NPObjectWrapper may not address all window script object lifetime issues
https://bugs.webkit.org/show_bug.cgi?id=85679

Source/WebCore:

The ScriptController implementations force-deallocate the window script object to ensure that DOM objects are not leaked if an NPAPI plugin fails to release a reference to it before being destroyed. The NPObjectWrapper was added to ensure that NPAPI scripting could not touch the real window script object after it had been deallocated, by providing the plugin with a small wrapper which will leak if the plugin fails to dereference it.

This patch removes NPObjectWrapper and instead drops the window script NPObject's reference to the underlying V8Object in ScriptController::clearScriptObjects(). If a plugin fails to dereference the object then the NPV8Object wrapper will be leaked but the DOM objects it references will not.

Patch by James Weatherall <wez@chromium.org> on 2012-06-29
Reviewed by Nate Chapin.

Test: plugins/npruntime/leak-window-scriptable-object.html

* WebCore.gypi:
* bindings/v8/NPObjectWrapper.cpp: Removed.
* bindings/v8/NPObjectWrapper.h: Removed.
* bindings/v8/NPV8Object.cpp:
(WebCore::disposeUnderlyingV8Object):
(WebCore):
(WebCore::freeV8NPObject):
(_NPN_Invoke):
(_NPN_InvokeDefault):
(_NPN_EvaluateHelper):
(_NPN_GetProperty):
(_NPN_SetProperty):
(_NPN_RemoveProperty):
(_NPN_HasProperty):
(_NPN_HasMethod):
(_NPN_Enumerate):
(_NPN_Construct):
* bindings/v8/NPV8Object.h:
(WebCore):
* bindings/v8/ScriptController.cpp:
(WebCore::ScriptController::ScriptController):
(WebCore::ScriptController::clearScriptObjects):
(WebCore::ScriptController::windowScriptNPObject):
* bindings/v8/ScriptController.h:
(ScriptController):

Tools:

TestNetscapePlugin now has a leak-window-scriptable-object test which takes a reference to the window script object, and a second reference to it via the "self" property, and does not release those references. This is used to simulate a leaky plugin in layout tests of the NPAPI scripting interface glue code.

Patch by James Weatherall <wez@chromium.org> on 2012-06-29
Reviewed by Nate Chapin.

* DumpRenderTree/DumpRenderTree.gypi:
* DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
(PluginTest::NPN_GetProperty):
* DumpRenderTree/TestNetscapePlugIn/PluginTest.h:
(PluginTest):
* DumpRenderTree/TestNetscapePlugIn/Tests/LeakWindowScriptableObject.cpp: Added.
(LeakWindowScriptableObject):
(LeakWindowScriptableObject::LeakWindowScriptableObject):
(LeakWindowScriptableObject::NPP_New):

LayoutTests:

Test that NPAPI plugins that leak references to the window script object don't cause the containing document to be leaked.

Patch by James Weatherall <wez@chromium.org> on 2012-06-29
Reviewed by Nate Chapin.

* plugins/npruntime/leak-window-scriptable-object-expected.txt: Added.
* plugins/npruntime/leak-window-scriptable-object.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121610 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Allow align-self: stretch to cause the item size to shrink below its intrinsic size
https://bugs.webkit.org/show_bug.cgi?id=90304

Reviewed by Ojan Vafai.

Source/WebCore:

The spec used to say that stretch could only make items grow, but now
it allows items to shrink.
http://dev.w3.org/csswg/css3-flexbox/#align-items-stretch

Tests: css3/flexbox/flex-align-stretch.html Updated expectations.
       css3/flexbox/child-overflow.html Updated expectations.

* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::applyStretchAlignmentToChild):

LayoutTests:

* css3/flexbox/child-overflow-expected.html:
* css3/flexbox/child-overflow.html:
* css3/flexbox/flex-align-stretch.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121611 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: Keep direction on IDBCursor to avoid calls to back end
https://bugs.webkit.org/show_bug.cgi?id=90114

Source/WebCore:

Reviewed by Tony Chang.

Let IDBCursor handle direction() accessor locally, without a call to
the IDBCursorBackendImpl which (in some ports) may reside in a different
process. Not a heavily called function, but further reduces the surface
area exposed by the XXXInterface classes.

