (Requested by weinig on #webkit).
</del><ins>+            REGRESSION: cnn.com will continue to reveal 1 px of overhang after rubber-banding 
+            at the top
+            https://bugs.webkit.org/show_bug.cgi?id=126054
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        &quot;Text decorations do not contribute to visual overflow&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132773
-        http://trac.webkit.org/changeset/168750
</del><ins>+            This regression was caused by http://trac.webkit.org/changeset/160791 It turns out 
+            that the line of code I removed was not always a no-op. In some instances, like on 
+            cnn.com, it would ensure that our final scroll position after a rubber-band was 
+            not something within the overhang area. It was still wrong in its assumption that 
+            rubber-band is always bouncing back the spot it originated from. So this patch 
+            continues to ignore the rubber-bands origin, and instead finds the nearest point 
+            that is not in the overhang area, and scrolls to that point instead of the origin.
</ins><span class="cx"> 
</span><del>-2014-05-14  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.h:
+            * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+            (WebCore::ScrollingTreeScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary):
+            * platform/mac/ScrollAnimatorMac.h:
+            * platform/mac/ScrollAnimatorMac.mm:
+            (WebCore::ScrollAnimatorMac::adjustScrollPositionToBoundsIfNecessary):
+            * platform/mac/ScrollElasticityController.h:
+            * platform/mac/ScrollElasticityController.mm:
+            (WebCore::ScrollElasticityController::snapRubberBandTimerFired):
</ins><span class="cx"> 
</span><del>-        [New multicolumn] Spin in RenderMultiColumnSet::repaintFlowThreadContent()
-        https://bugs.webkit.org/show_bug.cgi?id=132884
</del><ins>+2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+        Merge r159463: &lt;rdar://problems/15701094&gt;
</ins><span class="cx"> 
</span><del>-        On iOS, wikipedia pages can hang under RenderMultiColumnSet::repaintFlowThreadContent().
-        It appears that computedColumnHeight is set to 0 in prepareForLayout, but layout never happens
-        on the RenderMultiColumnSet in some cases, leaving the column height set to zero.
-        This caused columnIndexAtOffset() to return bad values, which resulted in very long loops
-        in repaintFlowThreadContent().
-        
-        This fix is a stop-gap.
</del><ins>+    2013-11-18  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/RenderMultiColumnSet.cpp:
-        (WebCore::RenderMultiColumnSet::columnIndexAtOffset):
</del><ins>+            At some scales, opaque compositing layers have garbage pixels around the edges
+            ​https://bugs.webkit.org/show_bug.cgi?id=124541
</ins><span class="cx"> 
</span><del>-2014-05-14  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Remove FrameView::viewportConstrainedExtentRect, it is unused
-        https://bugs.webkit.org/show_bug.cgi?id=132927
</del><ins>+            Layers get marked as having opaque contents when their background is
+            known to paint the entire layer. However, this failed to take into
+            account two reasons why every pixel may not get painted.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            First, subpixel layout can result in non-integral RenderLayer
+            bounds, which will get rounded up to an integral GraphicsLayer
+            size. When this happens we may not paint edge pixels.
</ins><span class="cx"> 
</span><del>-        * page/FrameView.cpp:
-        (WebCore::FrameView::viewportConstrainedExtentRect): Deleted.
-        * page/FrameView.h:
-        Simon replaced this by viewportConstrainedVisibleContentRect, remove the old code.
</del><ins>+            Second, at non-integral scale factors, graphics context scaling
+            may cause us to not paint edge pixels.
</ins><span class="cx"> 
</span><del>-2014-05-14  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</del><ins>+            Fix by only marking PlatformCALayers as having opaque contents
+            when the contentsScale of the layer is integral.
</ins><span class="cx"> 
</span><del>-        Only define MAX_GRID_TRACK_REPETITIONS if CSS_GRID_LAYOUT is enabled.
</del><ins>+            Not testable, because we can't guarantee to get garbage pixels
+            in a ref test, and layer dumps show GraphicsLayer's notion of
+            content opaqueness, not the one we set on the PlatformCALayer.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            * platform/graphics/ca/GraphicsLayerCA.cpp:
+            (WebCore::isIntegral):
+            (WebCore::clampedContentsScaleForScale):
+            (WebCore::GraphicsLayerCA::updateRootRelativeScale):
+            (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
+            (WebCore::GraphicsLayerCA::updateContentsOpaque):
+            (WebCore::GraphicsLayerCA::getTransformFromAnimationsWithMaxScaleImpact):
+            Drive-by typo fix.
+            (WebCore::GraphicsLayerCA::noteChangesForScaleSensitiveProperties):
+            * platform/graphics/ca/GraphicsLayerCA.h:
+            * rendering/RenderLayerBacking.cpp:
+            (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
</ins><span class="cx"> 
</span><del>-        This was causing -Wunused-const-variable errors.
</del><ins>+2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * css/CSSParser.cpp: Add include guard.
</del><ins>+        Merge r160791: &lt;rdar://problems/15694289&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+    2013-12-18  Beth Dakin  &lt;bdakin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Tile cache has way too many tiles when pinch-zoomed in
-        https://bugs.webkit.org/show_bug.cgi?id=132929
-        -and corresponding-
-        &lt;rdar://problem/16527172&gt;
</del><ins>+            Starting a momentum scroll while rubber banding can cause scrolling to jump back 
+            when the rubberband snaps
+            https://bugs.webkit.org/show_bug.cgi?id=119507
+            -and corresponding-
+            &lt;rdar://problem/14655893&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        This patch makes the margin sizing functions return the set margin size scaled by 
-        the TileGrid's scale. We also need to get rid of the old notion we used to have
-        that margin tiles might be allowed to have a different size than the other tiles. 
-        We don't want that. They should have the normal margin size, but they should
-        affect the overall coverage area.
</del><ins>+            This line of code was added with the very first implementation of rubber-banding. 
+            As far as I can tell, it was always a belt-and-suspenders line of code that is a 
+            no-op in all normal rubber-banding. In this J-shaped scrolling case, this line of 
+            code is what causes the bug to occur because this line of code assumes that your 
+            rubber-band is always trying to take you back to the origin. 
+            * platform/mac/ScrollElasticityController.mm:
+            (WebCore::ScrollElasticityController::snapRubberBandTimerFired):
</ins><span class="cx"> 
</span><del>-        Scale by the TileGrid's scale.
-        * platform/graphics/ca/mac/TileController.mm:
-        (WebCore::TileController::topMarginHeight):
-        (WebCore::TileController::bottomMarginHeight):
-        (WebCore::TileController::leftMarginWidth):
-        (WebCore::TileController::rightMarginWidth):
</del><ins>+2013-12-19  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Get rid of adjustRectAtTileIndexForMargin() since we do not want to ever do this 
-        adjustment. Use tileSize instead of margin size for all sizing computations.
-        * platform/graphics/ca/mac/TileGrid.h:
-        * platform/graphics/ca/mac/TileGrid.mm:
-        (WebCore::TileGrid::rectForTileIndex):
-        (WebCore::TileGrid::getTileIndexRangeForRect):
-        (WebCore::TileGrid::adjustRectAtTileIndexForMargin): Deleted.
</del><ins>+        Merge r160819: &lt;rdar://problems/15701133&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+    2013-12-18  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        [Mac] Search fields should not use centered look
-        https://bugs.webkit.org/show_bug.cgi?id=132930
-        &lt;rdar://problem/16825842&gt;
</del><ins>+            Crash in WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches
+            https://bugs.webkit.org/show_bug.cgi?id=125970
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+            Reviewed by Antti Koivisto.
</ins><span class="cx"> 
</span><del>-        We need to explicitly set the centeredLook property
-        to NO on modern releases of Mac.
</del><ins>+            The bug was caused by containingBlockForAbsolutePosition returning a non-RenderBlock render object.
+            Fixed the bug by obtaining its containg block.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderThemeMac.mm: Declare a new private property and set it to NO.
-        (WebCore::RenderThemeMac::search):
</del><ins>+            Also changed the return type of containingBlockForFixedPosition, containingBlockForAbsolutePosition,
+            containingBlockForObjectInFlow from RenderElement to RenderBlock as all callers of these functions
+            had assumed the return value to be an instance of RenderBlock.
</ins><span class="cx"> 
</span><del>-2014-05-14  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+            Test: svg/text/select-text-inside-non-static-position.html
</ins><span class="cx"> 
</span><del>-        Subpixel layout: Change Element.offset* client* scroll* return type to double.
-        https://bugs.webkit.org/show_bug.cgi?id=132895
</del><ins>+            * rendering/LogicalSelectionOffsetCaches.h:
+            (WebCore::containingBlockForFixedPosition):
+            (WebCore::containingBlockForAbsolutePosition):
+            (WebCore::containingBlockForObjectInFlow):
+            (WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches):
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This patch changes Element.offset*, Element.client* and Element.scroll* APIs return
-        type from long to double to match the latest CSSOM View Module spec[1].
-        Element.offset* and Element.client* do return subpixel values from now on.
-        Element.scroll* still return integral values as the scrolling code hasn't adopted to subpixel rendering yet.
</del><ins>+        Merged patch from &lt;rdar://problems/15474133&gt;.  This patch is a port of r157821.
</ins><span class="cx"> 
</span><del>-        subpixelCSSOMElementMetricsEnabled setting is added to be able to turn this feature on/off
-        from WK2 preferences. It toggles the return value from subpixel to floored integral.
-        It does not change layout/rendering behavior.
