Eliminate HostCall bit from JSC Stack CallerFrame
https://bugs.webkit.org/show_bug.cgi?id=123642

Reviewed by Geoffrey Garen.

Source/JavaScriptCore: 

Replace the HostCallFrame bit or'ed to the CallerFrame value in a CallFrame with
a VM entry sentinel CallFrame.  Logically, the VM entry sentinel call frame is
pushed on the stack before the callee frame when calling from native to JavaScript
code.  The callee frame's CallerFrame points at the VM entry sentinel call frame
and the VM entry sentinel call frame's CallerFrame points to the real caller.
The VM entry sentinel call frame has a sentinel (1) in the CodeBlock to indicate
its a VM entry sentinel call frame.  It's ScopeChain has vm.topCallFrame at the
time of the call.  This allows for a complete stack walk as well as walking just
the contiguous JS frames.

The VM entry sentinel call frame and callee frame are currently allocated and
initialized in ExecState::init(), but this initialization will be moved to
ctiTrampoline when we actually move onto the native stack.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::noticeIncomingCall):
* debugger/DebuggerCallFrame.cpp:
(JSC::DebuggerCallFrame::callerFrame):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compileExceptionHandlers):
* interpreter/CallFrame.h:
(JSC::ExecState::frameExtent):
(JSC::ExecState::currentVPC):
(JSC::ExecState::setCurrentVPC):
(JSC::ExecState::init):
(JSC::ExecState::noCaller):
(JSC::ExecState::isVMEntrySentinel):
(JSC::ExecState::vmEntrySentinelCallerFrame):
(JSC::ExecState::initializeVMEntrySentinelFrame):
(JSC::ExecState::callerFrameSkippingVMEntrySentinel):
(JSC::ExecState::vmEntrySentinelCodeBlock):
* interpreter/Interpreter.cpp:
(JSC::unwindCallFrame):
(JSC::Interpreter::getStackTrace):
* interpreter/Interpreter.h:
(JSC::TopCallFrameSetter::TopCallFrameSetter):
(JSC::TopCallFrameSetter::~TopCallFrameSetter):
(JSC::NativeCallFrameTracer::NativeCallFrameTracer):
* interpreter/JSStack.cpp:
(JSC::JSStack::~JSStack):
* interpreter/JSStackInlines.h:
(JSC::JSStack::getStartOfFrame):
(JSC::JSStack::pushFrame):
(JSC::JSStack::popFrame):
* interpreter/Register.h:
(JSC::Register::operator=):
(JSC::Register::callFrame):
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::readFrame):
(JSC::StackVisitor::readNonInlinedFrame):
(JSC::StackVisitor::readInlinedFrame):
(JSC::StackVisitor::Frame::print):
* interpreter/VMInspector.cpp:
(JSC::VMInspector::countFrames):
* jit/JIT.cpp:
(JSC::JIT::privateCompileExceptionHandlers):
* jit/JITOperations.cpp:
* jit/JITStubsARM.h:
(JSC::ctiTrampoline):
* jit/JITStubsARM64.h:
* jit/JITStubsARMv7.h:
(JSC::ctiTrampoline):
* jit/JITStubsMIPS.h:
* jit/JITStubsMSVC64.asm:
* jit/JITStubsSH4.h:
* jit/JITStubsX86.h:
* jit/JITStubsX86_64.h:
* jsc.cpp:
(functionDumpCallFrame):
* llint/LowLevelInterpreter.cpp:
(JSC::CLoop::execute):
* runtime/VM.cpp:
(JSC::VM::VM):
(JSC::VM::throwException):

Source/WebCore: 

Updated JavaScript stack walking as a result of the corresponding changes made in
JavaScriptCore.

* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy):
* bindings/js/ScriptDebugServer.cpp:
(WebCore::ScriptDebugServer::stepOutOfFunction):
(WebCore::ScriptDebugServer::returnEvent):
(WebCore::ScriptDebugServer::didExecuteProgram):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158586 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make LiveNodeListBase use Elements instead of Nodes
https://bugs.webkit.org/show_bug.cgi?id=123745

Reviewed by Anders Carlsson.

