[WebKit2] Only preprocess sandbox profiles if we're building for the OS X SDK
https://bugs.webkit.org/show_bug.cgi?id=112330

Reviewed by David Kilzer.

We shouldn't preprocess sandbox profiles just because the computer
we're building on is a Mac. We should only do it if we're actually
building for the OS X SDK.

* DerivedSources.make: Check if $PLATFORM_NAME is macosx rather than if
$OS is MACOS.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145846 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Exclusions] shape-outside on floats for rounded rectangle shapes
https://bugs.webkit.org/show_bug.cgi?id=100299

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-03-14
Reviewed by Dirk Schulze.

Adding tests for rounded rectangles. The code already supports them,
but that was more of a happy accident. These tests makes it more
likely to stay that way.

* fast/exclusions/resources/rounded-rectangle.js:
(xOutset): Function to determine the offset for the outside shape.
(generateShapeOutsideOnFloat): Generate a shape outside on a float.
(generateSimulatedShapeOutsideOnFloat): Simulate a shape outside on a
    float using a large number of smaller floats.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle-expected.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-rectangle.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145847 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Objective-C API: Objective-C functions exposed to JavaScript have the wrong type (object instead of function)
https://bugs.webkit.org/show_bug.cgi?id=105892

Reviewed by Geoffrey Garen.

Changed ObjCCallbackFunction to subclass JSCallbackFunction which already has all of the machinery to call
functions using the C API. Since ObjCCallbackFunction is now a JSCell, we changed the old implementation of
ObjCCallbackFunction to be the internal implementation and keep track of all the proper data so that we 
don't have to put all of that in the header, which will now be included from C++ files (e.g. JSGlobalObject.cpp).

* API/JSCallbackFunction.cpp: Change JSCallbackFunction to allow subclassing. Originally it was internally
passing its own Structure up the chain of constructors, but we now want to be able to pass other Structures as well.
(JSC::JSCallbackFunction::JSCallbackFunction):
(JSC::JSCallbackFunction::create):
* API/JSCallbackFunction.h:
(JSCallbackFunction):
* API/JSWrapperMap.mm: Changed interface to tryUnwrapBlock.
(tryUnwrapObjcObject):
* API/ObjCCallbackFunction.h:
(ObjCCallbackFunction): Moved into the JSC namespace, just like JSCallbackFunction.
(JSC::ObjCCallbackFunction::createStructure): Overridden so that the correct ClassInfo gets used since we have 
a destructor.
(JSC::ObjCCallbackFunction::impl): Getter for the internal impl.
* API/ObjCCallbackFunction.mm:
(JSC::ObjCCallbackFunctionImpl::ObjCCallbackFunctionImpl): What used to be ObjCCallbackFunction is now 
ObjCCallbackFunctionImpl. It handles the Objective-C specific parts of managing callback functions.
(JSC::ObjCCallbackFunctionImpl::~ObjCCallbackFunctionImpl):
(JSC::objCCallbackFunctionCallAsFunction): Same as the old one, but now it casts to ObjCCallbackFunction and grabs the impl 
rather than using JSObjectGetPrivate.
(JSC::ObjCCallbackFunction::ObjCCallbackFunction): New bits to allow being part of the JSCell hierarchy.
(JSC::ObjCCallbackFunction::create):
(JSC::ObjCCallbackFunction::destroy):
(JSC::ObjCCallbackFunctionImpl::call): Handles the actual invocation, just like it used to.
(objCCallbackFunctionForInvocation):
(tryUnwrapBlock): Changed to check the ClassInfo for inheritance directly, rather than going through the C API call.
* API/tests/testapi.mm: Added new test to make sure that doing Function.prototype.toString.call(f) won't result in 
an error when f is an Objective-C method or block underneath the covers.
* runtime/JSGlobalObject.cpp: Added new Structure for ObjCCallbackFunction.
(JSC::JSGlobalObject::reset):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSGlobalObject):
(JSC::JSGlobalObject::objcCallbackFunctionStructure):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145848 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add selectTrailingWhitespaceEnabled setting to WebCore::Page
https://bugs.webkit.org/show_bug.cgi?id=109404

Patch by Manuel Rego Casasnovas <rego@igalia.com> on 2013-03-14
Reviewed by Tony Chang.

