AX: Heap-use-after-free when deleting a ContainerNode with an AX object
https://bugs.webkit.org/show_bug.cgi?id=98073

Reviewed by Hajime Morita.

Source/WebCore:

Calls axObjectCache()->remove(this) in ~ContainerNode so that the AX tree
doesn't try to access the container node while walking up the parent chain
from one of the container node's children.

Test: accessibility/container-node-delete-causes-crash.html

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::~ContainerNode):
* dom/Node.cpp:
(WebCore::Node::~Node):
* dom/Node.h:
(WebCore::Node::document):
(WebCore::Node::documentInternal):

LayoutTests:

Adds test for heap-use-after-free when container node with AX object is deleted.

* accessibility/container-node-delete-causes-crash-expected.txt: Added.
* accessibility/container-node-delete-causes-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130266 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make sure that user gestures can't be consumed twice
https://bugs.webkit.org/show_bug.cgi?id=97483

Reviewed by Adam Barth.

Source/WebCore:

Instead of a simple counter, use a ref counted token to track how many
user gestures happened and where consumed. When creating a timer that
is supposed to forward the user gesture, take a reference to this token
and reinstantiate the UserGestureIndicator with that token when the
timer is triggered.

Tests: platform/chromium/fast/events/popup-forwarded-gesture-blocked.html
       platform/chromium/fast/events/popup-forwarded-gesture.html

* dom/UserGestureIndicator.cpp:
(WebCore):
(WebCore::UserGestureIndicator::UserGestureIndicator):
(WebCore::UserGestureIndicator::~UserGestureIndicator):
(WebCore::UserGestureIndicator::processingUserGesture):
(WebCore::UserGestureIndicator::consumeUserGesture):
(WebCore::UserGestureIndicator::currentToken):
* dom/UserGestureIndicator.h:
(Token):
(WebCore::UserGestureIndicator::Token::~Token):
(UserGestureIndicator):
* page/DOMTimer.cpp:
(WebCore::DOMTimer::DOMTimer):
(WebCore::DOMTimer::fired):
* page/DOMTimer.h:
(DOMTimer):

LayoutTests:

* platform/chromium/fast/events/popup-forwarded-gesture-blocked-expected.txt: Added.
* platform/chromium/fast/events/popup-forwarded-gesture-blocked.html: Added.
* platform/chromium/fast/events/popup-forwarded-gesture-expected.txt: Added.
* platform/chromium/fast/events/popup-forwarded-gesture.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130267 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebImage::framesFromData should skip corrupted frames
https://bugs.webkit.org/show_bug.cgi?id=98214

Patch by Peter Kotwicz <pkotwicz@google.com> on 2012-10-03
Reviewed by Adam Barth.

WebImage::framesFromData() should only return bitmaps for valid frames
of a .ico file.

* src/WebImageSkia.cpp:
(WebKit::WebImage::framesFromData):
* tests/WebImageTest.cpp:
(WebKit::TEST):
(WebKit):
* tests/data/valid_header_missing_bitmap.ico: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130268 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Profiles: taking heap snapshot causes error message in console.
https://bugs.webkit.org/show_bug.cgi?id=97890

Patch by Eugene Klyuchnikov <eustas.bug@gmail.com> on 2012-10-03
Reviewed by Yury Semikhatsky.

Actual problem is that proxy loader is closed twice.

"_snapshotReceived" should never try to close receiver,
because it is a callback fired by close.

Also minor glitches fixed:
 - taking snapshot shows "Loading..." status first,
and then "Saving xxx%";
 - after all chunks are sent "Parsing" status is set and
then is replaced with "Saving 100%";
 - removed dead code in proxy;
 - proxy was ignoring callback parameter;
 - "Loading %d\%" is not localized.

* English.lproj/localizedStrings.js: Added missing "Loading %d%" string.
* inspector/front-end/HeapSnapshotProxy.js: Removed dead code.
(WebInspector.HeapSnapshotLoaderProxy):
(WebInspector.HeapSnapshotLoaderProxy.prototype.write): Make this method
interface-conformant.
* inspector/front-end/HeapSnapshotView.js:
(WebInspector.HeapProfileHeader): Fixed update-status and
finish-transfer logic.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130269 268f45cc-cd09-0410-ab3c-d52691b4dbfc
MediaStream API: RTCPeerConnection should send down its handler via the FrameLoaderClient directly after creation.
https://bugs.webkit.org/show_bug.cgi?id=98149

Reviewed by Adam Barth.

