Move local utility class DocumentWeakReference entirely from Document.h into Document.cpp
since it is only used there. It is a followup for http://trac.webkit.org/changeset/53345.

Reviewed by Darin Adler.

No new tests since no change in functionality.

* dom/Document.cpp: Move definitions of the methods into declaration of the class, remove 'inline'.
* dom/Document.h: Replace DocumentWeakReference declaration with a forward declaration.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53563 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2010-01-19  Nikolas Zimmermann  <nzimmermann@rim.com>

        Reviewed by Alexey Proskuryakov.

        svg/custom/use-instanceRoot-event-bubbling.xhtml is flakey
        https://bugs.webkit.org/show_bug.cgi?id=33835

        mouseEvent fires mutiple times in svg/custom/use-instanceRoot-as-event-target.xhtml
        https://bugs.webkit.org/show_bug.cgi?id=32519

        Test: svg/custom/use-instanceRoot-event-listener-liveness.xhtml

        Stabilize <use> scripting support - use tests are reliable now (tested using --repeach-each 50 --random -p)

        Do not reclone trees anymore because of event listener changes, instead keep correspondingElement & shadowTreeElement
        synchronized for each SVGElementInstance - any mutations on any event listeners are live, and take immediate effect,
        w/o having to rely on a reclone - this was the root of several race conditions making the <use> tests flakey.

        Fix SVGUseElement::instanceRoot() to force shadow tree creation, even if it was not attached so far - we can't wait
        for finishedParsing() to be called which would recalculate the document style and attach the shadow tree as result.
        This is now matching Operas behaviour.

        Optimize createAttributeEventListener() to not create event listeners if the supplied Attribute isNull() - otherwhise
        DOM calls like removeAttribute("onclick") cause a temporary JSEventListener to be created, added to the event listener
        cache and removed afterwards.

        * bindings/js/ScriptEventListener.cpp:
        (WebCore::createAttributeEventListener): Return early if the supplied attribute is null as discussed with Geoffrey.
        * bindings/v8/ScriptEventListener.cpp:
        (WebCore::createAttributeEventListener): Ditto.
        * dom/Node.cpp: Synchronize event listeners with all element instances, instead of marking the use elements to reclone.
        (WebCore::instancesForSVGElement):
        (WebCore::tryAddEventListener):
        (WebCore::Node::addEventListener): When adding a listener, get a list of element instances and add it their as well.
        (WebCore::tryRemoveEventListener):
        (WebCore::Node::removeEventListener): Ditto for removals, but with special logic for listeners created from markup (see comments)
        * svg/SVGElementInstance.cpp: Cleaned up, removing unncessary checks of correspondingElement() - there is an ASSERT in the ctor.
        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
        (WebCore::SVGElementInstance::scriptExecutionContext):
        (WebCore::SVGElementInstance::addEventListener):
        (WebCore::SVGElementInstance::removeEventListener):
        (WebCore::SVGElementInstance::removeAllEventListeners):
        (WebCore::SVGElementInstance::eventTargetData):
        (WebCore::SVGElementInstance::ensureEventTargetData):
        * svg/SVGUseElement.cpp: Call document()->updateLayoutIgnorePendingStylesheets() to force shadow tree creation, just like CSSStyleDecl works.
        (WebCore::SVGUseElement::instanceRoot):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53564 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/6579204> Exception thrown when opening a <select> pop-up that
uses a web font
https://bugs.webkit.org/show_bug.cgi?id=23911

Reviewed by Darin Adler.

* platform/mac/PopupMenuMac.mm:
(WebCore::PopupMenu::populate): Use the (bold) system font if an NSFont cannot
be obtained.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53565 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>

        Not reviewed. Fix chromium build, introduced a copy&paste error.

        * bindings/v8/ScriptEventListener.cpp:
        (WebCore::createAttributeEventListener):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53566 268f45cc-cd09-0410-ab3c-d52691b4dbfc
MSAA: accSelect() is not implemented

https://bugs.webkit.org/show_bug.cgi?id=33918
<rdar://problem/7436861>

Reviewed by Darin Adler.

WebCore:

Test: platform/win/accessibility/selection-and-focus.html

* accessibility/AccessibilityMenuListOption.cpp:
(WebCore::AccessibilityMenuListOption::setSelected):
Return early if the object is not selectable.

WebKit/win:

* AccessibleBase.cpp:
(AccessibleBase::accSelect):
If there is an invalid combination of state flags, return early. If the
caller passed the "take focus" flag, focus the object. If the "take
selection" flag was passed, check whether the parent object is an
AccessibilityListBox; if so, call the object's setSelectedChildren()
function. If the parent is an AccessibilityMenuListPopup, call the
child object's setSelected() function. Otherwise, if the parent is some
other, unsupported object, return early.
If the selection flags include "add", "remove", or "extend" selection,
and the parent object is not multi-selectable, return early. Otherwise,
set or unset the child's selected flag based on the passed flag.