Source/WebCore:

Covered by
editing/selection/doubleclick-inline-first-last-contenteditable.html.

* page/Settings.cpp:
(WebCore): Configure default value for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled seetings as they are different in
Chromium port depending on the OS.
* page/Settings.in: Add new setting.

Source/WebKit/blackberry:

Use new settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.

Remove code related to DRT as it is not needed anymore.

* Api/DumpRenderTreeClient.h:
* WebCoreSupport/EditorClientBlackBerry.cpp:
(WebCore::EditorClientBlackBerry::smartInsertDeleteEnabled):
(WebCore::EditorClientBlackBerry::isSelectTrailingWhitespaceEnabled):

Source/WebKit/chromium:

Use new Page settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled and update API accordingly.

WebSettings API is required by DRT in order to set the proper default
values which are different from browser defaults.

* public/WebSettings.h: Add new API to manage smartInsertDeleteEnabled
and selectTrailingWhitespaceEnabled settings.
* public/WebViewClient.h: Remove API related to smartInsertDeleteEnabled
and selectTrailingWhitespaceEnabled as they will be managed from page
settings from now on.
* src/EditorClientImpl.cpp:
(WebKit::EditorClientImpl::smartInsertDeleteEnabled):
(WebKit::EditorClientImpl::isSelectTrailingWhitespaceEnabled): Use new
settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.
* src/WebSettingsImpl.cpp: Implement methods establishing the page
settings.
(WebKit::WebSettingsImpl::setSelectTrailingWhitespaceEnabled):
(WebKit):
(WebKit::WebSettingsImpl::setSmartInsertDeleteEnabled):
* src/WebSettingsImpl.h:
(WebSettingsImpl): Implement new API to manage the new settings.

Source/WebKit/efl:

Use new settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.

Remove code related to DRT as it is not needed anymore.

* WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
* WebCoreSupport/DumpRenderTreeSupportEfl.h:
* WebCoreSupport/EditorClientEfl.cpp:
(WebCore::EditorClientEfl::smartInsertDeleteEnabled):
(WebCore::EditorClientEfl::isSelectTrailingWhitespaceEnabled):
(WebCore::EditorClientEfl::EditorClientEfl):
* WebCoreSupport/EditorClientEfl.h:
(EditorClientEfl):

Source/WebKit/gtk:

Use new settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.

Remove code related to DRT as it is not needed anymore.

* WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
* WebCoreSupport/DumpRenderTreeSupportGtk.h:
(DumpRenderTreeSupportGtk):
* WebCoreSupport/EditorClientGtk.cpp:
(WebKit::EditorClient::smartInsertDeleteEnabled):
(WebKit::EditorClient::isSelectTrailingWhitespaceEnabled):
(WebKit::EditorClient::EditorClient):
* WebCoreSupport/EditorClientGtk.h:
(EditorClient):

Source/WebKit/mac:

Use new settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.

* WebCoreSupport/WebEditorClient.mm:
(WebEditorClient::smartInsertDeleteEnabled):
(WebEditorClient::isSelectTrailingWhitespaceEnabled):
* WebView/WebView.mm:
(-[WebView _commonInitializationWithFrameName:groupName:]): Initialize
settings from NSUserDefaults.
(-[WebView setSelectTrailingWhitespaceEnabled:]):
(-[WebView isSelectTrailingWhitespaceEnabled]):
(-[WebView setSmartInsertDeleteEnabled:]):
(-[WebView smartInsertDeleteEnabled]):
* WebView/WebViewData.h:
* WebView/WebViewData.mm:
(-[WebViewPrivate init]):

Source/WebKit/qt:

Use new settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.

