Unreviewed gardening. Fixing Mac results for fast/repaint/overhanging-float-detach-repaint.html.

* platform/chromium-mac-lion/fast/repaint/overhanging-float-detach-repaint-expected.png: Added.
* platform/chromium-mac-snowleopard/fast/repaint/overhanging-float-detach-repaint-expected.png: Added.
* platform/chromium-mac/fast/repaint/overhanging-float-detach-repaint-expected.png: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        <rdar://problem/12524710> Update sandbox rules after r128003
        https://bugs.webkit.org/show_bug.cgi?id=106840

        Reviewed by Anders Carlsson.

        * WebProcess/com.apple.WebProcess.sb.in:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139685 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Correct FrameView::scrollableAreaBoundingBox() calculation in the presence of transforms
https://bugs.webkit.org/show_bug.cgi?id=105075

Patch by Tien-Ren Chen <trchen@chromium.org> on 2013-01-14
Reviewed by Simon Fraser.

As mentioned by the FIXME comment, we need to ask the renderer for the
absolute bounding box of a frame for correct transformation.
This fixes the bug that iframe cannot be scrolled properly when it is
transformed.

Source/WebCore:

Tests: scrollingcoordinator/non-fast-scrollable-region-scaled-iframe.html
       scrollingcoordinator/non-fast-scrollable-region-transformed-iframe.html

* page/FrameView.cpp:
(WebCore::FrameView::scrollableAreaBoundingBox):

LayoutTests:

* platform/mac/scrollingcoordinator/non-fast-scrollable-region-scaled-iframe-expected.png: Added.
* platform/mac/scrollingcoordinator/non-fast-scrollable-region-scaled-iframe-expected.txt: Added.
* platform/mac/scrollingcoordinator/non-fast-scrollable-region-transformed-iframe-expected.png: Added.
* platform/mac/scrollingcoordinator/non-fast-scrollable-region-transformed-iframe-expected.txt: Added.
* scrollingcoordinator/non-fast-scrollable-region-scaled-iframe-expected.png: Added.
* scrollingcoordinator/non-fast-scrollable-region-scaled-iframe-expected.txt: Added.
* scrollingcoordinator/non-fast-scrollable-region-scaled-iframe.html: Added.
* scrollingcoordinator/non-fast-scrollable-region-transformed-iframe-expected.png: Added.
* scrollingcoordinator/non-fast-scrollable-region-transformed-iframe-expected.txt: Added.
* scrollingcoordinator/non-fast-scrollable-region-transformed-iframe.html: Added.
* scrollingcoordinator/resources/non-fast-scrollable-region-testing.js: Added.
(runNonFastScrollableRegionTest):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139686 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Python implementation reports "MemoryError" instead of doing things
https://bugs.webkit.org/show_bug.cgi?id=106690

Source/JavaScriptCore: 

Reviewed by Oliver Hunt.
        
The bug was that the CFA was assuming that a variable is dead at the end of a basic block and hence doesn't need to
be merged to the next block if the last mention of the variable was dead. This is almost correct, except that it
doesn't work if the last mention is a GetLocal - the GetLocal itself may be dead, but that doesn't mean that the
variable is dead - it may still be live. The appropriate thing to do is to look at the GetLocal's Phi. If the
variable is used in the next block then the next block will have a reference to the last mention in our block unless
that last mention is a GetLocal, in which case it will link to the Phi. Doing it this way captures everything that
the CFA wants: if the last use is a live GetLocal then the CFA needs to consider the GetLocal itself for possible
refinements to the proof of the value in the variable, but if the GetLocal is dead, then this must mean that the
variable is not mentioned in the block but may still be "passed through" it, which is what the Phi will tell us.
Note that it is not possible for the GetLocal to refer to anything other than a Phi, and it is also not possible
for the last mention of a variable to be a dead GetLocal while there are other mentions that aren't dead - if
there had been SetLocals or GetLocals prior to the dead one then the dead one wouldn't have been emitted by the
parser.
        
This also fixes a similar bug in the handling of captured variables. If a variable is captured, then it doesn't
matter if the last mention is dead, or not. Either way, we already know that a captured variable will be live in
the next block, so we must merge it no matter what.
        
Finally, this change makes the output of Operands dumping a bit more verbose: it now prints the variable name next
to each variable's dump. I've often found the lack of this information confusing particularly for operand dumps
that involve a lot of variables.

* bytecode/Operands.h:
(JSC::dumpOperands):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::mergeStateAtTail):

LayoutTests: 

Reviewed by Oliver Hunt.