</del><ins>+    2013-10-22  Samuel White  &lt;samuel_white@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reference list of what other browsers do:
-        IE: http://blogs.msdn.com/b/ie/archive/2012/02/17/sub-pixel-rendering-and-the-css-object-model.aspx
-        Blink: http://www.chromestatus.com/features/5497402177880064
-        Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=825607
</del><ins>+            AX: Add paramAttrs to fetch start and end text markers in a given rect.
+            https://bugs.webkit.org/show_bug.cgi?id=122164
</ins><span class="cx"> 
</span><del>-        [1] http://www.w3.org/TR/2013/WD-cssom-view-20131217/
</del><ins>+            Unreviewed change.
</ins><span class="cx"> 
</span><del>-        Test: cssom/subpixel-offsetleft-top-width-height-values.html
</del><ins>+            Added ability to fetch end and start text markers inside a given bounds. This gives ScreenReaders
+            like VoiceOver a way to retrieve the text markers for a specified column of page text.
</ins><span class="cx"> 
</span><del>-        * dom/Element.cpp:
-        (WebCore::localZoomForRenderer):
-        (WebCore::adjustForLocalZoom):
-        (WebCore::convertToNonSubpixelValueIfNeeded):
-        (WebCore::Element::offsetLeft):
-        (WebCore::Element::offsetTop):
-        (WebCore::Element::offsetWidth):
-        (WebCore::Element::offsetHeight):
-        (WebCore::Element::clientLeft):
-        (WebCore::Element::clientTop):
-        (WebCore::Element::clientWidth):
-        (WebCore::Element::clientHeight):
-        (WebCore::Element::scrollLeft):
-        (WebCore::Element::scrollTop):
-        (WebCore::Element::setScrollLeft):
-        (WebCore::Element::setScrollTop):
-        (WebCore::Element::scrollWidth):
-        (WebCore::Element::scrollHeight):
-        * dom/Element.h:
-        * dom/Element.idl:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::adjustForZoom):
-        (WebCore::HTMLBodyElement::scrollLeft):
-        (WebCore::HTMLBodyElement::setScrollLeft):
-        (WebCore::HTMLBodyElement::scrollTop):
-        (WebCore::HTMLBodyElement::setScrollTop):
-        (WebCore::HTMLBodyElement::scrollHeight):
-        (WebCore::HTMLBodyElement::scrollWidth):
-        * html/HTMLBodyElement.h:
-        * page/Settings.in:
</del><ins>+            Test: platform/mac/accessibility/text-marker-for-bounds.html
</ins><span class="cx"> 
</span><del>-2014-05-14  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::AccessibilityObject::mainFrame):
+            (WebCore::AccessibilityObject::topDocument):
+            (WebCore::AccessibilityObject::visiblePositionForBounds):
+            * accessibility/AccessibilityObject.h:
+            * accessibility/AccessibilityRenderObject.cpp:
+            * accessibility/AccessibilityRenderObject.h:
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (-[WebAccessibilityObjectWrapper screenToContents:]):
+            (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
</ins><span class="cx"> 
</span><del>-        Implement NSSharingServiceDelegate method &quot;transitionImageForShareItem&quot;
-        &lt;rdar://problem/16878020&gt; and https://bugs.webkit.org/show_bug.cgi?id=132911
</del><ins>+2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+        Merge r154513
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
</del><ins>+    2013-08-23  Alex Christensen  &lt;achristensen@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Re-separating Win32 and Win64 builds.
+            https://bugs.webkit.org/show_bug.cgi?id=120178
</ins><span class="cx"> 
</span><del>-        Another unreviewed build fix.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getTimingData):
-        Added necessary UNUSED_PARAMs.
</del><ins>+            * WebCore.vcxproj/WebCoreGenerated.make:
+            * WebCore.vcxproj/WebCoreGeneratedWinCairo.make:
+            Pass PlatformArchitecture as a command line parameter to bash scripts
+            and use PlatformArchitecture to determine which directory to delete
+            while cleaning (obj32 or obj64).
+            * WebCore.vcxproj/WebCoreGeneratedWinCairoCommon.props:
+            Export PlatformArchitecture to be used by make and cmd scripts.
+            * WebCore.vcxproj/build-generated-files.sh:
+            Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
+            * WebCore.vcxproj/copyForwardingHeaders.cmd:
+            * WebCore.vcxproj/copyWebCoreResourceFiles.cmd:
+            Use PlatformArchitecture to determine which directory to copy to (obj32 or obj64).
</ins><span class="cx"> 
</span><del>-2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r168849.
</del><ins>+        Rollout r160469.  Not rolling out from trunk because r160469 was
+        applied on the branch from a patch file.
</ins><span class="cx"> 
</span><del>-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getTimingData):
-        Protect use of timing data with ENABLE(WEB_TIMING).
</del><ins>+2013-12-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+        Merge r157821
</ins><span class="cx"> 
</span><del>-        Refactor duplicate code in web timing.
-        https://bugs.webkit.org/show_bug.cgi?id=132917
</del><ins>+    2013-10-22  Samuel White  &lt;samuel_white@apple.com&gt; 
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            AX: Add paramAttrs to fetch start and end text markers in a given rect. 
+            https://bugs.webkit.org/show_bug.cgi?id=122164 
</ins><span class="cx"> 
</span><del>-        * platform/network/ResourceHandle.h:
-        Added getTimingData declaration.
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::getTimingData):
-        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
-        Moved duplicate code to ResourceHandle.
</del><ins>+            Reviewed by Chris Fleizach. 
</ins><span class="cx"> 
</span><del>-2014-05-14  Alex Christensen  &lt;achristensen@webkit.org&gt;
</del><ins>+            Added ability to fetch end and start text markers inside a given bounds. This gives ScreenReaders
+            like VoiceOver a way to retrieve the text markers for a specified column of page text.
</ins><span class="cx"> 
</span><del>-        Use references instead of pointers with ResourceLoadTiming.
-        https://bugs.webkit.org/show_bug.cgi?id=132846
</del><ins>+            Test: platform/mac/accessibility/text-marker-for-bounds.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::AccessibilityObject::mainFrame):
+            (WebCore::AccessibilityObject::topDocument):
+            (WebCore::AccessibilityObject::visiblePositionForBounds):
+            * accessibility/AccessibilityObject.h:
+            * accessibility/AccessibilityRenderObject.cpp:
+            * accessibility/AccessibilityRenderObject.h:
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (-[WebAccessibilityObjectWrapper screenToContents:]):
+            (-[WebAccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        Removed ResourceResponseBase::setResourceLoadTiming linker symbol.
-        * inspector/InspectorResourceAgent.cpp:
-        (WebCore::buildObjectForResourceResponse):
-        * page/PerformanceResourceTiming.cpp:
-        (WebCore::PerformanceResourceTiming::domainLookupStart):
-        (WebCore::PerformanceResourceTiming::domainLookupEnd):
-        (WebCore::PerformanceResourceTiming::connectStart):
-        (WebCore::PerformanceResourceTiming::connectEnd):
-        (WebCore::PerformanceResourceTiming::secureConnectionStart):
-        (WebCore::PerformanceResourceTiming::requestStart):
-        Use references instead of pointers.
-        * page/PerformanceResourceTiming.h:
-        Make an instance instead of a RefPtr.
-        * page/PerformanceTiming.cpp:
-        (WebCore::PerformanceTiming::domainLookupStart):
-        (WebCore::PerformanceTiming::domainLookupEnd):
-        (WebCore::PerformanceTiming::connectStart):
-        (WebCore::PerformanceTiming::connectEnd):
-        (WebCore::PerformanceTiming::secureConnectionStart):
-        (WebCore::PerformanceTiming::requestStart):
-        (WebCore::PerformanceTiming::responseStart):
-        Check to see if the loader exists, then use ResourceLoadTiming reference.
-        (WebCore::PerformanceTiming::resourceLoadTiming): Deleted.
-        * page/PerformanceTiming.h:
-        Removed resourceLoadTiming declaration.
-        * platform/network/ResourceLoadTiming.h:
-        (WebCore::ResourceLoadTiming::ResourceLoadTiming):
-        (WebCore::ResourceLoadTiming::operator=):
-        Replaced reference counting with copy constructors.
-        (WebCore::ResourceLoadTiming::create): Deleted.
-        (WebCore::ResourceLoadTiming::deepCopy): Deleted.
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::adopt):
-        (WebCore::ResourceResponseBase::copyData):
-        (WebCore::ResourceResponseBase::resourceLoadTiming):
-        (WebCore::ResourceResponseBase::setResourceLoadTiming):
-        (WebCore::ResourceResponseBase::compare):
-        * platform/network/ResourceResponseBase.h:
-        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
-        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
-        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
-        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::didStartRequest):
-        (WebCore::networkEventCallback):
-        Use references instead of pointers.
</del><ins>+2013-12-11  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Commit Queue  &lt;commit-queue@webkit.org&gt;
</del><ins>+        Merge r159691
</ins><span class="cx"> 
</span><del>-        Unreviewed, rolling out r168837.
-        https://bugs.webkit.org/show_bug.cgi?id=132913
</del><ins>+    2013-11-22  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        The patch added an assertion which fires on 6 tests (Requested
-        by ap on #webkit).
</del><ins>+            [Win] Avoid deadlock when interacting with some AVFoundationCF content
+            &lt;rdar://problem/15482977&gt; and https://bugs.webkit.org/show_bug.cgi?id=124752
</ins><span class="cx"> 
</span><del>-        Reverted changeset:
</del><ins>+            Prevent deadlock caused by conflict over the &quot;mapLock&quot; mutex. Notification handling in the file,
+            which modify assets and make other changes, are required to happen on the main thread. This
+            patch enforces this requirement.
