Merge branch 'stable' of ssh://codereview.qt-project.org:29418/qt/qtwebkit into dev

Change-Id: I31e04357809b639e630f69ccf2f539846ab4c4bb
Point dependencies to 'dev' branches

Also adding qtxmlpatterns as a indirect dependency of qtdeclarative

Change-Id: If64cb255871304fc403e5acc65d7296ae939a804
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@digia.com>
Merge branch 'stable' of ssh://codereview.qt-project.org/qt/qtwebkit into dev

Change-Id: I95981330d4656a0322c8da5f7520fe696e1a34d1
Merge branch 'stable' of ssh://codereview.qt-project.org/qt/qtwebkit into dev

Change-Id: Ifcdecc268f5ddcc26f207886e1cd298d9f02677c
Merge remote-tracking branch 'origin/stable' into dev

Change-Id: I7c2b30bbc3335f4a7e96893af61cfb62aa0b5046
fix pkg-config dependencies

don't override QMAKE_PKGCONFIG_REQUIRES needlessly.

Task-number: QTBUG-29453
Change-Id: Ib680caca686b6bc59e05ff5118cdbf7c53f32df5
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@digia.com>
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
remove obsolete DEPENDPATH assignment

qmake now adds CONFIG+=depend_includepath by default, making manual
DEPENDPATH setup unnecessary.

Change-Id: I8fc3af40b91deae28872ea50e3d853f2f6f429cd
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@digia.com>
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
Merge remote-tracking branch 'origin/stable' into dev

Change-Id: I033dfeb9d44792bd6bccdc76388105fd7f3aaa57
REGRESSION (r135628-135632): Double box shadow failure to render

https://bugs.webkit.org/show_bug.cgi?id=107833

Reviewed by Simon Fraser.

Source/WebCore:

Regression caused by http://trac.webkit.org/changeset/135629
The regression was due to faulty occlusion logic that was assuming
that drawing the background color of a render box background layer
could be skipped when the same layer also has an opaque image attached.
In the case where the background color is drawn for the purpose of
rendering a box shadow, the shadow is typically not
completely occluded by the background image because of the shadow
blur and/or offset.  This patch fixes the problem by not culling a
background draw if it is used to draw a box shadow.

Test: fast/backgrounds/gradient-background-shadow.html

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintFillLayerExtended):
Changing occlusion culling test to never cull background color
draw if it is used to draw a box shadow. This is because box shadows
can draw outside the border fill region.

LayoutTests:

New ref test verifies that box shadow is drawn when
background is an opaque image. Test uses an blue gradient
as background image. Reference uses blue background color.

* fast/backgrounds/gradient-background-shadow-expected.html: Added.
* fast/backgrounds/gradient-background-shadow.html: Added.

Change-Id: I81e3271f1fdc312fd54dcd9de81903b12b1a9903
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141160 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
ASSERTION FAILED: !object || object->isBox(), UNKNOWN in WebCore::RenderListItem::positionListMarker

https://bugs.webkit.org/show_bug.cgi?id=108699

Reviewed by Abhishek Arya.

Source/WebCore:

RenderListItems performs special management of its children to maintain list markers. Splitting a flow
through a list item results in assumptions made inside RenderListItem failing, so for now, avoid splittin
flows when inside one.

Test: fast/multicol/span/list-multi-column-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::containingColumnsBlock):

LayoutTests:

* fast/multicol/span/list-multi-column-crash-expected.txt: Added.
* fast/multicol/span/list-multi-column-crash.html: Added.

Change-Id: If570c787773fbc69cecbb60833be32c445f2dc2b
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142657 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Regression(r131539): Heap-use-after-free in WebCore::RenderBlock::willBeDestroyed

https://bugs.webkit.org/show_bug.cgi?id=107189

Reviewed by Abhishek Arya.

Source/WebCore:

