Vector::append doesn't work if element type has overloaded operator&
https://bugs.webkit.org/show_bug.cgi?id=121175

Reviewed by Brent Fulgham.

Source/WTF:

Use std::addressof to get the address of the given object.

* wtf/Vector.h:
(WTF::::appendSlowCase):
(WTF::::uncheckedAppend):

Tools:

Add a test case.

* TestWebKitAPI/Tests/WTF/Vector.cpp:
(TestWebKitAPI::TEST):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155551 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: Stop using deleteAllValues in SVG code
https://bugs.webkit.org/show_bug.cgi?id=121172

Reviewed by Antti Koivisto.

Use OwnPtr for values instead.

* rendering/svg/RenderSVGResourceClipper.cpp:
(WebCore::RenderSVGResourceClipper::~RenderSVGResourceClipper):
(WebCore::RenderSVGResourceClipper::removeAllClientsFromCache):
(WebCore::RenderSVGResourceClipper::removeClientFromCache):
(WebCore::RenderSVGResourceClipper::applyClippingToContext):
* rendering/svg/RenderSVGResourceClipper.h:
* rendering/svg/RenderSVGResourceFilter.cpp:
(WebCore::RenderSVGResourceFilter::~RenderSVGResourceFilter):
(WebCore::RenderSVGResourceFilter::removeAllClientsFromCache):
(WebCore::RenderSVGResourceFilter::removeClientFromCache):
(WebCore::RenderSVGResourceFilter::applyResource):
(WebCore::RenderSVGResourceFilter::postApplyResource):
(WebCore::RenderSVGResourceFilter::primitiveAttributeChanged):
* rendering/svg/RenderSVGResourceFilter.h:
* rendering/svg/RenderSVGResourceMasker.cpp:
(WebCore::RenderSVGResourceMasker::~RenderSVGResourceMasker):
(WebCore::RenderSVGResourceMasker::removeAllClientsFromCache):
(WebCore::RenderSVGResourceMasker::removeClientFromCache):
(WebCore::RenderSVGResourceMasker::applyResource):
* rendering/svg/RenderSVGResourceMasker.h:

Source/WTF: Vector::append doesn't work if element type has overloaded operator&
https://bugs.webkit.org/show_bug.cgi?id=121175

Reviewed by Brent Fulgham.

Use std::addressof to get the address of the given object.

* wtf/Vector.h:
(WTF::::appendSlowCase):
(WTF::::uncheckedAppend):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155552 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=121169
media/track/track-cue-rendering-vertical.html is flaky on Mac

Reviewed by Eric Carlson.

Source/WebCore:

* html/shadow/MediaControlElements.cpp:
(WebCore::MediaControlTextTrackContainerElement::updateSizes): Added a FIXME.

LayoutTests:

* media/media-reparent.html: Changed to use setTimeout directly.

* media/video-test.js:
(endTest): Added a zero delay timer to let text track layout do its work.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155553 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix nested unicode-bidi: isolate
https://bugs.webkit.org/show_bug.cgi?id=120504

Patch by Myles C. Maxfield <mmaxfield@apple.com> on 2013-09-11
Reviewed by Darin Adler.

Source/WebCore:

When we have a nested isolate renderer if the outer isolate has a text
and this text is not the first child, the isolated chain is not
rendered correctly. This happens because constructBidiRunsForSegment
uses always the first inner isolated renderer as isolated inline
container. This patch fixes the behavior described changing
containingIsolate to find the right isolated container.

Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/840a57050eade39dd04dde0c6603e129b783151c

Tests: fast/text/international/unicode-bidi-isolate-nested-first-child-text.html
       fast/text/international/unicode-bidi-isolate-nested-simple.html

* rendering/InlineIterator.h:
(WebCore::containingIsolate):
* rendering/RenderBlockLineLayout.cpp:
(WebCore::constructBidiRunsForSegment):

LayoutTests:

* fast/text/international/unicode-bidi-isolate-nested-first-child-text-expected.html: Added.
* fast/text/international/unicode-bidi-isolate-nested-first-child-text.html: Added.
* fast/text/international/unicode-bidi-isolate-nested-simple-expected.html: Added.
* fast/text/international/unicode-bidi-isolate-nested-simple.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155554 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move all collapsing margin code out of RenderBlock and into RenderBlockFlow.
https://bugs.webkit.org/show_bug.cgi?id=121049

Reviewed by Dean Jackson.

This patch begins the migration of the rare data struct of RenderBlock into
RenderBlockFlow. During this process we will temporarily have rare data structs
in both places, but ultimately all of the members are going to move down into
RenderBlockFlow, and if any don't, they will get forced into a hash.
        
