Update TypedArrays to throw RangeError or similar instead of INDEX_SIZE_ERR
https://bugs.webkit.org/show_bug.cgi?id=45118

Patch by Arnaud Renevier <a.renevier@sisa.samsung.com> on 2012-08-03
Reviewed by Kenneth Russell.

Source/WebCore:

Update TypedArrays to raise JavaScript RangeError instead of dom
INDEX_SIZE_ERR exceptions. Also, update TypedArrays to raise TypeError
instead of JavaScript SyntaxError or dom exceptions SYNTAX_ERR when
calling set method with invalid arguments.

Specification does not define the type of exceptions to raise, but
other browsers raise JavaScript errors, so those changes will improve
compatibility.

New Test: fast/canvas/webgl/array-set-invalid-arguments.html

Updated Tests expectations:
    fast/canvas/webgl/array-set-out-of-bounds.html
    fast/canvas/webgl/data-view-crash.html
    fast/canvas/webgl/data-view-test.html

* bindings/js/JSArrayBufferViewHelper.h:
(WebCore):
(WebCore::setWebGLArrayWithTypedArrayArgument):
(WebCore::setWebGLArrayHelper):
(WebCore::constructArrayBufferViewWithTypedArrayArgument):
(WebCore::constructArrayBufferViewWithArrayBufferArgument):
(WebCore::constructArrayBufferView):
* bindings/v8/custom/V8ArrayBufferViewCustom.h:
(WebCore):
(WebCore::constructWebGLArrayWithArrayBufferArgument):
(WebCore::setWebGLArrayHelper):

LayoutTests:

New test to test invalid arguments to TypedArray set method

Update array-set-out-of-bounds.html, data-view-crash.html and
data-view-test.html test expectations no match new exceptions thrown.

* fast/canvas/webgl/array-set-invalid-arguments-expected.txt: Added.
* fast/canvas/webgl/array-set-invalid-arguments.html: Added.
* fast/canvas/webgl/array-set-out-of-bounds-expected.txt:
* fast/canvas/webgl/data-view-crash-expected.txt:
* fast/canvas/webgl/data-view-test-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124668 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Remove assert when getting hardware renderingStats in software mode.
https://bugs.webkit.org/show_bug.cgi?id=92325

Patch by Dave Tu <dtu@chromium.org> on 2012-08-03
Reviewed by Adrienne Walker.

If a page caused hardware mode to be turned on, then off, the hardware stats are still valid, so we don't need to assert that we're in hardware mode. Checking if the LayerTreeView is null should be sufficient.

* public/WebWidget.h:
(WebWidget):
* src/WebViewImpl.cpp:
(WebKit::WebViewImpl::WebViewImpl):
(WebKit::WebViewImpl::renderingStats):
(WebKit::WebViewImpl::paint):
* src/WebViewImpl.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124670 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement computePreferredLogicalWidths on RenderGrid
https://bugs.webkit.org/show_bug.cgi?id=92908

Reviewed by Ojan Vafai.

Source/WebCore:

This functions implements a primitive computePreferredLogicalWidths
so that we properly handle vertical writing modes.

Covered by fast/css-grid-layout/place-cell-by-index.html.

* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::computePreferredLogicalWidths):
* rendering/RenderGrid.h:
Added computePreferredLogicalWidths.

LayoutTests:

* fast/css-grid-layout/place-cell-by-index-expected.txt:
Updated the expected file (everything passes now).
* fast/css-grid-layout/place-cell-by-index.html:
Removed some FIXMEs and added one about the expected offsets making
a wrong assumption. It's fine to keep this testing until we support
this part of the spec.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124671 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r124668.
http://trac.webkit.org/changeset/124668
https://bugs.webkit.org/show_bug.cgi?id=93167

Broke Mac build (Requested by kbr_google on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2012-08-03

Source/WebCore:

* bindings/js/JSArrayBufferViewHelper.h:
(WebCore::setWebGLArrayWithTypedArrayArgument):
(WebCore::setWebGLArrayHelper):
(WebCore::constructArrayBufferViewWithTypedArrayArgument):
(WebCore::constructArrayBufferViewWithArrayBufferArgument):
(WebCore::constructArrayBufferView):
* bindings/v8/custom/V8ArrayBufferViewCustom.h:
(WebCore::constructWebGLArrayWithArrayBufferArgument):
(WebCore):
(WebCore::constructWebGLArray):
(WebCore::setWebGLArrayHelper):

LayoutTests:

* fast/canvas/webgl/array-set-invalid-arguments-expected.txt: Removed.
* fast/canvas/webgl/array-set-invalid-arguments.html: Removed.
* fast/canvas/webgl/array-set-out-of-bounds-expected.txt:
* fast/canvas/webgl/data-view-crash-expected.txt:
* fast/canvas/webgl/data-view-test-expected.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124672 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Double tap gesture should send dblclick event
https://bugs.webkit.org/show_bug.cgi?id=92412

Patch by Rick Byers <rbyers@chromium.org> on 2012-08-03
Reviewed by Adam Barth.