Test: fast/dynamic/continuation-detach-crash.html

This patch reverts r131539 and the following changes (r132591 and r139664).
This means we redo detaching from the bottom-up which solves the regression.
It fixes the attached test case as we re-attach child nodes before detaching
the parent. It seems wrong to do but this avoid a stale continuation.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::detach): Detach the children first, then ourself.
* dom/Node.cpp:
(WebCore::Node::detach): Clear the renderer instead of ASSERT'ing.
* rendering/RenderObject.cpp:
(WebCore::RenderObject::willBeDestroyed): Removed the code to clear the associated node's renderer.
(WebCore::RenderObject::destroyAndCleanupAnonymousWrappers):
* rendering/RenderObjectChildList.cpp:
(WebCore::RenderObjectChildList::removeChildNode):
Moved the repainting logic back into removeChildNode from destroyAndCleanupAnonymousWrappers.
(WebCore::RenderObjectChildList::destroyLeftoverChildren): Re-added the code to clear the associated node's
renderer.
* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::setText): Re-added the code to set the associated node's renderer.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::detach):
* dom/Node.cpp:
(WebCore::Node::detach):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::willBeDestroyed):
(WebCore::RenderObject::destroyAndCleanupAnonymousWrappers):
* rendering/RenderObjectChildList.cpp:
(WebCore::RenderObjectChildList::destroyLeftoverChildren):
(WebCore::RenderObjectChildList::removeChildNode):
* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::setText):

Change-Id: I5c4df1881f041ecd80180cb1638cd811d0972189
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142500 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[SVG] OOB access in SVGListProperty::replaceItemValues()

https://bugs.webkit.org/show_bug.cgi?id=109293

Source/WebCore:

Replacing a list property item with itself should be a no-op. This patch updates the related
APIs and logic to detect the self-replace case and prevent removal of the item from the list.

To avoid scanning the list multiple times, removeItemFromList() is updated to operate on
indices and a findItem() method is added to resolve an item to an index.

Reviewed by Dirk Schulze.

No new tests: updated existing tests cover the change.

* svg/properties/SVGAnimatedListPropertyTearOff.h:
(WebCore::SVGAnimatedListPropertyTearOff::findItem):
(SVGAnimatedListPropertyTearOff):
(WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
* svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
(WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
(SVGAnimatedPathSegListPropertyTearOff):
(WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
Add a findItem() delegating method, and update removeItemFromList() to use the new
index-based API.

* svg/properties/SVGListProperty.h:
(WebCore::SVGListProperty::insertItemBeforeValues):
(WebCore::SVGListProperty::insertItemBeforeValuesAndWrappers):
(WebCore::SVGListProperty::replaceItemValues):
(WebCore::SVGListProperty::replaceItemValuesAndWrappers):
(SVGListProperty):
Updated to handle the no-op case for insertItemBefore() & replaceItem().

* svg/properties/SVGListPropertyTearOff.h:
(WebCore::SVGListPropertyTearOff::findItem):
(WebCore::SVGListPropertyTearOff::removeItemFromList):
Index-based API updates.

(WebCore::SVGListPropertyTearOff::processIncomingListItemValue):
(WebCore::SVGListPropertyTearOff::processIncomingListItemWrapper):
* svg/properties/SVGPathSegListPropertyTearOff.cpp:
(WebCore::SVGPathSegListPropertyTearOff::processIncomingListItemValue):
Detect the self-replace case and return without removing the item from the list.

* svg/properties/SVGPathSegListPropertyTearOff.h:
(WebCore::SVGPathSegListPropertyTearOff::findItem):
(WebCore::SVGPathSegListPropertyTearOff::removeItemFromList):
(SVGPathSegListPropertyTearOff):
(WebCore::SVGPathSegListPropertyTearOff::processIncomingListItemWrapper):
* svg/properties/SVGStaticListPropertyTearOff.h:
(WebCore::SVGStaticListPropertyTearOff::processIncomingListItemValue):
(WebCore::SVGStaticListPropertyTearOff::processIncomingListItemWrapper):
Index-based API updates.

Change-Id: I6afa8ff964eaccd1337156af41c5ded07e3b4b7d
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142759 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Revert "[TexMap] Flickering after transitions on Apple HTML5 demo"

This reverts commit 99be50464a52281c481dd8221144603fed582aa0.

This change caused a regression and was undone in trunk.

Change-Id: Ic04eb4a5b49c354c129ed5d8c4bbe8cc579dc8f1
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[TexMap] Flickering after transitions on Apple HTML5 demo

https://bugs.webkit.org/show_bug.cgi?id=102501

Reviewed by Noam Rosenthal.

Notify about animation start after the new animation is actually commited.

* platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
(WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
(WebCore::GraphicsLayerTextureMapper::commitLayerChanges):
(WebCore::GraphicsLayerTextureMapper::addAnimation):
* platform/graphics/texmap/GraphicsLayerTextureMapper.h:
(GraphicsLayerTextureMapper):

Change-Id: Iee72191e03d2dba4c90e7d3ba70e0be3f165aead
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144183 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[TexMap] REGRESSION(144183): It make negative delay tests fails

https://bugs.webkit.org/show_bug.cgi?id=110989

Reviewed by Noam Rosenthal.

