Reviewed by Darin.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9880
          Memory leaks running DOM-Hanoi

        No change in behavior, thus no test included.

        * bridge/mac/FrameMac.mm:
        (WebCore::FrameMac::setStatusBarText): Use a local autorelease pool to release the temporaries - 
        the test runs non-stop, and the enclosing pool doesn't get a chance to be drained.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15405 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by Darin.

        <rdar://problem/4616920> REGRESSION: tabbing in mail moves focus
        to next control instead of inserting a tab space.

        Change editible WebView's tabKeyCyclesThroughElements to NO only
        if the setTabKeyCyclesThroughElements SPI wasn't called.

        * WebView/WebView.m:
        (-[WebView setEditable:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15406 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Rolling out this earlier change (r15378) now that it is fixed on AGL's end.
        Fixes <rdar://problem/4624865> Restore 64-bit OpenGL plug-in support once AGL is 64-bit

        <rdar://problem/4624858> AGL isn't 64-bit yet; temporarily remove it from WebKit 64-bit build

        * Plugins/WebBaseNetscapePluginView.h:
        * Plugins/WebBaseNetscapePluginView.m:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15407 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests:

        Reviewed by justin

        <rdar://problem/4622763> Deleting from beginning of paragraph following a table deletes rather than selects the table

        * editing/deleting/delete-block-table-expected.checksum: Added.
        * editing/deleting/delete-block-table-expected.png: Added.
        * editing/deleting/delete-block-table-expected.txt: Added.
        * editing/deleting/delete-block-table.html: Added.
        * editing/deleting/delete-hr-expected.checksum: Added.
        * editing/deleting/delete-hr-expected.png: Added.
        * editing/deleting/delete-hr-expected.txt: Added.
        * editing/deleting/delete-hr.html: Added.
        * editing/deleting/delete-to-select-table-expected.png:
        * editing/execCommand/insertHorizontalRule-expected.txt:
        * fast/lists/markers-in-selection-expected.txt:

WebCore:

        Reviewed by justin

        <rdar://problem/4622763> Deleting from beginning of paragraph following a table deletes rather than selects the table

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::initializeStartEnd): Added selection expansion for HRs.
        (WebCore::DeleteSelectionCommand::initializePositionData): Now uses enclosingBlockFlowOrTableElement
        instead of enclosingBlockFlowElement.
        (WebCore::DeleteSelectionCommand::removeNode): Use to identify that we need a placeholder
        when the start or end block is removed.
        (WebCore::DeleteSelectionCommand::handleGeneralDelete): Added check for canHaveChildrenForEditing
        to keep things like HRs from being given children.
        (WebCore::DeleteSelectionCommand::doApply): Switched to use member variable for needPlaceholder.
        * editing/DeleteSelectionCommand.h: Made needPlaceholder a member variable.
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::deleteKeyPressed): Fixed selection bug for tables and open typing commands.
        (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.
        * editing/htmlediting.cpp:
        (WebCore::editingIgnoresContent): Added check for HRs, since it's not considered a widget.
        * editing/visible_units.cpp:
        (WebCore::startOfParagraph): Fix for HRs and tables.
        (WebCore::endOfParagraph): Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15408 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests:

        Reviewed by Justin and Levi.

        <rdar://problem/4620743> REGRESSION: Option-Delete doesn't delete words during typing

        * editing/deleting/delete-by-word-001-expected.checksum: Added.
        * editing/deleting/delete-by-word-001-expected.png: Added.
        * editing/deleting/delete-by-word-001-expected.txt: Added.
        * editing/deleting/delete-by-word-001.html: Added.
        * editing/deleting/delete-by-word-002-expected.checksum: Added.
        * editing/deleting/delete-by-word-002-expected.png: Added.
        * editing/deleting/delete-by-word-002-expected.txt: Added.
        * editing/deleting/delete-by-word-002.html: Added.

WebCore:

        Reviewed by Justin and Levi.

