WebKitLoaderClient: add missing initializer.
https://bugs.webkit.org/show_bug.cgi?id=97930

Patch by Alberto Garcia <agarcia@igalia.com> on 2012-09-28
Reviewed by Martin Robinson.

WKPageLoaderClient is missing the initializer for the didLayout
field. Fixes -Wmissing-field-initializers.

* UIProcess/API/gtk/WebKitLoaderClient.cpp:
(attachLoaderClientToView):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129937 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: [HarfBuzz] harfbuzz expects log_clusters to have same length as other buffers.
https://bugs.webkit.org/show_bug.cgi?id=97725

Reviewed by Tony Chang.

log_clusters should have same length as other buffers, which is number of glyphs.

Test: fast/text/international/harfbuzz-buffer-overrun.html

* platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
(WebCore::ComplexTextController::ComplexTextController):
(WebCore::ComplexTextController::~ComplexTextController):
(WebCore::ComplexTextController::deleteGlyphArrays):
(WebCore::ComplexTextController::createGlyphArrays):

LayoutTests: [HarfBuzz] harfbuzz expects log_clusters to have same length as other buffers
https://bugs.webkit.org/show_bug.cgi?id=97725

Reviewed by Tony Chang.

Add a test case. A buffer overrun doesn't always cause immediate crash unless it runs with some
memory verification techs like WTF_FASTMALLOC_VALIDATION.

* fast/text/international/harfbuzz-buffer-overrun-expected.txt: Added.
* fast/text/international/harfbuzz-buffer-overrun.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129938 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unskip fast/text/descent-clip-in-scaled-page.html
https://bugs.webkit.org/show_bug.cgi?id=91552

The test now passes on Mac.

* platform/mac/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129939 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r129911.
http://trac.webkit.org/changeset/129911
https://bugs.webkit.org/show_bug.cgi?id=97933

Inspector test crashes on win debug (Requested by jsbell on
#webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-09-28

* Modules/indexeddb/IDBTransactionBackendImpl.cpp:
(WebCore::IDBTransactionBackendImpl::abort):
(WebCore::IDBTransactionBackendImpl::taskTimerFired):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129940 268f45cc-cd09-0410-ab3c-d52691b4dbfc
webkit-patch rebaseline-expectations is broken
https://bugs.webkit.org/show_bug.cgi?id=97619

Reviewed by Ojan Vafai.

The new expectations format is causing two problems for
webkit-patch rebaseline expectations

1) the transformation into and out of the old syntax (which is
still used internally) is somewhat lossy, e.g., we're not
preserving the case of Bug(x) identifiers. Also, we can't
tell if the input was [ WontFix ] or [ Skip WontFix Pass ]
2) the new syntax is more lenient, allowing for multiple ways to
specify the same result, e.g., "[ Skip ]" may or may not be
missing.

As a result, we end up rewriting a whole bunch of lines for
purely syntactic differences.

Both of these things are bugs that need to be fixed, but
we should also not just rewrite lines that shouldn't be
modified.

This patch fixes the last issue (no rewriting).

* Scripts/webkitpy/layout_tests/models/test_expectations.py:
(TestExpectationLine._format_line):
(TestExpectations.remove_rebaselined_tests):
* Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py:
(RebaseliningTest.test_remove):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129941 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Pass the correct path length to _NSGetExecutablePath
https://bugs.webkit.org/show_bug.cgi?id=97935

Reviewed by Sam Weinig.

* WebProcessServiceForWebKitDevelopment/WebProcessServiceForWebKitDevelopmentMain.mm:
(WebProcessServiceForWebKitDevelopmentEventHandler):
Initialize pathLength before passing it to _NSGetExecutablePath.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129942 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFGStructureHoistingPhase SetLocal assumes StructureTransitionWatchpoint has a structure set
https://bugs.webkit.org/show_bug.cgi?id=97810

Reviewed by Mark Hahnenberg.

No tests because this can't happen in ToT: the structure check hoisting phase runs before any
CFA or folding, so the only StructureTransitionWatchpoints it will see are the ones inserted
by the parser. But the parser will only insert StructureTransitinWatchpoints on constants, which
will not be subject to SetLocals.

Still, it would be good to fix this in case things changed.

* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash re-entering Document layout with frame flattening enabled
https://bugs.webkit.org/show_bug.cgi?id=97841

Reviewed by Kenneth Rohde Christiansen.

Source/WebCore:

Walking up to parent FrameViews when doing a frame-flattening
layout should walk via the Frame tree, not the Widget hierarchy.
Walking via the Frame tree ensures that we don't walk up to the
root Frame when laying out a subframe that is in the page cache.
That's bad, because the root Frame is reused for the new
page, and laying it out from a frame in the page cache causes
re-entrant layout.

Test: plugins/frameset-with-plugin-frame.html

* page/FrameView.cpp:
(WebCore::FrameView::parentFrameView):

LayoutTests:

Test that navigates from one frameset to another frameset, where
one of the subframes contains a plugin.

* plugins/frameset-with-plugin-frame-expected.txt: Added.
* plugins/frameset-with-plugin-frame.html: Added.
* plugins/resources/frame-with-plugin-subframe.html: Added.
* plugins/resources/target-frameset-frame.html: Added.
* plugins/resources/target-frameset.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129944 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Chromium should respect 'text-rendering:geometricPrecision' by disabling hinting.
https://bugs.webkit.org/show_bug.cgi?id=97932

Patch by Ben Wagner <bungeman@chromium.org> on 2012-09-28
Reviewed by Stephen White.

When text-redering:geometricPrecision css property is present, the specification states that hinting should be disabled. This change does so.

This also provides users a more stable and sane means of achieving the result webkit-font-smoothing:antialiased has been providing by accident.
See http://crbug.com/152304 .

* platform/graphics/skia/FontSkia.cpp:
(WebCore::setupPaint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129945 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] WebFrameImpl::m_frame is redundant now that WebFrameImpl inherits from FrameDestructionObserver
https://bugs.webkit.org/show_bug.cgi?id=97934

Reviewed by James Robinson.

After http://trac.webkit.org/changeset/129910, WebFrameImpl inherits
from FrameDestructionObserver, which means it no longer need to manage
its own weak pointer to WebCore::Frame.

* src/FrameLoaderClientImpl.cpp:
(WebKit::FrameLoaderClientImpl::frameLoaderDestroyed):
* src/WebFrameImpl.cpp:
(WebKit::WebFrameImpl::WebFrameImpl):
(WebKit::WebFrameImpl::setWebCoreFrame):
* src/WebFrameImpl.h:
(WebKit::WebFrameImpl::frameView):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129947 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION in m_graph[tailNodeIndex].op() == Flush || m_graph[tailNodeIndex].op() == SetLocal on plus.google.com
https://bugs.webkit.org/show_bug.cgi?id=97656

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 

There were two bugs here:
        
1) In case of multiple GetLocals to the same captured variable, the bytecode parser would linke the first,
   rather than the last, of the GetLocals into the vars-at-tail table.
        
2) The constant folding phase was asserting that any GetLocal it eliminates must be linked into the
   vars-at-tail table, when for captured variables only the last of those should be.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::getLocal):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):

LayoutTests: 

* fast/js/dfg-redundant-load-of-captured-variable-proven-constant-expected.txt: Added.
* fast/js/dfg-redundant-load-of-captured-variable-proven-constant.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-redundant-load-of-captured-variable-proven-constant.js: Added.
(o.f):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@129948 268f45cc-cd09-0410-ab3c-d52691b4dbfc