No new tests - no functional changes.

* Modules/indexeddb/IDBCursor.cpp:
(WebCore::IDBCursor::create): Accept direction, known at creation time.
(WebCore::IDBCursor::IDBCursor): Stash in member.
(WebCore::IDBCursor::direction): Use local copy
(WebCore::IDBCursor::stringToDirection): Return enum value, not int.
* Modules/indexeddb/IDBCursor.h:
(IDBCursor):
* Modules/indexeddb/IDBCursorBackendImpl.cpp: Remove accessor.
* Modules/indexeddb/IDBCursorBackendImpl.h:
(IDBCursorBackendImpl):
* Modules/indexeddb/IDBCursorBackendInterface.h: Remove accessor.
* Modules/indexeddb/IDBCursorWithValue.cpp:
(WebCore::IDBCursorWithValue::create):
(WebCore::IDBCursorWithValue::IDBCursorWithValue):
* Modules/indexeddb/IDBCursorWithValue.h:
(IDBCursorWithValue):
* Modules/indexeddb/IDBIndex.cpp: Prep IDBRequest with cursor direction too.
(WebCore::IDBIndex::openCursor):
(WebCore::IDBIndex::openKeyCursor):
* Modules/indexeddb/IDBObjectStore.cpp: Ditto.
(WebCore::IDBObjectStore::openCursor):
* Modules/indexeddb/IDBRequest.cpp: Stash direction for pending cursor too.
(WebCore::IDBRequest::IDBRequest):
(WebCore::IDBRequest::setCursorDetails):
(WebCore::IDBRequest::onSuccess): Apply stashed direction to new cursor.
* Modules/indexeddb/IDBRequest.h:
(IDBRequest):

Source/WebKit/chromium:

Stop plumbing IDBCursorBackendInterface::direction() through API.

Reviewed by Tony Chang.

* src/IDBCursorBackendProxy.cpp:
* src/IDBCursorBackendProxy.h:
(IDBCursorBackendProxy):
* src/WebIDBCursorImpl.cpp:
* src/WebIDBCursorImpl.h:
(WebIDBCursorImpl):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121612 268f45cc-cd09-0410-ab3c-d52691b4dbfc
All child elements of a flex container should be turned into a flex item
https://bugs.webkit.org/show_bug.cgi?id=90323

Reviewed by Ojan Vafai.

Source/WebCore:

We used to only convert some elements to blocks, but now we convert everything except text nodes.
This was recently changed here:
http://wiki.csswg.org/topics/css3-flexbox-flexbox-replaced-children

Tests: css3/flexbox/anonymous-block.html : Add new test case.
       css3/flexbox/flexitem.html: Update results.

* css/StyleResolver.cpp:
(WebCore::StyleResolver::collectMatchingRulesForList):

LayoutTests:

* css3/flexbox/anonymous-block-expected.html:
* css3/flexbox/anonymous-block.html:
* css3/flexbox/flexitem-expected.txt:
* css3/flexbox/flexitem.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121613 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix layout test runner for Android after https://bugs.webkit.org/show_bug.cgi?id=88134
https://bugs.webkit.org/show_bug.cgi?id=90309

Patch by Yaron Friedman <yfriedman@chromium.org> on 2012-06-29
Reviewed by Adam Barth.

* Scripts/webkitpy/layout_tests/port/chromium_android.py:
(ChromiumAndroidPort.start_http_server):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121614 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] HTMLCollection wrappers are not retained
https://bugs.webkit.org/show_bug.cgi?id=90208

Reviewed by Adam Barth.

Source/WebCore:

Generate visitDOMWrapper for HTMLCollection and HTMLAllCollection so that we add an implicit reference from the owner
to the collection.

Tests: fast/dom/htmlallcollection-reachable.html
       fast/dom/htmlcollection-reachable.html

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation): Instead of hard coding to use base() for HTMLAllCollection and HTMLCollection we now
annotate the IDL file to use GenerateIsReachable=ImplBaseRoot.
* bindings/scripts/CodeGeneratorV8.pm:
(GenerateVisitDOMWrapper): Generate visitDOMWrapper if GenerateIsReachable is ImplBaseRoot.
* bindings/scripts/IDLAttributes.txt: Added ImplBaseRoot.
* html/HTMLAllCollection.idl: Added annotations.
* html/HTMLCollection.idl: Ditto.