* fast/js/dfg-cfa-merge-with-dead-use-at-tail-expected.txt: Added.
* fast/js/dfg-cfa-merge-with-dead-use-at-tail.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-cfa-merge-with-dead-use-at-tail.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139687 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG should not forget that it had proved something to be a constant during a merge just because it's merging against the empty value
https://bugs.webkit.org/show_bug.cgi?id=106727

Reviewed by Oliver Hunt.
        
The problem was this statement:
        
if (m_value != other.m_value)
    m_value = JSValue();
        
This is well-intentioned, in the sense that if we want our abstract value (i.e. this) to become the superset of the other
abstract value, and the two abstract values have proven different constants, then our abstract value should rescind its
claim that it has been proven to be constant. But this misses the special case that if the other abstract value is
completely clear (meaning that it wishes to contribute zero information and so the superset operation shouldn't change
this), it will have a clear m_value. So, the code prior to this patch would rescind the constant proof even though it
didn't have to.
        
This comes up rarely and I don't believe it will be a performance win, but it is good to have the CFA been consistently
precise as often as possible.

* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::merge):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139688 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Enable `update-webkit --chromium --ninja` on windows
https://bugs.webkit.org/show_bug.cgi?id=106836

Reviewed by Eric Seidel.

After running this, build-webkit --chromium will use ninja to build.
Apparently there are some minor issues with that still, so it's
not quite ready for use yet.

* Scripts/webkitdirs.pm:
(determineIsChromiumNinja):
(buildChromium):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139689 268f45cc-cd09-0410-ab3c-d52691b4dbfc
EFL build fix after r139681.

* dom/NodeRareData.h:
(WebCore::NodeMicroDataTokenLists::NodeMicroDataTokenLists):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139690 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Sometimes RenderLayer::updateNeedsCompositedScrolling is not called
https://bugs.webkit.org/show_bug.cgi?id=106271

Reviewed by Simon Fraser.

Source/WebCore:

1. If a layer has no out-of-flow descendant, m_hasOutOfFlowPositionedDescendant won't change and won't trigger updateNeedsCompositedScrolling in updateDescendantDependentFlags. Set m_hasOutOfFlowPositionedDescendantDirty to true and call updateNeedsCompositedScrolling when the dirty flag becomes false from true.
2. When the content size changes causing change of scrollable status, updateNeedsCompositedScrolling should also be called.

Test: compositing/overflow/dynamic-composited-scrolling-status.html

* page/FrameView.cpp:
(WebCore::FrameView::addScrollableArea): Returns whether the scrollable area has just been newly added.
(WebCore::FrameView::removeScrollableArea): Returns whether the scrollable area has just been removed.
* page/FrameView.h:
(FrameView):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::RenderLayer): Changed the initial value of m_hasOutOfFlowPositionedDescendantDirty to true to make sure m_hasOutOfFlowPositionedDescendant will be updated initially.
(WebCore::RenderLayer::updateDescendantDependentFlags): Call updateNeedsCompositedScrolling when m_hasOutOfFlowPositionedDescendantDirty is true.
(RenderLayer::updateScrollableAreaSet): Calls updateNeedsCompositedScrolling() when scrollable status changes.
* rendering/RenderLayer.h:
(RenderLayer):

LayoutTests:

* compositing/overflow/dynamic-composited-scrolling-status-expected.txt: Added.
* compositing/overflow/dynamic-composited-scrolling-status.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139691 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement element type selectors for the WebVTT ::cue pseudo class
https://bugs.webkit.org/show_bug.cgi?id=105480

Patch by Dima Gorbik <dgorbik@apple.com> on 2013-01-14
Reviewed by Antti Koivisto.

Source/WebCore:

Implemented tag matching for the WebVTT specific tags "c" and "v". All common html tags like "b" and "i" are
handled without any changes to the code. Creating a rendering tree and DOM tree now use different code paths.
They both are made by cloning and modifying the tree produced by the parser. Voice tags now use spans for both
rendering and DOM trees to conform to specs. Since this changes a lot of code little refactoring has been
done. Removed m_hasInnerTimestamps since it is no longer needed, it doesn't affect anything. m_documentFragment
was renamed to m_webVTTNodeTree.

Existing tests were modified to cover this case.

