Heap-use-after-free in WebKit::MainThreadFileSystemCallbacks
https://bugs.webkit.org/show_bug.cgi?id=87019

Reviewed by David Levin.

Should not access the CallbacksBridge's member field after it's freed.

* src/WorkerFileSystemCallbacksBridge.cpp:
(WebKit::WorkerFileSystemCallbacksBridge::cleanUpAfterCallback):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121160 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove responseBlob field from XMLHttpResponse.idl
https://bugs.webkit.org/show_bug.cgi?id=89859

Reviewed by Eric Seidel.

Remove XMLHttpResponse.responseBlob from XMLHttpResponse.idl, which
has only been exposed for a very limited time (since r120574) but
probably should not have been done so since XHR2 spec no longer has
the field.  A quick search also showed that no one seems to be using the field.

(More context: the field was added long time ago with a runtime guard
which had never been enabled until the guard was removed in r120574
to remove XHR_RESPONSE_BLOB on all platforms.)

No new tests as no tests use this field.

* xml/XMLHttpRequest.idl: Removed responseBlob field.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121161 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Shadow] Executing Italic and InsertUnorderedList in Shadow DOM causes a crash
https://bugs.webkit.org/show_bug.cgi?id=88495

Reviewed by Ryosuke Niwa.

Source/WebCore:

InsertionPoint::removedFrom(insertionPoint) tries to find its owner ElementShadow from
parentNode or insertionPoint. If the parent node exsits but we cannot reach ElementShadow from
the parent node, InsertionPoint::removedFrom does not try to find ElementShadow anymore.

It's OK if the ElementShadow is being destructed, but there is a case ElementShadow is not being
destructed in editing. In this case, we should try to find ElementShadow from insertionPoint.
Otherwise it will bring inconsistency to Shadow DOM, and causes a crash.

Actually checking the existence of parentNode() does not make any sense. We should get
shadowRoot() directly.

Test: editing/shadow/insertorderedlist-crash.html

* html/shadow/InsertionPoint.cpp:
(WebCore::InsertionPoint::removedFrom):

LayoutTests:

* editing/shadow/insertorderedlist-crash-expected.txt: Added.
* editing/shadow/insertorderedlist-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121162 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Support screenDepth() functionality.
https://bugs.webkit.org/show_bug.cgi?id=89423

Reviewed by Kenneth Rohde Christiansen.

Support screenDepth() based on ecore_x_window_depth_get(). This functionality may be used by
both WebKit1 and WebKit2. So, concrete function is placed into EflScreenUtilities.cpp.

This patch can't support existing test cases. Because, EFL DumpRenderTree works without X11 window
by default.

* platform/efl/EflScreenUtilities.cpp:
(WebCore::getPixelDepth):
(WebCore):
* platform/efl/EflScreenUtilities.h:
(WebCore):
* platform/efl/PlatformScreenEfl.cpp:
(WebCore::screenDepth):
(WebCore::screenDepthPerComponent):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121163 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Split map* functions out of StyleResolver into a helper object
https://bugs.webkit.org/show_bug.cgi?id=89881

Reviewed by Daniel Bates.

These map* functions are completely independent of the rest of StyleResolver
and only exist to serve StyleBuilder.
CSSToStyleMap doesn't even want to have a StyleResolver pointer, but
currently needs one to access the resolve-lifetime caches for the
current resolve.  Once we split out that per-resolve state into
some sort of ResolveState/ResolveInfo object (akin to PaintInfo/LayoutState)
then this object will be even simpler.

No behavioral change, thus no tests.

* CMakeLists.txt:
* GNUmakefile.list.am:
* WebCore.gypi:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
* css/CSSToStyleMap.cpp: Added.
(WebCore):
(WebCore::CSSToStyleMap::style):
(WebCore::CSSToStyleMap::rootElementStyle):
(WebCore::CSSToStyleMap::useSVGZoomRules):
(WebCore::CSSToStyleMap::styleImage):
(WebCore::CSSToStyleMap::mapFillAttachment):
(WebCore::CSSToStyleMap::mapFillClip):
(WebCore::CSSToStyleMap::mapFillComposite):
(WebCore::CSSToStyleMap::mapFillOrigin):
(WebCore::CSSToStyleMap::mapFillImage):
(WebCore::CSSToStyleMap::mapFillRepeatX):
(WebCore::CSSToStyleMap::mapFillRepeatY):
(WebCore::CSSToStyleMap::mapFillSize):
(WebCore::CSSToStyleMap::mapFillXPosition):
(WebCore::CSSToStyleMap::mapFillYPosition):
(WebCore::CSSToStyleMap::mapAnimationDelay):
(WebCore::CSSToStyleMap::mapAnimationDirection):
(WebCore::CSSToStyleMap::mapAnimationDuration):
(WebCore::CSSToStyleMap::mapAnimationFillMode):
(WebCore::CSSToStyleMap::mapAnimationIterationCount):
(WebCore::CSSToStyleMap::mapAnimationName):
(WebCore::CSSToStyleMap::mapAnimationPlayState):
(WebCore::CSSToStyleMap::mapAnimationProperty):
(WebCore::CSSToStyleMap::mapAnimationTimingFunction):
(WebCore::CSSToStyleMap::mapNinePieceImage):
(WebCore::CSSToStyleMap::mapNinePieceImageSlice):
(WebCore::CSSToStyleMap::mapNinePieceImageQuad):
(WebCore::CSSToStyleMap::mapNinePieceImageRepeat):
* css/CSSToStyleMap.h: Added.
(WebCore):
(CSSToStyleMap):
(WebCore::CSSToStyleMap::CSSToStyleMap):
* css/StyleBuilder.cpp:
(WebCore::ApplyPropertyFillLayer::applyValue):
(WebCore::ApplyPropertyBorderImage::applyValue):
(WebCore::ApplyPropertyBorderImageModifier::applyValue):
(WebCore):
(WebCore::ApplyPropertyAnimation::map):
(WebCore::StyleBuilder::StyleBuilder):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::StyleResolver):
(WebCore::StyleResolver::collectMatchingRulesForList):
* css/StyleResolver.h:
(WebCore::StyleResolver::styleMap):
(StyleResolver):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121164 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERT(m_wheelEventHandlerCount > 0) can fire
https://bugs.webkit.org/show_bug.cgi?id=89856

Reviewed by Eric Seidel.

Source/WebCore:

When a node with a wheel or a touch event is moved from one document to
another, the didAddMumble/didRemoveMumble calls do not balance because
they're called on different documents. This patch twiddles the counts
appropriately in that case.

Test: fast/events/move-element-with-wheel-and-touch-event-listeners.html

* dom/EventNames.h:
(WebCore::EventNames::isTouchEventType):
(EventNames):
(WebCore::EventNames::touchEventNames):
* dom/Node.cpp:
(WebCore::Node::didMoveToNewDocument):

LayoutTests:

Test what happens when we move a node with wheel and/or touch events
from one document to another. Prior to this patch, this test triggers
ASSERT(m_wheelEventHandlerCount > 0) in Document.cpp.

* fast/events/move-element-with-wheel-and-touch-event-listeners-expected.txt: Added.
* fast/events/move-element-with-wheel-and-touch-event-listeners.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@121166 268f45cc-cd09-0410-ab3c-d52691b4dbfc