LayoutTests:

* fast/dom/htmlallcollection-reachable-expected.txt: Added.
* fast/dom/htmlallcollection-reachable.html: Added.
* fast/dom/htmlcollection-reachable-expected.txt: Added.
* fast/dom/htmlcollection-reachable.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121615 268f45cc-cd09-0410-ab3c-d52691b4dbfc
updateDescendantDependentFlags() is inside #if USE(ACCELERATED_COMPOSITING)
https://bugs.webkit.org/show_bug.cgi?id=90245

Reviewed by Dan Bernstein.

updateDescendantDependentFlags() and updateTransform() should be
outside the USE(ACCELERATED_COMPOSITING) #ifdef. They do work
that is needed even if accelerated compositing is disabled.

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::styleChanged):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121616 268f45cc-cd09-0410-ab3c-d52691b4dbfc
garden-o-matic broken: TypeError: 'undefined' is not an object (evaluating 'buildLocations[currentIndex].url')
https://bugs.webkit.org/show_bug.cgi?id=90243

Reviewed by Dirk Pranke.

jQuery was trying to be too smart and parsing the jsonp as json because of it's content-type.
Excise jQuery and just use XHR directly since it's easier to maintain something where we control it
all.

Not really sure how to unittest this. I tested it all manually of course.

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/net.js:
Made net.ajax a drop-in replacement for the features of $.ajax that we were using.
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui_unittests.js:
Not related to this patch, but figured I'd update the failing test while I was at it.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121617 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r121569.
http://trac.webkit.org/changeset/121569
https://bugs.webkit.org/show_bug.cgi?id=90082

It broke a couple of tests in Qt Linux Release


* platform/graphics/qt/GraphicsContextQt.cpp:
(WebCore::GraphicsContext::fillRect):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121618 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove leopard bots from garden-o-matic
https://bugs.webkit.org/show_bug.cgi?id=90328

Reviewed by Adam Barth.

* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures_unittests.js:
* BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/notifications_unittests.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121619 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt][WK2] Private non-QtQuick API
https://bugs.webkit.org/show_bug.cgi?id=84532

.:

Patch by Luiz Agostini <luiz.agostini@nokia.com> on 2012-06-29
Reviewed by Noam Rosenthal.

API tests for QRawWebView.

* Source/tests.pri:

Source/WebKit2:

Patch by Luiz Agostini <luiz.agostini@nokia.com> on 2012-06-29
Reviewed by Noam Rosenthal.

Adding new private non-QtQuick API. This new C++ API makes it possible
to have control over the lower levels of WebKit without going via QML.

This is a first version of the API, enough to show pages on the screen.
Many features are not implemented.

* Target.pri:
* UIProcess/API/qt/raw/qrawwebview.cpp: Added.
* UIProcess/API/qt/raw/qrawwebview_p.h: Added.
* UIProcess/API/qt/raw/qrawwebview_p_p.h: Added.

The tests for the new API are pixel tests. They use QRawWebView to load
html files and generate images, and them compare those images to the ones
in UIProcess/API/qt/tests/html/resources.

* UIProcess/API/qt/tests/html/bluesquare.html: Added.
* UIProcess/API/qt/tests/html/redsquare.html: Added.
* UIProcess/API/qt/tests/html/resources/qwkview_noBackground1.png: Added.
* UIProcess/API/qt/tests/html/resources/qwkview_noBackground3.png: Added.
* UIProcess/API/qt/tests/html/resources/qwkview_paint.png: Added.
* UIProcess/API/qt/tests/qrawwebview/qrawwebview.pro: Added.
* UIProcess/API/qt/tests/qrawwebview/tst_qrawwebview.cpp: Added.

Tools:

MiniBrowserRaw is an usage example for the QRawWebView API.
It is only an example and is not fully implemented.

Patch by Luiz Agostini <luiz.agostini@nokia.com> on 2012-06-29
Reviewed by Noam Rosenthal.

