Don't snapshot plug-ins that come from the same host as the page
https://bugs.webkit.org/show_bug.cgi?id=117969
<rdar://problem/12885400>

Reviewed by Tim Horton.

If a page is serving plug-in content directly, then that content
is typically very important to the page. For example, embedding
a video or audio player. In this case, don't snapshot the plug-ins.

* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): Add a test
that compares the plug-in's URL against the main page's URL and don't snapshot
if they are the same.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151971 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Adopt is/toHTMLAnchorElement for code cleanup
https://bugs.webkit.org/show_bug.cgi?id=117973

Reviewed by Andreas Kling.

To enhance readibility, this patch adopts is/toHTMLAnchorElement.
This also helps out to reduce duplicated use of static_cast.

Source/WebCore:

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::anchorElement):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::anchorElement):
(WebCore::AccessibilityRenderObject::internalLinkElement):
(WebCore::AccessibilityRenderObject::url):
(WebCore::AccessibilityRenderObject::stringValueForMSAA):
(WebCore::AccessibilityRenderObject::isLinked):
* css/CSSDefaultStyleSheets.cpp:
(WebCore::elementCanUseSimpleDefaultStyle):
* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOne):
* dom/Document.cpp:
(WebCore::Document::updateBaseURL):
* dom/TreeScope.cpp:
(WebCore::TreeScope::findAnchor):
* dom/VisitedLinkState.cpp:
(WebCore::linkHashForElement):
(WebCore::VisitedLinkState::determineLinkStateSlowCase):
* html/HTMLAnchorElement.h:
(WebCore::isHTMLAnchorElement):
(WebCore::toHTMLAnchorElement):
* page/DragController.cpp:
(WebCore::DragController::draggableElement):
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::absoluteLinkURL):
(WebCore::HitTestResult::isLiveLink):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::getTextDecorationColors):

Source/WebKit/blackberry:

* WebKitSupport/FatFingers.cpp:
(BlackBerry::WebKit::FatFingers::isElementClickable):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151975 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSString should remember AtomicString
https://bugs.webkit.org/show_bug.cgi?id=117386

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Added JSValue::toAtomicString and JSString::atomicString. These two functions allow WebCore to update
JSString's m_value to set isAtomic flag and avoid the AtomicStringTable lookups in subsequent attempts
to obtain the AtomicString of the same value.

* runtime/JSCJSValue.h:
* runtime/JSString.h:
(JSC::JSString::atomicString):
(JSC::JSValue::toAtomicString):

Source/WebCore:

Added "Atomic" attribute as a WebKit extension to WebIDL, and deployed it in Element.idl and Node.idl so that
the binding code can use newly added JSValue::toAtomic to update JSString's m_value.

* bindings/js/JSDOMBinding.cpp:
(WebCore::valueToAtomicStringWithNullCheck): Added.
(WebCore::valueToAtomicStringWithUndefinedOrNullCheck): Added.

* bindings/js/JSDOMBinding.h:

* bindings/scripts/CodeGeneratorJS.pm:
(GetNativeTypeFromSignature): Return const AtomicString& when either Atomic attribute is specified or the type is
Reflect. Note that setAttribute and getAttribute both use AtomicString for all arguments.
(JSValueToNative): Use AtomicString equivalents when possible when converting DOMString to a WebCore object.

* bindings/scripts/IDLAttributes.txt: Added "Atomic" attribute.

* bindings/scripts/test/JS/JSTestObj.cpp: Baselined test cases.
(WebCore::setJSTestObjReflectedStringAttr):
(WebCore::setJSTestObjReflectedURLAttr):
(WebCore::setJSTestObjReflectedCustomURLAttr):

* dom/Document.idl:
* dom/Element.idl:
* dom/Node.idl:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151978 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Refactoring: Fold Document::focusedNodeRemoved into Document::removeFocusedNodeOfSubtree
https://bugs.webkit.org/show_bug.cgi?id=118036

Reviewed by Kent Tamura.

Merge https://chromium.googlesource.com/chromium/blink/+/3391beabe75548cc638a6c88982f913621a4410f.

* dom/Document.cpp:
(WebCore::Document::removeFocusedNodeOfSubtree):
* dom/Document.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151980 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Adopt is/toHTMLAudioElement for code cleanup
https://bugs.webkit.org/show_bug.cgi?id=117985

Reviewed by Jer Noble.

To enhance readibility, this patch adopts is/toHTMLAudioElement.
This also helps out to reduce duplicated use of static_cast.

