REGRESSION (r153005): Crash in SpaceSplitString::spaceSplitStringContainsValue on Facebook
https://bugs.webkit.org/show_bug.cgi?id=119384

Patch by Benjamin Poulain <bpoulain@apple.com> on 2013-08-02
Reviewed by Alexey Proskuryakov.

Source/WebCore: 

When removing the "rel" attribute from HTMLAnchorElement, we parse the attribute for no value.
Following r153005, we no longer checked for null String, which caused a crash in that case.

Creating a SpaceSplitString from a null string causes the SpaceSplitString to be null. In that case
SpaceSplitString::contains() would always return false.
This patch modify SpaceSplitString::spaceSplitStringContainsValue() to follow the exact same
behavior.

Test: fast/dom/HTMLAnchorElement/remove-rel-attribute.html

* dom/SpaceSplitString.cpp:
(WebCore::SpaceSplitString::spaceSplitStringContainsValue):

LayoutTests: 

* fast/dom/HTMLAnchorElement/remove-rel-attribute.html: Added.
* fast/dom/HTMLAnchorElement/remove-rel-attribute-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153685 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove a bunch of redundant checks for empty string in StringImpl
https://bugs.webkit.org/show_bug.cgi?id=118768

Reviewed by Ryosuke Niwa.

The first thing done by createUninitialized() is check if the length passed
is zero. Internally, there are many cases for which we know the check will never succeed.

Clang is usually really smart for those kind of things, but there are a few cases where
the condition to avoid returning empty() is not simply a check for the length.
This patch adds an internal initializer to deal with that.

* wtf/text/StringImpl.cpp:
(WTF::StringImpl::createUninitializedInternal):
(WTF::StringImpl::createUninitializedInternalNonEmpty):
(WTF::StringImpl::createInternal): Create internal has a special case for null pointer
for the characters. The test also check length, the second check for length cannot fail.
(WTF::StringImpl::create8BitIfPossible): ditto.
(WTF::StringImpl::lower): 3 of the calls cannot be reached for empty length. On an empty length,
the test for (noUpper && !(ored & ~0x7F)) would have caused the function to return "this".

For the last createUninitialized(), there is no guarantee the realLength is not zero.

(WTF::StringImpl::replace): The first thing we do in replace(UChar,UChar) is check if there is anything
to replace. The check for length will never succeed as there must be a character to replace at that point.
* wtf/text/StringImpl.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153686 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Introduce toSVGMaskElement(), and use it
https://bugs.webkit.org/show_bug.cgi?id=119443

Reviewed by Andreas Kling.

As a step to change static_cast with toSVGXXX, static_cast<SVGMaskElement*> can
be changed with toSVGMaskElement().

Blink merge from https://src.chromium.org/viewvc/blink?view=rev&revision=155432

* rendering/svg/RenderSVGResourceMasker.cpp:
(WebCore::RenderSVGResourceMasker::applyResource):
(WebCore::RenderSVGResourceMasker::resourceBoundingBox):
* rendering/svg/RenderSVGResourceMasker.h:
* svg/SVGMaskElement.h:
(WebCore::toSVGMaskElement):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153687 268f45cc-cd09-0410-ab3c-d52691b4dbfc