[BlackBerry] Fix crash in InputHandler
https://bugs.webkit.org/show_bug.cgi?id=88808

Patch by Crystal Zhang <haizhang@rim.com> on 2012-06-12
Reviewed by Antonio Gomes.

m_page is destroyed before InputHandler, so should move the call to destroy popup to chromeDestroyed().

* WebCoreSupport/ChromeClientBlackBerry.cpp:
(WebCore::ChromeClientBlackBerry::chromeDestroyed():
* WebKitSupport/InputHandler.cpp:
(BlackBerry::WebKit::InputHandler::~InputHandler):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120091 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Support !ENABLE(VIDEO) builds with horizontally layed out video controls.
https://bugs.webkit.org/show_bug.cgi?id=88881

Patch by Silvia Pfeiffer <silviapf@chromium.org> on 2012-06-12
Reviewed by Csaba Osztrogonác.

No new tests as this is a regression from WK87835.

* html/shadow/SliderThumbElement.cpp:
(WebCore::hasVerticalAppearance):
Ifdef out video related functionality, since usesVerticalVolumeSlider
does not exist in that case.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120092 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make document.documentURI readonly from JavaScript
https://bugs.webkit.org/show_bug.cgi?id=65187

Patch by Mike West <mkwst@chromium.org> on 2012-06-12
Reviewed by Alexey Proskuryakov.

Source/WebCore:

The DOM4 working draft marks the documentURI attribute as read only
(http://www.w3.org/TR/dom/#document). Firefox has shipped with this
behavior since https://hg.mozilla.org/mozilla-central/rev/3bc751906409
landed in October 2011, IE9 doesn't support the property, and
Opera throws a NO_MODIFICATION_ALLOWED_ERR. This patch changes WebKit
to silently fail (matching Firefox's behavior) by setting the property
to readonly in the IDL.

Document::setDocumentURI and the m_documentURI property are retained
for compatibility with ObjC clients, and the readonly attribute is
ifdeffed out for ObjC.

This patch adds a single test to verify the behavior, and removes a
variety of tests that depended on the writable behavior. In particular,
potential security issues involving the document.baseURL property are
avoided completely as long as this property can't be changed.

Test: fast/dom/documenturi-readonly.html

* dom/Document.cpp:
(WebCore::Document::setDocumentURI):
    Adds a comment explaining that the fallback is necessary only to
    support ObjC, not for JS calls.
* dom/Document.cpp:
(WebCore::Document::updateBaseURL):
    Ditto.
(Document):
* dom/Document.idl:
    Add readonly to the attribute and drop null value when not in
    LANGUAGE_OBJECTIVE_C.

Tools:

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/SetDocumentURI.html: Added.
* TestWebKitAPI/Tests/mac/SetDocumentURI.mm: Added.
(-[SetDocumentURITest webView:didFinishLoadForFrame:]):
(TestWebKitAPI):
(TestWebKitAPI::TEST):

LayoutTests:

* dom/xhtml/level3/core/documentsetdocumenturi01-expected.txt: Removed.
* dom/xhtml/level3/core/documentsetdocumenturi01.xhtml-disabled: Renamed from LayoutTests/dom/xhtml/level3/core/documentsetdocumenturi01.xhtml.
* dom/xhtml/level3/core/documentsetdocumenturi02-expected.txt: Removed.
* dom/xhtml/level3/core/documentsetdocumenturi02.xhtml-disabled: Renamed from LayoutTests/dom/xhtml/level3/core/documentsetdocumenturi02.xhtml.
    Disabling these two tests, because they write out documentURI which is a `file:` URL dependent on a local path.
* dom/xhtml/level3/core/documentsetdocumenturi03-expected.txt:
* dom/xhtml/level3/core/nodegetbaseuri02-expected.txt:
    Updating these two tests to match the new, read-only behavior.
* fast/dom/documenturi-affects-relative-paths-expected.txt: Removed.
* fast/dom/documenturi-affects-relative-paths.html: Removed.
* fast/dom/documenturi-assigned-junk-implies-baseuri-null-expected.txt: Removed.
* fast/dom/documenturi-assigned-junk-implies-baseuri-null.html: Removed.
* fast/dom/documenturi-assigned-junk-implies-relative-urls-do-not-resolve-expected.txt: Removed.
* fast/dom/documenturi-assigned-junk-implies-relative-urls-do-not-resolve.html: Removed.
* fast/dom/documenturi-can-hold-arbitrary-string-expected.txt: Removed.
* fast/dom/documenturi-can-hold-arbitrary-string.html: Removed.
    Removing now-irrelevant tests.
* fast/dom/documenturi-readonly-expected.txt: Added.
* fast/dom/documenturi-readonly.html: Added.
    Adding a test to verify that document.documentURI is read-only.
* http/tests/security/xss-DENIED-document-baseURI-javascript-expected.txt: Removed.
* http/tests/security/xss-DENIED-document-baseURI-javascript-with-spaces-expected.txt: Removed.
* http/tests/security/xss-DENIED-document-baseURI-javascript-with-spaces.html: Removed.
* http/tests/security/xss-DENIED-document-baseURI-javascript.html: Removed.
* platform/chromium/dom/xhtml/level3/core/nodegetbaseuri02-expected.txt: Added
    Platform-specific result for Chromium, which doesn't set the `line` property on exceptions.
* storage/domstorage/events/documentURI-expected.txt: Removed.
* storage/domstorage/events/documentURI.html: Removed.
* storage/domstorage/events/script-tests/documentURI.js: Removed.
    Removing now-irrelevant tests.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120093 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Make damage tracking more robust to early exits
https://bugs.webkit.org/show_bug.cgi?id=84803

Reviewed by James Robinson.

Source/WebCore:

All CCDamageTrackerTest unit tests updated;
One new unit test added:
   CCDamageTrackerTest.verifyDamageAccumulatesUntilReset

Damage tracking inherently needs to be aware of all changes that
occur for every frame. Before this patch, anyone modifying details
of CCLayerTreeHostImpl and the drawing phases of the compositor
needed to be careful to avoid early exiting once draw is
initiated, otherwise running the risk of damage tracking's state
getting out-of-sync from actual changes. This patch makes the
damage tracker API more asynchronous-like, so that damage will
continue to accumulate until it is explicitly notified that
damaged areas have been drawn. This will allow more freedom in
designing and restructuing drawing code in the compositor, without
worrying as much about damage tracking getting out-of-sync.

* platform/graphics/chromium/cc/CCDamageTracker.h:
(WebCore::CCDamageTracker::didDrawDamagedArea):
* platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
(WebCore::CCLayerTreeHostImpl::drawLayers):
* platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
(CCLayerTreeHostImpl):

Source/WebKit/chromium:

* tests/CCDamageTrackerTest.cpp:
(WebKitTests::clearDamageForAllSurfaces):
(WebKitTests::TEST_F):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update some tests to better match actual results on the bots.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120095 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/11593686> and https://bugs.webkit.org/show_bug.cgi?id=88683
Garbage collection of an <img> element can cause reentrant event dispatch.

Reviewed by Darin Adler.

Source/WebCore:

The most straightforward solution is for ImageLoader to keep its Element alive
with ref/deref any time the Image is actually loading.

ImageLoader should always do this for all Elements, and if those Elements want/need
different behavior for when they are detached then they need to manually stop their
loads.

Tests: http/tests/loading/embed-image-load-outlives-gc-without-crashing.html
       http/tests/loading/image-input-type-outlives-gc-without-crashing.html
       http/tests/loading/image-load-outlives-gc-without-crashing.html
       http/tests/loading/object-image-load-outlives-gc-without-crashing.html
       http/tests/loading/svg-image-load-outlives-gc-without-crashing.html
       http/tests/loading/video-poster-image-load-outlives-gc-without-crashing.html

* loader/ImageLoader.cpp:
(WebCore::ImageLoader::ImageLoader):
(WebCore::ImageLoader::~ImageLoader):
(WebCore::ImageLoader::setImage):
(WebCore::ImageLoader::updateFromElement):
(WebCore::ImageLoader::notifyFinished):
(WebCore::ImageLoader::updatedHasPendingLoadEvent):
(WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
(WebCore::ImageLoader::dispatchPendingLoadEvent):
* loader/ImageLoader.h:
(ImageLoader):

LayoutTests:

New tests for all users of ImageLoader:
* http/tests/loading/embed-image-load-outlives-gc-without-crashing-expected.txt: Added.
* http/tests/loading/embed-image-load-outlives-gc-without-crashing.html: Added.
* http/tests/loading/image-input-type-outlives-gc-without-crashing-expected.txt: Added.
* http/tests/loading/image-input-type-outlives-gc-without-crashing.html: Added.
* http/tests/loading/image-load-outlives-gc-without-crashing-expected.txt: Added.
* http/tests/loading/image-load-outlives-gc-without-crashing.html: Added.
* http/tests/loading/object-image-load-outlives-gc-without-crashing-expected.txt: Added.
* http/tests/loading/object-image-load-outlives-gc-without-crashing.html: Added.
* http/tests/loading/resources/slowimage.php: Added.
* http/tests/loading/svg-image-load-outlives-gc-without-crashing-expected.txt: Added.
* http/tests/loading/svg-image-load-outlives-gc-without-crashing.html: Added.
* http/tests/loading/video-poster-image-load-outlives-gc-without-crashing-expected.txt: Added.
* http/tests/loading/video-poster-image-load-outlives-gc-without-crashing.html: Added.

Shared sub resource for all of those tests:
* http/tests/loading/resources/slowimage.php: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120096 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Separate RemoveID test cases.
https://bugs.webkit.org/show_bug.cgi?id=88798

Reviewed by Eric Carlson.

* http/tests/media/media-source/video-media-source-add-and-remove-ids-expected.txt:
* http/tests/media/media-source/video-media-source-add-and-remove-ids.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120097 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Gtk] TestExpectations should remove use of FAIL expectations
https://bugs.webkit.org/show_bug.cgi?id=88894

Reviewed by Martin Robinson.

Remove FAIL expectation from Gtk's TestExpectations file, replacing it
with TEXT or IMAGE in case of reftests. That should suffice for now as the
buildbots don't run pixel tests at the moment.

* platform/gtk/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120099 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change default for flex-grow back to 0
https://bugs.webkit.org/show_bug.cgi?id=88443

Reviewed by Tony Chang.

Source/WebCore:

* rendering/style/RenderStyle.h:

LayoutTests:

* css3/flexbox/flex-algorithm.html:
* css3/flexbox/flex-order.html:
* css3/flexbox/flex-property-parsing-expected.txt:
* css3/flexbox/flex-property-parsing.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120100 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Don't crash in CCLayerIterator if the root layer doesn't have a render surface
https://bugs.webkit.org/show_bug.cgi?id=88886

Patch by Sami Kyostila <skyostil@chromium.org> on 2012-06-12
Reviewed by James Robinson.

If we are iterating over a render render surface layer list where the
root layer does not have a render surface, fail gracefully instead of
crashing.

Tests: CCLayerIteratorTest.{emptyTree,rootLayerWithoutRenderSurface}

* platform/graphics/chromium/cc/CCLayerIterator.h:
(WebCore::CCLayerIterator::CCLayerIterator):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120103 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening after r120099, fix two incorrect text expectations.

* platform/gtk/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120104 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Fix incorrect LayerChromium scroll position for RTL overflow pages
https://bugs.webkit.org/show_bug.cgi?id=88887

Reviewed by James Robinson.

The scroll position on layers needs to take into account the scroll
origin, since RTL pages start scrolled all the way to the right.
Otherwise, when scrolling left the scroll position incorrectly will go
negative, causing havok in scrollbar theme code that just assumes that
it's always scrolled all the way to the left.

Also, now that the scroll origin is passed into NCCH, handle
scrollOrigin.y() for layer adjusting. This is always zero in practice,
but it seemed awkward to just drop it and that assumption could always
change in the future.

* src/NonCompositedContentHost.cpp:
(WebKit::NonCompositedContentHost::setViewport):
(WebKit::NonCompositedContentHost::paintContents):
* src/NonCompositedContentHost.h:
(NonCompositedContentHost):
* src/WebViewImpl.cpp:
(WebKit::WebViewImpl::updateLayerTreeViewport):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120105 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update more expectations to match the state of the bots.
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120106 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/http/tests/xmlhttprequest/origin-exact-matching.html is giving trouble due to too many redirects
https://bugs.webkit.org/show_bug.cgi?id=88896

Patch by Pablo Flouret <pablof@motorola.com> on 2012-06-12
Reviewed by Darin Adler.