WebKitTools:

* DumpRenderTree/AccessibilityUIElement.cpp:
(takeFocusCallback):
Call the object's takeFocus() function.
(takeSelectionCallback):
Call its takeSelection() function.
(addSelectionCallback):
Call its addSelection() function.
(removeSelectionCallback):
Call its removeSelection() function.
(AccessibilityUIElement::getJSClass):
Add new functions to the JS class definition.

* DumpRenderTree/AccessibilityUIElement.h:
Declare new functions.

* DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
(AccessibilityUIElement::takeFocus):
Stubbed.
(AccessibilityUIElement::takeSelection):
Stubbed.
(AccessibilityUIElement::addSelection):
Stubbed.
(AccessibilityUIElement::removeSelection):
Stubbed.

* DumpRenderTree/mac/AccessibilityUIElementMac.mm:
(AccessibilityUIElement::takeFocus):
Stubbed.
(AccessibilityUIElement::takeSelection):
Stubbed.
(AccessibilityUIElement::addSelection):
Stubbed.
(AccessibilityUIElement::removeSelection):
Stubbed.

* DumpRenderTree/win/AccessibilityUIElementWin.cpp:
(AccessibilityUIElement::takeFocus):
Call the object's accSelect() function, passing the appropriate flag.
(AccessibilityUIElement::takeSelection):
Ditto.
(AccessibilityUIElement::addSelection):
Ditto.
(AccessibilityUIElement::removeSelection):
Ditto.

LayoutTests:

* platform/win/accessibility/selection-and-focus-expected.txt: Added.
* platform/win/accessibility/selection-and-focus.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53567 268f45cc-cd09-0410-ab3c-d52691b4dbfc
CrossThreadCopier needs to support ThreadSafeShared better.
https://bugs.webkit.org/show_bug.cgi?id=33698

Reviewed by Oliver Hunt.

JavaScriptCore:

* wtf/TypeTraits.cpp: Added tests for the new type traits.
* wtf/TypeTraits.h:
(WTF::IsSubclass): Determines if a class is a derived from another class.
(WTF::IsSubclassOfTemplate): Determines if a class is a derived from a
template class (with one parameter that is unknown).
(WTF::RemoveTemplate): Reveals the type for a template parameter.

WebCore:

Now the copier is able to handle types that derive from ThreadSafeShared.

No change functionality so no new tests.

* loader/WorkerThreadableLoader.cpp:
(WebCore::WorkerThreadableLoader::MainThreadBridge::cancel): Remove unnecessary cast.
(WebCore::WorkerThreadableLoader::MainThreadBridge::clearClientWrapper): Ditto.
* loader/WorkerThreadableLoader.h:
Change to use the derived class instead of the ThreadSafeShared version.
* platform/CrossThreadCopier.cpp:
Add the new template parameter throughout the classes and adjust the class that
handles ThreadSafeShared to allow for derived types.
* platform/CrossThreadCopier.h:
Add another template parameter to be able to detect classes that derive
from ThreadSafeShared.
* websockets/WorkerThreadableWebSocketChannel.cpp:
Removed unnecessary casts and changed a type to use the derived class instead of
the ThreadSafeShared version.
(WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):
(WebCore::workerContextDidSend):
(WebCore::workerContextDidGetBufferedAmount):
(WebCore::workerContextDidConnect):
(WebCore::workerContextDidReceiveMessage):
(WebCore::workerContextDidClose):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::setWebSocketChannel):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadCreateWebSocketChannel):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::bufferedAmount):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::clearClientWrapper):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::setMethodNotCompleted):
(WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion):
* websockets/WorkerThreadableWebSocketChannel.h:
(WebCore::WorkerThreadableWebSocketChannel::Peer::create): Changed a type to use the
derived class instead of the ThreadSafeShared version.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53568 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Platform dependent expected files added for tests introduced in r53446,
because these tests pass. Compared to png files.

Reviewed by Nikolas Zimmermann.