Source/WebCore:

The chromium implementation needs to know which Frame created a PeerConnection so
that the right housekeeping can take place correctly.

Not testable in DRT, but have verified the change manually and with our pyautotests.

* Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::RTCPeerConnection):
* loader/FrameLoaderClient.h:
(WebCore):
(FrameLoaderClient):
(WebCore::FrameLoaderClient::dispatchWillStartUsingPeerConnectionHandler):
* platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp:
(WebCore::RTCPeerConnectionHandlerChromium::toWebRTCPeerConnectionHandler):
(WebCore):
(WebCore::RTCPeerConnectionHandlerChromium::RTCPeerConnectionHandlerChromium):
(WebCore::RTCPeerConnectionHandlerChromium::initialize):
* platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.h:
(RTCPeerConnectionHandlerChromium):

Source/WebKit/chromium:

Adding willStartUsingPeerConnectionHandler to the WebFrameClient.

* public/WebFrameClient.h:
(WebKit):
(WebFrameClient):
(WebKit::WebFrameClient::willStartUsingPeerConnectionHandler):
* src/FrameLoaderClientImpl.cpp:
(WebKit):
(WebKit::FrameLoaderClientImpl::dispatchWillStartUsingPeerConnectionHandler):
* src/FrameLoaderClientImpl.h:
(FrameLoaderClientImpl):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130270 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt][DRT] Add support for overriding the "WebKitDisplayImagesKey" preference.
https://bugs.webkit.org/show_bug.cgi?id=98200

Patch by Raphael Kubo da Costa <raphael.kubo.da.costa@intel.com> on 2012-10-03
Reviewed by Csaba Osztrogonác.

Tools:

* DumpRenderTree/qt/TestRunnerQt.cpp:
(TestRunner::overridePreference):

LayoutTests:

* platform/qt/TestExpectations: Unskip a few tests that depended
on this feature.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130271 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove MemoryInstrumentation::addCollectionElements
https://bugs.webkit.org/show_bug.cgi?id=98245

Reviewed by Vsevolod Vlasov.

Removed MemoryInstrumentation::addCollectionElements and switched all call sites
to reportSequenceMemoryUsage.

Drive-by fix: removed some unused methods on MemoryInstrumentation.

* wtf/MemoryInstrumentation.h:
* wtf/MemoryInstrumentationHashSet.h:
(WTF::reportMemoryUsage):
* wtf/MemoryInstrumentationSequence.h:
(WTF::SequenceMemoryInstrumentationTraits::reportMemoryUsage):
* wtf/MemoryInstrumentationVector.h:
(WTF::reportMemoryUsage):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130272 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Gardening after r130186 and r130231

Unreviewed, EFL gardening.

r130186 introduces usage of Xvfb which allows us to unskip a few X11 dependent cases.
r130231 introduces caching for the Harfbuzz font path, which caused regressions on Harfbuzz NG + Freetype,
see bug 98247. Temporarily going to skip those failures until I check Kenichi's patch.

* platform/efl-wk1/TestExpectations: DRT disables X11 usage, skip a few tests here only for Wk1.
* platform/efl-wk2/TestExpectations: Unskip a couple of X11 dependent cases. (r130186)
* platform/efl/TestExpectations: Temporarily mark a few complex font text as failed (r130231)
* platform/efl/fast/text/atsui-multiple-renderers-expected.png: Rebaseline incorrect result.
* platform/efl/fast/text/atsui-spacing-features-expected.png: Rebaseline incorrect result.
* platform/efl/fast/text/wide-zero-width-space-expected.png: Rebaseline incorrect result.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130273 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix for WinCE after r130160.

* platform/graphics/FontFastPath.cpp:
(WebCore::Font::glyphDataAndPageForCharacter):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130274 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed test rebaseline.

* platform/chromium-mac-snowleopard/platform/chromium/fast/forms/date/date-suggestion-picker-appearance-expected.png:
* platform/chromium-mac/fast/css/text-overflow-input-expected.png:
* platform/chromium-mac/fast/forms/box-shadow-override-expected.png:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130275 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ruby1.9 fails in PrettyPatch.rb with invalid byte sequence in UTF-8
https://bugs.webkit.org/show_bug.cgi?id=91212

Patch by Simon Pena <spena@igalia.com> on 2012-10-03
Reviewed by Hajime Morita.

ruby1.9 changed the way it handles encoding, so the gsub method used
when normalizing line ending complains of invalid byte sequence in UTF-8.
This patch uses the "encode" string method for versions of Ruby >= 1.9
to provide the encoding conversion (keeping the current implementation in
Ruby 1.8).

