Re-order variables in BidiRun and LayoutState
https://bugs.webkit.org/show_bug.cgi?id=100173

Reviewed by Eric Seidel.

The variable re-ordering and use of bitfields for bools has two benefits:
1) Size reduction. sizeof(BidiRun) goes down from 48 to 40 bytes on 64-bit. This is achieved by removing a bool member variable from BidiRun and packing it together with other bools in the BidiCharacterRun base class.
2) Security improvement. We have a lot of use-after-free in the RenderObject hierarchy, and the RenderArena class protects us from a lot of trouble by ensuring that objects of arbitrary type cannot be overlayed on top of freed RenderObjects. This change additionally makes sure that non-virtual RenderArena allocated objects do not have member variables which fully overlap the freed vtable pointer. This leaves re-used vtable pointers always pointing to either a valid vtable or an invalid address due to the freelist high-bit poisoning.

This change is exclusively about size savings; it is performance neutral as you would expect, including on Parser/html5-full-render.html

* platform/text/BidiResolver.h:
(WebCore::BidiCharacterRun::BidiCharacterRun): impact from re-ordering members.
(BidiCharacterRun): provide an efficiently packed bit of storage for BidiRun subclass to use, and re-order members to place bools adjacent.
* rendering/BidiRun.h:
(WebCore::BidiRun::BidiRun): use base class' efficiently packed bit storage for m_hasHyphen.
(BidiRun): m_hasHyphen is now stored in the base class.
* rendering/LayoutState.cpp:
(WebCore::LayoutState::LayoutState):
* rendering/LayoutState.h:
(WebCore::LayoutState::LayoutState): impact from re-ordering members.
(LayoutState): re-order members to place bools adjacently.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133713 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][EWebLauncher] Use Ctrl +/-  to zoom in EWebLauncher
https://bugs.webkit.org/show_bug.cgi?id=100207

Patch by KyungTae Kim <ktf.kim@samsung.com> on 2012-11-06
Reviewed by Gyuyoung Kim.

Use "Ctrl -" instead of "F7" to zoom out, and use "Ctrl +" instead of "F8" to zoom in,
and use "Ctrl 0" to set to default zoom level.
They are more common shortcuts on usual browsers.

* EWebLauncher/main.c:
(on_key_down):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133714 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Shadow] Pseudo custom-elements should start with 'x-'.
https://bugs.webkit.org/show_bug.cgi?id=100919

Reviewed by Dimitri Glazkov.

Source/WebCore:

Pseuco custom-elements should start with 'x-'. 'Pseudo' starting with '-webkit-' should work
only in UserAgent ShadowDOM. If it's used in Author ShadowDOM, it should not work.

Test: fast/dom/shadow/pseudo-attribute-rendering.html

* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkSelector): Added ShadowRoot type check.

LayoutTests:

* fast/dom/shadow/pseudo-attribute-rendering-expected.html: Added.
* fast/dom/shadow/pseudo-attribute-rendering.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133715 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] fast/dom/shadow/shadowdom-for-object-only-shadow.html fails
https://bugs.webkit.org/show_bug.cgi?id=101417

Unreviewed, EFL gardening.

shadowdom-for-object-only-shadow.html test is flaky in WK2 only.

Patch by Jaehun Lim <ljaehun.lim@samsung.com> on 2012-11-06

* platform/efl-wk2/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133716 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash due to column span under button element
https://bugs.webkit.org/show_bug.cgi?id=101402

Reviewed by Abhishek Arya.

Source/WebCore:

When there is a column-spanning child of a RenderButton
splitBlocks() must split the RenderButton as well as its
only permitted direct child, the anonymous block referenced
by m_inner. A crash was occurring because splitBlocks()
calls addChildIgnoringAnonymousColumnBlocks() to add the
cloned m_inner to the cloned RenderButton, which meant the
m_inner for the cloned RenderButton was not being set even
though a child was being added. This violates state
assumptions in the RenderButton code.