For this patch, the margin information is being shifted out of RenderBlock and into
RenderBlockFlow. Any functions that refer to MarginValues or to MarginInfo also got
moved down into RenderBlockFlow. Most of block child layout is now in RenderBlockFlow
after this patch.
        
Note that in many cases the code didn't simply move. There is some type tightening
that happened as well, i.e., places that look for RenderBlock can now look for
RenderBlockFlow instead and let RenderBlock execute the base RenderBox functions.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::RenderBlock):
(WebCore::RenderBlock::setPaginationStrut):
(WebCore::RenderBlock::setPageLogicalOffset):
(WebCore::RenderBlock::setBreakAtLineToAvoidWidow):
* rendering/RenderBlock.h:
(WebCore::RenderBlock::setLineGridBox):
(WebCore::RenderBlock::setShapeInsideInfo):
(WebCore::RenderBlock::RenderBlockRareData::RenderBlockRareData):
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::MarginInfo::MarginInfo):
(WebCore::RenderBlockFlow::RenderBlockFlow):
(WebCore::RenderBlockFlow::layoutBlockChild):
(WebCore::RenderBlockFlow::adjustPositionedBlock):
(WebCore::RenderBlockFlow::adjustFloatingBlock):
(WebCore::RenderBlockFlow::marginValuesForChild):
(WebCore::RenderBlockFlow::collapseMargins):
(WebCore::RenderBlockFlow::clearFloatsIfNeeded):
(WebCore::RenderBlockFlow::marginBeforeEstimateForChild):
(WebCore::RenderBlockFlow::estimateLogicalTopPosition):
(WebCore::RenderBlockFlow::setCollapsedBottomMargin):
(WebCore::RenderBlockFlow::handleAfterSideOfBlock):
(WebCore::RenderBlockFlow::setMaxMarginBeforeValues):
(WebCore::RenderBlockFlow::setMaxMarginAfterValues):
(WebCore::RenderBlockFlow::setMustDiscardMarginBefore):
(WebCore::RenderBlockFlow::setMustDiscardMarginAfter):
(WebCore::RenderBlockFlow::mustDiscardMarginBefore):
(WebCore::RenderBlockFlow::mustDiscardMarginAfter):
(WebCore::RenderBlockFlow::mustDiscardMarginBeforeForChild):
(WebCore::RenderBlockFlow::mustDiscardMarginAfterForChild):
(WebCore::RenderBlockFlow::mustSeparateMarginBeforeForChild):
(WebCore::RenderBlockFlow::mustSeparateMarginAfterForChild):
(WebCore::inNormalFlow):
(WebCore::RenderBlockFlow::applyBeforeBreak):
(WebCore::RenderBlockFlow::applyAfterBreak):
(WebCore::RenderBlockFlow::adjustBlockChildForPagination):
* rendering/RenderBlockFlow.h:
(WebCore::RenderBlockFlow::MarginValues::MarginValues):
(WebCore::RenderBlockFlow::MarginValues::positiveMarginBefore):
(WebCore::RenderBlockFlow::MarginValues::negativeMarginBefore):
(WebCore::RenderBlockFlow::MarginValues::positiveMarginAfter):
(WebCore::RenderBlockFlow::MarginValues::negativeMarginAfter):
(WebCore::RenderBlockFlow::MarginValues::setPositiveMarginBefore):
(WebCore::RenderBlockFlow::MarginValues::setNegativeMarginBefore):
(WebCore::RenderBlockFlow::MarginValues::setPositiveMarginAfter):
(WebCore::RenderBlockFlow::MarginValues::setNegativeMarginAfter):
(WebCore::RenderBlockFlow::RenderBlockFlowRareData::RenderBlockFlowRareData):
(WebCore::RenderBlockFlow::RenderBlockFlowRareData::positiveMarginBeforeDefault):
(WebCore::RenderBlockFlow::RenderBlockFlowRareData::negativeMarginBeforeDefault):
(WebCore::RenderBlockFlow::RenderBlockFlowRareData::positiveMarginAfterDefault):
(WebCore::RenderBlockFlow::RenderBlockFlowRareData::negativeMarginAfterDefault):
(WebCore::RenderBlockFlow::MarginInfo::setAtBeforeSideOfBlock):
(WebCore::RenderBlockFlow::MarginInfo::setAtAfterSideOfBlock):
(WebCore::RenderBlockFlow::MarginInfo::clearMargin):
(WebCore::RenderBlockFlow::MarginInfo::setHasMarginBeforeQuirk):
(WebCore::RenderBlockFlow::MarginInfo::setHasMarginAfterQuirk):
(WebCore::RenderBlockFlow::MarginInfo::setDeterminedMarginBeforeQuirk):
(WebCore::RenderBlockFlow::MarginInfo::setPositiveMargin):
(WebCore::RenderBlockFlow::MarginInfo::setNegativeMargin):
(WebCore::RenderBlockFlow::MarginInfo::setPositiveMarginIfLarger):
(WebCore::RenderBlockFlow::MarginInfo::setNegativeMarginIfLarger):
(WebCore::RenderBlockFlow::MarginInfo::setMargin):
(WebCore::RenderBlockFlow::MarginInfo::setCanCollapseMarginAfterWithChildren):
(WebCore::RenderBlockFlow::MarginInfo::setDiscardMargin):
(WebCore::RenderBlockFlow::MarginInfo::atBeforeSideOfBlock):
(WebCore::RenderBlockFlow::MarginInfo::canCollapseWithMarginBefore):
(WebCore::RenderBlockFlow::MarginInfo::canCollapseWithMarginAfter):
(WebCore::RenderBlockFlow::MarginInfo::canCollapseMarginBeforeWithChildren):
(WebCore::RenderBlockFlow::MarginInfo::canCollapseMarginAfterWithChildren):
(WebCore::RenderBlockFlow::MarginInfo::quirkContainer):
(WebCore::RenderBlockFlow::MarginInfo::determinedMarginBeforeQuirk):
(WebCore::RenderBlockFlow::MarginInfo::hasMarginBeforeQuirk):
(WebCore::RenderBlockFlow::MarginInfo::hasMarginAfterQuirk):
(WebCore::RenderBlockFlow::MarginInfo::positiveMargin):
(WebCore::RenderBlockFlow::MarginInfo::negativeMargin):
(WebCore::RenderBlockFlow::MarginInfo::discardMargin):
(WebCore::RenderBlockFlow::MarginInfo::margin):
(WebCore::RenderBlockFlow::maxPositiveMarginBefore):
(WebCore::RenderBlockFlow::maxNegativeMarginBefore):
(WebCore::RenderBlockFlow::maxPositiveMarginAfter):
(WebCore::RenderBlockFlow::maxNegativeMarginAfter):
(WebCore::RenderBlockFlow::initMaxMarginValues):
* rendering/RenderDeprecatedFlexibleBox.cpp:
(WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
* rendering/RenderTable.cpp:
(WebCore::RenderTable::layout):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155555 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix animations with !USE(ACCELERATED_COMPOSITING) after r147792.
https://bugs.webkit.org/show_bug.cgi?id=121159

