Heap-use-after-free in WebCore::DeleteButtonController::enable
https://bugs.webkit.org/show_bug.cgi?id=109447

Reviewed by Ryosuke Niwa.

RefPtr frame pointer since it can get deleted due to mutation events
fired inside AppendNodeCommand::doUnapply.

No new tests. Testcase is hard to minimize due to recursive
calls with DOMNodeRemovedFromDocument mutation event.

* editing/CompositeEditCommand.cpp:
(WebCore::EditCommandComposition::unapply):
(WebCore::EditCommandComposition::reapply):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142642 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] move text dump generation to TestRunner library
https://bugs.webkit.org/show_bug.cgi?id=109575

Reviewed by Adam Barth.

* DumpRenderTree/DumpRenderTree.gypi:
* DumpRenderTree/chromium/TestRunner/public/WebTestDelegate.h:
(WebKit):
(WebTestRunner::WebTestDelegate::captureHistoryForWindow):
* DumpRenderTree/chromium/TestRunner/public/WebTestProxy.h:
* DumpRenderTree/chromium/TestRunner/public/WebTestRunner.h:
(WebTestRunner):
* DumpRenderTree/chromium/TestRunner/src/TestCommon.cpp: Copied from Tools/DumpRenderTree/chromium/TestRunner/src/TestCommon.h.
(WebTestRunner::normalizeLayoutTestURL):
(WebTestRunner):
* DumpRenderTree/chromium/TestRunner/src/TestCommon.h:
(WebTestRunner):
* DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp:
(WebTestRunner::TestRunner::checkResponseMimeType):
(WebTestRunner):
(WebTestRunner::TestRunner::shouldDumpAsText):
(WebTestRunner::TestRunner::shouldGeneratePixelResults):
* DumpRenderTree/chromium/TestRunner/src/TestRunner.h:
(TestRunner):
* DumpRenderTree/chromium/TestRunner/src/WebPermissions.cpp:
* DumpRenderTree/chromium/TestRunner/src/WebTestProxy.cpp:
(WebTestRunner::WebTestProxyBase::captureTree):
(WebTestRunner):
* DumpRenderTree/chromium/TestShell.cpp:
(TestShell::dump):
(TestShell::captureHistoryForWindow):
* DumpRenderTree/chromium/TestShell.h:
(TestShell):
* DumpRenderTree/chromium/WebViewHost.cpp:
(WebViewHost::captureHistoryForWindow):
* DumpRenderTree/chromium/WebViewHost.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142643 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix.

Add back the files to the Xcode project that were removed in r142580.

* WebKit2.xcodeproj/project.pbxproj:
* WebProcess/Plugins/PluginProcessConnectionManager.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142644 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Background size width specified in viewport percentage units not working
https://bugs.webkit.org/show_bug.cgi?id=109536

Patch by Uday Kiran <udaykiran@motorola.com> on 2013-02-12
Reviewed by Antti Koivisto.

Source/WebCore:

Corrected the check for viewport percentage unit while calculating
background image width.

Test: fast/backgrounds/size/backgroundSize-viewportPercentage-width.html

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::calculateFillTileSize):

LayoutTests:

Added a test for background image width specified in viewport percentage unit.

* fast/backgrounds/size/backgroundSize-viewportPercentage-width-expected.html: Added.
* fast/backgrounds/size/backgroundSize-viewportPercentage-width.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142645 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK][Introspection] GObject bindings for DataTransferItemList - one add() method must be removed from .idl
https://bugs.webkit.org/show_bug.cgi?id=109180

Patch by Tomas Popela <tpopela@redhat.com> on 2013-02-12
Reviewed by Xan Lopez.

When compiling WebKit with --enable-introspection and generating GObject bindings
for DataTransferItemList we must disable one add() method, because GObject is
based on C and C does not allow two functions with the same name.

No tests needed.

