Removing a <link> element with an empty stylesheet shouldn't trigger style recalc.
<http://webkit.org/b/119442>
<rdar://problem/14631785>

Reviewed by Antti Koivisto.

Let Document decide whether or not to do a style recalc after a <link> element is removed.
This avoids unnecessary work when removing a <link> that refers to an empty style sheet.

Some Facebook pages have a <link rel="stylesheet" href="data:text/css;base64,"> that gets
removed during the initial page load, causing style recalc.

* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::removedFrom):

    Use DeferRecalcStyleIfNeeded. Since the style sheet is being removed, it will either
    cause a recalc (because it's no longer in the set of active sheets) or do nothing.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153672 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove no-arguments constructor to PropertySlot
https://bugs.webkit.org/show_bug.cgi?id=119460

Reviewed by Geoff Garen.

This constructor was unsafe if getValue is subsequently called,
and the property is a getter. Simplest to just remove it.

* runtime/Arguments.cpp:
(JSC::Arguments::defineOwnProperty):
* runtime/JSActivation.cpp:
(JSC::JSActivation::getOwnPropertyDescriptor):
* runtime/JSFunction.cpp:
(JSC::JSFunction::getOwnPropertyDescriptor):
(JSC::JSFunction::getOwnNonIndexPropertyNames):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::defineOwnProperty):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::hasOwnPropertyForWrite):
* runtime/JSNameScope.cpp:
(JSC::JSNameScope::put):
* runtime/JSONObject.cpp:
(JSC::Stringifier::Holder::appendNextProperty):
(JSC::Walker::walk):
* runtime/JSObject.cpp:
(JSC::JSObject::hasProperty):
(JSC::JSObject::hasOwnProperty):
(JSC::JSObject::reifyStaticFunctionsForDelete):
* runtime/Lookup.h:
(JSC::getStaticPropertyDescriptor):
(JSC::getStaticFunctionDescriptor):
(JSC::getStaticValueDescriptor):
* runtime/ObjectConstructor.cpp:
(JSC::defineProperties):
* runtime/PropertySlot.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153673 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Incorrect type speculation reported by ToPrimitive
https://bugs.webkit.org/show_bug.cgi?id=119458

Reviewed by Mark Hahnenberg.

Make sure that we report the correct type possibilities for the output
from ToPrimitive

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153674 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Gardening: Touched a line in Platform.h to get all bots to do a clean build.

Not reviewed.

* wtf/Platform.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153676 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove no-arguments constructor to PropertySlot
https://bugs.webkit.org/show_bug.cgi?id=119460

Reviewed by Geoff Garen.

This constructor was unsafe if getValue is subsequently called,
and the property is a getter. Simplest to just remove it.

Source/WebCore: 

* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::getOwnPropertyDescriptor):
(WebCore::DialogHandler::returnValue):
* bindings/js/JSHistoryCustom.cpp:
(WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
* bindings/js/JSLocationCustom.cpp:
(WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
* bindings/js/JSPluginElementFunctions.cpp:
(WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
* bindings/js/JSStorageCustom.cpp:
(WebCore::JSStorage::deleteProperty):
(WebCore::JSStorage::putDelegate):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertyDescriptorBody):
* bridge/runtime_array.cpp:
(JSC::RuntimeArray::getOwnPropertyDescriptor):
* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::getOwnPropertyDescriptor):
* bridge/runtime_object.cpp:
(JSC::Bindings::RuntimeObject::getOwnPropertyDescriptor):

Source/WebKit2: 

* WebProcess/Plugins/Netscape/JSNPObject.cpp:
(WebKit::JSNPObject::getOwnPropertyDescriptor):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153677 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. Skip failing canvas blending tests on AppleWin port.
https://bugs.webkit.org/show_bug.cgi?id=119463.

* platform/win/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153678 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Give the error object's stack property accessor attributes.
https://bugs.webkit.org/show_bug.cgi?id=119404

Source/JavaScriptCore:

Patch by Chris Curtis <chris_curtis@apple.com> on 2013-08-02
Reviewed by Geoffrey Garen.

Changed the attributes of error object's stack property to allow developers to write
and delete the stack property. This will match the functionality of Chrome. Firefox
allows developers to write the error's stack, but not delete it.

