Generated should not be supported for things with a shadow
https://bugs.webkit.org/show_bug.cgi?id=98836

Unreviewed rollout of rollout of http://trac.webkit.org/changeset/132269.
Initial rollout was speculative and was shown not to be related to crashes.
Change author: Elliott Sprehn  <esprehn@chromium.org>

Source/WebCore:

As far as CSS is concerned inputs and things with shadow content inside
shouldn't support pseudo elements like :before, :after or :first-letter.
Neither Gecko or Presto supports it, and we only accidentally supported
it.

Until the spec tells us what to do we should disable support. This is
also neccesary because the new generated content implementation doesn't
support shadows.

Test: fast/forms/pseudo-elements.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::updateFirstLetter):
* rendering/RenderListBox.h:
* rendering/RenderObjectChildList.cpp:
(WebCore::RenderObjectChildList::updateBeforeAfterContent):

LayoutTests:

Change all pseudos on <input> tests to be ref tests and clean up the tests.
They now make sure we don't support generated content on things with a shadow.
Also added another test for the other form control types to ensure they don't
support pseudos either.

* fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.html: Added.
* fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.txt: Removed.
* fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements.html:
* fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.html: Added.
* fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.txt: Removed.
* fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements.html:
* fast/forms/pseudo-elements-expected.html: Added.
* fast/forms/pseudo-elements.html: Added.
* fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.html: Added.
* fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.txt: Removed.
* fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements.html:
* fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.html: Added.
* fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.txt: Removed.
* fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements.html:
* platform/chromium-linux/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-linux/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-linux/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-linux/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-lion/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png:
* platform/chromium-mac-lion/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-lion/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png:
* platform/chromium-mac-lion/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png:
* platform/chromium-mac-snowleopard/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-snowleopard/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-snowleopard/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac-snowleopard/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-mac/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-win/fast/forms/date-multiple-fields/date-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-win/fast/forms/month-multiple-fields/month-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-win/fast/forms/time-multiple-fields/time-multiple-fields-appearance-pseudo-elements-expected.png: Removed.
* platform/chromium-win/fast/forms/week-multiple-fields/week-multiple-fields-appearance-pseudo-elements-expected.png: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132696 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebKitIDL] Optional dictionary types should have default values of empty dictionary
https://bugs.webkit.org/show_bug.cgi?id=100547

Reviewed by Adam Barth.

Per WebIDL, "Optional dictionary type arguments are always considered to have a default
value of an empty dictionary." WebKitIDL already supported this via the extended attribute
[Optional=DefaultIsUndefined] but make this the default for Dictionary.

Binding test expectations updated.

* Modules/filesystem/DirectoryEntry.h: Remove default parameters.
(DirectoryEntry):
* Modules/indexeddb/IDBDatabase.h: Remove overloads.
(IDBDatabase):
* Modules/indexeddb/IDBObjectStore.h: Remove overloads.
(IDBObjectStore):
* Modules/mediastream/RTCPeerConnection.idl: Remove DefaultIsUndefined annotations.
* bindings/scripts/CodeGeneratorJS.pm: Special case for Optional Dictionary.
(GenerateParametersCheck):
* bindings/scripts/CodeGeneratorV8.pm: Ditto.
(GenerateParametersCheck):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjPrototypeFunctionOptionsObject): Updated expectation - no early call.
* bindings/scripts/test/V8/V8TestObj.cpp:
(WebCore::TestObjV8Internal::optionsObjectCallback): Ditto.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132698 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Notification should be sent when accessibilityIsIgnored changes
https://bugs.webkit.org/show_bug.cgi?id=99547

Reviewed by Chris Fleizach.

Source/WebCore:

Adds a new flag in AccessibilityObject that keeps track of the most recent
value of accessibilityIsIgnored(). After certain events such as an ARIA
attribute change or content change, checks the new value of
accessibilityIsIgnored() and posts a "children changed" notification on the
parent node if it changed, making sure the parent recomputes its vector of
(unignored) children.