Do not apply a negative offset to the animation starttime send to the GraphicLayerClient,
it needs the actual animation start not a virtual start.

* platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
(WebCore::GraphicsLayerTextureMapper::addAnimation):

Change-Id: I29824c949eb3975aa3ef56a966296e1fac436b50
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144204 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[Qt] Fix the Mac build with the current qtbase/dev branch

https://bugs.webkit.org/show_bug.cgi?id=111190

Reviewed by Allan Sandfeld Jensen.

QMAKE_MACOSX_DEPLOYMENT_TARGET now influences
__MAC_OS_X_VERSION_MIN_REQUIRED through -mmacosx-version-min after
changes in qtbase to support iOS.

Having only WebCore defining it to 10.5 would create a mismatch of
ENABLE_THREADING_LIBDISPATCH with WTF to cause undefined symbols
while linking both together at the end.

Fix it by removing the statement which isn't needed anymore.
qtbase/mkspecs/common/mac-minimum-version.conf already defines
10.6 as the minimum Mac version.

* Target.pri:

Change-Id: Ib6a39093a2e1482c2db3a47ee3829ff94ed887ef
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144464 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Merge "Merge remote-tracking branch 'origin/stable' into dev" into refs/staging/dev
Switch QtWebKit to GStreamer 1.0.

https://bugs.webkit.org/show_bug.cgi?id=106669.

Original patch by Sebastian Dröge.
Reviewed by Csaba Osztrogonác.

Source/WebCore:

* WebCore.pri:

Tools:

Build with GStreamer 1.0 if available, but support GStreamer 0.10
temporarily to make upgrading easy and the patch suitable for Qt5.

* qmake/mkspecs/features/features.prf:

Change-Id: I910cb50741d9896995f35a6daa62a5ee8ea6ce4b
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144208 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[GStreamer] Buffering ranges are reported incorrectly with GStreamer 1.0

https://bugs.webkit.org/show_bug.cgi?id=105319

Patch by Xabier Rodriguez Calvar <calvaris@igalia.com> on 2012-12-21
Reviewed by Philippe Normand.

We add the gPercentMax constant to select between 100 and
GST_FORMAT_PERCENT_MAX depending if we are compiling against
GStreamer 0.10 or 1.0 and we use that in the corresponding method.

Current tests should suffice.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::buffered): Added the use of
gPercentMax constant instead of 100 to have the different code
paths for GStreamer 0.10 and 1.0.

Change-Id: I04d57303e683353b8734c62ef5016fa965a9627b
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138364 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
[gstreamer] MediaPlayerPrivateGStreamer should take ownership of the playbin

https://bugs.webkit.org/show_bug.cgi?id=107445

Reviewed by Philippe Normand.

In gstreamer 1.0, gst_element_factory_make() now returns a floating reference.
MediaPlayerPrivateGStreamer calls gst_element_factory_make() to create the
playbin object but does not take ownership of the object. As a consequence,
the object keeps floating until it is unref'd in the
MediaPlayerPrivateGStreamer destructor.

This patch uses a GRefPtr<GstElement> to store the playbin object and only
adopt the object returned by gst_element_factory_make() if gstreamer 0.10
is used. When gstreamer 1.0 is used, the returned object will not be adopted,
which will remove the floating reference. This way, we ensure that the
playbin object is owned by MediaPlayerPrivateGStreamer.

No new tests, no behavior change for layout tests.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
(WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer):
(WebCore::MediaPlayerPrivateGStreamer::load):
(WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
(WebCore::MediaPlayerPrivateGStreamer::changePipelineState):
(WebCore::MediaPlayerPrivateGStreamer::duration):
(WebCore::MediaPlayerPrivateGStreamer::seek):
(WebCore::MediaPlayerPrivateGStreamer::paused):
(WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfVideo):
(WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfAudio):
(WebCore::MediaPlayerPrivateGStreamer::setVolume):
(WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfVolumeChange):
(WebCore::MediaPlayerPrivateGStreamer::setRate):
(WebCore::MediaPlayerPrivateGStreamer::buffered):
(WebCore::MediaPlayerPrivateGStreamer::handleMessage):
(WebCore::MediaPlayerPrivateGStreamer::fillTimerFired):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
(MediaPlayerPrivateGStreamer):

Change-Id: I441285d33189c4afc26e9608bc0993716c24d7ed
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140414 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>