[skia] Handle mask box image.
https://bugs.webkit.org/show_bug.cgi?id=100570

Reviewed by James Robinson.

Source/WebCore:

When drawing an image with source rectangle it should intersect with image rectangle.
This should be the case for drawing single image and tiling an image.

Test: fast/images/mask-box-image-crash.html

* platform/graphics/skia/ImageSkia.cpp:
(WebCore::Image::drawPattern):
(WebCore::BitmapImage::draw):
(WebCore::BitmapImageSingleFrameSkia::draw):

LayoutTests:

Added a test for -webkit-mask-box-image. Test should complete without crashes.
Output image should be blank.

* fast/images/mask-box-image-crash-expected.png: Added.
* fast/images/mask-box-image-crash-expected.txt: Added.
* fast/images/mask-box-image-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132844 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove ensureAuxiliaryContext
https://bugs.webkit.org/show_bug.cgi?id=99975

Patch by Dan Carney <dcarney@google.com> on 2012-10-29
Reviewed by Adam Barth.

Source/WebCore:

Removed auxilliaryContext as use if it is problematic in IDB.

No new tests. No change in functionality.

* Modules/indexeddb/IDBCursor.cpp:
(WebCore::IDBCursor::update):
(WebCore::IDBCursor::setValueReady):
* Modules/indexeddb/IDBCursor.h:
(IDBCursor):
* Modules/indexeddb/IDBObjectStore.cpp:
(WebCore::generateIndexKeysForValue):
(WebCore::IDBObjectStore::put):
(WebCore):
* Modules/indexeddb/IDBRequest.cpp:
(WebCore::IDBRequest::onSuccess):
(WebCore::IDBRequest::dispatchEvent):
* bindings/v8/IDBBindingUtilities.cpp:
(WebCore::createIDBKeyFromScriptValueAndKeyPath):
(WebCore::deserializeIDBValue):
(WebCore::injectIDBKeyIntoScriptValue):
* bindings/v8/IDBBindingUtilities.h:
(WebCore):
* bindings/v8/V8Binding.cpp:
(WebCore::toV8Context):
(WebCore):
* bindings/v8/V8Binding.h:
(WebCore):
* bindings/v8/V8PerIsolateData.cpp:
(WebCore):
* bindings/v8/V8PerIsolateData.h:

Source/WebKit/chromium:

Updated tests to use correct v8 context.

* tests/IDBBindingUtilitiesTest.cpp:
(WebKit::checkKeyFromValueAndKeyPathInternal):
(WebKit::checkKeyPathNullValue):
(WebKit::injectKey):
(WebKit::checkInjection):
(WebKit::checkInjectionFails):
(WebKit::checkKeyPathStringValue):
(WebKit::checkKeyPathNumberValue):
(WebKit::scriptExecutionContext):
(WebKit):
(WebKit::TEST):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132845 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed rebaseline of webaudio/audiobuffersource-loop-points

* platform/chromium-win-xp/webaudio/audiobuffersource-loop-points-expected.wav: Added.
* platform/chromium-win/webaudio/audiobuffersource-loop-points-expected.wav: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132846 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Let SVGElements have pending resources.
https://bugs.webkit.org/show_bug.cgi?id=99694

Reviewed by Eric Seidel.

Our SVG pending resource tracking is used for handling dynamic id changes. For example,
if an SVG element references an id that is not yet in the document (or has been removed),
the SVG element will be 'pending' an id. When styled elements are inserted into
the document, buildPendingResourcesIfNeeded() is called to force any pending elements
to resolve their dependencies. Only SVGStyledElement targets can be referenced using
this infrastructure, and that is not changed with this patch.

Previously, only SVGStyledElements could have pending resources. Some examples of where
this is violated are SVGAnimateElement and SVGMPathElement which are not a styled elements
but which can have pending references (they can reference styled elements and
paths, respectively). This patch changes the pending resource handling to allow
any SVGElement to have pending resources.

This patch is only a refactoring of code in preparation for WK99694 and does not
affect existing functionality or tests.

* svg/SVGDocumentExtensions.cpp:
(WebCore::SVGDocumentExtensions::addPendingResource):
(WebCore::SVGDocumentExtensions::isElementPendingResources):
(WebCore::SVGDocumentExtensions::isElementPendingResource):
(WebCore::SVGDocumentExtensions::removeElementFromPendingResources):
(WebCore::SVGDocumentExtensions::removeElementFromPendingResourcesForRemoval):
* svg/SVGDocumentExtensions.h:
(WebCore):
(SVGDocumentExtensions):
* svg/SVGElement.cpp:
(WebCore::SVGElement::~SVGElement):
(WebCore::SVGElement::removedFrom):
(WebCore::SVGElement::hasPendingResources):
(WebCore):
(WebCore::SVGElement::setHasPendingResources):
(WebCore::SVGElement::clearHasPendingResourcesIfPossible):
* svg/SVGElement.h:
(SVGElement):
(WebCore::SVGElement::buildPendingResource):
* svg/SVGStyledElement.cpp:
(WebCore):
(WebCore::SVGStyledElement::buildPendingResourcesIfNeeded):
(WebCore::SVGStyledElement::removedFrom):
* svg/SVGStyledElement.h:
(SVGStyledElement):
(WebCore::SVGStyledElement::selfHasRelativeLengths):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132847 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: Crash on checking version of corrupt backing store
https://bugs.webkit.org/show_bug.cgi?id=100692

Reviewed by Tony Chang.

If the backing store fails to open (due to corruption, non-writeable disk, etc)
the subsequent schema version check dereferences a null pointer. Fix to only
do the schema check if the database opened.

Chromium tests will be included with crrev.com/11196029

* Modules/indexeddb/IDBLevelDBBackingStore.cpp:
(WebCore::IDBLevelDBBackingStore::open):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132848 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Block SVG external references pending a security review
https://bugs.webkit.org/show_bug.cgi?id=100635

Reviewed by Eric Seidel.

Source/WebCore:

We need to do a security review of loading external SVG references
before we're sure that it is safe.

* css/StyleResolver.cpp:
(WebCore::StyleResolver::createFilterOperations):
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::canRequest):

Source/WTF:

We need to do a security review of loading external SVG references
before we're sure that it is safe.

* wtf/Platform.h:

LayoutTests:

Skip tests that depend on external SVG references.

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132849 268f45cc-cd09-0410-ab3c-d52691b4dbfc