Also moves handling of attribute changes to AXObjectCache, and sends
notifications for some attribute changes that were previously silent. On
Chromium, all changes to an accessibility object's attributes should
result in some notification.

Some tests would have broken because an AccessibilityScrollView was created
and holding a reference to a ScrollView for an iframe after it was deleted,
so this change switches AccessibilityScrollView to hold a weak reference
to ScrollView instead.

Tests: platform/chromium/accessibility/is-ignored-change-sends-notification.html
       platform/chromium/accessibility/other-aria-attribute-change-sends-notification.html
       platform/chromium/accessibility/text-change-notification.html

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::focusedUIElementForPage):
(WebCore::AXObjectCache::getOrCreate):
(WebCore::AXObjectCache::textChanged):
(WebCore):
(WebCore::AXObjectCache::childrenChanged):
(WebCore::AXObjectCache::handleAriaRoleChanged):
(WebCore::AXObjectCache::handleAttributeChanged):
(WebCore::AXObjectCache::labelChanged):
(WebCore::AXObjectCache::recomputeIsIgnored):
* accessibility/AXObjectCache.h:
(AXObjectCache):
(WebCore::AXObjectCache::childrenChanged):
(WebCore::AXObjectCache::textChanged):
(WebCore::AXObjectCache::handleAttributeChanged):
(WebCore::AXObjectCache::recomputeIsIgnored):
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::insertChild):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::AccessibilityObject):
(WebCore::AccessibilityObject::cachedIsIgnoredValue):
(WebCore):
(WebCore::AccessibilityObject::setCachedIsIgnoredValue):
(WebCore::AccessibilityObject::notifyIfIgnoredValueChanged):
* accessibility/AccessibilityObject.h:
(WebCore::AccessibilityObject::textChanged):
(AccessibilityObject):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
(WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
(WebCore::AccessibilityRenderObject::textChanged):
(WebCore::AccessibilityRenderObject::addHiddenChildren):
(WebCore::AccessibilityRenderObject::addChildren):
* accessibility/AccessibilityRenderObject.h:
(AccessibilityRenderObject):
* accessibility/AccessibilityScrollView.cpp:
(WebCore::AccessibilityScrollView::~AccessibilityScrollView):
(WebCore):
(WebCore::AccessibilityScrollView::detach):
(WebCore::AccessibilityScrollView::isAttachment):
(WebCore::AccessibilityScrollView::widgetForAttachmentView):
(WebCore::AccessibilityScrollView::updateScrollbars):
(WebCore::AccessibilityScrollView::webAreaObject):
(WebCore::AccessibilityScrollView::elementRect):
(WebCore::AccessibilityScrollView::documentFrameView):
(WebCore::AccessibilityScrollView::parentObject):
(WebCore::AccessibilityScrollView::parentObjectIfExists):
(WebCore::AccessibilityScrollView::getScrollableAreaIfScrollable):
(WebCore::AccessibilityScrollView::scrollTo):
* accessibility/AccessibilityScrollView.h:
(WebCore::AccessibilityScrollView::scrollView):
(AccessibilityScrollView):
* accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::isDataTable):
* accessibility/chromium/AXObjectCacheChromium.cpp:
(WebCore::AXObjectCache::postPlatformNotification):
* dom/Element.cpp:
(WebCore::Element::attributeChanged):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::deleteLineBoxTree):
(WebCore::RenderBlock::createAndAppendRootInlineBox):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::styleWillChange):
* rendering/RenderText.cpp:
(WebCore::RenderText::setText):

Source/WebKit/chromium:

Adds new accessibility notifications.

* public/WebAccessibilityNotification.h:
* src/AssertMatchingEnums.cpp:

Tools:

Add additional accessibility notifications.

* DumpRenderTree/chromium/WebViewHost.cpp:
(WebViewHost::postAccessibilityNotification):

LayoutTests:

Adds 3 new test to ensure:
1. A "children changed" notification is fired on the parent object when an
   object that was previously ignored becomes unignored.
2. A notification is sent when an element's text (incl. title or label) changes.
3. A notification is sent when another ARIA attribute changes.

