Make WTF build with the latest version of clang.

Reviewed by Dan Bernstein.

* wtf/FastMalloc.cpp:
(WTF): Disable the -Wunused-private-field warning around the declaration of
TCMalloc_Central_FreeListPadded since the padding is intentionally unused.
(WTF::AdminRegionRecorder): Remove the unused m_reader member.
(WTF::FastMallocZone::enumerate): Don't pass in the RemoteMemoryReader since
it is no longer needed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126475 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make JavaScriptCore build with the latest version of clang.

Reviewed by Dan Bernstein.

* heap/MachineStackMarker.cpp:
(JSC::MachineThreads::MachineThreads): The m_heap member is only used within
assertions, so guard its initialization with !ASSERT_DISABLED.
* heap/MachineStackMarker.h:
(MachineThreads): Ditto for its declaration.
* jit/JITStubCall.h:
(JSC::JITStubCall::JITStubCall): The m_returnType member is only used within
assertions or if we're using JSVALUE32_64, so guard its uses with the appropriate
(JITStubCall): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126476 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make WebCore build with the latest version of clang.

Reviewed by Dan Bernstein.

* html/shadow/MediaControlRootElement.h: Remove m_textTrackDisplay as it is unused.
* platform/audio/mac/AudioFileReaderMac.cpp:
(WebCore::AudioFileReader::AudioFileReader): Remove m_filePath as it is unused.
* platform/audio/mac/AudioFileReaderMac.h:
(AudioFileReader): Ditto.
* platform/graphics/ImageSource.h:
(ImageSource): Guard m_alphaOption and m_gammaAndColorProfileOption with !USE(CG)
as they're unused on platforms using CG.
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
(MediaPlayerPrivateAVFoundationObjC): Remove m_player as it is unused.
* platform/graphics/cg/ImageSourceCG.cpp:
(WebCore::ImageSource::ImageSource): Don't initialize the m_alphaOption and
m_gammaAndColorProfileOption members since we never use them.
* platform/graphics/mac/GraphicsContext3DMac.mm:
(WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate): Remove m_graphicsContext3D
as it is unused.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126477 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make WebKit2 build with the latest version of clang.

Reviewed by Dan Bernstein.

* Configurations/Base.xcconfig: Ensure that operator new isn't exported as a weak external symbol.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126478 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make gtest build with the latest version of clang.

Reviewed by Dan Bernstein.

* gtest/src/gtest-internal-inl.h:
(GTestFlagSaver): Remove an unused member.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126479 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Not reviewed - fixing input list for timeline inspector module.
https://bugs.webkit.org/show_bug.cgi?id=94829

* WebKit.gyp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126480 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Roll out part of r126475 that breaks the build with older versions of Clang.

* wtf/FastMalloc.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126481 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Create sharedQuadState at same time as creating quads and give them to the quadSink
https://bugs.webkit.org/show_bug.cgi?id=94752

Reviewed by Adrienne Walker.

Source/WebCore:

Previously, CCRenderPass would create a sharedQuadState for a layer,
and pass it in to the layer. Then the layer would point all its quads
at the sharedQuadState.

After this change, the layer creates its own sharedQuadState, gives it
to the RenderPass (via CCQuadSink), and points its quads at it.

This approach allows a layer to generate more than one sharedQuadState
with different quads pointing to different shared states. Also, this
will allow the layer representing a delegating renderer (via ubercomp)
to copy sharedQuadStates from the delegating renderer in order to
merge its quads into the RenderPass for the current renderer.

Covered by existing tests, no change in behaviour.

* platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
(WebCore::CCHeadsUpDisplayLayerImpl::appendQuads):
* platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h:
(CCHeadsUpDisplayLayerImpl):
* platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
(WebCore::CCIOSurfaceLayerImpl::appendQuads):
* platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.h:
(CCIOSurfaceLayerImpl):
* platform/graphics/chromium/cc/CCLayerImpl.cpp:
(WebCore::CCLayerImpl::createSharedQuadState):
* platform/graphics/chromium/cc/CCLayerImpl.h:
(CCLayerImpl):
(WebCore::CCLayerImpl::appendQuads):
* platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
(WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
* platform/graphics/chromium/cc/CCQuadCuller.cpp:
(WebCore::CCQuadCuller::CCQuadCuller):
(WebCore::CCQuadCuller::append):
(WebCore::CCQuadCuller::useSharedQuadState):
(WebCore):
* platform/graphics/chromium/cc/CCQuadCuller.h:
(WebCore):
(CCQuadCuller):
* platform/graphics/chromium/cc/CCQuadSink.h:
(WebCore):
(CCQuadSink):
* platform/graphics/chromium/cc/CCRenderPass.cpp:
(WebCore::CCRenderPass::appendQuadsForLayer):
(WebCore::CCRenderPass::appendQuadsForRenderSurfaceLayer):
(WebCore::CCRenderPass::appendQuadsToFillScreen):
* platform/graphics/chromium/cc/CCRenderPass.h:
(WebCore):
(CCRenderPass):
* platform/graphics/chromium/cc/CCRenderSurface.cpp:
(WebCore::CCRenderSurface::appendQuads):
* platform/graphics/chromium/cc/CCRenderSurface.h:
(CCRenderSurface):
* platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
(WebCore::CCScrollbarLayerImpl::appendQuads):
* platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
(CCScrollbarLayerImpl):
* platform/graphics/chromium/cc/CCSharedQuadState.cpp:
(WebCore::CCSharedQuadState::create):
(WebCore::CCSharedQuadState::CCSharedQuadState):
* platform/graphics/chromium/cc/CCSharedQuadState.h:
(CCSharedQuadState):
* platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
(WebCore::CCSolidColorLayerImpl::appendQuads):
* platform/graphics/chromium/cc/CCSolidColorLayerImpl.h:
(CCSolidColorLayerImpl):
* platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
(WebCore::CCTextureLayerImpl::appendQuads):
* platform/graphics/chromium/cc/CCTextureLayerImpl.h:
(CCTextureLayerImpl):
* platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
(WebCore::CCTiledLayerImpl::appendQuads):
* platform/graphics/chromium/cc/CCTiledLayerImpl.h:
(CCTiledLayerImpl):
* platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
(WebCore::CCVideoLayerImpl::appendQuads):
* platform/graphics/chromium/cc/CCVideoLayerImpl.h:
(CCVideoLayerImpl):

Source/WebKit/chromium:

* tests/CCLayerTreeHostImplTest.cpp:
* tests/CCLayerTreeHostTest.cpp:
(WTF::EvictionTestLayerImpl::appendQuads):
* tests/CCQuadCullerTest.cpp:
* tests/CCRenderSurfaceTest.cpp:
* tests/CCSolidColorLayerImplTest.cpp:
(CCLayerTestCommon::TEST):
* tests/CCTiledLayerImplTest.cpp:
(CCLayerTestCommon::TEST):
(CCLayerTestCommon::getQuads):
(CCLayerTestCommon::coverageVisibleRectOnTileBoundaries):
(CCLayerTestCommon::coverageVisibleRectIntersectsTiles):
(CCLayerTestCommon::coverageVisibleRectIntersectsBounds):
* tests/MockCCQuadCuller.h:
(WebCore::MockCCQuadCuller::MockCCQuadCuller):
(MockCCQuadCuller):
(WebCore::MockCCQuadCuller::quadList):
(WebCore::MockCCQuadCuller::sharedQuadStateList):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126482 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ProgressTracker never completes if iframe detached during parsing
https://bugs.webkit.org/show_bug.cgi?id=92272

Reviewed by Adam Barth.

Add a simple helper class to FrameLoader to ensure progressStarted/progressCompleted calls are matched,
and balance the calls when the Frame is detached.

No new tests, as this behavior has only been producing reliably by setting a breakpoint in a specific place.

