WebCore:

2008-09-19  Beth Dakin  <bdakin@apple.com>

        Reviewed by Dave Hyatt.

        Fix for <rdar://problem/6231308> crash in AutoTableLayout

        The code assumes later on that a TableSection's grid's row vector 
        will never be empty. So make 1 the minimum number of columns.

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::ensureRows):

LayoutTests:

2008-09-19  Beth Dakin  <bdakin@apple.com>

        Reviewed by Dave Hyatt.

        Test for <rdar://problem/6231308> crash in AutoTableLayout

        * fast/table/empty-row-crash.html: Added.
        * platform/mac/fast/table/empty-row-crash-expected.checksum: Added.
        * platform/mac/fast/table/empty-row-crash-expected.png: Added.
        * platform/mac/fast/table/empty-row-crash-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36683 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  David Hyatt  <hyatt@apple.com>

        Add new scrollbar parts to be able to represent back and forward buttons
        at either end of the scrollbar.  The current scrollbar still just draws
        a single button at either end, but the parts now exist.

        Reviewed by Sam Weinig

        * platform/ScrollTypes.h:
        (WebCore::):
        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::autoscrollTimerFired):
        (WebCore::Scrollbar::pressedPartScrollDirection):
        (WebCore::Scrollbar::pressedPartScrollGranularity):
        (WebCore::Scrollbar::handleMouseMoveEvent):
        * platform/ScrollbarTheme.h:
        (WebCore::ScrollbarTheme::buttonsPlacement):
        (WebCore::ScrollbarTheme::invalidateParts):
        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::ScrollbarThemeComposite::paint):
        (WebCore::ScrollbarThemeComposite::hitTest):
        (WebCore::ScrollbarThemeComposite::invalidatePart):
        * platform/ScrollbarThemeComposite.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  Matt Lilek  <webkit@mattlilek.com>

        Reviewed by Tim Hatcher.

        Bug 17772: Inspector should support point-and-click to select a node to inspect
        https://bugs.webkit.org/show_bug.cgi?id=17772
        <rdar://problem/5792395>

        * English.lproj/localizedStrings.js:
        * page/Chrome.cpp:
        (WebCore::Chrome::mouseDidMoveOverElement):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):
        * page/InspectorController.cpp:
        (WebCore::toggleNodeSearch):
        (WebCore::searchingForNode):
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::toggleSearchForNodeInPage):
        (WebCore::InspectorController::mouseDidMoveOverElement):
        (WebCore::InspectorController::handleMousePressOnNode):
        (WebCore::InspectorController::windowScriptObjectAvailable):
        * page/InspectorController.h:
        (WebCore::InspectorController::searchingForNodeInPage):
        * page/inspector/ElementsPanel.js:
        * page/inspector/Images/nodeSearchButtons.png: Added.
        * page/inspector/inspector.css:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36685 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  David Hyatt  <hyatt@apple.com>

        Add support for painting/hit testing of four possible scrollbar buttons.
        The Windows themes simply ignore the two parts that they will never
        show.  The Mac theme also ignores the other two buttons for now.

        The cross-platform base for all three themes, ScrollbarThemeComposite,
        has all the proper support though.

        Reviewed by Sam Weinig

        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::ScrollbarThemeComposite::hitTest):
        (WebCore::ScrollbarThemeComposite::invalidatePart):
        * platform/ScrollbarThemeComposite.h:
        * platform/mac/ScrollbarThemeMac.h:
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::backButtonRect):
        (WebCore::ScrollbarThemeMac::forwardButtonRect):
        (WebCore::ScrollbarThemeMac::paintButton):
        * platform/win/ScrollbarThemeSafari.cpp:
        (WebCore::ScrollbarThemeSafari::backButtonRect):
        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
        (WebCore::ScrollbarThemeSafari::paintButton):
        * platform/win/ScrollbarThemeSafari.h:
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::backButtonRect):
        (WebCore::ScrollbarThemeWin::forwardButtonRect):
        (WebCore::ScrollbarThemeWin::paintButton):
        * platform/win/ScrollbarThemeWin.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36686 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  Chris Marrin  <cmarrin@apple.com>

        Reviewed by Dave Hyatt.