        <rdar://problem/4620743> REGRESSION: Option-Delete doesn't delete words during typing

        * Tests:
        editing/deleting/delete-by-word-001.html
        editing/deleting/delete-by-word-002.html

        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::deleteKeyPressed):
        (WebCore::TypingCommand::forwardDeleteKeyPressed):
        (WebCore::TypingCommand::doApply):
        * editing/TypingCommand.h:
        Delete and forward delete to use specified granularity.
        Undo of delete and forward delete to select what had been deleted (non-char granularity only).
        
        * page/Frame.cpp:
        (WebCore::Frame::setSelection):
        Close typing and end style even if selection is not changing.
        * page/Frame.h:
        Remove unused setSelection parameter keepTypingStyle.

WebKit:

        Reviewed by Justin and Levi.

        <rdar://problem/4620743> REGRESSION: Option-Delete doesn't delete words during typing

        * Tests:
        editing/deleting/delete-by-word-001.html
        editing/deleting/delete-by-word-002.html

        * WebView/WebHTMLView.m:
        (-[WebHTMLView _deleteRange:killRing:prepend:smartDeleteOK:deletionAction:granularity:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15414 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by Dave Hyatt.

        <rdar://problem/4624203> -webkit-highlight should be behind images

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paint):
        * rendering/RenderListMarker.cpp:
        (WebCore::RenderListMarker::paint):
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::paint):
        Call custom highlighter before painting the image, marker, or widget.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15415 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by Darin.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9795
          REGRESSION: Crash in [WebHTMLView(WebPrivate) 
          _updateMouseoverWithEvent:]
          and http://bugzilla.opendarwin.org/show_bug.cgi?id=9850
          REGRESSION: Assertion failure (SHOULD NEVER BE REACHED) in -
          [WebHTMLView(WebPrivate) removeTrackingRect:]

        * WebView/WebHTMLView.m:
        (-[WebHTMLView _updateMouseoverWithEvent:]): Return immediately if 
        the view has already been closed.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15416 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JavaScriptCore:

        Reviewed by Geoffrey.  Patch by Mark Rowe.

        http://bugzilla.opendarwin.org/show_bug.cgi?id=9742
        Bug 9742: REGRESSION: WebKit hangs when loading <http://www.vtbook.com>

        * kjs/value.h:
        (KJS::JSValue::getUInt32): Only types tagged as numeric can be converted to UInt32.

LayoutTests:

        Reviewed by Geoffrey.  Patch by Mark Rowe.

        http://bugzilla.opendarwin.org/show_bug.cgi?id=9742
        Bug 9742: REGRESSION: WebKit hangs when loading <http://www.vtbook.com>

        This includes tests for indexing an array with immediate types, and for
        setting selectField.options.length to immediate types.

        * fast/dom/select-selectedIndex-expected.txt:
        * fast/dom/select-selectedIndex-multiple-expected.txt:
        * fast/dom/select-selectedIndex-multiple.html: Update to test setting length to true and false.
        * fast/dom/select-selectedIndex.html: Ditto.
        * fast/js/array-index-immediate-types-expected.txt: Added.
        * fast/js/array-index-immediate-types.html: Added.
        * fast/js/resources/array-index-immediate-types.js: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15417 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests:

        Reviewed by Hyatt.  Patch by Mitz.

        - test and updated results for http://bugzilla.opendarwin.org/show_bug.cgi?id=9670
          REGRESSION: RTL white-space:pre-wrap text is offset to the right

        * editing/deleting/delete-to-select-table-expected.txt:
        * editing/execCommand/boldSelection-expected.txt:
        * editing/execCommand/italicizeByCharacter-expected.txt:
        * editing/execCommand/modifyForeColorByCharacter-expected.txt:
        * editing/execCommand/print-expected.txt:
        * editing/execCommand/selectAll-expected.txt:
        * editing/execCommand/strikethroughSelection-expected.txt:
        * editing/inserting/insert-div-027-expected.txt:
        * editing/selection/after-line-wrap-expected.txt:
        * editing/selection/mixed-editability-1-expected.txt:
        * editing/selection/select-all-001-expected.txt:
        * editing/selection/select-all-002-expected.txt:
        * editing/selection/select-all-003-expected.txt:
        * fast/clip/outline-overflowClip-expected.txt:
        * fast/text/international/rtl-white-space-pre-wrap-expected.checksum: Added.
        * fast/text/international/rtl-white-space-pre-wrap-expected.png: Added.
        * fast/text/international/rtl-white-space-pre-wrap-expected.txt: Added.
        * fast/text/international/rtl-white-space-pre-wrap.html: Added.
        * fast/text/whitespace/pre-wrap-overflow-selection-expected.txt:
        * fast/text/whitespace/pre-wrap-spaces-after-newline-expected.txt:

WebCore:

        Reviewed by Hyatt.  Patch by Mitz.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9670
          REGRESSION: RTL white-space:pre-wrap text is offset to the right

        Test: fast/text/international/rtl-white-space-pre-wrap.html

        * rendering/RenderText.cpp:
        (WebCore::RenderText::caretRect): Fixed LTR case and added the RTL case
        of clipping the caret position to the text box when the caret is after
        the trailing space of an autowrapped line.
        * rendering/bidi.cpp:
        (WebCore::RenderBlock::computeHorizontalPositionsForLine): Changed to truncate-
        to-fit the logically last text box if it contains the trailing spaces of an
        autowrapped line. 
        (WebCore::RenderBlock::bidiReorderLine): Remember the logically last text run.
        In the case of autowrapped text with white space that overflows beyond the line,
        the last text run is the one containing the overflowing white space.
        (WebCore::RenderBlock::findNextLineBreak): Split overflowing white space on a
        line that autowraps only after white space into a separate text run.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15418 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by Maciej.

        - Fix for <rdar://problem/4604703> 
        REGRESSION (NativeTextField): Focus is not removed from password field after I ctrl-click into a different field

        Test:
        * manual-tests/password-ctrl-click-lose-focus.html: Added.

        * bridge/mac/FrameMac.mm: (WebCore::FrameMac::sendContextMenuEvent):
        If we're about to set a selection in the current view, make sure its the first responder.
        In this case, this will cause the password field to resign first responder at the right time.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15419 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JavaScriptCore:

        Reviewed by Maciej.

        Moved JavaScriptCore to be a public framework.

        * JavaScriptCore.xcodeproj/project.pbxproj:

WebKit:

        Reviewed by Maciej.

        Moved JavaScriptCore to be a public framework.

        * WebKit.xcodeproj/project.pbxproj:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15420 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests:

        Reviewed by Hyatt.
        
        Test cases for <rdar://problem/4567031> REGRESSION: Crash at WebCore::RenderBlock::createLineBoxes (seems to be a security hole?)
        
        I included the test case from the bug plus variants for other broken cases that
        were similar but needed separate fixes.

        * fast/table/cell-in-row-before-misnested-text-crash-expected.txt: Added.
        * fast/table/cell-in-row-before-misnested-text-crash.xhtml: Added.
        * fast/table/form-in-row-before-misnested-text-crash-expected.txt: Added.
        * fast/table/form-in-row-before-misnested-text-crash.xhtml: Added.
        * fast/table/form-in-table-before-misnested-text-crash-expected.txt: Added.
        * fast/table/form-in-table-before-misnested-text-crash.xhtml: Added.
        * fast/table/form-in-tbody-before-misnested-text-crash-expected.txt: Added.
        * fast/table/form-in-tbody-before-misnested-text-crash.xhtml: Added.
        * fast/table/row-in-tbody-before-misnested-text-crash-expected.txt: Added.
        * fast/table/row-in-tbody-before-misnested-text-crash.xhtml: Added.
        * fast/table/section-in-table-before-misnested-text-crash-expected.txt: Added.
        * fast/table/section-in-table-before-misnested-text-crash.xhtml: Added.

WebCore:

        Reviewed by Hyatt.

        - fixed <rdar://problem/4567031> REGRESSION: Crash at WebCore::RenderBlock::createLineBoxes (seems to be a security hole?)
        
        I also fixed all the similar crash / assertion failure cases I could think of.

        * dom/Node.cpp:
        (WebCore::Node::nextRendererWithSameParent): Helper function for some of the above.
        * dom/Node.h:
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addChild): Don't allow inserting forms when not in
        an HTML document, since we don't need that quirk and because parsing won't
        do certain render tree fixups. Also watch out for case when inserting before
        the renderer of a misnested child.
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::addChild): ditto
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::addChild): ditto



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15421 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by Maciej.