Source/WebCore:

Propagate the tap count from PlatformGestureEvent in the derived mouse
events.

Also fixes a crash with unexpected GestureDoubleTap events by just
supressing them early.  They will probably be removed soon anyway.

Test: fast/events/touch/gesture/gesture-dblclick.html

* page/EventHandler.cpp:
(WebCore::EventHandler::handleGestureEvent):
(WebCore::EventHandler::handleGestureTap):

Source/WebKit/chromium:

Tweak comment to more completely describe the (lame) overloaded use
of deltaX in WebGestureEvent, and add a FIXME with the bug to track
cleaning it up.
* public/WebInputEvent.h:
(WebGestureEvent):

Tools:

Enable EventSender to set the tap count on tap gesture events.  The
delta X/Y parameters were not actually being used anymore (used to be
used for radius information).

* DumpRenderTree/chromium/TestRunner/EventSender.cpp:
(EventSender::gestureEvent):

LayoutTests:

Adds test for derived mouse events generated by a sequence of two tap
events.  Modeled after gesture-click.html.
* fast/events/touch/gesture/gesture-dblclick-expected.txt: Added.
* fast/events/touch/gesture/gesture-dblclick.html: Added.
* platform/chromium/fast/events/touch/gesture/gesture-dblclick-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124673 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Layout Test media/video-currentTime-set2.html is flakily crashing
https://bugs.webkit.org/show_bug.cgi?id=92852

Unreviewed, test expectation change only.

The DCHECK in question was removed in http://crrev.com/149452


* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124674 268f45cc-cd09-0410-ab3c-d52691b4dbfc
IndexedDB: Core upgradeneeded logic
https://bugs.webkit.org/show_bug.cgi?id=92558

Reviewed by Ojan Vafai.

Source/WebCore:

This is the backend webkit logic needed for integer versions. The rest
is in https://bugs.webkit.org/show_bug.cgi?id=89505.

I tried to make use of the existing processPendingCalls and added two
more queues, pendingOpenWithVersionCalls and
pendingSecondHalfOpenWithVersionCalls. The "second half" refers to
how there are two events that need to be fired in response to an
open-with-version call. The "second half" queue holds the open
requests that should immediately follow the caller's upgradeneeded
handler.

No new tests, there are so many they are in their own patch:
https://bugs.webkit.org/show_bug.cgi?id=92560

Though this patch doesn't change any expected behavior anyway, lack of
regressions is what we're hoping for here.

* Modules/indexeddb/IDBBackingStore.h:
(IDBBackingStore):
* Modules/indexeddb/IDBCallbacks.h:
(WebCore::IDBCallbacks::onBlocked):
(WebCore::IDBCallbacks::onUpgradeNeeded):
* Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
(IDBDatabaseBackendImpl::PendingOpenCall):
(IDBDatabaseBackendImpl::PendingOpenWithVersionCall):
(WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::create):
(WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::callbacks):
(WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::version):
(WebCore::IDBDatabaseBackendImpl::PendingOpenWithVersionCall::PendingOpenWithVersionCall):
(WebCore):
(WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
(WebCore::IDBDatabaseBackendImpl::openInternal):
(WebCore::IDBDatabaseBackendImpl::metadata):
(WebCore::IDBDatabaseBackendImpl::setVersion):
(WebCore::IDBDatabaseBackendImpl::setIntVersionInternal):
(WebCore::IDBDatabaseBackendImpl::transactionFinished):
(WebCore::IDBDatabaseBackendImpl::transactionFinishedAndEventsFired):
When an upgradeneeded event is fired in response to an
open-with-version call, the version change transaction must receive its
complete event before processPendingCalls fires a success event at
IDBOpenDBRequest. In the future this should probably be changed
instead to transactionFinishedAndAbortFired and
transactionFinishedAndCompleteFired so that we'll know to fire a
success or error event at IDBOpenDBRequest. Currently, instead of
firing error when there's an abort, we don't fire anything.

