FormAssociatedElement shouldn't create out-of-tree FormAttributeTargetObserver
https://bugs.webkit.org/show_bug.cgi?id=119309

Reviewed by Kent Tamura.

Merge https://chromium.googlesource.com/chromium/blink/+/6fbdcbf311de539107bc28711b3f7a527176e97b.

I'm not merging the test since the attached test case only works when the shadow DOM API is enabled.

* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::formAttributeChanged):
(WebCore::FormAssociatedElement::resetFormAttributeTargetObserver):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153632 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Forms: color] <input type='color'> popover color well implementation
<rdar://problem/14411008> and https://bugs.webkit.org/show_bug.cgi?id=119356

Patch by Ruth Fong <ruth_fong@apple.com> on 2013-08-01
Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

* Configurations/FeatureDefines.xcconfig: Added and enabled INPUT_TYPE_COLOR_POPOVER.

Source/WebCore:

* Configurations/FeatureDefines.xcconfig: Added and enabled INPUT_TYPE_COLOR_POPOVER.

Source/WebKit/mac:

* Configurations/FeatureDefines.xcconfig: Added and enabled INPUT_TYPE_COLOR_POPOVER.

Source/WebKit2:

This patch adds an popover implementation of <input type='color'>.

* Configurations/FeatureDefines.xcconfig: Added and enabled INPUT_TYPE_COLOR_POPOVER.

* UIProcess/API/mac/PageClientImpl.mm:
(WebKit::PageClientImpl::createColorPicker): Updated to pass the
  coordinates of the <input type='color'> element and the WKView
  object for the window.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::viewWillStartLiveResize): Close popover color
  picker when the view is resized.
(WebKit::WebPageProxy::viewInWindowStateDidChange): Close popover color
  picker when the view is no longer in the window.
(WebKit::WebPageProxy::showColorPicker): Updated to show either a color panel
  or a popover color picker depending on whether INPUT_TYPE_COLOR_POPOVER is enabled.

* UIProcess/mac/WebColorPickerMac.h:
* UIProcess/mac/WebColorPickerMac.mm:
(WebKit::WebColorPickerMac::create):
(WebKit::WebColorPickerMac::~WebColorPickerMac):
(WebKit::WebColorPickerMac::WebColorPickerMac):
(WebKit::WebColorPickerMac::endPicker):
(WebKit::WebColorPickerMac::setSelectedColor):
(WebKit::WebColorPickerMac::showColorPicker):
Methods updated to handle both the color panel implementation and
  the popover implementation; also renamed m_panel to m_colorPickerUI.

(-[WKColorPopoverMac initWithFrame:WebCore::inView:]):
(-[WKColorPopoverMac setAndShowPicker:WebKit::withColor:]):
(-[WKColorPopoverMac dealloc]):
(-[WKColorPopoverMac invalidate]):
(-[WKColorPopoverMac windowWillClose:]):
(-[WKColorPopoverMac didChooseColor:]):
(-[WKColorPopoverMac setColor:]):
WKColorPopoverMac provides the popover implementation of <input type='color'>.

(-[WKColorPanelMac didChooseColor:]): Updated to match the interface of
  WKColorPickerMac::didChooseColor.

Source/WTF:

* wtf/FeatureDefines.h: Added and enabled INPUT_TYPE_COLOR_POPOVER.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153633 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r153608.
http://trac.webkit.org/changeset/153608
https://bugs.webkit.org/show_bug.cgi?id=119425

Snorkled fast/multicol/overflow-content-expected.html
(Requested by kling on #webkit).

Source/WebCore:

* css/StyleResolver.cpp:
(WebCore::StyleResolver::applyMatchedProperties):

LayoutTests:

* fast/css/identical-logical-height-decl-expected.html: Removed.
* fast/css/identical-logical-height-decl.html: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153634 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/14528244> False-positive leaks from FastMalloc.

A logic error in the page map enumeration code within FastMalloc could result in a subset of the memory regions
owned by FastMalloc being skipped by the malloc zone enumeration code used by leaks and other performance tools.
If the only reference to an allocated object lived within one of the skipped memory regions, leaks would believe
it had been leaked since it would not find any references to the object.

