Silence MSVC 64-bit build warning c4309 for FrameTree::invalidCount
https://bugs.webkit.org/show_bug.cgi?id=107439

Reviewed by Dimitri Glazkov.

MSVC detects that the constant notFound is truncated on assignment to
invalidCount. Since we never compare them (as it would always fail on
64-bit anyway), just initialize invalidCount directly to -1.

No new tests. No behavior changed.

* page/FrameTree.h:
(FrameTree):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140433 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        One is not allowed to use commit-queue to make oneself a committer.

        * Scripts/webkitpy/common/config/committers.py: Removing eustas@chromium.org.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140434 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Heap-use-after-free in WebCore::RenderObject::isDescendantOf
https://bugs.webkit.org/show_bug.cgi?id=107226

Reviewed by Emil A Eklund.

Source/WebCore:

Test: fast/block/float/overhanging-float-not-removed-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
Skip anonymous blocks in the chain to get the enclosing block and
be able to correctly mark the overhanging floats in the next siblings.

LayoutTests:

* fast/block/float/overhanging-float-not-removed-crash-expected.txt: Added.
* fast/block/float/overhanging-float-not-removed-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140435 268f45cc-cd09-0410-ab3c-d52691b4dbfc
When we do setAttribute("border", null) on a table we should create a border like every other browser
https://bugs.webkit.org/show_bug.cgi?id=102112

Reviewed by Ryosuke Niwa.

Source/WebCore:

http://www.whatwg.org/specs/web-apps/current-work/multipage/rendering.html#tables says:
"If the [table's border] attribute is present but parsing the attribute's value using the rules for parsing
non-negative integers generates an error, a default value of 1px is expected to be used for that property instead."

Match the spec and bring us into line with other browsers by observing the 'parsing non-negative integers' algorithm.

Tests: fast/dom/HTMLTableElement/table-with-invalid-border.html
       fast/table/table-with-borderattr-null.html
       fast/table/table-with-borderattr-set-to-null.html

* html/HTMLElement.cpp:
(WebCore::HTMLElement::parseBorderWidthAttribute):
(WebCore::HTMLElement::applyBorderAttributeToStyle):
* html/HTMLElement.h:
(HTMLElement):
* html/HTMLTableElement.cpp:
(WebCore::HTMLTableElement::collectStyleForPresentationAttribute):
(WebCore::HTMLTableElement::parseAttribute):

LayoutTests:

* fast/dom/HTMLTableElement/table-with-invalid-border-expected.txt: Added.
* fast/dom/HTMLTableElement/table-with-invalid-border.html: Added.
* fast/table/table-with-borderattr-null-expected.txt: Added.
* fast/table/table-with-borderattr-null.html: Added.
* fast/table/table-with-borderattr-set-to-null-expected.txt: Added.
* fast/table/table-with-borderattr-set-to-null.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140436 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix DateMath.cpp to compile with -Wshorten-64-to-32
<http://webkit.org/b/107503>

Reviewed by Darin Adler.

Source/JavaScriptCore:

* runtime/JSDateMath.cpp:
(JSC::parseDateFromNullTerminatedCharacters): Remove unneeded
static_cast<int>().

Source/WTF:

Fixes the following build errors with -Wshorten-64-to-32:

    DateMath.cpp:742:47: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        if (month == 2 && day > 28 && !isLeapYear(year))
                                       ~~~~~~~~~~ ^~~~
    DateMath.cpp:757:48: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        double dateSeconds = ymdhmsToSeconds(year, month, day, hours, minutes, seconds) - timeZoneSeconds;
                             ~~~~~~~~~~~~~~~       ^~~~~
    DateMath.cpp:757:55: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        double dateSeconds = ymdhmsToSeconds(year, month, day, hours, minutes, seconds) - timeZoneSeconds;
                             ~~~~~~~~~~~~~~~              ^~~
    DateMath.cpp:757:60: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        double dateSeconds = ymdhmsToSeconds(year, month, day, hours, minutes, seconds) - timeZoneSeconds;
                             ~~~~~~~~~~~~~~~                   ^~~~~
    DateMath.cpp:757:67: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        double dateSeconds = ymdhmsToSeconds(year, month, day, hours, minutes, seconds) - timeZoneSeconds;
                             ~~~~~~~~~~~~~~~                          ^~~~~~~
    DateMath.cpp:996:59: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
                        offset = ((o / 100) * 60 + (o % 100)) * sgn;
                               ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~
    DateMath.cpp:998:37: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
                        offset = o * 60 * sgn;
                               ~ ~~~~~~~^~~~~
    DateMath.cpp:1005:40: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
                    offset = (o * 60 + o2) * sgn;
                           ~ ~~~~~~~~~~~~~~^~~~~
    DateMath.cpp:1041:40: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        return ymdhmsToSeconds(year, month + 1, day, hour, minute, second) * msPerSecond;
               ~~~~~~~~~~~~~~~       ~~~~~~^~~
    DateMath.cpp:1041:45: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        return ymdhmsToSeconds(year, month + 1, day, hour, minute, second) * msPerSecond;
               ~~~~~~~~~~~~~~~                  ^~~
    DateMath.cpp:1041:50: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        return ymdhmsToSeconds(year, month + 1, day, hour, minute, second) * msPerSecond;
               ~~~~~~~~~~~~~~~                       ^~~~
    DateMath.cpp:1041:56: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
        return ymdhmsToSeconds(year, month + 1, day, hour, minute, second) * msPerSecond;
               ~~~~~~~~~~~~~~~                             ^~~~~~
    12 errors generated.

