Assertion failure (toRenderBox() called on a RenderInline) beneath RenderBlock::blockBeforeWithinSelectionRoot()
https://bugs.webkit.org/show_bug.cgi?id=86500

Reviewed by Ojan Vafai.

Source/WebCore:


Test: fast/block/line-layout/selection-highlight-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::blockBeforeWithinSelectionRoot): Demoted the object local variable to
RenderObject, changed use of parentBox() to parent(), and added toRenderBlock() in two places.

LayoutTests:

* fast/block/line-layout/selection-highlight-crash-expected.txt: Added.
* fast/block/line-layout/selection-highlight-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118005 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][DRT] Key modifier bit flags have enum type.
https://bugs.webkit.org/show_bug.cgi?id=86838

Patch by Mikhail Pozdnyakov <mikhail.pozdnyakov@intel.com> on 2012-05-22
Reviewed by Antonio Gomes.

Refactoring. Key modifier flags are unsigned int.
Key modifier bit flags used have enum type. It caused problems as a key can have several modifiers
at the same time and the union of modifiers (i.e. EvasKeyModifierControl | EvasKeyModifierShift)
would have been out of EvasKeyModifier enum.

* DumpRenderTree/efl/EventSender.cpp:
(KeyEventInfo::KeyEventInfo):
(KeyEventInfo):
(MouseEventInfo::MouseEventInfo):
(MouseEventInfo):
(setEvasModifiers):
(modifiersFromJSValue):
(mouseDownCallback):
(mouseUpCallback):
(keyPadNameFromJSValue):
(keyNameFromJSValue):
(createKeyEventInfo):
(sendKeyDown):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118006 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK][DRT] Wrong cache model is taken in LayoutTestController's setCacheModel()
https://bugs.webkit.org/show_bug.cgi?id=86962

Patch by Mikhail Pozdnyakov <mikhail.pozdnyakov@intel.com> on 2012-05-22
Reviewed by Gustavo Noronha Silva.

* DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
(LayoutTestController::setCacheModel): Sets WEBKIT_CACHE_MODEL_WEB_BROWSER if argument is 2.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118007 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix a small syntax error in the GTK+ API test runner.

Reviewed by Gustavo Noronha Silva.

* gtk/run-api-tests:
(TestRunner._setup_testing_environment): When reporting the error use
the correct Python format string syntax.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118009 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] REGRESSION(r116135): Keys that confirm composition trigger a default action
https://bugs.webkit.org/show_bug.cgi?id=86925

Reviewed by Gustavo Noronha Silva.

Source/WebCore:

No new tests. Creating tests for GTK+ input methods is quite difficult, as they
can differ from machine to machine. It's also hard to simulate composition
sequences.

* platform/gtk/CompositionResults.h: Instead of holding composition results, just
keep a flag describing whether or not this event had results.
(CompositionResults):

Source/WebKit/gtk:

Instead of sending composition results with a keydown event, simply send whether
or not the event had results. Activate the results after processing the event. This
allows for input methods to modify the DOM after the keydown event and to still
prevent the default action during handleInputMethodKeydown.

* WebCoreSupport/EditorClientGtk.cpp:
(WebKit::EditorClient::respondToChangedSelection): This patch removes the m_updatingComposition
so we no longer have to check it here.
(WebKit::EditorClient::keyboardEventHadCompositionResults): Added.
(WebKit::EditorClient::handleInputMethodKeydown): Now prevent the default action when
the keyboard event had composition results.
(WebKit::EditorClient::EditorClient):
* WebCoreSupport/EditorClientGtk.h: Remove the m_updatingComposition member, as it's no
longer used.
* WebCoreSupport/WebViewInputMethodFilter.cpp:
(WebKit::WebViewInputMethodFilter::sendKeyEventWithCompositionResults): Now send the
composition results after the key event.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118010 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: Support Array-type key paths
https://bugs.webkit.org/show_bug.cgi?id=84207

Reviewed by Tony Chang.

