Speculative fix for
<rdar://problem/6937089> Crashes at RenderWidget::destroy()

Reviewed by Ada Chan.

* rendering/RenderWidget.cpp:
(WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
is null. Add two assertions that can help determine how this crash
happens (in particular, whether node() becomes null during destroy() or
it is null before destroy() is called).



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48443 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2009-09-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>

        Reviewed by Eric Seidel.

        Detect and add Windows7 properly to the user agent.

        * Api/qwebpage.cpp:
        (QWebPage::userAgentForUrl):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48444 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2009-09-16  Gabor Loki  <loki@inf.u-szeged.hu>

        Reviewed by Darin Adler.

        Fix GCC warnings on ARM_THUMB2 platform

        * assembler/ARMv7Assembler.h:
        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
        * assembler/MacroAssemblerARMv7.h:
        (JSC::MacroAssemblerARMv7::branchTruncateDoubleToInt32):
        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48445 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/7155710>
HTML selects on windows cause containing window to become inactive when opened
        
Reviewed by Adam Roben.

Redo the way we handle events when a popup menu is shown, based on
http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
        
Since a non-active window can't capture the mouse, we use the owning window 
(the WebView) as the capture window. We then run a recursive message pump that 
forwards all mouse and keyboard events to the popup menu.
        
* platform/PopupMenu.h:
* platform/win/PopupMenuWin.cpp:
(WebCore::PopupMenu::PopupMenu):
(WebCore::PopupMenu::show):
(WebCore::PopupMenu::hide):
(WebCore::PopupMenu::wndProc):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48446 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebCore: Removed some vestigial and potentially crashy code that makes consolidating
event listeners hard.

Patch by Geoffrey Garen <ggaren@apple.com> on 2009-09-16
Reviewed by Sam Weinig and Anders Carlsson.

* dom/Node.cpp:
(WebCore::Node::addEventListener): No need to limit when event listeners
can be added. Other EventTargets don't do this.
        
Also, check for null when accessing document(). Technically, the JS bindings
do this check for us, but let's not rely on that.

LayoutTests: Added a test for a potential crash when adding an event listener to a
doctype node.

Patch by Geoffrey Garen <ggaren@apple.com> on 2009-09-16
Reviewed by Sam Weinig.

* fast/dom/doctype-event-listener-crash-expected.txt: Added.
* fast/dom/doctype-event-listener-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48447 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2009-09-16  Enrica Casucci  <enrica@apple.com>

        Reviewed by Eric Seidel.

        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
        https://bugs.webkit.org/show_bug.cgi?id=29319

        * editing/IndentOutdentCommand.cpp:
        Removed implementation of isAtUnsplittableElement.

        * editing/IndentOutdentCommand.h:
        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.

        * editing/htmlediting.cpp:
        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.

        * editing/htmlediting.h:
        Reordered functions to group them by type of object returned or operate upon.
        Added comments.
        Added isAtUnsplittableElement declaration.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48448 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2009-09-15  Kent Tamura  <tkent@chromium.org>

        Reviewed by Eric Seidel.

        <input maxlength=> should restrict only values specified by users.
        https://bugs.webkit.org/show_bug.cgi?id=21271

        * fast/forms/input-appearance-maxlength-expected.txt:
        * fast/forms/input-appearance-maxlength.html:
        * fast/forms/input-maxlength-expected.txt:
        * fast/forms/input-maxlength.html:
        * fast/forms/input-text-maxlength-expected.txt: Added.
        * fast/forms/input-text-maxlength.html:
        * fast/forms/input-text-paste-maxlength-expected.txt: Added.
        * fast/forms/input-text-paste-maxlength.html:
        * platform/mac-leopard/fast/forms/input-text-maxlength-expected.checksum: Removed.
        * platform/mac-leopard/fast/forms/input-text-maxlength-expected.png: Removed.
        * platform/mac-leopard/fast/forms/input-text-maxlength-expected.txt: Removed.
        * platform/mac-leopard/fast/forms/input-text-paste-maxlength-expected.checksum: Removed.
        * platform/mac-leopard/fast/forms/input-text-paste-maxlength-expected.png: Removed.
        * platform/mac-leopard/fast/forms/input-text-paste-maxlength-expected.txt: Removed.
        * platform/mac/fast/forms/input-text-maxlength-expected.txt: Removed.
        * platform/mac/fast/forms/input-text-paste-maxlength-expected.txt: Removed.
        * platform/qt/fast/forms/input-text-maxlength-expected.txt: Removed.
        * platform/qt/fast/forms/input-text-paste-maxlength-expected.txt: Removed.
        * platform/win/fast/forms/input-text-maxlength-expected.txt: Removed.
        * platform/win/fast/forms/input-text-paste-maxlength-expected.txt: Removed.
2009-09-15  Kent Tamura  <tkent@chromium.org>

        Reviewed by Eric Seidel.