* wtf/DateMath.cpp:
(WTF::ymdhmsToSeconds): Change year argument from long to int.
Change mon, day, hour, minute arguments from int to long.
(WTF::parseInt): Add.  Identical to parseLong but bounds checks
for type int.
(WTF::parseLong): Switch to std::numeric_limits<long> instead of
macros.
(WTF::parseES5DatePortion): Change year argument from long to
int.
(WTF::parseES5DateFromNullTerminatedCharacters): Change year
local variable from long to int.
(WTF::parseDateFromNullTerminatedCharacters): Change year and
offset local variables from long to int.  Switch from using
parseLong() to parseInt() as needed.  Ditto for labs() to abs().
Add overflow check when switching from "MM/DD/YYYY" to
"YYYY/MM/DD" parsing.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140437 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Yarr JIT isn't big endian compatible
https://bugs.webkit.org/show_bug.cgi?id=102897

Patch by Tobias Netzel <tobias.netzel@googlemail.com> on 2013-01-22
Reviewed by Oliver Hunt.

This patch was tested in the current mozilla codebase only and has passed the regexp tests there.

* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140438 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r140435.
http://trac.webkit.org/changeset/140435
https://bugs.webkit.org/show_bug.cgi?id=107565

Crashes on ClusterFuzz due to float not removed (Requested by
inferno-sec on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2013-01-22

Source/WebCore:

* rendering/RenderBox.cpp:
(WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):

LayoutTests:

* fast/block/float/overhanging-float-not-removed-crash-expected.txt: Removed.
* fast/block/float/overhanging-float-not-removed-crash.html: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140439 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Debug build failure on x86-64
https://bugs.webkit.org/show_bug.cgi?id=107400

Reviewed by Xan Lopez.

* configure.ac: use thin archives for convenience libraries, if AR_FLAGS was not
overriden through the environment variable.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140440 268f45cc-cd09-0410-ab3c-d52691b4dbfc
BackgroundHTMLParser should simulate tree building in a separate function
https://bugs.webkit.org/show_bug.cgi?id=107569

Reviewed by Eric Seidel.

This patch cleans up BackgroundHTMLParser::pumpTokenizer to prepare for
implementing speculative parsing.

* html/parser/BackgroundHTMLParser.cpp:
(WebCore::BackgroundHTMLParser::simulateTreeBuilder):
(WebCore):
(WebCore::BackgroundHTMLParser::pumpTokenizer):
* html/parser/BackgroundHTMLParser.h:
(BackgroundHTMLParser):
* page/Settings.in:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r140344): Repeated crashes in WKTR PlatformWebView::viewSupportsOptions().
https://bugs.webkit.org/show_bug.cgi?id=107562

Rubber-stamped by Alexy Proskuryakov.

The input to WKBooleanGetValue() is not NULL-safe, so NULL check its inputs before calling.

* WebKitTestRunner/mac/PlatformWebViewMac.mm:
(WTR::PlatformWebView::PlatformWebView):
(WTR::PlatformWebView::viewSupportsOptions):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140442 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[gstreamer] GstBus signal watch should be removed on clean up
https://bugs.webkit.org/show_bug.cgi?id=107544

Reviewed by Philippe Normand.

Our gstreamer backend code currently calls gst_bus_add_signal_watch()
on GstBus to add a signal watch. As per the gstreamer  documentation,
"To clean up, the caller is responsible for calling
gst_bus_remove_signal_watch() as many times as this function is
called". This is because gst_bus_add_signal_watch() causes the GstBus
object to be ref'd and gst_bus_remove_signal_watch() needs to be
called to properly unref it.

This patch makes sure that gst_bus_remove_signal_watch() is called
on the GstBus object when cleaning up. This patch also uses smart
pointers for GstBus objects for consistency.

No new tests, no behavior change for layout tests.

* platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
(WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
(WebCore::AudioDestinationGStreamer::~AudioDestinationGStreamer):
* platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:
(WebCore::AudioFileReader::~AudioFileReader):
(WebCore::AudioFileReader::decodeAudioForBusCreation):
* platform/graphics/gstreamer/GStreamerGWorld.cpp:
(WebCore::GStreamerGWorld::GStreamerGWorld):
* platform/graphics/gstreamer/GStreamerVersioning.cpp:
(webkitGstPipelineGetBus):
* platform/graphics/gstreamer/GStreamerVersioning.h:
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140443 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Soup] Random thread crashes
https://bugs.webkit.org/show_bug.cgi?id=107439

Reviewed by Martin Robinson.

Process all pending requests in the inner GMainContext created to
perform synchronous requests before restoring the thread default. No
new tests required, already covered by network tests.

* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140445 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Wean BackgroundHTMLParser off HTMLInputStream
https://bugs.webkit.org/show_bug.cgi?id=107575

Reviewed by Eric Seidel.

The BackgroundHTMLParser doesn't need to use HTMLInputStream because it
doesn't need to handle nested calls to document.write. Instead, we can
just use a SegmentedString directly, which will let us checkpoint
m_input for speculation.

* html/parser/BackgroundHTMLParser.cpp:
(WebCore::BackgroundHTMLParser::append):
(WebCore::BackgroundHTMLParser::finish):
(WebCore::BackgroundHTMLParser::markEndOfFile):
(WebCore):
(WebCore::BackgroundHTMLParser::pumpTokenizer):
* html/parser/BackgroundHTMLParser.h:
(BackgroundHTMLParser):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140446 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Allow construction of unprefixed transition DOM events.
https://bugs.webkit.org/show_bug.cgi?id=107319

Reviewed by Dean Jackson.

Source/WebCore:

Make possible to construct unprefixed DOM events for transitions.
Unfortunately I have to duplicate the C++ implementation class of the
events (TransitionEvent.h and TransitionEvent.cpp). I can't find a
better way to re-use the WebKitTransitionEvent class to back the
TransitionEvent.idl as our code generators don't allow to have a
different name for the C++ class used in the generated file than the
interface name specified in the IDL file. Unfortunately
https://trac.webkit.org/wiki/WebKitIDL#InterfaceName doesn't help as
it's only a way to unlink the interface name specified in the IDL with
the one exposed in JavaScript. I don't think we should support such a
feature in our code generators as WebKitTransitionEvent class and more
exactly prefixed DOM events for transitions will be removed one day so
this use case will become obselete.

Test: fast/events/constructors/transition-event-constructor.html

* CMakeLists.txt:
* DerivedSources.cpp:
* DerivedSources.make:
* DerivedSources.pri:
* GNUmakefile.list.am:
* Target.pri:
* WebCore.gypi:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
* dom/DOMAllInOne.cpp:
* dom/EventNames.in:
* dom/TransitionEvent.cpp: Added.
(WebCore):
(WebCore::TransitionEventInit::TransitionEventInit):
(WebCore::TransitionEvent::TransitionEvent):
(WebCore::TransitionEvent::~TransitionEvent):
(WebCore::TransitionEvent::propertyName):
(WebCore::TransitionEvent::elapsedTime):
(WebCore::TransitionEvent::interfaceName):
* dom/TransitionEvent.h: Added.
(WebCore):
(TransitionEventInit):
(TransitionEvent):
(WebCore::TransitionEvent::create):
* dom/TransitionEvent.idl: Added.
* page/DOMWindow.idl:
* page/animation/AnimationController.cpp:
(WebCore::AnimationControllerPrivate::fireEventsAndUpdateStyle): always
create a TransitionEvent now. EventTarget will be responsible to create
a WebKitTransitionEvent if necessary.

LayoutTests:

Add new tests to cover the feature. Update some existing ones with new
expected results as a new constructor was added.

* fast/dom/constructed-objects-prototypes.html:
* fast/dom/constructed-objects-prototypes-expected.txt:
* fast/events/constructors/transition-event-constructor-expected.txt: Added.
* fast/events/constructors/transition-event-constructor.html: Added.
* fast/events/event-creation.html:
* platform/chromium/TestExpectations: Chromium turns the feature off.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140448 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r140392): InjectIDBKeyTest.TopLevelPropertyStringValue is crashing
https://bugs.webkit.org/show_bug.cgi?id=107578

Unreviewed build fix. Disabled 2 tests that are crashing after r140392.

* tests/IDBBindingUtilitiesTest.cpp:
(WebKit::TEST_F):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140449 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r140231): media track layout tests crashing
https://bugs.webkit.org/show_bug.cgi?id=107579

Unreviewed. Mark 3 tests as crashing:
media/track/track-css-cue-lifetime.html
media/track/track-css-matching.html
media/track/track-css-property-whitelist.html

* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140450 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WTF project files and property sheets for getting WebKit to compile in VS2010.
https://bugs.webkit.org/show_bug.cgi?id=106986

Reviewed by Timothy Horton and Brent Fulgham.

