Fix potential overflow in jpeg exif reader. Found by aedla@google.com.
https://bugs.webkit.org/show_bug.cgi?id=100320

Reviewed by Eric Seidel.

Adding more than 1 element past an array is undefined, so don't do it.

No test, since in practice ifd will just overflow and `end - ifd` will
become much larget than 2 and the `if (end - ifd < 2)` a few lines
down will catch that case.

* platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
(WebCore::readImageOrientation):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132961 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Skip another failing accessibility test on Windows: accessibility/svg-remote-element.html.

* platform/win/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132962 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] Sync up FeatureDefine Configuration Files
https://bugs.webkit.org/show_bug.cgi?id=100171

Reviewed by David Kilzer.

Follow up to better coordinate with iOS feature defines. Make:

  - ENABLE_FILTERS always on
  - ENABLE_INPUT_* iphonesimulator values point to the iphoneos values

Source/JavaScriptCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit/mac:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

* Configurations/FeatureDefines.xcconfig:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132963 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Test should not be run on Apple Windows port: fast/images/exif-orientation-image-document.html

* platform/win/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132964 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Temporarily restrict use of ImageBufferSkia::copyToPlatformTexture until bugs resolved
https://bugs.webkit.org/show_bug.cgi?id=100714

Reviewed by Stephen White.

For the moment, only use ImageBuffer::copyToPlatformTexture when
copying to RGBA/UNSIGNED_BYTE textures, and document restriction
in header. Restriction will be lifted once the implementations
(currently only Chromium has one) have been fixed; see bug 100715.

No new tests; manually ran WebGL conformance test
tex-image-and-sub-image-2d-with-canvas-rgba5551.html on NVIDIA
hardware on Mac OS.

* html/canvas/WebGLRenderingContext.cpp:
(WebCore):
(WebCore::WebGLRenderingContext::texImage2D):
* platform/graphics/ImageBuffer.h:
(ImageBuffer):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132965 268f45cc-cd09-0410-ab3c-d52691b4dbfc
cssText for cursor property doesn't include hotspot
https://bugs.webkit.org/show_bug.cgi?id=99530

Patch by Rick Byers <rbyers@chromium.org> on 2012-10-30
Reviewed by Darin Adler.

Source/WebCore:

Implement customCssText in CSSCursorImageValue to include the hotspot when present.
Also explicitly track whether or not a hotspot was supplied in the parser,
while still using the existing convention of (-1,-1) to denote no hotspot
in the rest of the system.

Test: fast/css/cursor-parsing.html

* css/CSSCursorImageValue.cpp:
(WebCore::CSSCursorImageValue::customCssText):
* css/CSSCursorImageValue.h:
(CSSCursorImageValue):

LayoutTests:

Add simple test for parsing of CSS cursor property.

* fast/css/cursor-parsing-expected.txt: Added.
* fast/css/cursor-parsing.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132966 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] update form theme for BB10.
https://bugs.webkit.org/show_bug.cgi?id=100760

Patch by Tiancheng Jiang <tijiang@rim.com> on 2012-10-30
Reviewed by Rob Buis.

RIM PR:222126
Introduce slide function to paint new theme for the form controls.

No new tests.

* css/themeBlackBerry.css:
(select):
* platform/blackberry/RenderThemeBlackBerry.cpp:
(WebCore):
(WebCore::drawControl): Added.
(WebCore::drawThreeSlice): Added.
(WebCore::drawNineSlice): Added.
(WebCore::loadImage): Added.
(WebCore::RenderThemeBlackBerry::systemFont): Modified.
(WebCore::RenderThemeBlackBerry::paintTextFieldOrTextAreaOrSearchField): Modified.
(WebCore::RenderThemeBlackBerry::paintCheckbox): Modified.
(WebCore::RenderThemeBlackBerry::paintRadio): Modified.
(WebCore::RenderThemeBlackBerry::paintButton): Modified.
(WebCore::RenderThemeBlackBerry::paintMenuList): Modified.
(WebCore::RenderThemeBlackBerry::paintMenuListButton): Modified.
(WebCore::RenderThemeBlackBerry::paintSliderTrackRect): Modified.
(WebCore::RenderThemeBlackBerry::paintSliderThumb): Modified.
* platform/blackberry/RenderThemeBlackBerry.h:
(RenderThemeBlackBerry):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132967 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=100796
Should add FixedPositionViewportConstraints to ScrollingConstraints.h

Reviewed by Simon Fraser.

ScrollingConstraints.h currently contains an abstract class called 
ViewportConstraints that is intended to encapsulate data and logic 
required to reposition elements whose layout depends on the viewport 
rect (positions fixed and sticky), when scrolling and zooming. 
However, at this time there is only a subclass for sticky. We should 
add a sub-class for fixed. This is required to get pages with fixed 
position elements scrolling on the scrolling thread.

* page/scrolling/ScrollingConstraints.cpp:
(WebCore::FixedPositionViewportConstraints::layerPositionForViewportRect):
(WebCore):
* page/scrolling/ScrollingConstraints.h:
(WebCore::ViewportConstraints::ViewportConstraints):
(ViewportConstraints):
(WebCore::ViewportConstraints::setAnchorEdges):
(FixedPositionViewportConstraints):
(WebCore::FixedPositionViewportConstraints::FixedPositionViewportConstraints):
(WebCore::FixedPositionViewportConstraints::viewportRectAtLastLayout):
(WebCore::FixedPositionViewportConstraints::setViewportRectAtLastLayout):
(WebCore::FixedPositionViewportConstraints::layerPositionAtLastLayout):
(WebCore::FixedPositionViewportConstraints::setLayerPositionAtLastLayout):
(WebCore):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@132968 268f45cc-cd09-0410-ab3c-d52691b4dbfc