[Chromium] Unreviewed rebaseline for svg/custom/clip-mask-negative-scale.svg

* platform/chromium-mac-snowleopard/svg/custom/clip-mask-negative-scale-expected.png: Added.
* platform/chromium-mac/svg/custom/clip-mask-negative-scale-expected.png: Added.
* platform/chromium-win/svg/custom/clip-mask-negative-scale-expected.png: Added.
* platform/chromium/svg/custom/clip-mask-negative-scale-expected.txt: Renamed from LayoutTests/platform/chromium-linux/svg/custom/clip-mask-negative-scale-expected.txt.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129949 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add canvas to set of elements that do not allow style sharing in order
to provoke RenderLayer creation
https://bugs.webkit.org/show_bug.cgi?id=97013

Unreviewed expectations update.

* platform/chromium-mac/fast/canvas/canvas-render-layer-expected.png: Added.
* platform/chromium-mac/fast/canvas/canvas-render-layer-expected.txt: Added.
* platform/chromium-mac/platform/chromium/virtual/gpu/fast/canvas/canvas-render-layer-expected.png: Added.
* platform/chromium-mac/platform/chromium/virtual/gpu/fast/canvas/canvas-render-layer-expected.txt: Added.
* platform/chromium-win/fast/canvas/canvas-render-layer-expected.png: Added.
* platform/chromium-win/fast/canvas/canvas-render-layer-expected.txt: Added.
* platform/chromium-win/platform/chromium/virtual/gpu/fast/canvas/canvas-render-layer-expected.png: Added.
* platform/chromium-win/platform/chromium/virtual/gpu/fast/canvas/canvas-render-layer-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129950 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Mark this test as Missing since it has no png on any platform.
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129951 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add two resources needed for the test added in r129944.

* plugins/resources/plugin-frame.html: Added.
* plugins/resources/plugin-page.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129952 268f45cc-cd09-0410-ab3c-d52691b4dbfc
perf/nested-combined-selectors.html is flaky on Lion as well.
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129953 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WontFix frame flattening crash test.
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129954 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r124168): Null crash in RenderLayer::createScrollbar
https://bugs.webkit.org/show_bug.cgi?id=96863

Reviewed by Abhishek Arya.

Source/WebCore:

After r124168, we synchronously create any overflow:scroll scrollbar on the first style change - we used to wait
until layout was called. The issue is that the logic in RenderLayer assumes that our node is completely attached
when the style change is dispatched. The crash occured because the 'content' image code path in
RenderObject::createObject triggered a style change too early.

Test: scrollbars/scrollbar-content-crash.html

* rendering/RenderObject.cpp:
(WebCore::RenderObject::createObject):
We need a style associated with the new RenderImage to call setImageResource but we don't need to trigger a
style change.

LayoutTests:

* scrollbars/scrollbar-content-crash-expected.txt: Added.
* scrollbars/scrollbar-content-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129955 268f45cc-cd09-0410-ab3c-d52691b4dbfc
TextureMapperGL destructor crashes
https://bugs.webkit.org/show_bug.cgi?id=97942

Patch by Luiz Agostini <luiz.agostini@nokia.com> on 2012-09-28
Reviewed by Noam Rosenthal.

BitmapTextureGL destructor uses a TextureMapperGL instance. The problem is that
BitmapTextureGL objects are destroyed on TextureMapper destructor and at that
time TextureMapperGL specific methods and data are not available any more.

This patch creates a new protected method TextureMapper::clearTexturePool()
that is called in TextureMapperGL's destructor.

* platform/graphics/texmap/TextureMapper.h:
(WebCore::TextureMapper::clearTexturePool):
* platform/graphics/texmap/TextureMapperGL.cpp:
(WebCore::TextureMapperGL::~TextureMapperGL):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129956 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix pluralization of Info.plist key.

Rubber-stamped by Anders Carlsson.