</ins><span class="cx"> 
</span><del>-        &quot;[CSS Regions] Add ASSERT to make sure using the flowThread
-        cache does not return incorrect results&quot;
-        https://bugs.webkit.org/show_bug.cgi?id=132906
-        http://trac.webkit.org/changeset/168837
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-13  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::NotificationCallbackData::NotificationCallbackData): Added
+            (WebCore::AVFWrapper::processNotification): Moved logic from 'notificationCallback', which was
+            sometimes happening on a background thread.
+            (WebCore::AVFWrapper::notificationCallback): Dispatch calls to main thread.
</ins><span class="cx"> 
</span><del>-        Revert &quot;Don't dispatch 'beforeload' event inside FrameView::layout()&quot;,
-        commit 84fe8cf6fbe8b5de9a06300ca3ef6d0ffc96948c, and associated
-        follow-up fixes:
</del><ins>+2013-12-11  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-            &quot;platform/mac/plugins/testplugin-onnew-onpaint.html failing after
-                r168668&quot;, commit c17be3bf5127baf94310af4b4b9bf5a57d29aaf4
-            &quot;[Win] Unreviewed build fix after r168668.&quot;, commit
-                4fa470ad12c38ee7d4c114541b6dd321181a8bc9
</del><ins>+        Merge r159460
</ins><span class="cx"> 
</span><del>-        The original merged patch appears to have caused a regression in
-        fast/dom/HTMLObjectElement/object-as-frame.html.
</del><ins>+    2013-11-18  David Hyatt  &lt;hyatt@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        &lt;https://bugs.webkit.org/show_bug.cgi?id=132886&gt;
</del><ins>+            Add a quirk to not respect center text-align when positioning
</ins><span class="cx"> 
</span><del>-        Reviewed by Alexey Proskuryakov.
</del><ins>+            &lt;rdar://problem/15427571&gt;
+            https://bugs.webkit.org/show_bug.cgi?id=124522
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * dom/Document.cpp:
-        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
-        * dom/Document.h:
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::renderWidgetForJSBindings):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderWidgetForJSBindings):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::reset):
-        (WebCore::FrameView::flushAnyPendingPostLayoutTasks):
-        (WebCore::FrameView::performPostLayoutTasks):
-        (WebCore::FrameView::updateEmbeddedObjectsTimerFired): Deleted.
-        * page/FrameView.h:
-        * testing/Internals.cpp:
-        (WebCore::Internals::updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks): Deleted.
-        * testing/Internals.h:
-        * testing/Internals.idl:
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-2014-05-14  Kiran  &lt;kiran.guduru@samsung.com&gt;
</del><ins>+            Added fast/block/legacy-text-align-position-quirk.html
</ins><span class="cx"> 
</span><del>-        alidation for getUserMedia() errorCallback is missing.
-        https://bugs.webkit.org/show_bug.cgi?id=132901
</del><ins>+            * page/Settings.in:
+            Add the quirk setting.
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::RenderBlock::startAlignedOffsetForLine):
+            Don't pay attention to center text-align when the quirk is set.
</ins><span class="cx"> 
</span><del>-        The patch adds the validation for getUserMedia errorCallBack
-        and throws TypeMismatchError.
</del><ins>+2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/mediastream/getusermedia.html 
</del><ins>+        Merge 154333
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/NavigatorUserMedia.cpp:
-        (WebCore::NavigatorUserMedia::webkitGetUserMedia):
</del><ins>+    2013-08-20  Alex Christensen  &lt;achristensen@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Tibor Meszaros  &lt;tmeszaros.u-szeged@partner.samsung.com&gt;
</del><ins>+            Use PlatformArchitecture to distinguish between 32-bit and 64-bit builds on Windows.
+            https://bugs.webkit.org/show_bug.cgi?id=119512
</ins><span class="cx"> 
</span><del>-        Remove CSS_STICKY_POSITION guards
-        https://bugs.webkit.org/show_bug.cgi?id=132676
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj.filters:
+            * WebCore.vcxproj/WebCoreCommon.props:
+            * WebCore.vcxproj/WebCoreGeneratedCommon.props:
+            * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
+            * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters:
+            Replaced obj32, bin32, and lib32 with macros for 64-bit build.
</ins><span class="cx"> 
</span><del>-        * Configurations/FeatureDefines.xcconfig:
-        * css/CSSParser.cpp:
-        (WebCore::isValidKeywordPropertyAndValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EPosition):
-        * css/CSSValueKeywords.in:
-        * editing/EditingStyle.cpp:
-        (WebCore::EditingStyle::convertPositionStyle):
</del><ins>+2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Radu Stavila  &lt;stavila@adobe.com&gt;
</del><ins>+        Merge 152982
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Add ASSERT to make sure using the flowThread cache does not return incorrect results
-        https://bugs.webkit.org/show_bug.cgi?id=132906
</del><ins>+    2013-07-22  Alex Christensen  &lt;achristensen@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andrei Bucur.
</del><ins>+            Added assembly files to Windows 64-bit builds.
+            https://bugs.webkit.org/show_bug.cgi?id=118931
</ins><span class="cx"> 
</span><del>-        If flowThreadContainingBlock() is called on an object which is in a different
-        flow thread than the one currently being laid out, this method will return an incorrect
-        result. I added an assertion for that to make sure we catch and treat any such scenarios.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        No new tests required.
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Added PaintHooks.asm for x64 and enabled MASM.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Added PaintHooks.asm.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::locateFlowThreadContainingBlockNoCache):
-        (WebCore::RenderObject::locateFlowThreadContainingBlock):
-        * rendering/RenderObject.h:
</del><ins>+2013-12-10  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+        Merge 152921
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Don't relayout when updating the region range unless necessary
-        https://bugs.webkit.org/show_bug.cgi?id=132120
</del><ins>+    2013-07-19  Alex Christensen  &lt;achristensen@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Antti Koivisto.
</del><ins>+            Added x64 configuration to Visual Studio build.
+            https://bugs.webkit.org/show_bug.cgi?id=118888
</ins><span class="cx"> 
</span><del>-        The patch reduces the cases when a relayout is made for boxes that change the region range.
-        This lowers the amount of nested layouts in most cases and produces big layout speedups for trees
-        without overhanging floats.
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Tests: Major performance improvement with speedups of 50-60% on:
-        Layout/RegionsAuto.html, Layout/RegionsAutoMaxHeight.html and Layout/RegionsFixed.html
</del><ins>+            * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj:
+            * WebCore.vcxproj/WebCore.vcxproj:
+            * WebCore.vcxproj/WebCoreGenerated.vcxproj:
+            * WebCore.vcxproj/WebCoreTestSupport.vcxproj:
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::updateRegionRangeForBoxChild): Ask the child box if it needs a relayout
-        in case its region range changes.
-        * rendering/RenderBlockFlow.cpp:
-        (WebCore::RenderBlockFlow::layoutBlockChild): It's not necessary to do two layouts here because
-        there's no block direction position change between them for the child.
-        (WebCore::RenderBlockFlow::needsLayoutAfterRegionRangeChange): If the block doesn't have floats
-        or if it expands to enclose the floats it doesn't need to relayout after a region range chage.
-        It's not possible for it to have a float inside overflow that must be repositioned using the new
-        range.
-        * rendering/RenderBlockFlow.h:
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::needsLayoutAfterRegionRangeChange): By default don't relayout after a region
-        range change.
</del><ins>+2013-11-20  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-14  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+        Merge r159481
</ins><span class="cx"> 
</span><del>-        RuleData should ref the StyleRule
-        https://bugs.webkit.org/show_bug.cgi?id=132865
</del><ins>+    2013-11-18  Zalan Bujtas  &lt;zalan@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+            use after free in WebCore::DocumentOrderedMap::remove / WebCore::TreeScope::removeElementById
+            https://bugs.webkit.org/show_bug.cgi?id=121324
</ins><span class="cx"> 
</span><del>-        As a defensive move make RuleData ref the StyleRule. 
-        This adds some ref churn but the overall performance impact should be minimal.
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-        * css/RuleSet.h:
-        (WebCore::RuleData::rule):
</del><ins>+            Update the document ordered map for an image element before dispatching load or error events
+            when it's inserted into a document.
</ins><span class="cx"> 
</span><del>-2014-05-14  Antti Koivisto  &lt;antti@apple.com&gt;
</del><ins>+            Test: fast/dom/modify-node-and-while-in-the-callback-too-crash.html
</ins><span class="cx"> 
</span><del>-        GIF animations don't restart after scrolling on iOS WebKit1
-        https://bugs.webkit.org/show_bug.cgi?id=132900
</del><ins>+            * dom/DocumentOrderedMap.cpp: defensive fix to avoid use after free issues.
+            (WebCore::DocumentOrderedMap::remove):
+            * html/HTMLImageElement.cpp:
+            (WebCore::HTMLImageElement::insertedInto):
+            * loader/ImageLoader.cpp:
+            (WebCore::ImageLoader::updateFromElement): setting m_failedLoadURL makes
+            repeated updateFromElement calls return early.
</ins><span class="cx"> 
</span><del>-        Reviewed by Andreas Kling.
</del><ins>+2013-11-13  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        &lt;rdar://problem/15292359&gt;
+        Fix incorrect merge of r157299 made in r158605.
</ins><span class="cx"> 
</span><del>-2014-05-13  Andrei Bucur  &lt;abucur@adobe.com&gt;
</del><ins>+        * platform/graphics/DisplayRefreshMonitor.cpp:
+        (WebCore::DisplayRefreshMonitor::removeClient): Remember to remove clients
+        from m_clientsToBeNotified.
+        * platform/graphics/DisplayRefreshMonitor.h: Might as well make the code
+        more consistent with ToT while I'm here.