        Transition starts running when it shouldn't
        https://bugs.webkit.org/show_bug.cgi?id=20892

        When there is a transition and an animation on the
        same element, make sure the animation wins.

        The fix is to save the unanimated style when an animation is started.
        Then, when starting a transition, check to see if there is a current
        animation on the same prop. If so, use the unanimated style as the
        fromStyle rather than the current style.

        Test: animations/transition-and-animation-1.html

        * page/animation/CompositeAnimation.cpp:
        (WebCore::CompositeAnimation::updateTransitions):
        (WebCore::CompositeAnimation::updateKeyframeAnimations):
        (WebCore::CompositeAnimation::animate):
        (WebCore::CompositeAnimation::getAnimationForProperty):
        * page/animation/CompositeAnimation.h:
        * page/animation/ImplicitAnimation.cpp:
        (WebCore::ImplicitAnimation::reset):
        * page/animation/ImplicitAnimation.h:
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::hasAnimationForProperty):
        * page/animation/KeyframeAnimation.h:
        (WebCore::KeyframeAnimation::KeyframeAnimation):
        (WebCore::KeyframeAnimation::unanimatedStyle):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36687 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix build bustage.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36688 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix build bustage.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36689 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  Darin Adler  <darin@apple.com>

        - try to fix Qt build

        * bridge/qt/qt_instance.cpp:
        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp): Add structure argument.
        (JSC::Bindings::QtInstance::getRuntimeObject): Ditto.
        * bridge/runtime_object.cpp:
        (JSC::RuntimeObjectImp::RuntimeObjectImp): Add an overload just for Qt.
        * bridge/runtime_object.h: Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36690 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix build bustage on Win.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36691 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  Alice Liu  <alice.liu@apple.com>

        Fix crash when submitting form at bugreport.apple.com rdar://6234126

        Reviewed by Mark Rowe.

        * COMPropertyBag.h:
        (::GetPropertyInfo):
        correct mis-use of comma operator



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36692 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix a mismatched new[]/delete in JSObject::allocatePropertyStorage


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36693 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  Sam Weinig  <sam@webkit.org>

        Reviewed by Darin Adler.

        Patch for https://bugs.webkit.org/show_bug.cgi?id=20928
        Speed up JS property enumeration by caching entire PropertyNameArray

        1.3% speedup on Sunspider, 30% on string-fasta.

        * JavaScriptCore.exp:
        * VM/JSPropertyNameIterator.cpp:
        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
        (JSC::JSPropertyNameIterator::invalidate):
        * VM/JSPropertyNameIterator.h:
        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
        (JSC::JSPropertyNameIterator::create):
        * kjs/JSObject.cpp:
        (JSC::JSObject::getPropertyNames):
        * kjs/PropertyMap.cpp:
        (JSC::PropertyMap::getEnumerablePropertyNames):
        * kjs/PropertyMap.h:
        * kjs/PropertyNameArray.cpp:
        (JSC::PropertyNameArray::add):
        * kjs/PropertyNameArray.h:
        (JSC::PropertyNameArrayData::create):
        (JSC::PropertyNameArrayData::propertyNameVector):
        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
        (JSC::PropertyNameArrayData::cachedPrototypeChain):
        (JSC::PropertyNameArrayData::begin):
        (JSC::PropertyNameArrayData::end):
        (JSC::PropertyNameArrayData::PropertyNameArrayData):
        (JSC::PropertyNameArray::PropertyNameArray):
        (JSC::PropertyNameArray::addKnownUnique):
        (JSC::PropertyNameArray::size):
        (JSC::PropertyNameArray::operator[]):
        (JSC::PropertyNameArray::begin):
        (JSC::PropertyNameArray::end):
        (JSC::PropertyNameArray::setData):
        (JSC::PropertyNameArray::data):
        (JSC::PropertyNameArray::releaseData):
        * kjs/ScopeChain.cpp:
        (JSC::ScopeChainNode::print):
        * kjs/StructureID.cpp:
        (JSC::structureIDChainsAreEqual):
        (JSC::StructureID::getEnumerablePropertyNames):
        (JSC::StructureID::clearEnumerationCache):
        (JSC::StructureID::createCachedPrototypeChain):
        * kjs/StructureID.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36694 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Improve peformance of local variable initialisation.

