Unsafe vsprintf usage in TestNetscapePlugin
https://bugs.webkit.org/show_bug.cgi?id=94522

Reviewed by Adam Barth.

* DumpRenderTree/TestNetscapePlugIn/PluginObject.cpp:
(pluginLogWithArguments): Using vsnprintf instead of vsprintf to ensure we don't overflow
    the message buffer.
(testDocumentOpen):
(testWindowOpen):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126089 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Assertion going back to results.html page from an image diff result
https://bugs.webkit.org/show_bug.cgi?id=94143

Reviewed by Adam Barth.

Avoid redundantly setting the DOMWindow on a JSDOMWindow shell in
ScriptCachedFrameData::restore(), as we may have already done this
in ScriptController::clearWindowShell(). This avoids an assertion
on some platforms when going Back to the test results page from
a diff image.

* bindings/js/ScriptCachedFrameData.cpp:
(WebCore::ScriptCachedFrameData::restore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126090 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Roll WebKit chromium DEPS forward.

* DEPS:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126091 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update TestExpectations now that stray ASSERT is fixed in AudioParamTimeline
https://bugs.webkit.org/show_bug.cgi?id=94548

Unreviewed.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126092 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fixed erroneous line number for LLint frame when throwing exceptions.
https://bugs.webkit.org/show_bug.cgi?id=94051.

Patch by Mark Lam <mark.lam@apple.com> on 2012-08-20
Reviewed by Filip Pizlo.

For LLInt frames, before throwing an exception, adjust the PC from the
return PC back to the call PC if we are indeed at a call site.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::adjustPCIfAtCallSite):
(JSC):
(JSC::CodeBlock::bytecodeOffset):
* bytecode/CodeBlock.h:
(CodeBlock):
* llint/LLIntExceptions.cpp:
(JSC::LLInt::fixupPCforExceptionIfNeeded):
(LLInt):
(JSC::LLInt::interpreterThrowInCaller):
(JSC::LLInt::returnToThrow):
(JSC::LLInt::callToThrow):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126093 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Canvas drawImage() should draw SVG at the correct scale.
https://bugs.webkit.org/show_bug.cgi?id=94377

Source/WebCore:

Previously, drawing SVG in canvas would render at the incorrect scale
because imageSizeForRenderer did not take into account the page scale.
After this patch, we now incorporate the page scale in
CachedImage::imageSizeForRenderer().

Reviewed by Tim Horton.

Test: svg/as-image/svg-as-image-canvas.html

* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::imageSizeForRenderer):

LayoutTests:

Reviewed by Tim Horton.

* svg/as-image/resources/100px-green-rect.svg: Added.
* svg/as-image/svg-as-image-canvas-expected.html: Added.
* svg/as-image/svg-as-image-canvas.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebWidget should be able to paint into a zoomed canvas without aliasing
https://bugs.webkit.org/show_bug.cgi?id=92043

Reviewed by James Robinson.

If accelerated compositing is enabled, WebWidget::paint reads back from
the compositor rather than re-painting the widget. That approach works
well if the canvas we're rendering into is at a similar resolution to
the pixels in the compositor, but if the canvas has been scaled (e.g.,
to help the user disambiguate links), then reading back from the
compositor will cause aliasing artifacts.

This patch adds an option to paint to let the embedder request a
software re-rendering of the widget to avoid these aliasing artifacts.

* public/WebWidget.h:
(WebKit::WebWidget::paint):
* src/WebPagePopupImpl.cpp:
(WebKit::WebPagePopupImpl::paint):
* src/WebPagePopupImpl.h:
(WebPagePopupImpl):
* src/WebPopupMenuImpl.cpp:
(WebKit::WebPopupMenuImpl::paint):
* src/WebPopupMenuImpl.h:
* src/WebViewImpl.cpp:
(WebKit::canvasBackgroundForTransparencey):
(WebKit):
(WebKit::WebViewImpl::paint):
* src/WebViewImpl.h:
(WebViewImpl):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126095 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Remove V8Proxy from V8IsolatedContext
https://bugs.webkit.org/show_bug.cgi?id=94450

Reviewed by Adam Barth.

This patch removes dependency on V8Proxy from V8IsolatedContext.

No tests. No change in behavior.

* bindings/v8/ScriptController.cpp:
(WebCore::ScriptController::evaluateInIsolatedWorld):
* bindings/v8/V8IsolatedContext.cpp:
(WebCore::V8IsolatedContext::V8IsolatedContext):
* bindings/v8/V8IsolatedContext.h:
(WebCore):
(V8IsolatedContext):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126096 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (125759) fast/forms/file/selected-files-from-history-state.html fails on Mac
https://bugs.webkit.org/show_bug.cgi?id=94549

Unreviewed (Bot gardening)

* platform/mac-wk2/Skipped:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126097 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Move collectGarbage() from ScriptController to V8GCController
https://bugs.webkit.org/show_bug.cgi?id=94455

Reviewed by Adam Barth.

- This patch moves collectGarbage() from ScriptController to V8GCController.
- This patch makes collectGarbage() a static method.
- This patch removes ScriptController::lowMemoryNotification()
since it is not used at all.

No tests. No change in behavior.

