Bad cast with toRenderBox in WebCore::RenderView::repaintViewRectangle
https://bugs.webkit.org/show_bug.cgi?id=129104

Reviewed by Simon Fraser.

Source/WebCore:

We should not cast the renderer of a RenderView's owner to RenderBox
unless we are sure it is one.

Test: plugins/crash-invalid-data-reference.html

* rendering/RenderView.cpp:
(WebCore::RenderView::repaintViewRectangle):

LayoutTests:

* plugins/crash-invalid-data-reference-expected.txt: Added.
* plugins/crash-invalid-data-reference.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165826 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r165815.
https://bugs.webkit.org/show_bug.cgi?id=130410

Broke many VTT tests (Requested by bfulgham on #webkit).

Reverted changeset:

Source/WebCore:

"TextTrackRegion Not Implemented"
https://bugs.webkit.org/show_bug.cgi?id=116546
http://trac.webkit.org/changeset/165815

LayoutTests:

"TextTrackRegion Not Implemented"
https://bugs.webkit.org/show_bug.cgi?id=116546
http://trac.webkit.org/changeset/165815

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165829 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Removed extra parens from if statement in a preprocessor define.
https://bugs.webkit.org/show_bug.cgi?id=130408

Patch by Matthew Mirman <mmirman@apple.com> on 2014-03-18
Reviewed by Filip Pizlo.

* parser/Parser.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165831 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Remove stale ReportMemoryUsagePlugin
https://bugs.webkit.org/show_bug.cgi?id=130405

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-03-18
Reviewed by Andreas Kling.

This clang plugin looks like it was used for the old Inspector memory
instrumentation that was removed. So the tool can be removed.

* clang/ReportMemoryUsagePlugin/CMakeLists.txt: Removed.
* clang/ReportMemoryUsagePlugin/Makefile: Removed.
* clang/ReportMemoryUsagePlugin/ReportMemoryUsage.cpp: Removed.
* clang/ReportMemoryUsagePlugin/tests/Source/WebCore/Test.cpp: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165833 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Removing MediaStreamVector typedef
https://bugs.webkit.org/show_bug.cgi?id=130402

Reviewed by Eric Carlson.

* Modules/mediastream/MediaStream.h:
* Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::getLocalStreams):
(WebCore::RTCPeerConnection::getRemoteStreams):
(WebCore::RTCPeerConnection::getStreamById):
(WebCore::RTCPeerConnection::hasLocalStreamWithTrackId):
* Modules/mediastream/RTCPeerConnection.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165834 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] shape-outside: ellipse(50% 50% at) causes crash
https://bugs.webkit.org/show_bug.cgi?id=130366

Reviewed by Andreas Kling.

Source/WebCore:

The BasicShape ellipse and circle functions now report a syntax error
if the "at" keyword is not followed by a position.

The existing parsing tests have been updated to include this case.

* css/CSSParser.cpp:
(WebCore::CSSParser::parseBasicShapeCircle):
(WebCore::CSSParser::parseBasicShapeEllipse):

LayoutTests:

Added invalid syntax tests for ellipse(.. at), circle(.. at) variations.

* fast/shapes/parsing/parsing-shape-inside-expected.txt:
* fast/shapes/parsing/parsing-shape-outside-expected.txt:
* fast/shapes/parsing/parsing-test-utils.js:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165835 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r163560): ASSERTION FAILED: childrenInline() in WebCore::RenderSVGText::layout
https://bugs.webkit.org/show_bug.cgi?id=130346

Reviewed by Andreas Kling.

Source/WebCore:

Following <http://trac.webkit.org/changeset/163560>, SVG inline elements may be treated as block-
level elements depending on their CSS styles (e.g. display: block). But such elements should always
be treated as inline-level elements.

Partially revert <http://trac.webkit.org/changeset/164368> as it addressed a similar issue for
<tspan> and <tref>. Instead we should implement RenderSVGInline::updateFromStyle() to ensure that
RenderSVGInline and any derived classes (e.g. RenderSVGTSpan) are always treated as inline elements
regardless of their CSS style because the SVG text layout code depends on this assumption as part
of a performance optimization. We may want to revaluate the benefits of this optimization with respect
to code clarity and ensuring the code is less error prone.

Test: svg/text/a-display-block.html
      svg/text/tref-display-inherit.html

* css/StyleResolver.cpp:
(WebCore::StyleResolver::adjustRenderStyle): Revert changes from <http://trac.webkit.org/changeset/164368>.
* rendering/RenderInline.h:
* rendering/svg/RenderSVGInline.cpp:
(WebCore::RenderSVGInline::updateFromStyle): Added; ensure that RenderSVGInline and any derived
classes are treated as inline elements because the SVG text layout code depends on this assumption.
* rendering/svg/RenderSVGInline.h:

LayoutTests:

Added tests to ensure that SVG <a> and <tref> are always treated as inline-level elements.