* WebCore.exp.in:
* dom/Element.cpp:
(WebCore::Element::firstElementChild):
(WebCore::Element::lastElementChild):
        
    Switch to correct calls. ElementTraversal::previous and previousChild are no longer equivalent.

* dom/ElementTraversal.h:
(WebCore::::lastWithinTemplate):
(WebCore::::previousTemplate):
        
    Fix ElementTraversal::lastWithin and previous. They had no real clients and didn't work correctly.
    With LiveNodeListBase starting to use these they get excellent test coverage.

* dom/LiveNodeList.cpp:
(WebCore::LiveNodeListBase::invalidateCache):
* dom/LiveNodeList.h:
(WebCore::LiveNodeListBase::LiveNodeListBase):
(WebCore::LiveNodeListBase::isElementCacheValid):
(WebCore::LiveNodeListBase::cachedElement):
(WebCore::LiveNodeListBase::cachedElementOffset):
(WebCore::LiveNodeListBase::setCachedElement):
        
    Make the cache Element based.
    Switch to Elements in all helpers.
    Rename item -> element for clarity.

* dom/NodeIterator.cpp:
(WebCore::NodeIterator::NodePointer::moveToPrevious):
(WebCore::NodeIterator::updateForNodeRemoval):
        
    This code expected the old inconsistent NodeTraversal::previous behavior where the traversal includes
    the root as the last item. Drop the stayWithin parameter and handle the one case where it is needed here.

* dom/NodeTraversal.cpp:
(WebCore::NodeTraversal::last):
(WebCore::NodeTraversal::deepLastChild):
* dom/NodeTraversal.h:
        
    Support ElementTraversal::previous/lastWithin.

(WebCore::NodeTraversal::previous):
        
    This was slightly wrong too.

* html/HTMLCollection.cpp:
(WebCore::previousElement):
(WebCore::lastElement):
(WebCore::LiveNodeListBase::iterateForPreviousElement):
(WebCore::LiveNodeListBase::itemBefore):
(WebCore::LiveNodeListBase::isLastItemCloserThanLastOrCachedItem):
(WebCore::LiveNodeListBase::isFirstItemCloserThanCachedItem):
(WebCore::LiveNodeListBase::setCachedElement):
(WebCore::LiveNodeListBase::item):
(WebCore::LiveNodeListBase::elementBeforeOrAfterCachedElement):
* html/HTMLCollection.h:
(WebCore::HTMLCollection::isEmpty):
(WebCore::HTMLCollection::hasExactlyOneItem):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158587 268f45cc-cd09-0410-ab3c-d52691b4dbfc
More WKRemoteObjectRegistry work
https://bugs.webkit.org/show_bug.cgi?id=123754

Reviewed by Dan Bernstein.

Source/WebKit2:

* Shared/API/Cocoa/WKRemoteObjectCoder.h:
* Shared/API/Cocoa/WKRemoteObjectCoder.mm:
(-[WKRemoteObjectEncoder rootObjectDictionary]):
Add a getter for the root object dictionary.

* Shared/API/Cocoa/WKRemoteObjectRegistry.mm:
(-[WKRemoteObjectRegistry _sendInvocation:interface:]):
Call _sendMessageWithBody:.
(-[WKRemoteObjectRegistry _sendMessageWithBody:]):
Call WebConnection::postMessage.

Tools:

* TestWebKitAPI/Tests/WebKit2ObjC/WKRemoteObjectRegistry.mm:
(TestWebKitAPI::TEST):
Use the correct bundle test name. Call Util::run.

* TestWebKitAPI/Tests/mac/WKRemoteObjectRegistry_Bundle.mm:
(-[BundleObject sayHello]):
(-[BundleObject testMethodWithString:double:integer:]):
Add BundleObject implementation. Register the bundle object with
the remote object registry. Call _handleMessageWithName:body: on the incoming message.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158595 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] image valued shape element margin can cause an ASSERT fail
https://bugs.webkit.org/show_bug.cgi?id=123743

Reviewed by Andreas Kling.