* bindings/scripts/CodeGeneratorGObject.pm:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142646 268f45cc-cd09-0410-ab3c-d52691b4dbfc
rootRenderer in FrameView is really RenderView
https://bugs.webkit.org/show_bug.cgi?id=109510

Reviewed by Eric Seidel.

The global function rootRenderer(FrameView*) is really just a way
to get the RenderView from the Frame so replace it with a renderView()
method and replace usage of the word "root" with renderView so it's
obvious the root we're talking about is the renderView. This is an
important distinction to make since we also have rootRenderer in the code
for the documentElement()'s renderer and we also have a "layout root" which
is entirely different.

No new tests, just refactoring.

* page/FrameView.cpp:
(WebCore::FrameView::rootRenderer): Removed.
(WebCore::FrameView::setFrameRect):
(WebCore::FrameView::adjustViewSize):
(WebCore::FrameView::updateCompositingLayersAfterStyleChange):
(WebCore::FrameView::updateCompositingLayersAfterLayout):
(WebCore::FrameView::clearBackingStores):
(WebCore::FrameView::restoreBackingStores):
(WebCore::FrameView::usesCompositedScrolling):
(WebCore::FrameView::layerForHorizontalScrollbar):
(WebCore::FrameView::layerForVerticalScrollbar):
(WebCore::FrameView::layerForScrollCorner):
(WebCore::FrameView::tiledBacking):
(WebCore::FrameView::scrollLayerID):
(WebCore::FrameView::layerForOverhangAreas):
(WebCore::FrameView::flushCompositingStateForThisFrame):
(WebCore::FrameView::hasCompositedContent):
(WebCore::FrameView::enterCompositingMode):
(WebCore::FrameView::isSoftwareRenderable):
(WebCore::FrameView::didMoveOnscreen):
(WebCore::FrameView::willMoveOffscreen):
(WebCore::FrameView::layout):
(WebCore::FrameView::embeddedContentBox):
(WebCore::FrameView::contentsInCompositedLayer):
(WebCore::FrameView::scrollContentsFastPath):
(WebCore::FrameView::scrollContentsSlowPath):
(WebCore::FrameView::maintainScrollPositionAtAnchor):
(WebCore::FrameView::scrollPositionChanged):
(WebCore::FrameView::repaintFixedElementsAfterScrolling):
(WebCore::FrameView::updateFixedElementsAfterScrolling):
(WebCore::FrameView::visibleContentsResized):
(WebCore::FrameView::scheduleRelayoutOfSubtree):
(WebCore::FrameView::needsLayout):
(WebCore::FrameView::setNeedsLayout):
(WebCore::FrameView::performPostLayoutTasks):
(WebCore::FrameView::updateControlTints):
(WebCore::FrameView::paintContents):
(WebCore::FrameView::forceLayoutForPagination):
(WebCore::FrameView::adjustPageHeightDeprecated):
(WebCore::FrameView::resetTrackedRepaints):
(WebCore::FrameView::isVerticalDocument):
(WebCore::FrameView::isFlippedDocument):
* page/FrameView.h:
(WebCore::FrameView::renderView): Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142647 268f45cc-cd09-0410-ab3c-d52691b4dbfc
BackgroundHTMLParser::resumeFrom should take a struct
https://bugs.webkit.org/show_bug.cgi?id=109598

Reviewed by Eric Seidel.

This patch is purely a syntatic change that paves the way for fixing
the partial-entity document.write tests. To fix those tests, we'll need
to pass more information to resumeFrom, but we're hitting the argument
limits in Functional.h. Rather than adding yet more arguments, this
patch moves to a single argument that's a struct.