* MiniBrowser/qt/raw/DerivedSources.pri: Added.
* MiniBrowser/qt/raw/MiniBrowserRaw.pro: Added.
* MiniBrowser/qt/raw/Target.pri: Added.
* MiniBrowser/qt/raw/View.cpp: Added.
* MiniBrowser/qt/raw/View.h: Added.
* Scripts/webkitpy/style/checker.py:
* Tools.pro:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121620 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a cold-boot.sh script for the EWS
https://bugs.webkit.org/show_bug.cgi?id=90330

Unreviewed.

* EWSTools/cold-boot.sh: Added.
    - This script can take us from a cold GCE instance to a running EWS
      bot in one fell swoop.
* EWSTools/start-queue.sh:
    - The if-block at the top of this script was causing trouble. I
      removed it from the bots a while ago. Now that we're using SVN to
      cold-boot the EWS bots, we need to make this change in the repo.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121621 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Turns out we need zip too.

* EWSTools/cold-boot.sh:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121622 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Remove unused declaration.
HTMLDocumentParser::begin() has no method definition.

* html/parser/HTMLDocumentParser.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121623 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening, updating baselines after r121599.

* platform/gtk/fast/transforms/bounding-rect-zoom-expected.txt: Added.
* platform/gtk/http/tests/misc/object-embedding-svg-delayed-size-negotiation-2-expected.txt:
* platform/gtk/svg/zoom/page/zoom-img-preserveAspectRatio-support-1-expected.txt:
* platform/gtk/svg/zoom/page/zoom-replaced-intrinsic-ratio-001-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121624 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK and EFL gardening, adding image expectation
for the failing css3/flexbox/anonymous-block.html test.

* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121625 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Allow surface resizing for use cases other than rotation.
https://bugs.webkit.org/show_bug.cgi?id=90295
RIM PR 171459

Reviewed by George Staikos.

A new API method setHasPendingSurfaceSizeChange() is
introduced for that effect, and used inside of
setViewportSize() to let the WebPageClient do the
resizing. Methods are renamed to reflect that this
is not exclusively meant for rotation anymore.

* Api/WebPage.cpp:
(BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
(BlackBerry::WebKit::WebPage::setScreenOrientation):
(WebKit):
(BlackBerry::WebKit::WebPage::setHasPendingSurfaceSizeChange):
(BlackBerry::WebKit::WebPagePrivate::resizeSurfaceIfNeeded):
(BlackBerry::WebKit::WebPagePrivate::setViewportSize):
* Api/WebPage.h:
* Api/WebPageClient.h:
* Api/WebPage_p.h:
(WebPagePrivate):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121626 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r121605.
http://trac.webkit.org/changeset/121605
https://bugs.webkit.org/show_bug.cgi?id=90336

Changes caused flaky crashes in sputnik/Unicode tests on Apple
WK1 and GTK Linux builders

* interpreter/Interpreter.cpp:
(JSC::Interpreter::privateExecute):
* jit/JIT.cpp:
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
* jit/JITInlineMethods.h:
(JSC::JIT::emitAllocateBasicJSObject):
(JSC::JIT::emitAllocateJSFinalObject):
(JSC):
(JSC::JIT::emitAllocateJSFunction):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_new_func):
(JSC::JIT::emitSlow_op_new_func):
(JSC):
(JSC::JIT::emit_op_new_func_exp):
(JSC::JIT::emitSlow_op_new_func_exp):
* runtime/JSFunction.cpp:
(JSC::JSFunction::finishCreation):
* runtime/JSObject.h:
(JSC::JSObject::isUsingInlineStorage):
(JSObject):
(JSC::JSObject::finishCreation):
(JSC):
(JSNonFinalObject):
(JSC::JSNonFinalObject::JSNonFinalObject):
(JSC::JSNonFinalObject::finishCreation):
(JSFinalObject):
(JSC::JSFinalObject::finishCreation):
(JSC::JSObject::offsetOfInlineStorage):
(JSC::JSObject::setPropertyStorage):
(JSC::Structure::isUsingInlineStorage):
(JSC::JSObject::putDirectInternal):
(JSC::JSObject::putDirectWithoutTransition):
(JSC::JSObject::transitionTo):
* runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC):
(JSC::Structure::growPropertyStorageCapacity):
(JSC::Structure::suggestedNewPropertyStorageSize):
* runtime/Structure.h:
(JSC::Structure::shouldGrowPropertyStorage):
(JSC::Structure::propertyStorageSize):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121627 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] CanvasLayerTextureUpdater needs to convert opaque rects back to content space.
https://bugs.webkit.org/show_bug.cgi?id=90092