Remove code related to DRT as it is not needed anymore.

* WebCoreSupport/DumpRenderTreeSupportQt.cpp:
* WebCoreSupport/DumpRenderTreeSupportQt.h:
* WebCoreSupport/EditorClientQt.cpp:
(WebCore::EditorClientQt::smartInsertDeleteEnabled):
(WebCore::EditorClientQt::toggleSmartInsertDelete):
(WebCore::EditorClientQt::isSelectTrailingWhitespaceEnabled):
(WebCore::EditorClientQt::EditorClientQt):
* WebCoreSupport/EditorClientQt.h:
(EditorClientQt):

Source/WebKit/win:

Use new settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.

* WebCoreSupport/WebEditorClient.cpp:
(WebEditorClient::smartInsertDeleteEnabled):
(WebEditorClient::isSelectTrailingWhitespaceEnabled):
* WebView.cpp:
(WebView::WebView):
(WebView::setSmartInsertDeleteEnabled):
(WebView::smartInsertDeleteEnabled):
(WebView::setSelectTrailingWhitespaceEnabled):
(WebView::isSelectTrailingWhitespaceEnabled):
* WebView.h:
(WebView):

Source/WebKit/wince:

Use new settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.

* WebCoreSupport/EditorClientWinCE.cpp:
(WebKit::EditorClientWinCE::smartInsertDeleteEnabled):
(WebKit::EditorClientWinCE::isSelectTrailingWhitespaceEnabled):

Source/WebKit/wx:

Use new settings for smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled.

* WebKitSupport/EditorClientWx.cpp:
(WebCore::EditorClientWx::smartInsertDeleteEnabled):
(WebCore::EditorClientWx::isSelectTrailingWhitespaceEnabled):

Tools:

Removes all the code related to smartInsertDeleteEnabled and
selectTrailingWhitespaceEnabled settings as they will be managed from
internals from now on.

* DumpRenderTree/TestRunner.cpp:
(TestRunner::staticFunctions):
* DumpRenderTree/TestRunner.h:
(TestRunner):
* DumpRenderTree/blackberry/DumpRenderTree.cpp:
(WebKit):
(BlackBerry::WebKit::DumpRenderTree::resetToConsistentStateBeforeTesting):
* DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h:
(DumpRenderTree):
* DumpRenderTree/blackberry/TestRunnerBlackBerry.cpp:
* DumpRenderTree/chromium/TestRunner/public/WebTestProxy.h:
(WebTestRunner::WebTestProxy::didStopLoading):
* DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp:
(WebTestRunner::TestRunner::TestRunner):
(WebTestRunner::TestRunner::reset):
* DumpRenderTree/chromium/TestRunner/src/TestRunner.h:
(TestRunner):
* DumpRenderTree/chromium/TestRunner/src/WebPreferences.cpp:
(WebTestRunner::WebPreferences::applyTo): Set default values for
smartInsertDeleteEnabled and selectTrailingWhitespaceEnabled settings as
Chromium DRT default values are different from Chromium browser.
* DumpRenderTree/chromium/TestRunner/src/WebTestProxy.cpp:
* DumpRenderTree/chromium/WebViewHost.cpp:
* DumpRenderTree/chromium/WebViewHost.h:
(WebViewHost):
* DumpRenderTree/efl/DumpRenderTreeChrome.cpp:
(DumpRenderTreeChrome::resetDefaultsToConsistentValues):
* DumpRenderTree/efl/TestRunnerEfl.cpp:
* DumpRenderTree/gtk/DumpRenderTree.cpp:
(resetDefaultsToConsistentValues):
* DumpRenderTree/gtk/TestRunnerGtk.cpp:
* DumpRenderTree/mac/DumpRenderTree.mm:
(resetWebViewToConsistentStateBeforeTesting):
* DumpRenderTree/mac/TestRunnerMac.mm:
* DumpRenderTree/qt/DumpRenderTreeQt.cpp:
(WebCore::WebPage::resetSettings):
* DumpRenderTree/qt/TestRunnerQt.cpp:
* DumpRenderTree/qt/TestRunnerQt.h:
(TestRunnerQt):
* DumpRenderTree/win/DumpRenderTree.cpp:
(resetWebViewToConsistentStateBeforeTesting):
* DumpRenderTree/win/TestRunnerWin.cpp:
* DumpRenderTree/wx/TestRunnerWx.cpp:

LayoutTests:

Replace testRunner.setSelectTrailingWhitespaceEnabled by
internals.settings.setSelectTrailingWhitespaceEnabled in tests.

Be sure that trailingWhitespaceEnabled and
selectTrailingWhitespaceEnabled are set to opposite values as they are
mutually exclusive.

* editing/deleting/smart-editing-disabled.html:
* editing/selection/doubleclick-beside-cr-span.html:
* editing/selection/doubleclick-whitespace-crash.html:
* editing/selection/doubleclick-whitespace-img-crash.html:
* editing/selection/doubleclick-whitespace.html:
* editing/selection/script-tests/doubleclick-inline-first-last-contenteditable.js:
* editing/spelling/resources/util.js:
(initSpellTest):
* editing/spelling/spelling-double-clicked-word-with-underscores.html:
* editing/spelling/spelling-double-clicked-word.html:
* platform/wk2/TestExpectations: Unflag
editing/selection/doubleclick-inline-first-last-contenteditable.html
as it passes now.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145849 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed test expectations updates. Suppressed a couple of
failures and adjusted a couple of existing expectations.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145850 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Character orientation should follow UTR50 specs for vertical layout.
https://bugs.webkit.org/show_bug.cgi?id=112213
<rdar://problem/12880943>

Reviewed by Ryosuke Niwa.

Source/WebCore: 

platform/mac/fast/text/vertical-no-sideways.html: Modified to cover samples
of the additional character ranges that should not be rotated in vertical layout.
Added pixel results.

This patch modifies shouldIgnoreRotation to include all the characters that
should not be rotated sideways in vertical layout according to the UTR50 draft 6
specifications. It also fixes rotation for Emojii.

* platform/graphics/FontFastPath.cpp:
(WebCore::shouldIgnoreRotation):
(WebCore::isInRange): Added.
* platform/graphics/mac/FontMac.mm:
(WebCore::showGlyphsWithAdvances): Adds the proper transforms to ensure
Emojii also are drawn correctly upright.

LayoutTests: 

* platform/mac/fast/text/vertical-no-sideways.html: Modified to cover samples
of the additional character ranges that should not be rotated in vertical layout.
* platform/mac/platform/mac/fast/text/vertical-no-sideways-expected.txt:
* platform/mac/platform/mac/fast/text/vertical-no-sideways-expected.png: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145854 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Make zoom filter independent of the layer size.
https://bugs.webkit.org/show_bug.cgi?id=112221

Reviewed by Stephen White.

Source/Platform:

Make the zoom filter hold a zoom amount and an inset.

* chromium/public/WebFilterOperation.h:
(WebKit::WebFilterOperation::zoomInset):
(WebFilterOperation):
(WebKit::WebFilterOperation::createZoomFilter):
(WebKit::WebFilterOperation::setZoomInset):
(WebKit::WebFilterOperation::WebFilterOperation):

Source/WebKit/chromium:

* tests/FilterOperationsTest.cpp:
(WebKit):
(WebKit::TEST):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145855 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Check to ensure MultisampleRenderbuffer creation succeeds
https://bugs.webkit.org/show_bug.cgi?id=111780

Patch by Brandon Jones <bajones@google.com> on 2013-03-14
Reviewed by Kenneth Russell.

