[Chromium] LayoutTests: css3/selector3/xml tests are flaky / have wrong expectations on Snow Leopard
https://bugs.webkit.org/show_bug.cgi?id=82122

Unreviewed Chromium gardening. Expanded expectations from Snow Leopard to Mac.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126487 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Trailing spaces in CSP source lists should not generate console warnings.
https://bugs.webkit.org/show_bug.cgi?id=94847

Patch by Mike West <mkwst@chromium.org> on 2012-08-23
Reviewed by Adam Barth.

Trailing space after a valid source in a Content Security Policy source
list was accidentally generating console warnings about an invalid
(empty) source. This patch silently ignores trailing whitespace instead.

Source/WebCore:

A test-case has been added to 'source-list-parsing-02.html' to cover
this case.

* page/ContentSecurityPolicy.cpp:
(WebCore::CSPSourceList::parse):
    Return early if we reach the end of the source list after skipping
    leading whitespace.

LayoutTests:

* http/tests/security/contentSecurityPolicy/source-list-parsing-02-expected.txt:
* http/tests/security/contentSecurityPolicy/source-list-parsing-02.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126488 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Adjust test expectations for fast/js/toString-overrides.html and fast/js/eval-cross-window.html
https://bugs.webkit.org/show_bug.cgi?id=94824

Patch by Ulan Degenbaev <ulan@chromium.org> on 2012-08-23
Reviewed by Kentaro Hara.

Add a bug number for tracking failing cases in fast/js/toString-overrides.html.
Upload Chromium specific test expectations for fast/js/eval-cross-window.html.

Failing tests in eval-cross-window swap the eval() function in the main window and the frame.
This behaviour is not specified in ECMA-262 and is probably implementation dependent.
Both Firefox and Chromium produce the same result for this test.

* platform/chromium/TestExpectations:
* platform/chromium/fast/js/eval-cross-window-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126489 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r124815): PDF in frame does not display any more
<rdar://problem/12063306> and https://bugs.webkit.org/show_bug.cgi?id=94869

Reviewed by Alexey Proskuryakov.

* WebProcess/Plugins/PDF/BuiltInPDFView.mm:
(WebKit::BuiltInPDFView::initialize): Tell the controller that initialization was successful.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126490 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSSParser: Move enumeration to a common place (StylePropertyShorthand)
https://bugs.webkit.org/show_bug.cgi?id=93210

Patch by Adenilson Cavalcanti <cavalcantii@gmail.com> on 2012-08-23
Reviewed by Dean Jackson.

CSSParser::parseAnimationShorthand() uses an enumeration with the same
elements as another enumeration present in StylePropertyShorthand, but
with different ordering of values. This patch puts both enums in the same place.

No new tests. No change in behavior.

* css/CSSParser.cpp:
(WebCore::CSSParser::parseAnimationShorthand):
* css/StylePropertyShorthand.cpp:
(WebCore::webkitAnimationShorthandForParsing):
(WebCore):
* css/StylePropertyShorthand.h:
(WebCore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126491 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change behavior of MasqueradesAsUndefined to better accommodate DFG changes
https://bugs.webkit.org/show_bug.cgi?id=93884

Reviewed by Filip Pizlo.

Source/JavaScriptCore: 

With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
masquerade as undefined within frame B, but it will continue to masquerade in frame A. 

There are two primary changes that are taking place here. One is to thread the ExecState* through  
JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's  
JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two  
are distinct, then the object cannot MasqueradeAsUndefined. 

The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined 
flag in the Structure is checked. For C++ code, this check has been factored into its own function in  
Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has  
had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed  
through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers 
that are MasqueradesAsUndefined.

* API/JSValueRef.cpp:
(JSValueToBoolean):
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* bytecode/Watchpoint.h:
(WatchpointSet):
* debugger/DebuggerCallFrame.h:
(JSC::DebuggerCallFrame::callFrame):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::run):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
(JSC::DFG::SpeculativeJIT::compile):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::privateExecute):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_is_undefined):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_is_undefined):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncFilter):
(JSC::arrayProtoFuncEvery):
(JSC::arrayProtoFuncSome):
* runtime/BooleanConstructor.cpp:
(JSC::constructBoolean):
(JSC::callBooleanConstructor):
* runtime/JSCell.h:
(JSCell):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
* runtime/JSGlobalObject.h:
(JSGlobalObject):
(JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint):
* runtime/JSString.h:
(JSC::JSCell::toBoolean):
(JSC::JSValue::toBoolean):
* runtime/JSValue.h:
* runtime/ObjectConstructor.cpp:
(JSC::toPropertyDescriptor):
* runtime/Operations.cpp:
(JSC::jsTypeStringForValue):
(JSC::jsIsObjectType):
* runtime/Operations.h:
(JSC):
(JSC::JSValue::equalSlowCaseInline):
* runtime/RegExpConstructor.cpp:
(JSC::setRegExpConstructorMultiline):
* runtime/RegExpPrototype.cpp:
(JSC::regExpProtoFuncToString):
* runtime/Structure.h:
(Structure):
(JSC::Structure::globalObjectOffset):
(JSC::Structure::masqueradesAsUndefined):
(JSC):

Source/WebCore: 

With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
masquerade as undefined within frame B, but it will continue to masquerade in frame A. 