</ins><span class="cx"> 
</span><del>-        [CSS Regions] Assertion failure in some cases with inline blocks
-        https://bugs.webkit.org/show_bug.cgi?id=132859
</del><ins>+2013-11-08  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Mihnea Ovidenie.
</del><ins>+        Merge r152867
</ins><span class="cx"> 
</span><del>-        The patch hardens the conditions when the region range caches are
-        populated to avoid desynchronizations when objects move during layout.
-        This is true especially in the case of the boxes found inside
-        inline blocks, that get their range from the containing line.
</del><ins>+    2013-07-18  Jer Noble  &lt;jer.noble@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        There is a new function |computedRegionRangeForBox| that will always
-        return a region range for a box using a best effort algorithm. This should
-        be used only when there's no need to cache region information.
</del><ins>+            New PDFPlugin doesn't support WebKitOmitPDFSupport, acts as if Plug-ins are off
+            https://bugs.webkit.org/show_bug.cgi?id=118858
</ins><span class="cx"> 
</span><del>-        This change also allows better control over the lifecycle of the
-        |RenderBoxRegionInfo| objects stored on the regions. We can now iterate
-        over the full range of the box when cleaning up the region box info. The
-        same applies for the width change detection function.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-        Test: fast/regions/inline-block-shifted-region.html
</del><ins>+            Expand the scope of rejecting non video/ or audio/ MIME types when
+            filling the MIME type cache.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::RenderBlockFlow::updateRegionForLine): Don't set the containing
-        region if the block doesn't have a range. The returned value would not
-        be correctly clamped.
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBlock::hasRegionRangeInFlowThread):
-        * rendering/RenderBox.h:
-        * rendering/RenderFlowThread.cpp:
-        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo): Iterate only over
-        the range of the box, not from the start of the region chain.
-        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock): Same as
-        above.
-        (WebCore::RenderFlowThread::hasCachedRegionRangeForBox):
-        (WebCore::RenderFlowThread::getRegionRangeForBoxFromCachedInfo):
-        (WebCore::RenderFlowThread::getRegionRangeForBox):
-        (WebCore::RenderFlowThread::computedRegionRangeForBox): Best effort function
-        to determine the range of a box. It will always return something as long
-        as the flow thread has regions.
-        (WebCore::RenderFlowThread::objectShouldFragmentInFlowRegion): Use the new function
-        to determine the range.
-        * rendering/RenderFlowThread.h:
-        * rendering/RenderNamedFlowThread.cpp:
-        (WebCore::RenderNamedFlowThread::absoluteQuadsForBox): Use the new function to determine
-        the range.
</del><ins>+            * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+            (WebCore::shouldRejectMIMEType): Added utility function.
</ins><span class="cx"> 
</span><del>-2014-05-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+2013-11-07  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Fix &quot;ASSERTION FAILED: m_representation == PlatformLayerRepresentation&quot; with UI-side compositing
-        https://bugs.webkit.org/show_bug.cgi?id=132899
</del><ins>+        Merge r158743
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+    2013-11-06  Chris Fleizach  &lt;cfleizach@apple.com&gt; 

+        AX: Audio and Video attachments are not output to VoiceOver 
+        https://bugs.webkit.org/show_bug.cgi?id=123479 
</ins><span class="cx"> 
</span><del>-        Export some things
</del><ins>+        Reviewed by Mario Sanchez Prada. 
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
</del><ins>+        Video and audio elements don't appear as distinct objects in the AX hierarchy, 
+        nor are they treated as replaceable objects when emitting the text. We should 
+        treat these characters like attachments, for one. On the Mac platform, we should 
+        also identify them with special subroles. 
</ins><span class="cx"> 
</span><del>-2014-05-13  Hans Muller  &lt;hmuller@adobe.com&gt;
</del><ins>+        Tests: platform/mac/accessibility/media-emits-object-replacement.html 
+              platform/mac/accessibility/media-role-descriptions.html 

+        * accessibility/AccessibilityNodeObject.cpp: 
+        (WebCore::AccessibilityNodeObject::isGenericFocusableElement): 
+        * accessibility/AccessibilityObject.h: 
+        * accessibility/AccessibilityRenderObject.cpp: 
+        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored): 
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): 
+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm: 
+        (createAccessibilityRoleMap): 
+        (-[WebAccessibilityObjectWrapper subrole]): 
+        (-[WebAccessibilityObjectWrapper roleDescription]): 
+        * editing/TextIterator.cpp: 
+        (WebCore::isRendererReplacedElement): 
</ins><span class="cx"> 
</span><del>-        [CSS Shapes] line height grows around polygon and incorrectly causes text to wrap to next line
-        https://bugs.webkit.org/show_bug.cgi?id=131622
</del><ins>+2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Bem Jones-Bey.
</del><ins>+        Merge r158617
</ins><span class="cx"> 
</span><del>-        Corrected an earlier PolygonShape fix https://bugs.webkit.org/show_bug.cgi?id=132132
-        When the top or bottom of a layout line is coincident with a polygon edge vertex, we
-        only consider it an intersection if the edge extends into the line.
</del><ins>+    2013-11-04  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: fast/shapes/shape-outside-floats/shape-outside-edge-case.html
</del><ins>+            AX: Mail attachments at the start of an email are not output by VoiceOver
+            https://bugs.webkit.org/show_bug.cgi?id=123697
</ins><span class="cx"> 
</span><del>-        * rendering/shapes/PolygonShape.cpp:
-        (WebCore::OffsetPolygonEdge::clippedEdgeXRange):
</del><ins>+            Reviewed by Ryosuke Niwa.
</ins><span class="cx"> 
</span><del>-2014-05-13  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+            VoiceOver is expecting that &quot;replaced elements&quot; (attachments in a Mail message in this case) to be
+            represented by the replacement character when asking for a stringForRange.
</ins><span class="cx"> 
</span><del>-        m_layerForOverhangAreas is sometimes not positioned correctly when topContentInset 
-        has changed
-        https://bugs.webkit.org/show_bug.cgi?id=132898
-        -and corresponding-
-        &lt;rdar://problem/16644710&gt;
</del><ins>+            However, when that replaced element is at the beginning of the document, the logic does not work because
+            there is a few code places that will take that first Position and advance it forward, not accounting for replaced elements.
+            When using the TextIterator normally, it does account for these, so that's why it's only affecting as at the beginning of the document.
</ins><span class="cx"> 
</span><del>-        Reviewed by Anders Carlsson.
</del><ins>+            Also a &quot;replaced element&quot; can be more than just renderer-&gt;isReplaced(), hence the externing of the isRendererReplacedElement method
+            and using that it in pertinent places.
</ins><span class="cx"> 
</span><del>-        This function is called whenever the topContentInset changes, so use it as an 
-        opportunity to ensure that m_layerForOverhangAreas has been positioned correctly.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::frameViewDidChangeSize):
</del><ins>+            Tests: platform/mac/accessibility/object-replacement-with-no-rendered-children-at-node-start.html
+                   platform/mac/accessibility/object-replacement-with-rendered-children-at-node-start.html
</ins><span class="cx"> 
</span><del>-        Everyone gets an anchor point!
-        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
</del><ins>+            * accessibility/AccessibilityObject.cpp:
+            (WebCore::replacedNodeNeedsCharacter):
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (nsStringForReplacedNode):
+            * dom/Position.cpp:
+            (WebCore::Position::isCandidate):
+            * dom/PositionIterator.cpp:
+            * dom/Range.cpp:
+            (WebCore::Range::firstNode):
+            * editing/TextIterator.cpp:
+            (WebCore::isRendererReplacedElement):
+            * editing/TextIterator.h:
</ins><span class="cx"> 
</span><del>-2014-05-13  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Attempted build fix after https://bugs.webkit.org/show_bug.cgi?id=132891
</del><ins>+        Merge r158629
</ins><span class="cx"> 
</span><del>-        * page/PageDebuggable.cpp:
</del><ins>+    2013-11-04  Samuel White  &lt;samuel_white@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Timothy Hatcher  &lt;timothy@apple.com&gt;
</del><ins>+            AX: AXShowMenu doesn't always work.
+            https://bugs.webkit.org/show_bug.cgi?id=123649
</ins><span class="cx"> 
</span><del>-        Force developerExtrasEnabled when a remote Inspector client connects.
</del><ins>+            Reviewed by Chris Fleizach.
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=132891
</del><ins>+            No new tests, the change occurs in a code path that forces the context menu to show which
+            locks up DRT if we try to test it (platform menu is shown). The change itself gives the mouse
+            event handler a chance to handle our platform mouse event BEFORE the event ends up in the show
+            context menu machinery. This is necessary because without it, the element will not become
+            focused. Without focus, accessibility shows different/less menu items than a mouse click. The
+            end result is that context menus shown via accessibility are consistent with menus shown via click.
</ins><span class="cx"> 
</span><del>-        Reviewed by Joseph Pecoraro.
</del><ins>+            * page/ContextMenuController.cpp:
+            (WebCore::ContextMenuController::showContextMenuAt):
</ins><span class="cx"> 
</span><del>-        * page/PageDebuggable.cpp:
-        (WebCore::PageDebuggable::PageDebuggable): Initialize m_forcedDeveloperExtrasEnabled to false.
-        (WebCore::PageDebuggable::connect): Set m_forcedDeveloperExtrasEnabled if the setting is changed.
-        (WebCore::PageDebuggable::disconnect): Switch developerExtrasEnabled back to false
-        if m_forcedDeveloperExtrasEnabled is true.
-        * page/PageDebuggable.h: Added m_forcedDeveloperExtrasEnabled.
