Source/WebCore: Floats should not overhang from flex items
https://bugs.webkit.org/show_bug.cgi?id=115925

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-05-13
Reviewed by David Hyatt.

Allowing floats to overhand from flex items is not only against the
spec, it causes bad bugs. Fix this by having flex items properly avoid
floats.

Test: fast/block/float/float-not-removed-crash2.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::avoidsFloats): Add flex items to avoid floats.
* rendering/RenderBox.h:
(WebCore::RenderBox::isFlexItemIncludingDeprecated): Determine if the current box is a
    flex item or deprecated flex item.

LayoutTests: Fix the float logic to not return an anonymous block ancestor
https://bugs.webkit.org/show_bug.cgi?id=115925

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-05-13
Reviewed by David Hyatt.

Cleaned up fuzzer test. Note that this will only crash when run under
a memory checker like ASAN.

* fast/block/float/float-not-removed-crash2-expected.txt: Added.
* fast/block/float/float-not-removed-crash2.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150029 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2] Crash in WebKit::StorageAreaMap::didSetItem()
https://bugs.webkit.org/show_bug.cgi?id=116026

Reviewed by Andreas Kling.

Make sure that we ignore any leftover messages from the UI process after we've reset
the storage map. Achieve this by keeping a seed count in the StorageAreaMap object that's incremented
everytime the map is reset. Associate every storage area change with the seed and ignore any incoming
notification messages from the UI process if the seeds are different.

* Platform/CoreIPC/HandleMessage.h:
(CoreIPC):
(CoreIPC::callMemberFunction):
* UIProcess/Storage/StorageManager.cpp:
(WebKit::StorageManager::getValues):
(WebKit::StorageManager::setItem):
(WebKit::StorageManager::removeItem):
(WebKit::StorageManager::clear):
* UIProcess/Storage/StorageManager.h:
(StorageManager):
* UIProcess/Storage/StorageManager.messages.in:
* WebProcess/Storage/StorageAreaMap.cpp:
(WebKit::StorageAreaMap::StorageAreaMap):
(WebKit::StorageAreaMap::setItem):
(WebKit::StorageAreaMap::removeItem):
(WebKit::StorageAreaMap::clear):
(WebKit::StorageAreaMap::resetValues):
(WebKit::StorageAreaMap::loadValuesIfNeeded):
(WebKit::StorageAreaMap::didGetValues):
(WebKit::StorageAreaMap::didSetItem):
(WebKit::StorageAreaMap::didRemoveItem):
(WebKit::StorageAreaMap::didClear):
(WebKit::StorageAreaMap::applyChange):
* WebProcess/Storage/StorageAreaMap.h:
(StorageAreaMap):
* WebProcess/Storage/StorageAreaMap.messages.in:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150030 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r150022.
http://trac.webkit.org/changeset/150022
https://bugs.webkit.org/show_bug.cgi?id=114044

Causes assertions in media tests

Source/WebCore:

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
(WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
(WebCore::MediaPlayerPrivateGStreamer::prepareToPlay):
(WebCore::MediaPlayerPrivateGStreamer::currentTime):
(WebCore::MediaPlayerPrivateGStreamer::seek):
(WebCore::MediaPlayerPrivateGStreamer::handleMessage):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
(MediaPlayerPrivateGStreamer):

LayoutTests:

* media/video-seek-after-end-expected.txt: Removed.
* media/video-seek-after-end.html: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150031 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Exclusions] Simple shape-outside tests fail when subpixel layout is disabled
https://bugs.webkit.org/show_bug.cgi?id=115767

Reviewed by Dirk Schulze.

The overall goal of this change was to restore the (last) four excluded exclusions ref-tests
by making them work correctly when subpixel layout is disabled. All of the tests were
substantially simplified, as was the supporting javascript code. The original
shape-outside-floats-simple-rounded-rectangle test was replaced by three separate tests
because the original was bigger then then the 800x600 limit and because it unncessarily
combined three indepedent test cases.

* fast/exclusions/resources/rounded-rectangle.js:
(ellipseXIntercept): Return the 1st quadrant X intercept for an ellipse given a first quadrant Y intercept.
(scanConvertRoundedRectangleOutside): Return the line segment intervals that overlap a rounded rectangle.
(genLeftRightRoundedRectFloatShapeOutsideRefTest): Insert a stack of float divs that match the left or right edge of a rounded rectangle.
* fast/exclusions/shape-outside-floats/shape-outside-floats-non-zero-y-expected.html:
* fast/exclusions/shape-outside-floats/shape-outside-floats-non-zero-y.html:
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-circle-expected.html:
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-circle.html:
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-ellipse-expected.html:
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-ellipse.html:
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle-001-expected.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle-001.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle-002-expected.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle-002.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle-003-expected.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle-003.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle-expected.html: Removed.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle.html: Removed.
* platform/mac/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150032 268f45cc-cd09-0410-ab3c-d52691b4dbfc