Large canvas fills should not crash or create unnecessarily large image buffers
https://bugs.webkit.org/show_bug.cgi?id=67988

Source/WebCore:

When using source-in, destination-in, source-out, or destination-atop a temporary
buffer is created. This buffer only needs to be big enough to cover the intersection
of the path and the canvas.

This change also adds some null checks for failures to create contexts or buffers.

Patch by Ben Wells <benwells@chromium.org> on 2011-09-14
Reviewed by Stephen White.

Test: fast/canvas/canvas-large-fills.html

* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::CanvasRenderingContext2D::clearCanvas):
(WebCore::CanvasRenderingContext2D::fillAndDisplayTransparencyElsewhere):

LayoutTests:

Patch by Ben Wells <benwells@chromium.org> on 2011-09-14
Reviewed by Stephen White.

* fast/canvas/canvas-large-fills-expected.txt: Added.
* fast/canvas/canvas-large-fills.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95080 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Unreviewed, update test expectations for
svg/custom/dynamic-svg-document-creation.svg after r95030

* platform/qt/svg/custom/dynamic-svg-document-creation-expected.png:
* platform/qt/svg/custom/dynamic-svg-document-creation-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95081 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, update chromium test expecations.

* platform/chromium/test_expectations.txt:
  - remove failure by r95058, which was reverted by r95077.
  - add failures by r95070

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95082 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: [v8] building call frame info for location-less internal script function crashes.
https://bugs.webkit.org/show_bug.cgi?id=67991

Reviewed by Yury Semikhatsky.

Source/WebCore:

Test: inspector/debugger/debugger-pause-in-internal.html

* bindings/v8/DebuggerScript.js:
():
* bindings/v8/ScriptDebugServer.cpp:
(WebCore::ScriptDebugServer::currentCallFrame):

LayoutTests:

* inspector/debugger/debugger-pause-in-internal-expected.txt: Added.
* inspector/debugger/debugger-pause-in-internal.html: Added.
* inspector/debugger/debugger-pause-on-exception-crash-expected.txt: Added.
* platform/chromium/inspector/debugger/debugger-pause-in-internal-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95083 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, rolling out r95080.
http://trac.webkit.org/changeset/95080
https://bugs.webkit.org/show_bug.cgi?id=68070

It caused some 2d.composite.uncovered tests fail (Requested by
rgabor on #webkit).

Patch by Sheriff Bot <webkit.review.bot@gmail.com> on 2011-09-14

Source/WebCore:

* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::CanvasRenderingContext2D::clearCanvas):
(WebCore::CanvasRenderingContext2D::fillAndDisplayTransparencyElsewhere):

LayoutTests:

* fast/canvas/canvas-large-fills-expected.txt: Removed.
* fast/canvas/canvas-large-fills.html: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95084 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Remove obsolete WebViewClient methods from DumpRenderTree.
https://bugs.webkit.org/show_bug.cgi?id=68066

Reviewed by Adam Barth.

* DumpRenderTree/chromium/WebViewHost.cpp:
* DumpRenderTree/chromium/WebViewHost.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95085 268f45cc-cd09-0410-ab3c-d52691b4dbfc
page-transition-event-constructor-expected.txt is missing
https://bugs.webkit.org/show_bug.cgi?id=68069

Reviewed by Hajime Morita.

* fast/events/constructors/page-transition-event-constructor-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95086 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, update chromium test expectations.

* platform/chromium/test_expectations.txt: fix lint-test-files error

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95087 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[EFL] Add NULL checks to ewk_window_features_new_from_core and ewk_view_window_create.
https://bugs.webkit.org/show_bug.cgi?id=64932

Patch by Grzegorz Czajkowski <g.czajkowski@samsung.com> on 2011-09-14
Reviewed by Eric Seidel.

It prevents the crash while allocating memory for the new window.

* ewk/ewk_view.cpp:
(ewk_view_window_create):
* ewk/ewk_window_features.cpp:
(ewk_window_features_new_from_core):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95088 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: InspectorInstrumentation::frameDestroyed is called after m_page has been reset.
https://bugs.webkit.org/show_bug.cgi?id=67997

We should not instrument frameDestroyed event from within Frame's destructor
since frame's m_page pointer is likely to be 0 by that time and appropriate
instrumenting agent won't be found. As a result, stale frame with its id
end up in the inspector.

This change wipes out frame binding from the inspector upon detach rather
than destroy + adds an assertion into the inspector agents lookup with 0 page.

Reviewed by Tony Gentilcore.