The logic error manifested when a FastMalloc span owned a region of memory that crossed a 16MB address space boundary,
and when there was one or more other spans immediately after it in the address space. Crossing the 16MB address space
boundary means that the start and end points of the span are in different leaf nodes of the page map trie, and the
code within the page map's visitValues method didn't correctly account this case when skipping to the end of the span
after visiting it. It would resume iterating from the start of the next leaf node rather than continuing to skip values
until the end of the span was passed. The value representing the end of the span would then be processed as if it were
the start of a new span, and more values would be skipped even though they may contain actual spans.

The solution is to rework the algorithm used in visitValues so that it will skip the correct number of values even when
some of the values are in different leaf nodes. This is a more involved change than it may seem since it's also necessary
to deal with the case where a memory region spans two separate root nodes, which can happen if the region happens to cross
a 64GB boundary in the address space.

Reviewed by Geoff Garen.

* wtf/TCPageMap.h:
(TCMalloc_PageMap3::visitValues): Use a single loop to iterate, with the loop index being the key in to the page map in the
same form as used by get and set. This allows us to correctly deal with the index being skipped to a different intermediate or
root node as a result of visiting a span that crosses a 16MB boundary in memory.
(TCMalloc_PageMap2::visitValues): Ditto, but without having to deal with intermediate nodes.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153635 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/14235491> FastMalloc zone enumerator responding to MALLOC_PTR_REGION_RANGE_TYPE with individual allocations

Teach PageMapMemoryUsageRecorder::recordPendingRegions to only record data of the type that it's asked for.
This also fixes the vmmap output to associate some regions with the FastMalloc malloc zone that were previously
associated with it only via the VM tag, meaning they were incorrectly being omitted from the malloc statistics
section of the report.

Reviewed by Dan Bernstein.

* wtf/FastMalloc.cpp:
(WTF::PageMapMemoryUsageRecorder::recordPendingRegions): Report the individual allocations only when requested. Add
the ability to report the regions containing pointers separately from the allocations.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153636 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<http://webkit.org/b/119169> RetainPtr should support ARC for Objective-C objects.

While RetainPtr is not necessary under ARC, having it available makes it easier to transition
existing code from manual retain / release to ARC.

Under ARC, the object member of RetainPtr is treated as a strong reference by the compiler.
This means that merely assigning to the member variable is sufficient to retain the object,
and clearing the member variable is sufficient to release it. We still need to explicitly
CFRetain / CFRelease CoreFoundation types so the explicit calls to these functions are
moved in to helper functions and overloading is used to have the Objective-C object versions
of them be no-ops under ARC.

Reviewed by Anders Carlsson.

* wtf/RetainPtr.h:
(WTF::retain): Continue to always CFRetain / CFRelease CoreFoundation objects. Only CFRetain / CFRelease
Objective-C objects when using manual retain / release.
(WTF::release): Ditto.
(WTF::adoptNSReference): Adopting references will be handled automatically by the compiler
when possible under ARC by eliminating redundant retain / release pairs.
(WTF::RetainPtr::ImplicitConversionToBoolIsNotAllowed): A new method that exists only to be used by the
conversion to the unspecified bool type.
(WTF::RetainPtr::operator UnspecifiedBoolType): Switch to using a pointer to a member function as the
unspecified bool type to avoid warnings from the compiler when casting Objective-C object types under ARC.

(WTF::RetainPtr::RetainPtr): Switch to our retain / release helper functions.
(WTF::RetainPtr::~RetainPtr): Ditto.
(WTF::::RetainPtr): Ditto.
(WTF::::clear): Ditto.
(WTF::=): Ditto.
(WTF::adoptCF): Annotate the argument with CF_RELEASES_ARGUMENT on both the declaration and the definition.
(WTF::adoptNS): Ditto for NS_RELEASES_ARGUMENT.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153637 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Check WTF::Vector size with '0' inline capacity
https://bugs.webkit.org/show_bug.cgi?id=119397

Reviewed by Andreas Kling.