Source/WebCore:

When margin-top is specified for a shape's element, the Y coordinates passed
to RasterShapeIntervals::getExcludedIntervals() may be negative. This is
because the incoming logical coordinates are relative to the content or
padding box, depending on the box-sizing property. The RasterShape::getExcludedIntervals()
method now clips the incoming Y coordinates to the shape's bounds before
accessing the shape's intervals.

Test: fast/shapes/shape-outside-floats/shape-outside-floats-margin-crash.html

* rendering/shapes/RasterShape.cpp:
(WebCore::RasterShapeIntervals::getExcludedIntervals):

LayoutTests:

Verify that an element with an image valued shape and a non-negative margin
does not cause an assertion failure.

* fast/shapes/shape-outside-floats/shape-outside-floats-margin-crash-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-margin-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158596 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[MSE] [Mac] Disclaim support for MSE in AVFoundation and QTKit engines
https://bugs.webkit.org/show_bug.cgi?id=123593

Reviewed by Eric Carlson.

Immediately fail if asked to load a Media Source in engines which do not support
them.

* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
(WebCore::MediaPlayerPrivateAVFoundation::load):
* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
(WebCore::MediaPlayerPrivateAVFoundationObjC::supportsType):
* platform/graphics/mac/MediaPlayerPrivateQTKit.h:
* platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
(WebCore::MediaPlayerPrivateQTKit::load):
(WebCore::MediaPlayerPrivateQTKit::supportsType):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158597 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r158561): fast/block/float/float-append-child-crash.html asserting.

The non-const ancestor iterator was walking siblings, not ancestors.

Rubber-stamped by Antti Koivisto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158598 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[PluginProxy] Add a setting to disable video plugin proxy support in HTMLMediaElement.
https://bugs.webkit.org/show_bug.cgi?id=123621

Reviewed by Eric Carlson.

Source/WebCore:

Add a new Setting which will disable the video plugin proxy. Enable support for AVFoundation
in iOS (which requries fixing a few compile errors resulting from classes and methods which
are not available on iOS.

* WebCore.exp.in: Export wkAVAssetResolvedURL.
* css/StyleResolver.cpp:
(WebCore::StyleResolver::canShareStyleWithElement): Make conditional upon
    new isVideoPluginProxyEnabled() setting.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::parseAttribute): Ditto.
* html/HTMLMediaElement.h:
* html/HTMLVideoElement.cpp:
(WebCore::HTMLVideoElement::createRenderer): Ditto.
(WebCore::HTMLVideoElement::attach): Ditto.
(WebCore::HTMLVideoElement::parseAttribute): Ditto.
(HTMLVideoElement::setDisplayMode): Ditto.
* html/HTMLVideoElement.h:
* page/Settings.cpp:
(WebCore::Settings::setVideoPluginProxyEnabled): Simple setter.
* page/Settings.h:
(WebCore::Settings::isVideoPluginProxyEnabled): Simple getter.
* platform/graphics/MediaPlayer.cpp:
(WebCore::installedMediaEngines): Conditionally add MediaPlayerPrivateIOS and always add
    MediaPlayerPriateAVFoundationObjC.
* platform/graphics/MediaPlayerPrivate.h:
(WebCore::MediaPlayerPrivateInterface::deliverNotification): Add default implementation.
(WebCore::MediaPlayerPrivateInterface::setMediaPlayerProxy): Ditto.
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
(WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): Use new
    HAS_ and USE_ macros instead of __MAC_OS_MIN_VERNSION_REQUIRED.
(WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC): Ditto.
(WebCore::MediaPlayerPrivateAVFoundationObjC::hasContextRenderer): Ditto.
(WebCore::MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer): Ditto.
(WebCore::MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer): Ditto.
(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Ditto.
(WebCore::MediaPlayerPrivateAVFoundationObjC::paint): Ditto.
(WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer): Use cachedCGColor instead
    of CGColorGetConstantColor.
(WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput): Use CVPixelBuffer pixel
    format constant instead of QuickDraw constant.
(WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer): Ditto.
(WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput): Draw to intermediary
    CGImage on iOS.
* platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
* platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
* platform/ios/WebCoreSystemInterfaceIOS.mm:
* platform/mac/WebCoreSystemInterface.h:

Source/WebKit/mac:

Add a new isVideoPluginProxyEnabled setting.