Source/WebCore:

Implement IDB spec behavior that key paths can be arrays of strings; when
evaluated, these yield arrays of keys, providing compound key support. Also
changes exception types to match the spec.

Test: storage/indexeddb/keypath-arrays.html
Test: storage/indexeddb/keypath-basics.html

* Modules/indexeddb/IDBDatabase.cpp:
(WebCore::IDBDatabase::createObjectStore): Look for both string and array in option dict,
throw exceptions for forbidden combinations of key generator and key paths.
* Modules/indexeddb/IDBObjectStore.cpp:
(WebCore::IDBObjectStore::createIndex): Handle special cases (accepted and forbidden).
(WebCore):
* Modules/indexeddb/IDBObjectStore.h:
(IDBObjectStore):
(WebCore::IDBObjectStore::createIndex): Overloads to satisfy IDL overloads and optional dicts.
* Modules/indexeddb/IDBObjectStore.idl: Add DOMString array overload.
* bindings/v8/IDBBindingUtilities.cpp: Implement spec logic for evaluating array key paths.
(WebCore::createIDBKeyFromSerializedValueAndKeyPath):
(WebCore):

LayoutTests:

* storage/indexeddb/keypath-arrays-expected.txt: Added.
* storage/indexeddb/keypath-arrays.html: Added.
* storage/indexeddb/keypath-basics-expected.txt:
* storage/indexeddb/mozilla/create-objectstore-basics-expected.txt:
* storage/indexeddb/mozilla/resources/create-objectstore-basics.js:
(cleanDatabase):
* storage/indexeddb/objectStore-required-arguments-expected.txt:
* storage/indexeddb/resources/keypath-arrays.js: Added.
(test.request.onsuccess):
(test):
(openSuccess.request.onsuccess):
(openSuccess):
(testKeyPaths.checkStore.request.onsuccess):
(testKeyPaths.checkStore):
(testKeyPaths.checkIndex.request.onsuccess):
(testKeyPaths.checkIndex):
(testKeyPaths):
* storage/indexeddb/resources/keypath-basics.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118011 268f45cc-cd09-0410-ab3c-d52691b4dbfc
!HAVE(ACCESSIBILITY) depends on AccessibilityObject::actionVerb in the Chromium Android build
https://bugs.webkit.org/show_bug.cgi?id=87141

Reviewed by Eric Seidel.

In the Chromium Android build there is still one remaining dependency
on object files in the accessibility directory:
AccessibilityObject::actionVerb. I missed this function in my previous
patch, but this patch changes it to be an inline stub.

* accessibility/AccessibilityObject.cpp:
(WebCore):
* accessibility/AccessibilityObject.h:
(WebCore):
(WebCore::actionVerb):
(WebCore::AccessibilityObject::lineForPosition):
(WebCore::AccessibilityObject::updateBackingStore):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118012 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r117815) fast/css/zoom-in-length-round-trip.html fails on Mac bots
https://bugs.webkit.org/show_bug.cgi?id=87145

Reviewed by Levi Weintraub.

Fix zoom-in-length-round-trip to support subpixel support turned on or off.

* fast/css/zoom-in-length-round-trip.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118013 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Disable private names by default in WebCore
https://bugs.webkit.org/show_bug.cgi?id=87088

Reviewed by Geoff Garen.

r117859 introduced a preliminary implementation of ES6-like private name objects to JSC.
These are probably not yet ready to be web-facing, so disabling by default in WebCore.
Opting-in for JSC & DumpRenderTree so that we can still run the fast/js/names.html test.

Source/JavaScriptCore: 

* jsc.cpp:
(GlobalObject):
(GlobalObject::javaScriptExperimentsEnabled):
    - Implemented new trap to opt-in to private names support.
* runtime/JSGlobalObject.cpp:
(JSC):
(JSC::JSGlobalObject::reset):
    - Only add the Name property to the global object if experiments are enabled.
* runtime/JSGlobalObject.h:
(GlobalObjectMethodTable):
    - Added new trap to enabled experiments.
(JSGlobalObject):
(JSC::JSGlobalObject::finishCreation):
    - Set the global object's m_experimentsEnabled state on construction.
(JSC::JSGlobalObject::javaScriptExperimentsEnabled):
    - Defaults to off.