Putting in place the compile assertion that had been removed with r153514.

* wtf/SizeLimits.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153638 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add --rmdir option to git svn dcommit
https://bugs.webkit.org/show_bug.cgi?id=119398

Reviewed by Ryosuke Niwa.

Add this option tells git-svn to remove empty directories
from the svn tree so they do not leave over there.

* Scripts/webkitpy/common/checkout/scm/git.py:
(Git.push_local_commits_to_server):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153639 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Frame flattening: Change the logic on whether resize event needs to be dispatched.
https://bugs.webkit.org/show_bug.cgi?id=119394

Reviewed by Simon Fraser.

http://trac.webkit.org/changeset/149287 changed the logic so that resize events are
sent out from FrameView::setFrameRect() too. Checking whether frame flattening is
enabled is sufficient enough to ensure that no extra resize events are dispatched.

Source/WebCore:

Test: fast/frames/flattening/iframe-flattening-resize-event-count.html

* page/FrameView.cpp:
(WebCore::FrameView::FrameView):
(WebCore::FrameView::setFrameRect):
(WebCore::FrameView::frameFlatteningEnabled):
(WebCore::FrameView::supportsFrameFlattening):
(WebCore::FrameView::avoidScrollbarCreation):
(WebCore::FrameView::calculateScrollbarModesForLayout):
(WebCore::FrameView::layout):
(WebCore::FrameView::isInChildFrameWithFrameFlattening):
* page/FrameView.h:
* rendering/RenderFrameBase.cpp:
(WebCore::RenderFrameBase::layoutWithFlattening):

LayoutTests:

* fast/frames/flattening/iframe-flattening-resize-event-count-expected.txt: Added.
* fast/frames/flattening/iframe-flattening-resize-event-count.html: Added.
* fast/frames/flattening/resources/iframe-to-resize.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153640 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Removing an empty style sheet shouldn't trigger style recalc.
<http://webkit.org/b/119248>
<rdar://problem/14629045>

Reviewed by Antti Koivisto.

Teach DocumentStyleSheetCollection to filter out empty style sheets when deciding whether
or not to trigger a style recalc. We can then be clever when an empty style sheet is removed
from the document, and avoid causing extra work.

Some pages use this pattern:

    (1) Create a <style> element.
    (2) Add it to the document's <head> element.
    (3) Insert some CSS as a text child of the <style> element.

Since the <style> element is already inside the document at (3), we had to treat this as an
old style sheet being removed, even though it was just an empty sheet of nothing.

With this patch, Document gains enough smarts to know that removing/adding an empty sheet
won't affect layout/rendering in any meaningful way, thus a style recalc can be avoided.

* dom/Document.h:
* dom/Document.cpp:
(WebCore::Document::styleResolverChanged):

    Add a DeferRecalcStyleIfNeeded mode to styleResolverChanged().

* css/CSSStyleSheet.h:
* css/CSSStyleSheet.cpp:
(WebCore::CSSStyleSheet::clearOwnerNode):

    Use DeferRecalcStyleIfNeeded when saying bye from a CSSStyleSheet and let Document decide
    if removing the sheet should trigger style recalc instead of always assuming it should.

* dom/DocumentStyleSheetCollection.cpp:
(WebCore::filterEnabledNonemptyCSSStyleSheets):
(WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):

    Exclude empty sheets from the activeAuthorStyleSheets() collection. They are still
    visible through CSSOM's document.styleSheets.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153641 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Correct bugzilla link in my last commit.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153642 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove redundant call of argsList->current() from loops in CSSParser.
https://bugs.webkit.org/show_bug.cgi?id=119432

Reviewed by Christophe Dumez.

while loops in CSSParser call argList->current() function at the start
of each iteration, but this is redundant because argsList->next() at
the end of the iteration calls the argList->current() and returns the
result.