On OSX systems using AMD graphics chips the allocation of large
Multisample Renderbuffers in Chromium would fail without any indication
of failure. Attempting to draw to the buffer resulted in garbage being
rendered onscreen. This could be reproduced by opening a full-page
WebGL app and pressing (Command + "-") several times. This patch adds an
additional check during DrawingBuffer resize to verify that the resized
buffer is valid.

* platform/graphics/gpu/DrawingBuffer.cpp:
(WebCore):
(WebCore::DrawingBuffer::checkBufferIntegrity):
(WebCore::DrawingBuffer::reset):
* platform/graphics/gpu/DrawingBuffer.h:
(DrawingBuffer):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145856 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix flaky layout tests that rely on setTimeout()s firing after <body> is parsed
https://bugs.webkit.org/show_bug.cgi?id=112306

Reviewed by Eric Seidel.

These tests all rely in one way or another on the body of a setTimeout set in an inline <script> in the <head>
firing after the <body> element is generated by the HTML parser. This is a flaky pattern since the HTML parser
may yield when parsing a </script> or when runnnig out of bytes from the network. In practice, this pattern used
to be not terribly flaky for layout tests loaded from disk unless there was a large GC pause. However, since the
threaded HTML parser yields more frequently when hitting a </script> this flakes more.

These tests were found by identifying layout tests that call setTimeout before the document's body exists by
modifying the code, then intersecting that set with tests that are flaky on the chromium flakiness dashboard.

* editing/inserting/insert-text-into-empty-frameset-crash.html:
* editing/style/apply-style-crash.html:
* fast/block/float/float-originating-line-deleted-crash.html:
* fast/block/float/floats-not-cleared-crash.html:
* fast/block/line-layout/inline-box-wrapper-crash.html:
* fast/css/positioned-in-relative-position-inline-crash.html:
* fast/css/user-stylesheet-crash.html:
* fast/encoding/script-in-head.html:
* fast/forms/textarea-placeholder-relayout-assertion.html:
* fast/frames/seamless/seamless-form-get.html:
* fast/frames/seamless/seamless-form-post-named.html:
* fast/frames/seamless/seamless-window-location-href.html:
* fast/frames/seamless/seamless-window-location-replace.html:
* fast/inline/update-always-create-line-boxes-full-layout-crash.html:
* fast/innerHTML/innerHTML-iframe.html:
* fast/js/same-origin-subframe-about-blank.html:
* fast/multicol/span/removal-of-multicol-span-crash.html:
* fast/text/international/bidi-neutral-in-mixed-direction-run-crash.html:
* fast/writing-mode/overhanging-float-legend-crash.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145857 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed gardening. Added images for new test.

* platform/chromium-mac-lion/platform/chromium/scrollbars/short-scrollbar-expected.png: Added.
* platform/chromium-mac-snowleopard/platform/chromium/scrollbars/short-scrollbar-expected.png: Added.
* platform/chromium-mac/platform/chromium/scrollbars/short-scrollbar-expected.png: Added.
* platform/chromium-win/platform/chromium/scrollbars/short-scrollbar-expected.png: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145858 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build: Remove XSLT option and depend hard on XSLT.
You will now not be able to give --disable-xslt or --enable-xslt
because it is not optional anymore.
https://bugs.webkit.org/show_bug.cgi?id=112368

Patch by Tobias Mueller <tobiasmue@gnome.org> on 2013-03-14
Reviewed by Martin Robinson.

* Source/autotools/FindDependencies.m4:
    Always check for libxslt

* Source/autotools/PrintBuildConfiguration.m4:
    Removed printing out the value of XSLT

* Source/autotools/ReadCommandLineArguments.m4:
    Removed reading XSLT options

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145859 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r145000): Crash loading arstechnica.com when Safari Web Inspector is open
https://bugs.webkit.org/show_bug.cgi?id=111868

Reviewed by Antti Koivisto.

Don't allow non-local property lookup when the debugger is enabled.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::resolve):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145860 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Cleanup: Remove g_resourceLoader.
https://bugs.webkit.org/show_bug.cgi?id=112305

Reviewed by Dirk Pranke.