Test: fast/js/document-all-between-frames.html

All of the changes in WebCore are simply passing the additional ExecState argument to JSValue::toBoolean. 

* bindings/js/JSCustomSQLStatementErrorCallback.cpp:
(WebCore::JSSQLStatementErrorCallback::handleEvent):
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::addEventListener):
(WebCore::JSDOMWindow::removeEventListener):
* bindings/js/JSDataViewCustom.cpp:
(WebCore::getDataViewMember):
* bindings/js/JSDeviceMotionEventCustom.cpp:
(WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
* bindings/js/JSDeviceOrientationEventCustom.cpp:
(WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
* bindings/js/JSDictionary.cpp:
(WebCore::JSDictionary::convertValue):
* bindings/js/JSHTMLCanvasElementCustom.cpp:
(WebCore::JSHTMLCanvasElement::getContext):
* bindings/js/JSInspectorFrontendHostCustom.cpp:
(WebCore::populateContextMenuItems):
* bindings/js/JSMessageEventCustom.cpp:
(WebCore::handleInitMessageEvent):
* bindings/js/JSWebGLRenderingContextCustom.cpp:
(WebCore::dataFunctionMatrix):
* bindings/js/JSXMLHttpRequestCustom.cpp:
(WebCore::JSXMLHttpRequest::open):
* bindings/js/JavaScriptCallFrame.cpp:
(WebCore::JavaScriptCallFrame::exec):
(WebCore):
* bindings/js/JavaScriptCallFrame.h:
(JavaScriptCallFrame):
* bindings/js/ScriptDebugServer.cpp:
(WebCore::ScriptDebugServer::hasBreakpoint):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneSerializer::dumpIfTerminal):
* bindings/scripts/CodeGeneratorJS.pm: Also add the custom create function for MasqueradesAsUndefined JS DOM wrappers. 
(GenerateEventListenerCall):
(GenerateHeader):
(JSValueToNative):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
(WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
* bindings/scripts/test/JS/JSTestEventTarget.h:
(WebCore::JSTestEventTarget::create):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::setJSTestObjCreate):
(WebCore::setJSTestObjReflectedBooleanAttr):
(WebCore::setJSTestObjReflectedCustomBooleanAttr):
(WebCore::jsTestObjPrototypeFunctionAddEventListener):
(WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
* bridge/c/c_utility.cpp:
(JSC::Bindings::convertValueToNPVariant):
* bridge/jni/jni_jsobject.mm:
(JavaJSObject::convertValueToJObject):
* bridge/qt/qt_runtime.cpp:
(JSC::Bindings::convertValueToQVariant):

Source/WebKit/mac: 

With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
masquerade as undefined within frame B, but it will continue to masquerade in frame A. 

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::addValueToArray): Passing ExecState to toBoolean call.

Source/WebKit2: 

With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
masquerade as undefined within frame B, but it will continue to masquerade in frame A.

* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
(WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant): Passing ExecState to toBoolean call.

LayoutTests: 

Added a test that uses a variety of ways of checking whether something is correctly 
masquerading as undefined (or not) in a subframe.

* fast/js/document-all-between-frames-expected.txt: Added.
* fast/js/document-all-between-frames.html: Added.
* fast/js/resources/document-all-between-frames-subframe.html: Added.
* platform/chromium/TestExpectations: Chromium treats document.all differently, so skip our new test.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126494 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove RenderTable::removeChild
https://bugs.webkit.org/show_bug.cgi?id=94842

Reviewed by Abhishek Arya.

This change removed removeChild, replaced by willBeRemovedFromTree calls. The upside is that
the invalidations are now guaranteed to run if we split a table (which is not guaranteed when
using removeChild). This change also shows that our code may be doing too much work in some
of the child's removal, in which case the code was marked as needed.

Covered by existing tests.

* rendering/RenderTable.cpp:
(WebCore::RenderTable::removeCaption):
Helper function used to remove the caption from our Vector. The invalidation are very likely
unneeded so added a comment about that.

* rendering/RenderTable.h:
* rendering/RenderTableCaption.cpp:
(WebCore::RenderTableCaption::willBeRemovedFromTree):
(WebCore::RenderTableCaption::table):
* rendering/RenderTableCaption.h:
* rendering/RenderTableCol.cpp:
(WebCore::RenderTableCol::willBeRemovedFromTree):
* rendering/RenderTableCol.h:
Added the following functions to do the invalidation.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126495 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Focusable elements without a role should not be ignored
https://bugs.webkit.org/show_bug.cgi?id=94302

Reviewed by Chris Fleizach.

Source/WebCore:

Changes the accessibility logic so that a generic element that's focusable is
not ignored for accessibility, and returns its inner text as its title. That way
if you Tab to the element, a reasonable accessibility notification is generated.

One exception is the body element, because focusing the body is equivalent to
blurring the current focused element and does not result in a "focus" accessibility
notification.

