[chromium] Build fix.

Unreviewed build fix. Remove the use of SkMutex from DiscardablePixelRef.

* platform/graphics/chromium/DiscardablePixelRef.cpp:
(WebCore::DiscardablePixelRefAllocator::allocPixelRef):
(WebCore::DiscardablePixelRef::DiscardablePixelRef):
* platform/graphics/chromium/DiscardablePixelRef.h:
(DiscardablePixelRef):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141033 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[v8] Security feature: JavaScript Bindings hardening
https://bugs.webkit.org/show_bug.cgi?id=106608

Source/WebCore: 

The patch adds a check at wrapper creation time to enuse that the
object being wrapped is not already free, to the extent that we know
the information about the type of the object as provided in the IDL.

Patch by Tom Sepez <tsepez@chromium.org> on 2013-01-28
Reviewed by Adam Barth.

Patch is correct if existing tests pass without new crashes.

* bindings/scripts/CodeGeneratorV8.pm:
(GenerateImplementation):
(GenerateToV8Converters):
(GetNativeTypeForConversions):
(GetGnuVTableRefForInterface):
(GetGnuVTableNameForInterface):
(GetGnuMangledNameForInterface):
(GetGnuVTableOffsetForType):
(GetWinVTableRefForInterface):
(GetWinVTableNameForInterface):
(GetWinMangledNameForInterface):
(GetNamespaceForInterface):
(GetImplementationLacksVTableForInterface):
(GetV8SkipVTableValidationForInterface):
Update code generation to add object validity tests under the control
of the ENABLE_BINDING_INTEGRITY option.
        
* Modules/filesystem/DirectoryReader.idl:
* Modules/filesystem/DirectoryReaderSync.idl:
* Modules/filesystem/EntryArray.idl:
* Modules/filesystem/EntryArraySync.idl:
* Modules/filesystem/Metadata.idl:
* Modules/gamepad/Gamepad.idl:
* Modules/gamepad/GamepadList.idl:
* Modules/geolocation/Geoposition.idl:
* Modules/geolocation/PositionError.idl:
* Modules/indexeddb/IDBFactory.idl:
* Modules/indexeddb/IDBIndex.idl:
* Modules/indexeddb/IDBKeyRange.idl:
* Modules/indexeddb/IDBObjectStore.idl:
* Modules/mediastream/RTCStatsElement.idl:
* Modules/mediastream/RTCStatsReport.idl:
* Modules/quota/StorageInfo.idl:
* Modules/speech/SpeechGrammar.idl:
* Modules/speech/SpeechGrammarList.idl:
* Modules/speech/SpeechRecognitionAlternative.idl:
* Modules/speech/SpeechRecognitionResult.idl:
* Modules/speech/SpeechRecognitionResultList.idl:
* Modules/webaudio/AudioBuffer.idl:
* Modules/webaudio/AudioDestinationNode.idl:
* Modules/webaudio/AudioListener.idl:
* Modules/webaudio/AudioSourceNode.idl:
* Modules/webaudio/WaveTable.idl:
* Modules/webdatabase/SQLError.idl:
* Modules/webdatabase/SQLException.idl:
* Modules/webdatabase/SQLResultSet.idl:
* Modules/webdatabase/SQLResultSetRowList.idl:
* Modules/webdatabase/SQLTransaction.idl:
* Modules/webdatabase/SQLTransactionSync.idl:
* bindings/scripts/IDLAttributes.txt:
* css/CSSPrimitiveValue.idl:
* css/CSSRule.idl:
* css/CSSRuleList.idl:
* css/CSSStyleDeclaration.idl:
* css/CSSValue.idl:
* css/CSSValueList.idl:
* css/Counter.idl:
* css/MediaList.idl:
* css/MediaQueryList.idl:
* css/RGBColor.idl:
* css/Rect.idl:
* css/StyleSheetList.idl:
* css/WebKitCSSFilterValue.idl:
* css/WebKitCSSMixFunctionValue.idl:
* css/WebKitCSSTransformValue.idl:
* dom/ClientRect.idl:
* dom/ClientRectList.idl:
* dom/Clipboard.idl:
* dom/DOMCoreException.idl:
* dom/DOMError.idl:
* dom/DOMImplementation.idl:
* dom/DOMNamedFlowCollection.idl:
* dom/DOMStringList.idl:
* dom/DOMStringMap.idl:
* dom/DataTransferItem.idl:
* dom/DataTransferItemList.idl:
* dom/DocumentFragment.idl:
* dom/Element.idl:
* dom/Entity.idl:
* dom/Event.idl:
* dom/EventException.idl:
* dom/MessageChannel.idl:
* dom/MouseEvent.idl:
* dom/MutationObserver.idl:
* dom/MutationRecord.idl:
* dom/NamedNodeMap.idl:
* dom/NodeFilter.idl:
* dom/NodeIterator.idl:
* dom/NodeList.idl:
* dom/Range.idl:
* dom/RangeException.idl:
* dom/Touch.idl:
* dom/TouchList.idl:
* dom/TreeWalker.idl:
* fileapi/FileError.idl:
* fileapi/FileException.idl:
* fileapi/FileList.idl:
* html/DOMFormData.idl:
* html/DOMTokenList.idl:
* html/DOMURL.idl:
* html/HTMLAllCollection.idl:
* html/HTMLCollection.idl:
* html/HTMLDialogElement.idl:
* html/HTMLDivElement.idl:
* html/HTMLDocument.idl:
* html/HTMLElement.idl:
* html/HTMLImageElement.idl:
* html/HTMLInputElement.idl:
* html/HTMLSelectElement.idl:
* html/HTMLSpanElement.idl:
* html/HTMLUnknownElement.idl:
* html/ImageData.idl:
* html/MediaError.idl:
* html/MediaKeyError.idl:
* html/TimeRanges.idl:
* html/ValidityState.idl:
* html/canvas/ArrayBuffer.idl:
* html/canvas/ArrayBufferView.idl:
* html/canvas/CanvasGradient.idl:
* html/canvas/CanvasPattern.idl:
* html/canvas/Float32Array.idl:
* html/canvas/Float64Array.idl:
* html/canvas/Int16Array.idl:
* html/canvas/Int32Array.idl:
* html/canvas/Int8Array.idl:
* html/canvas/Uint16Array.idl:
* html/canvas/Uint32Array.idl:
* html/canvas/Uint8Array.idl:
* html/canvas/Uint8ClampedArray.idl:
* html/canvas/WebGLActiveInfo.idl:
* html/canvas/WebGLShaderPrecisionFormat.idl:
* html/track/TextTrack.idl:
* html/track/TextTrackCue.idl:
* html/track/TextTrackCueList.idl:
* inspector/InjectedScriptHost.idl:
* inspector/InspectorFrontendHost.idl:
* inspector/JavaScriptCallFrame.idl:
* page/Coordinates.idl:
* page/Crypto.idl:
* page/MemoryInfo.idl:
* page/PagePopupController.idl:
* page/PerformanceEntryList.idl:
* page/SpeechInputResult.idl:
* page/SpeechInputResultList.idl:
* page/WebKitPoint.idl:
* svg/SVGAnimatedAngle.idl:
* svg/SVGAnimatedBoolean.idl:
* svg/SVGAnimatedEnumeration.idl:
* svg/SVGAnimatedInteger.idl:
* svg/SVGAnimatedLength.idl:
* svg/SVGAnimatedLengthList.idl:
* svg/SVGAnimatedNumber.idl:
* svg/SVGAnimatedNumberList.idl:
* svg/SVGAnimatedPreserveAspectRatio.idl:
* svg/SVGAnimatedRect.idl:
* svg/SVGAnimatedString.idl:
* svg/SVGAnimatedTransformList.idl:
* svg/SVGColor.idl:
* svg/SVGException.idl:
* svg/SVGPaint.idl:
* svg/SVGPathSeg.idl:
* svg/SVGRenderingIntent.idl:
* svg/SVGUnitTypes.idl:
* svg/SVGZoomAndPan.idl:
* testing/MallocStatistics.idl:
* testing/TypeConversions.idl:
* workers/WorkerLocation.idl:
* xml/DOMParser.idl:
* xml/XMLHttpRequestException.idl:
* xml/XMLSerializer.idl:
* xml/XPathEvaluator.idl:
* xml/XPathException.idl:
* xml/XPathExpression.idl:
* xml/XPathNSResolver.idl:
* xml/XPathResult.idl:
* xml/XSLTProcessor.idl:
Add exceptions to binding integrity checks to IDL.