* interpreter/Interpreter.cpp:
(JSC::Interpreter::addStackTraceIfNecessary):
* runtime/ErrorInstance.cpp:
(JSC::ErrorInstance::finishCreation):

LayoutTests:

Patch by Chris Curtis <chris_curtis@apple.com> on 2013-08-02
Reviewed by Geoffrey Garen.

* fast/dom/DOMException/stack-trace-expected.txt:

New tests to show that the error object's stack property is writable and deleteable.
* fast/js/error-object-write-and-detele-for-stack-property-expected.txt: Added.
* fast/js/error-object-write-and-detele-for-stack-property.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153679 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Update binding test results

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153680 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Force elements with perspective or preserve-3d to disallow direct composited backgrounds
https://bugs.webkit.org/show_bug.cgi?id=119462
<rdar://problem/14607548>

Reviewed by Simon Fraser.

Source/WebCore:

Bug 119461 (http://wkb.ug/119461) describes how a directly composited
background color can intersect with its children. It's not clear exactly
what the best way to fix that is, but for the moment we should disallow
any element that has perspective or a preserve-3d transform style from
getting a directly composited background.

Test: compositing/background-color/no-composited-background-color-when-perspective.html

* rendering/RenderLayerBacking.cpp:
(WebCore::hasPerspectiveOrPreserves3D): New static helper.
(WebCore::supportsDirectBoxDecorationsComposition): Return false if the above function is true.

LayoutTests:

* compositing/background-color/no-composited-background-color-when-perspective-expected.html: Added.
* compositing/background-color/no-composited-background-color-when-perspective.html: Added.
* compositing/geometry/preserve-3d-switching-expected.txt: Rebaselined.
* compositing/overflow-trumps-transform-style-expected.txt: Rebaselined.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153681 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r153005): Crash in SpaceSplitString::spaceSplitStringContainsValue on Facebook
https://bugs.webkit.org/show_bug.cgi?id=119384

Patch by Benjamin Poulain <bpoulain@apple.com> on 2013-08-02
Reviewed by Alexey Proskuryakov.

Source/WebCore: 

When removing the "rel" attribute from HTMLAnchorElement, we parse the attribute for no value.
Following r153005, we no longer checked for null String, which caused a crash in that case.

Creating a SpaceSplitString from a null string causes the SpaceSplitString to be null. In that case
SpaceSplitString::contains() would always return false.
This patch modify SpaceSplitString::spaceSplitStringContainsValue() to follow the exact same
behavior.

Test: fast/dom/HTMLAnchorElement/remove-rel-attribute.html

* dom/SpaceSplitString.cpp:
(WebCore::SpaceSplitString::spaceSplitStringContainsValue):

LayoutTests: 

* fast/dom/HTMLAnchorElement/remove-rel-attribute.html: Added.
* fast/dom/HTMLAnchorElement/remove-rel-attribute-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153685 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove a bunch of redundant checks for empty string in StringImpl
https://bugs.webkit.org/show_bug.cgi?id=118768

Reviewed by Ryosuke Niwa.

The first thing done by createUninitialized() is check if the length passed
is zero. Internally, there are many cases for which we know the check will never succeed.

Clang is usually really smart for those kind of things, but there are a few cases where
the condition to avoid returning empty() is not simply a check for the length.
This patch adds an internal initializer to deal with that.

* wtf/text/StringImpl.cpp:
(WTF::StringImpl::createUninitializedInternal):
(WTF::StringImpl::createUninitializedInternalNonEmpty):
(WTF::StringImpl::createInternal): Create internal has a special case for null pointer
for the characters. The test also check length, the second check for length cannot fail.
(WTF::StringImpl::create8BitIfPossible): ditto.
(WTF::StringImpl::lower): 3 of the calls cannot be reached for empty length. On an empty length,
the test for (noUpper && !(ored & ~0x7F)) would have caused the function to return "this".

For the last createUninitialized(), there is no guarantee the realLength is not zero.

(WTF::StringImpl::replace): The first thing we do in replace(UChar,UChar) is check if there is anything
to replace. The check for length will never succeed as there must be a character to replace at that point.
* wtf/text/StringImpl.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153686 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Introduce toSVGMaskElement(), and use it
https://bugs.webkit.org/show_bug.cgi?id=119443

Reviewed by Andreas Kling.

As a step to change static_cast with toSVGXXX, static_cast<SVGMaskElement*> can
be changed with toSVGMaskElement().