(WebCore::IDBDatabaseBackendImpl::processPendingCalls):
Now that this is called after a connection is opened, we unfortunately
lose the invariant that there is only one existing connection when this
is called, but nothing inside this function actually relied on that.
Additionally, the secondHalfOpen calls only ever need to be serviced
in one place: right after a version change transaction completes, so
it could be moved out of here.

(WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
Now that setVersion and deleteDatabase calls are queued up behind
secondHalfOpen calls, we have to service those queues when
secondHalfOpen calls complete, which is here.  So call
processPendingCalls().

(WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):
(WebCore::IDBDatabaseBackendImpl::openConnectionWithVersion):
(WebCore::IDBDatabaseBackendImpl::deleteDatabase):
(WebCore::IDBDatabaseBackendImpl::close):
* Modules/indexeddb/IDBDatabaseBackendImpl.h:
(IDBDatabaseBackendImpl):
* Modules/indexeddb/IDBDatabaseCallbacks.h:
(WebCore::IDBDatabaseCallbacks::onVersionChange):
* Modules/indexeddb/IDBFactoryBackendImpl.cpp:
(WebCore::IDBFactoryBackendImpl::open):
This is refactored some so that the call to openConection{WithVersion}
happens once, at the end.

* Modules/indexeddb/IDBLevelDBBackingStore.cpp:
(WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
(WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
(WebCore::IDBLevelDBBackingStore::updateIDBDatabaseIntVersion):
(WebCore):
(WebCore::IDBLevelDBBackingStore::deleteDatabase):
* Modules/indexeddb/IDBLevelDBBackingStore.h:
(IDBLevelDBBackingStore):
* Modules/indexeddb/IDBTransactionBackendImpl.cpp:
(WebCore::IDBTransactionBackendImpl::commit):
See above comments about transactionFinishedAndEventsFired. I tried
moving the call to transactionFinished after the events were fired but
that failed some asserts. But changing those asserts is still an
alternative to splitting up transactionFinished as is done here.

Source/WebKit/chromium:

Update overridden methods to match new signatures.

* tests/IDBAbortOnCorruptTest.cpp:
(WebCore::FailingBackingStore::createIDBDatabaseMetaData):
* tests/IDBFakeBackingStore.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124675 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chrome-Android] - Prepare apk tests for switch to checked in SDK.
https://bugs.webkit.org/show_bug.cgi?id=92931

Patch by Yaron Friedman <yfriedman@chromium.org> on 2012-08-03
Reviewed by Adam Barth.

Source/WebKit/chromium:

Pass Android-specific gyp variables to the native test generator
avoiding any dependencies on environment variables during build time.

* WebKitUnitTests.gyp:

Tools:

Pass Android-specific gyp variables to the native test generator,
avoiding any dependencies on environment variables during build time.

* DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
* TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124676 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Fix Renderer4.CompositorThreadImplDrawDelay histogram.
https://bugs.webkit.org/show_bug.cgi?id=93159

Patch by Dave Tu <dtu@chromium.org> on 2012-08-03
Reviewed by Adrienne Walker.

The histogram is using the frame number instead of the frame time by mistake.

* platform/graphics/chromium/cc/CCFrameRateCounter.cpp:
(WebCore::CCFrameRateCounter::markBeginningOfFrame):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124677 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
https://bugs.webkit.org/show_bug.cgi?id=92691

Reviewed by Mark Hahnenberg.

The state of the stubs was changing after we determined the type (by virtue of the slow path
function that was called), since the get or put (in this case put) could cause arbitrary
side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
function to determine what to do, but an easier fix for now is to have the slow path give up
if its assumptions were invalidated by a side effect.

* dfg/DFGOperations.cpp:
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124678 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Convert HTML parser to handle 8-bit resources without converting to UChar*
https://bugs.webkit.org/show_bug.cgi?id=90321

Reviewed by Adam Barth.

Source/WebCore: 

No new tests, no new functionality therefore covered by existing tests.

Changed the parsing of HTML to handle 8-bit strings without converting the 
whole string to 16-bits.  Primary change was to use the appropriate 
character pointer type (LChar* or UChar*) depending on the source string.
This access is abstracted in SegmentedSubstring by getCurrentChar{8,16} and
incrementAndGetCurrentChar{8,16} methods.  In SegmentedString, the advance()
and advanceAndUpdateLineNumber() methods have been refactored into a
state machine managed pair of function pointers.  The possible functions
have not only the 8 and 16 bitness factored out, they also have the 
"exclude line numbers" logic factored out for advanceAndUpdateLineNumber().
This change also has improvements over http://trac.webkit.org/changeset/123679.
The most prominent change was to inline the 8 bit paths for both advance()
and advanceAndUpdateLineNumber().
This provides a net speed-up even with the 8/16 bit testing.
Other changes involve using String methods to access and compare with the
source data.