* platform/qt/svg/custom/relative-sized-deep-shadow-tree-content-expected.txt: Added.
* platform/qt/svg/custom/relative-sized-shadow-tree-content-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53569 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2010-01-20  Eric Seidel  <eric@webkit.org>

        No review, rolling out r53537.
        http://trac.webkit.org/changeset/53537
        https://bugs.webkit.org/show_bug.cgi?id=33496

        Added a failure condition to the commit-queue and looks to
        have broken the EWS bots

        * Scripts/webkitpy/commands/early_warning_system.py:
        * Scripts/webkitpy/commands/queues.py:
        * Scripts/webkitpy/queueengine.py:
        * Scripts/webkitpy/scm.py:
        * Scripts/webkitpy/scm_unittest.py:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53570 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Qt] Platform dependent expected files added for tests introduced in r53476,
because these tests pass. Compared to png files.

Reviewed by Nikolas Zimmermann.

* platform/qt/fast/fast-mobile-scrolling/fixed-position-element-expected.txt: Added.
* platform/qt/fast/fast-mobile-scrolling/no-fixed-position-elements-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53571 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/7562708> REGRESSION(53460): Heap::destroy may not run
all destructors

Reviewed by Oliver Hunt.

* runtime/Collector.cpp:
(JSC::Heap::freeBlocks): Instead of fully marking protected objects,
just set their mark bits. This prevents protected objects from keeping
unprotected objects alive. Destructor order is not guaranteed, so it's
OK to destroy objects pointed to by protected objects before destroying
protected objects.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53572 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WAI-ARIA popup buttons spoken as simply 'button'
https://bugs.webkit.org/show_bug.cgi?id=33922

Reviewed by Beth Dakin.

WebCore: 

Test: platform/mac/accessibility/aria-popup.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::actionElement):
(WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
* html/HTMLAttributeNames.in:

LayoutTests: 

* platform/mac/accessibility/aria-popup-expected.txt: Added.
* platform/mac/accessibility/aria-popup.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53573 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Implement File and Blob interfaces as defined in File API spec.
https://bugs.webkit.org/show_bug.cgi?id=32912

Reviewed by Dmitry Titov.

WebCore:

* Android.derived.jscbindings.mk:
* Android.derived.v8bindings.mk:
* Android.mk:
* DerivedSources.cpp:
* DerivedSources.make:
* GNUmakefile.am:
* WebCore.gypi:
* WebCore.pri:
* WebCore.pro:
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:
* WebCoreSources.bkl:
* bindings/js/JSXMLHttpRequestCustom.cpp:
(WebCore::JSXMLHttpRequest::send):
* bindings/objc/DOMHTML.h:
* bindings/objc/PublicDOMInterfaces.h:
* bindings/scripts/CodeGeneratorJS.pm:
* bindings/scripts/CodeGeneratorObjC.pm:
* bindings/scripts/CodeGeneratorV8.pm:
* bindings/v8/DOMObjectsInclude.h:
* bindings/v8/DerivedSourcesAllInOne.cpp:
* bindings/v8/V8Binding.h:
(WebCore::toInt64):
* bindings/v8/V8Index.cpp:
* bindings/v8/V8Index.h:
* bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
(WebCore::V8XMLHttpRequest::sendCallback):
* html/File.cpp:
(WebCore::File::File):
* html/File.h:
(WebCore::File::create):
(WebCore::File::name):
(WebCore::File::fileName):
(WebCore::File::fileSize):
* html/File.idl:
* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::send):
* xml/XMLHttpRequest.h:

WebKit/mac:

* MigrateHeaders.make:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53574 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/7557695> REGRESSION(r53445-r53449): Many new memory leaks (33867)

Reviewed by NOBODY.

Revert r53447, since this caused leaks.

* WebCore.base.exp:
* platform/text/StringImpl.cpp:
(WebCore::StringImpl::operator new):
(WebCore::StringImpl::operator delete):
(WebCore::StringImpl::StringImpl):
(WebCore::StringImpl::~StringImpl):
(WebCore::StringImpl::create):
(WebCore::StringImpl::createWithTerminatingNullCharacter):
(WebCore::StringImpl::crossThreadString):
(WebCore::StringImpl::sharedBuffer):
* platform/text/StringImpl.h:
(WebCore::StringImpl::hasTerminatingNullCharacter):
(WebCore::StringImpl::inTable):
(WebCore::StringImpl::setInTable):
(WebCore::StringImpl::):
* storage/OriginUsageRecord.cpp:
(WebCore::OriginUsageRecord::addDatabase):
(WebCore::OriginUsageRecord::markDatabase):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53575 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2010-01-20  Nikolas Zimmermann  <nzimmermann@rim.com>

        Rubber-stamped by Eric Seidel.

        Add Leopard specific pixel test results where needed, most just show marginal 1px diffs, or even invisible changes,
        only the filter test changed, but it visually looks the same - must be a Cg difference to the Snow Leopard baseline.
        Now the pixel tests pass again with --tolerance 0 on my Leopard machine.