Modifies add-to-menu-list-crashes because it was too brittle; it was
    referencing a stale object rather than retrieving its latest handle.
Modifies aria-checkbox-sends-notification to listen on the correct
    object on all platforms.
Simplifies notification-listeners so it doesn't generate additional
    notifications that are inconsistent between platforms now.

* accessibility/aria-checkbox-sends-notification.html:
* accessibility/notification-listeners.html:
* platform/chromium/accessibility/add-to-menu-list-crashes-expected.txt:
* platform/chromium/accessibility/add-to-menu-list-crashes.html:
* platform/chromium/accessibility/is-ignored-change-sends-notification-expected.txt: Added.
* platform/chromium/accessibility/is-ignored-change-sends-notification.html: Added.
* platform/chromium/accessibility/other-aria-attribute-change-sends-notification-expected.txt: Added.
* platform/chromium/accessibility/other-aria-attribute-change-sends-notification.html: Added.
* platform/chromium/accessibility/text-change-notification-expected.txt: Added.
* platform/chromium/accessibility/text-change-notification.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132699 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move non-Settings Inspector methods from internals.settings to internals
https://bugs.webkit.org/show_bug.cgi?id=100392

Reviewed by Adam Barth.

Source/WebCore:

These methods don't have to do with the WebCore Settings object, so move them up to internals.
I moved the reset code from InternalSettings to Internals.

No new tests, this is just a rename. Existing tests should pass.

* testing/InternalSettings.cpp:
(WebCore::InternalSettings::Backup::Backup): Remove inspector methods.
(WebCore::InternalSettings::Backup::restoreTo): Remove inspector methods.
* testing/InternalSettings.h:
* testing/InternalSettings.idl:
* testing/Internals.cpp:
(WebCore::Internals::resetToConsistentState): New method for resetting page state. Named after similar
methods in WTR.
(WebCore::Internals::setInspectorResourcesDataSizeLimits): Moved from InspectorSettings.
(WebCore::Internals::setJavaScriptProfilingEnabled): Moved from InspectorSettings.
* testing/Internals.h:
* testing/Internals.idl:
* testing/js/WebCoreTestSupport.cpp:
(WebCoreTestSupport::resetInternalsObject): Reset state in Internals.
* testing/v8/WebCoreTestSupport.cpp:
(WebCoreTestSupport::resetInternalsObject): Reset state in Internals.

LayoutTests:

Update tests to use internals.setJavaScriptProfilingEnabled instead of internals.settings.setJavaScriptProfilingEnabled.
Update tests to use internals.setInspectorResourcesDataSizeLimits instead of internals.settings.setInspectorResourcesDataSizeLimits.