* html/FTPDirectoryDocument.cpp:
(WebCore::FTPDirectoryDocumentParser::append): Changed to use currentChar()
instead of SegmentedString '*' operator.
* html/parser/HTMLEntityParser.cpp: Changed to use currentChar() instead of
SegmentedString '*' operator.
* html/parser/HTMLParserIdioms.cpp:
(WebCore::stripLeadingAndTrailingHTMLSpaces): Added 8-bit fast path.
* html/parser/HTMLSourceTracker.cpp:
(WebCore::HTMLSourceTracker::sourceForToken): Changed to use currentChar() instead of
SegmentedString '*' operator.
* loader/cache/CachedScript.cpp:
(WebCore::CachedScript::script): Updated to use new String::dataSize() method.
* platform/text/SegmentedString.cpp:
(WebCore::SegmentedString::SegmentedString):
(WebCore::SegmentedString::operator=):
(WebCore::SegmentedString::clear):
(WebCore::SegmentedString::append):
(WebCore::SegmentedString::prepend):
(WebCore::SegmentedString::advanceSubstring):
(WebCore::SegmentedString::advance):
(WebCore::SegmentedString::advance8): Fast path advance function for 8 bit data.
(WebCore::SegmentedString::advance16): Fast path advance function for 16 bit data.
(WebCore::SegmentedString::advanceAndUpdateLineNumber8): Fast path
advanceAndUpdateLineNumber for 8 bit data when we need to update the line number.
(WebCore::SegmentedString::advanceAndUpdateLineNumber16): Fast path
advanceAndUpdateLineNumber for 16 bit data when we need to update the line number.
(WebCore::SegmentedString::advanceSlowCase): Slow case advance function for both
8 and 16 bit advance.
(WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase): Slow case
advanceAndUpdateLineNumber function for both 8 and 16 bit data.
(WebCore::SegmentedString::advanceEmpty): Advance function when input has been exhausted.
(WebCore::SegmentedString::updateSlowCaseFunctionPointers): Set advance function
pointers to slow case functions.
* platform/text/SegmentedString.h:
(WebCore::SegmentedSubstring::SegmentedSubstring):
(WebCore::SegmentedSubstring::clear):
(SegmentedSubstring):
(WebCore::SegmentedSubstring::is8Bit): New getter.
(WebCore::SegmentedSubstring::appendTo):
(WebCore::SegmentedSubstring::getCurrentChar8): New getter for the 8 bit case.
(WebCore::SegmentedSubstring::getCurrentChar16): New getter for the 16 bit case.
(WebCore::SegmentedSubstring::incrementAndGetCurrentChar8): New wrapper functions
that pre-increments the 8 bit pointer and returns the next character.
(WebCore::SegmentedSubstring::incrementAndGetCurrentChar16): New wrapper functions
that pre-increments the 16 bit pointer and returns the next character.
(WebCore::SegmentedSubstring::currentSubString):
(WebCore::SegmentedSubstring::getCurrentChar):
(WebCore::SegmentedSubstring::incrementAndGetCurrentChar):
(WebCore::SegmentedString::SegmentedString):
(WebCore::SegmentedString::push):
(WebCore::SegmentedString::isEmpty):
(WebCore::SegmentedString::lookAhead):
(WebCore::SegmentedString::lookAheadIgnoringCase):
(WebCore::SegmentedString::advance): Wrapper that contains 8 bit fast path
or calls via member function point to approriate advance() flavor.
(WebCore::SegmentedString::advanceAndUpdateLineNumber): Wrapper that
contains 8 bit fast path or calls via member function point to approriate
advance() flavor.
(WebCore::SegmentedString::advanceAndASSERT):
(WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
(WebCore::SegmentedString::advancePastNonNewline):
(WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
(WebCore::SegmentedString::currentChar):
(WebCore::SegmentedString::decrementAndCheckLength): Decrement substring length and
change to slow case functions when only one character left.
(WebCore::SegmentedString::updateAdvanceFunctionPointers): Select appropriate
advance functions based on current substring.
(WebCore::SegmentedString::lookAheadInline): Changed to use String::startsWith().
(WebCore::SegmentedString::lookAheadSlowCase):
* xml/parser/CharacterReferenceParserInlineMethods.h:
(WebCore::consumeCharacterReference): Changed to use currentChar() instead of
SegmentedString '*' operator.
* xml/parser/MarkupTokenizerBase.h:
(WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
(WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek): Changed to use
currentChar() instead of SegmentedString '*' operator.
(WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):

Source/WTF: 

* wtf/text/WTFString.h:
(WTF::String::dataSize): New method to return the number of bytes 
the string requires.  This replaces a harcoded calculation based on
length and sizeof(UChar).