Source/WebKit/chromium: 

Patch by Tom Sepez <tsepez@chromium.org> on 2013-01-28
Reviewed by Adam Barth.

* features.gypi:
Added ENABLE_BINDING_INTEGRITY option.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141034 268f45cc-cd09-0410-ab3c-d52691b4dbfc
compositing/reflections/become-simple-composited-reflection.html pixel result shows bug
https://bugs.webkit.org/show_bug.cgi?id=107174

Reviewed by Dean Jackson.

When we have a content layer for solid color, we need to update reflection
clones when that color changes.

Tested by the pixel test for compositing/reflections/become-simple-composited-reflection.html.

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::updateContentsColorLayer):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141035 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Avoid doing work at 60fps for tiled layers when not necessary
https://bugs.webkit.org/show_bug.cgi?id=108135

Reviewed by Dean Jackson.

When there were any tiled layers on the page, we would run a CVDisplayLink
to cause GraphicsLayerCA to flush, in order to update tiled layer visible rects.
This is overkill; we should only do this if the tiled layer is affected by
an accelerated animation.

Fix by tracking whether an ancestor has a running animation when committing
GraphicsLayerCAs.

* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::flushCompositingState): Start with an empty CommitState.
(WebCore::GraphicsLayerCA::recursiveCommitChanges): Push CommitState for
each layer, which tracks whether an ancestor has a running transform animation.
(WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers): updateLayerAnimations() renamed.
(WebCore::GraphicsLayerCA::updateAnimations): Renamed from updateLayerAnimations().
(WebCore::GraphicsLayerCA::isRunningTransformAnimation): Look in the map of running
animations for one affecting transform. This list is normally small (one item).
* platform/graphics/ca/GraphicsLayerCA.h:
(WebCore::GraphicsLayerCA::CommitState::CommitState):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141036 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move Mach port handling from WorkQueue to Connection
https://bugs.webkit.org/show_bug.cgi?id=108140

Reviewed by Sam Weinig.

Instead of having WorkQueue know about Mach port sources, just fold that
functionality directly into Connection. This lets us get rid of the generic source
handling from WorkQueue.

* Platform/CoreIPC/Connection.h:
(Connection):
* Platform/CoreIPC/mac/ConnectionMac.cpp:
(CoreIPC::Connection::platformInvalidate):
(CoreIPC::createDataAvailableSource):
(CoreIPC):
(CoreIPC::Connection::open):
(CoreIPC::Connection::initializeDeadNameSource):
* Platform/WorkQueue.h:
(WorkQueue::dispatchQueue):
(WorkQueue):
* Platform/mac/WorkQueueMac.cpp:
(WorkQueue::platformInvalidate):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141037 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Skipping mathml tests because MATHML was disasbled.