</del><ins>+2013-11-06  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Beth Dakin  &lt;bdakin@apple.com&gt;
</del><ins>+        Merge r154391
</ins><span class="cx"> 
</span><del>-        REGRESSION (topContentInset): Searching through Facebook Messenger's chat causes 
-        scrolling in News Feed
-        https://bugs.webkit.org/show_bug.cgi?id=132889
-        -and corresponding-
-        &lt;rdar://problem/16715716&gt;
</del><ins>+    2013-08-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            &lt;https://webkit.org/b/120113&gt; [Windows] Enable CSS_IMAGE_SET
</ins><span class="cx"> 
</span><del>-        First of all, scrollOffsetRelativeToDocument() was very poorly named. This patch 
-        re-names it to the much more accurate documentScrollOffsetRelativeToViewOrigin(). 
-        Re-naming it makes it clear that ONE call site was not getting the right offset. 
-        That call site does not want to know the document’s position relative to the view 
-        origin, but rather it wants to know the Document’s position relative to the 
-        scrolling origin.
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        Export new name.
-        * WebCore.exp.in:
</del><ins>+            We can now activate:
+            fast/css/image-set-parsing.html
+            fast/css/image-set-parsing-invalid.html
</ins><span class="cx"> 
</span><del>-        Use newly re-named documentScrollPositionRelativeToViewOrigin().
-        * page/FrameView.cpp:
-        (WebCore::FrameView::convertToRenderer):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::documentScrollOffsetRelativeToViewOrigin):
-        (WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin):
-        (WebCore::ScrollView::documentScrollOffsetRelativeToScrollableAreaOrigin):
-        (WebCore::ScrollView::rootViewToContents):
-        (WebCore::ScrollView::windowToContents):
-        (WebCore::ScrollView::scrollOffsetRelativeToDocument): Deleted.
-        (WebCore::ScrollView::scrollPositionRelativeToDocument): Deleted.
-        * platform/ScrollView.h:
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add missing image set implementation files.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
+            * css/CSSAllInOne.cpp: Add missing CSSImageSetValue.cpp
+            * rendering/style/StyleAllInOne.cpp: Add missing StyeCachedImageSet.cpp
</ins><span class="cx"> 
</span><del>-        THIS is the spot that needs the new function, 
-        documentScrollOffsetRelativeToScrollableAreaOrigin()()
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollRectToVisible):
</del><ins>+2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Dean Jackson  &lt;dino@apple.com&gt;
</del><ins>+        Merge r155130
</ins><span class="cx"> 
</span><del>-        [iOS] Page scale update messages for media controls should only fire at the end of zooming
-        https://bugs.webkit.org/show_bug.cgi?id=132857
-        &lt;rdar://problem/16631009&gt;
</del><ins>+    2013-09-05  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Simon Fraser.
</del><ins>+            [Windows] Unreviewed build/link improvement after r155127 to be
+            consistent about using debug-build support libraries.
</ins><span class="cx"> 
</span><del>-        As the user was zooming, the media controls that responded
-        to the page scale (and resized themselves) would do so
-        slightly out of sync with the screen refreshes, and it looked
-        terrible. They really only need to get told at the end
-        of the zoom that they need to relayout.
</del><ins>+            Now that &lt;rdar://problem/9898937&gt; is resolved, we should be linking
+            to debug AVFoundationCF as well.
</ins><span class="cx"> 
</span><del>-        Allow setPageScaleFactor to accept another parameter
-        that indicates if the change is stable. That way, changes
-        during a user triggers zoom gesture can be ignored for
-        media controls.
</del><ins>+            * page/CaptionUserPreferencesMediaAF.cpp: Link to AVFoundationCF_debug
+            when building with the DEBUG_ALL target.
+            * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Ditto.
+            * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Ditto.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Page::setPageScaleFactor takes a new parameter.
-        * dom/Document.cpp:
-        (WebCore::Document::pageScaleFactorChangedAndStable): Renamed from pageScaleFactorChanged.
-        (WebCore::Document::pageScaleFactorChanged): Deleted.
-        * dom/Document.h:
-        * page/Page.cpp:
-        (WebCore::Page::setPageScaleFactor): Accepts a new inStableState parameter,
-        and tells the main frame that the scale factor has changed if it's stable.
-        * page/Page.h:
</del><ins>+2013-11-04  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Merge r157773
</ins><span class="cx"> 
</span><del>-        Unreviewed build fix after r168755.
</del><ins>+2013-10-21  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive):
</del><ins>+        [WIN] Properly support reverse animations without needing software fallback.
+        https://bugs.webkit.org/show_bug.cgi?id=85121
</ins><span class="cx"> 
</span><del>-2014-05-13  Eric Carlson  &lt;eric.carlson@apple.com&gt;
</del><ins>+        Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        [Mac] hasVideo should return true when video is ready to display
-        https://bugs.webkit.org/show_bug.cgi?id=132885
</del><ins>+        Testing is provided by existing animation tests.
</ins><span class="cx"> 
</span><del>-        Reviewed by Jer Noble.
</del><ins>+        * platform/animation/TimingFunction.h:
+        (WebCore::CubicBezierTimingFunction::createReversed): Added.
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::addAnimation): The early return when performing a reverse or
+        autoreverse animation is no longer needed.
+        * platform/graphics/ca/PlatformCAAnimation.h:
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (toCAMediaTimingFunction): Use new reversed function.
+        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+        (toCACFTimingFunction): Ditto.
+        (PlatformCAAnimation::setTimingFunction): Pass 'reverse' flag.
+        (PlatformCAAnimation::setTimingFunctions): Ditto.
</ins><span class="cx"> 
</span><del>-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::parseAttribute):
</del><ins>+2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/AudioTrackPrivateAVFObjC.mm:
-        (WebCore::AudioTrackPrivateAVFObjC::resetPropertiesFromTrack): Don't change the
-            enabled state of the AVPlayerItemTrack during setup.
</del><ins>+        Merge r154180
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
-        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): Initialize
-            m_cachedIsReadyForDisplay.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Remove &quot;enabled&quot; KVO observers.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer): Observe &quot;readyForDisplay&quot;
-            change notifications.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): Remove for &quot;readyForDisplay&quot;
-            observer.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::hasAvailableVideoFrame): Return cached readyForDisplay
-            state instead of polling every time.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Call setHasVideo(true) if the
-            player layer is ready for display.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateAudioTracks): Update logging.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoTracks): Ditto.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::firstFrameAvailableDidChange): Cache readyForDisplay
-            state, call tracksChanged() if we haven't seen a video track yet.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::trackEnabledDidChange): New.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive): Correct logging.
-        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksDidChange): Remove old &quot;enabled&quot; listeners
-            before release tracks, add new ones to new tracks.
-        (WebCore::assetTrackMetadataKeyNames): Add &quot;enabled&quot; to the list of properties we require to 
-            be loaded before announcing that metadata has loaded.
-        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]): Observe 
-            &quot;readyForDisplay&quot; and &quot;enabled&quot;.
</del><ins>+    2013-08-15  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/avfoundation/objc/VideoTrackPrivateAVFObjC.cpp:
-        (WebCore::VideoTrackPrivateAVFObjC::resetPropertiesFromTrack): Don't change the
-            enabled state of the AVPlayerItemTrack during setup.
</del><ins>+            [Windows] Prevent dangling CACFLayer when switching to/from Tiled backing.
+            https://bugs.webkit.org/show_bug.cgi?id=119818
</ins><span class="cx"> 
</span><del>-2014-05-13  Myles C. Maxfield  &lt;litherum@gmail.com&gt;
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        Text decorations do not contribute to visual overflow
-        https://bugs.webkit.org/show_bug.cgi?id=132773
</del><ins>+            Covered by existing: compositing/tiling/empty-to-tiled.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+            (PlatformCALayer::~PlatformCALayer): Remove deleted layer from its
+            parent layer 
</ins><span class="cx"> 
</span><del>-        Tests: fast/css3-text/css3-text-decoration/repaint/underline-outside-of-layout-rect.html
</del><ins>+2013-11-04  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * rendering/InlineTextBox.cpp:
-        (WebCore::textDecorationStrokeThickness): Refactor into a common function
-        (WebCore::wavyOffsetFromDecoration): Ditto
-        (WebCore::InlineTextBox::extendVerticalVisualOverflowForDecorations): Given
-        vertical overflow bounds, possibly extend those to include location of
-        decorations.
-        (WebCore::InlineTextBox::paintDecoration): Use refactored functions.
-        * rendering/InlineTextBox.h: Function signature
-        * rendering/RenderBlockLineLayout.cpp:
-        (WebCore::setLogicalWidthForTextRun): Call extendVerticalVisualOverflowForDecorations()
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::changeAffectsVisualOverflow): Inspects shadows and text decorations
-        (WebCore::RenderStyle::changeRequiresLayout): Calls changeAffectsVisualOverflow()
-        (WebCore::RenderStyle::changeRequiresRepaintIfTextOrBorderOrOutline): Moved code from here
-        to changeAffectsVisualOverflow().
-        * rendering/style/RenderStyle.h: Function signature
</del><ins>+        &lt;rdar://problem/15292359&gt;
+        Merge r157299
</ins><span class="cx"> 
</span><del>-2014-05-13  Enrica Casucci  &lt;enrica@apple.com&gt;
</del><ins>+    2013-10-10  Darin Adler  &lt;darin@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION (WebKit2): Zooming to text field leaves it partially hidden by the form assistant.
-        https://bugs.webkit.org/show_bug.cgi?id=132879
-        &lt;rdar://problem/16318049&gt;
</del><ins>+            Use after free in WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded
+            https://bugs.webkit.org/show_bug.cgi?id=121033
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+            Reviewed by Dean Jackson.