Blink merge from https://src.chromium.org/viewvc/blink?view=rev&revision=155402

* css/CSSParser.cpp:
(WebCore::CSSParser::parseMixFunction):
(WebCore::CSSParser::parseCustomFilterFunctionWithInlineSyntax):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153643 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add JSCTestRunnerUtils to the list of forwarding headers to fix build.

* CMakeLists.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153644 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WIN] Fix build without precompiled header.

* accessibility/win/AccessibilityObjectWrapperWin.h: Added missing include.
* rendering/RenderThemeWin.cpp: Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153645 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r153612): It made jsc and layout tests crash
https://bugs.webkit.org/show_bug.cgi?id=119440

Reviewed by Csaba Osztrogonác.

Made the changes if changeset r153612 only apply to 32 bit builds.

* jit/JITExceptions.cpp:
* jit/JITExceptions.h:
* jit/JITStubs.cpp:
(JSC::cti_vm_throw_slowpath):
* jit/JITStubs.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153646 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<input type="search"> doesn't correctly handle the "size" attribute
https://bugs.webkit.org/show_bug.cgi?id=119174

Source/WebCore:

We weren't taking into account the decorations for search fields (results and close buttons)
when computing the preferred logical width for these fields based on the "size" attribute
and as a result we would not guarantee that we could show the number of characters set by
the "size" attribute.

To make the process of reporting extra width due to decorations cleaner, we add a new decorationWidth()
method for InputType subclasses to override and called through HTMLInputElement::decorationWidth()
and have NumberInputType and SearchInputType return custom decoration widths.

Reviewed by Darin Adler.

Test: fast/forms/search/search-size-with-decorations.html

* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::decorationWidth):
* html/HTMLInputElement.h:
* html/InputType.cpp:
(WebCore::InputType::decorationWidth):
* html/InputType.h:
Expose a new method to get the width for the input's decoration through the InputType.

* html/NumberInputType.cpp:
(WebCore::NumberInputType::decorationWidth):
* html/NumberInputType.h:
Override InputType::decorationWidth() to return the decoration width for a number input
using the same code previously used in RenderTextControlSingleLine::preferredContentLogicalWidth().

* html/SearchInputType.cpp:
(WebCore::SearchInputType::sizeShouldIncludeDecoration):
Override InputType::sizeShouldIncludeDecoration() to return true since search fields
have custom decoration adding to the size of the field.

(WebCore::SearchInputType::decorationWidth):
Return the combined size of the results and cancel buttons, as available.
* html/SearchInputType.h:

* rendering/RenderTextControlSingleLine.cpp:
(WebCore::RenderTextControlSingleLine::preferredContentLogicalWidth):
Remove the code specific to NumberInputType (which was moved to InputType::decorationWidth())
and replace it with a call to HTMLInputElement::decorationWidth() since this method will now
return the extra decoration width for an input element should it have any.

LayoutTests:

New test fast/forms/search/search-size-with-decorations.html that checks the different
decorations for search fields and the resulting sizes.

Also rebaselining the following tests since the rendering of search fields changed:

fast/forms/search-cancel-button-style-sharing.html
fast/forms/search-display-none-cancel-button.html
fast/forms/searchfield-heights.html
fast/forms/control-restrict-line-height.html
fast/forms/placeholder-pseudo-style.html
fast/forms/search-rtl.html
fast/css/text-overflow-input.html
fast/forms/placeholder-position.html
fast/repaint/search-field-cancel.html
fast/forms/input-appearance-height.html
fast/forms/search-vertical-alignment.html
fast/forms/box-shadow-override.html
fast/forms/search/search-size-with-decorations.html
fast/css/input-search-padding.html
fast/forms/search-styled.html

Reviewed by Darin Adler.