The test was giving out "too many redirect" errors on GTK and EFL due to
using redirect-cors.php without an actual url to redirect.

Redirects are not actually tested in that test, a script that set the
Access-Control-Allow-Origin header to an arbitrary origin was needed and
redirect-cors.php was the only existing one that had the capability. The
infinite redirect thing was an unintended consequence.
Use resources/access-control-allow-lists.php to set the header instead.

* http/tests/xmlhttprequest/origin-exact-matching-expected.txt:
* http/tests/xmlhttprequest/resources/origin-exact-matching-iframe.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120107 268f45cc-cd09-0410-ab3c-d52691b4dbfc
HTML parser should yield more to improve perceived page load time
https://bugs.webkit.org/show_bug.cgi?id=86165

Source/WebCore:

Patch by Shrey Banga <banga@chromium.org> on 2012-06-12
Reviewed by Tony Gentilcore.

Test: fast/events/event-yield-timing.html

We want the parser to yield at least every 500ms to keep the page somewhat responsive and allow painting.
Since it would be too expensive to check the time after each token, the previous heuristic was to check every 4,096 tokens.
That works fine for most tokens, but a script may spend an arbitrary amount of time executing.

This patch fixes the issue by causing the parser to check the elapsed time immediately after executing a script.

* html/parser/HTMLParserScheduler.cpp:
(WebCore::HTMLParserScheduler::checkForYieldBeforeScript):
* html/parser/HTMLParserScheduler.h:
(WebCore::PumpSession::PumpSession):
(PumpSession):
(WebCore::HTMLParserScheduler::checkForYieldBeforeToken):

LayoutTests:

Added test for parser yield times after seeing a script

Patch by Shrey Banga <banga@chromium.org> on 2012-06-12
Reviewed by Tony Gentilcore.

* fast/parser/parser-yield-timing-expected.txt: Added.
* fast/parser/parser-yield-timing.html: Added.
* http/tests/loading/gmail-assert-on-load-expected.txt: The test was added
for an assert that failed on debug builds when an iframe removed itself
from its parent window after blocking for 1 second. In previous builds,
the destroyIt() function was called without yielding to the event loop,
which lead to didFailLoadWithError being called. The fix for bug 86165
ensures that we yield after executing the script, which leads to
didHandleOnloadEventsForFrame being called instead. This is the cause
of the change in output of the test. The test still successfully removes
the iframe and since no asserts fail in the debug build, we should consider
it as passing.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120108 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rename Apple bots to a standard convention.
https://bugs.webkit.org/show_bug.cgi?id=88893

Note: This has the side effect of grouping all of the Apple bots together in the waterfall.

Reviewed by Simon Fraser.

* BuildSlaveSupport/build.webkit.org-config/config.json:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120109 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add zlieber@chromium.org to contributors list
https://bugs.webkit.org/show_bug.cgi?id=88904

Unreviewed.

* Scripts/webkitpy/common/config/committers.py:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120110 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use testRunner in accessibility tests instead of layoutTestController
https://bugs.webkit.org/show_bug.cgi?id=88755

Reviewed by Tony Chang.

Replaced all instances of layoutTestController in accessibility tests by testRunner.

* accessibility/:
* platform/chromium/accessibility/:
* platform/gtk/accessibility/:
* platform/mac/accessibility/:
* platform/win/accessibility/:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120111 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Disable autoplay when user gesture is required for media playback
https://bugs.webkit.org/show_bug.cgi?id=88897

Patch by Min Qin <qinmin@google.com> on 2012-06-12
Reviewed by Adam Barth.

When user gesture is required for media playback, we should block autoplay.
Otherwise, people will use autoplay instead of video.play() to bypass the gesture requirement.
Test: media/no-autoplay-with-user-gesture-requirement.html

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::setReadyState):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120112 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Resolve CMake warnings on overlapping search paths for EFL jhbuild-enabled build
https://bugs.webkit.org/show_bug.cgi?id=84707

Fixing CMAKE prefix path for 64bit systems to avoid CMAKE warnings on those.
use_lib64 variable is preconfigured to True by jhbuild.

Patch by Dominik Röttsches <dominik.rottsches@intel.com> on 2012-06-12
Reviewed by Dirk Pranke.

* efl/jhbuildrc:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120113 268f45cc-cd09-0410-ab3c-d52691b4dbfc