REGRESSION (r166853): fast/preloader/document-write.html is very flaky
https://bugs.webkit.org/show_bug.cgi?id=130942

* platform/mac/TestExpectations: The offending code was re-landed, marking as
flaky again.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167015 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Plugin process crashes when loading totem plugin
https://bugs.webkit.org/show_bug.cgi?id=131357

Reviewed by Martin Robinson.

Remove netscape plugin implementation from WebCore that was only
used by WebKit1. This removes the conflict between the WebCore NPN
symbols and the ones used by the plugins.

* CMakeLists.txt:
* PlatformEfl.cmake:
* PlatformGTK.cmake:
* PlatformWin.cmake:
* plugins/PluginViewNone.cpp:
* plugins/gtk/PluginPackageGtk.cpp: Removed.
* plugins/gtk/PluginViewGtk.cpp: Removed.
* plugins/gtk/gtk2xtbin.c: Removed.
* plugins/gtk/gtk2xtbin.h: Removed.
* plugins/gtk/xembed.h: Removed.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167016 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use std::array in AffineTransform, and get rid of setMatrix
https://bugs.webkit.org/show_bug.cgi?id=131416

Reviewed by Sam Weinig.

* platform/graphics/transforms/AffineTransform.cpp:
(WebCore::AffineTransform::AffineTransform):
(WebCore::AffineTransform::multiply):
* platform/graphics/transforms/AffineTransform.h:
(WebCore::AffineTransform::setMatrix): Deleted.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167017 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Regions] Monolithic elements should not affect the layout of the content outside its region
https://bugs.webkit.org/show_bug.cgi?id=130499

Reviewed by David Hyatt.

Source/WebCore:

When performing layout on an element flowed into regions, its logical height must not be incremented
past the region's logical bottom for monolithic elements in regions different than the last region their containing
block is fragmented into. This ensures that the following elements are correctly laid out
from the top of the next region.
This change must also be applied to floats in order to prevent text from avoiding part
of a float that did not actually made it into the current region, but instead overflowed
the previous one.

Tests: fast/regions/fragmentation-after-float-overflow-single-region.html
       fast/regions/fragmentation-after-monolithic-overflow-self-collapsed.html
       fast/regions/fragmentation-after-monolithic-overflow-single-region.html
       fast/regions/fragmentation-after-monolithic-overflow.html

* rendering/FloatingObjects.cpp:
(WebCore::FloatingObjects::computePlacedFloatsTree):
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::layoutBlockChild):
(WebCore::RenderBlockFlow::adjustBlockChildForPagination):
(WebCore::RenderBlockFlow::lowestFloatLogicalBottom):
(WebCore::RenderBlockFlow::getClearDelta):
(WebCore::RenderBlockFlow::applyAfterBreak): Deleted.
(WebCore::RenderBlockFlow::nextFloatLogicalBottomBelow): Deleted.
(WebCore::RenderBlockFlow::nextFloatLogicalBottomBelowForBlock): Deleted.
(WebCore::RenderBlockFlow::flipFloatForWritingModeForChild): Deleted.
* rendering/RenderBlockFlow.h:
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::isBoxInDifferentRegionsAsFloat):
* rendering/RenderFlowThread.h:

LayoutTests:

Added tests for different types of fragmentation following monolithic content
overflowing its region.
Rebased the webkit-flow-float-unable-to-push test as its expected result was not the correct one.

* fast/regions/webkit-flow-float-unable-to-push-expected.html:
* fast/regions/fragmentation-after-float-overflow-single-region-expected.html: Added.
* fast/regions/fragmentation-after-float-overflow-single-region.html: Added.
* fast/regions/fragmentation-after-monolithic-overflow-expected.html: Added.
* fast/regions/fragmentation-after-monolithic-overflow-self-collapsed-expected.html: Added.
* fast/regions/fragmentation-after-monolithic-overflow-self-collapsed.html: Added.
* fast/regions/fragmentation-after-monolithic-overflow-single-region-expected.html: Added.
* fast/regions/fragmentation-after-monolithic-overflow-single-region.html: Added.
* fast/regions/fragmentation-after-monolithic-overflow.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167018 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed iOS build fix. Replacing deprecated enum with AVPlayerViewControllerExitFullScreenReason.

* platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
(-[WebAVPlayerController playerViewController:shouldDismissWithReason:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167019 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rewrite Function.bind as a builtin
https://bugs.webkit.org/show_bug.cgi?id=131083

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This change removes the existing function.bind implementation
entirely so JSBoundFunction is no more.

Instead we just return a regular JS closure with a few
private properties hanging off it that allow us to perform
the necessary bound function fakery.  While most of this is
simple, a couple of key changes:

- The parser and lexer now directly track whether they're
  parsing code for call or construct and convert the private
  name @IsConstructor into TRUETOK or FALSETOK as appropriate.
  This automatically gives us the ability to vary behaviour
  from within the builtin. It also leaves a lot of headroom
  for trivial future improvements.
- The instanceof operator now uses the prototypeForHasInstance
  private name, and we have a helper function to ensure that
  all objects that need to can update their magical 'prototype'
  property pair correctly.

* API/JSScriptRef.cpp:
(parseScript):
* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/BuiltinExecutables.cpp:
(JSC::BuiltinExecutables::createBuiltinExecutable):
* builtins/Function.prototype.js:
(bind.bindingFunction):
(bind.else.bindingFunction):
(bind):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::generateFunctionCodeBlock):
* bytecompiler/NodesCodegen.cpp:
(JSC::InstanceOfNode::emitBytecode):
* interpreter/Interpreter.cpp:
* parser/Lexer.cpp:
(JSC::Lexer<T>::Lexer):
(JSC::Lexer<LChar>::parseIdentifier):
(JSC::Lexer<UChar>::parseIdentifier):
* parser/Lexer.h:
* parser/Parser.cpp:
(JSC::Parser<LexerType>::Parser):
(JSC::Parser<LexerType>::parseInner):
* parser/Parser.h:
(JSC::parse):
* parser/ParserModes.h:
* runtime/CodeCache.cpp:
(JSC::CodeCache::getGlobalCodeBlock):
(JSC::CodeCache::getFunctionExecutableFromGlobalCode):
* runtime/CommonIdentifiers.h:
* runtime/Completion.cpp:
(JSC::checkSyntax):
* runtime/Executable.cpp:
(JSC::ProgramExecutable::checkSyntax):
* runtime/FunctionPrototype.cpp:
(JSC::FunctionPrototype::addFunctionProperties):
(JSC::functionProtoFuncBind): Deleted.
* runtime/JSBoundFunction.cpp: Removed.
* runtime/JSBoundFunction.h: Removed.
* runtime/JSFunction.cpp:
(JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
(JSC::RetrieveCallerFunctionFunctor::operator()):
(JSC::retrieveCallerFunction):
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::defineOwnProperty):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncSetTypeErrorAccessor):
* runtime/JSGlobalObjectFunctions.h:
* runtime/JSObject.h:
(JSC::JSObject::inlineGetOwnPropertySlot):

Source/WebCore:

Switch WebCore to use the helper functions when defining the
prototype properties on DOM constructors, and update bindings
tests accordingly.

* bindings/js/JSImageConstructor.cpp:
(WebCore::JSImageConstructor::finishCreation):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateConstructorHelperMethods):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::JSTestActiveDOMObjectConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::JSTestCustomNamedGetterConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::JSTestEventConstructorConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::JSTestEventTargetConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::JSTestExceptionConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::JSTestGenerateIsReachableConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterfaceConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::JSTestMediaQueryListListenerConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::JSTestNamedConstructorConstructor::finishCreation):
(WebCore::JSTestNamedConstructorNamedConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::JSTestNodeConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::JSTestObjConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::JSTestOverloadedConstructorsConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::JSTestTypedefsConstructor::finishCreation):
* bindings/scripts/test/JS/JSattribute.cpp:
(WebCore::JSattributeConstructor::finishCreation):
* bindings/scripts/test/JS/JSreadonly.cpp:
(WebCore::JSreadonlyConstructor::finishCreation):

LayoutTests:

Testing.

