Get rid of ref-counting on RenderWidget.
<https://webkit.org/b/121357>

Reviewed by Darin Adler.

Source/WebCore:

Instead of RenderView tracking RenderWidgets, have FrameView track Widgets
that are currently in the render tree.

To protect ourselves during NPAPI tomfoolery, we now let RenderWidget hand
out weak pointers through a createWeakPtr() method so call sites can monitor
the renderer for deletion without having to take shared ownership.

This works out quite nicely since instead of keeping a limping object alive
for a little longer just so we can call methods on it (to accomplish nothing),
we're forced to check right away if it's gone, and take immediate action.

De-virtualized RenderObject::destroy() since it's no longer needed for
RenderWidget to defer destruction.

* page/FrameView.cpp:
(WebCore::FrameView::layout):
(WebCore::FrameView::repaintFixedElementsAfterScrolling):

    Call updateWidgetPositions() on FrameView instead of RenderView.

(WebCore::FrameView::updateEmbeddedObject):

    Turn null checking of embedded object's element backpointer into an
    assertion. This will eventually go away completely once that renderer
    can return a HTMLFrameOwnerElement&.

    Use WeakPtr to check for renderer destruction following the call out
    to updateWidget().

(WebCore::FrameView::updateEmbeddedObjects):

    Slap a WidgetHierarchyUpdatesSuspensionScope guard on this function
    to defer Widget updates until all the updateEmbeddedObject calls are
    done. This avoids RenderWidget::setWidget() having to handle 'this'
    disappearing from underneath.

    Also use a ListHashSet with a null sentinel to avoid looping forever.

(WebCore::FrameView::performPostLayoutTasks):

    Only call updateEmbeddedObjects() once since that function no longer
    operates in chunks.

(WebCore::FrameView::notifyWidgetsInAllFrames):

    Call notifyWidgets() on FrameView instead of RenderView.

(WebCore::FrameView::didAddWidgetToRenderTree):
(WebCore::FrameView::willRemoveWidgetFromRenderTree):

    Added. These are called by RenderWidget when a Widget is being
    added or removed from a RenderWidget.

(WebCore::collectWidgets):

    Helper to collect raw Widget pointers into a Vector and ref them.

(WebCore::FrameView::updateWidgetPositions):

    Moved here from RenderView. This function holds a ref on all the
    attached Widgets and calls RenderWidget::updateWidgetPosition() on
    their corresponding renderers.

(WebCore::FrameView::notifyWidgets):

    Moved here from RenderView. Holds a ref on all the widgets while
    calling Widget::notifyWidget() on each one.

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::scrollTo):

    Call updateWidgetPositions() on FrameView instead of RenderView.

* rendering/RenderObject.h:

    De-virtualized destroy().

* rendering/RenderView.cpp:
* rendering/RenderView.h:

    Moved a bunch of things to FrameView. Made protected section private
    since nothing inherits from RenderView.

* rendering/RenderWidget.h:
(WebCore::RenderWidget::createWeakPtr):

    Added a WeakPtr factory for clients that want to monitor this object
    for destruction.

* rendering/RenderWidget.cpp:
(WebCore::RenderWidget::RenderWidget):
(WebCore::RenderWidget::willBeDestroyed):
(WebCore::RenderWidget::~RenderWidget):

    Removed ref counting.
    Removed registration with RenderView in ctor/willBeDestroyed.

(WebCore::RenderWidget::setWidgetGeometry):

    Monitor the RenderWidget itself through a WeakPtr and check on it
    after each step that we're still alive. In that case just bail out.

(WebCore::RenderWidget::setWidget):

    Register the incoming/outgoing Widget with the FrameView.
    Use a WeakPtr to check on 'this' after updateWidgetGeometry().

(WebCore::RenderWidget::updateWidgetPosition):

    Use a WeakPtr to check on 'this' after updateWidgetGeometry().

* GNUmakefile.list.am:
* rendering/RenderWidgetProtector.h:

    Removed.

Source/WTF:

* wtf/WeakPtr.h:
(WTF::WeakPtr::operator!):

    Add operator! to WeakPtr.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155796 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement the mmultiscripts tag
https://bugs.webkit.org/show_bug.cgi?id=99618

Patch by Frédéric Wang <fred.wang@free.fr> on 2013-09-15
Reviewed by Chris Fleizach.