* svg/text/a-display-block-expected.txt: Added.
* svg/text/a-display-block.html: Added.
* svg/text/tref-display-inherit-expected.txt: Added.
* svg/text/tref-display-inherit.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165836 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r162334): RenderTableCol::styleDidChange uses out-of-date table information
https://bugs.webkit.org/show_bug.cgi?id=129561

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/table/update-col-width-and-remove-table-cell-crash.html

Fixes an issue where a table column or table column group may query an out-
of-date model of its associated table as part of its process to propagate
style changes to affected table cells.

* rendering/RenderTableCol.cpp:
(WebCore::RenderTableCol::styleDidChange): Ensure that all sections in the table
are up-to-date before querying for a table cell.
* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::recalcCells): Update comment to read well. In
particular, remove the reference to RenderTableSection::fillRowsWithDefaultStartingAtPosition()
as this function was removed in <http://trac.webkit.org/changeset/99919>.
(WebCore::RenderTableSection::setNeedsCellRecalc): Clear the grid preemptively to
to ensure that accessors cannot access stale data. We'll build the grid again
in RenderTableSection::recalcCells().
(WebCore::RenderTableSection::numColumns): Add ASSERT(!m_needsCellRecalc) to assert
that the grid cells are up-to-date. That is, we don't need to calculate them again.
* rendering/RenderTableSection.h: Add ASSERT(!m_needsCellRecalc) or call recalcCellsIfNeeded()
before accessing the grid to ensure that it's up-to-date.

LayoutTests:

Add a test to ensure that a table column propagates a style change to applicable
table cells.

* fast/table/update-col-width-and-remove-table-cell-crash-expected.txt: Added.
* fast/table/update-col-width-and-remove-table-cell-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165837 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: Make update-InspectorBackendCommands.rb only update legacy protocol versions
https://bugs.webkit.org/show_bug.cgi?id=130412

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-03-18
Reviewed by Timothy Hatcher.

Rename the script and simplify to only update Legacy protocol versions.

* Scripts/update-LegacyInspectorBackendCommands.rb: Renamed from Source/WebInspectorUI/Scripts/update-InspectorBackendCommands.rb.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165838 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebPageCreationParameters colorSpace should be MAC not COCOA
https://bugs.webkit.org/show_bug.cgi?id=130414

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-03-18
Reviewed by Dan Bernstein.

The colorSpace param was only set and used on Mac, not iOS.

* Shared/WebPageCreationParameters.h:
* Shared/WebPageCreationParameters.cpp:
(WebKit::WebPageCreationParameters::encode):
(WebKit::WebPageCreationParameters::decode):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165839 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add Copyright to framework.sb
https://bugs.webkit.org/show_bug.cgi?id=130413

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2014-03-18
Reviewed by Timothy Hatcher.

Other sb files got the copyright. Follow suit.

* framework.sb:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165840 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION: Visited link coloring seems to be completely broken in tip of tree
https://bugs.webkit.org/show_bug.cgi?id=130419
<rdar://problem/16337850>

Reviewed by Dan Bernstein.

Make sure to send any queued up messages before calling connectionWillOpen so we'll ensure
FIFO ordering if any messages are sent from within connectionWillOpen.

* Shared/ChildProcessProxy.cpp:
(WebKit::ChildProcessProxy::didFinishLaunching):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165841 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add CompareStrictEq(StringIdent:, NotStringVar:) and CompareStrictEq(String:, Untyped:)
https://bugs.webkit.org/show_bug.cgi?id=130300

Reviewed by Mark Hahnenberg.
        
We can quickly strictly compare StringIdent's to NotStringVar's and String's to Untyped's.
This makes the DFG aware of this.
        
Also adds StringIdent-to-StringIdent and StringIdent-to-NotStringVar strict comparisons to
the FTL. Also adds StringIdent-to-StringIdent non-strict comparisons to the FTL.
        
This also gives the DFG some abstractions for checking something is a cell or is other.
This made this patch easier to write and also simplified a bunch of other stuff.
        
1% speed-up on Octane.

* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::JumpList::JumpList):
* bytecode/SpeculatedType.h:
(JSC::isNotStringVarSpeculation):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::childFor):
(JSC::DFG::Node::shouldSpeculateNotStringVar):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileIn):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
(JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
(JSC::DFG::SpeculativeJIT::compileInstanceOf):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::compileBooleanCompare):
(JSC::DFG::SpeculativeJIT::compileStringEquality):
(JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality):
(JSC::DFG::SpeculativeJIT::compileStringIdentEquality):
(JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality):
(JSC::DFG::SpeculativeJIT::compileStringZeroLength):
(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
(JSC::DFG::SpeculativeJIT::speculateString):
(JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
(JSC::DFG::SpeculativeJIT::speculateNotStringVar):
(JSC::DFG::SpeculativeJIT::speculateNotCell):
(JSC::DFG::SpeculativeJIT::speculateOther):
(JSC::DFG::SpeculativeJIT::speculate):
(JSC::DFG::SpeculativeJIT::emitSwitchChar):
(JSC::DFG::SpeculativeJIT::emitSwitchString):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::blessedBooleanResult):
(JSC::DFG::SpeculativeJIT::unblessedBooleanResult):
(JSC::DFG::SpeculativeJIT::booleanResult):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::branchIsCell):
(JSC::DFG::branchNotCell):
(JSC::DFG::SpeculativeJIT::branchIsOther):
(JSC::DFG::SpeculativeJIT::branchNotOther):
(JSC::DFG::SpeculativeJIT::moveTrueTo):
(JSC::DFG::SpeculativeJIT::moveFalseTo):
(JSC::DFG::SpeculativeJIT::blessBoolean):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
(JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::writeBarrier):
(JSC::DFG::SpeculativeJIT::branchIsCell):
(JSC::DFG::SpeculativeJIT::branchNotCell):
(JSC::DFG::SpeculativeJIT::branchIsOther):
(JSC::DFG::SpeculativeJIT::branchNotOther):
(JSC::DFG::SpeculativeJIT::moveTrueTo):
(JSC::DFG::SpeculativeJIT::moveFalseTo):
(JSC::DFG::SpeculativeJIT::blessBoolean):
* dfg/DFGUseKind.cpp:
(WTF::printInternal):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::lowString):
(JSC::FTL::LowerDFGToLLVM::lowStringIdent):
(JSC::FTL::LowerDFGToLLVM::speculate):
(JSC::FTL::LowerDFGToLLVM::speculateString):
(JSC::FTL::LowerDFGToLLVM::speculateStringIdent):
(JSC::FTL::LowerDFGToLLVM::speculateNotStringVar):
* runtime/JSCJSValue.h:
* tests/stress/string-ident-to-not-string-var-equality.js: Added.
(foo):
(bar):
(test):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165842 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutBox is a terrible name
https://bugs.webkit.org/show_bug.cgi?id=130351

Reviewed by Simon Fraser.

Rename LayoutBox to CSSBoxType. Also rename the functions and methods
that mention "LayoutBox" to something that makes sense for each
specific situation.

No new tests, no behavior change.

* css/BasicShapeFunctions.cpp:
(WebCore::valueForBasicShape):
(WebCore::basicShapeForValue):
* css/CSSBasicShapes.cpp:
(WebCore::CSSBasicShapeCircle::cssText):
(WebCore::CSSBasicShapeCircle::equals):
(WebCore::CSSBasicShapeEllipse::cssText):
(WebCore::CSSBasicShapeEllipse::equals):
(WebCore::CSSBasicShapePolygon::cssText):
(WebCore::CSSBasicShapePolygon::equals):
(WebCore::CSSBasicShapeInset::cssText):
* css/CSSBasicShapes.h:
(WebCore::CSSBasicShape::referenceBox):
(WebCore::CSSBasicShape::setReferenceBox):
* css/CSSComputedStyleDeclaration.cpp:
(WebCore::shapePropertyValue):
* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator CSSBoxType):
* css/DeprecatedStyleBuilder.cpp:
(WebCore::ApplyPropertyClipPath::applyValue):
(WebCore::ApplyPropertyShape::applyValue):
* page/animation/CSSPropertyAnimation.cpp:
(WebCore::blendFunc):
* rendering/ClipPathOperation.h:
(WebCore::ShapeClipPathOperation::setReferenceBox):
(WebCore::ShapeClipPathOperation::referenceBox):
(WebCore::BoxClipPathOperation::create):
(WebCore::BoxClipPathOperation::referenceBox):
(WebCore::BoxClipPathOperation::BoxClipPathOperation):
* rendering/shapes/Shape.cpp:
(WebCore::Shape::createBoxShape):
* rendering/shapes/Shape.h:
* rendering/shapes/ShapeInfo.cpp:
(WebCore::ShapeInfo<RenderType>::computedShape):
* rendering/shapes/ShapeInfo.h:
* rendering/shapes/ShapeInsideInfo.h:
* rendering/shapes/ShapeOutsideInfo.h:
* rendering/style/BasicShapes.cpp:
(WebCore::BasicShape::canBlend):
* rendering/style/BasicShapes.h:
(WebCore::BasicShape::referenceBox):
(WebCore::BasicShape::setReferenceBox):
(WebCore::BasicShape::BasicShape):
* rendering/style/RenderStyleConstants.h:
* rendering/style/ShapeValue.h:
(WebCore::ShapeValue::createShapeValue):
(WebCore::ShapeValue::createBoxShapeValue):
(WebCore::ShapeValue::cssBox):
(WebCore::ShapeValue::ShapeValue):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165843 268f45cc-cd09-0410-ab3c-d52691b4dbfc