Add FeatureDefines for image controls
https://bugs.webkit.org/show_bug.cgi?id=129022

Reviewed by Jer Noble.

Source/JavaScriptCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit/mac:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

* Configurations/FeatureDefines.xcconfig:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164366 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Do not dispatch change event twice in single step action
https://bugs.webkit.org/show_bug.cgi?id=116936
<rdar://problem/16086828>

Reviewed by Ryosuke Niwa.

Merged from Blink (patch by Kent Tamura):
https://src.chromium.org/viewvc/blink?view=rev&revision=151175

Source/WebCore:

Test: fast/forms/number/number-type-update-by-change-event.html

* html/InputType.cpp:
(WebCore::InputType::stepUpFromRenderer):

LayoutTests:

* fast/forms/number/number-type-update-by-change-event-expected.txt: Added.
* fast/forms/number/number-type-update-by-change-event.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164367 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r163560): Always treat SVG <tspan> and <textPath> as display inline
https://bugs.webkit.org/show_bug.cgi?id=128552
<rdar://problem/16029658>

Reviewed by Andreas Kling.

Source/WebCore:

Following <http://trac.webkit.org/changeset/163560>, SVG <tspan> and <textPath> may be treated as block-
level elements depending on their CSS styles (e.g. display: block). But such elements should always be
treated as inline-level elements.

Tests: svg/text/textpath-display-block.html
       svg/text/textpath-display-none.html
       svg/text/tspan-display-block.html

* css/StyleResolver.cpp:
(WebCore::StyleResolver::adjustRenderStyle):

LayoutTests:

Added tests to ensure that SVG <tspan> and <textPath> are always treated as inline-level
elements when explicitly or implicitly specified as a non-none, non-inline display type.

Additionally, added a test to ensure that we don't render a <textPath> when it has CSS
display none. Note, the test LayoutTests/svg/batik/text/textProperties2.svg ensures a
similar behavior for <tspan>.

* svg/text/textpath-display-block-expected.txt: Added.
* svg/text/textpath-display-block.html: Added.
* svg/text/textpath-display-none-expected.html: Added.
* svg/text/textpath-display-none.html: Added.
* svg/text/tspan-display-block-expected.txt: Added.
* svg/text/tspan-display-block.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164368 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Don't call to willBeDeletedFrom(Document&) when destructing document
https://bugs.webkit.org/show_bug.cgi?id=129013

Reviewed by Andreas Kling.
        
The document is half dead at this point.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::~ContainerNode):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164369 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Windows gardening. Mark more flakes.

* platform/win/TestExpectations: Add flaky tests.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164370 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Dedicated worker crash caused by global DFG worklists + GC
https://bugs.webkit.org/show_bug.cgi?id=128537

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

The process-global DFG worklists were causing objects to participate in the garbage collections of VMs
other than the one they were allocated in. This started manifesting in the worker tests because they're
one of the few WebKit tests that do multithreaded JS.

The fix is to filter out Plans from other VMs during collection.

* dfg/DFGSafepoint.cpp:
(JSC::DFG::Safepoint::vm):
* dfg/DFGSafepoint.h:
* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::isActiveForVM):
(JSC::DFG::Worklist::suspendAllThreads):
(JSC::DFG::Worklist::resumeAllThreads):
(JSC::DFG::Worklist::visitChildren):
* dfg/DFGWorklist.h:
* heap/Heap.cpp:
(JSC::Heap::deleteAllCompiledCode):
* heap/SlotVisitorInlines.h:
(JSC::SlotVisitor::copyLater):

LayoutTests:

Reenable a previously skipped test.

* TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164371 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebRTC] Updating RTCConfiguration to match WebRTC editor's draft of 01/27/2014
https://bugs.webkit.org/show_bug.cgi?id=129000

Source/WebCore:

Reviewed by Eric Carlson.

Adding RTCIceTransports and RTCIdentityOption to RTCConfiguration object.

Existing test was updated.

* Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::parseConfiguration): Taking into account iceTransports and requestIdentity
parameters.
* platform/mediastream/RTCConfiguration.h:
(WebCore::RTCConfiguration::iceTransports): Added.
(WebCore::RTCConfiguration::setIceTransports): Added.
(WebCore::RTCConfiguration::requestIdentity): Added.
(WebCore::RTCConfiguration::setRequestIdentity): Added.
(WebCore::RTCConfiguration::RTCConfiguration): Initialize iceTransports and requestIdentity with the default
values.