        <input maxlength=> should restrict only values specified by users.
        https://bugs.webkit.org/show_bug.cgi?id=21271

        * dom/InputElement.cpp:
        (WebCore::InputElement::setValueFromRenderer):
        (WebCore::InputElement::sanitizeValue):
        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
        (WebCore::InputElement::handleBeforeTextInsertedEvent):
        (WebCore::InputElement::updateValueIfNeeded):
        * dom/InputElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setInputType):
        (WebCore::HTMLInputElement::value):
        (WebCore::HTMLInputElement::setValue):
        (WebCore::HTMLInputElement::sanitizeValue):
        * html/HTMLInputElement.h:
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
        * wml/WMLInputElement.cpp:
        (WebCore::WMLInputElement::constrainValue):
        * wml/WMLInputElement.h:
        (WebCore::WMLInputElement::sanitizeValue):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48449 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Revert "2009-09-16  Albert J. Wong  <ajwong@chromium.org>"
This change did not compile.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48450 268f45cc-cd09-0410-ab3c-d52691b4dbfc
wxPython bindings build fixes after recent changes.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48451 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Split the SnowLeopard build across a few machines.

* BuildSlaveSupport/build.webkit.org-config/config.json:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48452 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
JS callback objects should store the global object

Reviewed by Anders Carlsson.

This just changes the callback objects to store the global object instead
of the frame. A follow up patch will change them to store the 'current' 
global object instead of the lexical or dynamic.

* DerivedSources.make: Remove unused VoidCallback.
* WebCore.xcodeproj/project.pbxproj: Ditto.
* bindings/js/JSCustomPositionCallback.cpp:
(WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
(WebCore::JSCustomPositionCallback::handleEvent):
* bindings/js/JSCustomPositionCallback.h:
(WebCore::JSCustomPositionCallback::create):
* bindings/js/JSCustomPositionErrorCallback.cpp:
(WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
(WebCore::JSCustomPositionErrorCallback::handleEvent):
* bindings/js/JSCustomPositionErrorCallback.h:
(WebCore::JSCustomPositionErrorCallback::create):
* bindings/js/JSCustomSQLStatementCallback.cpp:
(WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
(WebCore::JSCustomSQLStatementCallback::handleEvent):
* bindings/js/JSCustomSQLStatementCallback.h:
(WebCore::JSCustomSQLStatementCallback::create):
* bindings/js/JSCustomSQLStatementErrorCallback.cpp:
(WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
(WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
* bindings/js/JSCustomSQLStatementErrorCallback.h:
(WebCore::JSCustomSQLStatementErrorCallback::create):
* bindings/js/JSCustomSQLTransactionCallback.cpp:
(WebCore::JSCustomSQLTransactionCallback::Data::Data):
(WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
(WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
(WebCore::JSCustomSQLTransactionCallback::handleEvent):
* bindings/js/JSCustomSQLTransactionCallback.h:
(WebCore::JSCustomSQLTransactionCallback::create):
* bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
(WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
(WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
* bindings/js/JSCustomSQLTransactionErrorCallback.h:
(WebCore::JSCustomSQLTransactionErrorCallback::create):
* bindings/js/JSCustomVoidCallback.cpp:
(WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
(WebCore::JSCustomVoidCallback::handleEvent):
* bindings/js/JSCustomVoidCallback.h:
(WebCore::JSCustomVoidCallback::create):
* bindings/js/JSDatabaseCustom.cpp:
(WebCore::JSDatabase::changeVersion):
(WebCore::createTransaction):
(WebCore::JSDatabase::transaction):
(WebCore::JSDatabase::readTransaction):
* bindings/js/JSGeolocationCustom.cpp:
(WebCore::createPositionCallback):
(WebCore::createPositionErrorCallback):
(WebCore::JSGeolocation::getCurrentPosition):
(WebCore::JSGeolocation::watchPosition):
* bindings/js/JSSQLTransactionCustom.cpp:
(WebCore::JSSQLTransaction::executeSql):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48453 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add some groups to the xcode project to make the bindings/js/ group
a little nicer.

Reviewed by Anders Carlsson.