* js/dom/function-bind-expected.txt:
* js/regress/function-bind-expected.txt: Added.
* js/regress/function-bind.html: Added.
* js/regress/script-tests/function-bind.js: Added.
(foo):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167020 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2014-04-09  Geoffrey Garen  <ggaren@apple.com>

        Rolled back in r166972.

        The iOS buildbot's scripts have been updated to build bmalloc, so the
        build should now succeed on the bot.

        Also renamed "Frameworks" to "Libraries" as suggested in a review comment.

            WTF should link against bmalloc
            https://bugs.webkit.org/show_bug.cgi?id=131403

            Reviewed by Michael Saboff.

            This is required to build successfullly with bmalloc enabled.

            * WTF.xcodeproj/project.pbxproj:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167021 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[CSS Shapes] Add no regions version of RegionsShapes performance test
https://bugs.webkit.org/show_bug.cgi?id=131442

Reviewed by Ryosuke Niwa.

We would like have a no regions version for RegionsShapes performance test. The new
test produces similar layout to RegionsShapes.html without using regions. It is helpful
for us to do further comparisons when necessary. This test is skipped by default.

* Layout/Shapes/RegionsShapesNoRegions.html: Added.
* Layout/Shapes/resources/RegionsShapes.css: Added.
(html, body):
(.shape):
(#circleShape):
(#imageShape):
(#insetShape):
(#roundedInsetShape):
(#triangleLeft):
(#triangleRight):
(#selfIntersectingStar):
(#region1):
(#region2):
(#region3):
* Layout/Shapes/resources/RegionsShapesContent.html:
* Layout/Shapes/resources/RegionsShapesContentNoRegionsWidth400.html: Added.
* Layout/Shapes/resources/RegionsShapesContentNoRegionsWidth600.html: Added.
* Layout/Shapes/resources/RegionsShapesContentNoRegionsWidth800.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167022 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ContentFilterMac is broken when NE_FILTER_SOURCE is enabled.
<rdar://problem/15978793> and https://bugs.webkit.org/show_bug.cgi?id=131445

Reviewed by Andy Estes.

No new tests (Not a tested feature).

* platform/mac/ContentFilterMac.mm:
(WebCore::ContentFilter::needsMoreData): Only consider m_neFilterSourceStatus if m_neFilterSource exists.
(WebCore::ContentFilter::didBlockData): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167023 268f45cc-cd09-0410-ab3c-d52691b4dbfc
AX: Make AXPress much more reliable on the Web
https://bugs.webkit.org/show_bug.cgi?id=131426

Reviewed by Mario Sanchez Prada.

Source/WebCore: 

AXPress fails when an event handler is on a node higher in the parent chain than the focused node.

We need to make AXPress more reliable by 
    1) Using the element that is focused as the target of the event
    2) Search for the inner most control object when dispatching the event

Updated existing accessibility/press-works-on-control-types.html

* accessibility/AccessibilityMenuList.cpp:
(WebCore::AccessibilityMenuList::press):
* accessibility/AccessibilityMenuList.h:
* accessibility/AccessibilityMenuListPopup.cpp:
(WebCore::AccessibilityMenuListPopup::press):
* accessibility/AccessibilityMenuListPopup.h:
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::press):
* accessibility/AccessibilityObject.h:
(WebCore::AccessibilityObject::performDefaultAction):
* accessibility/AccessibilitySearchFieldButtons.cpp:
(WebCore::AccessibilitySearchFieldCancelButton::press):
* accessibility/AccessibilitySearchFieldButtons.h:
* accessibility/AccessibilitySpinButton.cpp:
(WebCore::AccessibilitySpinButtonPart::press):
* accessibility/AccessibilitySpinButton.h:

LayoutTests: 

* accessibility/press-works-on-control-types-expected.txt:
* accessibility/press-works-on-control-types.html:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167024 268f45cc-cd09-0410-ab3c-d52691b4dbfc