Blink merge from https://src.chromium.org/viewvc/blink?view=rev&revision=155432

* rendering/svg/RenderSVGResourceMasker.cpp:
(WebCore::RenderSVGResourceMasker::applyResource):
(WebCore::RenderSVGResourceMasker::resourceBoundingBox):
* rendering/svg/RenderSVGResourceMasker.h:
* svg/SVGMaskElement.h:
(WebCore::toSVGMaskElement):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153687 268f45cc-cd09-0410-ab3c-d52691b4dbfc
RenderBoxModelObject::firstLetterRemainingText should be a RenderTextFragment*.
<http://webkit.org/b/119181>

Reviewed by Sam Weinig.

De-generalize this code a bit since we know that the firstLetterRemainingText() is always
going to be a RenderTextFragment.

* rendering/RenderBoxModelObject.h:
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::firstLetterRemainingText):
(WebCore::RenderBoxModelObject::setFirstLetterRemainingText):

    Make these two deal in RenderTextFragment*.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::updateFirstLetterStyle):

    Tighten up some pointer types so we don't have to cast as much.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153688 268f45cc-cd09-0410-ab3c-d52691b4dbfc
PreloadScanner preloads external CSS with non-matching media attribute
https://bugs.webkit.org/show_bug.cgi?id=106198

Patch by Yoav Weiss <yoav@yoav.ws> on 2013-08-03
Reviewed by Dean Jackson.

Source/WebCore:

Test: http/tests/loading/preload-css-test.html

* html/parser/HTMLPreloadScanner.cpp:
Remove m_linkMediaAttributeIsScreen
Remove MediaQueryEvaluator calls
Add m_mediaAttribute that gets the value of the "media" attribute
Pass m_mediaAttribute to PreloadRequest
(WebCore::TokenPreloadScanner::StartTagScanner::StartTagScanner):
(WebCore::TokenPreloadScanner::StartTagScanner::createPreloadRequest):
(WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):
(WebCore::TokenPreloadScanner::StartTagScanner::resourceType):
(WebCore::TokenPreloadScanner::StartTagScanner::shouldPreload):
* html/parser/HTMLResourcePreloader.cpp:
Add MediaQueryEvaluator calls to see if "media" matches
Perform preload only to resource with a matching media (if media exists)
(WebCore::PreloadRequest::isSafeToSendToAnotherThread):
(WebCore::mediaAttributeMatches):
(WebCore::HTMLResourcePreloader::preload):
* html/parser/HTMLResourcePreloader.h:
Add a constructor with a mediaAttribute value
Add m_mediaAttribute & its getter.
(WebCore::PreloadRequest::create):
(WebCore::PreloadRequest::media):
(WebCore::PreloadRequest::PreloadRequest):

LayoutTests:

* http/tests/loading/preload-css-test-expected.txt: Added.
* http/tests/loading/preload-css-test.html: Added.
* http/tests/loading/resources/big_mq.css: Added.
* http/tests/loading/resources/small_mq.css: Added.
* http/tests/local/link-stylesheet-load-order-preload-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153689 268f45cc-cd09-0410-ab3c-d52691b4dbfc
webaudio/audiobuffersource-loop-points.html always times out
https://bugs.webkit.org/show_bug.cgi?id=119467

Skip this test.

* platform/mac-wk2/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153690 268f45cc-cd09-0410-ab3c-d52691b4dbfc
hasIndexingHeader() ought really to be a property of an object and its structure, not just its structure
https://bugs.webkit.org/show_bug.cgi?id=119470

Reviewed by Oliver Hunt.
        
Structure can still tell you if the object "could" (in the conservative sense)
have an indexing header; that's used by the compiler.
        
Most of the time if you want to know if there's an indexing header, you ask the
JSObject.
        
In some cases, the JSObject wants to know if it would have an indexing header if
it had a different structure; then it uses Structure::hasIndexingHeader(JSCell*).

* dfg/DFGRepatch.cpp:
(JSC::DFG::tryCachePutByID):
(JSC::DFG::tryBuildPutByIdList):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
* runtime/ButterflyInlines.h:
(JSC::Butterfly::create):
(JSC::Butterfly::growPropertyStorage):
(JSC::Butterfly::growArrayRight):
(JSC::Butterfly::resizeArray):
* runtime/JSObject.cpp:
(JSC::JSObject::copyButterfly):
(JSC::JSObject::visitButterfly):
* runtime/JSObject.h:
(JSC::JSObject::hasIndexingHeader):
(JSC::JSObject::setButterfly):
* runtime/Structure.h:
(JSC::Structure::couldHaveIndexingHeader):
(JSC::Structure::hasIndexingHeader):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153691 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove pageOverlayShouldApplyFadeWhenPainting() and adopt composited fade for the Mac port
https://bugs.webkit.org/show_bug.cgi?id=119411

Reviewed by Simon Fraser.

