Crash when favicon is requested
https://bugs.webkit.org/show_bug.cgi?id=114624

Patch by peavo@outlook.com <peavo@outlook.com> on 2013-04-15
Reviewed by Brent Fulgham.

* WebIconDatabase.cpp:
(WebIconDatabase::getOrCreateDefaultIconBitmap): Added NULL pointer check.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148456 268f45cc-cd09-0410-ab3c-d52691b4dbfc
HTMLMediaElement::removeTextTrack should clear track client
https://bugs.webkit.org/show_bug.cgi?id=114630

Reviewed by Jer Noble.

No new tests, this is clean-up that prevents a potential crash.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::removeTextTrack): Clear the track client.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148458 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WKR gets stuck when there are many merges
https://bugs.webkit.org/show_bug.cgi?id=114632

Reviewed by Andreas Kling.

Move the last revision forward when it exists in a branch.
Otherwise, we'll be stuck looping over revisions made to merge patches.

* Scripts/webkitpy/tool/commands/newcommitbot.py:
(NewCommitBot.next_work_item):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148461 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WIN] Remove remaining calls to pthread from WTF
https://bugs.webkit.org/show_bug.cgi?id=114563

Reviewed by Brent Fulgham.

Replace pthread_key_create with threadSpecificKeyCreate and
pthread_setspecific with threadSpecificSet from ThreadSpecific.h.
These functions provide a windows-specific implementation for the pthread functions,
but require that the thread has been created with WTF::createThread(),
which is the case for all threads created within WebKit.
To call this function from fastMalloc we must not call fastMalloc in them.
To fulfill this constraint ThreadSpecificWin will allocated its memory through the
original malloc implementation and use the stack for local and static variables.
Keep the Darwin implementation as it is, since it contains some performance tweaks.

* wtf/FastMalloc.cpp:
* wtf/ThreadSpecificWin.cpp:
(WTF::destructorsList):
(WTF::destructorsMutex):
(WTF::threadSpecificKeyCreate):
(WTF::threadSpecificKeyDelete):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148462 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CMake] Add WTF_USE_*_UNICODE variables
https://bugs.webkit.org/show_bug.cgi?id=114556

Reviewed by Brent Fulgham.

WTF_USE_ICU_UNICODE and WTF_USE_WCHAR_UNICODE are used to
reduce duplication in the platform specific CMake files.

.:

* Source/cmake/OptionsBlackBerry.cmake:
* Source/cmake/OptionsEfl.cmake:
* Source/cmake/OptionsWinCE.cmake:

Source/JavaScriptCore:

* CMakeLists.txt:
* PlatformEfl.cmake:

Source/WebCore:

* CMakeLists.txt:
* PlatformBlackBerry.cmake:
* PlatformEfl.cmake:
* PlatformWinCE.cmake:

Source/WTF:

* wtf/CMakeLists.txt:
* wtf/PlatformBlackBerry.cmake:
* wtf/PlatformEfl.cmake:
* wtf/PlatformWinCE.cmake:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148463 268f45cc-cd09-0410-ab3c-d52691b4dbfc
After switching to another space and back, video races to catch up with audio
https://bugs.webkit.org/show_bug.cgi?id=114634

Reviewed by Tim Horton.

In Mountain Lion and previous, report that a view is "not visible" when its window
is not in the active space. This causes us to notify AVFoundation that its CAImageQueues
will not be serviced and results in not having the "catch up" behavior when returning
to the browser's space.

* UIProcess/API/mac/PageClientImpl.mm:
(WebKit::PageClientImpl::isViewVisible):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148464 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Crash from null m_webSettings in WebPagePrivate
https://bugs.webkit.org/show_bug.cgi?id=114633
RIM PR 303745

Patch by Liam Quinn <lquinn@blackberry.com> on 2013-04-15
Reviewed by Rob Buis.
Internally reviewed by Leo Yang.

Speculative fix suggested by George Staikos--initialize m_webSettings first thing in the init() method.

* Api/WebPage.cpp:
(BlackBerry::WebKit::WebPagePrivate::init):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148466 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove files related to quota and proximity events from the Xcode project
https://bugs.webkit.org/show_bug.cgi?id=114635

Reviewed by Benjamin Poulain.