* WTF.vcproj/WTF.sln:
* WTF.vcxproj: Added.
* WTF.vcxproj/WTF.vcxproj: Added.
* WTF.vcxproj/WTF.vcxproj.filters: Added.
* WTF.vcxproj/WTF.vcxproj.user: Added.
* WTF.vcxproj/WTFCommon.props: Added.
* WTF.vcxproj/WTFDebug.props: Added.
* WTF.vcxproj/WTFGenerated.make: Added.
* WTF.vcxproj/WTFGenerated.vcxproj: Added.
* WTF.vcxproj/WTFGenerated.vcxproj.filters: Added.
* WTF.vcxproj/WTFGenerated.vcxproj.user: Added.
* WTF.vcxproj/WTFGeneratedCommon.props: Added.
* WTF.vcxproj/WTFGeneratedDebug.props: Added.
* WTF.vcxproj/WTFGeneratedRelease.props: Added.
* WTF.vcxproj/WTFPostBuild.cmd: Added.
* WTF.vcxproj/WTFPreBuild.cmd: Added.
* WTF.vcxproj/WTFPreLink.cmd: Added.
* WTF.vcxproj/WTFRelease.props: Added.
* WTF.vcxproj/build-generated-files.sh: Added.
* WTF.vcxproj/copy-files.cmd: Added.
* WTF.vcxproj/work-around-vs-dependency-tracking-bugs.py: Added.
* config.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140451 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Assertion parent->inDocument() failed in WebCore::PseudoElement::PseudoElement
https://bugs.webkit.org/show_bug.cgi?id=106224

Reviewed by Ojan Vafai.

Appending a node that contains a <style> and also elements that should have
generated content can cause us to create PseudoElements in nodes that are not
yet inDocument because we may recalcStyle in HTMLStyleElement::insertedInto
triggering a reattach() which could then traverse into the siblings of the
<style> attaching them even though they are not yet inDocument.

This means that we should not assert about the parent of a PseudoElement
being inDocument as this is not always the case.

Instead forward Node::insertedInto and removedFrom notifications to
PseudoElements so they will correctly get their inDocument bit set. Nothing
in the code appears to depend on them being inDocument we just make sure to
set it so they're consistent with the rest of the document.

No new tests, there's no way to test that PseudoElements are really inDocument.

* dom/Element.cpp:
(WebCore::Element::insertedInto):
(WebCore::Element::removedFrom):
* dom/PseudoElement.cpp:
(WebCore::PseudoElement::PseudoElement):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140452 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Make CompactHTMLToken a little more compact
https://bugs.webkit.org/show_bug.cgi?id=107317

Reviewed by Darin Adler.

Reduce the size of CompactHTMLToken by two pointers.
The abuse of the attribute vector to store the DOCTYPE strings
is kinda lame, but makes a lot of sense given how rare DOCTYPE tokens are.

The resulting CompactHTMLToken vector should be a smaller malloc and thus faster.
However I saw no perf change on html-parser-srcdoc.html.

* html/parser/CompactHTMLToken.cpp:
(SameSizeAsCompactHTMLToken):
(WebCore):
(WebCore::CompactHTMLToken::CompactHTMLToken):
(WebCore::CompactHTMLToken::isSafeToSendToAnotherThread):
* html/parser/CompactHTMLToken.h:
(WebCore::CompactHTMLToken::type):
(CompactHTMLToken):
(WebCore::CompactHTMLToken::publicIdentifier):
(WebCore::CompactHTMLToken::systemIdentifier):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140453 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix a race condition on SkBitmap::lockPixels()/unlockPixels() for lazy image decoding
https://bugs.webkit.org/show_bug.cgi?id=107404

Patch by Min Qin <qinmin@chromium.org> on 2013-01-22
Reviewed by Stephen White.

Skbitmap::lockPixels()/unlockPixels() are not threadsafe.
unlike SkPixelRef, these 2 calls are not protected by an internal mutex.
Bugfix, no behaviral change and hard to test as tests will be flaky.

* platform/graphics/chromium/ImageDecodingStore.cpp:
(WebCore::ImageDecodingStore::lockCache):
(WebCore::ImageDecodingStore::unlockCache):
(WebCore::ImageDecodingStore::insertAndLockCache):
(WebCore::ImageDecodingStore::overwriteAndLockCache):
* platform/graphics/chromium/ImageDecodingStore.h:
(ImageDecodingStore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140454 268f45cc-cd09-0410-ab3c-d52691b4dbfc