* WebCore.xcodeproj/project.pbxproj:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48454 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2009-09-16  Adam Barth  <abarth@webkit.org>

        Reviewed by Dimitri Glazkov.

        [V8] Teach ScheduledAction::execute about isolated worlds
        https://bugs.webkit.org/show_bug.cgi?id=27703

        We now save a handle to the original context.  We use that handle to
        call the timeout in the right context / world.

        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
               http/tests/security/isolatedWorld/window-setTimeout-string.html

        * bindings/v8/ScheduledAction.cpp:
        (WebCore::ScheduledAction::ScheduledAction):
        (WebCore::ScheduledAction::execute):
        * bindings/v8/ScheduledAction.h:
        (WebCore::ScheduledAction::ScheduledAction):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8Custom::WindowSetTimeoutImpl):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::SetTimeoutOrInterval):
2009-09-16  Adam Barth  <abarth@webkit.org>

        Reviewed by Dimitri Glazkov.

        [V8] Teach ScheduledAction::execute about isolated worlds
        https://bugs.webkit.org/show_bug.cgi?id=27703

        Add test coverage for the interaction between setTimeout and isolated
        worlds.

        * http/tests/security/isolatedWorld/window-setTimeout-function-expected.txt: Added.
        * http/tests/security/isolatedWorld/window-setTimeout-function.html: Added.
        * http/tests/security/isolatedWorld/window-setTimeout-string-expected.txt: Added.
        * http/tests/security/isolatedWorld/window-setTimeout-string.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48455 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Explore allowing pages with unload handlers into the Page Cache
https://bugs.webkit.org/show_bug.cgi?id=29021

Reviewed by Sam Weinig.

No new tests. (All previous tests continue to pass)

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48456 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2009-09-16  Adam Barth  <abarth@webkit.org>

        Unreviewed.  Added new isolated world test to the skipped list.

        * platform/gtk/Skipped:
        * platform/mac/Skipped:
        * platform/qt/Skipped:
        * platform/win/Skipped:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48457 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2009-09-16  Daniel Bates  <dbates@webkit.org>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=29306

        Tests that scripts with accented characters do not bypass the XSSAuditor.

        * http/tests/security/xssAuditor/img-onerror-accented-char-expected.txt: Added.
        * http/tests/security/xssAuditor/img-onerror-accented-char.html: Added.
2009-09-16  Daniel Bates  <dbates@webkit.org>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=29306

        Fixes an issue where an attack that contains accented characters can
        bypass the XSSAuditor.

        XSSAuditor::decodeURL used the wrong length for the input string.
        When the input string was decoded, the decoded result was truncated.
        Hence, XSSAuditor was comparing the source code of the script to the
        truncated input parameters.

        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html

        * page/XSSAuditor.cpp:
        (WebCore::XSSAuditor::decodeURL):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48458 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Small cosmetic documentation fixlet in the QWebInspector.

Patch by Jocelyn Turcotte <jocelyn.turcotte@nokia.com> on 2009-09-17
Reviewed by Simon Hausmann.

* Api/qwebinspector.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48459 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Symbian build fix.

Patch by Janne Koskinen <janne.p.koskinen@digia.com> on 2009-09-17
Reviewed by Simon Hausmann.

Moved the #ifdefs around _q_cleanupLeakMessages() into the function
definition.

QMake is not being able to distinguish between release and debug builds
in Symbian build. This is a Symbian toolchain issue.

* Api/qwebpage.cpp:
(QWebPagePrivate::_q_cleanupLeakMessages):
* Api/qwebpage.h:
* Api/qwebpage_p.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48460 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=27060

Patch by Norbert Leser <norbert.leser@nokia.com> on 2009-09-15
Reviewed by Darin Adler.

Symbian compiler for emulator target (WINSCW) fails with
"illegal operand" for m_attributesInPrevious in structure.ccp
(when calling make_pair functions).
This error is apparently due to the compiler not properly
resolving the unsigned type of the declared bitfield.

Initial patch explicitly casted m_attributesInPrevious
to unsigned, but since bitfield optimization is not critical for
the emulator target, this conditional change in header file
appears to be least intrusive.

* runtime/Structure.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48461 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Symbian/WINSCW build fix.

Patch by Janne Koskinen <janne.p.koskinen@digia.com> on 2009-09-17
Reviewed by Simon Hausmann.

https://bugs.webkit.org/show_bug.cgi?id=29186

WINSCW Template specialisation name in declaration must the be the same as in implementation.

* runtime/LiteralParser.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@48462 268f45cc-cd09-0410-ab3c-d52691b4dbfc