Threadsafety issues in WebScriptObject
https://bugs.webkit.org/show_bug.cgi?id=90849

Reviewed by Geoff Garen.

Updated fix for this bug. The JSC API lock needs to be acquired also in JSObject.

* bindings/objc/WebScriptObject.mm:
(-[WebScriptObject JSObject]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122635 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Refactor RenderTable to use the section's iteration functions.
https://bugs.webkit.org/show_bug.cgi?id=89751

Patch by Arpita Bahuguna <arpitabahuguna@gmail.com> on 2012-07-13
Reviewed by Julien Chaffraix.

Removing anti-pattern wherever possible from RenderTable code. Also, modifying
RenderTable sections' iterations to use helper functions.

No new tests required for this change since no change in behavior is expected.

* rendering/RenderTable.cpp:
(WebCore::RenderTable::addOverflowFromChildren):
(WebCore::RenderTable::setCellLogicalWidths):
(WebCore::RenderTable::outerBorderStart):
(WebCore::RenderTable::outerBorderEnd):
Removed anti-patterns involving iterations over RenderObjects.

(WebCore::RenderTable::outerBorderAfter):
Modified RenderTable sections' iteration to use helper functions.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122636 268f45cc-cd09-0410-ab3c-d52691b4dbfc
NodeLists should not invalidate on irreleavnt attribute changes
https://bugs.webkit.org/show_bug.cgi?id=91277

Reviewed by Ojan Vafai.

Explicitely check the invalidation type and the changed attribute in NodeListNodeData::invalidateCaches
and ElementRareData::clearHTMLCollectionCaches to only invalidate node lists affected by the change.

Also merged invalidateNodeListsCacheAfterAttributeChanged and invalidateNodeListsCacheAfterChildrenChanged
as invalidateNodeListCachesInAncestors since they're almost identical after r122498.

In addition, moved shouldInvalidateNodeListForType from Document.cpp to DynamicNodeList.h and renamed it to
shouldInvalidateTypeOnAttributeChange since it needs to called in Node.cpp and ElementRareData.h.

* dom/Attr.cpp:
(WebCore::Attr::setValue):
(WebCore::Attr::childrenChanged):
* dom/ContainerNode.cpp:
(WebCore::ContainerNode::childrenChanged):
* dom/Document.cpp:
(WebCore::Document::registerNodeListCache): Calls isRootedAtDocument() instead of directly comparing
the value of NodeListRootType in order to prepare for the bug 80269.
(WebCore::Document::unregisterNodeListCache): Ditto.
(WebCore): shouldInvalidateNodeListForType is moved to DynamicNodeList.h
(WebCore::Document::shouldInvalidateNodeListCaches):
* dom/DynamicNodeList.h:
(DynamicNodeListCacheBase):
(WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange): Moved from Document.cpp.
* dom/Element.cpp: 
(WebCore::Element::attributeChanged):
* dom/ElementRareData.h:
(WebCore::ElementRareData::clearHTMLCollectionCaches): Takes const QualifiedName* to compare against
the invalidation type of HTML collections via shouldInvalidateTypeOnAttributeChange.
* dom/Node.cpp:
(WebCore::Node::invalidateNodeListCachesInAncestors): Merged invalidateNodeListCachesInAncestors and
invalidateNodeListsCacheAfterChildrenChanged. Also pass attrName to clearHTMLCollectionCaches.
(WebCore::NodeListsNodeData::invalidateCaches): Compares attrName against the invalidation type of
node lists via shouldInvalidateTypeOnAttributeChange.
(WebCore):
* dom/Node.h:
(Node):
* dom/NodeRareData.h:
(WebCore::NodeRareData::ensureNodeLists): Merged NodeRareData::createNodeLists.
(WebCore::NodeRareData::clearChildNodeListCache): Moved from Node.cpp.
(NodeRareData):
* html/HTMLCollection.h:
(HTMLCollectionCacheBase):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122637 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Fix crash due to unguarded use of renderer in select
popup.
https://bugs.webkit.org/show_bug.cgi?id=91287

Reviewed by Rob Buis.

No known testcase for this.  Found in the wild.