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::init):
(WebCore::FrameLoader::FrameProgressTracker::progressStarted):
(WebCore::FrameLoader::FrameProgressTracker::progressCompleted):
(WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker):
(WebCore::FrameLoader::prepareForLoadStart):
(WebCore::FrameLoader::clearProvisionalLoad):
(WebCore::FrameLoader::checkLoadCompleteForThisFrame):
(WebCore::FrameLoader::detachFromParent):
* loader/FrameLoader.h:
(FrameProgressTracker):
(WebCore::FrameLoader::FrameProgressTracker::create):
(WebCore::FrameLoader::FrameProgressTracker::FrameProgressTracker):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126483 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] OwnHandle is a bit of a misnomer
https://bugs.webkit.org/show_bug.cgi?id=94841

Reviewed by Eric Seidel.

You don't really own the handle in the same way that you own a pointer
with OwnPtr. This class is more correctly called ScopedPersistent
because it just forces you to balance New() and Dispose() calls.

* WebCore.gypi:
* bindings/v8/JavaScriptCallFrame.h:
(JavaScriptCallFrame):
* bindings/v8/OwnHandle.h: Removed.
* bindings/v8/ScheduledAction.h:
(ScheduledAction):
* bindings/v8/ScopedPersistent.h: Copied from Source/WebCore/bindings/v8/OwnHandle.h.
(ScopedPersistent):
(WebCore::ScopedPersistent::ScopedPersistent):
(WebCore::ScopedPersistent::~ScopedPersistent):
* bindings/v8/ScriptDebugServer.cpp:
(WebCore::ScriptDebugServer::compileScript):
(WebCore::ScriptDebugServer::runScript):
* bindings/v8/ScriptDebugServer.h:
(ScriptDebugServer):
* bindings/v8/ScriptInstance.h:
(V8ScriptInstance):
* bindings/v8/V8PerContextData.h:
(V8PerContextData):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126484 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Replace the three different rendering mechanisms for clearing the render queue
https://bugs.webkit.org/show_bug.cgi?id=94837

Patch by Adam Treat <atreat@rim.com> on 2012-08-23
Reviewed by George Staikos.

PR 197738

Currently, we have three different mechanisms for clearing the render queue.
The first mechanism is render on idle.  Whenever the webkit thread becomes idle
(read: no more events in its queue) we render the next job in the render queue.
 This is the primary means we use for clearing the render queue.  However, this
mechanism has a flaw, it is such a low priority mechanism that sometimes the
queue grows so fast due to higher priority events adding rects to the queue
that this mechanism can't possibly keep up.  That is what leads to the second
mechanism: rendering right before a timer is fired when we discover that the
render queue is under pressure and rendering on idle can't keep up.  However,
there are still degenerate cases where even this mechanism does not allow us to
keep up.  That brings us to the third mechanism: rendering based on a timer
that is a catch-all.

The second and third mechanisms lead to very large render jobs as they try and
clear the queue faster when it comes under pressure.  These very large render
jobs end up keeping the webkit thread busy with a message that can take large
fractions of a second to resolve.

These three mechanisms were put in place when the backingstore had a different
overall design that was not truly asynchronous.  This patch replaces these
three mechanisms with a single one that uses the platform messaging classes to
full purpose - a uniquely coalescing message that has a higher priority level
than timers making sure the render queue can never come under pressure.

* Api/BackingStore.cpp:
(BlackBerry::WebKit::BackingStorePrivate::BackingStorePrivate):
(WebKit):
(RenderJobMessage):
(BlackBerry::WebKit::RenderJobMessage::RenderJobMessage):
(BlackBerry::WebKit::BackingStorePrivate::dispatchRenderJob):
(BlackBerry::WebKit::BackingStorePrivate::renderJob):
(BlackBerry::WebKit::BackingStore::blitContents):
* Api/BackingStore.h:
* Api/BackingStore_p.h:
(BackingStorePrivate):
* Api/WebPage.cpp:
* Api/WebPage.h:
* WebKitSupport/RenderQueue.cpp:
(BlackBerry::WebKit::RenderQueue::reset):
(BlackBerry::WebKit::RenderQueue::addToRegularQueue):
(BlackBerry::WebKit::RenderQueue::addToScrollZoomQueue):
(BlackBerry::WebKit::RenderQueue::clear):
(BlackBerry::WebKit::RenderQueue::clearVisibleZoom):
(BlackBerry::WebKit::RenderQueue::render):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126485 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove some unneeded cruft from WebCore.xcodeproj.