* html/parser/BackgroundHTMLParser.cpp:
(WebCore::BackgroundHTMLParser::resumeFrom):
* html/parser/BackgroundHTMLParser.h:
(Checkpoint):
(BackgroundHTMLParser):
* html/parser/HTMLDocumentParser.cpp:
(WebCore::HTMLDocumentParser::didFailSpeculation):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142648 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r142387.
http://trac.webkit.org/changeset/142387
https://bugs.webkit.org/show_bug.cgi?id=109601

caused all layout and jscore tests on windows to fail
(Requested by kling on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2013-02-12

* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
* bytecode/UnlinkedCodeBlock.h:
(UnlinkedCodeBlock):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142649 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix the gyp build of JavaScriptCore.

* JavaScriptCore.gypi: Added some missing DFG files to the source list.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142650 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add WKContext API to retrieve basic network process statistics
https://bugs.webkit.org/show_bug.cgi?id=109329

Reviewed by Sam Weinig.

This patch adds a WKContextGetStatisticsWithOptions which allows the client to ask for
certain types of statistics.

It also expands the "get statistics" callback mechanism to allow for a statistics request
to be answered by multiple child processes.

That mechanism still has some rough edges but will eventually allow for getting statistics
from multiple web processes, as well.

* NetworkProcess/HostRecord.cpp:
(WebKit::HostRecord::pendingRequestCount):
(WebKit::HostRecord::activeLoadCount):
* NetworkProcess/HostRecord.h:

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::getNetworkProcessStatistics):
* NetworkProcess/NetworkProcess.h:
* NetworkProcess/NetworkProcess.messages.in:

* NetworkProcess/NetworkResourceLoadScheduler.cpp:
(WebKit::NetworkResourceLoadScheduler::hostsPendingCount):
(WebKit::NetworkResourceLoadScheduler::loadsPendingCount):
(WebKit::NetworkResourceLoadScheduler::hostsActiveCount):
(WebKit::NetworkResourceLoadScheduler::loadsActiveCount):
* NetworkProcess/NetworkResourceLoadScheduler.h:

* Shared/Authentication/AuthenticationManager.h:
(WebKit::AuthenticationManager::outstandingAuthenticationChallengeCount):
* Shared/Downloads/DownloadManager.h:

* UIProcess/API/C/WKContext.cpp:
(WKContextGetStatistics):
(WKContextGetStatisticsWithOptions):
* UIProcess/API/C/WKContext.h:

* UIProcess/StatisticsRequest.cpp: Added.
(WebKit::StatisticsRequest::StatisticsRequest):
(WebKit::StatisticsRequest::~StatisticsRequest):
(WebKit::StatisticsRequest::addOutstandingRequest):
(WebKit::addToDictionaryFromHashMap):
(WebKit::createDictionaryFromHashMap):
(WebKit::StatisticsRequest::completedRequest):
* UIProcess/StatisticsRequest.h: Added.
(WebKit::StatisticsRequest::create):

* UIProcess/WebContext.cpp:
(WebKit::WebContext::networkingProcessConnection):
(WebKit::WebContext::getStatistics):
(WebKit::WebContext::requestWebContentStatistics):
(WebKit::WebContext::requestNetworkingStatistics):
(WebKit::WebContext::didGetStatistics):
* UIProcess/WebContext.h:
* UIProcess/WebContext.messages.in:

* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::getWebCoreStatistics):

* WebKit2.xcodeproj/project.pbxproj:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142651 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Cache timer heap pointer to timers
https://bugs.webkit.org/show_bug.cgi?id=109597

Reviewed by Andreas Kling.

Accessing timer heap through thread global storage is slow (~0.1% in PLT3). We can cache the heap pointer to
each TimerBase. There are not huge numbers of timers around so memory is not an issue and many timers are heavily reused.

* platform/Timer.cpp:
(WebCore::threadGlobalTimerHeap):
(WebCore::TimerHeapReference::operator=):
(WebCore::TimerHeapIterator::checkConsistency):
(WebCore::TimerBase::TimerBase):
(WebCore::TimerBase::checkHeapIndex):
(WebCore::TimerBase::setNextFireTime):
* platform/Timer.h:
(WebCore::TimerBase::timerHeap):
(TimerBase):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142652 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] IndexedDB/Worker crash during shutdown
https://bugs.webkit.org/show_bug.cgi?id=109467

Reviewed by Tony Chang.