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124679 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use testRunner instead of layoutTestController in fast/scrolling through fast/xsl tests
https://bugs.webkit.org/show_bug.cgi?id=92947

Reviewed by Kent Tamura.

* fast/scrolling/resources/scrollable-area.js:
* fast/selectors/empty-element-made-non-empty.html:
* fast/selectors/querySelector-in-range-crash.html:
* fast/selectors/selection-window-inactive.html:
* fast/selectors/style-sharing-adjacent-selector.html:
* fast/selectors/style-sharing-last-child.html:
* fast/spatial-navigation/:
* fast/storage/storage-detached-iframe.html:
* fast/sub-pixel/client-width-height-snapping.html:
* fast/sub-pixel/float-containing-block-with-margin.html:
* fast/sub-pixel/table-rows-have-stable-height.html:
* fast/table/:
* fast/text/:
* fast/tokenizer/:
* fast/transforms/container-transform-crash.html:
* fast/transforms/matrix-with-zoom.html:
* fast/transforms/scrollIntoView-transformed.html:
* fast/transforms/selection-bounds-in-transformed-view.html:
* fast/transforms/topmost-becomes-bottomost-for-scrolling.html:
* fast/transforms/transform-hit-test-flipped.html:
* fast/transforms/transform-inside-overflow-scroll.html:
* fast/url/degenerate-file-base.html:
* fast/viewport/:
* fast/workers/:
* fast/writing-mode/auto-margins-across-boundaries.html:
* fast/writing-mode/block-formatting-context.html:
* fast/writing-mode/broken-ideographic-font.html:
* fast/writing-mode/display-mutation.html:
* fast/writing-mode/flipped-blocks-hit-test-overflow.html:
* fast/writing-mode/flipped-blocks-text-map-local-to-container.html:
* fast/writing-mode/japanese-rl-text-with-broken-font.html:
* fast/writing-mode/overhanging-float-legend-crash.html:
* fast/writing-mode/percentage-padding.html:
* fast/writing-mode/positionForPoint.html:
* fast/writing-mode/relative-positioning-percentages.html:
* fast/writing-mode/table-hit-test.html:
* fast/xmlhttprequest/null-document-xmlhttprequest-open.html:
* fast/xmlhttprequest/resources/xmlhttprequest-no-file-access-real.html:
* fast/xmlhttprequest/resources/xmlhttprequest-nonexistent-file-real.html:
* fast/xmlhttprequest/xmlhttprequest-bad-mimetype.html:
* fast/xmlhttprequest/xmlhttprequest-gc.html:
* fast/xmlhttprequest/xmlhttprequest-get.xhtml:
* fast/xmlhttprequest/xmlhttprequest-html-response-encoding.html:
* fast/xmlhttprequest/xmlhttprequest-invalid-values.html:
* fast/xmlhttprequest/xmlhttprequest-missing-file-exception.html:
* fast/xmlhttprequest/xmlhttprequest-no-file-access.html:
* fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html:
* fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html:
* fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html:
* fast/xmlhttprequest/xmlhttprequest-responsetype-abort.html:
* fast/xmlhttprequest/xmlhttprequest-responsetype-arraybuffer.html:
* fast/xmlhttprequest/xmlhttprequest-responsetype-document.html:
* fast/xmlhttprequest/xmlhttprequest-responsetype-text.html:
* fast/xpath/4XPath/Borrowed/namespace-nodes.html:
* fast/xpath/ancestor-axis.html:
* fast/xpath/complex-id.html:
* fast/xpath/empty-string-substring.html:
* fast/xpath/ensure-null-namespace.xhtml:
* fast/xpath/id-path.html:
* fast/xpath/id-simple.html:
* fast/xpath/implicit-node-args.html:
* fast/xpath/name-null-namespace.html:
* fast/xpath/namespace-vs-predicate.xhtml:
* fast/xpath/nan-to-boolean.html:
* fast/xpath/nodeset-duplicates.html:
* fast/xpath/nsresolver-bad-object.xhtml:
* fast/xpath/nsresolver-exception.xhtml:
* fast/xpath/nsresolver-function.xhtml:
* fast/xpath/nsresolver-object.xhtml:
* fast/xpath/preceding-axis.xhtml:
* fast/xpath/text-nodes.html:
* fast/xpath/union-context-node.xhtml:
* fast/xpath/xpath-detached-iframe-resolver-crash.html:
* fast/xpath/xpath-empty-string.html:
* fast/xpath/xpath-functional-test.html:
* fast/xpath/xpath-iterator-result-should-mark-its-nodeset.html:
* fast/xpath/xpath-other-nodeset-result-should-mark-its-nodeset.html:
* fast/xpath/xpath-result-eventlistener-crash.html:
* fast/xpath/xpath-snapshot-result-should-mark-its-nodeset.html:
* fast/xsl/default-html.html:
* fast/xsl/exslt-node-set.xsl:
* fast/xsl/extra-lf-at-end.html:
* fast/xsl/import-non-document-node.xhtml:
* fast/xsl/mozilla-tests.xsl:
* fast/xsl/nbsp-in-stylesheet.html:
* fast/xsl/resources/dtd-in-source-document.xsl:
* fast/xsl/resources/import-after-comment-transform.xsl:
* fast/xsl/resources/to-html.xsl:
* fast/xsl/resources/xslt-entity-enc.xsl:
* fast/xsl/resources/xslt-nested-stylesheets1.xsl:
* fast/xsl/resources/xslt-recursion-chain1.xsl:
* fast/xsl/resources/xslt-second-level-import.xsl:
* fast/xsl/sort-locale.xsl:
* fast/xsl/sort-unicode.xsl:
* fast/xsl/subframe-location.html:
* fast/xsl/transform-xhr-doc.xhtml:
* fast/xsl/transformToFragment-XML-declaration.html:
* fast/xsl/utf8-chunks.xsl:
* fast/xsl/xslt-bad-import-uri.html:
* fast/xsl/xslt-doc-enc.xsl:
* fast/xsl/xslt-doc-noenc.xsl:
* fast/xsl/xslt-fragment-in-empty-doc.html:
* fast/xsl/xslt-processor.html:
* fast/xsl/xslt-string-parameters.html:
* fast/xsl/xslt-text.html:
* fast/xsl/xslt-transform-to-fragment-crash.html:
* fast/xsl/xslt-url.xsl:
* platform/chromium-linux/fast/text/chromium-linux-text-subpixel-positioning.html:
* platform/chromium-linux/fast/text/international/arabic-vertical-offset.html:
* platform/chromium-linux/fast/text/international/draw-complex-text-from-to.html:
* platform/chromium/fast/text/chromium-mac-duplicate-ime-composition.html:
* platform/chromium/fast/text/font-linux-normalize.html:
* platform/chromium/fast/text/international/complex-text-rectangle.html:
* platform/mac/fast/text/attributed-substring-from-range-001.html:
* platform/mac/fast/text/attributed-substring-from-range-002.html:
* platform/mac/fast/text/attributed-substring-from-range-in-textfield.html:
* platform/mac/fast/text/attributed-substring-from-range.html:
* platform/mac/fast/text/core-text-fallback-to-unknown-font.html:
* platform/mac/fast/text/justified-text-rect.html:
* platform/mac/fast/text/myanmar-shaping.html:
* platform/mac/fast/text/thai-combining-mark-positioning.html:
* platform/mac/fast/text/webfont-after-tiny-monospace-text.html:
* platform/qt/fast/spatial-navigation/resources/ensure-scrolls-with-scrollbars-disabled-by-webkit.html:
* platform/qt/fast/spatial-navigation/snav-ensure-scrolls-with-scrollbars-disabled-by-webkit.html:
* platform/win/fast/text/uniscribe-item-boundary-crash.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124680 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[SVG] Tref target event listener cleanup
https://bugs.webkit.org/show_bug.cgi?id=93004

Reviewed by Abhishek Arya.

Source/WebCore:

Currently SVGTRefElement allocates event listeners dynamically as it attaches to its
targets. Synchronizing the lifetime of the target listener vs. the tref element is
error prone, as various events can stack and trigger nested handlers.

In order to reduce complexity and address a couple of outstanding issues, this patch
changes the way event listeners are allocated: only one target listener is created
for the lifetime of the SVGTRefElement, and gets reused if the target element changes.