        Make JavaScriptCore a public framework. Adjusted the paths.

        * WebCore.xcodeproj/project.pbxproj:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15422 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by Adele.

        - Build fix: don't need BLOCK_OBJC_EXCEPTIONS because we already have
        one surrounding this function, and the nested one makes the compiler
        think our local variable is volatile (seems like a compiler bug to me).
        
        * bridge/mac/FrameMac.mm:
        (WebCore::FrameMac::sendContextMenuEvent):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15423 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebCore:

        Reviewed by Geoffrey.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9903
          Simplify logic in JSHTMLOptionsCollection::setLength() by using no-arg getNumber()

        No test cases since there is no change in functionality.

        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
        (WebCore::JSHTMLOptionsCollection::setLength):  Simplified logic by using the
        no-argument getNumber() method.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15424 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests:

        Reviewed by Darin.

        - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=9879
          REGRESSION: Repro crash when clicking to the side of an anonymous table
        - see also <rdar://problem/4628129> REGRESSION: Repro crash when clicking
          to the side of an anonymous table

        NOTE: Only the layout test part of this patch was landed since an alternate
        fix was committed in r15401:  <rdar://problem/4509393> selected DOM range
        starts with <object>, 0 offset but selection should include the <object>

        * fast/table/click-near-anonymous-table-expected.checksum: Added.
        * fast/table/click-near-anonymous-table-expected.png: Added.
        * fast/table/click-near-anonymous-table-expected.txt: Added.
        * fast/table/click-near-anonymous-table.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15425 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests:

        Reviewed by Darin.

        - test for http://bugzilla.opendarwin.org/show_bug.cgi?id=9905
          REGRESSION (r15404-r15415): Repro crash when pressing delete in an empty editable div

        * editing/deleting/delete-at-start-or-end-expected.checksum: Added.
        * editing/deleting/delete-at-start-or-end-expected.png: Added.
        * editing/deleting/delete-at-start-or-end-expected.txt: Added.
        * editing/deleting/delete-at-start-or-end.html: Added.

WebCore:

        Reviewed by Darin.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9905
          REGRESSION (r15404-r15415): Repro crash when pressing delete in an empty editable div

        Test: editing/deleting/delete-at-start-or-end.html

        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::deleteKeyPressed): Added null check.
        (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15426 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebCore:

        Reviewed by Darin.  Patch by Mitz.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9907
          REGRESSION (r15418): editing/pasteboard/paste-table-001 fails in pixel  mode

        * rendering/RenderText.cpp:
        (WebCore::RenderText::caretRect): Fixed the calculation of the max/min allowed caret
        position.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15427 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by Beth.
        
        Moved JSCheckScriptSyntax, JSEvaluateScript, and JSGarbageCollect into
        JSBase.h/.cpp. They don't belong in the value-specific or context-specific 
        files because they're not part of the value or context implementations.

        * API/JSBase.h:
        * API/JSContextRef.cpp:
        (JSContextGetGlobalObject):
        * API/JSContextRef.h:
        * API/JSValueRef.cpp:
        (JSValueUnprotect):
        * API/JSValueRef.h:
        * JavaScriptCore.xcodeproj/project.pbxproj:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15428 268f45cc-cd09-0410-ab3c-d52691b4dbfc
        Reviewed by Darin.

        - Fix for <rdar://problem/4614054> REGRESSION: Safari submits forms when the Return key is hit to complete inline inputs

        * page/Frame.h: (WebCore::Frame::inputManagerHasMarkedText): Added.
        * bridge/mac/FrameMac.h: ditto.
        * bridge/mac/FrameMac.mm: (WebCore::FrameMac::inputManagerHasMarkedText): Added. Asks the input manager if there's marked text.
        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::defaultEventHandler): For text fields, don't submit the form on Enter
        if the input manager says there's marked text.  I added this code for all text field paths.  For widgets, WebCoreTextField.mm
        has code to deal with this case.  But as we convert search, password, and isindex, they will need to do this check too.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@15429 268f45cc-cd09-0410-ab3c-d52691b4dbfc