Source/WebCore:

* bindings/js/JSNodeCustom.cpp:
(WebCore::isReachableFromDOM):
* css/CSSDefaultStyleSheets.cpp:
(WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::canShareStyleWithElement):
* html/HTMLAudioElement.h:
(WebCore::isHTMLAudioElement):
(WebCore::toHTMLAudioElement):
* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::loadMediaPlayerProxyPlugin):
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::mediaElement):
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::requiresCompositingForVideo):
* rendering/RenderThemeMac.mm:
(WebCore::RenderThemeMac::paintMediaMuteButton):
(WebCore::RenderThemeMac::paintMediaPlayButton):

Source/WebKit/mac:

* Plugins/WebPluginController.mm:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151981 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Mark SVG(Circle|Path|Rect)Element::createRenderer() with OVERRIDE
https://bugs.webkit.org/show_bug.cgi?id=118037

Reviewed by Philip Rogers.

Merge https://chromium.googlesource.com/chromium/blink/+/e8196920e769ab0786b2b4b21d3fdc2d87afef0d.

* svg/SVGCircleElement.h:
* svg/SVGPathElement.h:
* svg/SVGRectElement.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151982 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Creating cURL watchlist and adding myself to it.

Patch by Peter Gal <galpeter@inf.u-szeged.hu> on 2013-05-26
Reviewed by Csaba Osztrogonác.

* Scripts/webkitpy/common/config/watchlist:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151984 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Get rid of multiple inheritence for SVGViewElement interface
https://bugs.webkit.org/show_bug.cgi?id=118014

Reviewed by Kentaro Hara.

Source/WebCore:

Web IDL no longer supports multiple inheritence. As per the latest
specification SVGViewElement should only inherit from SVGElement.
'implements' statements are used for the rest. This patch refactors
the IDL files to match the latest specification:
http://www.w3.org/TR/SVG2/linking.html#InterfaceSVGViewElement

Note that there is a WebExposed change as SVGZoomAndPan used to be
exposed on the Window and it is not anymore. SVGZoomAndPan merely
supplements SVGViewElement and should not be exposed to JavaScript
according to the latest specification.

No new tests, covered by existing tests.

* CMakeLists.txt:
* DerivedSources.pri:
* GNUmakefile.list.am:
* svg/SVGExternalResourcesRequired.idl:
* svg/SVGFitToViewBox.idl:
* svg/SVGViewElement.idl:
* svg/SVGZoomAndPan.idl:

LayoutTests:

Update / Rebaseline several SVG test cases now that SVGZoomAndPan interface
is no longer exposed.

* fast/js/global-constructors-attributes-expected.txt:
* platform/efl/fast/js/global-constructors-attributes-expected.txt:
* platform/gtk/fast/js/global-constructors-attributes-expected.txt:
* platform/mac-lion/fast/js/global-constructors-attributes-expected.txt:
* platform/qt/fast/js/global-constructors-attributes-expected.txt:
* svg/custom/global-constructors-expected.txt:
* svg/custom/js-svg-constructors-expected.txt:
* svg/custom/js-svg-constructors.svg:
* svg/custom/script-tests/global-constructors.js:
* svg/dom/SVGViewSpec-defaults-expected.txt:
* svg/dom/SVGViewSpec-expected.txt:
* svg/dom/resources/viewspec-parser.js:
(zoomAndPanToString):
(viewSpecToString):
* svg/dom/script-tests/SVGViewSpec-defaults.js:
* svg/dom/script-tests/SVGViewSpec.js:
(continueTesting):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151985 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use-after-free in RadioInputType::handleKeydownEvent
https://bugs.webkit.org/show_bug.cgi?id=118035

Reviewed by Kent Tamura.

Use RefPtr for inputElement since setFocusedNode could blow it away.

* html/RadioInputType.cpp:
(WebCore::RadioInputType::handleKeydownEvent):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151986 268f45cc-cd09-0410-ab3c-d52691b4dbfc
gdb: Remove the webcore.py pretty printer.
https://bugs.webkit.org/show_bug.cgi?id=117992

Reviewed by Jochen Eisinger.

webcore.py has been only a placeholder for backwards compatibility
for almost 3 years. It should be safe enough to remove it now.

* gdb/webcore.py: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151987 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Stop inheriting SVGExternalResourcesRequired, SVGFitToViewBox and SVGZoomAndPan
https://bugs.webkit.org/show_bug.cgi?id=118029

Reviewed by Kentaro Hara.

Stop inheriting SVGExternalResourcesRequired, SVGFitToViewBox and SVGZoomAndPan
in the IDL and use implements statements instead.

This is one step towards getting rid of multiple inheritance in the SVG code
and matching the latest specification:
http://www.w3.org/TR/SVG2/types.html#BasicDOMInterfaces

There is no webexposed behavior change.

No new tests, no behavior change.