Also fixes logic that determined if an element was contentEditable by making
sure it catches the case with no attribute value (e.g. <div contentEditable>),
which also implies contentEditable=true according to the spec.

Test: accessibility/focusable-div.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore):
(WebCore::nodeHasContentEditableAttributeSet):
(WebCore::AccessibilityRenderObject::title):
(WebCore::AccessibilityRenderObject::accessibilityIsIgnored):

LayoutTests:

Adds a new test to make sure that a generic focusable element (like a div with tabindex=0)
can get focus and return an appropriate title, just like a form control or element with
an ARIA role.

Modifies three existing tests that were previously assuming that a focusable node
with no role would be ignored for accessibility ("accessibilityIsIgnored").

* accessibility/editable-webarea-context-menu-point.html:
* accessibility/focusable-div-expected.txt: Added.
* accessibility/focusable-div.html: Added.
* accessibility/table-detection.html:
* platform/mac/accessibility/listbox-hit-test.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126496 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Replay tests take forever to load
https://bugs.webkit.org/show_bug.cgi?id=94764

Reviewed by Adam Barth.

Don't load about:blank at the beginning. This appears to clog the DRT.

* Scripts/webkitpy/performance_tests/perftest.py:
(ReplayPerfTest.run_single):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126497 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Remove WebLayer::setChildren API
https://bugs.webkit.org/show_bug.cgi?id=94749

Reviewed by Adrienne Walker.

Source/Platform:

This is redundant with removeAllChildren() / addChild() and less efficient.

* chromium/public/WebLayer.h:
(WebLayer):

Source/WebCore:

Sets up the child list directly instead of building an intermediate buffer. Covered by compositing/*

* platform/graphics/chromium/GraphicsLayerChromium.cpp:
(WebCore::GraphicsLayerChromium::updateChildList):

Source/WebKit/chromium:

* src/WebLayer.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126498 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed Chromium gardening. Generalized a few Snow Leopard-only
expectations to Mac in order to get the new Lion bot green.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126499 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] ScriptValue should use ScopedPresistent rather than calling New/Dispose directly
https://bugs.webkit.org/show_bug.cgi?id=94864

Reviewed by Eric Seidel.

ScriptValue was created before ScopedPersistent existed and therefore
calls New/Dispose manually. Instead, it should use the less error-prone
approach of having ScopedPersistent balance those calls.

* bindings/v8/ScriptValue.cpp:
(WebCore::ScriptValue::serialize):
(WebCore::ScriptValue::getString):
(WebCore::ScriptValue::toString):
(WebCore::ScriptValue::toInspectorValue):
* bindings/v8/ScriptValue.h:
(WebCore::ScriptValue::ScriptValue):
(WebCore::ScriptValue::operator=):
(WebCore::ScriptValue::operator==):
(WebCore::ScriptValue::isEqual):
(WebCore::ScriptValue::isFunction):
(WebCore::ScriptValue::isNull):
(WebCore::ScriptValue::isUndefined):
(WebCore::ScriptValue::isObject):
(WebCore::ScriptValue::hasNoValue):
(WebCore::ScriptValue::clear):
(WebCore::ScriptValue::v8Value):
(ScriptValue):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126500 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Don't require a RenderSurface* in order to create a RenderPass
https://bugs.webkit.org/show_bug.cgi?id=94862

Reviewed by Adrienne Walker.

Source/WebCore:

If a test wants to create a RenderPass, they are required to create a
Layer, and a RenderSurface. This is not ideal, we should let tests
create RenderPasses more simply by giving the information that it needs.

This also helps us recreate the RenderPasses after receiving a copy
via IPC.

* platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
(WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
* platform/graphics/chromium/cc/CCRenderPass.cpp:
(WebCore::CCRenderPass::create):
(WebCore::CCRenderPass::CCRenderPass):
* platform/graphics/chromium/cc/CCRenderPass.h:
(CCRenderPass):

Source/WebKit/chromium:

* tests/CCLayerTreeHostImplTest.cpp:
* tests/CCRendererGLTest.cpp:
(FakeCCRendererClient::FakeCCRendererClient):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126501 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] ScriptState is using stone knifes and bear skins
https://bugs.webkit.org/show_bug.cgi?id=94846

Reviewed by Eric Seidel.

This patch just modernizes ScriptState to use some of the newer tools
available in the V8 bindings. There shouldn't be any behavior changes.

* bindings/v8/ScriptState.cpp:
(WebCore::ScriptState::ScriptState):
(WebCore::ScriptState::~ScriptState):
(WebCore::ScriptState::domWindow):
(WebCore::ScriptState::scriptExecutionContext):
(WebCore::ScriptState::forContext):
(WebCore::ScriptState::current):
* bindings/v8/ScriptState.h:
(WebCore):
(WebCore::ScriptState::context):
(ScriptState):
(WebCore::ScriptStateProtectedPtr::ScriptStateProtectedPtr):
(ScriptStateProtectedPtr):
* bindings/v8/V8Binding.cpp:
(WebCore::toScriptExecutionContext):
(WebCore):
* bindings/v8/V8Binding.h:
(WebCore):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126502 268f45cc-cd09-0410-ab3c-d52691b4dbfc