Mac is the only holdout that performs non-composited fades of page
overlays. We should adopt that mechanism (as a precursor to doing a
CA-accelerated fade) and remove the now-unnecessary property.

* WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp:
(WKBundlePageOverlayFractionFadedIn):
Always return 1 (fully-faded-in) so that clients who attempt to use this
to bake the fade opacity into their painting will paint at full opacity,
allowing us to do the composited fade separately.

* WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.h:
* WebProcess/WebPage/DrawingArea.h:
* WebProcess/WebPage/DrawingAreaImpl.cpp:
* WebProcess/WebPage/DrawingAreaImpl.h:
* WebProcess/WebPage/LayerTreeHost.h:
* WebProcess/WebPage/PageOverlay.cpp:
(WebKit::PageOverlay::PageOverlay):
(WebKit::PageOverlay::setPage):
(WebKit::PageOverlay::setNeedsDisplay):
(WebKit::PageOverlay::fadeAnimationTimerFired):
* WebProcess/WebPage/PageOverlay.h:
Remove pageOverlayShouldApplyFadeWhenPainting and fractionFadedIn().

* WebProcess/WebPage/FindController.cpp:
(WebKit::FindController::drawRect):
Draw the find overlay without taking the PageOverlay's fade into account.

* WebProcess/WebPage/TapHighlightController.cpp:
(WebKit::TapHighlightController::drawRect):
Remove pageOverlayShouldApplyFadeWhenPainting. Since it's always
"false" for all ports now, take the second path here.

* WebProcess/WebPage/mac/LayerTreeHostMac.h:
* WebProcess/WebPage/mac/LayerTreeHostMac.mm:
(WebKit::LayerTreeHostMac::setPageOverlayOpacity):
* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
(WebKit::TiledCoreAnimationDrawingArea::setPageOverlayOpacity):
Implement setPageOverlayOpacity for DrawingAreaImpl
and TiledCoreAnimationDrawingArea.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153692 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove SimplePDFPlugin
https://bugs.webkit.org/show_bug.cgi?id=119437

Reviewed by Alexey Proskuryakov.

* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::getPlugins):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::createPlugin):
Don't add SimplePDFPlugin, nor try to instantiate it.

* WebProcess/Plugins/PDF/PDFPlugin.h:
* WebProcess/Plugins/PDF/PDFPlugin.mm:
Merge previously inherited behavior in from SimplePDFPlugin.

* WebKit2.xcodeproj/project.pbxproj:
* WebProcess/Plugins/PDF/SimplePDFPlugin.h: Removed.
* WebProcess/Plugins/PDF/SimplePDFPlugin.mm: Removed.
Remove SimplePDFPlugin.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153693 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, build and style fix for r153693.

* UIProcess/WebProcessProxy.cpp:
* WebProcess/Plugins/PDF/PDFPlugin.h:
* WebProcess/WebPage/WebPage.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153694 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Refine the unavailable plug-in indicator
https://bugs.webkit.org/show_bug.cgi?id=119400
<rdar://problem/14616012>

Reviewed by Oliver Hunt.

Add a border, flip the text and background colors, and make the indicator
much higher contrast, to be more visible on a variety of sites.
Also, refine the arrow to be less blocky and inlaid inside a circle.

* rendering/RenderEmbeddedObject.cpp:
(WebCore::replacementTextRoundedRectPressedColor):
(WebCore::replacementTextRoundedRectColor):
(WebCore::replacementTextColor):
(WebCore::unavailablePluginBorderColor):
(WebCore::drawReplacementArrow):
(WebCore::RenderEmbeddedObject::paintReplaced):
(WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
(WebCore::RenderEmbeddedObject::unavailablePluginIndicatorBounds):
(WebCore::RenderEmbeddedObject::isInUnavailablePluginIndicator):
* rendering/RenderEmbeddedObject.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153695 268f45cc-cd09-0410-ab3c-d52691b4dbfc