Removing another global.

Now, each dashboard creates its own loader, rather than having
a general global one.

Remove usage of g_resourceLoader.isLoadingComplete from
handleLocationChange by ensuring that handleLocationChange is
never called before the loader is done.  It was called in two
places before: 1 was from the callback when the loader is done,
so that was obviously true, and the other was from onhashchange,
where it would just return rather than running.  Instead, lets
only register the onhashchange handler once the loader is
setup, so the check is no longer necessary.

Remove isLoadingComplete since it is now unused.

Callback for loader is now initializeHistory, rather than just
handleLocationChange which will set up the hashchange handler now.
This will all eventually be moving to a new History object.

* TestResultServer/static-dashboards/aggregate_results.html:
* TestResultServer/static-dashboards/dashboard_base.js:
(handleLocationChange):
(intializeHistory):
(decompressResults):
* TestResultServer/static-dashboards/flakiness_dashboard.js:
(generatePage):
* TestResultServer/static-dashboards/loader.js:
(.):
* TestResultServer/static-dashboards/loader_unittests.js:
* TestResultServer/static-dashboards/timeline_explorer.html:
* TestResultServer/static-dashboards/treemap.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145861 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed test expectations update. Expanded suppression.

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145862 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL][MiniBrowser] Add a search field to the MiniBrowser
https://bugs.webkit.org/show_bug.cgi?id=112122

Patch by Jinwoo Song <jinwoo7.song@samsung.com> on 2013-03-14
Reviewed by Kenneth Rohde Christiansen.

Implement a search field to test API ewk_view_text_find() and add a shortcut 'ctrl' + f.

* MiniBrowser/efl/main.c:
(_Browser_Window):
(search_box_show):
(search_box_hide):
(on_key_down):
(on_url_changed):
(on_search_field_aborted):
(on_search_field_activated):
(on_search_field_clicked):
(on_search_backward_button_clicked):
(on_search_forward_button_clicked):
(window_create):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145863 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash at CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement reported by fuzzer
https://bugs.webkit.org/show_bug.cgi?id=112328

Reviewed by Dimitri Glazkov.

Source/WebCore:

ensureDefaultStyleSheets should check whether page() is null or not.

Test: fast/css/ensure-default-style-sheets-crash.xhtml

* css/CSSDefaultStyleSheets.cpp:
(WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement):

LayoutTests:

* fast/css/ensure-default-style-sheets-crash-expected.txt: Added.
* fast/css/ensure-default-style-sheets-crash.xhtml: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145864 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Shadow]: left side of ::-webkit-distributed selector not working as expected
https://bugs.webkit.org/show_bug.cgi?id=110825

Reviewed by Dimitri Glazkov.

Source/WebCore:

Make functional pseudo distributed elements work even when a left side element has specifiers.

Test: fast/dom/shadow/distributed-pseudo-element-specifiers-in-left-side.html

* css/CSSParser.cpp:
(WebCore::CSSParser::rewriteSpecifiersWithNamespaceIfNeeded):
Make it call rewriteSpecifiersForShadowDistributed() if required.

(WebCore::CSSParser::rewriteSpecifiersWithElementName):
Updated so that it can generate a correct chain of
CSSParserSelectors even when '::distributed()' is used with an
element, which might be empty, with specifiers.

e.g. When parsing a selector of 'content.content-class::-webkit-distributed(div)', the following happens:

1. rewriteSpecifiersWithElementName(...) is called with:

   elementName is: "content"
   specifiers is: [.content-class] -> [::-webkit-distributed]

2. Looking for a distributed pseudo element in the specifiers and
   found it at the end of tagHistory chain of the specifiers.