Test: svg/custom/tref-nested-events-crash.svg

* dom/EventListener.h:
Added new <tref> target event listener type.
* svg/SVGTRefElement.cpp:
(WebCore):
(WebCore::SVGTRefTargetEventListener::create):
(WebCore::SVGTRefTargetEventListener::cast):
(SVGTRefTargetEventListener):
(WebCore::SVGTRefTargetEventListener::isAttached):
(WebCore::SVGTRefTargetEventListener::SVGTRefTargetEventListener):
(WebCore::SVGTRefTargetEventListener::attach):
(WebCore::SVGTRefTargetEventListener::detach):
(WebCore::SVGTRefTargetEventListener::operator==):
(WebCore::SVGTRefTargetEventListener::handleEvent):
No need to check m_trefElement anymore - the listener is allocated for the whole element
lifetime, detached when the element is removed and deallocated when the element is
destroyed.
(WebCore::SVGTRefElement::SVGTRefElement):
Allocate one target listener per element, at construction time.
(WebCore::SVGTRefElement::~SVGTRefElement):
Detach the listener if necessary.
(WebCore::SVGTRefElement::detachTarget):
Check whether the element is still in document after updating the text (may have been
removed by event handlers).
(WebCore::SVGTRefElement::buildPendingResource):
Attach the event listener before updating the text content to avoid racing with event
handlers (which can remove the element).
(WebCore::SVGTRefElement::removedFrom):
* svg/SVGTRefElement.h:
(WebCore):
(SVGTRefElement):

LayoutTests:

* svg/custom/tref-nested-events-crash-expected.txt: Added.
* svg/custom/tref-nested-events-crash.svg: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124681 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Cross-thread-copy a couple more recently added ResourceResponse data members, apparently
these got missed when they were added. And fix a bug with how the m_remoteIPAddress
data member is handled, an isolatedCopy() is needed for thread safety.
https://bugs.webkit.org/show_bug.cgi?id=93158

Reviewed by David Levin.

No new tests, minor cleanup.

* platform/network/chromium/ResourceResponse.cpp:
(WebCore::ResourceResponse::doPlatformCopyData): make deep copies
(WebCore::ResourceResponse::doPlatformAdopt): take ownership of them
* platform/network/chromium/ResourceResponse.h:
(ResourceResponse):
(CrossThreadResourceResponseData):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124682 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Stop relying on implicit WebFoo <-> WebCore conversion operators in compositor
https://bugs.webkit.org/show_bug.cgi?id=93169

Reviewed by Adrienne Walker.

This removes the compositor's reliance on implicit conversion operators from Web* types to WebKit-internal
types, specifically WebRect <-> WebCore::IntRect and WebString <-> WTF::String.

* platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
(WebCore::CanvasLayerTextureUpdater::paintContents):
* platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
(WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
* platform/graphics/chromium/LayerRendererChromium.cpp:
(WebCore::LayerRendererChromium::getFramebufferPixels):
* platform/graphics/chromium/ScrollbarLayerChromium.cpp:
(WebCore::ScrollbarLayerChromium::setTexturePriorities):
(WebCore::ScrollbarLayerChromium::update):
* platform/graphics/chromium/cc/CCFontAtlas.cpp:
(WebCore::CCFontAtlas::drawOneLineOfTextInternal):
* platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp:
(WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
(WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):
* platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
(WebCore::toUVRect):
(WebCore::CCScrollbarLayerImpl::appendQuads):
(WebCore::CCScrollbarLayerImpl::CCScrollbar::size):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124683 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rebaseline MathML pixel tests with STIX fonts for Lion
https://bugs.webkit.org/show_bug.cgi?id=93163

Reviewed by Eric Seidel.

This is gardening in response to https://bugs.webkit.org/show_bug.cgi?id=93073, which
followed https://bugs.webkit.org/show_bug.cgi?id=43819. The latter turned on the STIX
fonts in the testing tools, and apparently the STIX fonts or their handling have been
changed (apparently improved) between Snow Leopard and Lion. I am therefore moving my
10 *-expected.txt files below to platform/mac-snowleopard, and putting the slightly
improved metrics in the 10 files in platform/mac.