* html/track/TextTrackCue.cpp:
(WebCore::TextTrackCue::TextTrackCue):
(WebCore::TextTrackCue::setText): rename m_documentFragment to m_webVTTNodeTree
(WebCore::TextTrackCue::createWebVTTNodeTree): parse the cue if it hasn't been parsed before.
(WebCore::TextTrackCue::copyWebVTTNodeToDOMTree): clone and prepare a node for using in the DOM tree according to specs.
(WebCore::TextTrackCue::getCueAsHTML): get a DOM tree for the cue.
(WebCore::TextTrackCue::createCueRenderingTree): create a rendering tree (main tree is just being cloned for now).
(WebCore::TextTrackCue::markFutureAndPastNodes): tightening the argument type.
(WebCore::TextTrackCue::updateDisplayTree):
(WebCore::TextTrackCue::getDisplayTree): code cleanup, removed m_hasInnerTimeStamps.
* html/track/TextTrackCue.h:
(WebCore::TextTrackCue::voiceElementTagName):
(TextTrackCue):
(WebCore::TextTrackCue::classElementTagName):
* html/track/WebVTTParser.cpp:
(WebCore::WebVTTParser::constructTreeFromToken): type of the newly created elements was changed to Element to avoid hitting
an assertion when cloning because a cloned element will not have HTMLElement type for elements with "v" and "c" tag.

LayoutTests:

* media/track/captions-webvtt/styling.vtt:
* media/track/track-css-matching-expected.txt:
* media/track/track-css-matching.html:
* media/track/track-webvtt-tc026-voice.html: voice elements should be spans according to specs.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139692 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderListItem does not need to override computePreferredLogicalWidth
https://bugs.webkit.org/show_bug.cgi?id=106839

Reviewed by Levi Weintraub.

Apparently there was a time when the list marker was considered part of
the list item's preferred width, but that is no longer the case.
This code was added in r3421. The code around preferred widths has change
a lot since then.

* rendering/RenderListItem.cpp:
* rendering/RenderListItem.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139693 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: Rolling out r139683. It broke a bunch of webkit_unit_tests.

Source/WebKit/win: Rolling out r139683. It broke a bunch of webkit_unit_tests. 


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139694 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rolling out r139678. This triggered a number of WebAudio crashes on Debug bots.

* platform/audio/chromium/AudioDestinationChromium.cpp:
(WebCore::AudioDestinationChromium::AudioDestinationChromium):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139695 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore: Rolling out r139618. Appears to be causing sporadic crashes on Debug bots.

* Modules/mediastream/MediaStream.cpp:
(WebCore::processTrack):
* Modules/mediastream/MediaStreamTrack.cpp:
(WebCore::MediaStreamTrack::readyState):
* Modules/mediastream/MediaStreamTrack.h:
* Modules/mediastream/MediaStreamTrack.idl:

LayoutTests: Speculatively rolling out r139618. Appears to be causing sporadic crashes on Debug bots.

* fast/mediastream/MediaStreamTrack-expected.txt:
* fast/mediastream/MediaStreamTrack.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139696 268f45cc-cd09-0410-ab3c-d52691b4dbfc
kill whole lighttpd process tree for chromium win
https://bugs.webkit.org/show_bug.cgi?id=106838

Reviewed by Tony Chang.

Land a speculative fix for lighttpd.exe hanging on some chromium bots;
I think a test is causing a httpd server child process to wedge and
killing the parent httpd server process isn't sufficient to ensure
that the children are also killed.

* Scripts/webkitpy/layout_tests/servers/http_server.py:
(Lighttpd._check_and_kill):
* Scripts/webkitpy/layout_tests/servers/http_server_unittest.py:
(TestHttpServer.test_start_cmd):
(TestHttpServer):
(TestHttpServer.test_win32_start_and_stop):
(TestHttpServer.test_win32_start_and_stop.wait_for_action):
(TestHttpServer.test_win32_start_and_stop.mock_returns):
(TestHttpServer.test_win32_start_and_stop.mock_returns.return_value_thunk):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139697 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Move BlobRegistryProxy into WebCore
https://bugs.webkit.org/show_bug.cgi?id=106831

Reviewed by Adam Barth.

Part of a larger refactoring series to remove layering violations
in Chromium. See tracking bug 106829.

Source/WebCore:

* WebCore.gypi:
* platform/network/chromium/BlobRegistryProxy.cpp: Added.
(WebCore):
(WebCore::blobRegistry):
(WebCore::BlobRegistryProxy::BlobRegistryProxy):
(WebCore::BlobRegistryProxy::registerBlobURL):
(WebCore::BlobRegistryProxy::unregisterBlobURL):
* platform/network/chromium/BlobRegistryProxy.h: Added.
(WebCore):
(BlobRegistryProxy):
(WebCore::BlobRegistryProxy::loadResourceSynchronously):
(WebCore::BlobRegistryProxy::~BlobRegistryProxy):

Source/WebKit/chromium:

* WebKit.gyp:
* src/BlobRegistryProxy.cpp: Removed.
* src/BlobRegistryProxy.h: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139698 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed gardening. Adding mac expectatons after r139686.