This patch prevents any descendants of RenderButton from
spanning columns. Also, it adds a precautionary check in
RenderButton::removeChild() to mitigate problems if similar
state problems are found in future.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::containingColumnsBlock):
* rendering/RenderButton.cpp:
(WebCore::RenderButton::removeChild):

LayoutTests:

Test creates crashing condition for bug 101402.

* fast/block/colspan-under-button-crash.html: Added.
* fast/block/colspan-under-button-crash-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133717 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2][EFL] Add shortcut for setting a pagination mode on Minibrowser
https://bugs.webkit.org/show_bug.cgi?id=100301

Patch by KyungTae Kim <ktf.kim@samsung.com> on 2012-11-06
Reviewed by Gyuyoung Kim.

Setting pagination modes is for a paginated view - left to right / right to left / top to bottom / bottom to top.
Assign a shortcut "F7" to set pagination modes for tests.

* MiniBrowser/efl/main.c:
(on_key_down):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133718 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Unify setJSWrapperForDOMObject and setJSWrapperForDOMNode
https://bugs.webkit.org/show_bug.cgi?id=101422

Reviewed by Kentaro Hara.

This patch is another incremental step towards the patch in Bug 10110.
In this step, we unify setJSWrapperForDOMObject and
setJSWrapperForDOMNode.

* bindings/scripts/CodeGeneratorV8.pm:
(GenerateHeader):
(GenerateNormalAttrGetter):
(GenerateConstructorCallback):
(GenerateNamedConstructorCallback):
(GenerateToV8Converters):
* bindings/scripts/test/V8/V8Float64Array.h:
(WebCore::V8Float64Array::wrap):
* bindings/scripts/test/V8/V8TestActiveDOMObject.h:
(WebCore::V8TestActiveDOMObject::wrap):
* bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
(WebCore::V8TestCustomNamedGetter::wrap):
* bindings/scripts/test/V8/V8TestEventConstructor.h:
(WebCore::V8TestEventConstructor::wrap):
* bindings/scripts/test/V8/V8TestEventTarget.h:
(WebCore::V8TestEventTarget::wrap):
* bindings/scripts/test/V8/V8TestException.h:
(WebCore::V8TestException::wrap):
* bindings/scripts/test/V8/V8TestInterface.h:
(WebCore::V8TestInterface::wrap):
* bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
(WebCore::V8TestMediaQueryListListener::wrap):
* bindings/scripts/test/V8/V8TestNamedConstructor.h:
(WebCore::V8TestNamedConstructor::wrap):
* bindings/scripts/test/V8/V8TestNode.cpp:
(WebCore::V8TestNode::constructorCallback):
(WebCore::V8TestNode::wrapSlow):
* bindings/scripts/test/V8/V8TestObj.cpp:
(WebCore::TestObjV8Internal::readOnlyTestObjAttrAttrGetter):
* bindings/scripts/test/V8/V8TestObj.h:
(WebCore::V8TestObj::wrap):
* bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
(WebCore::V8TestSerializedScriptValueInterface::wrap):
* bindings/v8/DOMDataStore.cpp:
(WebCore::DOMDataStore::current):
* bindings/v8/DOMDataStore.h:
(WebCore::DOMDataStore::get):
(DOMDataStore):
* bindings/v8/V8DOMWrapper.cpp:
* bindings/v8/V8DOMWrapper.h:
(V8DOMWrapper):
(WebCore::V8DOMWrapper::setJSWrapperPrivate):
(WebCore::V8DOMWrapper::setJSWrapperForDOMObject):
* bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
(WebCore::v8HTMLImageElementConstructorCallback):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133719 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Enable REQUEST_AUTOCOMPLETE for chromium port
https://bugs.webkit.org/show_bug.cgi?id=101376

Patch by Dan Beam <dbeam@chromium.org> on 2012-11-06
Reviewed by Adam Barth.