Source/WebCore:

Tests: mathml/invalid-scripts-crash.html
       mathml/presentation/multiscripts-equivalence.html
       mathml/presentation/multiscripts-noscripts.html
       mathml/presentation/multiscripts-positions.html
       mathml/presentation/scripts-base-alignment.html
       mathml/presentation/scripts-horizontal-alignment.html
       mathml/presentation/scripts-vertical-alignment.html
       mathml/scripts-addChild.html
       mathml/scripts-removeChild.html

This relies on the existing msub/msup/msubsup code to implement the mmultiscripts tag. This also improves dynamic addition/removal of children for these MathML elements and adds a specific style for invalid children, so that they render like an merror tag. Finally, this fixes a bad memory access in the Accessibility render object of msubsup.

* CMakeLists.txt:
* GNUmakefile.list.am:
* Target.pri:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
* WebCore.xcodeproj/project.pbxproj:
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::isMathSubscriptSuperscript):
(WebCore::AccessibilityRenderObject::mathSuperscriptObject):
* css/mathml.css:
(mo, mrow, mfenced, mfrac, msub, msup, msubsup, mmultiscripts, mprescripts, none, munder, mover, munderover, msqrt, mroot):
(mover > :last-child, munderover > :last-child):
(msub > * + *, msup > * + *, msubsup > * + *, mmultiscripts > * + *, munder > * + *, mover > * + *, munderover > * + *):
(merror, msub > * + * + *, msup > * + * + *, msubsup > * + * + * + *, msub > mprescripts, msup > mprescripts, msubsup > mprescripts, msub > none, msup > none, msubsup > none, mmultiscripts > mprescripts ~ mprescripts, mmultiscripts > mprescripts ~ mprescripts ~ *):
* mathml/MathMLInlineContainerElement.cpp:
(WebCore::MathMLInlineContainerElement::createRenderer):
* mathml/mathtags.in:
* rendering/mathml/RenderMathMLBlock.h:
(WebCore::RenderMathMLBlock::isRenderMathMLScripts):
(WebCore::RenderMathMLBlock::isRenderMathMLScriptsWrapper):
* rendering/mathml/RenderMathMLScripts.cpp: Added.
(WebCore::isMPrescripts):
(WebCore::RenderMathMLScripts::RenderMathMLScripts):
(WebCore::RenderMathMLScripts::base):
(WebCore::RenderMathMLScripts::fixAnonymousStyleForSubSupPair):
(WebCore::RenderMathMLScripts::fixAnonymousStyles):
(WebCore::RenderMathMLScripts::addChildInternal):
(WebCore::RenderMathMLScripts::removeChildInternal):
(WebCore::RenderMathMLScripts::addChild):
(WebCore::RenderMathMLScripts::removeChild):
(WebCore::RenderMathMLScripts::styleDidChange):
(WebCore::RenderMathMLScripts::unembellishedOperator):
(WebCore::RenderMathMLScripts::layout):
(WebCore::RenderMathMLScripts::firstLineBoxBaseline):
(WebCore::RenderMathMLScriptsWrapper::createAnonymousWrapper):
(WebCore::RenderMathMLScriptsWrapper::addChildInternal):
(WebCore::RenderMathMLScriptsWrapper::addChild):
(WebCore::RenderMathMLScriptsWrapper::removeChildInternal):
(WebCore::RenderMathMLScriptsWrapper::removeChild):
* rendering/mathml/RenderMathMLScripts.h: Added.
(WebCore::RenderMathMLScriptsWrapper::RenderMathMLScriptsWrapper):
(WebCore::RenderMathMLScriptsWrapper::renderName):
(WebCore::RenderMathMLScriptsWrapper::isRenderMathMLScriptsWrapper):
(WebCore::toRenderMathMLScriptsWrapper):
(WebCore::RenderMathMLScripts::isRenderMathMLScripts):
(WebCore::RenderMathMLScripts::renderName):
(WebCore::toRenderMathMLScripts):
* rendering/mathml/RenderMathMLSubSup.cpp: Removed.
* rendering/mathml/RenderMathMLSubSup.h: Removed.