Reviewed by Simon Fraser.

CSSPropertyAnimation::blendProperties() is available always
and needs to be called to make the animations work.

* page/animation/ImplicitAnimation.cpp:
(WebCore::ImplicitAnimation::animate):
* page/animation/KeyframeAnimation.cpp:
(WebCore::KeyframeAnimation::animate):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155556 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Windows] Revise GDI Create Functions to use GDIObject Smart Pointer.
https://bugs.webkit.org/show_bug.cgi?id=121100

Reviewed by Anders Carlsson.

* platform/graphics/FontPlatformData.h: Use GDIObject instead of bare pointer.
* platform/graphics/win/FontCacheWin.cpp:
(WebCore::createGDIFont): No longer need to leak the pointer; use move semantic
to pass ownership to FontPlatformData.
(WebCore::FontCache::createFontPlatformData):
* platform/graphics/win/FontCustomPlatformData.cpp:
(WebCore::FontCustomPlatformData::fontPlatformData): Use move operation.
* platform/graphics/win/FontCustomPlatformDataCairo.cpp:
(WebCore::FontCustomPlatformData::fontPlatformData): Ditto.
* platform/graphics/win/FontPlatformDataCGWin.cpp:
(WebCore::FontPlatformData::FontPlatformData): Ditto.
* platform/graphics/win/FontPlatformDataCairoWin.cpp:
(WebCore::FontPlatformData::FontPlatformData): Ditto.
* platform/graphics/win/FontPlatformDataWin.cpp:
(WebCore::FontPlatformData::FontPlatformData): Ditto.
* platform/graphics/win/GlyphPageTreeNodeCairoWin.cpp:
(WebCore::GlyphPage::fill): Use HWndDC smart pointer instead of bare HDC.
* platform/graphics/win/SimpleFontDataWin.cpp:
(WebCore::SimpleFontData::platformCreateScaledFontData): Use move operation.
* platform/win/DragImageCGWin.cpp:
(WebCore::allocImage): Change to use GDIObject.
(WebCore::scaleDragImage): Use smart pointers to avoid manual deallocs.
(WebCore::createDragImageFromImage): Ditto.
* platform/win/DragImageCairoWin.cpp:
(WebCore::allocImage): Change to use GDIObject.
(WebCore::scaleDragImage): Use smart pointers to avoid manual deallocs.
(WebCore::createDragImageFromImage): Ditto.
* platform/win/DragImageWin.cpp:
(WebCore::createDragImageForLink): Update for GDIObject.
* platform/win/PopupMenuWin.cpp:
(WebCore::PopupMenuWin::PopupMenuWin): Switch to GDIObject.
(WebCore::PopupMenuWin::~PopupMenuWin): Remove uneeded deallocs.
(WebCore::PopupMenuWin::paint): Update for GDIObject.
* platform/win/PopupMenuWin.h: Use smart pointers instead of bare GDI objects.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155557 268f45cc-cd09-0410-ab3c-d52691b4dbfc
MapData and WeakMapData don't need to be objects
https://bugs.webkit.org/show_bug.cgi?id=121167

