FEComponentTransfer could be faster.
https://bugs.webkit.org/show_bug.cgi?id=119671

Patch by Jinwoo Jeong <jw00.jeong@samsung.com> on 2013-08-14
Reviewed by Christophe Dumez.

Use direct writing to target data instead of calling Uint8ClampedArray::set() function.
This change reduces at least 80% time in the loop of that function.

The Uint8ClampedArray::set() function has index checking code, value checking code and value casting code.
But the index is managed by for loop condition, the value is generated by transferFunction.
And the value is already defined as unsigned char.
Thus all works in Uint8ClampedArray::set() function is redundant.
Removing the call to Uint8ClampedArray::set() function does not reduce stability but improves performance.

* platform/graphics/filters/FEComponentTransfer.cpp:
(WebCore::FEComponentTransfer::platformApplySoftware):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154042 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add toSVGTextPathElement(), and use it
https://bugs.webkit.org/show_bug.cgi?id=119783

Reviewed by Ryosuke Niwa.

As a step to clean-up static_cast<SVGXXX>, static_cast<SVGTextPathElement*> can
be changed with toSVGTextPathElement().

* rendering/svg/RenderSVGTextPath.cpp:
(WebCore::RenderSVGTextPath::layoutPath):
(WebCore::RenderSVGTextPath::startOffset):
(WebCore::RenderSVGTextPath::exactAlignment):
(WebCore::RenderSVGTextPath::stretchMethod):
* svg/SVGTextPathElement.h:
(WebCore::toSVGTextPathElement):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154043 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Grid Layout] Align our grid-line handling with the updated specification
https://bugs.webkit.org/show_bug.cgi?id=113546

Reviewed by Andreas Kling.

From Blink r148091 by <jchaffraix@chromium.org>

Source/WebCore:

This change makes us match the updated specification by making
grid line numbers to always resolve against the
grid-{column|row}-start edge (the previous code would resolve
grid-{column|row}-end grid lines against the grid-{column|row}-end
edge).

To keep feature parity, negative numbers resolve against the
grid-{column|row}-end edge of the 'explicit grid'.

Test: fast/css-grid-layout/grid-item-negative-integer-explicit-grid-resolution.html

* rendering/RenderGrid.cpp:
(WebCore::estimatedGridSizeForPosition):
(WebCore::RenderGrid::explicitGridColumnCount): New utility function.
(WebCore::RenderGrid::explicitGridRowCount): Ditto.
(WebCore::RenderGrid::maximumIndexInDirection): Use explicitGridXXXCount().
(WebCore::RenderGrid::resolveGridPositionsFromStyle): Check that row-end > row-start.
(WebCore::RenderGrid::resolveGridPositionFromStyle): Clamp negative values to the first line.
* rendering/RenderGrid.h:
* rendering/style/GridPosition.h:

LayoutTests:

Added a couple of new tests to cover the cases of grid resolutions
using negative integers. Negative integers must resolve against
the grid-{column|row}-end of the explicit grid.

* fast/css-grid-layout/grid-auto-flow-resolution-expected.txt:
* fast/css-grid-layout/grid-auto-flow-resolution.html:
* fast/css-grid-layout/grid-item-negative-integer-explicit-grid-resolution-expected.txt: Added.
* fast/css-grid-layout/grid-item-negative-integer-explicit-grid-resolution.html: Added.
* fast/css-grid-layout/grid-item-spanning-resolution-expected.txt:
* fast/css-grid-layout/grid-item-spanning-resolution.html:
* fast/css-grid-layout/resources/grid.css:
(.autoLastRowAutoLastColumn):
(.autoSecondRowAutoFirstColumn):
(.firstRowBothColumn):
(.secondRowBothColumn):
(.bothRowFirstColumn):
(.bothRowSecondColumn):
(.bothRowBothColumn):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154044 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERT(m_frame->view() == this) fails
https://bugs.webkit.org/show_bug.cgi?id=119015

Reviewed by Simon Fraser.

Introduced the method fixedLayoutSizeChanged and made it chack if the view
is attached to the frame before issuing contentsResized.

* page/FrameView.cpp:
(WebCore::FrameView::fixedLayoutSizeChanged):
* page/FrameView.h:
* platform/ScrollView.cpp:
(WebCore::ScrollView::setFixedLayoutSize):
(WebCore::ScrollView::setUseFixedLayout):
(WebCore::ScrollView::fixedLayoutSizeChanged):
* platform/ScrollView.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154045 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Unreviewd gardening. Skipping failing tests on x86.

