[BlackBerry] ROI details are not always cleared when using back navigation.
https://bugs.webkit.org/show_bug.cgi?id=117159

Reviewed by Carlos Garcia Campos.

PR 328557.

Secondary change to ensure when restoreViewState is triggered
ROI is reset.

Internally Reviewed by Nima Ghanavatian.

* WebKitSupport/InputHandler.cpp:
(BlackBerry::WebKit::InputHandler::restoreViewState):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151115 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] inset-rectangle support for shape-outside
https://bugs.webkit.org/show_bug.cgi?id=116641

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-06-03
Reviewed by Alexandru Chiculita.

Source/WebCore:

Implement support for using inset-rectangles in a shape-outside.

Tests: fast/exclusions/shape-outside-floats/shape-outside-floats-simple-inset-rectangle.html
       fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-inset-rectangle.html

* rendering/ExclusionShape.cpp:
(WebCore::ExclusionShape::createExclusionShape): An inset-rectangle is
    simply a rectangle with the dimensions calculated differently. So
    just use ExclusionRectangle after converting the dimensions.
* rendering/ExclusionShapeOutsideInfo.cpp:
(WebCore::ExclusionShapeOutsideInfo::isEnabledFor): Enable inset
    rectangles for shape-outside.

LayoutTests:

Add tests for inset-rectangles.

* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-inset-rectangle-expected.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-inset-rectangle.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-inset-rectangle-percentage-expected.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-inset-rectangle-percentage.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-inset-rectangle-expected.html: Added.
* fast/exclusions/shape-outside-floats/shape-outside-floats-simple-rounded-inset-rectangle.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151116 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: node->parentNode(), Heap-use-after-free in WebCore::RenderBox::exclusionShapeOutsideInfo
https://bugs.webkit.org/show_bug.cgi?id=117155

Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-06-03
Reviewed by David Hyatt.

Source/WebCore:

Ported from a Blink patch by kenrb@chromium.org:

Clear floats on RenderBlocks that haven't had layout

WebKit revision 150084 creates a condition where a RenderBlock
can have a populated floating object list even when it has not
previously had layout. Since clearing of floats is optimized
to not search through parts of the tree that have not had layout,
references to floating objects were not being cleared in some cases.

This patch causes markAllDescendantsWithFloatsForLayout() to proceed
in the above case, in order to clear floats for a RenderBlock that has
not had layout.

Test: fast/block/float/float-list-changed-before-layout-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):

LayoutTests:

Test for crash. Note that this will only crash when run under a memory
checking tool like ASAN.

* fast/block/float/float-list-changed-before-layout-crash-expected.txt: Added.
* fast/block/float/float-list-changed-before-layout-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151117 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] Selection handles are not cleared when displaying error pages.
https://bugs.webkit.org/show_bug.cgi?id=117158

Reviewed by Carlos Garcia Campos.

PR 342159.

Add explicit cancel of selection state when loading an error page
as it is not always cleared.

Internally Reviewed by Nima Ghanavatian.

* WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
(WebCore::FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151118 268f45cc-cd09-0410-ab3c-d52691b4dbfc