Protect against resource deletion during iteration in MemoryCache::pruneDeadResourcesToSize
https://bugs.webkit.org/show_bug.cgi?id=101211

Reviewed by Andreas Kling.
        
Some crashes have been seen under MemoryCache::pruneDeadResourcesToSize. A possible cause is that
destroyDecodedData() call ends up evicting the resource pointed by 'previous' pointer during iteration
and deleting the object. This looks in principle possible via stylesheets and SVG images.
        
Speculative fix, no repro, no obvious way to construct a test.

* loader/cache/MemoryCache.cpp:
(WebCore::MemoryCache::pruneDeadResourcesToSize):
        
    Use CachedResourceHandle to protect the 'previous' pointer during iteration. Check if the
    resource has been kicked out from the cache during destroyDecodedData() and stop iterating
    if has (as it may die when CachedResourceHandle releases it).
    The 'current' pointer is not protected as the resource it points to is allowed to die.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133469 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Add a now-failing test, remove a now-passing test.  Unreviewed.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133471 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Mark a flaky test.  Unreviewed.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133473 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Exclusions] Layout of the first shape-inside line can be incorrect
https://bugs.webkit.org/show_bug.cgi?id=100996

Patch by Hans Muller <hmuller@adobe.com> on 2012-11-05
Reviewed by Dirk Schulze.

Source/WebCore:

Made the conversion from floating point top/bottom logical shape bounds coordinates
LayoutUnits explicit and corrected the case where the top value was truncated.  A
float logicalTop value is converted to LayoutUnit with fromFloatCeil() to ensure
that the LayoutUnit value is within the shape.

Test: fast/exclusions/shape-inside/shape-inside-shape-logical-top.html

* rendering/ExclusionShapeInsideInfo.h:
(WebCore::ExclusionShapeInsideInfo::shapeLogicalTop): Redefined this method in terms of shapeLogicalBoundsY,Max().
(WebCore::ExclusionShapeInsideInfo::shapeLogicalBottom):  Ditto.
(WebCore::ExclusionShapeInsideInfo::lineOverlapsShapeBounds):  Ditto.
(ExclusionShapeInsideInfo):
(WebCore::ExclusionShapeInsideInfo::shapeLogicalBoundsY): Explicit conversion from floating point shape coordinates to LayoutUnits.
(WebCore::ExclusionShapeInsideInfo::shapeLogicalBoundsMaxY): Ditto.

LayoutTests:

Verify that the first line of shape-inside content is laid out correctly
when the top of the shape's bounds has a non-integral value.

* fast/exclusions/shape-inside/shape-inside-shape-logical-top-expected.html: Added.
* fast/exclusions/shape-inside/shape-inside-shape-logical-top.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133475 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Web Inspector: Add InspectorInstrumentaiton calls for timeline compositing.
https://bugs.webkit.org/show_bug.cgi?id=101213
RIM PR 178131

Reviewed by Rob Buis.

Internally Reviewed by Arvid Nilsson.

Added compositing events to the timeline for BlackBerry.

* Api/WebPage.cpp:
(BlackBerry::WebKit::WebPagePrivate::commitRootLayerIfNeeded):
(BlackBerry::WebKit::WebPagePrivate::willComposite):
(WebKit):
(BlackBerry::WebKit::WebPagePrivate::didComposite):
* Api/WebPage_p.h:
(WebPagePrivate):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133477 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Dispose() and Clear() should be always coupled for safety
https://bugs.webkit.org/show_bug.cgi?id=101191

Reviewed by Adam Barth.

Clear() is not mandatory. However, to avoid misusing already
disposed wrappers, Clear() should be always called just
after Dispose().

No tests. No change in behavior.