* WebView/WebPreferenceKeysPrivate.h:
* WebView/WebPreferences.mm:
(+[WebPreferences initialize]): Set isVideoPluginProxyEnabled preference.
(-[WebPreferences isVideoPluginProxyEnabled]): Pass through to Settings.
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(-[WebView _preferencesChanged:]): Set isVideoPluginProxyEnabled preference.

Source/WebKit2:

Add WebKit2 functions for setting then new isVideoPluginProxyEnabled preference.

* Shared/WebPreferencesStore.h:
* UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetVideoPluginProxyEnabled):
(WKPreferencesGetVideoPluginProxyEnabled):
* UIProcess/API/C/WKPreferences.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences):

Source/WTF:

Enable WTF_USE_AVFOUNDATION and add some HAVE_AVFOUNDATION_* defines
to replace the existing __MAC_OS_X_VERSION_MIN_REQUIRED macros in
MediaPlayerPrivateAVFoundationObjC.mm.

* wtf/Platform.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158599 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2] Update WebGeolocationManager to support multiple WebContent processes
https://bugs.webkit.org/show_bug.cgi?id=123658

Patch by Benjamin Poulain <bpoulain@apple.com> on 2013-11-04
Reviewed by Anders Carlsson.

Change WebGeolocationManagerProxy to track which WebProcessProxy needs geolocation.

* UIProcess/WebContext.cpp:
(WebKit::WebContext::disconnectProcess):
WebContext::disconnectProcess does not handle ContextSupplement yet when using multiple
WebContent processes. Add an explicit call for WebGeolocationManagerProxy as a temporary
solution.

* UIProcess/WebGeolocationManagerProxy.cpp:
(WebKit::WebGeolocationManagerProxy::WebGeolocationManagerProxy):
(WebKit::WebGeolocationManagerProxy::contextDestroyed):
(WebKit::WebGeolocationManagerProxy::processDidClose):
(WebKit::WebGeolocationManagerProxy::startUpdating):
(WebKit::WebGeolocationManagerProxy::stopUpdating):
(WebKit::WebGeolocationManagerProxy::removeRequester):
* UIProcess/WebGeolocationManagerProxy.h:
* UIProcess/WebGeolocationManagerProxy.messages.in:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158600 268f45cc-cd09-0410-ab3c-d52691b4dbfc
../WebKit: [Win] Use VersionStamper for official builds
https://bugs.webkit.org/show_bug.cgi?id=123758

Reviewed by Tim Horton.

* WebKit.vcxproj/WebKit/WebKitPostBuild.cmd: Restore command to
call VersionStamper on final stage of build.

../WTF: [Win] User VersionStamper for official builds
https://bugs.webkit.org/show_bug.cgi?id=123758

Reviewed by Tim Horton.

* WTF.vcxproj/WTFPostBuild.cmd: Add missing command to run VersionStamper.exe.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158602 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[MSE] Add a SourceBufferPrivateClient interface for platform -> html communication.
https://bugs.webkit.org/show_bug.cgi?id=123373

Reviewed by Eric Carlson.

To enable communication between SourceBuffer and SourceBufferPrivate without introducing
layering violations, add a new interface class SourceBufferPrivateInterface from which
SourceBuffer will inherit.

* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::SourceBuffer): Set the private's client.
(WebCore::SourceBuffer::~SourceBuffer): Clear the private's client.
(WebCore::SourceBuffer::sourceBufferPrivateDidEndStream): Added stub.
(WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment): Hinno.
(WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Ditto.
(WebCore::SourceBuffer::sourceBufferPrivateHasAudio): Ditto.
(WebCore::SourceBuffer::sourceBufferPrivateHasVideo): Ditto.
* Modules/mediasource/SourceBuffer.h:
* WebCore.xcodeproj/project.pbxproj: Add new files to project.
* platform/graphics/SourceBufferPrivate.h:
* platform/graphics/SourceBufferPrivateClient.h: Added.
(WebCore::SourceBufferPrivateClient::~SourceBufferPrivateClient): Empty destructor.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158606 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG NewArray/NewArrayBuffer shouldn't be constructing with negative indexing
https://bugs.webkit.org/show_bug.cgi?id=123760
<rdar://problem/15356705>

Reviewed by Mark Hahnenberg and Oliver Hunt.