Reviewed by Maciej Stachowiak

Pull local and constant initialisation out of slideRegisterWindowForCall
and into its own opcode.  This allows the JIT to generate the initialisation
code for a function directly into the instruction stream and so avoids a few
branches on function entry.

Results a 1% progression in SunSpider, particularly in a number of the bitop
tests where the called functions are very fast.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36695 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  Sam Weinig  <sam@webkit.org>

        Roll out r36694.

        * JavaScriptCore.exp:
        * VM/JSPropertyNameIterator.cpp:
        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
        (JSC::JSPropertyNameIterator::invalidate):
        * VM/JSPropertyNameIterator.h:
        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
        (JSC::JSPropertyNameIterator::create):
        * kjs/JSObject.cpp:
        (JSC::JSObject::getPropertyNames):
        * kjs/PropertyMap.cpp:
        (JSC::PropertyMap::getEnumerablePropertyNames):
        * kjs/PropertyMap.h:
        * kjs/PropertyNameArray.cpp:
        (JSC::PropertyNameArray::add):
        * kjs/PropertyNameArray.h:
        (JSC::PropertyNameArray::PropertyNameArray):
        (JSC::PropertyNameArray::addKnownUnique):
        (JSC::PropertyNameArray::begin):
        (JSC::PropertyNameArray::end):
        (JSC::PropertyNameArray::size):
        (JSC::PropertyNameArray::operator[]):
        (JSC::PropertyNameArray::releaseIdentifiers):
        * kjs/StructureID.cpp:
        (JSC::StructureID::getEnumerablePropertyNames):
        * kjs/StructureID.h:
        (JSC::StructureID::clearEnumerationCache):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36696 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  David Hyatt  <hyatt@apple.com>

        Add support for hit testing of all five possible scrollbar button placements. 

        Reviewed by Sam Weinig

        * platform/ScrollbarThemeComposite.cpp:
        (WebCore::ScrollbarThemeComposite::paint):
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::):
        (WebCore::ScrollbarThemeMac::backButtonRect):
        (WebCore::ScrollbarThemeMac::forwardButtonRect):
        (WebCore::ScrollbarThemeMac::trackRect):
        (WebCore::ScrollbarThemeMac::paintButton):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36697 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by John Sullivan.

        - fix https://bugs.webkit.org/show_bug.cgi?id=20951
          Typo in Position::getInlineBoxAndOffset()
          and add an assertion

        Without the fix, the newly-added assertion fails in platform/mac/editing/input/caret-primary-bidi.html

        * dom/Position.cpp:
        (WebCore::Position::getInlineBoxAndOffset):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::positionForOffset):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36698 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed by Antti & Eric.

Fixes: https://bugs.webkit.org/show_bug.cgi?id=20372

Finish HTMLScriptElement / SVGScriptElement unification.
SVG <script> support is complete now, full SVGLoad event
respecting the influence of the externalResourcesRequired attribute
as well as SVGError event support. All other features shared with HTML.

Tests: fast/dom/HTMLScriptElement/script-reexecution.html
       svg/dom/SVGScriptElement/script-change-externalResourcesRequired-while-loading.svg
       svg/dom/SVGScriptElement/script-load-and-error-events.svg
       svg/dom/SVGScriptElement/script-reexecution.svg
       svg/dom/SVGScriptElement/script-set-href.svg


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36699 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-20  Alp Toker  <alp@nuanti.com>

        Reviewed by Timothy Hatcher.

        https://bugs.webkit.org/show_bug.cgi?id=20913
        Avoid redudant includes

        Document.h is included excessively such that a modification to Document.h (or
        any of the header it includes itself) triggers a rebuild of many files
        including the whole of SVG and a lot of the JS bindings.