Source/WebCore: 

* WebCore.exp.in:
    - Added export.
* bindings/js/JSDOMWindowBase.cpp:
(WebCore):
(WebCore::JSDOMWindowBase::javaScriptExperimentsEnabled):
    - Override default from JSC, enable based on corresponding Setting.
* bindings/js/JSDOMWindowBase.h:
(JSDOMWindowBase):
    - Added declaration for javaScriptExperimentsEnabled. 
* page/Settings.cpp:
(WebCore::Settings::Settings):
(WebCore::Settings::setJavaScriptExperimentsEnabled):
(WebCore):
* page/Settings.h:
(Settings):
(WebCore::Settings::javaScriptExperimentsEnabled):
    - Added Setting, reflecting WebPreference.

Source/WebKit/mac: 

* WebView/WebPreferenceKeysPrivate.h:
* WebView/WebPreferences.mm:
(+[WebPreferences initialize]):
(-[WebPreferences setJavaScriptExperimentsEnabled:]):
(-[WebPreferences javaScriptExperimentsEnabled]):
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(-[WebView _preferencesChanged:]):
    - Added JavaScriptExperimentsEnabled to WebPreferences.

Source/WebKit2: 

* Shared/WebPreferencesStore.h:
(WebKit):
* UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetJavaScriptExperimentsEnabled):
(WKPreferencesGetJavaScriptExperimentsEnabled):
* UIProcess/API/C/WKPreferences.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences):
    - Added JavaScriptExperimentsEnabled to WebPreferences.

Tools: 

* DumpRenderTree/mac/DumpRenderTree.mm:
(resetDefaultsToConsistentValues):
    - Enable private name support in DRT.
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::resetStateToConsistentValues):
    - Enable private name support in WKTR.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118018 268f45cc-cd09-0410-ab3c-d52691b4dbfc
GC allocation trigger should be tuned to system RAM
https://bugs.webkit.org/show_bug.cgi?id=87039

Reviewed by Darin Adler.

../JavaScriptCore: 

This helps avoid OOM crashes on small platforms, and helps avoid "too much GC"
performance issues on big platforms.

* heap/Heap.cpp:
(JSC::Heap::Heap):
(JSC::Heap::collect):
* heap/Heap.h:
(Heap): GC balances between a fixed minimum and a proportional multiplier,
which are limited based on system RAM.

* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):
(JSC::JSGlobalData::createContextGroup):
(JSC::JSGlobalData::create):
(JSC::JSGlobalData::createLeaked):
* runtime/JSGlobalData.h:
(JSGlobalData): Renamed HeapSize to HeapType because the exact size is
influenced by the heap type, but not determined by it.

../WTF: 

Added a helper function for measuring system RAM.

* GNUmakefile.list.am:
* WTF.gypi:
* WTF.pro:
* WTF.vcproj/WTF.vcproj:
* WTF.xcodeproj/project.pbxproj:
* wtf/AmountOfRAM.cpp: Added.
(WTF):
(WTF::computeAmountOfRAM):
(WTF::amountOfRAM):
* wtf/AmountOfRAM.h: Added.
(WTF):
* wtf/CMakeLists.txt:
* wtf/StdLibExtras.h:
(WTF):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118019 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] canvas/philip/tests/2d.path.stroke.overlap.html fails with Qt-4.6.2 or higher
https://bugs.webkit.org/show_bug.cgi?id=40362

Reviewed by Noam Rosenthal.

Source/WebCore:

Before drawing the stroke from a certain path, it should make the union of the stroke areas.
The previous implementation didn't consider that so the intersection was painted twice.
By using QPainterPathStroker, we create a QPainterPath on top of the platform path, and
then we fill it with the expected brush. This way we avoid repainting areas.