Source/JavaScriptCore: 

* dfg/DFGOperations.cpp:

LayoutTests: 

* js/dfg-new-array-buffer-while-having-a-bad-time-expected.txt: Added.
* js/dfg-new-array-buffer-while-having-a-bad-time.html: Added.
* js/dfg-new-array-while-having-a-bad-time-expected.txt: Added.
* js/dfg-new-array-while-having-a-bad-time.html: Added.
* js/script-tests/dfg-new-array-buffer-while-having-a-bad-time.js: Added.
(foo):
* js/script-tests/dfg-new-array-while-having-a-bad-time.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158608 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WKRemoteObjectEncoder should escape keys
https://bugs.webkit.org/show_bug.cgi?id=123761

Reviewed by Tim Horton.

Keys that start with $ will be reserved for use by the coder, so prepend an extra
$ to keys that already start with $ to avoid clashes.

* Shared/API/Cocoa/WKRemoteObjectCoder.mm:
(escapeKey):
(-[WKRemoteObjectEncoder encodeBytes:length:forKey:]):
(-[WKRemoteObjectEncoder _encodeObjectForKey:usingBlock:]):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158610 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use RenderAncestorIterator in a couple of places.
<https://webkit.org/b/123725>

Take the ancestorsOfType<RenderMoo>() thingy out for a spin.

Found a bunch of parent chain walking loops that were really just
looking for the first ancestor renderer of a certain type.
They were a perfect fit for this pattern:

    if (auto svgRoot = ancestorsOfType<RenderSVGRoot>(renderer).first())
        svgRoot->shakeMoneyMaker();

Quite a bit clearer than the previous:

    for (auto ancestor = renderer.parent(); ancestor; ancestor = ancestor->parent()) {
        if (ancestor->isSVGRoot())
            toRenderSVGRoot(ancestor)->makeMoneyShaker();
    }

Reviewed by Antti Koivisto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158611 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r158586): plugins/refcount-leaks.html fails
https://bugs.webkit.org/show_bug.cgi?id=123765

Add the test expectation.

* TestExpectations:
* platform/wk2/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158614 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change structure of frame tree in WINCE port.
https://bugs.webkit.org/show_bug.cgi?id=121079

Patch by Zhuang Zhigang <zhuangzg@cn.fujitsu.com> on 2013-11-04
Reviewed by Darin Adler.

* WebCoreSupport/FrameLoaderClientWinCE.cpp:
(WebKit::FrameLoaderClientWinCE::createFrame):
* WebView.cpp:
(WebView::createFrame):
* WebView.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158616 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Mail attachments at the start of an email are not output by VoiceOver
https://bugs.webkit.org/show_bug.cgi?id=123697

Reviewed by Ryosuke Niwa.

Source/WebCore: 

VoiceOver is expecting that "replaced elements" (attachments in a Mail message in this case) to be
represented by the replacement character when asking for a stringForRange.

However, when that replaced element is at the beginning of the document, the logic does not work because
there is a few code places that will take that first Position and advance it forward, not accounting for replaced elements.
When using the TextIterator normally, it does account for these, so that's why it's only affecting as at the beginning of the document.

Also a "replaced element" can be more than just renderer->isReplaced(), hence the externing of the isRendererReplacedElement method
and using that it in pertinent places.

Tests: platform/mac/accessibility/object-replacement-with-no-rendered-children-at-node-start.html
       platform/mac/accessibility/object-replacement-with-rendered-children-at-node-start.html

* accessibility/AccessibilityObject.cpp:
(WebCore::replacedNodeNeedsCharacter):
* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(nsStringForReplacedNode):
* dom/Position.cpp:
(WebCore::Position::isCandidate):
* dom/PositionIterator.cpp:
* dom/Range.cpp:
(WebCore::Range::firstNode):
* editing/TextIterator.cpp:
(WebCore::isRendererReplacedElement):
* editing/TextIterator.h:

LayoutTests: 

Add two flavors of this. One where the replaced element has rendered children and one where it does not,
which go down two different code paths.