3. The result of calling specifiers->prependTagSelector(tag) is:

   specifiers is: [content] -> [.content-class] -> [::-webkit-distributed]

4. rewriteSpecifiersForShadowDistributed() is called with:

   specifiers is: [content] -> [.content-class] -> [::-webkit-distributed]
   distributedPseudoElementSelector is: [::-webkit-distributed]

5. An argumentSelector of the distributedPseudoElementSelector is:

   argumentSelector is: [div]

6. Remove the distributed pseudo element selector from the specifiers.

   specifiers is: [content] -> [.content-class]

   Note that one pseudo-element may appear per complex selector
   and the pseudo-element may appear only if the subject of the
   selector is the last compound selector in the selector.

7. Append specifiers to the end of the argument selector with a relation of ShadowDistributed:

   argumentSelector is: [div] -(ShadowDistributed)-> [content] -> [.content-class]

8. Returns the argument selector as a return value.

(WebCore::CSSParser::rewriteSpecifiersForShadowDistributed): As explained.
* css/CSSParserValues.cpp:
(WebCore):
(WebCore::CSSParserSelector::findDistributedPseudoElementSelector):
* css/CSSParserValues.h:
(CSSParserSelector):
(WebCore::CSSParserSelector::clearTagHistory):

LayoutTests:

* fast/dom/shadow/distributed-pseudo-element-specifiers-in-left-side-expected.html: Added.
* fast/dom/shadow/distributed-pseudo-element-specifiers-in-left-side.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145865 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Crash when removing aria-menu item from DOM
https://bugs.webkit.org/show_bug.cgi?id=112396

Reviewed by Tim Horton.

Source/WebCore:

Prevent nil access to items in the ARIA menu flow when deleting
objects from the DOM.

Test: accessibility/menu-item-crash.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::siblingWithAriaRole):
(WebCore::AccessibilityNodeObject::menuButtonForMenu):

LayoutTests:

* accessibility/menu-item-crash-expected.txt: Added.
* accessibility/menu-item-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145866 268f45cc-cd09-0410-ab3c-d52691b4dbfc
plugins/plugin-clip-subframe.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=112324

Patch by John Bauman <jbauman@chromium.org> on 2013-03-14
Reviewed by Ryosuke Niwa.

Ignore duplicate SetWindow calls with identical arguments. Plugins
will ignore these so they're not a problem, and they can cause
flakiness on mac-wk2.

* platform/chromium-linux/plugins/plugin-clip-subframe-expected.txt:
* platform/chromium-mac/plugins/plugin-clip-subframe-expected.txt:
* platform/chromium-win/plugins/plugin-clip-subframe-expected.txt:
* platform/mac-wk2/plugins/plugin-clip-subframe-expected.txt:
* platform/mac/plugins/plugin-clip-subframe-expected.txt:
* plugins/plugin-clip-subframe-expected.txt:
* plugins/resources/plugin-clip-subframe-iframe.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145868 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r145169): [Mac][WK2] http/tests/security/cross-frame-access-put.html fails.
<http://webkit.org/b/111815>
<rdar://problem/13380145>

Reviewed by Anders Carlsson.

Source/WebKit2:

Call getWindowFrame() to see if the UI client wants to override the window frame before sending
a WindowAndViewFramesChanged message to the web process.
This fixes a glitch in WTR and the Web Inspector where incorrect window frames were being used.

* UIProcess/mac/WebPageProxyMac.mm:
(WebKit::WebPageProxy::windowAndViewFramesChanged):

Tools:

Add PlatformWebView::didInitializeClients() and call it after setting up all the clients
after creating a PlatformWebView. Otherwise, the initial WindowAndViewFramesChanged message
will be sent before there's a UI client set up to adjust the frame with WTR's fake origin.

* WebKitTestRunner/PlatformWebView.h:
(PlatformWebView):
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::createOtherPage):
(WTR::TestController::createWebViewWithOptions):
* WebKitTestRunner/mac/PlatformWebViewMac.mm:
(WTR::PlatformWebView::didInitializeClients):

LayoutTests:

* platform/mac-wk2/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145869 268f45cc-cd09-0410-ab3c-d52691b4dbfc