Unreviewed. Gardening.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141038 268f45cc-cd09-0410-ab3c-d52691b4dbfc
position:fixed that doesn't render any content should not force compositing
https://bugs.webkit.org/show_bug.cgi?id=108112

Source/WebCore:

Reviewed by Beth Dakin.

It's not uncommon for pages to have position:fixed elements with no content.
When these are behind other elements, they can cause those other elements
to become composited, using lots of backing store memory.

Optimize for the case where the position:fixed element has no rendered
content and no children by not making it composited in that case.

Test: compositing/layer-creation/fixed-position-no-content.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::hasNonEmptyChildRenderers): Moved from RenderLayerBacking.cpp.
(WebCore::hasBoxDecorations): Ditto.
(WebCore::RenderLayer::hasBoxDecorationsOrBackground): Ditto.
(WebCore::RenderLayer::hasVisibleBoxDecorations): Check for visibility:visible, box decorations and
overflow controls.
(WebCore::RenderLayer::isVisuallyNonEmpty): Returns true if this layer has some visible
representation.
* rendering/RenderLayer.h:
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): Need to call updateDescendantDependentFlags()
to ensure that the visibility flags are up to date.
(WebCore::RenderLayerBacking::updateDrawsContent): Call RenderLayer::hasBoxDecorationsOrBackground() now.
(WebCore::RenderLayerBacking::paintsBoxDecorations): Call RenderLayer::hasVisibleBoxDecorations() now.
(WebCore::RenderLayerBacking::paintsChildren): Call RenderLayer::hasNonEmptyChildRenderers().
(WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Whitespace.
(WebCore::RenderLayerBacking::containsPaintedContent): Call RenderLayer::hasBoxDecorationsOrBackground().
(WebCore::RenderLayerBacking::isDirectlyCompositedImage): Ditto.
* rendering/RenderLayerBacking.h:
(RenderLayerBacking):
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::requiresCompositingForPosition): If the layer has no content to paint,
or visible descendant layers, then don't make it composited.

LayoutTests:

Reviewed by Beth Dakin.

Change tests to put a background color on position:fixed elements that need to be composited.
New test with an empty fixed position element.

* compositing/layer-creation/fixed-position-change-out-of-view-in-view.html:
* compositing/layer-creation/fixed-position-no-content-expected.txt: Added.
* compositing/layer-creation/fixed-position-no-content.html: Copied from LayoutTests/compositing/layer-creation/fixed-position-out-of-view.html.
* compositing/layer-creation/fixed-position-out-of-view-scaled-scroll.html:
* compositing/layer-creation/fixed-position-out-of-view-scaled.html:
* compositing/layer-creation/fixed-position-out-of-view.html:
* platform/mac/tiled-drawing/fixed/fixed-position-out-of-view-negative-zindex.html:
* platform/mac/tiled-drawing/fixed/fixed-position-out-of-view.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141039 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[TexMap] Enable debug borders and repaint counter via Settings.
https://bugs.webkit.org/show_bug.cgi?id=107198

Patch by Huang Dongsung <luxtella@company100.net> on 2013-01-28
Reviewed by Benjamin Poulain.

Source/WebKit/efl:

If WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS is set to 1, set
showDebugBorders and showRepaintCounter in Settings to true.

* ewk/ewk_view.cpp:
(_ewk_view_priv_new):

Source/WebKit/gtk:

If WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS is set to 1, set
showDebugBorders and showRepaintCounter in Settings to true.

* webkit/webkitwebview.cpp:
(webkit_web_view_update_settings):

Source/WebKit/qt:

If WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS is set to 1, set
showDebugBorders and showRepaintCounter in Settings to true.

* Api/qwebsettings.cpp:
(QWebSettingsPrivate::apply):

Source/WebKit2:

Currently, if the environment variable WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS
is set to 1, only CoordinatedBacking shows debug borders and repaint counter.

This patch makes the environment variable change Settings.

In addition, Qt uses WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS instead of
QT_WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS from now.

After Bug 105787, all backing stores and platform layers in TextureMapper can
show debug borders and repaint counter.

* UIProcess/API/efl/EwkView.cpp:
(EwkView::EwkView):
* UIProcess/API/gtk/WebKitSettings.cpp:
(webKitSettingsSetProperty):
* UIProcess/API/qt/qquickwebview.cpp:
(QQuickWebViewPrivate::initialize):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141040 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Reduce the region that is spellchecked on keystroke
https://bugs.webkit.org/show_bug.cgi?id=108115

Reviewed by Rob Buis.

PR288217
Instead of blindly checking text until endOfDocument, we should be honoring the boundaries of
the VisibleSelection that is passed into SpellingHandler. Though this results in the same behavior
on focus, this dramatically reduces the region that is rechecked when a key is hit.

Internally reviewed by Mike Fenton.

* WebKitSupport/InputHandler.cpp:
(BlackBerry::WebKit::InputHandler::requestCheckingOfString):
* WebKitSupport/SpellingHandler.cpp:
(BlackBerry::WebKit::SpellingHandler::spellCheckTextBlock):
(BlackBerry::WebKit::SpellingHandler::parseBlockForSpellChecking):
* WebKitSupport/SpellingHandler.h:
(SpellingHandler):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141041 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fix multi-touch-inside-iframes Layout test
https://bugs.webkit.org/show_bug.cgi?id=108113

Patch by Min Qin <qinmin@chromium.org> on 2013-01-28
Reviewed by Adam Barth.

The ordering of OnLoad() of the 2 child iframes is racy.
Fixed by assigning title from the parent frame.

* fast/events/touch/multi-touch-inside-iframes.html:
* fast/events/touch/resources/multi-touch-inside-iframes2.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141042 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Small animated zoom level adjustments are unnecessary
https://bugs.webkit.org/show_bug.cgi?id=108104

Patch by Andrew Lo <anlo@rim.com> on 2013-01-28
Reviewed by Rob Buis.
Internally reviewed by Mike Fenton.