* bindings/v8/DOMWrapperMap.h:
(WebCore::DOMWrapperHashMap::defaultWeakCallback):
* bindings/v8/IntrusiveDOMWrapperMap.h:
(WebCore::IntrusiveDOMWrapperMap::weakCallback):
* bindings/v8/NPV8Object.cpp:
(WebCore::freeV8NPObject):
* bindings/v8/ScheduledAction.cpp:
(WebCore::ScheduledAction::~ScheduledAction):
* bindings/v8/V8NPObject.cpp:
(WebCore::V8NPTemplateMap::dispose):
(WebCore::weakNPObjectCallback):
(WebCore::forgetV8ObjectForNPObject):
* bindings/v8/V8PerContextData.cpp:
(WebCore::V8PerContextData::dispose):
* bindings/v8/V8ValueCache.cpp:
(WebCore::cachedStringCallback):
(WebCore::IntegerCache::~IntegerCache):
* bindings/v8/custom/V8InjectedScriptManager.cpp:
(WebCore::WeakReferenceCallback):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133479 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Cairo] Make Cairo honor image orientation
https://bugs.webkit.org/show_bug.cgi?id=101207

Reviewed by Kenneth Rohde Christiansen.

Source/WebCore:

Implement transformed image drawing in BitmapImageCairo, similar
as it was done for Skia in bug 100179, r132384.
The image drawing code needs to transform the graphics context
depending on exif orientation in order for this to work.

No new tests, covered by fast/images/exif-* which are passing now.

* platform/graphics/BitmapImage.h: Enable draw function which respects image orientation for Cairo.
* platform/graphics/cairo/BitmapImageCairo.cpp:
(WebCore::BitmapImage::draw): Apply ImageOrientation's transformFromDefault() transformation to context.
(WebCore):

LayoutTests:

Unskip and rebaseline exif orientation tests for EFL.

* platform/efl-wk1/TestExpectations: Tests not passing here yet, since DRT needs a setShouldRespectImageOrientation setting.
* platform/efl/TestExpectations: Unskipping three exif orientation tests.
* platform/efl/fast/images/exif-orientation-css-expected.png: Added.
* platform/efl/fast/images/exif-orientation-css-expected.txt: Added.
* platform/efl/fast/images/exif-orientation-expected.png: Added.
* platform/efl/fast/images/exif-orientation-expected.txt: Added.
* platform/efl/fast/images/exif-orientation-image-document-expected.png: Added.
* platform/efl/fast/images/exif-orientation-image-document-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133482 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a comment about a return value of IDBKey::toV8()
https://bugs.webkit.org/show_bug.cgi?id=101212

Reviewed by Adam Barth.

Although all other toV8(impl) return null when impl is 0,
IDBKey::toV8(impl) is expected to return undefined when impl is 0.
This patch adds a comment about it.

No tests.

* bindings/js/JSIDBKeyCustom.cpp:
(WebCore::toJS):
* bindings/v8/custom/V8IDBKeyCustom.cpp:
(WebCore::toV8):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133483 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Mark inspector-protocol/debugger-pause-dedicated-worker.html
as also crashy, and give it a bug ID.  Unreviewed.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133486 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Unreviewed gardening, unskip now passing tests.

* platform/qt/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133487 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Use POSIX implementation of SharedBuffer::createWithContentsOfFile()
https://bugs.webkit.org/show_bug.cgi?id=101228

Patch by Christophe Dumez <christophe.dumez@intel.com> on 2012-11-05
Reviewed by Kenneth Rohde Christiansen.

Get rid of EFL-specific implementation of SharedBuffer::createWithContentsOfFile()
and reuse the POSIX one since it is pretty much the same.

No new tests, no behavior change.

* PlatformEfl.cmake:
* platform/efl/SharedBufferEfl.cpp: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133488 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Exclusions] Polygon edges should span colinear vertices
https://bugs.webkit.org/show_bug.cgi?id=99343

Patch by Hans Muller <hmuller@adobe.com> on 2012-11-05
Reviewed by Dirk Schulze.

Source/WebCore:

ExclusionPolygonEdges now span coincident and collinear vertices. Currently
pairs of vertices are only considered coincident if their coordinates are exactly
equal. Similarly, a vertex is only considered collinear with an edge if the area
of the triangle defined by the three vertices is exactly zero.  In the future it
may be useful to relax the comparison with zero.