* PrettyPatch/PrettyPatch.rb: Use the "encode" string method for encoding
conversion when the Ruby version is >= 1.9.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130276 268f45cc-cd09-0410-ab3c-d52691b4dbfc
getComputedStyle perspective-origin is based on the wrong bounding box
https://bugs.webkit.org/show_bug.cgi?id=98027

Patch by Jussi Kukkonen <jussi.kukkonen@intel.com> on 2012-10-03
Reviewed by Simon Fraser.

Source/WebCore:

perspective-origin for ComputedStyleDeclaration is currently calculated using the
wrong bounding box (sizingBox() which ends up as the contentbox).

Start using borderbox for ComputedStyleDeclaration perspective-origin, similar to
what transform-origin already does.

Test: fast/css/getComputedStyle/getComputedStyle-origin-percentage.html

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):

LayoutTests:

Add test for perspective-origin calculation into existing transform-origin test.

* transforms/2d/computed-style-origin-expected.txt:
* transforms/2d/computed-style-origin.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130277 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Shrink ElementRareData by moving bool flags to NodeRareData.
<http://webkit.org/b/98225>

Reviewed by Antti Koivisto.

Move all bool flags from ElementRareData to the bitfield in its base class NodeRareData.
This shrinks ElementRareData by 8 bytes (on 64-bit) and saves a whopping 58kB on Membuster3.
Also removed some double raredata hash lookups.

* dom/Element.cpp:
(WebCore::Element::detach):
(WebCore::Element::recalcStyle):
(WebCore::Element::ensureShadow):
(WebCore::Element::setStyleAffectedByEmpty):
(WebCore::Element::styleAffectedByEmpty):
(WebCore::Element::setIsInCanvasSubtree):
(WebCore::Element::isInCanvasSubtree):
(WebCore::Element::containsFullScreenElement):
(WebCore::Element::setContainsFullScreenElement):
* dom/ElementRareData.h:
(ElementRareData):
(WebCore::ElementRareData::ElementRareData):
* dom/NodeRareData.h:
(WebCore::NodeRareData::styleAffectedByEmpty):
(WebCore::NodeRareData::setStyleAffectedByEmpty):
(WebCore::NodeRareData::isInCanvasSubtree):
(WebCore::NodeRareData::setIsInCanvasSubtree):
(NodeRareData):
(WebCore::NodeRareData::containsFullScreenElement):
(WebCore::NodeRareData::setContainsFullScreenElement):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130278 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] WebKitWebView doesn't emit notify:favicon when it changes in some cases in WebKit2
https://bugs.webkit.org/show_bug.cgi?id=98153

Reviewed by Martin Robinson.

The main problem is that it relies on icon-ready signal to be
emitted by the favicon database, but that signal is only emitted
when the icon is loaded from the network or imported from the
database, but not when the icon is already in memory. The way to
detect if a web page doesn't have a favicon or it's unknown it's
also incorrectly done and the wrong error is returned for pages
not having a favicon.