Internal PR 285861.
If the difference between the target scale and current scale is
less than a given threshold, don't perform a zoom animation.

* WebKitSupport/InputHandler.cpp:
(BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141043 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Rebaselining integer-modulo after r141031.

Unreviewed. Gardening.

* platform/chromium/fast/js/regress/integer-modulo-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141044 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add window occlusion criteria to determine page visibility on Mac
https://bugs.webkit.org/show_bug.cgi?id=107494

Patch by Kiran Muppala <cmuppala@apple.com> on 2013-01-28
Reviewed by Simon Fraser.

Source/WebKit2:

* UIProcess/API/mac/PageClientImpl.mm:
(WebKit::PageClientImpl::isViewVisible): Add window occlusion check.
* UIProcess/API/mac/WKView.mm:
(-[WKView dealloc]): Remove self from the all views vector.
(-[WKView addWindowObserversForWindow:]): Register observer for
NSWindowWillOrderOffScreenNotification.
(-[WKView removeWindowObservers]): Unregister observer for
NSWindowWillOrderOffScreenNotification.
(-[WKView viewWillMoveToWindow:]): Disable occlusion notifications.
(-[WKView viewDidMoveToWindow]): Enable occlusion notifications.
(-[WKView _windowWillOrderOffScreen:]): Disable occlusion notifications.
(-[WKView _windowDidOrderOnScreen:]): Enable occlusion notifications.
This notification ensures that occlusion notifications are registered
correctly even if the NSWindow object is assigned a window number after
the viewDidMoveToWindow notification has been received.  This occurs
for instance during application launch.
(-[WKView _setIsWindowOccluded:]):
(-[WKView _enableWindowOcclusionNotifications]):
(-[WKView _disableWindowOcclusionNotifications]):
(windowBecameVisible):
(windowBecameOccluded):
(+[WKView _registerWindowOcclusionNotificationHandlers]):
(+[WKView _unregisterWindowOcclusionNotificationHandlers]):
(+[WKView _allViews]):
(-[WKView _isWindowOccluded]):
(-[WKView initWithFrame:contextRef:pageGroupRef:relatedToPage:]): Add
self to the all views vector.
* UIProcess/API/mac/WKViewInternal.h:

WebKitLibraries:

Add enum constants to specify window occlusion notification type to
notification registration/unregistration methods.  Add typedef for
window ID data passed to the window occlusion notification handler.
Add method to enable occlusion notifications for a particular window.

* WebKitSystemInterface.h: Add
WKOcclusionNotificationTypeWindowBecameVisible,
WKOcclusionNotificationTypeWindowBecameOccluded,
WKWindowID,
WKEnableWindowOcclusionNotifications().

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141045 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: Pass metadata in to IDBOpenDBRequest.onUpgradeNeeded/onSuccess
https://bugs.webkit.org/show_bug.cgi?id=103920

Reviewed by Dimitri Glazkov.

Source/WebCore:

Update IDBCallbacks::onSuccess and IDBCallbacks::onUpgradeNeeded to
pass through a metadata parameter. While there, remove the unused
IDBTransactionBackendInterface parameter to onUpgradeNeeded.

As this is another step in the IDB refactor, I've simplified future cleanup
work by making the WebKit API code still use the old API. This
will make it possible to outright remove code on the chromium side rather
than another three-step checkin.

No new tests, as this is more refactoring.

* Modules/indexeddb/IDBCallbacks.h:
(WebCore::IDBCallbacks::onUpgradeNeeded): new method signature.
(WebCore::IDBCallbacks::onSuccess): new method signature.
* Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
(WebCore::IDBDatabaseBackendImpl::VersionChangeOperation::perform):
(WebCore::IDBDatabaseBackendImpl::processPendingCalls):
(WebCore::IDBDatabaseBackendImpl::openConnection):
* Modules/indexeddb/IDBOpenDBRequest.cpp:
(WebCore::IDBOpenDBRequest::onUpgradeNeeded): use passed-in metadata.
(WebCore::IDBOpenDBRequest::onSuccess): use passed-in metadata.
* Modules/indexeddb/IDBOpenDBRequest.h:
(IDBOpenDBRequest):

Source/WebKit/chromium:

Support the new IDBCallbacks::onSuccess and IDBCallbacks::onUpgradeNeeded
while maintaining chromium compatibility by shimming in the old API
in the WebKit side. Future code will clean this up so that it is just a
pass-through as it was before.

* public/WebIDBCallbacks.h:
(WebKit):
(WebKit::WebIDBCallbacks::onSuccess): new method signature.
(WebKit::WebIDBCallbacks::onUpgradeNeeded): new method signature.
* src/IDBCallbacksProxy.cpp:
(WebKit::IDBCallbacksProxy::onSuccess): call on new method signature proxies through old API.
(WebKit):
(WebKit::IDBCallbacksProxy::onUpgradeNeeded): call on new method signature proxies through old API.
* src/IDBCallbacksProxy.h:
(IDBCallbacksProxy):
* src/WebIDBCallbacksImpl.cpp:
(WebKit::WebIDBCallbacksImpl::onSuccess): call on old WebKit proxy signature calls new API.
(WebKit):
(WebKit::WebIDBCallbacksImpl::onUpgradeNeeded): call on old WebKit proxy signature calls new API.
* src/WebIDBCallbacksImpl.h:
(WebIDBCallbacksImpl):
* tests/IDBAbortOnCorruptTest.cpp: new method signature.
(WebCore::MockIDBCallbacks::onSuccess):
* tests/IDBDatabaseBackendTest.cpp: new method signature.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141049 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Static size inference for JavaScript objects
https://bugs.webkit.org/show_bug.cgi?id=108093

Reviewed by Phil Pizlo.