* WebCore.xcodeproj/project.pbxproj:
* history/PageCache.cpp:
* page/DOMWindow.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148467 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Call directly RenderBlock::deleteLineBoxTree
https://bugs.webkit.org/show_bug.cgi?id=102761

Reviewed by Darin Adler.

Instead of implementing RenderLineBoxList::deleteLineBoxTree logic inside
RenderBlock::determineStartPosition, we can reuse the code. The commentaries added
in the changeset #86628 are not valid anymore, nextRootBox is casting m_nextLineBox
and nextLineBox is returning m_nextLineBox.

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::determineStartPosition):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148468 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LLInt SH4 backend implementation
https://bugs.webkit.org/show_bug.cgi?id=112886

Patch by Julien Brianceau <jbrianceau@nds.com> on 2013-04-15
Reviewed by Oliver Hunt.

Source/JavaScriptCore:

* dfg/DFGOperations.cpp:
(JSC):
* jit/JITStubs.cpp:
* llint/LLIntOfflineAsmConfig.h:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* offlineasm/arm.rb:
* offlineasm/ast.rb:
* offlineasm/backends.rb:
* offlineasm/instructions.rb:
* offlineasm/mips.rb:
* offlineasm/risc.rb:
* offlineasm/sh4.rb: Added.

Source/WTF:

* wtf/Platform.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148474 268f45cc-cd09-0410-ab3c-d52691b4dbfc
HeapTimer lifetime should be less complicated
https://bugs.webkit.org/show_bug.cgi?id=114529

Reviewed by Oliver Hunt.

Right now our HeapTimer lifetime is rather complicated. HeapTimers are "owned" by the JSGlobalData,
but there's an issue in that there can be races between a thread that is trying to tear down a JSGlobalData
and the HeapTimer's fire function. Our current code for tearing down HeapTimers is an intricate and delicate
dance which probably contains subtle bugs.

We can make our lives easier by changing things around a bit.

1) We should free the API lock from being solely owned by the JSGlobalData so we don't have to worry about
   grabbing the lock out of invalid memory when our HeapTimer callback fires.

2) We should also make it so that we deref the JSGlobalData first, then unlock the API lock so that when we
   have the lock, the JSGlobalData is in one of two states: fully valid or completely destroyed, and we know exactly which one.

3) The JSLock can tell us this information by keeping a back pointer to the JSGlobalData. When the JSGlobalData's
   destructor is called, it clears this pointer in the JSLock. Other clients of the API lock can then check
   this pointer to determine whether or not the JSGlobalData is still around.

4) The CFRunLoopTimer will use the API lock as its context rather than the HeapTimer itself. The only way
   the HeapTimer's callback can get to the HeapTimer is through the API lock's JSGlobalData pointer.

5) The CFRunLoopTimerContext struct has two fields for retain and release callbacks for the context's info field.
   We'll provide these callbacks to ref() and deref() the JSLock as necessary. Thus, the timer becomes the other
   owner of the JSLock apart from the JSGlobalData.

