The order of resolving distribution in tree composition is wrong.
https://bugs.webkit.org/show_bug.cgi?id=99552

Reviewed by Dimitri Glazkov.

Source/WebCore:

According to the current ShadowDOM spec, we have to resolve <content> first, then resolve <shadow>.
However, the order of resolution is now the mixed tree order of <content> and <shadow>.

Test: fast/dom/shadow/content-reprojection-order.html

* html/shadow/ContentDistributor.cpp:
(WebCore::ContentDistributor::distribute): We should resolve <content> before <shadow>.
Only the first active shadow insertion point can select the rest of contents.
* html/shadow/HTMLContentElement.h:
(HTMLContentElement):
* html/shadow/HTMLShadowElement.cpp:
* html/shadow/HTMLShadowElement.h:
(WebCore::isHTMLShadowElement):
(WebCore):
(WebCore::toHTMLShadowElement):
* html/shadow/InsertionPoint.h:
(InsertionPoint): We don't need doesSelectFromHostChildren() anymore.

LayoutTests:

We also fix the existing wrong test.

* fast/dom/shadow/content-reprojection-order-expected.html: Added.
* fast/dom/shadow/content-reprojection-order.html: Added.
* fast/dom/shadow/shadow-element-rendering-single.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: array grouping does not work for arrays with exactly 10000 elements.
https://bugs.webkit.org/show_bug.cgi?id=100131

Reviewed by Vsevolod Vlasov.

Source/WebCore:

Using ceil() - 1 instead of floor() in bucket size calculation.

* inspector/front-end/ObjectPropertiesSection.js:

LayoutTests:

* inspector/console/console-big-array-expected.txt:
* inspector/console/console-big-array.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132238 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: paint rectangles are incorrectly shown in case subframes are present
https://bugs.webkit.org/show_bug.cgi?id=99849

Reviewed by Pavel Feldman.

Move GraphicsContext and paint rectangle from willPaint() to didPaint(), so we don't have
to store them as a state of InspectorPageAgent

* inspector/InspectorInstrumentation.cpp:
(WebCore):
(WebCore::InspectorInstrumentation::willPaintImpl):
(WebCore::InspectorInstrumentation::didPaintImpl):
* inspector/InspectorInstrumentation.h:
(InspectorInstrumentation):
(WebCore::InspectorInstrumentation::willPaint):
(WebCore::InspectorInstrumentation::didPaint):
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::didPaint):
* inspector/InspectorPageAgent.h:
* inspector/InspectorTimelineAgent.cpp:
(WebCore::InspectorTimelineAgent::willPaint):
(WebCore::InspectorTimelineAgent::didPaint):
* inspector/InspectorTimelineAgent.h:
(InspectorTimelineAgent):
* inspector/TimelineRecordFactory.cpp:
* inspector/TimelineRecordFactory.h:
(TimelineRecordFactory):
* page/FrameView.cpp:
(WebCore::FrameView::paintContents):
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::paintContents):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132239 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Make selection in search input box not overlap cancel button
https://bugs.webkit.org/show_bug.cgi?id=100130

Reviewed by Antonio Gomes.

This ensures that even when selection is active, the user can still press 'cancel'.

* WebKitSupport/InputHandler.cpp:
(BlackBerry::WebKit::InputHandler::boundingBoxForInputField):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132240 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] remove the const qualifier from WebTestDelegate::printMessage
https://bugs.webkit.org/show_bug.cgi?id=100082

Reviewed by Adam Barth.

There's no reason the method should be const, and indeed for
content_shell we want to send an IPC which is a non-const operation.

* DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h:
(WebTestDelegate):
* DumpRenderTree/chromium/TestRunner/src/TestDelegate.h:
(TestDelegate):
* DumpRenderTree/chromium/TestRunner/src/WebTestInterfaces.cpp:
(WebTestInterfaces::Internal):
(WebTestRunner::WebTestInterfaces::Internal::printMessage):
* DumpRenderTree/chromium/WebViewHost.cpp:
(WebViewHost::printMessage):
* DumpRenderTree/chromium/WebViewHost.h:
(WebViewHost):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132241 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Enumerate Nodes via the V8 heap rather than via a list in WebCore
https://bugs.webkit.org/show_bug.cgi?id=100033

Reviewed by Eric Seidel.

This patch changes how we enumerate nodes during garbage collection.
After this patch, we use V8's list of open handles to enumerate node
wrappers rather than using a separate list that we maintain in WebCore
for this purpose. A future patch will remove the list in WebCore for a
DOM performance gain.

* bindings/js/ScriptProfiler.h:
(WebCore):
(WebCore::ScriptProfiler::visitNodeWrappers):
* bindings/scripts/CodeGeneratorV8.pm:
(GenerateToV8Converters):
* bindings/scripts/test/V8/V8TestNode.cpp:
(WebCore::V8TestNode::wrapSlow):
* bindings/v8/IntrusiveDOMWrapperMap.h:
(WebCore::IntrusiveDOMWrapperMap::set):
* bindings/v8/ScriptProfiler.cpp:
(WebCore::ScriptProfiler::visitNodeWrappers):
* bindings/v8/ScriptProfiler.h:
(WebCore):
(ScriptProfiler):
* bindings/v8/V8DOMMap.cpp:
(WebCore::NodeWrapperVisitor::~NodeWrapperVisitor):
(WebCore):
(WebCore::visitAllDOMNodes):
* bindings/v8/V8DOMMap.h:
(WebCore):
(NodeWrapperVisitor):
* bindings/v8/V8DOMWrapper.cpp:
(WebCore::V8DOMWrapper::setJSWrapperForDOMNode):
(WebCore::V8DOMWrapper::setJSWrapperForActiveDOMNode):
* bindings/v8/V8GCController.cpp:
(WebCore::NodeVisitor::visitNodeWrapper):
(WebCore::V8GCController::gcPrologue):
(WebCore::V8GCController::gcEpilogue):
* inspector/BindingVisitors.h:
(WebCore::WrappedNodeVisitor::~WrappedNodeVisitor):
* inspector/InspectorMemoryAgent.cpp:
(WebCore):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132242 268f45cc-cd09-0410-ab3c-d52691b4dbfc