Tests: fast/exclusions/shape-inside/shape-inside-coincident-vertices.html
       fast/exclusions/shape-inside/shape-inside-collinear-vertices.html

* rendering/ExclusionPolygon.cpp:
(WebCore::determinant): Used to measure collinearity.
(WebCore):
(WebCore::areCollinearPoints): True if three FloatPoint arguments are collinear per the test outlined above.
(WebCore::areCoincidentPoints): True if the two FloatPoint arguments are equal.
(WebCore::nextVertexIndex): The next vertex index in clockwise or counterclockwise order.
(WebCore::ExclusionPolygon::findNextEdgeVertexIndex): Return the index of the next non-coincident, non-collinear vertex.
(WebCore::ExclusionPolygon::ExclusionPolygon): Skip coincident and collinear vertices when building the list of edges.
* rendering/ExclusionPolygon.h: Added private findNextEdgeVertexIndex() declaration.

LayoutTests:

Verify that exclusion polygonal shape-inside layout is unaffected by coincident
or collinear vertices.

* fast/exclusions/shape-inside/shape-inside-coincident-vertices-expected.html: Added.
* fast/exclusions/shape-inside/shape-inside-coincident-vertices.html: Added.
* fast/exclusions/shape-inside/shape-inside-collinear-vertices-expected.html: Added.
* fast/exclusions/shape-inside/shape-inside-collinear-vertices.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133490 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Unreviewed gardening, unskip a now passing test.

* platform/qt-5.0-wk1/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133491 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Decouple Attr logic from ElementAttributeData.
<http://webkit.org/b/101126>

Reviewed by Antti Koivisto.

Move all logic dealing with Attr DOM nodes from ElementAttributeData to Element.
This makes more sense since an Attr is tied to a single Element, but an ElementAttributeData
can be shared by any number of Elements at a given time.

Also updated naming convention from just "Attr" to "Attr node" in the code I was touching.
"Attr" is way too generic, and has been historically confused with WebCore::Attribute a lot.

* dom/Element.h:
* dom/ElementAttributeData.h:
* dom/Element.cpp:
(WebCore::attrNodeListMap):
(WebCore::attrNodeListForElement):
(WebCore::ensureAttrNodeListForElement):
(WebCore::removeAttrNodeListForElement):
(WebCore::findAttrNodeInList):
(WebCore::Element::~Element):
(WebCore::Element::detachAttribute):
(WebCore::Element::setAttributeNode):
(WebCore::Element::removeAttributeInternal):
(WebCore::Element::getAttributeNode):
(WebCore::Element::getAttributeNodeNS):
(WebCore::Element::normalizeAttributes):
(WebCore::Element::attrIfExists):
(WebCore::Element::ensureAttr):
(WebCore::Element::detachAttrNodeFromElementWithValue):
(WebCore::Element::detachAllAttrNodesFromElement):
(WebCore::Element::cloneAttributesFromElement):

    Move everything Attr-related into Element.cpp while simplifying some loops and remove
    conditions that are no longer needed as they used to depend on having an attributeData().

* dom/Node.h:
(WebCore::Node::hasSyntheticAttrChildNodes):
(WebCore::Node::setHasSyntheticAttrChildNodes):

    Renamed the hasAttrList() node flag to hasSyntheticAttrChildNodes().

* dom/Attr.cpp:
(WebCore::Attr::detachFromElementWithValue):

    Remove awkward indirection and let the call site deal with removing the Attr node from
    the Element's list of Attr nodes.

* dom/ElementAttributeData.cpp:
(WebCore::ElementAttributeData::clearAttributes):

    Remove now-unused Element* argument.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133492 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reduce the verbosity of referring to QNaN in JavaScriptCore
https://bugs.webkit.org/show_bug.cgi?id=101174

Reviewed by Geoffrey Garen.

Introduces a #define QNaN in JSValue.h, and replaces all previous uses of
std::numeric_limits<double>::quiet_NaN() with QNaN.