* inspector/InspectorInstrumentation.cpp:
(WebCore::InspectorInstrumentation::frameDetachedImpl):
(WebCore::InspectorInstrumentation::instrumentingAgentsForPage):
* inspector/InspectorInstrumentation.h:
(WebCore::InspectorInstrumentation::frameWindowDiscarded):
(WebCore::InspectorInstrumentation::domContentLoadedEventFired):
(WebCore::InspectorInstrumentation::loadEventFired):
(WebCore::InspectorInstrumentation::frameDetached):
(WebCore::InspectorInstrumentation::didCommitLoad):
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::frameDetached):
* inspector/InspectorPageAgent.h:
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::detachFromParent):
* page/Frame.cpp:
(WebCore::Frame::~Frame):
(WebCore::Frame::detachFromPage):
(WebCore::Frame::transferChildFrameToNewDocument):
* page/Frame.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95089 268f45cc-cd09-0410-ab3c-d52691b4dbfc
HashTraits.h should include template specialization for WTF::String
https://bugs.webkit.org/show_bug.cgi?id=67851

Ensure that the template specialization for HashTraits<String> is always
picked up. (Previously it was possible to include HashSet and String but
not the correct HashTraits, so you would get an inefficient template
instantiation.)

Patch by Iain Merrick <husky@google.com> on 2011-09-14
Reviewed by Darin Adler.

* wtf/HashTraits.h:
* wtf/text/StringHash.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95090 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: requestAnimationFrame callbacks don't show up in the timeline panel.
https://bugs.webkit.org/show_bug.cgi?id=67986

Reviewed by Pavel Feldman.

Source/WebCore:

Test: inspector/timeline/timeline-animation-frame.html

* English.lproj/localizedStrings.js:
* bindings/v8/V8Proxy.cpp:
(WebCore::V8Proxy::callFunction):
(WebCore::V8Proxy::callFunctionWithoutFrame):
(WebCore::V8Proxy::instrumentedCallFunction):
* bindings/v8/V8Proxy.h:
* bindings/v8/custom/V8CustomVoidCallback.cpp:
(WebCore::invokeCallback):
* dom/ScriptedAnimationController.cpp:
(WebCore::ScriptedAnimationController::registerCallback):
(WebCore::ScriptedAnimationController::cancelCallback):
(WebCore::ScriptedAnimationController::serviceScriptedAnimations):
* inspector/InspectorInstrumentation.cpp:
(WebCore::InspectorInstrumentation::didRegisterAnimationFrameCallbackImpl):
(WebCore::InspectorInstrumentation::didCancelAnimationFrameCallbackImpl):
(WebCore::InspectorInstrumentation::willFireAnimationFrameEventImpl):
(WebCore::InspectorInstrumentation::didFireAnimationFrameEventImpl):
* inspector/InspectorInstrumentation.h:
(WebCore::InspectorInstrumentation::willCallFunction):
(WebCore::InspectorInstrumentation::didRegisterAnimationFrameCallback):
(WebCore::InspectorInstrumentation::didCancelAnimationFrameCallback):
(WebCore::InspectorInstrumentation::willFireAnimationFrameEvent):
(WebCore::InspectorInstrumentation::didFireAnimationFrameEvent):
* inspector/InspectorTimelineAgent.cpp:
(WebCore::InspectorTimelineAgent::didRegisterAnimationFrameCallback):
(WebCore::InspectorTimelineAgent::didCancelAnimationFrameCallback):
(WebCore::InspectorTimelineAgent::willFireAnimationFrameEvent):
(WebCore::InspectorTimelineAgent::didFireAnimationFrameEvent):
* inspector/InspectorTimelineAgent.h:
* inspector/TimelineRecordFactory.cpp:
(WebCore::TimelineRecordFactory::createAnimationFrameCallbackData):
* inspector/TimelineRecordFactory.h:
* inspector/front-end/TimelineAgent.js:
* inspector/front-end/TimelinePanel.js:
(WebInspector.TimelinePanel):
(WebInspector.TimelinePanel.prototype.get _recordStyles):
(WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
(WebInspector.TimelinePanel.prototype._clearPanel):
(WebInspector.TimelinePanel.FormattedRecord):
(WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
(WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):

LayoutTests:

* inspector/timeline/timeline-animation-frame-expected.txt: Added.
* inspector/timeline/timeline-animation-frame.html: Added.
* inspector/timeline/timeline-enum-stability-expected.txt:
* platform/chromium/inspector/timeline/timeline-enum-stability-expected.txt:
* inspector/timeline/timeline-test.js:
(initialize_Timeline.InspectorTest.performActions.step2):
(initialize_Timeline.InspectorTest.performActions):
(initialize_Timeline.InspectorTest.performActionsAndPrint):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95091 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2011-09-14  Pavel Feldman  <pfeldman@google.com>

        Not reviewed: rolling out r95089.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::frameDestroyedImpl):
        (WebCore::InspectorInstrumentation::instrumentingAgentsForPage):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::frameWindowDiscarded):
        (WebCore::InspectorInstrumentation::domContentLoadedEventFired):
        (WebCore::InspectorInstrumentation::loadEventFired):
        (WebCore::InspectorInstrumentation::didCommitLoad):
        (WebCore::InspectorInstrumentation::frameDestroyed):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::frameDetached):
        (WebCore::InspectorPageAgent::frameDestroyed):
        * inspector/InspectorPageAgent.h:
        * page/Frame.cpp:
        (WebCore::Frame::~Frame):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95092 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2011-09-13  Pavel Feldman  <pfeldman@google.com>

        Web Inspector: InspectorInstrumentation::frameDestroyed is called after m_page has been reset.
        https://bugs.webkit.org/show_bug.cgi?id=67997

        We should not instrument frameDestroyed event from within Frame's destructor
        since frame's m_page pointer is likely to be 0 by that time and appropriate
        instrumenting agent won't be found. As a result, stale frame with its id
        end up in the inspector.

