point dependencies to 'release' branches

Change-Id: I669ec01576ca5f0f5e21ec1cefbda4a259764cd3
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Merge branch 'stable' into release

Change-Id: Ifdbfff78833ca658ad6d10dd829289fc0a430e6d
Bump Qt version to 5.0.1

Change-Id: Iaef944ee139760ca62c5fc3b0f056d0caa596a53
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
[Qt] Crash in gmail on enabling desktop notifications

https://bugs.webkit.org/show_bug.cgi?id=106699

Patch by David Rosca.
Reviewed by Jocelyn Turcotte.

Protect against callback that may be null. This also matches WebKit2 behaviour.

* WebCoreSupport/NotificationPresenterClientQt.cpp:
(WebCore::NotificationPresenterClientQt::allowNotificationForFrame):

Reviewed-by: jocelyn.turcotte@digia.com

Change-Id: Icac8f0202c378d129895b47224bfabc9b2a53b3d
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Fixing memory read after free in CanvasRenderingContext2D::accessFont

https://bugs.webkit.org/show_bug.cgi?id=106244

Reviewed by Abhishek Arya.

Using a temporary String object to hold ref count on string that is
passed by reference in CanvasRenderingContext2D::accessFont.

Test: fast/canvas/canvas-measureText.html

* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::CanvasRenderingContext2D::accessFont):

Change-Id: Icfab9c7b7e870af9ca9ba05a1b803b51a9a329ad
Reviewed-by: Zeno Albisser <zeno.albisser@digia.com>
Make custom filter render in Wk1 mode

https://bugs.webkit.org/show_bug.cgi?id=101532

Fix CSS shaders so they work in QGraphicsWebView at least when used in
an OpenGL context.

Change-Id: I64e7269cd1347079f02faa3153e262520bc6ad5c
Reviewed-by: Zeno Albisser <zeno.albisser@digia.com>
Heap-use-after-free in DocumentLoader::stopLoading

https://bugs.webkit.org/show_bug.cgi?id=103656

Reviewed by Eric Seidel.

Source/WebCore:

Test: fast/dom/ready-state-change-crash.html

* html/parser/HTMLDocumentParser.cpp:
(WebCore::HTMLDocumentParser::prepareToStopParsing): Bail out
if the parser is detached due to mutation event.
* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::stopLoading): Move the protectors for
frame and document loader to the start of the function. Call to
m_frame->loader()->stopLoading() can change document ready state
and fire mutation event which might blow the document loader from
underneath.

Change-Id: Ib51a1eb062e552eb0cfa7e4ac647e59a4c6b433d
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Heap-use-after-free in WebCore::XMLDocumentParser::doEnd

https://bugs.webkit.org/show_bug.cgi?id=100152

Reviewed by Adam Barth.

XMLDocumentParser can be blown away inside document()->styleResolverChanged()
call. Protect it with a local RefPtr in Document::explitClose.

No new tests. The site specific dependencies are hard to minimize.

* dom/Document.cpp:
(WebCore::Document::explicitClose): RefPtr m_parser into a local, since
it can be detached and nulled out in DocumentWriter::end().
* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::end): Bail out when we are detached.
* xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::XMLDocumentParser::doEnd): Bail out when we are detached.
* xml/parser/XMLDocumentParserQt.cpp:
(WebCore::XMLDocumentParser::doEnd): Bail out when we are detached.

Change-Id: If7ff9142c561391e7c30632a9b8fb9cbb284fb2c
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Crash in WebCore::Element::cloneElementWithoutChildren

https://bugs.webkit.org/show_bug.cgi?id=105949

Reviewed by Ryosuke Niwa.

RefPtr |ancestors| vector since its elements can be destroyed from mutation events
fired in CompositeEditCommand::appendNode.

No new tests. The testcase relies on recursive DOM mutations and does not minimize.

* editing/InsertParagraphSeparatorCommand.cpp:
(WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock):
(WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock):
(WebCore::InsertParagraphSeparatorCommand::doApply):
* editing/InsertParagraphSeparatorCommand.h:
(InsertParagraphSeparatorCommand):

Change-Id: I8792007dd6b3d397c7885943400eb5193a701edd
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Early out from FontCache::releaseFontData if cached font data not found.

https://bugs.webkit.org/show_bug.cgi?id=106104

Patch by John Mellor <johnme@chromium.org> on 2013-01-04
Reviewed by Abhishek Arya.

No tests, as no change in behavior.