</ins><span class="cx"> 
</span><del>-        Adding some exports. The fix to setScrollPosition is to avoid clamping the scroll
-        position when using delegate scrolling.
</del><ins>+            For safe iteration, use a set rather than a vector, and remove the clients from
+            the set if they are removed during iteration.
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setScrollPosition):
</del><ins>+            Test: fast/animation/request-animation-frame-remove-client.html
</ins><span class="cx"> 
</span><del>-2014-05-13  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+            * platform/graphics/DisplayRefreshMonitor.cpp:
+            (WebCore::DisplayRefreshMonitor::DisplayRefreshMonitor): Initialize the
+            m_clientsToBeNotified pointer to null.
+            (WebCore::DisplayRefreshMonitor::removeClient): If there is a m_clientsToBeNotified
+            set, remove from it as well as the real m_clients set.
+            (WebCore::DisplayRefreshMonitor::displayDidRefresh): Use a HashSet instead of a
+            vector for the copy of the clients set we iterate.
</ins><span class="cx"> 
</span><del>-        Followup to: Update positioning/drawing of the image controls button.
-        &lt;rdar://problem/16885077&gt; and https://bugs.webkit.org/show_bug.cgi?id=132883
</del><ins>+            * platform/graphics/DisplayRefreshMonitor.h: Moved some of the BlackBerry-specific
+            part of this out of the header. Added a new HashSet pointer, m_clientsToBeNotified,
+            to be used to remove clients during the notification process. Also added a FIXME.
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            * platform/graphics/blackberry/DisplayRefreshMonitorBlackBerry.cpp: Moved the
+            DisplayAnimationClient class in here.
</ins><span class="cx"> 
</span><del>-        Cleared up the actual intent behind review feedback on the original patch.
</del><ins>+2013-11-04  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        (WebCore::ImageControlsButtonElementMac::maybeCreate):
</del><ins>+        Merge r157436
</ins><span class="cx"> 
</span><del>-2014-05-13  Brady Eidson  &lt;beidson@apple.com&gt;
</del><ins>+    2013-10-14  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
</ins><span class="cx"> 
</span><del>-        Update positioning/drawing of the image controls button.
-        &lt;rdar://problem/16885077&gt; and https://bugs.webkit.org/show_bug.cgi?id=132883
</del><ins>+            Crash in WebCore::BidiResolver&lt;WebCore::InlineIterator, WebCore::BidiRun&gt;::createBidiRunsForLine
+            https://bugs.webkit.org/show_bug.cgi?id=122776
</ins><span class="cx"> 
</span><del>-        Reviewed by Tim Horton.
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
-        (WebCore::ImageControlsButtonElementMac::maybeCreate): Add inline style for top/right
-          positioning based on the metrics from the render theme.
</del><ins>+            Merge https://chromium.googlesource.com/chromium/blink/+/aca89bc4d984705a1f94b623dae0ab03e239a248
</ins><span class="cx"> 
</span><del>-        * html/shadow/mac/imageControlsMac.css:
-        (.x-webkit-image-controls-button): Can’t hard code any positioning.
</del><ins>+            Fix modification of whitespace endpoints to not assume it's operating on RenderTexts
</ins><span class="cx"> 
</span><del>-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::imageControlsButtonPositionOffset):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::servicesRolloverButtonCell):
-        (WebCore::RenderThemeMac::imageControlsButtonPositionOffset):
</del><ins>+            During line layout, we use midpoints to identify RenderObjects, or parts of
+            RenderObjects, that don't need InlineBoxes, usually because of collapsed whitespace.
</ins><span class="cx"> 
</span><del>-2014-05-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            Prior to actually creating BidiRuns (the precursor to InlineBoxes), we use
+            checkMidpoints to fix up our lineMidpointState to handle the case where we start
+            ignoring spaces in our line, but don't stop until somewhere on the following line.
+            Previously, this function assumed that the final midpoint (called an endpoint)
+            was a RenderText, but this assumption is wrong if we have a beginning midpoint
+            created by shouldSkipWhitespaceAfterStartObject (which handles inlines and list
+            markers) and no endpoint on that line. In that case, we'd instead adjust the
+            position backwards on the beginning midpoint, which would cause us to fail to
+            create an InlineBox for the inline or list marker. In the new test added, this
+            would actually trigger a crash due to an assumption when visually re-ordering
+            BidiRuns that a non-empty line would actually contain at least one such run.
</ins><span class="cx"> 
</span><del>-        [iOS WK2] background-attachment:fixed behaves very poorly
-        https://bugs.webkit.org/show_bug.cgi?id=132881
-        &lt;rdar://problem/16789526&gt;
</del><ins>+            Test: fast/text/whitespace/whitespace-and-margin-wrap-after-list-marker-crash.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Beth Dakin.
</del><ins>+            * rendering/RenderBlockLineLayout.cpp:
+            (WebCore::checkMidpoints):
</ins><span class="cx"> 
</span><del>-        Remove the old ENABLE_FAST_MOBILE_SCROLLING code, and add a setting that
-        controls whether fixed backgrounds paint relative to the document, which
-        is enabled for iOS (WK1 and WK2). This setting is consulted when we repaint
-        fixed backgrounds on scrolling, when we paint them, and when we decide to make
-        a layer for fixed backgrounds.
-        
-        * page/Settings.cpp:
-        * page/Settings.in:
-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
-        * rendering/RenderElement.cpp:
-        (WebCore::RenderElement::styleWillChange):
-        (WebCore::RenderElement::willBeRemovedFromTree):
-        (WebCore::shouldRepaintFixedBackgroundsOnScroll): Deleted.
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::needsFixedRootBackgroundLayer):
</del><ins>+2013-11-01  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Zalan Bujtas  &lt;zalan@apple.com&gt;
</del><ins>+        Merge r157070
</ins><span class="cx"> 
</span><del>-        REGRESSSION(r168528) Subpixel rendering: Selection rect is not positioned properly when SVG text is selected.
-        https://bugs.webkit.org/show_bug.cgi?id=132868
</del><ins>+    2013-10-04  Ojan Vafai  &lt;ojan@chromium.org&gt; and Martin Robinson  &lt;mrobinson@igalia.com&gt;
</ins><span class="cx"> 
</span><del>-        Reviewed by Dirk Schulze.
</del><ins>+            [MathML] Remove RenderTree modification during layout and refactor the StretchyOp code
+            https://bugs.webkit.org/show_bug.cgi?id=121416
</ins><span class="cx"> 
</span><del>-        Scale the selection rect. r168528 missed applying this final transform on the selection/painting rect.
</del><ins>+            Reviewed by David Hyatt.
</ins><span class="cx"> 
</span><del>-        Test: svg/text/hidpi-text-selection-rect-position.html
</del><ins>+            Tests: mathml/presentation/mo-minus.html
+                mathml/presentation/mo-stacked-glyphs.html
+                mathml/presentation/mo-stretchy-vertical-bar.html
+                mathml/very-large-stretchy-operators.html
</ins><span class="cx"> 
</span><del>-        * rendering/svg/SVGInlineTextBox.cpp:
-        (WebCore::SVGInlineTextBox::selectionRectForTextFragment):
</del><ins>+            MathML stretched operators by both modifying the width of the operator
+            and adding children to the operator node in the render tree.
</ins><span class="cx"> 
</span><del>-2014-05-13  Martin Hodovan  &lt;mhodovan.u-szeged@partner.samsung.com&gt;
</del><ins>+            Instead we make the operator width equal to the widest glyph possible that we use
+            to represent the operator.  Additionally instead of rendering stretchy glyphs via
+            stacked operator pieces in separate render tree nodes, keep only one node for the
+            glyph, and use a custom paint method to paint the stacked representation.
</ins><span class="cx"> 
</span><del>-        ASSERTION FAILED: leftCategory != CalcOther &amp;&amp; rightCategory != CalcOther
-        in WebCore::CSSCalcBinaryOperation::createSimplified
-        https://bugs.webkit.org/show_bug.cgi?id=132870
</del><ins>+            With this patch, rendering seems roughly equivalent on Mac and markedly better
+            on Linux.
</ins><span class="cx"> 
</span><del>-        According to the standard, calc() should be able to handle angle, time
-        and frequency values as well: http://www.w3.org/TR/css3-values/#calc
</del><ins>+            * css/mathml.css:
+            Not sure what this line-height:0 was here for, but it caused bugs with the new code
</ins><span class="cx"> 
</span><del>-        Reviewed by Darin Adler.
</del><ins>+            * mathml/MathMLTextElement.cpp:
+            (WebCore::MathMLTextElement::attach):
+            (WebCore):
+            (WebCore::MathMLTextElement::childrenChanged):
+            Need to update the anonymous render tree below &lt;mo&gt; elements when their
+            children change or when the renderer is first attached.
</ins><span class="cx"> 
</span><del>-        Test: fast/css/calc-with-angle-time-frequency.html
</del><ins>+            * mathml/MathMLTextElement.h:
+            (MathMLTextElement):
+            * rendering/mathml/RenderMathMLBlock.cpp:
+            (WebCore::RenderMathMLBlock::RenderMathMLBlock):
+            * rendering/mathml/RenderMathMLBlock.h:
+            Now that the preferred width doesn't depend on the height, we don't
+            need to override computePreferredLogicalWidths at all.