Patch by Gabor Abraham <abrhm@inf.u-szeged.hu> on 2013-08-14

* platform/qt/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154046 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove Node::attach() and ContainerNode::attach()
https://bugs.webkit.org/show_bug.cgi?id=119698

Reviewed by Andreas Kling.

Currently attach() is a virtual function on Node. However only Elements have style and so a corresponding 
independent render object. Attaching should be made Element level concept.
        
This patch merges Node::attach() and ContainerNode::attach() to Element::attach(). Other related functions
(detach(), reattach(), etc) move similarly.
        
Next step here is to make attach non-virtual in common case and move it out from the DOM tree.

* dom/ContainerNode.cpp:
(WebCore::attachChild):
(WebCore::detachChild):
        
    Temporary helpers. Further refactoring should get rid of these.

(WebCore::ContainerNode::takeAllChildrenFrom):
(WebCore::ContainerNode::removeBetween):
(WebCore::updateTreeAfterInsertion):
* dom/ContainerNode.h:
* dom/Document.cpp:
(WebCore::Document::attach):
(WebCore::Document::detach):
        
    Copy the relevant parts of the code from base class attach/detach here. It is not much.

* dom/Document.h:
* dom/Element.cpp:
(WebCore::Element::~Element):
        
    Node destructor no longer detaches.

(WebCore::Element::attachChildren):
(WebCore::Element::attach):
        
    Combine Node::attach(), ContainerNode::attach() and Element::attach().

(WebCore::Element::detachChildren):
(WebCore::Element::detach):
        
    Combine Node::detach(), ContainerNode::detach() and Element::detach().

(WebCore::Element::reattach):
(WebCore::Element::reattachIfAttached):
(WebCore::Element::lazyReattach):
(WebCore::Element::lazyAttach):
        
    This stuff moves from ContainerNode/Node.

* dom/Element.h:
(WebCore::Element::AttachContext::AttachContext):
* dom/ElementShadow.cpp:
(WebCore::ElementShadow::removeShadowRoot):
(WebCore::ElementShadow::attach):
(WebCore::ElementShadow::detach):
* dom/ElementShadow.h:
* dom/Node.cpp:
(WebCore::Node::~Node):
        
    Assert that we are not attached at this point.

(WebCore::Node::markAncestorsWithChildNeedsStyleRecalc):
* dom/Node.h:
(WebCore::Node::setAttached):
(WebCore::Node::setStyleChange):
        
    Make available.

* dom/NodeRenderingContext.cpp:
(WebCore::NodeRenderingContext::NodeRenderingContext):
* dom/NodeRenderingContext.h:
* dom/ShadowRoot.cpp:
(WebCore::ShadowRoot::attach):
(WebCore::ShadowRoot::detach):
* dom/ShadowRoot.h:
* dom/Text.cpp:
(WebCore::Text::~Text):
        
    Node destructor no longer detaches. Add destructor.

(WebCore::Text::createTextRenderersForSiblingsAfterAttachIfNeeded):
        
    Factor the code that updates sibling text renderers after attach into a function.

(WebCore::Text::attachText):
(WebCore::Text::detachText):
        
    Text::attachText/detachText replace virtual Node::attach/detach. They do the part of the work text nodes actually ended up doing.

(WebCore::Text::updateTextRenderer):
* dom/Text.h:
* html/HTMLViewSourceDocument.cpp:
(WebCore::HTMLViewSourceDocument::addText):
* html/PluginDocument.cpp:
(WebCore::PluginDocument::detach):
* html/PluginDocument.h:
* html/parser/HTMLConstructionSite.cpp:
(WebCore::executeTask):
* html/shadow/ContentDistributor.cpp:
(WebCore::ContentDistributor::invalidateDistribution):
* html/shadow/InsertionPoint.cpp:
(WebCore::InsertionPoint::attach):
(WebCore::InsertionPoint::detach):
* loader/PlaceholderDocument.cpp:
(WebCore::PlaceholderDocument::attach):
* loader/PlaceholderDocument.h:
* style/StyleResolveTree.cpp:
(WebCore::Style::resolveLocal):
(WebCore::Style::updateTextStyle):
* xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::exitText):
* xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::XMLDocumentParser::processingInstruction):
(WebCore::XMLDocumentParser::cdataBlock):
(WebCore::XMLDocumentParser::comment):
        
    No need to attach non-rendered nodes.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154047 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Try to fix Qt build.
        