* WebProcessService/Info.plist:
* WebProcessServiceForWebKitDevelopment/Info.plist:
It's _MultipleInstances, not _MultipleInstance. :(



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129957 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Improve saturation arithmetic support in FractionalLayoutUnit
https://bugs.webkit.org/show_bug.cgi?id=97938

Reviewed by Levi Weintraub.

Source/WebCore:

Fix bug in FractionalLayoutUnit::setValue where greater than or
equals is used instead of greater than to clamp the values.
Add SATURATED_LAYOUT_ARITHMETIC support to round preventing it
from overflowing when adding the fraction.

Test: fast/sub-pixel/large-sizes.html

* platform/FractionalLayoutUnit.h:
(WebCore::FractionalLayoutUnit::round):
(WebCore::FractionalLayoutUnit::setValue):

LayoutTests:

Update large sizes test to better cover values near limit.

* fast/sub-pixel/large-sizes-expected.txt:
* fast/sub-pixel/large-sizes.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129958 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/12398537> WebKit2 lacks API for disabling document.cookie like -[WebView _setCookieEnabled:]
https://bugs.webkit.org/show_bug.cgi?id=97939

Reviewed by Sam Weinig.

* Shared/WebPreferencesStore.h:
(WebKit): Defined CookieEnabled key with a default value of true.
* UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetCookieEnabled): Added this setter.
(WKPreferencesGetCookieEnabled): Added this getter.
* UIProcess/API/C/WKPreferencesPrivate.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences): Added a call to Settings::setCookieEnabled to push the
preference into Settings.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129959 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add draggable property to WebDraggableRegion.
https://bugs.webkit.org/show_bug.cgi?id=97950

Reviewed by Adam Barth.

This needs to be done before we can land the patch to use new syntax for
draggable regions. This is because Chromium side code cannot enable
the changes to support new syntax side by side when this property is
not present.

* public/WebDraggableRegion.h:
(WebDraggableRegion):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129960 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove Instance::setDidExecuteFunction
https://bugs.webkit.org/show_bug.cgi?id=97952

Reviewed by Alexey Proskuryakov.

Instance::setDidExecuteFunction was added over 8 years ago to fix a bug where Objective-C
DOM calls weren't updating the document correctly. Nowadays we correctly invalidate the DOM tree
when these calls are made so we don't need an extra step to do so.

* bindings/js/ScriptControllerMac.mm:
(WebCore):
(WebCore::ScriptController::initJavaJSBindings):
* bindings/objc/WebScriptObject.mm:
(-[WebScriptObject callWebScriptMethod:withArguments:]):
(-[WebScriptObject evaluateWebScript:]):
(-[WebScriptObject setValue:forKey:]):
(-[WebScriptObject valueForKey:]):
(-[WebScriptObject removeWebScriptKey:]):
(-[WebScriptObject hasWebScriptKey:]):
(-[WebScriptObject stringRepresentation]):
(-[WebScriptObject webScriptValueAtIndex:]):
(-[WebScriptObject setWebScriptValueAtIndex:value:]):
* bridge/jsc/BridgeJSC.cpp:
* bridge/jsc/BridgeJSC.h:
(Instance):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129961 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r122215) - CachedImage::likelyToBeUsedSoon crashes on accessing a deleted CachedImageClient
https://bugs.webkit.org/show_bug.cgi?id=97749

Reviewed by James Robinson.

.:

Added a manual test to demonstrate drag image and crashing.

* ManualTests/drag-image-no-crash.html: Added.

Source/WebCore:

All implementations of Clipboard set themselves as clients to CachedImage
through the JS API setDrageImage() but they do not detach during destruction.
This causes memory corruption when CachedImage tries to access a deleted client
when MemoryCache prunes and calls CachedImage::likelyToUsedSoon().