Source/WebCore:

* bindings/v8/ScriptController.cpp:
* bindings/v8/ScriptController.h:
* bindings/v8/V8GCController.cpp:
(WebCore::V8GCController::collectGarbage):
(WebCore):
* bindings/v8/V8GCController.h:
(V8GCController):

Source/WebKit/chromium:

* src/WebFrameImpl.cpp:
(WebKit::WebFrameImpl::collectGarbage):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126098 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] REGRESSION(126076) Should not touch old GraphicsLayerChromium::m_contentsLayer when setting up a new contents layer
https://bugs.webkit.org/show_bug.cgi?id=94544

Reviewed by Adrienne Walker.

Source/Platform:

Exposes an id so users of the WebLayer API can make identity checks for layers that they do not have ownership
of.

* chromium/public/WebLayer.h:
(WebLayer):

Source/WebCore:

GraphicsLayerChromium only keeps a weak pointer to its m_contentsLayer. When replacing it with a new contents
layer, it may be unsafe to touch the old value. It's also completely unnecessary.

* platform/graphics/chromium/GraphicsLayerChromium.cpp:
(WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
(WebCore::GraphicsLayerChromium::setContentsToImage):
(WebCore::GraphicsLayerChromium::setContentsTo):
(WebCore::GraphicsLayerChromium::setupContentsLayer):
* platform/graphics/chromium/GraphicsLayerChromium.h:

Source/WebKit/chromium:

* src/WebLayerImpl.cpp:
(WebKit::WebLayerImpl::id):
(WebKit):
* src/WebLayerImpl.h:
(WebLayerImpl):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126099 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Yank an unneccessary if added in r125810.
https://bugs.webkit.org/show_bug.cgi?id=85804

Reviewed by Levi Weintraub.

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::layoutInlineChildren):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126100 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Lots of "error, test and reference image have different properties" in pixel test output
https://bugs.webkit.org/show_bug.cgi?id=92578

Reviewed by Dirk Pranke.

Improve ImageDiff's error reporting when test result image and expected image
differ in their properties.

* DumpRenderTree/cg/ImageDiffCG.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126101 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BLACKBERRY] Add notification if an element does not have touch move or mouse move handlers.
https://bugs.webkit.org/show_bug.cgi?id=94529

Patch by Genevieve Mak <gmak@rim.com> on 2012-08-20
Reviewed by George Staikos.

Send a notification to the client if the fat finger element does
not have a mouse move or touch move handler or if it is empty.
PR #177701

Reviewed Internally By Mike Lattanzio and Antonio Gomes.

* Api/WebPageClient.h:
* WebKitSupport/TouchEventHandler.cpp:
(BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126102 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[V8] Move retrieve{Window,Frame,PerContextData}() from V8Proxy to V8Binding
https://bugs.webkit.org/show_bug.cgi?id=94460

Reviewed by Adam Barth.

To kill V8Proxy, we move retrieve{Window,Frame,PerContextData}()
from V8Proxy to V8Binding. Also, this patch renames these methods as follows:

- retrieveWindow() -> toDOMWindow()
- retrieveFrame() -> toFrameIfNotDetached()
- retrievePerContextData() -> perContextDataForCurrentWorld()

No tests. No change in behavior.

Source/WebCore:

* bindings/v8/BindingState.cpp:
(WebCore::activeDOMWindow):
(WebCore::firstDOMWindow):
(WebCore::activeFrame):
(WebCore::firstFrame):
(WebCore::currentFrame):
(WebCore::currentDocument):
* bindings/v8/PageScriptDebugServer.cpp:
(WebCore::retrieveFrameWithGlobalObjectCheck):
(WebCore::PageScriptDebugServer::getDebugListenerForContext):
(WebCore::PageScriptDebugServer::runMessageLoopOnPause):
* bindings/v8/V8Binding.cpp:
(WebCore::retrieveWindow):
(WebCore):
(WebCore::retrieveFrame):
(WebCore::retrievePerContextData):
* bindings/v8/V8Binding.h:
(WebCore):
* bindings/v8/V8DOMWrapper.cpp:
(WebCore::V8DOMWrapper::constructorForType):
* bindings/v8/V8NPUtils.cpp:
(WebCore::convertV8ObjectToNPVariant):
* bindings/v8/V8Proxy.cpp:
(WebCore::V8Proxy::handleOutOfMemory):
(WebCore::V8Proxy::context):
(WebCore::V8Proxy::matchesCurrentContext):
* bindings/v8/V8Proxy.h:
(V8Proxy):

Source/WebKit/chromium:

* src/WebBindings.cpp:
(WebKit::makeIntArrayImpl):
(WebKit::makeStringArrayImpl):
* src/WebFrameImpl.cpp:
(WebKit::WebFrame::frameForContext):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126103 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Move jhbuild dependencies based on SVN to tarballs
https://bugs.webkit.org/show_bug.cgi?id=90374

Patch by Thiago Marcos P. Santos <thiago.santos@intel.com> on 2012-08-20
Reviewed by Kenneth Rohde Christiansen.

Moved all the dependencies based on SVN to tarballs taken from a
equivalent snapshot from the official git mirror. This will make
update-webkitefl not dependent on network connection after the first
run. The bots will not fail if EFL SVN server in unreachable.
The reason why git mirror is not used directly is to minimize the
total size of source code we need to download.

* efl/jhbuild.modules:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@126104 268f45cc-cd09-0410-ab3c-d52691b4dbfc