../JavaScriptCore: 

* API/JSObjectRef.cpp:
* JavaScriptCore.order:
* JavaScriptCore.xcodeproj/project.pbxproj: Pay the tax man.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode): op_new_object and op_create_this now
have an extra inferredInlineCapacity argument. This is the statically
inferred inline capacity, just from analyzing source text. op_new_object
also gets a pointer to an allocation profile. (For op_create_this, the
profile is in the construtor function.)

(JSC::CodeBlock::CodeBlock): Link op_new_object.

(JSC::CodeBlock::stronglyVisitStrongReferences): Mark our profiles.

* bytecode/CodeBlock.h:
(CodeBlock): Removed some dead code. Added object allocation profiles.

* bytecode/Instruction.h:
(JSC): New union type, since an instruction operand may point to an
object allocation profile now.

* bytecode/ObjectAllocationProfile.h: Added.
(JSC):
(ObjectAllocationProfile):
(JSC::ObjectAllocationProfile::offsetOfAllocator):
(JSC::ObjectAllocationProfile::offsetOfStructure):
(JSC::ObjectAllocationProfile::ObjectAllocationProfile):
(JSC::ObjectAllocationProfile::isNull):
(JSC::ObjectAllocationProfile::initialize):
(JSC::ObjectAllocationProfile::structure):
(JSC::ObjectAllocationProfile::inlineCapacity):
(JSC::ObjectAllocationProfile::clear):
(JSC::ObjectAllocationProfile::visitAggregate):
(JSC::ObjectAllocationProfile::possibleDefaultPropertyCount): New class
for tracking a prediction about object allocation: structure, inline
capacity, allocator to use.

* bytecode/Opcode.h:
(JSC):
(JSC::padOpcodeName): Updated instruction sizes.

* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
* bytecode/UnlinkedCodeBlock.h:
(JSC):
(JSC::UnlinkedCodeBlock::addObjectAllocationProfile):
(JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles):
(UnlinkedCodeBlock): Unlinked support for allocation profiles.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::generate): Kill all remaining analyses at the
end of codegen, since this is our last opportunity.

(JSC::BytecodeGenerator::BytecodeGenerator): Added a static property
analyzer to bytecode generation. It tracks initializing assignments and
makes a guess about how many will happen.

(JSC::BytecodeGenerator::newObjectAllocationProfile):
(JSC):
(JSC::BytecodeGenerator::emitProfiledOpcode):
(JSC::BytecodeGenerator::emitMove):
(JSC::BytecodeGenerator::emitResolve):
(JSC::BytecodeGenerator::emitResolveBase):
(JSC::BytecodeGenerator::emitResolveBaseForPut):
(JSC::BytecodeGenerator::emitResolveWithBaseForPut):
(JSC::BytecodeGenerator::emitResolveWithThis):
(JSC::BytecodeGenerator::emitGetById):
(JSC::BytecodeGenerator::emitPutById):
(JSC::BytecodeGenerator::emitDirectPutById):
(JSC::BytecodeGenerator::emitPutGetterSetter):
(JSC::BytecodeGenerator::emitGetArgumentByVal):
(JSC::BytecodeGenerator::emitGetByVal): Added hooks to the static property
analyzer, so it can observe allocations and stores.

(JSC::BytecodeGenerator::emitCreateThis): Factored this into a helper
function because it was a significant amount of logic, and I wanted to
add to it.

(JSC::BytecodeGenerator::emitNewObject):
(JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitCallVarargs):
(JSC::BytecodeGenerator::emitConstruct): Added a hook to profiled opcodes
to track their stores, in case a store kills a profiled allocation. Since
profiled opcodes are basically the only interesting stores we do, this
is a convenient place to notice any store that might kill an allocation.

* bytecompiler/BytecodeGenerator.h:
(BytecodeGenerator): As above.

* bytecompiler/StaticPropertyAnalysis.h: Added.
(JSC):
(StaticPropertyAnalysis):
(JSC::StaticPropertyAnalysis::create):
(JSC::StaticPropertyAnalysis::addPropertyIndex):
(JSC::StaticPropertyAnalysis::record):
(JSC::StaticPropertyAnalysis::propertyIndexCount):
(JSC::StaticPropertyAnalysis::StaticPropertyAnalysis): Simple helper
class for tracking allocations and stores.

* bytecompiler/StaticPropertyAnalyzer.h: Added.
(StaticPropertyAnalyzer):
(JSC::StaticPropertyAnalyzer::StaticPropertyAnalyzer):
(JSC::StaticPropertyAnalyzer::createThis):
(JSC::StaticPropertyAnalyzer::newObject):
(JSC::StaticPropertyAnalyzer::putById):
(JSC::StaticPropertyAnalyzer::mov):
(JSC::StaticPropertyAnalyzer::kill): Helper class for observing allocations
and stores and making an inline capacity guess. The heuristics here are
intentionally minimal because we don't want this one class to try to
re-create something like a DFG or a runtime analysis. If we discover that
we need those kinds of analyses, we should just replace this class with
something else.

This class tracks multiple registers that alias the same object -- that
happens a lot, when moving locals into temporary registers -- but it
doesn't track control flow or multiple objects that alias the same register.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute): Updated for rename.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock): Updated for inline capacity and
allocation profile.

* dfg/DFGNode.h:
(JSC::DFG::Node::hasInlineCapacity):
(Node):
(JSC::DFG::Node::inlineCapacity):
(JSC::DFG::Node::hasFunction): Give the graph a good way to represent
inline capacity for an allocation.