* API/APIShims.h: Remove the cruft that was required by the previous design, such as RefGlobalDataTag.
(JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
(JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
(APIEntryShimWithoutLock):
(JSC::APIEntryShim::APIEntryShim):
(JSC::APIEntryShim::~APIEntryShim): Protect the API lock with a RefPtr, deref the JSGlobalData, which could destroy it,
then unlock the API lock. This ordering prevents others from obtaining the API lock while the JSGlobalData is in the
middle of being torn down.
(JSC::APIEntryShim::init): We now take the lock, then ref the JSGlobalData, which is the opposite order of when we
tear down the shim.
* heap/Heap.cpp:
(JSC::Heap::setActivityCallback): Use PassOwnPtr now.
(JSC::Heap::activityCallback): Ditto.
(JSC::Heap::sweeper): Ditto.
(JSC):
* heap/Heap.h:
(Heap):
* heap/HeapTimer.cpp:
(JSC::retainAPILock): Retain callback for CFRunLoopTimerContext struct.
(JSC::releaseAPILock): Release callback for the CFRunLoopTimerContext struct.
(JSC::HeapTimer::HeapTimer): Use the API lock as the context's info field rather than the HeapTimer.
(JSC::HeapTimer::timerDidFire): Grab the API lock. Return early if the JSGlobalData has already been destroyed.
Otherwise, figure out which kind of HeapTimer we are based on the CFRunLoopTimerRef passed to the callback and
call the HeapTimer's callback.
* heap/HeapTimer.h:
(HeapTimer):
* heap/IncrementalSweeper.cpp:
(JSC::IncrementalSweeper::create): PassOwnPtr all the things.
* heap/IncrementalSweeper.h:
(IncrementalSweeper):
* jsc.cpp:
(jscmain): We use an APIEntryShim instead of a RefPtr for the JSGlobalData because we need to
tear down the JSGlobalData while we still hold the lock, which the APIEntryShim handles correctly.
* runtime/GCActivityCallback.h:
(DefaultGCActivityCallback):
(JSC::DefaultGCActivityCallback::create):
* runtime/JSGlobalData.cpp:
(JSC::JSGlobalData::JSGlobalData):
(JSC::JSGlobalData::~JSGlobalData): Notify the API lock that the JSGlobalData is being torn down.
* runtime/JSGlobalData.h:
(JSGlobalData):
(JSC::JSGlobalData::apiLock):
* runtime/JSLock.cpp:
(JSC::JSLockHolder::JSLockHolder): Ref, then lock (just like the API shim).
(JSC):
(JSC::JSLock::willDestroyGlobalData):
(JSC::JSLockHolder::init):
(JSC::JSLockHolder::~JSLockHolder): Protect, deref, then unlock (just like the API shim).
(JSC::JSLock::JSLock):
* runtime/JSLock.h: Add back pointer to the JSGlobalData and a callback for when the JSGlobalData is being
torn down that clears this pointer to notify other clients (i.e. timer callbacks) that the JSGlobalData is no
longer valid.
(JSLockHolder):
(JSLock):
(JSC::JSLock::globalData):
* testRegExp.cpp:
(realMain): We use an APIEntryShim instead of a RefPtr for the JSGlobalData because we need to
tear down the JSGlobalData while we still hold the lock, which the APIEntryShim handles correctly.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148475 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][WK2] build fix after r148434
https://bugs.webkit.org/show_bug.cgi?id=114647

Patch by Seokju Kwon <seokju.kwon@gmail.com> on 2013-04-15
Reviewed by Benjamin Poulain.

* UIProcess/API/efl/EwkView.cpp:
(EwkView::showContextMenu):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148477 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ScriptWrappable subclasses shouldn't have to include WeakInlines.h
https://bugs.webkit.org/show_bug.cgi?id=114641

Reviewed by Alexey Proskuryakov.

Source/JavaScriptCore:

Move back the Weak constructor, destructor and clear() to Weak.h. Add a new weakClearSlowCase function
and put it in Weak.cpp.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* heap/Weak.cpp: Added.
* heap/Weak.h:
* heap/WeakInlines.h:
* heap/WeakSetInlines.h:

Source/WebCore:

Remove ScriptWrappableInlines.h includes, they're not needed anymore.

* css/WebKitCSSMatrix.cpp:
* dom/ClientRect.cpp:
* dom/ClientRectList.cpp:
* dom/Clipboard.cpp:
* dom/DOMStringMap.cpp:
* dom/Event.cpp:
* dom/MutationRecord.cpp:
* fileapi/FileList.cpp:
* page/BarInfo.cpp:
* plugins/DOMMimeTypeArray.cpp:
* plugins/DOMPlugin.cpp:
* plugins/DOMPluginArray.cpp:
* storage/Storage.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148479 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove V8-specific extended attributes from IDL files
https://bugs.webkit.org/show_bug.cgi?id=114523

Reviewed by Geoffrey Garen.

No tests because no behavior change is expected.