        * platform/mac-leopard/svg/W3C-SVG-1.1/pservers-grad-17-b-expected.checksum:
        * platform/mac-leopard/svg/W3C-SVG-1.1/pservers-grad-17-b-expected.png:
        * platform/mac-leopard/svg/css/circle-in-mask-with-shadow-expected.checksum: Added.
        * platform/mac-leopard/svg/css/circle-in-mask-with-shadow-expected.png: Added.
        * platform/mac-leopard/svg/css/composite-shadow-example-expected.checksum:
        * platform/mac-leopard/svg/css/composite-shadow-example-expected.png:
        * platform/mac-leopard/svg/css/composite-shadow-with-opacity-expected.checksum: Added.
        * platform/mac-leopard/svg/css/composite-shadow-with-opacity-expected.png: Added.
        * platform/mac-leopard/svg/css/css-box-min-width-expected.checksum: Added.
        * platform/mac-leopard/svg/css/css-box-min-width-expected.png: Added.
        * platform/mac-leopard/svg/css/mask-with-shadow-expected.checksum: Added.
        * platform/mac-leopard/svg/css/mask-with-shadow-expected.png: Added.
        * platform/mac-leopard/svg/custom/container-opacity-clip-viewBox-expected.checksum: Added.
        * platform/mac-leopard/svg/custom/container-opacity-clip-viewBox-expected.png: Added.
        * platform/mac-leopard/svg/custom/js-update-bounce-expected.checksum: Added.
        * platform/mac-leopard/svg/custom/js-update-bounce-expected.png: Added.
        * platform/mac-leopard/svg/custom/svg-fonts-in-html-expected.checksum: Added.
        * platform/mac-leopard/svg/custom/svg-fonts-in-html-expected.png: Added.
        * platform/mac-leopard/svg/filters: Added.
        * platform/mac-leopard/svg/filters/shadow-on-rect-with-filter-expected.checksum: Added.
        * platform/mac-leopard/svg/filters/shadow-on-rect-with-filter-expected.png: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53576 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2010-01-19  Oliver Hunt  <oliver@apple.com>

        Reviewed by Dan Bernstein.

        Insufficient repaint issues with html embedded in foreignObject
        https://bugs.webkit.org/show_bug.cgi?id=16318

        Partial fix for selection repaint in foreignObject, basically we
        just need to make sure foreignObject correctly applies the svg
        transform to the selection rect.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintSelection):
        * rendering/RenderForeignObject.cpp:
        (WebCore::RenderForeignObject::mapLocalToContainer):
        * rendering/RenderForeignObject.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53577 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2010-01-20  Eric Seidel  <eric@webkit.org>

        Reviewed by Maciej Stachowiak.

        REGRESSION(r53514?): fast/canvas/webgl/texImage2DImageDataTest.html fails on Leopard Release Bot
        https://bugs.webkit.org/show_bug.cgi?id=33893

        * platform/mac-leopard/Skipped: Skip the test for now.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53578 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/7215063> Use GCD instead of an extra thread for FastMalloc scavenging on platforms where it is supported

Reviewed by Oliver Hunt.

Abstract the background scavenging slightly so that an alternate implementation that uses GCD can be used on platforms
where it is supported.

* wtf/FastMalloc.cpp:
(WTF::TCMalloc_PageHeap::init):
(WTF::TCMalloc_PageHeap::initializeScavenger):
(WTF::TCMalloc_PageHeap::signalScavenger):
(WTF::TCMalloc_PageHeap::shouldContinueScavenging):
(WTF::TCMalloc_PageHeap::Delete):
(WTF::TCMalloc_PageHeap::periodicScavenge):
* wtf/Platform.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53579 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use the inline i386 assembly for x86_64 as well rather than falling back to using pthread mutexes.

Reviewed by Oliver Hunt.

* wtf/TCSpinLock.h:
(TCMalloc_SpinLock::Lock):
(TCMalloc_SpinLock::Unlock):
(TCMalloc_SlowLock):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53580 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/7086565> Crash in WebCore::PlugInView::dispatchNPEvent

Reviewed by Sam Weinig.

* plugins/PluginView.cpp:
(WebCore::PluginView::handleEvent):
Ref the PluginView to protect it from deletion while calling into the
plug-in.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53581 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix crash in geolocation when observers change during iteration.

Reviewed by Sam Weinig.

* page/GeolocationController.cpp:
(WebCore::GeolocationController::positionChanged): Copy observers to vector while iterating.
(WebCore::GeolocationController::errorOccurred): Copy observers to vector while iterating.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53582 268f45cc-cd09-0410-ab3c-d52691b4dbfc