* dfg/DFGNodeType.h:
(DFG): Updated for rename.

* dfg/DFGOperations.cpp: Updated for interface change.

* dfg/DFGOperations.h: We pass the inline capacity to the slow case as
an argument. This is the simplest way, since it's stored as a bytecode operand.

* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate): Updated for rename.

* dfg/DFGRepatch.cpp:
(JSC::DFG::tryCacheGetByID): Fixed a horrible off-by-one-half bug that only
appears when doing an inline cached load for property number 64 on a 32-bit
system. In JSVALUE32_64 land, "offsetRelativeToPatchedStorage" is the
offset of the 64bit JSValue -- but we'll actually issue two loads, one for
the payload at that offset, and one for the tag at that offset + 4. We need
to ensure that both loads have a compact representation, or we'll corrupt
the instruction stream.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
(JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
(SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile): Lots of refactoring to support
passing an allocator to our allocation function, and/or passing a Structure
as a register instead of an immediate.

* heap/MarkedAllocator.h:
(DFG):
(MarkedAllocator):
(JSC::MarkedAllocator::offsetOfFreeListHead): Added an accessor to simplify
JIT code generation of allocation from an arbitrary allocator.

* jit/JIT.h:
(JSC):
* jit/JITInlines.h:
(JSC):
(JSC::JIT::emitAllocateJSObject):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_create_this):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_create_this): Same refactoring as done for the DFG.

* jit/JITStubs.cpp:
(JSC::tryCacheGetByID): Fixed the same bug mentioned above.

(JSC::DEFINE_STUB_FUNCTION): Updated for interface changes.

* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions): Updated for interface changes.

* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm: Same refactoring as for the JITs.

* profiler/ProfilerBytecode.cpp:
* profiler/ProfilerBytecodes.cpp:
* profiler/ProfilerCompilation.cpp:
* profiler/ProfilerCompiledBytecode.cpp:
* profiler/ProfilerDatabase.cpp:
* profiler/ProfilerOSRExit.cpp:
* profiler/ProfilerOrigin.cpp:
* profiler/ProfilerProfiledBytecodes.cpp: Include ObjectConstructor.h
because that's where createEmptyObject() lives now.

* runtime/Executable.h:
(JSC::JSFunction::JSFunction): Updated for rename.

* runtime/JSCellInlines.h:
(JSC::allocateCell): Updated to match the allocator selection code in
the JIT, so it's clearer that both are correct.

* runtime/JSFunction.cpp:
(JSC::JSFunction::JSFunction):
(JSC::JSFunction::createAllocationProfile):
(JSC::JSFunction::visitChildren):
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):
(JSC::JSFunction::getConstructData):
* runtime/JSFunction.h:
(JSC::JSFunction::offsetOfScopeChain):
(JSC::JSFunction::offsetOfExecutable):
(JSC::JSFunction::offsetOfAllocationProfile):
(JSC::JSFunction::allocationProfile):
(JSFunction):
(JSC::JSFunction::tryGetAllocationProfile):
(JSC::JSFunction::addAllocationProfileWatchpoint): Changed inheritorID
data member to be an ObjectAllocationProfile, which includes a pointer
to the desired allocator. This simplifies JIT code, since we don't have
to compute the allocator on the fly. I verified by code inspection that
JSFunction is still only 64 bytes.

* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSGlobalObject):
(JSC::JSGlobalObject::dateStructure): No direct pointer to the empty
object structure anymore, because now clients need to specify how much
inline capacity they want.

* runtime/JSONObject.cpp:
* runtime/JSObject.h:
(JSC):
(JSFinalObject):
(JSC::JSFinalObject::defaultInlineCapacity):
(JSC::JSFinalObject::maxInlineCapacity):
(JSC::JSFinalObject::createStructure): A little refactoring to try to 
clarify where some of these constants derive from.

(JSC::maxOffsetRelativeToPatchedStorage): Used for bug fix, above.

* runtime/JSProxy.cpp:
(JSC::JSProxy::setTarget): Ugly, but effective.

* runtime/LiteralParser.cpp:
* runtime/ObjectConstructor.cpp:
(JSC::constructObject):
(JSC::constructWithObjectConstructor):
(JSC::callObjectConstructor):
(JSC::objectConstructorCreate): Updated for interface changes.

* runtime/ObjectConstructor.h:
(JSC::constructEmptyObject): Clarified your options for how to allocate
an empty object, to emphasize what things can actually vary.

* runtime/PropertyOffset.h: These constants have moved because they're
really higher level concepts to do with the layout of objects and the
collector. PropertyOffset is just an abstract number line, independent
of those things.

* runtime/PrototypeMap.cpp:
(JSC::PrototypeMap::emptyObjectStructureForPrototype):
(JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
* runtime/PrototypeMap.h:
(PrototypeMap): The map key is now a pair of prototype and inline capacity,
since Structure encodes inline capacity.

* runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::copyPropertyTableForPinning):
* runtime/Structure.h:
(Structure):
(JSC::Structure::totalStorageSize):
(JSC::Structure::transitionCount):
(JSC::Structure::create): Fixed a nasty refactoring bug that only shows
up after enabling variable-sized inline capacities: we were passing our
type info where our inline capacity was expected. The compiler didn't
notice because both have type int :(.

../WebCore: 

* ForwardingHeaders/runtime/ObjectConstructor.h: Added.

* bindings/js/JSInjectedScriptHostCustom.cpp:
* bindings/js/JSSQLResultSetRowListCustom.cpp: Include ObjectConstructor.h because
that's where createEmptyObject() is located now.

* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::deserialize): Updated for interface change.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141050 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Plug-ins should initialize their sandbox at creation time
https://bugs.webkit.org/show_bug.cgi?id=108098

Reviewed by Anders Carlsson.

Add the ability to add string key/value pairs to process creation parameters
to allow the plugin process to get passed the plugin path which in turn allows
the plugin to initialize its sandbox at the correct time.

* NetworkProcess/EntryPoint/mac/XPCService/NetworkService.Development/NetworkServiceMain.Development.mm:
* NetworkProcess/EntryPoint/mac/XPCService/NetworkService/NetworkServiceMain.mm:
* NetworkProcess/EntryPoint/mac/XPCService/NetworkServiceEntryPoint.mm:
(NetworkServiceInitializer):
* PluginProcess/EntryPoint/mac/LegacyProcess/PluginProcessMain.mm:
(WebKit::PluginProcessMainDelegate::getExtraData):
(PluginProcessMainDelegate):
* PluginProcess/EntryPoint/mac/XPCService/PluginService.32/PluginService.32.Main.mm:
* PluginProcess/EntryPoint/mac/XPCService/PluginService.64/PluginService.64.Main.mm:
* PluginProcess/EntryPoint/mac/XPCService/PluginService.Development/PluginService.Development.Main.mm:
* PluginProcess/EntryPoint/mac/XPCService/PluginServiceEntryPoint.mm:
(WebKit):
(PluginServiceInitializerDelegate):
(WebKit::PluginServiceInitializerDelegate::PluginServiceInitializerDelegate):
(WebKit::PluginServiceInitializerDelegate::getExtraData):
(PluginServiceInitializer):
* PluginProcess/PluginProcess.cpp:
(WebKit::PluginProcess::initializeProcess):
(WebKit::PluginProcess::initializePluginProcess):
(WebKit::PluginProcess::initializeProcessName):
(WebKit::PluginProcess::initializeSandbox):
* PluginProcess/PluginProcess.h:
* PluginProcess/mac/PluginProcessMac.mm:
(WebKit::PluginProcess::platformInitializePluginProcess):
(WebKit::PluginProcess::platformInitializeProcess):
(WebKit::PluginProcess::initializeProcessName):
(WebKit::PluginProcess::initializeSandbox):
* Shared/ChildProcess.h:
(ChildProcessInitializationParameters):
* Shared/EntryPointUtilities/mac/LegacyProcess/ChildProcessMain.h:
(ChildProcessMainDelegate):
(WebKit::ChildProcessMain):
* Shared/EntryPointUtilities/mac/LegacyProcess/ChildProcessMain.mm:
(WebKit::ChildProcessMainDelegate::getExtraData):
* Shared/EntryPointUtilities/mac/XPCService/XPCServiceBootstrapper.Development.h:
(WebKit::XPCServiceEventHandler):
* Shared/EntryPointUtilities/mac/XPCService/XPCServiceBootstrapper.h:
(WebKit::XPCServiceEventHandler):
* Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h: Added.
(XPCServiceInitializerDelegate):
(WebKit::XPCServiceInitializerDelegate::XPCServiceInitializerDelegate):
(WebKit::XPCServiceInitializer):
* Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm: Added.
(WebKit::XPCServiceInitializerDelegate::~XPCServiceInitializerDelegate):
(WebKit::XPCServiceInitializerDelegate::getConnectionIdentifier):
(WebKit::XPCServiceInitializerDelegate::getClientIdentifier):
(WebKit::XPCServiceInitializerDelegate::getClientProcessName):
(WebKit::XPCServiceInitializerDelegate::getExtraData):
* Shared/Plugins/PluginProcessCreationParameters.cpp:
(WebKit::PluginProcessCreationParameters::encode):
(WebKit::PluginProcessCreationParameters::decode):
* Shared/Plugins/PluginProcessCreationParameters.h:
(PluginProcessCreationParameters):
* UIProcess/Launcher/ProcessLauncher.h:
(LaunchOptions):
* UIProcess/Launcher/mac/ProcessLauncherMac.mm:
(WebKit::connectToService):
(WebKit::connectToReExecService):
(WebKit::createService):
(WebKit::createProcess):
(WebKit::ProcessLauncher::launchProcess):
* UIProcess/Plugins/PluginProcessProxy.cpp:
(WebKit::PluginProcessProxy::didFinishLaunching):
* UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
(WebKit::PluginProcessProxy::platformInitializeLaunchOptions):
(WebKit::PluginProcessProxy::platformInitializePluginProcess):
* WebKit2.xcodeproj/project.pbxproj:
* WebProcess/EntryPoint/mac/XPCService/WebContentService.Development/WebContentServiceMain.Development.mm:
* WebProcess/EntryPoint/mac/XPCService/WebContentService/WebContentServiceMain.mm:
* WebProcess/EntryPoint/mac/XPCService/WebContentServiceEntryPoint.mm:
(WebContentServiceInitializer):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141051 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Disable default use of the Plug-in XPCService until we can
figure out how to deal with the 32-bit one.

* UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
(WebKit::shouldUseXPC):
(WebKit::PluginProcessProxy::platformInitializeLaunchOptions):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141052 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make page scale shrink FrameView in applyPageScaleInCompositor mode
https://bugs.webkit.org/show_bug.cgi?id=107424

Reviewed by Levi Weintraub.

If applyPageScaleFactorInCompositor is enabled (Chromium-only setting),
instead of the entire document expanding as the user pinch zooms, the
viewport shrinks instead. This patch applies the pageScaleFactor to
visibleContentRect to get this behavior, and simplifies Chromium's
resize logic to stop hiding the true viewport size from WebCore.