* WebCore.xcodeproj/project.pbxproj:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126486 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] LayoutTests: css3/selector3/xml tests are flaky / have wrong expectations on Snow Leopard
https://bugs.webkit.org/show_bug.cgi?id=82122

Unreviewed Chromium gardening. Expanded expectations from Snow Leopard to Mac.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126487 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Trailing spaces in CSP source lists should not generate console warnings.
https://bugs.webkit.org/show_bug.cgi?id=94847

Patch by Mike West <mkwst@chromium.org> on 2012-08-23
Reviewed by Adam Barth.

Trailing space after a valid source in a Content Security Policy source
list was accidentally generating console warnings about an invalid
(empty) source. This patch silently ignores trailing whitespace instead.

Source/WebCore:

A test-case has been added to 'source-list-parsing-02.html' to cover
this case.

* page/ContentSecurityPolicy.cpp:
(WebCore::CSPSourceList::parse):
    Return early if we reach the end of the source list after skipping
    leading whitespace.

LayoutTests:

* http/tests/security/contentSecurityPolicy/source-list-parsing-02-expected.txt:
* http/tests/security/contentSecurityPolicy/source-list-parsing-02.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126488 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Adjust test expectations for fast/js/toString-overrides.html and fast/js/eval-cross-window.html
https://bugs.webkit.org/show_bug.cgi?id=94824

Patch by Ulan Degenbaev <ulan@chromium.org> on 2012-08-23
Reviewed by Kentaro Hara.

Add a bug number for tracking failing cases in fast/js/toString-overrides.html.
Upload Chromium specific test expectations for fast/js/eval-cross-window.html.

Failing tests in eval-cross-window swap the eval() function in the main window and the frame.
This behaviour is not specified in ECMA-262 and is probably implementation dependent.
Both Firefox and Chromium produce the same result for this test.

* platform/chromium/TestExpectations:
* platform/chromium/fast/js/eval-cross-window-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126489 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r124815): PDF in frame does not display any more
<rdar://problem/12063306> and https://bugs.webkit.org/show_bug.cgi?id=94869

Reviewed by Alexey Proskuryakov.

* WebProcess/Plugins/PDF/BuiltInPDFView.mm:
(WebKit::BuiltInPDFView::initialize): Tell the controller that initialization was successful.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126490 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CSSParser: Move enumeration to a common place (StylePropertyShorthand)
https://bugs.webkit.org/show_bug.cgi?id=93210

Patch by Adenilson Cavalcanti <cavalcantii@gmail.com> on 2012-08-23
Reviewed by Dean Jackson.

CSSParser::parseAnimationShorthand() uses an enumeration with the same
elements as another enumeration present in StylePropertyShorthand, but
with different ordering of values. This patch puts both enums in the same place.

No new tests. No change in behavior.

* css/CSSParser.cpp:
(WebCore::CSSParser::parseAnimationShorthand):
* css/StylePropertyShorthand.cpp:
(WebCore::webkitAnimationShorthandForParsing):
(WebCore):
* css/StylePropertyShorthand.h:
(WebCore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126491 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change behavior of MasqueradesAsUndefined to better accommodate DFG changes
https://bugs.webkit.org/show_bug.cgi?id=93884

Reviewed by Filip Pizlo.

Source/JavaScriptCore: 

With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
masquerade as undefined within frame B, but it will continue to masquerade in frame A. 

There are two primary changes that are taking place here. One is to thread the ExecState* through  
JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's  
JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two  
are distinct, then the object cannot MasqueradeAsUndefined. 