* platform/graphics/FontCache.cpp:
(WebCore::FontCache::releaseFontData):
    Early out in release builds if cached font data not found.

Change-Id: Iabf218a7fd001588831b331afb49e2de3a314a2a
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
[Qt] Webkit debug build links against release binaries of ANGLE libEGL, libGLESv2
https://bugs.webkit.org/show_bug.cgi?id=106217

Patch by Kai Koehne <kai.koehne@digia.com> on 2013-01-24
Reviewed by Jocelyn Turcotte.

Use libEGLd, libEGLSv2d if qtbase was compiled with ANGLE.

* WebCore.pri: Mirror logic of qtbase\mkspecs\features\win32\opengl.prf

Change-Id: Iad260dbc0bd85ba45c4cd8ccfd5e12f5bef52998
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140675 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[Qt] Fix a crash when the QQuickWebPage is destroyed between the scene graph sync and render.

https://bugs.webkit.org/show_bug.cgi?id=106018

Reviewed by Simon Hausmann.

The main and rendering threads are only guaranteed to be synchronised in
the updatePaintNode call. In every other cases, QQuickItems cannot be
safely accessed from the rendering thread.

Do as the first patch version in
https://bugs.webkit.org/show_bug.cgi?id=104574 was doing and copy the
ratio value directly to fix the issue.

Also add a note about the threading issue in QQuickWebPage::updatePaintNode.

* UIProcess/API/qt/qquickwebpage.cpp:
(QQuickWebPage::updatePaintNode):
* UIProcess/qt/QtWebPageSGNode.cpp:
(WebKit::QtWebPageSGNode::QtWebPageSGNode):
* UIProcess/qt/QtWebPageSGNode.h:
(QtWebPageSGNode):
(WebKit::QtWebPageSGNode::devicePixelRatio):
(WebKit::QtWebPageSGNode::setDevicePixelRatio):

Change-Id: I2ef35f357c56c251033573d4435ddd7768a4422f
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[Qt] Horizontal scrollbars events are offseted making them difficult to use

https://bugs.webkit.org/show_bug.cgi?id=105014

Reviewed by Allan Sandfeld Jensen.

Patch co-authored by Simon Hausmann.

Only copy the layout direction from the facade options if the
current option is Qt::LayoutDirectionAuto in order to prevent
misinterpretations as different layout direction when hit testing.

Tests added to tst_qwebview and tst_qgraphicswebview to verify
that the view actually is scrolled in the right direction.

* WidgetSupport/QStyleFacadeImp.cpp:
(WebKit::initGenericStyleOption):
* tests/qgraphicswebview/resources/scrolltest_page.html: Added.
* tests/qgraphicswebview/tst_qgraphicswebview.cpp:
(tst_QGraphicsWebView):
(tst_QGraphicsWebView::horizontalScrollbarTest):
* tests/qgraphicswebview/tst_qgraphicswebview.qrc:
* tests/qwebview/resources/scrolltest_page.html: Added.
* tests/qwebview/tst_qwebview.cpp:
(tst_QWebView):
(tst_QWebView::horizontalScrollbarTest):
* tests/qwebview/tst_qwebview.qrc:

[Qt] Apply correct patch for the scrolling issue from bug 105014
https://bugs.webkit.org/show_bug.cgi?id=106219

Correct the if condition when overwriting the layout direction option
with the values from the facade options to only overwrite if the facade
direction is not equal to LayoutDirectionAuto.

Reviewed by Allan Sandfeld Jensen.

* WidgetSupport/QStyleFacadeImp.cpp:
(WebKit::initGenericStyleOption):

Change-Id: I8a8c8d483beabf304cb2cdf63276cba61600138d
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[Qt] Crash in gmail on enabling desktop notifications

https://bugs.webkit.org/show_bug.cgi?id=106699

Patch by David Rosca.
Reviewed by Jocelyn Turcotte.

Protect against callback that may be null. This also matches WebKit2 behaviour.

* WebCoreSupport/NotificationPresenterClientQt.cpp:
(WebCore::NotificationPresenterClientQt::allowNotificationForFrame):

Change-Id: Ic8e421c4c6948b6dc5578355b41e754b5beca723
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Merge branch 'release' into stable

Conflicts:
	Source/WebCore/ChangeLog
	Source/WebKit/qt/ChangeLog

Change-Id: Id01082a2a19811f59b08068331a658afe9eefbdb
substitute fixed version numbers in qdocconf files with variables

Change-Id: I132cd94b9507ee55c8421b7297c4a38fb3b7fd04
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Butterfly::growArrayRight shouldn't be called on null Butterfly objects

https://bugs.webkit.org/show_bug.cgi?id=105221

Reviewed by Filip Pizlo.