* WebCoreSupport/SelectPopupClient.cpp:
(WebCore::SelectPopupClient::setValueAndClosePopup):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122638 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=91278
Improve block margin estimation function to account for not having a layout and for quirks mode
        
Reviewed by Simon Fraser.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::marginBeforeEstimateForChild):
Revise marginBeforeEstimateForChild so that it computes block margins for the grandchild before
recurring. This includes the quirks margin information as well. This ensures that the margins are
up-to-date when checked, even before the object has had its first layout.
        
* rendering/RenderBlock.h:
(WebCore::RenderBlock::setMarginStartForChild):
(WebCore::RenderBlock::setMarginEndForChild):
(WebCore::RenderBlock::setMarginBeforeForChild):
(WebCore::RenderBlock::setMarginAfterForChild):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::computeBlockDirectionMargins):
* rendering/RenderBox.h:
(RenderBox):
Add consts in order to compile.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122639 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LLInt fails to mark structures stored in the bytecode
https://bugs.webkit.org/show_bug.cgi?id=91296

Reviewed by Geoffrey Garen.

LLInt stores structures in the bytecode, so we need to visit the appropriate
instructions as we would if we were running in the classic interpreter.
This requires adding additional checks for the LLInt specific opcodes, and
the lint specific variants of operand ordering.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::visitStructures):
(JSC::CodeBlock::stronglyVisitStrongReferences):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122640 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use LayoutBoxExtent for image outsets
https://bugs.webkit.org/show_bug.cgi?id=91166

Reviewed by Tony Chang.

Change RenderStyle and calling code to use LayoutBoxExtent for image
outsets and remove text direction and writing mode versions of the
outline getters from RenderStyle as LayoutBoxExtent provides the same
functionality.

No new tests, no change in functionality.

* platform/graphics/FractionalLayoutBoxExtent.h:
* platform/graphics/FractionalLayoutBoxExtent.cpp:
(WebCore::FractionalLayoutBoxExtent::logicalTop):
(WebCore::FractionalLayoutBoxExtent::logicalBottom):
Add logicalTop and logicalBottom methods to go with the existing
logicalLeft and logicalRight ones.

* platform/graphics/FractionalLayoutRect.h:
(WebCore::FractionalLayoutRect::expand):
Add FractionalLayoutBoxExtent version of expand method.

* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::addBorderOutsetVisualOverflow):
Change implementation to use the new FractionalLayoutBoxExtent version of
borderImageOutsets and the logicalTop/Bottom/Left/Right methods.

(WebCore::clipRectForNinePieceImageStrip):
Change implementation to use the new FractionalLayoutBoxExtent version of
borderImageOutsets.

* rendering/RenderBox.cpp:
(WebCore::RenderBox::maskClipRect):
Change implementation to use the new FractionalLayoutBoxExtent version of
borderImageOutsets and the new FractionalLayoutRect::expand method.

(WebCore::RenderBox::addVisualEffectOverflow):
Change implementation to use the new FractionalLayoutBoxExtent version of
borderImageOutsets.

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintNinePieceImage):
Change implementation to use the new FractionalLayoutBoxExtent version of
borderImageOutsets and the new FractionalLayoutRect::expand method.

* rendering/style/RenderStyle.h:
* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::imageOutsets):
Change getImageOutsets to return a FractionalLayoutBoxExtent object and
rename to imageOutsets to match the webkit naming convention for getters.

Remove getBorderImageHorizontalOutsets, getBorderImageVerticalOutsets,
getBorderImageInlineDirectionOutsets, getImageHorizontalOutsets,
getImageVerticalOutsets and getBorderImageBlockDirectionOutsets methods
as the same functionality is provided by FractionalLayoutBoxExtent.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122641 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove an always-failing table-wrapping check in RenderObject::addChild
https://bugs.webkit.org/show_bug.cgi?id=91286

Reviewed by Eric Seidel.

Due to the structure of the code, this test is always failing (newChild->isTableCell()
is true to get in the branch).

The changeset adding the code didn't add testing so I poundered adding the mentioned test,
which is passing. However the test would need to be blindly changed to be included in our
test harness. I would also expect this code to be exercised by other table tests anyway.

* rendering/RenderObject.cpp:
(WebCore::RenderObject::addChild):
Removed never-reached branch. While at it, removed a 'what' comment in the same file.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@122642 268f45cc-cd09-0410-ab3c-d52691b4dbfc