</ins><span class="cx"> 
</span><del>-        * css/CSSCalculationValue.cpp:
-        (WebCore::unitCategory):
-        (WebCore::CSSCalcPrimitiveValue::createCalcExpression):
-        (WebCore::CSSCalcPrimitiveValue::computeLengthPx):
-        (WebCore::CSSCalcPrimitiveValue::addSubtractResult):
-        (WebCore::CSSCalcPrimitiveValue::determineCategory):
-        (WebCore::CSSCalcBinaryOperation::primitiveType)
-        * css/CSSCalculationValue.h: extending CalculationCategory
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validCalculationUnit):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::primitiveType):
</del><ins>+            * rendering/mathml/RenderMathMLFenced.cpp:
+            (WebCore::RenderMathMLFenced::makeFences):
+            (WebCore::RenderMathMLFenced::styleDidChange):
+            Need to update the anonymous renderers for the anonymous RenderMathMLOperators.
</ins><span class="cx"> 
</span><del>-2014-05-13  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+            * rendering/mathml/RenderMathMLOperator.cpp:
+            (WebCore::RenderMathMLOperator::expandedStretchHeight):
+            Store the non-expanded stretch height so that we can detect when the height
+            actually changed.
</ins><span class="cx"> 
</span><del>-        Try to fix the !ENABLE(ICONDATABASE) build
</del><ins>+            (WebCore::RenderMathMLOperator::stretchToHeight):
+            Only update the style on the anonymous render tree since this is called
+            from RenderMathMLRow::layout
</ins><span class="cx"> 
</span><del>-        * loader/icon/IconDatabase.h: Include WTFString.h.
</del><ins>+            (WebCore::RenderMathMLOperator::styleDidChange):
+            (WebCore::RenderMathMLOperator::glyphBoundsForCharacter): A helper to get glyph boundaries.
+            (WebCore::RenderMathMLOperator::glyphHeightForCharacter): Ditto for glyph width.
+            (WebCore::RenderMathMLOperator::advanceForCharacter): The advance is different from the width,
+            and we want the width of the operator to be the advance instead of the tight bounding width.
+            (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Use the max of all possible glyphs
+            we can use to render this operator.
+            (WebCore::RenderMathMLOperator::computeLogicalHeight): Return the stretched operator height, if appropriate.
+            (WebCore::RenderMathMLOperator::updateFromElement): We add a child for rendering the non-scaled
+            version of the glyph.
+            (WebCore::RenderMathMLOperator::firstCharacterForStretching): Helper to figure out what character
+            is the character used for stretching operations.
+            (WebCore::RenderMathMLOperator::findAcceptableStretchyCharacter): Helper to find an acceptable set
+            of glyph pieces for stretching characters.
+            (WebCore::RenderMathMLOperator::updateStyle): Resize the operator to the appropriate height and hide
+            the child if we are using the stretchy style.
+            (WebCore::RenderMathMLOperator::firstLineBoxBaseline):
+            (WebCore::RenderMathMLOperator::paintCharacter): Helper to paint a single character component of the
+            stretchy glyph.
+            (WebCore::RenderMathMLOperator::fillWithExtensionGlyph): Helper to paint the extender glue between
+            features of the stretchy glyph.
+            (WebCore::RenderMathMLOperator::paint): Properly paint stretchy glyphs.
+            * rendering/mathml/RenderMathMLOperator.h: Update method declarations.
</ins><span class="cx"> 
</span><del>-2014-05-13  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</del><ins>+2013-11-01  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        REGRESSION(r167771): [GTK] Text fields and areas are rendered unthemed
-        https://bugs.webkit.org/show_bug.cgi?id=132864
</del><ins>+        Merge r158334
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+    2013-10-30  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        This is because the virtual methods changed the API in the parent,
-        and since we don't have the methods marked as override we didn't
-        noticed it. After using override keyword for all virtual methods
-        in the derived class another problem showed up, the ActiveListBox
-        selection methods were incorrectly named.
</del><ins>+            [Win] Legible Output callbacks should happen on notification queue
+            https://bugs.webkit.org/show_bug.cgi?id=123545
</ins><span class="cx"> 
</span><del>-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::paintTextArea): Update to API changes in the
-        parent class.
-        * platform/gtk/RenderThemeGtk.h: Mark all virtual methods as
-        override and the class as final.
-        * platform/gtk/RenderThemeGtk2.cpp:
-        (WebCore::RenderThemeGtk::paintTextField): Update to API changes
-        in the parent class.
-        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeGtk::activeListBoxSelectionBackgroundColor): Deleted.
-        (WebCore::RenderThemeGtk::inactiveListBoxSelectionBackgroundColor): Deleted.
-        (WebCore::RenderThemeGtk::activeListBoxSelectionForegroundColor): Deleted.
-        (WebCore::RenderThemeGtk::inactiveListBoxSelectionForegroundColor): Deleted.
-        * platform/gtk/RenderThemeGtk3.cpp:
-        (WebCore::RenderThemeGtk::paintTextField): Update to API changes
-        in the parent class.
-        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor):
-        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor):
-        (WebCore::RenderThemeGtk::activeListBoxSelectionBackgroundColor): Deleted.
-        (WebCore::RenderThemeGtk::inactiveListBoxSelectionBackgroundColor): Deleted.
-        (WebCore::RenderThemeGtk::activeListBoxSelectionForegroundColor): Deleted.
-        (WebCore::RenderThemeGtk::inactiveListBoxSelectionForegroundColor): Deleted.
</del><ins>+            Reviewed by Eric Carlson.
</ins><span class="cx"> 
</span><del>-2014-05-13  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt;
</del><ins>+            Modify the callback creation for Legible Output items so that they
+            are made on our notification queue. The use of the main queue was a
+            holdover from some temporary code used during earlier development.
</ins><span class="cx"> 
</span><del>-        [GStreamer] Move toGstClockTime to utilities
-        https://bugs.webkit.org/show_bug.cgi?id=132702
</del><ins>+            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+            (WebCore::AVFWrapper::AVFWrapper): Assert this happens on the main thread.
+            (WebCore::AVFWrapper::~AVFWrapper): Ditto.
+            (WebCore::destroyAVFWrapper): Ditto.
+            (WebCore::AVFWrapper::createPlayer): Ditto.
+            (WebCore::AVFWrapper::createPlayerItem): Ditto.
+            Also, instruct LegibleOutput callbacks to happen on our notification
+            queue, rather than the main thread.
+            (WebCore::AVFWrapper::createAVCFVideoLayer): Assert this happens on the main thread.
+            (WebCore::AVFWrapper::destroyVideoLayer): Ditto.
+            (WebCore::AVFWrapper::createImageGenerator): Ditto.
+            (WebCore::AVFWrapper::destroyImageGenerator): Ditto.
</ins><span class="cx"> 
</span><del>-        Reviewed by Philippe Normand.
</del><ins>+2013-10-31  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        toGstClockTime should be in GStreamerUtilities and corrected typo
-        in getGstPlayFlag.
</del><ins>+        Merge r157183
</ins><span class="cx"> 
</span><del>-        No new tests needed.
</del><ins>+    2013-10-09  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * platform/graphics/gstreamer/GStreamerUtilities.cpp:
-        (WebCore::getGstPlayFlag): Renamed from getGstPlaysFlag.
-        (WebCore::toGstClockTime): Moved from MediaPlayerPrivateGStreamer.
-        (WebCore::getGstPlaysFlag): Deleted.
-        * platform/graphics/gstreamer/GStreamerUtilities.h:
-        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::MediaPlayerPrivateGStreamer::setDownloadBuffering):
-        Corrected getGstPlayFlag typo.
-        (WebCore::toGstClockTime): Deleted.
</del><ins>+            AX: VoiceOver double speaks all items in &lt;li&gt; nodes
+            https://bugs.webkit.org/show_bug.cgi?id=122564
</ins><span class="cx"> 
</span><del>-2014-05-12  Darin Adler  &lt;darin@apple.com&gt;
</del><ins>+            Reviewed by Brent Fulgham.
</ins><span class="cx"> 
</span><del>-        Make a few icon database improvements
-        https://bugs.webkit.org/show_bug.cgi?id=132812
</del><ins>+            Test: platform/mac/accessibility/native-list-item-should-not-expose-label.html
</ins><span class="cx"> 
</span><del>-        Reviewed by Brady Eidson.
</del><ins>+            * accessibility/AccessibilityNodeObject.cpp:
+            (WebCore::AccessibilityNodeObject::visibleText):
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in: Export more IconDatabase functions, since they are now called
-        by WebKit2 through pointers to a class marked final.
</del><ins>+2013-10-31  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/icon/IconDatabase.cpp: Removed unneeded includes. Use override for
-        virtual functions.
</del><ins>+        Merge r157056
</ins><span class="cx"> 
</span><del>-        * loader/icon/IconDatabase.h: Removed unneeded includes. Marked the class final.
-        Use override for virtual functions. Use a public constructor instead of a create
-        function.
</del><ins>+    2013-10-07  Tim Horton  &lt;timothy_horton@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * loader/icon/IconDatabaseBase.h: Removed unneeded includes.
</del><ins>+            Animated images are not restarted when page visibility changes
+            https://bugs.webkit.org/show_bug.cgi?id=122464
+            &lt;rdar://problem/14293474&gt;
</ins><span class="cx"> 
</span><del>-2014-05-13  Kiran  &lt;kiran.guduru@samsung.com&gt;
</del><ins>+            Reviewed by Simon Fraser.
</ins><span class="cx"> 
</span><del>-        [MediaStream] MediaStream.addTrack Should not check for active state.
-        https://bugs.webkit.org/show_bug.cgi?id=132558
</del><ins>+            Always kickstart animated images when the page visibility changes,
+            which can occur via window occlusion, and which is independent of in-window
+            state, which we were previously using to advance animation.
</ins><span class="cx"> 
</span><del>-        Reviewed by Eric Carlson.
</del><ins>+            No new tests; attempts to make a test have resulted only in a flaky, timing-dependent test.