* fast/profiler/anonymous-event-handler.html:
* fast/profiler/anonymous-function-called-from-different-contexts.html:
* fast/profiler/anonymous-function-calls-built-in-functions.html:
* fast/profiler/anonymous-function-calls-eval.html:
* fast/profiler/anonymous-functions-with-display-names.html:
* fast/profiler/apply.html:
* fast/profiler/built-in-function-calls-anonymous.html:
* fast/profiler/built-in-function-calls-user-defined-function.html:
* fast/profiler/call-register-leak.html:
* fast/profiler/call.html:
* fast/profiler/calling-the-function-that-started-the-profiler-from-another-scope.html:
* fast/profiler/compare-multiple-profiles.html:
* fast/profiler/constructor.html:
* fast/profiler/dead-time.html:
* fast/profiler/document-dot-write.html:
* fast/profiler/event-handler.html:
* fast/profiler/execution-context-and-eval-on-same-line.html:
* fast/profiler/inline-event-handler.html:
* fast/profiler/many-calls-in-the-same-scope.html:
* fast/profiler/multiple-and-different-scoped-anonymous-function-calls.html:
* fast/profiler/multiple-and-different-scoped-function-calls.html:
* fast/profiler/multiple-anonymous-functions-called-from-the-same-function.html:
* fast/profiler/multiple-frames.html:
* fast/profiler/named-functions-with-display-names.html:
* fast/profiler/nested-anonymous-functon.html:
* fast/profiler/nested-start-and-stop-profiler.html:
* fast/profiler/no-execution-context.html:
* fast/profiler/one-execution-context.html:
* fast/profiler/profile-calls-in-included-file.html:
* fast/profiler/profile-with-no-title.html:
* fast/profiler/profiling-from-a-nested-location-but-stop-profiling-outside-the-nesting.html:
* fast/profiler/profiling-from-a-nested-location.html:
* fast/profiler/simple-event-call.html:
* fast/profiler/simple-no-level-change.html:
* fast/profiler/start-and-stop-profiler-multiple-times.html:
* fast/profiler/start-and-stop-profiling-in-the-same-function.html:
* fast/profiler/start-but-dont-stop-profiling.html:
* fast/profiler/stop-profiling-after-setTimeout.html:
* fast/profiler/stop-then-function-call.html:
* fast/profiler/two-execution-contexts.html:
* fast/profiler/user-defined-function-calls-built-in-functions.html:
* fast/profiler/window-dot-eval.html:
* http/tests/inspector/network-test.js:
(resetInspectorResourcesData):
* http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html:
* http/tests/inspector/network/network-content-replacement-embed.html:
* http/tests/inspector/network/network-content-replacement-xhr.html:
* inspector/profiler/cpu-profiler-profiling-without-inspector.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132700 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Forward OSR calculation is wrong in the presence of multiple SetLocals, or a mix of SetLocals and Phantoms
https://bugs.webkit.org/show_bug.cgi?id=100461

Reviewed by Oliver Hunt and Gavin Barraclough.

This does a couple of things. First, it removes the part of the change in r131822 that made the forward
OSR exit calculator capable of handling multiple SetLocals. That change was wrong, because it would
blindly assume that all SetLocals had the same ValueRecovery, and would ignore the possibility that if
there is no value recovery then a ForwardCheckStructure on the first SetLocal would not know how to
recover the state associated with the second SetLocal. Then, it introduces the invariant that any bytecode
op that decomposes into multiple SetLocals must first emit dead SetLocals as hints and then emit a second
set of SetLocals to actually do the setting of the locals. This means that if a ForwardCheckStructure (or
any other hoisted forward speculation) is inserted, it will always be inserted on the second set of
SetLocals (since hoisting only touches the live ones), at which point OSR will already know about the
mov hints implied by the first set of (dead) SetLocals. This gives us the behavior we wanted, namely, that
a ForwardCheckStructure applied to a variant set by a resolve_with_base-like operation can correctly do a
forward exit while also ensuring that prior to exiting we set the appropriate locals.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::OSRExit):
* dfg/DFGOSRExit.h:
(OSRExit):
* dfg/DFGOSRExitCompiler.cpp:
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132701 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Prevent NaN offset values in ElementTimeControl.
https://bugs.webkit.org/show_bug.cgi?id=100322

Reviewed by Abhishek Arya.

Source/WebCore:

NaN values can cause ElementTimeControl to go back in time!
If a value of NaN is passed to ElementTimeControl::beginElementAt(offset),
subsequent sorting will cause an assert in SVGSMILElement::findInstanceTime
because NaN values are not properly sorted. NaN SMILTime values
should not be allowed at all, so this patch adds a check for them in
ElementTimeControl's setters.

This patch also adds preventative asserts to catch if SMILTime is ever
initialized with NaN, or if addEndTime/addBeginTime are ever called
with NaN values.

Test: svg/custom/elementTimeControl-nan-crash.html

* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::beginElementAt):
(WebCore::SVGAnimationElement::endElementAt):
* svg/animation/SMILTime.h:
(WebCore::SMILTime::SMILTime):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::addBeginTime):
(WebCore::SVGSMILElement::addEndTime):

LayoutTests:

* svg/custom/elementTimeControl-nan-crash-expected.txt: Added.
* svg/custom/elementTimeControl-nan-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132702 268f45cc-cd09-0410-ab3c-d52691b4dbfc