* API/JSValueRef.cpp:
(JSValueMakeNumber):
(JSValueToNumber):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitFloatTypedArrayGetByVal):
* runtime/CachedTranscendentalFunction.h:
(JSC::CachedTranscendentalFunction::initialize):
* runtime/DateConstructor.cpp:
(JSC::constructDate):
* runtime/DateInstanceCache.h:
(JSC::DateInstanceData::DateInstanceData):
(JSC::DateInstanceCache::reset):
* runtime/ExceptionHelpers.cpp:
(JSC::InterruptedExecutionError::defaultValue):
(JSC::TerminatedExecutionError::defaultValue):
* runtime/JSCell.h:
(JSC::JSValue::getPrimitiveNumber):
* runtime/JSDateMath.cpp:
(JSC::parseDateFromNullTerminatedCharacters):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):
(JSC::JSGlobalData::resetDateCache):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::parseInt):
(JSC::jsStrDecimalLiteral):
(JSC::toDouble):
(JSC::jsToNumber):
(JSC::parseFloat):
* runtime/JSValue.cpp:
(JSC::JSValue::toNumberSlowCase):
* runtime/JSValue.h:
(JSC):
* runtime/JSValueInlineMethods.h:
(JSC::jsNaN):
* runtime/MathObject.cpp:
(JSC::mathProtoFuncMax):
(JSC::mathProtoFuncMin):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133493 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement SimpleFontData::platformBoundsForGlyph on skia
https://bugs.webkit.org/show_bug.cgi?id=101115

Reviewed by Eric Seidel.

Source/WebCore:

The implementation is similar to SimpleFontData::platformWidthForGlyph on skia.

Tested by: fast/block/lineboxcontain/*glyphs*, mathml/presentation/*

* platform/graphics/skia/SimpleFontDataSkia.cpp:
(WebCore::SimpleFontData::platformBoundsForGlyph): Implemented.

LayoutTests:

Some lineboxcontain/etc. tests will need rebaselining.

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133494 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Rolled DEPS.

* DEPS:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133495 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] toV8(impl) should return null if impl is 0
https://bugs.webkit.org/show_bug.cgi?id=101206

Reviewed by Adam Barth.

toV8(impl) should return null if impl is 0. However,
V8HTMLCollection::toV8() does not have the null check.
All other toV8()s return null.

No tests. I think there will be no call path that hits the change.

* bindings/v8/custom/V8HTMLCollectionCustom.cpp:
(WebCore::toV8):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133496 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Build fix after http://trac.webkit.org/changeset/133488.
Removed a deleted file.  Unreviewed.

* WebCore.gypi:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133497 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Pass canPaintLCDText to WebContentLayerClient::paintContents
https://bugs.webkit.org/show_bug.cgi?id=99083

Reviewed by Stephen White.

Use LCD text setting passed to WebContentLayerClient::paintContents instead of turning it off for all composited layers.

Source/Platform:

* chromium/public/WebContentLayerClient.h:
(WebContentLayerClient):
(WebKit::WebContentLayerClient::paintContents):

Source/WebCore:

No new tests needed. This patch does not change anything functionally.

* platform/graphics/chromium/GraphicsLayerChromium.cpp:
(WebCore::GraphicsLayerChromium::setContentsOpaque):
(WebCore::GraphicsLayerChromium::paint):
* platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
(WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
* platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
(OpaqueRectTrackingContentLayerDelegate):

Source/WebKit/chromium:

* src/LinkHighlight.cpp:
(WebKit::LinkHighlight::paintContents):
* src/LinkHighlight.h:
(LinkHighlight):
* src/NonCompositedContentHost.cpp:
(WebKit::NonCompositedContentHost::NonCompositedContentHost):
(WebKit::NonCompositedContentHost::setOpaque):
(WebKit::NonCompositedContentHost::paintContents):
* src/NonCompositedContentHost.h:
(NonCompositedContentHost):
* tests/OpaqueRectTrackingContentLayerDelegateTest.cpp:
(WebCore::TEST_F):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133499 268f45cc-cd09-0410-ab3c-d52691b4dbfc