* Modules/encryptedmedia/MediaKeyMessageEvent.idl:
* Modules/encryptedmedia/MediaKeyNeededEvent.idl:
* Modules/encryptedmedia/MediaKeySession.idl:
* Modules/encryptedmedia/MediaKeys.idl:
* Modules/filesystem/HTMLInputElementFileSystem.idl:
* Modules/indexeddb/IDBAny.idl:
* Modules/mediasource/MediaSource.idl:
* Modules/mediasource/SourceBuffer.idl:
* Modules/mediasource/SourceBufferList.idl:
* Modules/mediastream/MediaStream.idl:
* Modules/webaudio/AudioDestinationNode.idl:
* html/track/TextTrackCue.idl:
* html/track/TextTrackCueList.idl:
* html/track/TextTrackList.idl:
* html/track/TextTrackRegion.idl:
* html/track/TextTrackRegionList.idl:
* html/track/TrackEvent.idl:
* storage/Storage.idl:
* svg/SVGDocument.idl:
* svg/SVGElement.idl:
* workers/WorkerContext.idl:
* xml/XMLHttpRequest.idl:
* xml/XPathNSResolver.idl:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148480 268f45cc-cd09-0410-ab3c-d52691b4dbfc
activating a focused link to an in-page fragment ID should transfer focus to the target of the link when possible
https://bugs.webkit.org/show_bug.cgi?id=17450

Reviewed by Maciej Stachowiak.

Source/WebCore: 

When a fragment is scrolled to due to an activation event or on load, focus should attempt to 
move to the fragment if possible.

Test: fast/dom/fragment-activation-focuses-target.html

* page/FrameView.cpp:
(WebCore::FrameView::scrollToAnchor):

LayoutTests: 

* fast/dom/fragment-activation-focuses-target.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148481 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Plugins that resize might need to be snapshotted.
https://bugs.webkit.org/show_bug.cgi?id=102157
<rdar://problem/12696259>

Reviewed by Tim Horton.

Source/WebCore:

A plugin could avoid snapshotting if it started very
small (below the threshold where we autostart), and then
resized to be large (above the threshold). Detect this
case and tell the plugin to snapshot.

There unfortunately is a bit of state to track when doing
this. We have to start the snapshotting in a post-layout
task, so we carry a flag to say we're checking size but
not wanting the plugin to update (which would restart it).
We also might be a plugin that would have already restarted
due to a similar plugin being clicked or detected as dominant.
So this patch introduces a member variable that tracks what
decision has been made on snapshotting.

I also added some more logging to be more clear about what is
happening to plugins going through the snapshot process, and
changed the order of the tests in the algorithm so that domain
detection comes before examining the size.

* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement): Initialise
    the two new member variables.
(WebCore::HTMLPlugInImageElement::setDisplayState): Mark a restarted
    plugin as NeverSnapshot. This means that if it later resizes above the
    threshold, it won't trigger the snapshot detection.
(WebCore::HTMLPlugInImageElement::checkSnapshotStatus): Renamed from
    updateSnapshotInfo. This now updates the snapshot, but also runs
    the check for size changes.
(WebCore::addPlugInsFromNodeListMatchingPlugInOrigin): Gather all plugins
    that look like a restarting plugin, not just those snapshotted. That
    way they can all be marked as NeverSnapshot.
(WebCore::HTMLPlugInImageElement::restartSimilarPlugIns): Bless every
    plugin that looks similar, whether or not it is snapshotted.
(WebCore::HTMLPlugInImageElement::userDidClickSnapshot): More logging.
(WebCore::HTMLPlugInImageElement::setIsPrimarySnapshottedPlugIn): Ditto.
(WebCore::HTMLPlugInImageElement::checkSizeChangeForSnapshotting): New
    method. If the plugin was below the threshold and is now above it,
    begin the snapshotting process.
(WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Plugins
    that were marked as NeverSnapshot should start immediately. Move the origin
    test earlier in the method. If a plugin avoided snapshotting due to size,
    remember the size.
(WebCore::HTMLPlugInImageElement::subframeLoaderDidCreatePlugIn): Mark the
    plugin as NeverSnapshot.