* platform/mac/accessibility/object-replacement-with-no-rendered-children-at-node-start-expected.txt: Added.
* platform/mac/accessibility/object-replacement-with-no-rendered-children-at-node-start.html: Added.
* platform/mac/accessibility/object-replacement-with-rendered-children-at-node-start-expected.txt: Added.
* platform/mac/accessibility/object-replacement-with-rendered-children-at-node-start.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158617 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove PlatformCALayer::playerLayer
https://bugs.webkit.org/show_bug.cgi?id=123764

Reviewed by Sam Weinig.

Source/WebCore:

* platform/graphics/ca/PlatformCALayer.h:
* platform/graphics/ca/mac/PlatformCALayerMac.h:
* platform/graphics/ca/mac/PlatformCALayerMac.mm:
(PlatformCALayerMac::clone):
Remove playerLayer(), fold it into clone().

Source/WebKit2:

* WebProcess/WebPage/mac/PlatformCALayerRemote.cpp:
* WebProcess/WebPage/mac/PlatformCALayerRemote.h:
Remove playerLayer().


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158619 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fixing MediaStreamDescriptor addSource and addTrack methods
https://bugs.webkit.org/show_bug.cgi?id=123755

Patch by Thiago de Barros Lacerda <thiago.lacerda@openbossa.org> on 2013-11-04
Reviewed by Eric Carlson.

We must store the track and source that is passed as parameter in a RefPtr,
otherwise we will refer to a null pointer.

No new tests needed.

* platform/mediastream/MediaStreamDescriptor.cpp:
(WebCore::MediaStreamDescriptor::addSource):
(WebCore::MediaStreamDescriptor::addTrack):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158620 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove code duplications in createFontCustomPlatformData()
https://bugs.webkit.org/show_bug.cgi?id=123706

Reviewed by Darin Adler.

Move OpenTypeSanitizer and WOFF handling from the port specific
implementations in createFontCustomPlatformData() into the only
caller of this function CachedFont::ensureCustomFontData().
Also change the parameter passing the SharedBuffer from a
pointer to a reference since it is never null.

* loader/cache/CachedFont.cpp:
(WebCore::CachedFont::ensureCustomFontData):
* platform/graphics/blackberry/FontCustomPlatformData.h:
* platform/graphics/blackberry/FontCustomPlatformDataBlackBerry.cpp:
(WebCore::FontCustomPlatformData::FontCustomPlatformData):
(WebCore::createFontCustomPlatformData):
* platform/graphics/cairo/FontCustomPlatformData.h:
* platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
(WebCore::FontCustomPlatformData::FontCustomPlatformData):
(WebCore::createFontCustomPlatformData):
* platform/graphics/mac/FontCustomPlatformData.cpp:
(WebCore::createFontCustomPlatformData):
* platform/graphics/mac/FontCustomPlatformData.h:
* platform/graphics/win/FontCustomPlatformData.cpp:
(WebCore::createFontCustomPlatformData):
* platform/graphics/win/FontCustomPlatformData.h:
* platform/graphics/win/FontCustomPlatformDataCairo.cpp:
(WebCore::createFontCustomPlatformData):
* platform/graphics/wince/FontCustomPlatformData.cpp:
(WebCore::createFontCustomPlatformData):
* platform/graphics/wince/FontCustomPlatformData.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158623 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r158311): media/media-fragments/TC0054.html and TC0061.html hit assertions
https://bugs.webkit.org/show_bug.cgi?id=123555

Reviewed by Darin Adler.

Source/WebCore:

No new tests, covered by existing tests.

* html/MediaFragmentURIParser.cpp:
(WebCore::MediaFragmentURIParser::parseFragments): Don't add a fragment with empty key or value as
    they will not processed.
(WebCore::MediaFragmentURIParser::parseNPTFragment): Remove excess whitespace.

LayoutTests:

* TestExpectations: Remove media/media-fragments/TC0054.html and media/media-fragments/TC0061.html.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158624 268f45cc-cd09-0410-ab3c-d52691b4dbfc