Source/WebCore:

Added a runtime enabled feature to control whether HTMLFormElement#requestAutocomplete is visible from JavaScript.

* bindings/generic/RuntimeEnabledFeatures.cpp:
(WebCore):
* bindings/generic/RuntimeEnabledFeatures.h:
(RuntimeEnabledFeatures):

Added a binding from RuntimeEnabledFeatures that triggers [V8EnabledAtRuntime=requestAutocomplete].

(WebCore::RuntimeEnabledFeatures::requestAutocompleteEnabled):

Added a getter to WebCore to ask whether the runtime flag requestAutocomplete is on.

(WebCore::RuntimeEnabledFeatures::setRequestAutocompleteEnabled):

Added a setter to WebCore to affect the runtime flag requestAutocomplete.

* html/HTMLFormElement.idl:

Wrapped commonly grouped features in an #if defined(ENABLED_REQUEST_AUTOCOMPLETE) block and added [V8EnableAtRuntime]
so these features can be changed with a command line switch in the chromium port.

Source/WebKit/chromium:

This patch enables the feature flag REQUEST_AUTOCOMPLETE in WebKit/chromium only to allow web authors to start to use
HTMLFormElement#requestAutocomplete as the chrome-side work progresses further.

* features.gypi:

Turned on the *compile* time flag for REQUEST_AUTOCOMPLETE in chromium's webkit port but also added a *run* time flag
that functionally enables the behavior.  This means the chromium port will compile in support but will require a run
time flag to enable.

* public/WebRuntimeFeatures.h:
(WebRuntimeFeatures):

Added a method to the public chromium run time features interface to allow chrome to enable/disable this feature.

* src/WebRuntimeFeatures.cpp:
(WebKit::WebRuntimeFeatures::enableRequestAutocomplete):
(WebKit):

A setter than can be called from chrome code to change the enable/disable requestAutocomplete and associated events at
runtime.

(WebKit::WebRuntimeFeatures::isRequestAutocompleteEnabled):

A getter that returns whether the requestAutocomplete run time feature is enabled.

Tools:

This patch enables the feature flag REQUEST_AUTOCOMPLETE in WebKit/chromium only to allow web authors to start to use
HTMLFormElement#requestAutocomplete as the chrome-side work progresses further.

* DumpRenderTree/chromium/TestShell.cpp:
(TestShell::TestShell):

Enables the requestAutocomplete runtime feature flag during tests.

LayoutTests:

This patch enables the feature flag REQUEST_AUTOCOMPLETE in WebKit/chromium only to allow web authors to start to use
HTMLFormElement#requestAutocomplete as the chrome-side work progresses further.

* fast/forms/form-request-autocomplete-expected.txt:

Updated to match form-request-autocomplete.html changes.

* fast/forms/form-request-autocomplete.html:

Remove bug number as per Adam Barth <abarth@webkit.org>'s advice.

* platform/chromium/fast/forms/form-request-autocomplete-expected.txt: Added.

Adding expected successful layout test for form-request-autocomplete.html tests to chromium specific directory
(as chromium is currently the only place the feature is enabled).

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133720 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed attempt to fix the chromium-mac build.

* WebCoreSupport/WebSystemInterface.mm:
(InitWebCoreSystemInterface):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133721 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement month picking to calendar picker
https://bugs.webkit.org/show_bug.cgi?id=101333

Reviewed by Kent Tamura.

.:

* ManualTests/forms/calendar-picker.html: Added test for month picker.

Source/WebCore:

This adds month picker mode to CalendarPicker.

No new tests. Tests will be added later when this feature is enabled in DRT.