        This change wipes out frame binding from the inspector upon detach rather
        than destroy.

        Reviewed by Tony Gentilcore.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::frameDetachedImpl):
        * inspector/InspectorInstrumentation.h:
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::frameDetached):
        * inspector/InspectorPageAgent.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::detachFromParent):
        * page/Frame.cpp:
        (WebCore::Frame::~Frame):
        (WebCore::Frame::detachFromPage):
        * page/Frame.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95093 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. timeline-animation-frame.html was marked as TIMEOUT.

* platform/qt/test_expectations.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95094 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. timeline-animation-frame.html was marked as TEXT.

* platform/qt/test_expectations.txt:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95095 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=68050
        
Regressions in some layout tests from making border/mask/reflection nine-piece-image
parsing match the spec, which allows any of the pieces to be omitted and to also be
specifiable in any order.
        
When the higher level code suddenly allowed the image slices to be omitted, the fixup
for legacy compatibility for reflections and masks in the parseBorderImageSlice function
no longer happened because that function no longer got called.
        
The fix is to properly set the defaults to include the "fill" keyword, so the fixup is
applied to the NinePieceImages you create before you ever map anything in from the rules.
        
This also has the side effect of fixing -webkit-max-box-image-slice to actually dump as
"0 fill" instead of just "0", which is the correct initial value for this property.

Reviewed by Adam Roben.

Source/WebCore: 

* css/CSSParser.cpp:
(WebCore::CSSParser::parseBorderImageSlice):
* css/CSSStyleSelector.cpp:
(WebCore::CSSStyleSelector::applyProperty):
* rendering/style/StyleRareNonInheritedData.cpp:
(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
* rendering/style/StyleReflection.h:
(WebCore::StyleReflection::StyleReflection):

LayoutTests: 

* fast/css/getComputedStyle/computed-style-expected.txt:
* fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
* svg/css/getComputedStyle-basic-expected.txt:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95096 268f45cc-cd09-0410-ab3c-d52691b4dbfc
query SystemParametersInfo for GDI font smoothing settings
https://bugs.webkit.org/show_bug.cgi?id=68080

Reviewed by Stephen White.

No new tests. fixes antialiasing issues based on User settings

* platform/graphics/skia/SkiaFontWin.cpp:
(WebCore::getDefaultGDITextFlags):
(WebCore::setupPaintForFont):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95097 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Remove Jan Erik Hanssen (added in my r95078) from the list for now
since I can't confirm acceptable his committership.

* Scripts/webkitpy/common/config/committers.py:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95098 268f45cc-cd09-0410-ab3c-d52691b4dbfc
https://bugs.webkit.org/show_bug.cgi?id=68040
        
Make sure border image sub-properties can be specified in any order.

Reviewed by Beth Dakin.

Source/WebCore: 

New tests in fast/borders.

* css/CSSParser.cpp:
(WebCore::BorderImageParseContext::BorderImageParseContext):
(WebCore::BorderImageParseContext::canAdvance):
(WebCore::BorderImageParseContext::setCanAdvance):
(WebCore::BorderImageParseContext::allowCommit):
(WebCore::BorderImageParseContext::allowImage):
(WebCore::BorderImageParseContext::allowImageSlice):
(WebCore::BorderImageParseContext::allowSlash):
(WebCore::BorderImageParseContext::requireWidth):
(WebCore::BorderImageParseContext::requireOutset):
(WebCore::BorderImageParseContext::commitImage):
(WebCore::BorderImageParseContext::commitImageSlice):
(WebCore::BorderImageParseContext::commitSlash):
(WebCore::BorderImageParseContext::commitBorderWidth):
(WebCore::BorderImageParseContext::commitBorderOutset):
(WebCore::BorderImageParseContext::commitRepeat):
(WebCore::CSSParser::parseBorderImage):
(WebCore::CSSParser::parseBorderImageRepeat):
(WebCore::CSSParser::parseBorderImageSlice):
(WebCore::CSSParser::parseBorderImageQuad):
* css/CSSParserValues.h:
(WebCore::CSSParserValueList::previous):

LayoutTests: 

* fast/borders/border-image-scrambled.html: Added.
* platform/mac/fast/borders/border-image-scrambled-expected.png: Added.
* platform/mac/fast/borders/border-image-scrambled-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95099 268f45cc-cd09-0410-ab3c-d52691b4dbfc