* html/HTMLPlugInImageElement.h:
(HTMLPlugInImageElement): Four new member variables:
    - the decision we made regarding snapshotting (or not), uses the SnapshotDecision enum
    - the size when it avoided snapshotting
    - a flag to indicate the post layout update was triggered due to
      a size change
(WebCore::HTMLPlugInImageElement::needsCheckForSizeChange): New method.
(WebCore::HTMLPlugInImageElement::setNeedsCheckForSizeChange): New method.
(WebCore::HTMLPlugInImageElement::snapshotDecision): Return the decision
    regarding snapshotting or not snapshotting.

* page/FrameView.cpp:
(WebCore::FrameView::addWidgetToUpdate): Guard updating the widget. We don't
    want to do it when we're checking for a size change in the plugin.
(WebCore::FrameView::updateWidget): Call new name.

* plugins/PluginViewBase.h:
(WebCore::PluginViewBase::beginSnapshottingRunningPlugin): Empty virtual
    method to snapshot a running plugin.

* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::layout): If the plugin has increased in
    size add it to the post layout list so that it will be checked.

Source/WebKit2:

Allow a running plugin to be snapshotted. All this
means is that we start the snapshot timer again.

* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::beginSnapshottingRunningPlugin): Restart
    the timer.
* WebProcess/Plugins/PluginView.h: Virtual method declaration.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148482 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebKit/mac: plugins/get-url-beforeunload-destroys-plugin.html crashes in WebKit1
https://bugs.webkit.org/show_bug.cgi?id=114653
<rdar://problem/13659541>

Reviewed by Sam Weinig.

Protect the NetscapePluginInstanceProxy since it can otherwise go away.

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::performRequest):

LayoutTests: plugins/get-url-beforeunload-destroys-plugin.html crashes in WebKit1
https://bugs.webkit.org/show_bug.cgi?id=114653

Reviewed by Sam Weinig.

Move this test back now that it passes in WK1.

* http/tests/plugins/get-url-beforeunload-destroys-plugin-expected.txt: Renamed from LayoutTests/platform/mac-wk2/http/tests/plugins/get-url-beforeunload-destroys-plugin-expected.txt.
* http/tests/plugins/get-url-beforeunload-destroys-plugin.html: Renamed from LayoutTests/platform/mac-wk2/http/tests/plugins/get-url-beforeunload-destroys-plugin.html.
* http/tests/plugins/resources/notify-done.html: Renamed from LayoutTests/platform/mac-wk2/http/tests/plugins/resources/notify-done.html.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148483 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit should not expose AXSubrole:AXDescriptionList on Mountain Lion as it causes a regression in VoiceOver behavior
https://bugs.webkit.org/show_bug.cgi?id=113975

Patch by James Craig <james@cookiecrook.com> on 2013-04-15
Reviewed by Chris Fleizach.

Serve NSAccessibilityDescriptionListSubrole or NSAccessibilityDefinitionListSubrole
depending on platform. Updated existing test coverage.

Source/WebCore:

* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper subrole]):

LayoutTests:

* platform/mac/accessibility/lists-expected.txt:
* platform/mac/accessibility/role-subrole-roledescription-expected.txt:
* platform/mac/accessibility/role-subrole-roledescription.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148484 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove V8 attribtues from IDLAttributes.txt
https://bugs.webkit.org/show_bug.cgi?id=114651

Reviewed by Sam Weinig.

No tests because no behavior change is expected.

* bindings/scripts/IDLAttributes.txt: Remove V8 attribtues.
* html/track/TextTrackList.idl: Remove a stray V8-specific attribute
(so I guess this change is not useless)


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148486 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rename restartedPlugin to isRestartedPlugin. This was
review feedback from r148038 that I thought I fixed
everywhere but failed.
https://bugs.webkit.org/show_bug.cgi?id=114233

* html/HTMLPlugInElement.h:
(WebCore::HTMLPlugInElement::isRestartedPlugin): Prefix with "is".
* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
(WebCore::HTMLPlugInImageElement::setDisplayState):
(WebCore::HTMLPlugInImageElement::removeSnapshotTimerFired):
* html/HTMLPlugInImageElement.h:
* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::paintContents):
* rendering/RenderLayerBacking.cpp:
(WebCore::isRestartedPlugin):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148487 268f45cc-cd09-0410-ab3c-d52691b4dbfc