I verified that the scaling makes sense for all the callers of
visibleContentRect. The exceptions are clip-layer size,
layout size in non-fixed-layout mode, and text autosizing, which need
the original unscaled size. Therefore I added a new method
unscaledVisibleContentSize() to ScrollView/FrameView.

This patch also modifies Page::setPageScaleFactor to perform no
invalidates or layout when applyPageScaleFactorInCompositor is true,
and also writes pageScaleFactor into HistoryItems instead of using
frameScaleFactor.

Since all behavior changes are tied to applyPageScaleFactorInCompositor,
this patch should be a no-op for non-Chromium ports.

Source/Platform:

* chromium/public/WebLayerTreeView.h:
(WebLayerTreeView):
(WebKit::WebLayerTreeView::adjustEventPointForPinchZoom):

Source/WebCore:

New unit tests in WebFrameTest.cpp.

* loader/HistoryController.cpp:
(WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
Use pageScaleFactor here because frameScaleFactor always returns 1
with our setting.
* page/FrameView.cpp:
(WebCore::FrameView::visibleContentScaleFactor):
(WebCore):
* page/FrameView.h:
(FrameView):
* page/Page.cpp:
(WebCore::Page::setPageScaleFactor): Make setPageScaleFactor stop
invalidating/layouting as this is handled by our compositor.
* platform/ScrollView.cpp:
(WebCore::ScrollView::unscaledVisibleContentSize): This new method
just returns the original visible rect without pageScaleFactor being
applied.
(WebCore):
(WebCore::ScrollView::visibleContentRect): This now is divided by
pageScaleFactor if our setting is active.
(WebCore::ScrollView::layoutSize):
* platform/ScrollView.h:
(WebCore::ScrollView::visibleContentScaleFactor): Returns
pageScaleFactor if the visible rect is scaled, 1 normally.
(ScrollView):
(WebCore::ScrollView::layoutWidth):
(WebCore::ScrollView::layoutHeight):
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::frameViewDidChangeSize):
(WebCore::RenderLayerCompositor::updateRootLayerPosition): Clip layer
should use unscaled size, because it's above the root scroll layer
on the layer tree (i.e. page scale isn't applied on it).
* rendering/TextAutosizer.cpp:
(WebCore::TextAutosizer::processSubtree): Text autosizer should use
unscaled size, because it cares about physical screen size.

Source/WebKit/chromium:

* src/WebViewImpl.cpp:
(WebKit::WebViewImpl::scaledSize): Returns the post page-scale size
similar to what visibleContentRect() now returns, except that it may
be at a different scale than the current one.
(WebKit::WebViewImpl::size): Back to returning density-independent
size without any tricks, not the "layoutSize()" fake viewport.
(WebKit::WebViewImpl::resize):
(WebKit::WebViewImpl::handleInputEvent): No need to apply
implTransform anymore as WebKit knows the true scroll offset; just
divide event coords by pageScaleFactor.
(WebKit::WebViewImpl::clampOffsetAtScale): Make this method support
applyPageScaleFactorInCompositor.  This is used to pre-clamp scroll
offsets at a given viewport size.
(WebKit::WebViewImpl::setPageScaleFactorPreservingScrollOffset): Make
this method support applyPageScaleFactorInCompositor (don't scale
scroll offsets as they are now scale-independent).
(WebKit::WebViewImpl::setPageScaleFactor): Make this method always use
clampOffsetAtScale instead of bypassing it, since it's now supported.
Also notify the compositor to update its state.
(WebKit::WebViewImpl::contentsSize): Convenience method, removed
difference between scaled and unscaled.
(WebKit::WebViewImpl::layoutSize): This method returned the "fake"
size we used to give FrameView.  Now no longer used for much.
(WebKit::WebViewImpl::computePageScaleFactorLimits):
(WebKit::WebViewImpl::didChangeContentsSize): Remove unnecessary
resize() now that we can give the true size to FrameView.
(WebKit::WebViewImpl::updateLayerTreeViewport): Use layoutSize()
directly now that FrameView no longer uses it.
* src/WebViewImpl.h:
(WebViewImpl):
* tests/WebFrameTest.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141053 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Shadow] Gesture event is not fired in ShadowDOM
https://bugs.webkit.org/show_bug.cgi?id=107797

Reviewed by Dimitri Glazkov.

Source/WebCore:

Gesture event (e.g. touchstart) is not fired in ShadowDOM.

We have to run event retargetting algorithm to retarget touchTarget, however it is not implemented yet (Bug 107800).
Until it's implemented, we use the shadow ancestor node of touchTarget in Document treescope as touchTarget
for backward compatibility. If a touch event is fired in nested ShadowDOM, touchTarget will be always element in
document tree, so an event listener in ShadowDOM will get a wrong touchTarget. However we prioritized
the correctness of document tree.

Test: fast/dom/shadow/touch-event.html

* page/EventHandler.cpp:
(WebCore::EventHandler::handleTouchEvent): Allows us to take elements in ShadowDOM.

LayoutTests:

* fast/dom/shadow/touch-event-expected.txt: Added.
* fast/dom/shadow/touch-event.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141054 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Expose isRadioButton and isCheckbox API in chromium-webkit glue layer.
https://bugs.webkit.org/show_bug.cgi?id=108031

Patch by Raman Kumar <ramankk@chromium.org> on 2013-01-28
Reviewed by Adam Barth.

In chromium, to know if an InputElement is radiobutton or a checkbox,
we are checking for formControlType (a string comparision), which is
very slow. Exposing these API to chromium will make them faster.

* public/WebInputElement.h:
(WebInputElement):
* src/WebInputElement.cpp:
(WebKit::WebInputElement::isRadioButton):
(WebKit):
(WebKit::WebInputElement::isCheckbox):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141055 268f45cc-cd09-0410-ab3c-d52691b4dbfc