Manual test added: ManualTests/drag-image-no-crash.html

* platform/chromium/ClipboardChromium.cpp:
(WebCore::ClipboardChromium::~ClipboardChromium):
* platform/gtk/ClipboardGtk.cpp:
(WebCore::ClipboardGtk::~ClipboardGtk):
* platform/mac/ClipboardMac.mm:
(WebCore::ClipboardMac::~ClipboardMac):
* platform/win/ClipboardWin.cpp:
(WebCore::ClipboardWin::~ClipboardWin):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129962 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove unused parameter in SelectorChecker::checkScrollbarPseudoClass.
https://bugs.webkit.org/show_bug.cgi?id=97941

Reviewed by Kentaro Hara.

The last parameter in checkScrollbarPseudoClass was unused, so I removed it.

No change in behavior, just refactoring.

* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOneSelector): Changed the callsite to accommodate the change.
(WebCore::SelectorChecker::checkScrollbarPseudoClass): Removed last param.
* css/SelectorChecker.h: Ditto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129963 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove Java bridge
https://bugs.webkit.org/show_bug.cgi?id=97954

Reviewed by Sam Weinig.

The Java bridge is not used by any port; Mac now has a NPAPI Java plug-in.

Source/WebCore:

* WebCore.exp.in:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::ScriptController):
* bindings/js/ScriptController.h:
(ScriptController):
* bindings/js/ScriptControllerMac.mm:
(WebCore::ScriptController::createScriptInstanceForWidget):
* bridge/jni/JNIUtility.cpp: Removed.
* bridge/jni/JNIUtility.h: Removed.
* bridge/jni/JavaType.h: Removed.
* bridge/jni/JobjectWrapper.cpp: Removed.
* bridge/jni/JobjectWrapper.h: Removed.
* bridge/jni/jni_jsobject.h: Removed.
* bridge/jni/jni_jsobject.mm: Removed.
* bridge/jni/jni_objc.mm: Removed.
* bridge/jni/jsc/JNIUtilityPrivate.cpp: Removed.
* bridge/jni/jsc/JNIUtilityPrivate.h: Removed.
* bridge/jni/jsc/JavaArrayJSC.cpp: Removed.
* bridge/jni/jsc/JavaArrayJSC.h: Removed.
* bridge/jni/jsc/JavaClassJSC.cpp: Removed.
* bridge/jni/jsc/JavaClassJSC.h: Removed.
* bridge/jni/jsc/JavaFieldJSC.cpp: Removed.
* bridge/jni/jsc/JavaFieldJSC.h: Removed.
* bridge/jni/jsc/JavaInstanceJSC.cpp: Removed.
* bridge/jni/jsc/JavaInstanceJSC.h: Removed.
* bridge/jni/jsc/JavaMethodJSC.cpp: Removed.
* bridge/jni/jsc/JavaMethodJSC.h: Removed.
* bridge/jni/jsc/JavaRuntimeObject.cpp: Removed.
* bridge/jni/jsc/JavaRuntimeObject.h: Removed.
* bridge/jni/jsc/JavaStringJSC.h: Removed.
* bridge/runtime_root.h:
* loader/FrameLoaderClient.h:
(FrameLoaderClient):

Source/WebKit/mac:

* WebCoreSupport/WebFrameLoaderClient.h:
* WebCoreSupport/WebFrameLoaderClient.mm:
Make sure that we try to load the NPAPI Java plug-in.

Source/WebKit2:

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
* WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
(WebFrameLoaderClient):

Source/WTF:

* wtf/Platform.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129964 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove V8DOMWindowShell::getEntered
https://bugs.webkit.org/show_bug.cgi?id=96637

Patch by Dan Carney <dcarney@google.com> on 2012-09-28
Reviewed by Adam Barth.

V8DOMWindowShell::getEntered was refactored so that the window shell
no longer has to be kept alive by a v8 context but rather a smaller
object.

No new tests. No change in functionality.