* platform/graphics/qt/GraphicsContextQt.cpp:
(WebCore::fillPathStroke):
(WebCore):
(WebCore::GraphicsContext::strokePath):

LayoutTests:

* platform/qt/Skipped: Unskip test after fix.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118020 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG should support reflective arguments access
https://bugs.webkit.org/show_bug.cgi?id=85721

Reviewed by Oliver Hunt.
        
Merged r116345 from dfgopt.
        
This adds support for op_create_arguments to the DFG. No other arguments-related
opcodes are added by this change, though it does add a lot of the scaffolding
necessary for the other ops.
        
This also adds GetByVal/PutByVal optimizations for Arguments.
        
Finally, this rationalizes slowPathCall with no return. Previously, that would
work via callOperation() overloads that took InvalidGPRReg as the return GPR.
But that creates awful ambiguity, since we had template functions that were
polymorphic over all parameters except the second, which was a GPRReg, and a
bunch of non-template overloads that also potentially had GPRReg as the second
argument. I finally started to hit this ambiguity and was getting absolutely
bizarre compiler errors, that made me feel like I was programming in SML. So,
I changed the no-argument overloads to take NoResultTag instead, which made
everything sensible again by eliminating the overload ambiguity.
        
This is a ~7% speed-up on V8/earley and neutral elsewhere.

* bytecode/PredictedType.h:
(JSC::isArgumentsPrediction):
(JSC):
(JSC::isActionableMutableArrayPrediction):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCCallHelpers.h:
(JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
(CCallHelpers):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGCapabilities.h:
(JSC::DFG::canCompileOpcode):
(JSC::DFG::canInlineOpcode):
* dfg/DFGCommon.h:
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::unmodifiedArgumentsRegister):
(Node):
(JSC::DFG::Node::shouldSpeculateArguments):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
(DFG):
(JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::silentSpillAllRegistersImpl):
(SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::pickCanTrample):
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedPutById):
(JSC::DFG::SpeculativeJIT::compile):
* runtime/Arguments.h:
(ArgumentsData):
(Arguments):
(JSC::Arguments::offsetOfData):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118030 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix.

* wtf/RAMSize.cpp:
(WTF::computeRAMSize):
If you say you are going to return a size_t, actually return a size_t.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118031 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Fix tests being flaky when multiple draws occur in between commits
https://bugs.webkit.org/show_bug.cgi?id=83935

Tests that are verifying events in a commit/draw lock-step pattern, should use
sourceFrameNumber() not frameNumber() on the impl side.
Otherwise they will fail if the same frame is drawn more than once in
between commits (which is perfectly legal and could happen for example
because we draw without a new commit because we are still in BEGIN_FRAME
or updating resources).

Patch by Daniel Sievers <sievers@chromium.org> on 2012-05-22
Reviewed by Adrienne Walker.

* tests/CCLayerTreeHostTest.cpp:
(WTF::CCLayerTreeHostTestScrollSimple::drawLayersOnCCThread):
(WTF::CCLayerTreeHostTestScrollMultipleRedraw::drawLayersOnCCThread):
(WTF::CCLayerTreeHostTestStartPageScaleAnimation::commitCompleteOnCCThread):
(WTF::CCLayerTreeHostTestAtomicCommit::commitCompleteOnCCThread):
(WTF::CCLayerTreeHostTestAtomicCommit::drawLayersOnCCThread):
(WTF::CCLayerTreeHostTestAtomicCommitWithPartialUpdate::commitCompleteOnCCThread):
(WTF::CCLayerTreeHostTestAtomicCommitWithPartialUpdate::drawLayersOnCCThread):
(WTF::CCLayerTreeHostTestFractionalScroll::drawLayersOnCCThread):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118034 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-05-22  Geoffrey Garen  <ggaren@apple.com>

        Build fix.