If the message queue has already been terminated, don't bother scheduling
a new error event that will never be delivered. Speculative fix for the
issue, which only repros in multiprocess ports and so far only on some
platforms.

* src/IDBFactoryBackendProxy.cpp:
(WebKit::IDBFactoryBackendProxy::allowIndexedDB): Early exit.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142653 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: JavaScript execution disabled by browser/UA should be notified to the front-end
https://bugs.webkit.org/show_bug.cgi?id=109402

Reviewed by Yury Semikhatsky.

Source/WebCore:

Whenever the UA/Browser changes the Script Execution state of a page, it should notify the
inspector front-end. Added the InspectorInstrumentation method didScriptExecutionStateChange
to achieve this. Also the state change triggered by the inspector should be ignored to avoid
infinite loop.

Test: inspector/script-execution-state-change-notification.html

* inspector/Inspector.json:
* inspector/InspectorInstrumentation.cpp:
(WebCore):
(WebCore::InspectorInstrumentation::scriptsEnabledImpl):
* inspector/InspectorInstrumentation.h:
(InspectorInstrumentation):
(WebCore::InspectorInstrumentation::scriptsEnabled):
(WebCore):
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::InspectorPageAgent):
(WebCore::InspectorPageAgent::setScriptExecutionDisabled):
(WebCore::InspectorPageAgent::scriptsEnabled):
(WebCore):
* inspector/InspectorPageAgent.h:
(InspectorPageAgent):
* inspector/front-end/ResourceTreeModel.js:
(WebInspector.PageDispatcher.prototype.javascriptDialogClosed):
(WebInspector.PageDispatcher.prototype.scriptsEnabled):
* page/Settings.cpp:
(WebCore::Settings::setScriptEnabled):

LayoutTests:

Tests that whenever Script Execution state is changed outside inspector, its notified to the Inspector front-end.

* inspector/script-execution-state-change-notification-expected.txt: Added.
* inspector/script-execution-state-change-notification.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142654 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed Windows build fix.

* testing/Internals.cpp:
(WebCore::Internals::resetToConsistentState):
(WebCore::Internals::Internals):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142655 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change the queue client base class to be private everywhere
https://bugs.webkit.org/show_bug.cgi?id=109604

Reviewed by Andreas Kling.

Move connection queue client registration inside of the respective queue client classes.

Also, it's too late to add queue clients in ChildProcessProxy::didFinishLaunching, so do this in
ChildProcessProxy::connectionWillOpen instead.

Finally, assert that queue clients are only being added and removed from the client thread.

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::initializeConnection):
* Platform/CoreIPC/Connection.cpp:
(CoreIPC::Connection::addQueueClient):
(CoreIPC::Connection::removeQueueClient):
* Shared/mac/SecItemShim.cpp:
(WebKit::SecItemShim::initializeConnection):
(WebKit):
* Shared/mac/SecItemShim.h:
(SecItemShim):
* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::connectionWillOpen):
(WebKit):
(WebKit::NetworkProcessProxy::connectionWillClose):
(WebKit::NetworkProcessProxy::didFinishLaunching):
* UIProcess/Network/NetworkProcessProxy.h:
(NetworkProcessProxy):
* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::connectionWillOpen):
(WebKit::WebProcessProxy::didFinishLaunching):
* UIProcess/mac/SecItemShimProxy.cpp:
(WebKit::SecItemShimProxy::initializeConnection):
(WebKit):
* UIProcess/mac/SecItemShimProxy.h:
(SecItemShimProxy):
* WebProcess/Plugins/PluginProcessConnectionManager.cpp:
(WebKit::PluginProcessConnectionManager::initializeConnection):
(WebKit):
* WebProcess/Plugins/PluginProcessConnectionManager.h:
(PluginProcessConnectionManager):
* WebProcess/WebPage/EventDispatcher.cpp:
(WebKit::EventDispatcher::initializeConnection):
(WebKit):
* WebProcess/WebPage/EventDispatcher.h:
(EventDispatcher):
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::initializeConnection):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142656 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: !object || object->isBox(), UNKNOWN in WebCore::RenderListItem::positionListMarker
https://bugs.webkit.org/show_bug.cgi?id=108699