Patch by Sam Weinig <sam@webkit.org> on 2013-09-11
Reviewed by Geoffrey Garen.

* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::mapStructure):
Remove MapData and WeakMapData structures (they moved to VM with other non-object Structures).

* runtime/JSMap.cpp:
(JSC::JSMap::finishCreation):
* runtime/JSMap.h:
(JSC::JSMap::create):
* runtime/JSSet.cpp:
(JSC::JSSet::finishCreation):
* runtime/JSSet.h:
(JSC::JSSet::create):
* runtime/JSWeakMap.cpp:
(JSC::JSWeakMap::finishCreation):
* runtime/JSWeakMap.h:
(JSC::JSWeakMap::create):
Update to not pass a global object to the MapData or WeakMapData Structure.

* runtime/MapData.cpp:
(JSC::MapData::MapData):
* runtime/MapData.h:
(JSC::MapData::create):
(JSC::MapData::createStructure):
* runtime/WeakMapData.cpp:
(JSC::WeakMapData::WeakMapData):
(JSC::WeakMapData::set): Change to take a VM rather than a CallFrame, as that it all it needs.
* runtime/WeakMapData.h:
(JSC::WeakMapData::create):
(JSC::WeakMapData::createStructure):
Instead of inheriting from JSDestructibleObject, inherit from JSCell and mark self as needing destruction
and having an immortal structure.

* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
Add MapData and WeakMapData Structures.

* runtime/WeakMapPrototype.cpp:
(JSC::protoFuncWeakMapSet):
Pass a VM rather than an ExecState.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155558 268f45cc-cd09-0410-ab3c-d52691b4dbfc
HTMLEntityTable could use char to reduce binary size
https://bugs.webkit.org/show_bug.cgi?id=121176

Reviewed by Anders Carlsson.

Use LChar instead.

* html/parser/HTMLEntityParser.cpp:
(WebCore::HTMLEntityParser::consumeNamedEntity):
* html/parser/HTMLEntityTable.h:
(WebCore::HTMLEntityTableEntry::lastCharacter):
* html/parser/create-html-entity-table:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155559 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Partial Information Leakage in Hash Table implementations (PrivateName)
https://bugs.webkit.org/show_bug.cgi?id=120663

Reviewed by Michael Saboff.

These hashtables mix keys that are hashed on pointers or user controlled
data.  To prevent any potential information leak we mask the keys with
a per table entropy value.

* runtime/MapData.cpp:
(JSC::MapData::MapData):
(JSC::MapData::find):
(JSC::MapData::add):
(JSC::MapData::remove):
* runtime/MapData.h:
* runtime/PropertyMapHashTable.h:
(JSC::PropertyTable::find):
(JSC::PropertyTable::findWithString):
(JSC::PropertyTable::rehash):
* runtime/PropertyTable.cpp:
(JSC::PropertyTable::PropertyTable):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155560 268f45cc-cd09-0410-ab3c-d52691b4dbfc
update-webkit-localizable-strings is at least 5.8x slower than it should be
https://bugs.webkit.org/show_bug.cgi?id=121178

Reviewed by Darin Adler.

* Scripts/extract-localizable-strings: Quickly skip over lines that contain neither " nor /*.
Note that this does not change functionality, because the script already does not understand
the line continuation sequence (backslash followed by a newline).



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155561 268f45cc-cd09-0410-ab3c-d52691b4dbfc