* UIProcess/API/gtk/WebKitFaviconDatabase.cpp:
(GetFaviconSurfaceAsyncData): Add a GError field.
(getIconSurfaceSynchronously): Add a GError parameter and fill it
accordingly. Use imageForPageURL() instead of
nativeImageForPageURL() because the latter always returns NULL for
empty images, so it's not possible to know whether it's an empty
image or not. If the image is empty is because the web page is
known by the database and it doesn't have a favicon.
(processPendingIconsForURI): Pass the data error to
getIconSurfaceSynchronously(). Don't set the icon if the request
has been cancelled.
(webkitFaviconDatabaseGetFavicon): Pass NULL as error to
getIconSurfaceSynchronously().
(setErrorForAsyncResult): Fill also error for
WEBKIT_FAVICON_DATABASE_ERROR_FAVICON_UNKNOWN.
(webkit_favicon_database_get_favicon): If we get NULL as icon in
the first place, check the error code returned by
getIconSurfaceSynchronously() and return early if the page doesn't
have a favicon. Remove the cancelled signal to avoid race
conditions.
(webkit_favicon_database_get_favicon_finish): Errors are processed
before now, so simply propagate the error if any or return the
favicon.
* UIProcess/API/gtk/WebKitWebView.cpp:
(_WebKitWebViewPrivate): Keep a reference of the favicon.
(webkitWebViewCancelFaviconRequest): Cancel any async operation to
get the favicon.
(webkitWebViewUpdateFavicon): Check if favicon has changed and
save it emitting also notify::favicon signal.
(iconReadyCallback): Only update the favicon if we don't have one
already.
(webkitWebViewFinalize): Call webkitWebViewCancelFaviconRequest().
(getFaviconReadyCallback): Update the favicon.
(webkitWebViewRequestFavicon): Request a new favicon.
(webkitWebViewLoadChanged): Try to get the favicon when the load
has been committed and the URI is the final one.
(webkit_web_view_get_favicon): Return the cached favicon.
* UIProcess/API/gtk/tests/TestWebKitFaviconDatabase.cpp:
(serverCallback):
(testSetDirectory):
(testGetFavicon):
(testWebViewFavicon):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130279 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Update pixel expectations for some css2.1 tests.

* platform/efl/css2.1/20110323/c543-txt-decor-000-expected.png: Added.
* platform/efl/css2.1/20110323/replaced-elements-001-expected.png:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130280 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Skeleton code of File system API.
https://bugs.webkit.org/show_bug.cgi?id=91187

Patch by Dongwoo Joshua Im <dw.im@samsung.com> on 2012-10-03
Reviewed by Gyuyoung Kim.

Add skeleton code of File System API on EFL port.
Implementation patches will be created later.

No new tests because this is just skeleton code.

* CMakeLists.txt: Add new files which created by other patches in Modules/filesystem/ directory.
* PlatformEfl.cmake: Add AsyncFileSystemEfl.cpp.
* platform/AsyncFileSystem.cpp:
(WebCore):
* platform/efl/AsyncFileSystemEfl.cpp: Added.
* platform/efl/AsyncFileSystemEfl.h: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130281 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] [WK2] Add favicon support to the MiniBrowser
https://bugs.webkit.org/show_bug.cgi?id=98063

Patch by Alberto Garcia <agarcia@igalia.com> on 2012-10-03
Reviewed by Carlos Garcia Campos.

Set the icon in the URI text entry using the favicon property of
the WebKitWebView.

* MiniBrowser/gtk/BrowserWindow.c:
(_BrowserWindow):
(updateUriEntryIcon):
(uriEntryTextChanged):
(faviconChanged):
(browserWindowFinalize):
(browser_window_init):
(browserWindowConstructed):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130282 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Enable mock scrollbars
https://bugs.webkit.org/show_bug.cgi?id=98011

Patch by Balazs Kelemen <kbalazs@webkit.org> on 2012-10-03
Reviewed by Csaba Osztrogonác.

Source/WebKit/qt:

Added helper to enable mock scrollbars.

* WebCoreSupport/DumpRenderTreeSupportQt.cpp:
(DumpRenderTreeSupportQt::enableMockScrollbars):
* WebCoreSupport/DumpRenderTreeSupportQt.h:

Tools:

Enable mock scrollbars for the Qt port. This patch will require a huge rebaseline.

* DumpRenderTree/qt/DumpRenderTreeQt.cpp:
(WebCore::DumpRenderTree::DumpRenderTree):
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::resetStateToConsistentValues):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130283 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: After "Edit as HTML", any click outside box should stop editing
https://bugs.webkit.org/show_bug.cgi?id=98258

Reviewed by Vsevolod Vlasov.

Make the DOM tree OL span the entire height of its container in the Elements panel to catch mouse events.

* inspector/front-end/elementsPanel.css:
(#elements-content > ol):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130284 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] Implement focus/unfocus in UIClient
https://bugs.webkit.org/show_bug.cgi?id=98253

Patch by Christophe Dumez <christophe.dumez@intel.com> on 2012-10-03
Reviewed by Gyuyoung Kim.

Implement focus-related functionality in
WebKitEFL's UIClient.

* UIProcess/API/efl/ewk_view_ui_client.cpp:
(focus):
(unfocus):
(takeFocus):
(ewk_view_ui_client_attach):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@130285 268f45cc-cd09-0410-ab3c-d52691b4dbfc