* bindings/v8/DOMData.cpp:
(WebCore::DOMData::getCurrentStore):
* bindings/v8/ScopedPersistent.h:
(WebCore::ScopedPersistent::leakHandle):
(ScopedPersistent):
* bindings/v8/ScriptController.cpp:
(WebCore::ScriptController::resetIsolatedWorlds):
(WebCore::ScriptController::evaluateInIsolatedWorld):
(WebCore::ScriptController::currentWorldContext):
* bindings/v8/V8Binding.cpp:
(WebCore::perContextDataForCurrentWorld):
* bindings/v8/V8DOMWindowShell.cpp:
(WebCore::setIsolatedWorldField):
(WebCore::V8DOMWindowShell::toIsolatedContextData):
(WebCore::isolatedContextWeakCallback):
(WebCore::V8DOMWindowShell::disposeContext):
(WebCore::V8DOMWindowShell::clearIsolatedShell):
(WebCore):
(WebCore::V8DOMWindowShell::initializeIfNeeded):
(WebCore::V8DOMWindowShell::setIsolatedWorldSecurityOrigin):
* bindings/v8/V8DOMWindowShell.h:
(V8DOMWindowShell):
(IsolatedContextData):
(WebCore::V8DOMWindowShell::IsolatedContextData::create):
(WebCore::V8DOMWindowShell::IsolatedContextData::world):
(WebCore::V8DOMWindowShell::IsolatedContextData::perContextData):
(WebCore::V8DOMWindowShell::IsolatedContextData::setSecurityOrigin):
(WebCore::V8DOMWindowShell::IsolatedContextData::securityOrigin):
(WebCore::V8DOMWindowShell::IsolatedContextData::IsolatedContextData):
(WebCore::V8DOMWindowShell::enteredIsolatedContext):
(WebCore::V8DOMWindowShell::enteredIsolatedContextData):
* bindings/v8/V8DOMWrapper.h:
(WebCore::V8DOMWrapper::getCachedWrapper):
* bindings/v8/WorldContextHandle.cpp:
(WebCore::WorldContextHandle::WorldContextHandle):
* bindings/v8/custom/V8DocumentCustom.cpp:
(WebCore::toV8):
* bindings/v8/custom/V8HTMLDocumentCustom.cpp:
(WebCore::toV8):
* bindings/v8/custom/V8SVGDocumentCustom.cpp:
(WebCore::toV8):
* bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
(WebCore::V8XMLHttpRequest::constructorCallback):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129965 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash re-entering Document layout with frame flattening enabled
https://bugs.webkit.org/show_bug.cgi?id=97841

Reviewed by Brady Eidson.

When creating a CachedFrame, clearTimers on the Frame later; it has to
be done after documentWillSuspendForPageCache(), because the style
changes that HTMLPlugInImageElement::documentWillSuspendForPageCache()
do can schedule a layout on the FrameView, and we don't want this layout
timer to fire while the page is in the page cache.

Add an assertion in FrameView::layout() that the document is not in
the page cache. Without the above change, this would assert in
the plugins/frameset-with-plugin-frame.html test.

* history/CachedFrame.cpp:
(WebCore::CachedFrame::CachedFrame):
* page/FrameView.cpp:
(WebCore::FrameView::layout):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129966 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix chromium build after http://trac.webkit.org/changeset/129964.
* WebCore.gypi:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129967 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix compilation of V8DependentRetained and JSDependentRetained.
https://bugs.webkit.org/show_bug.cgi?id=97955

Patch by Elliott Sprehn <esprehn@chromium.org> on 2012-09-28
Reviewed by Kentaro Hara.

Fix bad usage of putDirect and removeDirect from JSDependentRetained and fix
incorrect assumptions about how weak handles work in V8. This is refactored
out of the patch on http://wkbug.com/93661

No tests needed, this just fixes the compile and wrong usage of ScopedPersistent.

* bindings/js/JSDependentRetained.h:
(WebCore::JSDependentRetained::JSDependentRetained):
(WebCore::JSDependentRetained::retain):
(WebCore::JSDependentRetained::release):
(JSDependentRetained):
* bindings/v8/V8DependentRetained.h:
(WebCore::V8DependentRetained::V8DependentRetained):
(WebCore::V8DependentRetained::retain):
(WebCore::V8DependentRetained::weakCallback):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129968 268f45cc-cd09-0410-ab3c-d52691b4dbfc