</ins><span class="cx"> 
</span><del>-        MediaStream.addTrack method is checking for active state of a
-        MediaStream, but it should not check for active state while adding a Track.
</del><ins>+            * page/Frame.cpp:
+            (WebCore::Frame::resumeActiveDOMObjectsAndAnimations):
+            Move this call to resumeAnimatingImages() up to Page.
</ins><span class="cx"> 
</span><del>-        Test: fast/mediastream/MediaStream-add-tracks-to-inactive-stream.html
</del><ins>+            * page/FrameView.cpp:
+            (WebCore::FrameView::setIsInWindow):
+            Move this call to resumeAnimatingImages() up to Page.
</ins><span class="cx"> 
</span><del>-        * Modules/mediastream/MediaStream.cpp:
-        (WebCore::MediaStream::addTrack):
</del><ins>+            * WebCore.exp.in
+            * page/FrameView.h:
+            * page/Page.h:
+            Move resumeAnimatingImages() itself up to Page.
</ins><span class="cx"> 
</span><del>-2014-05-12  Mark Lam  &lt;mark.lam@apple.com&gt;
</del><ins>+            * page/Page.cpp:
+            (WebCore::Page::setIsInWindow):
+            Resume animated images when we move in-window.
</ins><span class="cx"> 
</span><del>-        WebKit2 on iOS needs to capture the main thread's floating point environment.
-        &lt;https://webkit.org/b/132755&gt;
</del><ins>+            (WebCore::Page::setVisibilityState):
+            Resume animated images when we become visible.
+            This is the one we were previously missing.
</ins><span class="cx"> 
</span><del>-        Reviewed by Geoffrey Garen.
</del><ins>+            (WebCore::Page::resumeActiveDOMObjectsAndAnimations):
+            Resume animated images when we're told to.
</ins><span class="cx"> 
</span><del>-        For iOS, WorkerThread::workerThread() expects to be able to initialize the
-        worker thread's floating point environment to be the same as the one in the
-        main thread.  The FP env of the main thread is expected to have been captured
-        in the mainThreadFEnv global.  On WebKit2 for iOS, we neglected to initialize
-        mainThreadFEnv.
</del><ins>+            (WebCore::Page::resumeAnimatingImages):
+            Kickstart any animated images in all frames.
</ins><span class="cx"> 
</span><del>-        We now introduce a FloatingPointEnvironment class that will encapsulate the main
-        thread (aka &quot;UIThread&quot;) fenv, and we'll call FloatingPointEnv::saveMainThreadEnvironment()
-        from ChildProcess::platformInitialize() to ensure that the FloatingPointEnvironment
-        singleton instance is initialized properly for WebKit2.
</del><ins>+2013-10-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        In the ChildProcess::platformInitialize(), we also need to initialize the ARMv7
-        FP env to support denormalized numbers.  We'll do this before calling
-        saveMainThreadEnvironment().
</del><ins>+        
+        Merge r155221.
</ins><span class="cx"> 
</span><del>-        Tests: fast/workers/worker-floating-point.html
-               js/floating-point-denormalized.html
</del><ins>+ 
+    2013-09-06  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        * WebCore.exp.in:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/ios/wak/FloatingPointEnvironment.cpp: Added.
-        (WebCore::FloatingPointEnvironment::env):
-        (WebCore::FloatingPointEnvironment::FloatingPointEnvironment):
-        (WebCore::FloatingPointEnvironment::enableDenormalSupport):
-        (WebCore::FloatingPointEnvironment::saveMainThreadEnvironment):
-        (WebCore::FloatingPointEnvironment::propagateMainThreadEnvironment):
-        * platform/ios/wak/FloatingPointEnvironment.h: Added.
-        * platform/ios/wak/WebCoreThread.h:
-        * platform/ios/wak/WebCoreThread.mm:
-        (RunWebThread):
-        (StartWebThread):
-        * workers/WorkerThread.cpp:
-        (WebCore::WorkerThread::workerThread):
</del><ins>+            [Windows] StructuredExceptionHandlerSuppressor Causes Bad Interactions with Support Libraries
+            https://bugs.webkit.org/show_bug.cgi?id=120901
</ins><span class="cx"> 
</span><del>-2014-05-12  Dirk Schulze  &lt;krit@webkit.org&gt;
</del><ins>+            Reviewed by Anders Carlsson.
</ins><span class="cx"> 
</span><del>-        SVG root element accepts background color but fails to repaint it
-        https://bugs.webkit.org/show_bug.cgi?id=63153
</del><ins>+            Change from old &quot;crash on any exception&quot; implementation to a new version that leaves normal
+            exception handling infrastructure in place for use by support libraries. We check exceptions
+            and decide whether to abort or not based on the failure type.
</ins><span class="cx"> 
</span><del>-        Reviewed by Dean Jackson.
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Add new implementation files.
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
+            * platform/graphics/ca/win/LayerChangesFlusher.cpp:
+            (WebCore::LayerChangesFlusher::hookCallback): Allocate handler struct on stack.
+            * platform/win/StructuredExceptionHandlerSuppressor.cpp: Added.
+            (exceptionShouldTerminateProgram): New.
+            (exceptionHandler): New.
+            (WebCore::StructuredExceptionHandlerSuppressor::StructuredExceptionHandlerSuppressor): Moved
+            from header, and updated to add our new exception handler.
+            (WebCore::StructuredExceptionHandlerSuppressor::~StructuredExceptionHandlerSuppressor): Moved
+            from header.
+            * platform/win/StructuredExceptionHandlerSuppressor.h: Move implementation of constructor and
+            destructor from header file.
+            * platform/win/makesafeseh.asm: Added.
</ins><span class="cx"> 
</span><del>-        This is back ported from Blink. Don't know the exact commit though.
-        The patch checks if the SVGSVGElement is an outermost root element.
-        If it is, mark the whole element for repaint.
</del><ins>+2013-10-28  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Test: svg/custom/svg-root-background.html
</del><ins>+        Merge r155215.
</ins><span class="cx"> 
</span><del>-        * rendering/RenderBoxModelObject.cpp:
-        (WebCore::RenderBoxModelObject::calculateHasBoxDecorations):
-        (WebCore::RenderBoxModelObject::updateFromStyle):
-        * rendering/RenderBoxModelObject.h:
-        * rendering/svg/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::RenderSVGRoot):
-        (WebCore::RenderSVGRoot::layout):
-        (WebCore::RenderSVGRoot::paintReplaced):
-        (WebCore::RenderSVGRoot::clippedOverflowRectForRepaint):
-            This is a simple optimization by taking the necessary parts
-            from RenderReplaced and SVGRenderSupport.
-        * rendering/svg/RenderSVGRoot.h:
</del><ins>+     2013-09-06  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-12  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</del><ins>+            [Windows] Unreviewed gardening: Spell 'Suppressor' properly
</ins><span class="cx"> 
</span><del>-        [iOS] Fixed items are sometimes clipped after rubber-banding
-        https://bugs.webkit.org/show_bug.cgi?id=132851
-        &lt;rdar://problem/16870790&gt;
</del><ins>+            * WebCore.vcxproj/WebCore.vcxproj: Change StructuredExceptionHandlerSupressor to StructuredExceptionHandlerSuppressor
+            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto
+            * platform/graphics/ca/win/LayerChangesFlusher.cpp:
+            (WebCore::LayerChangesFlusher::hookCallback): Ditto
+            * platform/win/StructuredExceptionHandlerSuppressor.h: Copied from platform/win/StructuredExceptionHandlerSupressor.h.
+            * platform/win/StructuredExceptionHandlerSupressor.h: Removed.
</ins><span class="cx"> 
</span><del>-        Reviewed by Benjamin Poulain.
</del><ins>+2013-10-28  Lucas Forschler  &lt;lforschler@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        On iOS fixed-position layers would get clipped to the document rect,
-        but with rubber-banding, we can now have a custom fixed postion rect
-        that extends outside the document rect.
-        
-        Another issue was that we would un-composite fixed elements sometimes
-        when scrolling fast, again because they could fall outside of the document rect.
-        
-        A final issue was that pinching could reveal parts of fixed elements that should
-        lie outside the viewport, rather than clipping the layers.
-        
-        Fix by converting both call points to use viewportConstrainedVisibleContentRect()
-        rather than viewportConstrainedExtentRect(). On non-iOS platforms these are
-        the same, but on iOS viewportConstrainedVisibleContentRect() uses the
-        custom fixed position rect, which is the correct rect to intersect with.
</del><ins>+        Merge r157298
</ins><span class="cx"> 
</span><del>-        * rendering/RenderLayerBacking.cpp:
-        (WebCore::RenderLayerBacking::updateCompositedBounds):
-        * rendering/RenderLayerCompositor.cpp:
-        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
</del><ins>+    2013-10-10  Dean Jackson  &lt;dino@apple.com&gt;
</ins><span class="cx"> 
</span><del>-2014-05-06  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</del><ins>+            Use after free in WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded
+            http://webkit.org/b/121033
</ins><span class="cx"> 
</span><del>-        Don't dispatch 'beforeload' event inside FrameView::layout()
</del><ins>+            Reviewed by Darin Adler.
</ins><span class="cx"> 
</span><del>-        https://bugs.webkit.org/show_bug.cgi?id=132621
-        &lt;rdar://problem/15661470&gt;
</del><ins>+            Add an ASSERT to detect if an animation client will be removed
+            during the callback dispatch.
</ins><span class="cx"> 
</span><del>-        This merges Blink revision 162073 with minor renaming and style
-        changes. From that commit:
</del><ins>+            Test: fast/animation/request-animation-frame-remove-client.html
</ins><span class="cx"> 
</span><del>-        Executing JavaScript code inside FrameView::layout() is problematic.
-