* Resources/pagepopups/calendarPicker.css:
(.month-mode .day): Remove rounded corners when in month mode.
* Resources/pagepopups/calendarPicker.js:
(Month.createFromToday): Creates month containing today.
(CalendarPicker): Set this.selectionConstructor to Day or Month depending on the mode. Create DayTables or MonthPickerDaysTable depending on the mode.
(CalendarPicker.prototype.handleToday):
(CalendarPicker.prototype._layoutButtons):
(DaysTable.prototype._renderMonth): Set element.dataset.monthValue for all date nodes.
(DaysTable.prototype._markRangeAsSelected): Marks all day nodes in range as selected.
(DaysTable.prototype.selectRange): Selects a day.
(DaysTable.prototype.selectRangeAndShowEntireRange): Same as selectRange.
(DaysTable.prototype._selectRangeContainingNode):
(DaysTable.prototype._rangeForNode): Returns Day for node.
(DaysTable.prototype.startDate): Start datetime of visible date range. This value is inclusive.
(DaysTable.prototype.endDate): End datetime of visible date range. This value is exclusive.
(DaysTable.prototype._handleKey):
(MonthPickerDaysTable):
(MonthPickerDaysTable.prototype._markRangeAsSelected): Marks all day nodes in range as selected.
(MonthPickerDaysTable.prototype.selectRange): Selects month. If month is not visible, navigates to that month.
(MonthPickerDaysTable.prototype.selectRangeAndShowEntireRange): Selects month. Navigates to the month.
(MonthPickerDaysTable.prototype._rangeForNode): Returns Month for node.
(MonthPickerDaysTable.prototype._handleKey): Arrow keys simply move the selection forwards or backwards.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133722 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] API test crash with accelerated compositing on.
https://bugs.webkit.org/show_bug.cgi?id=101384

Patch by Viatcheslav Ostapenko <v.ostapenko@samsung.com> on 2012-11-06
Reviewed by Gyuyoung Kim.

If accelerated compositing is enabled API tests should create GL evas engine
instead of default one.
Also, in API tests first window resize and display often comes earlier
than enterAcceleratedCompositingMode call, so let's create GL surface in
_ewk_view_smart_calculate on first window resize.

* UIProcess/API/efl/ewk_view.cpp:
(_ewk_view_smart_calculate):
* UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp:
(EWK2UnitTest::EWK2UnitTestBase::SetUp):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133723 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move DrawingAreaImpl methods graphicsLayerFactory, setRootCompositingLayer & scheduleCompositingLayerSync under ACCELERATED_COMPOSITING
https://bugs.webkit.org/show_bug.cgi?id=101427

Patch by Vivek Galatage <vivekgalatage@gmail.com> on 2012-11-06
Reviewed by Anders Carlsson.

Moving these methods under the ACCELERATED_COMPOSITING flag.
This fixes broken wincairo due to use of override specifier.

* WebProcess/WebPage/DrawingAreaImpl.cpp:
(WebKit):
* WebProcess/WebPage/DrawingAreaImpl.h:
(DrawingAreaImpl):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133724 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] media/media-continues-playing-after-replace-source.html fails
https://bugs.webkit.org/show_bug.cgi?id=101429

Unreviewed, EFL gardening.

media-continues-playing-after-replace-source.html test case crashes in WK2 only.

Patch by Kangil Han <kangil.han@samsung.com> on 2012-11-06

* platform/efl-wk2/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133725 268f45cc-cd09-0410-ab3c-d52691b4dbfc
StringBuilder::append(UChar) with an 8 bit quantity shouldn't change the contents to 16 bits
https://bugs.webkit.org/show_bug.cgi?id=101421

Reviewed by Anders Carlsson.

If the string builder contains only 8 bit data, check if the character being appended contains
8 bit data.  If so, append it to the 8 bit buffer instead of converting the buffer to 16 bits.

* wtf/text/StringBuilder.cpp:
(WTF::StringBuilder::append):
* wtf/text/StringBuilder.h:
(WTF::StringBuilder::append):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@133726 268f45cc-cd09-0410-ab3c-d52691b4dbfc