* fast/forms/placeholder-position-expected.txt:
* fast/forms/search/search-size-with-decorations-expected.txt: Added.
* fast/forms/search/search-size-with-decorations.html: Added.
* fast/repaint/search-field-cancel-expected.txt:
* platform/mac/fast/css/input-search-padding-expected.txt:
* platform/mac/fast/css/text-overflow-input-expected.png:
* platform/mac/fast/css/text-overflow-input-expected.txt:
* platform/mac/fast/forms/box-shadow-override-expected.png:
* platform/mac/fast/forms/box-shadow-override-expected.txt:
* platform/mac/fast/forms/control-restrict-line-height-expected.png:
* platform/mac/fast/forms/control-restrict-line-height-expected.txt:
* platform/mac/fast/forms/input-appearance-height-expected.png:
* platform/mac/fast/forms/input-appearance-height-expected.txt:
* platform/mac/fast/forms/placeholder-position-expected.png:
* platform/mac/fast/forms/placeholder-pseudo-style-expected.png:
* platform/mac/fast/forms/placeholder-pseudo-style-expected.txt:
* platform/mac/fast/forms/search-cancel-button-style-sharing-expected.png:
* platform/mac/fast/forms/search-cancel-button-style-sharing-expected.txt:
* platform/mac/fast/forms/search-display-none-cancel-button-expected.txt:
* platform/mac/fast/forms/search-rtl-expected.png:
* platform/mac/fast/forms/search-rtl-expected.txt:
* platform/mac/fast/forms/search-styled-expected.txt:
* platform/mac/fast/forms/search-vertical-alignment-expected.png:
* platform/mac/fast/forms/search-vertical-alignment-expected.txt:
* platform/mac/fast/forms/search/search-size-with-decorations-expected.png: Added.
* platform/mac/fast/forms/searchfield-heights-expected.png:
* platform/mac/fast/forms/searchfield-heights-expected.txt:
* platform/mac/fast/repaint/search-field-cancel-expected.png:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153647 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION: ARM still crashes after change set r153612.
https://bugs.webkit.org/show_bug.cgi?id=119433

Patch by Julien Brianceau <jbrianceau@nds.com> on 2013-08-02
Reviewed by Michael Saboff.

Update call frame and do not restore registers from JIT stack frame in ARM and ARMv7
implementations of ctiVMThrowTrampolineSlowpath. This change is similar to r153583
for sh4 architecture.

* jit/JITStubsARM.h:
* jit/JITStubsARMv7.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153648 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r130783): Scrolling is broken going back to a cached page from a page that still has outstanding subresources.
<rdar://problem/14601124> and https://bugs.webkit.org/show_bug.cgi?id=119416

Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/loading/unfinished-load-back-to-cached-page-callbacks.html

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::stopLoading): Always explicitly cancel the Document parser when stopLoading is called.

LayoutTests:

* http/tests/loading/resources/page-with-slow-loading-subresource.html: Added.
* http/tests/loading/resources/slowimage.php: Added.
* http/tests/loading/unfinished-load-back-to-cached-page-callbacks-expected.txt:
* http/tests/loading/unfinished-load-back-to-cached-page-callbacks.html:
* http/tests/loading/unfinished-main-resource-back-to-cached-page-callbacks-expected.txt: Copied from LayoutTests/http/tests/loading/unfinished-load-back-to-cached-page-callbacks-expected.txt.
* http/tests/loading/unfinished-main-resource-back-to-cached-page-callbacks.html: Copied from LayoutTests/http/tests/loading/unfinished-load-back-to-cached-page-callbacks.html.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153649 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Buildfix for !ENABLE(SVG) platforms after r153581.
https://bugs.webkit.org/show_bug.cgi?id=119444

Reviewed by Andreas Kling.

Adding missing guards.

* css/StylePropertyShorthand.cpp:
(WebCore::matchingShorthandsForLonghand):
* css/StylePropertyShorthand.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153650 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] REGRESSION after r153432: some accessibility tests crash.
https://bugs.webkit.org/show_bug.cgi?id=119333

Patch by Mario Sanchez Prada <mario.prada@samsung.com> on 2013-08-02
Reviewed by Gustavo Noronha Silva.

Add missing null-check to avoid dereferencing a non-existent parent.

* WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:
(WTR::attributesOfElement): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153651 268f45cc-cd09-0410-ab3c-d52691b4dbfc