The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined 
flag in the Structure is checked. For C++ code, this check has been factored into its own function in  
Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has  
had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed  
through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers 
that are MasqueradesAsUndefined.

* API/JSValueRef.cpp:
(JSValueToBoolean):
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* bytecode/Watchpoint.h:
(WatchpointSet):
* debugger/DebuggerCallFrame.h:
(JSC::DebuggerCallFrame::callFrame):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::run):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
(JSC::DFG::SpeculativeJIT::compile):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::privateExecute):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_is_undefined):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_is_undefined):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncFilter):
(JSC::arrayProtoFuncEvery):
(JSC::arrayProtoFuncSome):
* runtime/BooleanConstructor.cpp:
(JSC::constructBoolean):
(JSC::callBooleanConstructor):
* runtime/JSCell.h:
(JSCell):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
* runtime/JSGlobalObject.h:
(JSGlobalObject):
(JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint):
* runtime/JSString.h:
(JSC::JSCell::toBoolean):
(JSC::JSValue::toBoolean):
* runtime/JSValue.h:
* runtime/ObjectConstructor.cpp:
(JSC::toPropertyDescriptor):
* runtime/Operations.cpp:
(JSC::jsTypeStringForValue):
(JSC::jsIsObjectType):
* runtime/Operations.h:
(JSC):
(JSC::JSValue::equalSlowCaseInline):
* runtime/RegExpConstructor.cpp:
(JSC::setRegExpConstructorMultiline):
* runtime/RegExpPrototype.cpp:
(JSC::regExpProtoFuncToString):
* runtime/Structure.h:
(Structure):
(JSC::Structure::globalObjectOffset):
(JSC::Structure::masqueradesAsUndefined):
(JSC):

Source/WebCore: 

With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
masquerade as undefined within frame B, but it will continue to masquerade in frame A. 

Test: fast/js/document-all-between-frames.html

All of the changes in WebCore are simply passing the additional ExecState argument to JSValue::toBoolean. 

* bindings/js/JSCustomSQLStatementErrorCallback.cpp:
(WebCore::JSSQLStatementErrorCallback::handleEvent):
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::addEventListener):
(WebCore::JSDOMWindow::removeEventListener):
* bindings/js/JSDataViewCustom.cpp:
(WebCore::getDataViewMember):
* bindings/js/JSDeviceMotionEventCustom.cpp:
(WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
* bindings/js/JSDeviceOrientationEventCustom.cpp:
(WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
* bindings/js/JSDictionary.cpp:
(WebCore::JSDictionary::convertValue):
* bindings/js/JSHTMLCanvasElementCustom.cpp:
(WebCore::JSHTMLCanvasElement::getContext):
* bindings/js/JSInspectorFrontendHostCustom.cpp:
(WebCore::populateContextMenuItems):
* bindings/js/JSMessageEventCustom.cpp:
(WebCore::handleInitMessageEvent):
* bindings/js/JSWebGLRenderingContextCustom.cpp:
(WebCore::dataFunctionMatrix):
* bindings/js/JSXMLHttpRequestCustom.cpp:
(WebCore::JSXMLHttpRequest::open):
* bindings/js/JavaScriptCallFrame.cpp:
(WebCore::JavaScriptCallFrame::exec):
(WebCore):
* bindings/js/JavaScriptCallFrame.h:
(JavaScriptCallFrame):
* bindings/js/ScriptDebugServer.cpp:
(WebCore::ScriptDebugServer::hasBreakpoint):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneSerializer::dumpIfTerminal):
* bindings/scripts/CodeGeneratorJS.pm: Also add the custom create function for MasqueradesAsUndefined JS DOM wrappers. 
(GenerateEventListenerCall):
(GenerateHeader):
(JSValueToNative):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::jsTestEventTargetPrototypeFunctionAddEventListener):
(WebCore::jsTestEventTargetPrototypeFunctionRemoveEventListener):
* bindings/scripts/test/JS/JSTestEventTarget.h:
(WebCore::JSTestEventTarget::create):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::setJSTestObjCreate):
(WebCore::setJSTestObjReflectedBooleanAttr):
(WebCore::setJSTestObjReflectedCustomBooleanAttr):
(WebCore::jsTestObjPrototypeFunctionAddEventListener):
(WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
* bridge/c/c_utility.cpp:
(JSC::Bindings::convertValueToNPVariant):
* bridge/jni/jni_jsobject.mm:
(JavaJSObject::convertValueToJObject):
* bridge/qt/qt_runtime.cpp:
(JSC::Bindings::convertValueToQVariant):