LayoutTests:

Add many tests for script msub/msup/msubsup/mmultiscripts:
- invalid markup
- equivalence between mmultiscripts without scripts and mrow
- equivalence between mmultiscripts and msub/msup/msubsup
- position of scripts in mmultiscripts
- baseline alignment of msub/msup/msubsup elements
- horizontal/vertical alignment of scripts
- adding/removing children with the DOM

* TestExpectations: Some remaining MathML pixel tests are broken by this patch.
* mathml/invalid-scripts-crash-expected.txt: Added.
* mathml/invalid-scripts-crash.html: Added.
* mathml/presentation/multiscripts-equivalence-expected.html: Added.
* mathml/presentation/multiscripts-equivalence.html: Added.
* mathml/presentation/multiscripts-noscripts-expected.html: Added.
* mathml/presentation/multiscripts-noscripts.html: Added.
* mathml/presentation/multiscripts-positions-expected.html: Added.
* mathml/presentation/multiscripts-positions.html: Added.
* mathml/presentation/scripts-base-alignment-expected.html: Added.
* mathml/presentation/scripts-base-alignment.html: Added.
* mathml/presentation/scripts-horizontal-alignment-expected.html: Added.
* mathml/presentation/scripts-horizontal-alignment.html: Added.
* mathml/presentation/scripts-vertical-alignment-expected.html: Added.
* mathml/presentation/scripts-vertical-alignment.html: Added.
* mathml/scripts-addChild-expected.html: Added.
* mathml/scripts-addChild.html: Added.
* mathml/scripts-removeChild-expected.html: Added.
* mathml/scripts-removeChild.html: Added.
* platform/mac/accessibility/mathml-multiscript-expected.txt: Reference updated.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155797 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Restore two-pass mechanism for FrameView::updateEmbeddedObjects().
<https://webkit.org/b/121380>

Reviewed by Darin Adler.

Restore the code to make a second pass over the embedded objects needing
an update in case more objects were added to the set during the first pass.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155798 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Fix Qt build.

        * css/CSSSelector.cpp:
        (WebCore::populatePseudoTypeByNameMap): Removed stray line that was breaking
        the build for any platform with !ENABLE(VIDEO_TRACK).

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155799 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Get rid of ref-counting on RenderArena.
<https://webkit.org/b/121379>

Reviewed by Darin Adler.

This was used to guard the arena during ref-counted RenderWidget teardown.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155800 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Shrink factory functions
https://bugs.webkit.org/show_bug.cgi?id=121378

Reviewed by Andreas Kling.

This makes the functions that builds four different types of per-element tables
all have smaller code size.

* DerivedSources.make: Tweaked how HTML and SVG wrapper factories are made a bit.
It was OK, but a little sloppy.

* dom/Document.cpp:
(WebCore::Document::createElement): Changed to call the createElement functions
in the factories. Also did some style improvement.

* dom/make_names.pl:
(printConstructorSignature): Make constructors take a Document& instead of
a Document*.
(printConstructorInterior): Updated for Document& instead of Document*.
(printFunctionTable): Renamed from printFunctionInits, because this now
creates table entries. The actual code to add each function is now done
in a loop instead.
(printNamesHeaderFile): Made the table const.
(printNamesCppFile): Made the table const.
(printDefinitions): Generate a table, table entries, and a loop that calls
createQualifiedName, rather than an "unrolled loop".
(printFactoryCppFile): Tweaked indentation. Updated to take Document& instead
of Document*. Generate a table, table entries, and a loop that builds a map,
rather than an "unrolled" loop.
(printFactoryHeaderFile): Eliminated the unused createElement member function
that was part of a dream of factory objects in a namespace registry, giving
the name createElement to the static member function so it would be less
redundant. Also made the function takes a Document& instead of Document*.
Also made the default "not created by parser", since the parser is the simpler
use case, outnumbered by the non-parser uses, at least at the moment. Also,
use nullptr instead of 0.
(printWrapperFactoryCppFile): Generate a table, table entries, and a loop
that builds a map rather than an "unrolled" loop.

* editing/htmlediting.cpp:
(WebCore::createHTMLElement): Put the null check here that used to be in
HTMLElementFactory::createElement, and call with a reference instead of a
pointer. Also don't need to pass "0, false" since "not created by the parser"
is now the default.
* html/HTMLDocument.cpp:
(WebCore::HTMLDocument::createElement): Ditto.