LayoutTests:

Adding RTCIceTransports and RTCIdentityOption to RTCConfiguration object.

Reviewed by Eric Carlson.

* fast/mediastream/RTCPeerConnection-expected.txt:
* fast/mediastream/RTCPeerConnection.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164372 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0) in WTF::dateToDaysFrom1970
https://bugs.webkit.org/show_bug.cgi?id=128740

Source/JavaScriptCore:

Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970
DateConstructor will now check if the number fits into an Int32 before casting

Patch by Dániel Bátyai <dbatyai.u-szeged@partner.samsung.com> on 2014-02-19
Reviewed by Geoffrey Garen.

* runtime/DateConstructor.cpp:
(JSC::constructDate):
(JSC::dateUTC):

LayoutTests:

Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970
Added test case which checks for this

Patch by Dániel Bátyai <dbatyai.u-szeged@partner.samsung.com> on 2014-02-19
Reviewed by Geoffrey Garen.

* js/date-constructor-expected.txt:
* js/script-tests/date-constructor.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164373 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Win][LLINT] Incorrect stack alignment.
https://bugs.webkit.org/show_bug.cgi?id=129045

Patch by peavo@outlook.com <peavo@outlook.com> on 2014-02-19
Reviewed by Michael Saboff.

LLINT expects the stack to be 16 byte aligned, but with MSVC it is not.
To align the stack, a new backend, X86_WIN, is created.

* llint/LLIntOfflineAsmConfig.h: Use X86_WIN backend on Windows.
* llint/LowLevelInterpreter.asm: Align stack to 16 byte boundaries. Otherwise, use same implementation for X86_WIN as for X86.
* llint/LowLevelInterpreter32_64.asm: Adjust stack offset to retrieve function parameters now that the stack is aligned.
* offlineasm/backends.rb: Added X86_WIN backend.
* offlineasm/x86.rb: Fix crash caused by incorrect assembly code for double types.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164374 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add missing layout test results for
<http://trac.webkit.org/changeset/164323>.

Unreviewed.

* platform/mac/fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164375 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: AX: clarify reason for ignored state where possible (hidden, default for tag, etc)
https://bugs.webkit.org/show_bug.cgi?id=129037

Patch by James Craig <jcraig@apple.com> on 2014-02-19
Reviewed by Timothy Hatcher.

Source/WebCore:

Passing back hidden and ignoredByDefault attrs to clarify some reasons for "ignored" status.

Test Updated: inspector-protocol/dom/getAccessibilityPropertiesForNode.html

* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
* inspector/protocol/DOM.json:

Source/WebInspectorUI:

Passing back hidden and ignoredByDefault attrs to clarify some reasons for "ignored" status.

* Localizations/en.lproj/localizedStrings.js:
* UserInterface/DOMNode.js:
* UserInterface/DOMNodeDetailsSidebarPanel.js:

LayoutTests:

Test updates to support hidden and ignoredByDefault in accessibility properties.

* inspector-protocol/dom/getAccessibilityPropertiesForNode-expected.txt:
* inspector-protocol/dom/getAccessibilityPropertiesForNode.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164376 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SegmentedVector::append() should take in rvalue reference, forward it to Vector::uncheckedAppend()
https://bugs.webkit.org/show_bug.cgi?id=128996

Patch by Zan Dobersek <zdobersek@igalia.com> on 2014-02-19
Reviewed by Brent Fulgham.

* wtf/SegmentedVector.h:
(WTF::SegmentedVector::append): Take in an rvalue reference of the object that's to be appended and
then forward it to Vector::uncheckedAppend(). This avoids unnecessary copies in the current situation
where a const lvalue is accepted and passed on.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164377 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use std::swap() in HashTable::swap()
https://bugs.webkit.org/show_bug.cgi?id=128995

Patch by Zan Dobersek <zdobersek@igalia.com> on 2014-02-19
Reviewed by Brent Fulgham.

Use std::swap() to swap the member variable values of two HashTable objects in HashTable::swap().

* wtf/HashTable.h:
(WTF::KeyTraits>::swap):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164378 268f45cc-cd09-0410-ab3c-d52691b4dbfc