* svg/SVGAnimationElement.idl:
* svg/SVGCircleElement.idl:
* svg/SVGClipPathElement.idl:
* svg/SVGCursorElement.idl:
* svg/SVGDefsElement.idl:
* svg/SVGEllipseElement.idl:
* svg/SVGFEImageElement.idl:
* svg/SVGFilterElement.idl:
* svg/SVGForeignObjectElement.idl:
* svg/SVGGElement.idl:
* svg/SVGGradientElement.idl:
* svg/SVGImageElement.idl:
* svg/SVGLineElement.idl:
* svg/SVGMPathElement.idl:
* svg/SVGMarkerElement.idl:
* svg/SVGMaskElement.idl:
* svg/SVGPathElement.idl:
* svg/SVGPatternElement.idl:
* svg/SVGPolygonElement.idl:
* svg/SVGPolylineElement.idl:
* svg/SVGRectElement.idl:
* svg/SVGSVGElement.idl:
* svg/SVGScriptElement.idl:
* svg/SVGSwitchElement.idl:
* svg/SVGSymbolElement.idl:
* svg/SVGTextContentElement.idl:
* svg/SVGUseElement.idl:
* svg/SVGViewSpec.idl:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151988 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove many static_casts to Element types from AccessibilityNodeObject
https://bugs.webkit.org/show_bug.cgi?id=118021

Reviewed by Chris Fleizach.

Merge https://chromium.googlesource.com/chromium/blink/+/ecd837f94996a20fdb8798e24f26cf6edea2a423.

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::isReadOnly):
(WebCore::AccessibilityNodeObject::alternativeTextForWebArea):
(WebCore::AccessibilityNodeObject::text):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151990 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: stepping through while paused in debugger makes a popover appear
https://bugs.webkit.org/show_bug.cgi?id=117994

There is no obvious need to call tokenTrackingControllerNewHighlightCandidate when the
active call frame changes and it leads to an extraneous display of the popover.

Reviewed by Timothy Hatcher.

* UserInterface/SourceCodeTextEditor.js:
(WebInspector.SourceCodeTextEditor.prototype._activeCallFrameDidChange):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151991 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Regions] fast/regions/seamless-iframe-flowed-into-regions.html asserts
https://bugs.webkit.org/show_bug.cgi?id=117797

Reviewed by Antti Koivisto.

The seamless iframes inherit the current RenderFlowThread during layout. This means getting
the LayoutState object from the flow thread RenderView object is not always correct.
For RenderObjects inside the seamless iframes the view()/LayoutState object is different than the one
of the RenderFlowThread. The patch changes the code to use the correct LayoutState object during
layout when pushing a new state.

Tests: covered by fast/regions/seamless-iframe-flowed-into-regions.html

* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::currentActiveRenderBox):
(WebCore::RenderFlowThread::pushFlowThreadLayoutState):
(WebCore::RenderFlowThread::popFlowThreadLayoutState):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151992 268f45cc-cd09-0410-ab3c-d52691b4dbfc
editing/selection/doubleclick-crash.html can be flaky
https://bugs.webkit.org/show_bug.cgi?id=118017

Reviewed by Jessie Berlin.

Merge https://chromium.googlesource.com/chromium/blink/+/45ac882064589ac41a63762905f0618fc035cd44.

* editing/selection/doubleclick-crash.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151993 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Mac] Document URL is not updated by HSTS
<rdar://problem/14241270> and https://bugs.webkit.org/show_bug.cgi?id=118003

Patch started by Alexey Proskuryakov, finished by Brady Eidson.

Reviewed by Brady Eidson and then Alexey Proskuryakov.

Synthesize a response and properly handle willSendRequest when the URL changes in a way that's typical for HSTS.

* platform/network/mac/WebCoreURLResponse:
* platform/network/mac/WebCoreURLResponse:
(WebCore::synthesizeRedirectResponseIfNecessary): Synthesize a redirect response and when the URL changes in a way that's
  typical for HSTS connections.

* platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
(-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): Call synthesizeRedirectResponseIfNecessary.

* platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
(-[WebCoreResourceHandleAsOperationQueueDelegate connection:willSendRequest:redirectResponse:]): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151994 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[BlackBerry] ASSERT(!m_tileMatrixNeedsUpdate) in BackingStorePrivate::render()
https://bugs.webkit.org/show_bug.cgi?id=118062

Patch by Jacky Jiang <zhajiang@blackberry.com> on 2013-06-26.
Reviewed by Rob Buis.
Internally reviewed by Jakob Petsovits.

JIRA426949
requestLayoutIfNeeded() can cause zoomAboutPoint() when the layout
is finished and make the tile matrix stale. We need requestLayoutIfNeeded()
before we updateTileMatrixIfNeeded() so that we can fix the ASSERT and
also pass the valid TileIndexList to render().