* html/HTMLElement.cpp:
(WebCore::populateEventNameForAttributeLocalNameMap): Changed to use an
AtomicStringImpl* as the key instead of AtomicString, since all the strings
come from the local names of tags, and so don't need to be ref'd. This saves
a bit of reference count churn when building the map and is the same pattern
used in some maps in the make_names.pl script above.
(WebCore::HTMLElement::parseAttribute): Updated for change above.

* html/HTMLObjectElement.cpp:
(WebCore::isRecognizedTagName): More const.

* html/parser/HTMLConstructionSite.cpp:
(WebCore::HTMLConstructionSite::createHTMLElement): Changed to call the
HTMLElementFactory::createElement function under its new name with a reference
rather than a pointer.

* html/parser/HTMLIdentifier.cpp:
(WebCore::nameForIndex): More const.
(WebCore::HTMLIdentifier::addNames): More const.

* html/parser/HTMLTreeBuilder.cpp:
(WebCore::mapLoweredLocalNameToName): More const.
(WebCore::adjustSVGTagNameCase): Eliminated local variable so we would not have
to utter type with more const.
(WebCore::adjustAttributes): Ditto.
(WebCore::addNamesWithPrefix): More const. Also tweaked to use a bit more reference,
and a bit less pointer. Also used array instead of pointer for argument since they
are synonyms and this use is more array-like and const array is slightly easier to
understand than the double const pointer.
(WebCore::adjustForeignAttributes): Eliminated local variable so we would not have
to utter type with more const.

* html/track/TextTrackCue.cpp:
(WebCore::TextTrackCue::copyWebVTTNodeToDOMTree): Pass a reference to
WebVTTElement::createEquivalentHTMLElement.

* html/track/WebVTTElement.cpp:
(WebCore::WebVTTElement::WebVTTElement): Take a reference instead of a pointer.
(WebCore::WebVTTElement::create): Ditto.
(WebCore::WebVTTElement::cloneElementWithoutAttributesAndChildren): Pass a
reference instead of a pointer to create.
(WebCore::WebVTTElement::createEquivalentHTMLElement): Take a reference instead
of a pointer, and update uses of HTMLElementFactory::createElement. Also made
this return null when a bad node type is passed in, which should never happen.

* html/track/WebVTTElement.h: Use Document& instead of Document*. Removed unused
and undefined create/constructor overloads.

* html/track/WebVTTParser.cpp:
(WebCore::WebVTTParser::constructTreeFromToken): Pass document reference rather than
pointer to WebVTTElement::create.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155801 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use FINAL instead of virtualChildren trick in render tree classes
https://bugs.webkit.org/show_bug.cgi?id=121373

Reviewed by Andreas Kling.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::updateFirstLetterStyle): Use children instead of
virtualChildren.
* rendering/RenderBox.cpp:
(WebCore::RenderBox::splitAnonymousBoxesAroundChild): Ditto.
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::moveChildTo): Ditto.
* rendering/RenderObject.cpp:
(WebCore::RenderObject::addChild): Ditto.
(WebCore::RenderObject::removeChild): Ditto.
(WebCore::RenderObject::handleDynamicFloatPositionChange): Ditto.
(WebCore::RenderObject::willBeDestroyed): Ditto.
(WebCore::RenderObject::removeFromRenderFlowThreadRecursive): Ditto.

* rendering/RenderBlock.h: Changed firstChild and lastChild to use
m_children directly instead of a function. Made the children function
a final virtual override. Deleted the virtualChildren override. Added
override keywords to other virtual functions.
* rendering/RenderEmbeddedObject.h: Ditto.
* rendering/RenderFrameSet.h: Ditto.
* rendering/RenderInline.h: Ditto.
* rendering/RenderMedia.h: Ditto.
* rendering/RenderTableCol.h: Ditto.
* rendering/RenderTableRow.h: Ditto.
* rendering/RenderTableSection.h: Ditto.
* rendering/svg/RenderSVGContainer.h: Ditto.
* rendering/svg/RenderSVGRoot.h: Ditto.

* rendering/RenderObject.h:
(WebCore::RenderObject::firstChild): Use children instead of virtualChildren.
(WebCore::RenderObject::lastChild): Ditto.
(WebCore::RenderObject::children): Renamed from virtualChildren.
(WebCore::RenderObject::canHaveChildren): Use children instead of virtualChildren.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155802 268f45cc-cd09-0410-ab3c-d52691b4dbfc