Currently we depend upon the fact that Butterfly::growArrayRight works with null Butterfly
objects purely by coincidence. We should add a new static function that null checks the old
Butterfly object and creates a new one if it's null, or calls growArrayRight if it isn't for
use in the couple of places in JSObject that expect such behavior to work.

* runtime/Butterfly.h:
(Butterfly):
* runtime/ButterflyInlines.h:
(JSC::Butterfly::createOrGrowArrayRight):
(JSC):
* runtime/JSObject.cpp:
(JSC::JSObject::createInitialIndexedStorage):
(JSC::JSObject::createArrayStorage):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@137961 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change-Id: I643bc988f3e25b6f05be4e99f19fd2dc609152e4
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Restrictions on oversize CopiedBlock allocations should be relaxed

https://bugs.webkit.org/show_bug.cgi?id=105339

Reviewed by Filip Pizlo.

Currently the DFG has a single branch in the inline allocation path for property/array storage where
it checks to see if the number of bytes requested will fit in the current block. This does not match
what the C++ allocation path does; it checks if the requested number of bytes is oversize, and then
if it's not, it tries to fit it in the current block. The garbage collector assumes that ALL allocations
that are greater than 16KB are in oversize blocks. Therefore, this mismatch can lead to crashes when
the collector tries to perform some operation on a CopiedBlock.

To avoid adding an extra branch to the inline allocation path in the JIT, we should make it so that
oversize blocks are allocated on the same alignment boundaries so that there is a single mask to find
the block header of any CopiedBlock (rather than two, one for normal and one for oversize blocks), and
we should figure out if a block is oversize by some other method than just whatever the JSObject says
it is. One way we could record this info Region of the block, since we allocate a one-off Region for
oversize blocks.

* heap/BlockAllocator.h:
(JSC::Region::isCustomSize):
(Region):
(JSC::Region::createCustomSize):
(JSC::Region::Region):
(JSC::BlockAllocator::deallocateCustomSize):
* heap/CopiedBlock.h:
(CopiedBlock):
(JSC::CopiedBlock::isOversize):
(JSC):
* heap/CopiedSpace.cpp:
(JSC::CopiedSpace::tryAllocateOversize):
(JSC::CopiedSpace::tryReallocate):
(JSC::CopiedSpace::tryReallocateOversize):
* heap/CopiedSpace.h:
(CopiedSpace):
* heap/CopiedSpaceInlines.h:
(JSC::CopiedSpace::contains):
(JSC::CopiedSpace::tryAllocate):
(JSC):
* heap/CopyVisitor.h:
(CopyVisitor):
* heap/CopyVisitorInlines.h:
(JSC::CopyVisitor::checkIfShouldCopy):
(JSC::CopyVisitor::didCopy):
* heap/SlotVisitorInlines.h:
(JSC::SlotVisitor::copyLater):
* runtime/JSObject.cpp:
(JSC::JSObject::copyButterfly):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138067 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Change-Id: Icebcfe83d82ace7c3e1db6a979306f604459c5ae
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[Qt] Box shadows on a transparency layer is very slow

https://bugs.webkit.org/show_bug.cgi?id=107547

Reviewed by Noam Rosenthal.

Include the window boundaries in the clip returned by GraphicsContext,
since QPainter may remember clips larger than the destination, but
ShadowBlur uses the clipBounds to determine the size of the shadow layer.

* platform/graphics/qt/GraphicsContextQt.cpp:
(WebCore::GraphicsContext::clipBounds):

Change-Id: Icb53ad7001420bd3bd9c2105c3ae8dcc7bc49d8c
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141413 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[Qt][WK1] Permission request callbacks for non-legacy notifications

https://bugs.webkit.org/show_bug.cgi?id=107438

Reviewed by Jocelyn Turcotte.

Tracks the new callbacks the same way legacy callbacks are tracked.

No test affected yet as we are still lacking support for testing
feature permission callbacks.

* WebCoreSupport/NotificationPresenterClientQt.cpp:
(WebCore::NotificationPresenterClientQt::requestPermission):
(WebCore::NotificationPresenterClientQt::allowNotificationForFrame):
* WebCoreSupport/NotificationPresenterClientQt.h:
(NotificationPresenterClientQt):
(CallbacksInfo):

Change-Id: Ia01ec54c2d55fac59c6a245757f44ce507a3ef19
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140330 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>