* platform/chromium-mac/scrollingcoordinator: Added.
* platform/chromium-mac/scrollingcoordinator/non-fast-scrollable-region-scaled-iframe-expected.png: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139699 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Adding an error string to AmbiguousCommitError.
https://bugs.webkit.org/show_bug.cgi?id=106846

Patch by Tim 'mithro' Ansell <mithro@mithis.com> on 2013-01-14
Reviewed by Adam Barth.

* Scripts/webkitpy/common/checkout/scm/git.py:
(AmbiguousCommitError.__init__):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139700 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Blur the label background of a snapshotted plugin
https://bugs.webkit.org/show_bug.cgi?id=106630

Reviewed by Simon Fraser.

When we are showing a label indicating the plugin has been snapshotted,
slightly blur the snapshot behind the label so that it is more clear. I expect
that if/when other ports pick up this code, we'll need to separate the
UI treatment somewhat, but this is ok for a first step.

* rendering/RenderSnapshottedPlugIn.cpp:
(RenderSnapshottedPlugInBlurFilter): Private class to use FEGaussianBlur to blur an image.
(WebCore::RenderSnapshottedPlugInBlurFilter::create):
(WebCore::RenderSnapshottedPlugInBlurFilter::setSourceImageRect):
(WebCore::RenderSnapshottedPlugInBlurFilter::sourceImageRect):
(WebCore::RenderSnapshottedPlugInBlurFilter::filterRegion):
(WebCore::RenderSnapshottedPlugInBlurFilter::output):
(WebCore::RenderSnapshottedPlugInBlurFilter::RenderSnapshottedPlugInBlurFilter):
(WebCore::RenderSnapshottedPlugInBlurFilter::apply):
(WebCore::RenderSnapshottedPlugIn::RenderSnapshottedPlugIn): New member variable to hold a cached version of a preblurred snapshot.
(WebCore::RenderSnapshottedPlugIn::~RenderSnapshottedPlugIn): Remember to remove the preblurred image from the cache.
(WebCore::RenderSnapshottedPlugIn::updateSnapshot): Zero the preblurred version if it exists.
(WebCore::RenderSnapshottedPlugIn::paintReplaced): Either paint snapshot or blurred snapshot with label.
(WebCore::RenderSnapshottedPlugIn::paintSnapshot): New method to paint a full sized snapshot.
(WebCore::RenderSnapshottedPlugIn::paintReplacedSnapshot):
(WebCore::snapshottedPluginImageForLabelDisplay): Static function to produce the blurred snapshot.
(WebCore::RenderSnapshottedPlugIn::paintReplacedSnapshotWithLabel): Calls paintSnapshot with the blurred snapshot on Mac.
* rendering/RenderSnapshottedPlugIn.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139701 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[ANGLE] Update ANGLE in WebKit
https://bugs.webkit.org/show_bug.cgi?id=106274

Unreviewed attempted build fix.

Source/ThirdParty/ANGLE:

Remove the copy files stage. Make khrplatform.h a public header.

* ANGLE.xcodeproj/project.pbxproj:
* include/GLSLANG/ShaderLang.h:

Source/WebKit:

The khrplatform.h file is now a public header without a directory
prefix. Update the include path to look in the right place.

* PlatformEfl.cmake:

Source/WebKit2:

The khrplatform.h file is now a public header without a directory
prefix. Update the include path to look in the right place.

* PlatformEfl.cmake:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139702 268f45cc-cd09-0410-ab3c-d52691b4dbfc
fast/dom/HTMLTemplateElement/inertContents.html is flaky on Debug Chromium bots
https://bugs.webkit.org/show_bug.cgi?id=106810

Reviewed by Levi Weintraub.

This patch reverts the test for inertContents back to a non-flaky version which did not
attempt to assert that images are prevented from loaded.

* fast/dom/HTMLTemplateElement/inertContents-expected.txt:
* fast/dom/HTMLTemplateElement/inertContents.html:
* platform/chromium/TestExpectations:
* platform/efl/fast/dom/HTMLTemplateElement/inertContents-expected.txt: Removed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139703 268f45cc-cd09-0410-ab3c-d52691b4dbfc