        * wtf/RAMSize.cpp:
        (WTF::computeRAMSize): sysctl expects a uint64_t, so use that and then
        cast back to size_t. Since it's coneivable that a 32bit process would
        run on a system with more than 4GB RAM, I added a paranoid check for
        that condition.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118035 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] getPlatformThreadRegisters() should fetch target thread's registers
https://bugs.webkit.org/show_bug.cgi?id=87148

Patch by Yong Li <yoli@rim.com> on 2012-05-22
Reviewed by George Staikos.

Our previous implementation of getPlatformThreadRegisters() read registers in current
thread's context but it is supposed to read the target thread's registers.

* heap/MachineStackMarker.cpp:
(JSC::getPlatformThreadRegisters):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118038 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: Fix iframe printing.
https://bugs.webkit.org/show_bug.cgi?id=85118

Patch by Vitaly Buka <vitalybuka@chromium.org> on 2012-05-22
Reviewed by Darin Adler, Eric Seidel.

Patch fixed two issues by disabling special handling of subframes for printing.
1. Regression. Division by zero when forceLayoutForPagination called for subframes
and page sizes set to zero.
2. Old issue. RendererView adjusted layout of subframes for printing and set invalid
dimensions. Sometimes it caused missing iframe when printed.

Test: printing/iframe-print.html

* page/Frame.cpp:
(WebCore::Frame::setPrinting): Calls forceLayoutForPagination for root frames only.
(WebCore::Frame::resizePageRectsKeepingRatio): Added ASSERTs to catch division by zero.
* rendering/RenderView.cpp: Replaced printing() with shouldUsePrintingLayout() for most calls.
(WebCore::RenderView::computeLogicalHeight):
(WebCore::RenderView::computeLogicalWidth):
(WebCore::RenderView::layout):
(WebCore::RenderView::shouldUsePrintingLayout): Returns true only if printing enabled and it's a root frame.
(WebCore::RenderView::viewRect):
(WebCore::RenderView::viewHeight):
(WebCore::RenderView::viewWidth):
* rendering/RenderView.h:

LayoutTests: LayoutTest for iframe printing.
https://bugs.webkit.org/show_bug.cgi?id=85118

Patch by Vitaly Buka <vitalybuka@chromium.org> on 2012-05-22
Reviewed by Darin Adler, Eric Seidel.

* printing/iframe-print-expected.txt: Added.
* printing/iframe-print.html: Added.
* printing/resources/iframe-subframe-vertical-rl.html: Added.
* printing/resources/iframe-subframe.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118039 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] platform/chromium/.../visibility-simple-*-layer.html fails intermittently on Windows bots.

Unreviewed gardening.

* platform/chromium/test_expectations.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118040 268f45cc-cd09-0410-ab3c-d52691b4dbfc
.: == Rolled over to ChangeLog-2012-05-22 ==

Source/JavaScriptCore: == Rolled over to ChangeLog-2012-05-22 ==

Source/WebCore: == Rolled over to ChangeLog-2012-05-22 ==

Source/WebKit/chromium: == Rolled over to ChangeLog-2012-05-22 ==

Source/WebKit/gtk: == Rolled over to ChangeLog-2012-05-22 ==

Source/WebKit2: == Rolled over to ChangeLog-2012-05-22 ==

Tools: == Rolled over to ChangeLog-2012-05-22 ==

LayoutTests: == Rolled over to ChangeLog-2012-05-22 ==

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118041 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r117613): Dromaeo/jslib-style-prototype regressed by 20%
https://bugs.webkit.org/show_bug.cgi?id=87142

Reviewed by Alexis Menard.

Move CSSPropertyDisplay back into isValidKeywordPropertyAndValue.
Pass in the parser context so we can check whether we're grid or not.

No new tests. Covered by Dromaeo/jslib-style-prototype perf test.

* css/CSSParser.cpp:
(WebCore::isValidKeywordPropertyAndValue):
(WebCore::isKeywordPropertyID):
(WebCore::parseKeywordValue):
(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parseFont):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118044 268f45cc-cd09-0410-ab3c-d52691b4dbfc