Not reviewed.

* xml/parser/XMLDocumentParserQt.cpp:
(WebCore::XMLDocumentParser::parseProcessingInstruction):
(WebCore::XMLDocumentParser::parseCdata):
(WebCore::XMLDocumentParser::parseComment):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154048 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: resultAnimationElement->m_animatedType in WebCore::SVGAnimateElement::calculateAnimatedValue
https://bugs.webkit.org/show_bug.cgi?id=119748

Reviewed by Dirk Schulze.

Source/WebCore:

Avoid animation when attributeType="CSS" is used on an animateTransform.

Tests: svg/animations/animateTransform-translate-attributetype-auto.html
       svg/animations/animateTransform-translate-invalid-attributetype.html

* svg/SVGAnimateTransformElement.cpp:
(WebCore::SVGAnimateTransformElement::hasValidAttributeType):

LayoutTests:

Test that using animateTransform with attributeType="CSS" will cause no animateTransform animation, and
attributeType="auto" will act as "XML".

* svg/animations/animateTransform-translate-attributetype-auto-expected.txt: Added.
* svg/animations/animateTransform-translate-attributetype-auto.html: Added.
* svg/animations/animateTransform-translate-invalid-attributetype-expected.txt: Added.
* svg/animations/animateTransform-translate-invalid-attributetype.html: Added.
* svg/animations/script-tests/animateTransform-translate-attributetype-auto.js: Added.
(sample1):
(sample2):
(sample3):
(executeTest):
* svg/animations/script-tests/animateTransform-translate-invalid-attributetype.js: Added.
(sample):
(executeTest):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154049 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Revert r154019; causes >50 tests to fail on WebKit1 bots.

* Plugins/Hosted/NetscapePluginHostManager.h:
* Plugins/Hosted/NetscapePluginHostManager.mm:
(WebKit::NetscapePluginHostManager::instantiatePlugin):
* Plugins/Hosted/NetscapePluginHostProxy.mm:
* Plugins/Hosted/NetscapePluginInstanceProxy.h:
* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
* Plugins/Hosted/WebHostedNetscapePluginView.h:
* Plugins/Hosted/WebHostedNetscapePluginView.mm:
(-[WebHostedNetscapePluginView setAttributeKeys:andValues:]):
(-[WebHostedNetscapePluginView createPlugin]):
(-[WebHostedNetscapePluginView updateAndSetWindow]):
* Plugins/Hosted/WebKitPluginClient.defs:
* Plugins/Hosted/WebKitPluginHost.defs:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154050 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CMake] Fix building with bison-3.0.
https://bugs.webkit.org/show_bug.cgi?id=119788

Patch by Gabor Abraham <abrhm@inf.u-szeged.hu> on 2013-08-14
Reviewed by Zoltan Herczeg.

No new tests, just build fix.

* CMakeLists.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154051 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG_JIT implementation for sh4 architecture.
https://bugs.webkit.org/show_bug.cgi?id=119737

Patch by Julien Brianceau <jbrianceau@nds.com> on 2013-08-14
Reviewed by Oliver Hunt.

Source/JavaScriptCore:

* assembler/MacroAssemblerSH4.h:
(JSC::MacroAssemblerSH4::invert):
(JSC::MacroAssemblerSH4::add32):
(JSC::MacroAssemblerSH4::and32):
(JSC::MacroAssemblerSH4::lshift32):
(JSC::MacroAssemblerSH4::mul32):
(JSC::MacroAssemblerSH4::or32):
(JSC::MacroAssemblerSH4::rshift32):
(JSC::MacroAssemblerSH4::sub32):
(JSC::MacroAssemblerSH4::xor32):
(JSC::MacroAssemblerSH4::store32):
(JSC::MacroAssemblerSH4::swapDouble):
(JSC::MacroAssemblerSH4::storeDouble):
(JSC::MacroAssemblerSH4::subDouble):
(JSC::MacroAssemblerSH4::mulDouble):
(JSC::MacroAssemblerSH4::divDouble):
(JSC::MacroAssemblerSH4::negateDouble):
(JSC::MacroAssemblerSH4::zeroExtend32ToPtr):
(JSC::MacroAssemblerSH4::branchTruncateDoubleToUint32):
(JSC::MacroAssemblerSH4::truncateDoubleToUint32):
(JSC::MacroAssemblerSH4::swap):
(JSC::MacroAssemblerSH4::jump):
(JSC::MacroAssemblerSH4::branchNeg32):
(JSC::MacroAssemblerSH4::branchAdd32):
(JSC::MacroAssemblerSH4::branchMul32):
(JSC::MacroAssemblerSH4::urshift32):
* assembler/SH4Assembler.h:
(JSC::SH4Assembler::SH4Assembler):
(JSC::SH4Assembler::labelForWatchpoint):
(JSC::SH4Assembler::label):
(JSC::SH4Assembler::debugOffset):
* dfg/DFGAssemblyHelpers.h:
(JSC::DFG::AssemblyHelpers::preserveReturnAddressAfterCall):
(JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):
(JSC::DFG::AssemblyHelpers::debugCall):
* dfg/DFGCCallHelpers.h:
(JSC::DFG::CCallHelpers::setupArguments):
(JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
* dfg/DFGFPRInfo.h:
(JSC::DFG::FPRInfo::toRegister):
(JSC::DFG::FPRInfo::toIndex):
(JSC::DFG::FPRInfo::debugName):
* dfg/DFGGPRInfo.h:
(JSC::DFG::GPRInfo::toRegister):
(JSC::DFG::GPRInfo::toIndex):
(JSC::DFG::GPRInfo::debugName):
* dfg/DFGOperations.cpp:
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* jit/JITStubs.h:
* jit/JITStubsSH4.h:

Source/WTF:

* wtf/Platform.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154052 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Activate visibility API layout tests
https://bugs.webkit.org/show_bug.cgi?id=119790

Patch by Benjamin Dupont <bdupont@nds.com> on 2013-08-14
Reviewed by Allan Sandfeld Jensen.

Tools:

* DumpRenderTree/qt/TestRunnerQt.cpp:
(TestRunner::resetPageVisibility):
(TestRunner::setPageVisibility):

LayoutTests:

* platform/qt/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154053 268f45cc-cd09-0410-ab3c-d52691b4dbfc
createAttribute/setAttributeNode does not properly normalize case
https://bugs.webkit.org/show_bug.cgi?id=90341

Reviewed by Darin Adler.

Source/WebCore:

setAttributeNode() verifies for existing attributes in a case sensitive
manner. Thus, it would add another attribute if specified in a case
different from the existing one. Instead, like setAttribute(), it too
should modify the existing attribute's value.

Tests: fast/dom/Element/setAttributeNode-case-insensitivity-xhtml.xhtml
       fast/dom/Element/setAttributeNode-case-insensitivity.html

* dom/Element.cpp:
(WebCore::Element::setAttributeNode):
Passing the second param (shouldIgnoreAttributeCase) to
findAttributeIndexByNameForAttributeNode() method. We are now letting
findAttributeIndexByNameForAttributeNode() handle the case-sensitive/insensitive
checking.

(WebCore::ElementData::findAttributeIndexByNameForAttributeNode):
* dom/Element.h:
Added shouldIgnoreAttributeCase boolean param to the method. It passes
this on to QualifiedName::matchesIgnoringCaseForLocalName() method.

* dom/QualifiedName.h:
(WebCore::QualifiedName::matchesIgnoringCaseForLocalName):
New method added for doing a case-insensitive comparison based on the
shouldIgnoreCase param passed to this method.

LayoutTests:

* fast/dom/Element/setAttributeNode-case-insensitivity.html: Added.
* fast/dom/Element/setAttributeNode-case-insensitivity-expected.txt: Added.
Testcase for verifying that setAttributeNode() checks against existing
attributes in a case insensitive manner. It updates the value of an
existing attribute (in lower case) with that of the one set using
setAttributeNode() (in upper case).
The test also verifies the behavior of attributes when specified with
namespace and prefix.

* fast/dom/Element/setAttributeNode-case-insensitivity-xhtml-expected.txt: Added.
* fast/dom/Element/setAttributeNode-case-insensitivity-xhtml.xhtml: Added.
Testcase added for verifying that the default behavior for xhtml documents
does not change with this fix.
For xhtml documents, attributes can be added case sensitively. This testcase
verifies that two attributes with the same name but different case are
allowed for an xhtml document.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154054 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Move id attribute to parent Element interface
https://bugs.webkit.org/show_bug.cgi?id=119706

Reviewed by Ryosuke Niwa.