        Some of these includes can be avoided by only including Document.h where
        necessary.

        * bindings/js/JSAttrCustom.cpp:
        * bindings/js/JSElementCustom.cpp:
        * bindings/js/JSEventTargetBase.cpp:
        * bindings/js/JSEventTargetBase.h:
        * bindings/js/JSEventTargetNode.cpp:
        * bindings/js/JSHTMLFrameElementCustom.cpp:
        * bindings/js/JSHTMLIFrameElementCustom.cpp:
        * bindings/scripts/CodeGeneratorJS.pm:
        * css/CSSCursorImageValue.cpp:
        * css/SVGCSSStyleSelector.cpp:
        * dom/make_names.pl:
        * svg/SVGAnimateElement.h:
        * svg/SVGAnimatedProperty.h:
        (WebCore::::baseValue):
        (WebCore::::setBaseValue):
        (WebCore::::startAnimation):
        (WebCore::::stopAnimation):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::accessDocumentSVGExtensions):
        * svg/SVGElement.h:
        * svg/SVGElementInstance.cpp:
        * svg/SVGFitToViewBox.cpp:
        * svg/SVGFontElement.cpp:
        * svg/SVGFontFaceElement.cpp:
        * svg/SVGLinearGradientElement.cpp:
        * svg/SVGMPathElement.cpp:
        * svg/SVGViewSpec.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36700 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  Sam Weinig  <sam@webkit.org>

        Roll r36694 back in.  It did not cause the crash.

        * JavaScriptCore.exp:
        * VM/JSPropertyNameIterator.cpp:
        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
        (JSC::JSPropertyNameIterator::invalidate):
        * VM/JSPropertyNameIterator.h:
        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
        (JSC::JSPropertyNameIterator::create):
        * kjs/JSObject.cpp:
        (JSC::JSObject::getPropertyNames):
        * kjs/PropertyMap.cpp:
        (JSC::PropertyMap::getEnumerablePropertyNames):
        * kjs/PropertyMap.h:
        * kjs/PropertyNameArray.cpp:
        (JSC::PropertyNameArray::add):
        * kjs/PropertyNameArray.h:
        (JSC::PropertyNameArrayData::create):
        (JSC::PropertyNameArrayData::propertyNameVector):
        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
        (JSC::PropertyNameArrayData::cachedPrototypeChain):
        (JSC::PropertyNameArrayData::begin):
        (JSC::PropertyNameArrayData::end):
        (JSC::PropertyNameArrayData::PropertyNameArrayData):
        (JSC::PropertyNameArray::PropertyNameArray):
        (JSC::PropertyNameArray::addKnownUnique):
        (JSC::PropertyNameArray::size):
        (JSC::PropertyNameArray::operator[]):
        (JSC::PropertyNameArray::begin):
        (JSC::PropertyNameArray::end):
        (JSC::PropertyNameArray::setData):
        (JSC::PropertyNameArray::data):
        (JSC::PropertyNameArray::releaseData):
        * kjs/StructureID.cpp:
        (JSC::structureIDChainsAreEqual):
        (JSC::StructureID::getEnumerablePropertyNames):
        (JSC::StructureID::clearEnumerationCache):
        (JSC::StructureID::createCachedPrototypeChain):
        * kjs/StructureID.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36701 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2008-09-19  David Hyatt  <hyatt@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=20954

        Roll out r36628 since it has caused horrible regressions with
        animated GIF CPU usage.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::cacheFrame):
        (WebCore::BitmapImage::startAnimation):
        * platform/graphics/BitmapImage.h:
        (WebCore::FrameData::FrameData):
        * platform/graphics/cairo/ImageCairo.cpp:
        (WebCore::FrameData::clear):
        * platform/graphics/cg/ImageCG.cpp:
        (WebCore::FrameData::clear):
        * platform/graphics/qt/ImageQt.cpp:
        (WebCore::FrameData::clear):
        * platform/graphics/wx/ImageWx.cpp:
        (WebCore::FrameData::clear):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36702 268f45cc-cd09-0410-ab3c-d52691b4dbfc