* Api/BackingStore.cpp:
(BlackBerry::WebKit::BackingStorePrivate::resumeScreenUpdates):
(BlackBerry::WebKit::BackingStorePrivate::render):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151995 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Adopt is/toHTMLAreaElement for code cleanup
https://bugs.webkit.org/show_bug.cgi?id=117980

Reviewed by Antonio Gomes.

To enhance readibility, this patch adopts is/toHTMLAreaElement.
This also helps out to reduce duplicated use of static_cast.

Source/WebCore:

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::focusedUIElementForPage):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::getDocumentLinks):
(WebCore::AccessibilityRenderObject::accessibilityHitTest):
(WebCore::AccessibilityRenderObject::addImageMapChildren):
* html/HTMLAreaElement.h:
(WebCore::isHTMLAreaElement):
(WebCore::toHTMLAreaElement):
* html/HTMLMapElement.cpp:
(WebCore::HTMLMapElement::mapMouseEvent):
* page/FocusController.cpp:
(WebCore::FocusController::advanceFocusDirectionally):
* page/SpatialNavigation.cpp:
(WebCore::FocusCandidate::FocusCandidate):
(WebCore::areElementsOnSameLine):
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::absoluteLinkURL):
* rendering/RenderImage.cpp:
(WebCore::RenderImage::paintAreaElementFocusRing):

Source/WebKit/blackberry:

* Api/WebPage.cpp:
(BlackBerry::WebKit::WebPagePrivate::webContext):
* WebKitSupport/TouchEventHandler.cpp:
(BlackBerry::WebKit::elementForTapHighlight):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151996 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Flex boxes (both old and new) don't handle max-height images correctly.
https://bugs.webkit.org/show_bug.cgi?id=118000

Reviewed by Beth Dakin.

Source/WebCore: 

Tests: css3/flexbox/image-percent-max-height.html
       fast/flexbox/image-percent-max-height.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::dirtyForLayoutFromPercentageHeightDescendants):
(WebCore::RenderBlock::layoutBlockChildren):
Pull the percentage height descendant code that dirties those descendants
out of layoutBlockChildren and into a protected helper function,
dirtyForLayoutFromPercentageHeightDescendants, that can be called from the 
flex box code.
        
Also patch dirtyForLayoutFromPercentageHeightDescendants so that it will dirty
preferred logical widths when a child has an aspect ratio, since we know that
percentage height changes will potentially affect the preferred widths of the image and
its ancestor blocks.

* rendering/RenderBlock.h:
Declaration of the new dirtyForLayoutFromPercentageHeightDescendants function.

* rendering/RenderDeprecatedFlexibleBox.cpp:
(WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
Make the old flex box code call dirtyForLayoutFromPercentageHeightDescendants so
that everything is dirtied properly.

(WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
(WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
Remove the isReplaced()/percentage height/width dirtying now that the old flexible
box is using the same dirtying mechanism as RenderBlock.

* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::layoutBlock):
Patch the new flexible box code to use the dirtying mechanism that RenderBlock
uses for percentage heights/widths on replaced descendants.

* rendering/RenderObject.h:
(WebCore::RenderObject::hasAspectRatio):
Pulled the static helper function from RenderReplaced into a full-blown method
on RenderObject, so that dirtyForLayoutFromPercentageHeightDescendants can call
it to check if an object has an aspect ratio.

* rendering/RenderReplaced.cpp:
(WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox):
(WebCore::RenderReplaced::computeIntrinsicRatioInformation):
Patch the call sites of the static helper function to use hasAspectRatio instead
and get rid of the static in the cpp file.

LayoutTests: 

* css3/flexbox/image-percent-max-height-expected.html: Added.
* css3/flexbox/image-percent-max-height.html: Added.
* css3/flexbox/resources/hero.png: Added.
* fast/flexbox/image-percent-max-height-expected.html: Added.
* fast/flexbox/image-percent-max-height.html: Added.
* fast/flexbox/resources/hero.png: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151997 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Set Attr.ownerDocument in Element#setAttributeNode()
https://bugs.webkit.org/show_bug.cgi?id=118031

Reviewed by Andreas Kling.

Source/WebCore: 

Merge https://chromium.googlesource.com/chromium/blink/+/fa739fe5369f55bbdcb3fa123cb64df36b8ae414.

Adopt Attr node as needed.

Test: fast/dom/Attr/set-attribute-node-from-iframe.html

* dom/Element.cpp:
(WebCore::Element::setAttributeNode):

LayoutTests: 

Add a regression test.

* fast/dom/Attr/set-attribute-node-from-iframe-expected.txt: Added.
* fast/dom/Attr/set-attribute-node-from-iframe.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@151998 268f45cc-cd09-0410-ab3c-d52691b4dbfc