* platform/mac-snowleopard/mathml: Added.
* platform/mac-snowleopard/mathml/presentation: Added.
* platform/mac-snowleopard/mathml/presentation/attributes-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/fenced-mi-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/fractions-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/mo-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/over-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/roots-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/row-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/sub-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/tokenElements-expected.txt: Added.
* platform/mac-snowleopard/mathml/presentation/underover-expected.txt: Added.
* platform/mac/mathml/presentation/attributes-expected.txt:
* platform/mac/mathml/presentation/fenced-mi-expected.txt:
* platform/mac/mathml/presentation/fractions-expected.txt:
* platform/mac/mathml/presentation/mo-expected.txt:
* platform/mac/mathml/presentation/over-expected.txt:
* platform/mac/mathml/presentation/roots-expected.txt:
* platform/mac/mathml/presentation/row-expected.txt:
* platform/mac/mathml/presentation/sub-expected.txt:
* platform/mac/mathml/presentation/tokenElements-expected.txt:
* platform/mac/mathml/presentation/underover-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use testRunner instead of layoutTestController in the remaining layout tests
https://bugs.webkit.org/show_bug.cgi?id=93172

Reviewed by Adam Barth.

One last sweeping patch.

* accessibility/canvas-accessibilitynodeobject.html:
* compositing/backface-visibility/backface-visibility-webgl.html:
* compositing/fixed-position-scroll-offset-history-restore.html:
* compositing/overflow/image-load-overflow-scrollbars.html:
* css3/flexbox/flexitem.html:
* dom/html/level1/core/selfhtml.js:
(startTest):
* dom/html/level2/core/selfhtml.js:
(startTest):
* dom/html/level2/events/selfhtml.js:
(startTest):
* dom/html/level2/html/AppletsCollection.html:
* dom/html/level2/html/HTMLBaseElement01.html:
* dom/html/level2/html/HTMLBaseElement02.html:
* dom/html/level2/html/selfhtml.js:
(startTest):
* dom/svg/level3/xpath/svgunit.js:
* dom/xhtml/level1/core/selfxhtml.js:
(startTest):
* dom/xhtml/level2/core/selfxhtml.js:
(startTest):
* dom/xhtml/level2/events/selfxhtml.js:
(startTest):
* dom/xhtml/level2/html/HTMLBaseElement01.xhtml:
* dom/xhtml/level2/html/HTMLBaseElement02.xhtml:
* dom/xhtml/level2/html/selfxhtml.js:
(startTest):
* dom/xhtml/level3/core/selfxhtml.js:
(startTest):
* editing/shadow/adjusting-editing-boundary-with-table-in-shadow.html:
* editing/shadow/bold-twice-in-shadow.html:
* editing/shadow/breaking-editing-boundaries-2.html:
* editing/shadow/contenteditable-propagation-at-shadow-boundary.html:
* editing/shadow/delete-characters-in-distributed-node-crash.html:
* editing/shadow/delete-list-in-shadow.html:
* editing/shadow/insertorderedlist-crash.html:
* editing/shadow/pressing-enter-on-list.html:
* editing/spelling/grammar-edit-word-expected.txt:
* editing/spelling/grammar-edit-word.html:
* fast/block/percent-height-descendant-not-removed-crash2.html:
* fast/block/positioning/abspositioned-object-under-split-relpositioned-inline-crash.html:
* fast/block/positioning/insert-positioned-in-anonymous-crash.html:
* fast/canvas/fallback-content.html:
* fast/css/counters/counter-reset-subtree-insert-crash.html:
* fast/css/crash-on-gradient-with-derived-color.html:
* fast/dom/NodeList/childNodes-reverse-iteration.html:
* fast/dom/Window/window-property-shadowing-onclick.html:
* fast/dom/XMLSerializer-xml-namespace.html:
* fast/dom/shadow/content-after-style.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124685 268f45cc-cd09-0410-ab3c-d52691b4dbfc
media/media-fragments/TC0030-TC0039.html sometimes times out on Chromium Windows
https://bugs.webkit.org/show_bug.cgi?id=76967

Unreviewed, test expectation change only.

These media/media-fragments/TC00X0-TC00X9.html tests each test 10 test cases, and consistently skate in the 6-8s range. Marking them as SLOW.


* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124686 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Chromium] Layout Test http/tests/media/media-source/webm/video-media-source-*.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=85952

Unreviewed test expectation update.

Test fixed by http://crrev.com/149702.


* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124687 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Add API to make it possible to request all variants of a WebImage
https://bugs.webkit.org/show_bug.cgi?id=92933

Reviewed by Adam Barth.

Part of http://crbug.com/138550

Source/Platform:

* chromium/public/WebImage.h:
(WebImage):

Source/WebKit/chromium:

* src/WebImageSkia.cpp:
(WebKit::WebImage::framesFromData):
(WebKit):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@124688 268f45cc-cd09-0410-ab3c-d52691b4dbfc