Reviewed by Abhishek Arya.

Source/WebCore:

RenderListItems performs special management of its children to maintain list markers. Splitting a flow
through a list item results in assumptions made inside RenderListItem failing, so for now, avoid splitting
flows when inside one.

Test: fast/multicol/span/list-multi-column-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::containingColumnsBlock):

LayoutTests:

* fast/multicol/span/list-multi-column-crash-expected.txt: Added.
* fast/multicol/span/list-multi-column-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142657 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed rebaseline for r142638.

* platform/chromium-linux-x86/fast/dom/Window: Removed.
* platform/chromium-linux-x86/fast/dom/Window/webkitConvertPoint-expected.txt: Removed.
* platform/chromium-linux/fast/dom/Window/webkitConvertPoint-expected.txt: Removed.
* platform/chromium-mac/fast/dom/Window/webkitConvertPoint-expected.txt:
* platform/chromium-win/fast/dom/Window/webkitConvertPoint-expected.txt: Added.
* platform/chromium/TestExpectations:
* platform/mac-lion/accessibility: Added.
* platform/mac-lion/accessibility/table-attributes-expected.txt: Added.
* platform/mac-lion/accessibility/table-cell-spans-expected.txt: Added.
* platform/mac-lion/accessibility/table-sections-expected.txt: Added.
* platform/mac-lion/fast/dom/Window: Added.
* platform/mac-lion/fast/dom/Window/webkitConvertPoint-expected.txt: Added.
* platform/mac-wk2/accessibility/table-cell-spans-expected.txt: Added.
* platform/mac-wk2/fast/dom/Window: Added.
* platform/mac-wk2/fast/dom/Window/webkitConvertPoint-expected.txt: Added.
* platform/mac/accessibility/image-link-expected.txt:
* platform/mac/accessibility/internal-link-anchors2-expected.txt:
* platform/mac/accessibility/table-detection-expected.txt:
* platform/mac/fast/dom/Window/webkitConvertPoint-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142658 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r136967): Combination of float and clear yields to bad layout
https://bugs.webkit.org/show_bug.cgi?id=109476

Reviewed by Levi Weintraub.

Source/WebCore:

Test: fast/block/margin-collapse/self-collapsing-block-with-float-children.html

The change made at http://trac.webkit.org/changeset/136967 only needs to worry about the first floated
child of a self-collapsing block. The ones that follow are not affected by its margins.

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace):

LayoutTests:

* fast/block/margin-collapse/self-collapsing-block-with-float-children-expected.txt: Added.
* fast/block/margin-collapse/self-collapsing-block-with-float-children.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142659 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Adding myself to watch lists.

Unreviewed.

* Scripts/webkitpy/common/config/watchlist:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142662 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WK2] Unreviewed trivial buildfix after r142630 and r142651.

* CMakeLists.txt:
* GNUmakefile.list.am:
* Target.pri:
* UIProcess/Plugins/PluginProcessProxy.cpp:
(WebKit::PluginProcessProxy::didFinishLaunching):
* UIProcess/Plugins/qt/PluginProcessProxyQt.cpp:
(WebKit::PluginProcessProxy::platformGetLaunchOptions):
* UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp:
(WebKit::PluginProcessProxy::platformGetLaunchOptions):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142663 268f45cc-cd09-0410-ab3c-d52691b4dbfc