The CanvasLayerTextureUpdater currently receives its opaque rects in
layer space, but is expected to return them in content space and does
not convert them. This patch adds this conversion. To avoid numerical
errors, this patch also switches to using float rects to store opaque
rects where appropriate.

Patch by Ian Vollick <vollick@chromium.org> on 2012-06-30
Reviewed by Adrienne Walker.

Source/Platform:

* chromium/public/WebContentLayerClient.h:
(WebKit):
(WebContentLayerClient):

Source/WebCore:

Unit test: ContentLayerTest.ContentLayerPainterWithDeviceScale

* platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
(WebCore::CanvasLayerTextureUpdater::paintContents):
* platform/graphics/chromium/ContentLayerChromium.cpp:
(WebCore::ContentLayerPainter::ContentLayerPainter):
(WebCore::ContentLayerPainter::create):
(WebCore::ContentLayerPainter::paint):
* platform/graphics/chromium/ContentLayerChromium.h:
(WebCore):
(ContentLayerDelegate):
(ContentLayerPainter):
* platform/graphics/chromium/LayerPainterChromium.h:
(WebCore):
(LayerPainterChromium):
* platform/graphics/chromium/LinkHighlight.cpp:
(WebCore::LinkHighlight::paintContents):
* platform/graphics/chromium/LinkHighlight.h:
(LinkHighlight):
* platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
(WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
* platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
(OpaqueRectTrackingContentLayerDelegate):
* platform/graphics/chromium/ScrollbarLayerChromium.cpp:

Source/WebKit/chromium:

* WebKit.gypi:
* src/WebContentLayerImpl.cpp:
(WebKit::WebContentLayerImpl::paintContents):
* src/WebContentLayerImpl.h:
(WebContentLayerImpl):
* tests/CCLayerTreeHostCommonTest.cpp:
* tests/CCLayerTreeHostTest.cpp:
(WTF::TestOpacityChangeLayerDelegate::paintContents):
(WTF::MockContentLayerDelegate::paintContents):
* tests/ContentLayerChromiumTest.cpp: Added.
(WebKit):
(OpaqueRectDrawingGraphicsContextPainter):
(WebKit::OpaqueRectDrawingGraphicsContextPainter::OpaqueRectDrawingGraphicsContextPainter):
(WebKit::OpaqueRectDrawingGraphicsContextPainter::~OpaqueRectDrawingGraphicsContextPainter):
(MockContentLayerDelegate):
(WebKit::MockContentLayerDelegate::MockContentLayerDelegate):
(WebKit::TEST):
* tests/LayerChromiumTest.cpp:
* tests/OpaqueRectTrackingContentLayerDelegateTest.cpp:
(WebCore::TEST_F):
* tests/TiledLayerChromiumTest.cpp:
* tests/WebLayerTest.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121628 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Webkit crashes in DFG on Google Docs when creating a new document
https://bugs.webkit.org/show_bug.cgi?id=90209

Source/JavaScriptCore: 

Reviewed by Gavin Barraclough.
        
Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a
captured variable.

* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::mergeBlocks):

LayoutTests: 

Reviewed by Gavin Barraclough.

* fast/js/dfg-cfg-simplify-phantom-get-local-on-same-block-set-local-expected.txt: Added.
* fast/js/dfg-cfg-simplify-phantom-get-local-on-same-block-set-local.html: Added.
* fast/js/script-tests/dfg-cfg-simplify-phantom-get-local-on-same-block-set-local.js: Added.
(baz):
(stuff):
(foo):
(o.g):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121629 268f45cc-cd09-0410-ab3c-d52691b4dbfc