Source/WebCore:

Move id attribute from SVGElement / HTMLElement to their Element parent
interface to match the latest DOM specification and avoid duplication:
http://dom.spec.whatwg.org/#dom-element-id

There is no web-exposed behavior change because we haven't moved
properties from instances to their prototype, as per the Web IDL
specification (http://dev.w3.org/2006/webapi/WebIDL/#es-attributes).

Firefox already exposes the id property of Element's prototype.

This patch also drops the comment about returning the empty string when
no id is present (introduced in http://trac.webkit.org/changeset/4417).
This comment is redundant since the id property is already marked to
"reflect" the id attribute. Returning the empty string when the
attribute is not present is the normal behavior when reflecting:
http://www.whatwg.org/specs/web-apps/current-work/multipage/common-dom-interfaces.html#reflect

No new test, no web-exposed behavior change.

* dom/Element.idl:
* html/HTMLElement.idl:
* svg/SVGElement.idl:

LayoutTests:

Rebaseline fast/js/dom-static-property-for-in-iteration.html as
the order has changed.

* fast/js/dom-static-property-for-in-iteration-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154057 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Headings not longer have an AXTitle if they have a link as the only child
https://bugs.webkit.org/show_bug.cgi?id=119699

Reviewed by Anders Carlsson.

Source/WebCore: 

Normally, focusable content is not incuded when looking at the visible text of an element.
One case where we need an exception is with headings, where there is usually link content inside the heading
that we want to be used as the visible text.

Test: accessibility/heading-title-includes-links.html

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::visibleText):
(WebCore::shouldUseAccessiblityObjectInnerText):
(WebCore::AccessibilityNodeObject::title):
* accessibility/AccessibilityNodeObject.h:
* accessibility/AccessibilityObject.h:
(WebCore::AccessibilityTextUnderElementMode::AccessibilityTextUnderElementMode):
(WebCore::AccessibilityObject::textUnderElement):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::textUnderElement):
* accessibility/AccessibilityRenderObject.h:

LayoutTests: 

* accessibility/heading-title-includes-links.html: Added.
* platform/mac/accessibility/heading-title-includes-links-expected.txt: Added.
* platform/mac/accessibility/internal-link-anchors2-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154058 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add a hyperlink from build.webkit.org to the flakiness dashboard.

Rubbers-tamped by Simon Fraser.

* BuildSlaveSupport/build.webkit.org-config/templates/root.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154061 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION(r153815): fast/repaint/caret-jump-between-nodes.html sucks.
<http://webkit.org/b/119520>

Unreviewed, remove the description text from this repaint test in an attempt
to get consistent cross-platform results.

* fast/repaint/caret-jump-between-nodes-expected.txt:
* fast/repaint/caret-jump-between-nodes.html:
* platform/gtk/fast/repaint/caret-jump-between-nodes-expected.txt: Removed.
* platform/qt-5.0-wk2/fast/repaint/caret-jump-between-nodes-expected.txt: Removed.
* platform/qt/fast/repaint/caret-jump-between-nodes-expected.txt: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154062 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Assertion failure in RenderObject::drawLineForBoxSide
https://bugs.webkit.org/show_bug.cgi?id=108187

Reviewed by David Hyatt.

Source/WebCore:

Don't draw the outline if the rectangle to draw is empty.

Test: fast/css/outline-negative.html

* rendering/RenderInline.cpp:
(WebCore::RenderInline::paintOutlineForLine):

LayoutTests:

Add testcase from bug with small adjustments.

* fast/css/outline-negative-expected.txt: Added.
* fast/css/outline-negative.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154064 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<http://webkit.org/b/119520> REGRESSION(154062): fast/repaint/caret-jump-between-nodes.html flakes on bots.

Unreviewed. This isn't working out. I can't get it to blink the caret a consistent number of times.
Removing the test for now to stop making bots red.

* fast/repaint/caret-jump-between-nodes-expected.txt: Removed.
* fast/repaint/caret-jump-between-nodes.html: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154065 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Compile fix for Win64 with jit disabled.
https://bugs.webkit.org/show_bug.cgi?id=119804

Reviewed by Michael Saboff.

* offlineasm/cloop.rb: Added std:: before isnan.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154066 268f45cc-cd09-0410-ab3c-d52691b4dbfc