Source/WebKit/mac: 

With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
masquerade as undefined within frame B, but it will continue to masquerade in frame A. 

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::addValueToArray): Passing ExecState to toBoolean call.

Source/WebKit2: 

With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
masquerade as undefined within frame B, but it will continue to masquerade in frame A.

* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
(WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant): Passing ExecState to toBoolean call.

LayoutTests: 

Added a test that uses a variety of ways of checking whether something is correctly 
masquerading as undefined (or not) in a subframe.

* fast/js/document-all-between-frames-expected.txt: Added.
* fast/js/document-all-between-frames.html: Added.
* fast/js/resources/document-all-between-frames-subframe.html: Added.
* platform/chromium/TestExpectations: Chromium treats document.all differently, so skip our new test.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126494 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove RenderTable::removeChild
https://bugs.webkit.org/show_bug.cgi?id=94842

Reviewed by Abhishek Arya.

This change removed removeChild, replaced by willBeRemovedFromTree calls. The upside is that
the invalidations are now guaranteed to run if we split a table (which is not guaranteed when
using removeChild). This change also shows that our code may be doing too much work in some
of the child's removal, in which case the code was marked as needed.

Covered by existing tests.

* rendering/RenderTable.cpp:
(WebCore::RenderTable::removeCaption):
Helper function used to remove the caption from our Vector. The invalidation are very likely
unneeded so added a comment about that.

* rendering/RenderTable.h:
* rendering/RenderTableCaption.cpp:
(WebCore::RenderTableCaption::willBeRemovedFromTree):
(WebCore::RenderTableCaption::table):
* rendering/RenderTableCaption.h:
* rendering/RenderTableCol.cpp:
(WebCore::RenderTableCol::willBeRemovedFromTree):
* rendering/RenderTableCol.h:
Added the following functions to do the invalidation.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126495 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Focusable elements without a role should not be ignored
https://bugs.webkit.org/show_bug.cgi?id=94302

Reviewed by Chris Fleizach.

Source/WebCore:

Changes the accessibility logic so that a generic element that's focusable is
not ignored for accessibility, and returns its inner text as its title. That way
if you Tab to the element, a reasonable accessibility notification is generated.

One exception is the body element, because focusing the body is equivalent to
blurring the current focused element and does not result in a "focus" accessibility
notification.

Also fixes logic that determined if an element was contentEditable by making
sure it catches the case with no attribute value (e.g. <div contentEditable>),
which also implies contentEditable=true according to the spec.

Test: accessibility/focusable-div.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore):
(WebCore::nodeHasContentEditableAttributeSet):
(WebCore::AccessibilityRenderObject::title):
(WebCore::AccessibilityRenderObject::accessibilityIsIgnored):

LayoutTests:

Adds a new test to make sure that a generic focusable element (like a div with tabindex=0)
can get focus and return an appropriate title, just like a form control or element with
an ARIA role.

Modifies three existing tests that were previously assuming that a focusable node
with no role would be ignored for accessibility ("accessibilityIsIgnored").

* accessibility/editable-webarea-context-menu-point.html:
* accessibility/focusable-div-expected.txt: Added.
* accessibility/focusable-div.html: Added.
* accessibility/table-detection.html:
* platform/mac/accessibility/listbox-hit-test.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126496 268f45cc-cd09-0410-ab3c-d52691b4dbfc