Merge r166480 - [GTK] [TextureMapper] Weird brightness with some videos with acceletared compositing
https://bugs.webkit.org/show_bug.cgi?id=130665

Reviewed by Martin Robinson.

When we uploaded a video texture to the mapper we were not
considering that some videos could be decoded into a format
without alpha component. Now we check if the video has alpha and
if it does not, we remove the alpha flag when retrieving the
texture from the pool. For this, the method to get the texture
from the pool was modified to receive the flags, that is mapped to
have alpha by default in order not to break any other existing
code.

Though we have a problem with AC in WTR and that makes it
currently not testable, no new tests are needed because once this
is fixed the current test set suffices to detect a possible
regression in this.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::updateTexture): Check
the video format and decide if the texture shall be pulled with
alpha support or not.
* platform/graphics/texmap/TextureMapper.cpp:
(WebCore::TextureMapper::acquireTextureFromPool): Use the flags
when resetting the texture.
* platform/graphics/texmap/TextureMapper.h:
(WebCore::BitmapTexture::Flag::None): Added with 0x00.
(WebCore::TextureMapper::acquireTextureFromPool): Added flag
parameter to set up the texture with the default for including
alpha channel.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167986 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166574 - [GTK] Don't copy the ResourceResponse object in webkitWebViewDecidePolicy
https://bugs.webkit.org/show_bug.cgi?id=131015

Reviewed by Carlos Garcia Campos.

* UIProcess/API/gtk/WebKitWebView.cpp:
(webkitWebViewDecidePolicy): Avoid copying the ResourceResponce object returned by webkitURIResponseGetResourceResponse.
That function already returns a reference, so the return value should be stored accordingly.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167987 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167883 - [GTK] Crash in debug build with removing windowed plugin child widgets from the view
https://bugs.webkit.org/show_bug.cgi?id=132252

Reviewed by Philippe Normand.

It crashes due to an assert in HashTable that checks the iterators
validity. The problem is that we are iterating the children map
and the callback called on every iteration might modify the map,
making the iterators invalid. This happens when the WebView is
destroyed, GtkContainer calls gtk_container_foreach() with
gtk_widget_destroy as callback. When a widget inside a container
is destroyed, it's removed from the container, and in our case,
the child widget is removed from the map. This fixes several
crashes when running layout tests in debug bot.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseContainerForall): Use copyKeysToVector() instead
of using a range iterator for the map keys and check in every
iteration that the child widget from the keys vector is still
present in the map before calling the callback.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167989 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed. [GTK] Plugin process crashes when loading totem plugin
https://bugs.webkit.org/show_bug.cgi?id=131357

Make Netscape browser functions static to avoid conflicts with
plugins defining those functions as well.

* GNUmakefile.list.am: Do not build npapi.cpp.
* plugins/PluginPackage.cpp:
(WebCore::pluginViewForInstance):
(WebCore::NPN_MemAlloc):
(WebCore::NPN_MemFree):
(WebCore::NPN_MemFlush):
(WebCore::NPN_ReloadPlugins):
(WebCore::NPN_RequestRead):
(WebCore::NPN_GetURLNotify):
(WebCore::NPN_GetURL):
(WebCore::NPN_PostURLNotify):
(WebCore::NPN_PostURL):
(WebCore::NPN_NewStream):
(WebCore::NPN_Write):
(WebCore::NPN_DestroyStream):
(WebCore::NPN_UserAgent):
(WebCore::NPN_Status):
(WebCore::NPN_InvalidateRect):
(WebCore::NPN_InvalidateRegion):
(WebCore::NPN_ForceRedraw):
(WebCore::NPN_GetValue):
(WebCore::NPN_SetValue):
(WebCore::NPN_GetJavaEnv):
(WebCore::NPN_GetJavaPeer):
(WebCore::NPN_PushPopupsEnabledState):
(WebCore::NPN_PopPopupsEnabledState):
(WebCore::NPN_PluginThreadAsyncCall):
(WebCore::NPN_GetValueForURL):
(WebCore::NPN_SetValueForURL):
(WebCore::NPN_GetAuthenticationInfo):
(WebCore::NPN_PopUpContextMenu):
* plugins/PluginPackage.h:
(WebCore::PluginPackage::browserFuncs): Add accessor to browser
function pointers.
* plugins/PluginView.cpp:
(WebCore::PluginView::stop): Use browser function pointers instead
of NPN wrappers that are now private.
(WebCore::PluginView::getValueForURL): Ditto.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167990 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167116 - [GTK][WK2] Move Vector objects into WebEditorClient::executePendingEditorCommands() invocations
https://bugs.webkit.org/show_bug.cgi?id=131454

Reviewed by Carlos Garcia Campos.

* WebProcess/WebCoreSupport/WebEditorClient.h:
* WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:
(WebKit::WebEditorClient::executePendingEditorCommands): Take a const reference of the Vector
object to avoid unnecessary copies. Also deploy two range-based for loops and efficiently move
the Editor::Command objects into the other Vector.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167991 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r167128 - wk2-gtk does not display anything
https://bugs.webkit.org/show_bug.cgi?id=125558

Reviewed by Martin Robinson.

Remove fcntl call to set access mode flags on the duplicated files
descriptor. Those flags are ignored in Linux and make fcntl to
fail in FreeBSD. We should handle the case where the passed
protection is ReadOnly.
Thanks to Raphael Kubo da Costa who proposed the solution.

* Platform/unix/SharedMemoryUnix.cpp:
(WebKit::SharedMemory::createHandle):
(WebKit::accessModeFile): Deleted.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167992 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164170 - ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
https://bugs.webkit.org/show_bug.cgi?id=128810

Patch by Renata Hodovan <rhodovan.u-szeged@partner.samsung.com> on 2014-02-15
Reviewed by Ryosuke Niwa.

Source/WebCore:

Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
doesn't contain |start|.

Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
|outerNode| only if |outerNode| contains |start| position.

Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&view=revision by yosin@chromium.org.

Test: editing/execCommand/indent-with-uneditable-crash.html

* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):

LayoutTests:

* editing/execCommand/indent-with-uneditable-crash-expected.txt: Added.
* editing/execCommand/indent-with-uneditable-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167994 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164204 - Ensure that removing an iframe from the DOM tree disconnects its Frame.
<https://webkit.org/b/128889>
<rdar://problem/15671221>

Merged from Blink (patch by Adam Klein):
https://src.chromium.org/viewvc/blink?revision=156174&view=revision

Source/WebCore:

SubframeLoadingDisabler wasn't catching the case when an <iframe> was,
in its unload handler, removed and re-added to the same parent.
Fix this by using a count of SubframeLoadingDisablers that are on the
stack for a given root, rather than a simple boolean.

Test: fast/frames/reattach-in-unload.html

* html/HTMLFrameOwnerElement.h:
(WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):

LayoutTests:

* fast/frames/reattach-in-unload-expected.txt: Added.
* fast/frames/reattach-in-unload.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167995 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164367 - Do not dispatch change event twice in single step action
https://bugs.webkit.org/show_bug.cgi?id=116936
<rdar://problem/16086828>

Reviewed by Ryosuke Niwa.

Merged from Blink (patch by Kent Tamura):
https://src.chromium.org/viewvc/blink?view=rev&revision=151175

Source/WebCore:

Test: fast/forms/number/number-type-update-by-change-event.html

* html/InputType.cpp:
(WebCore::InputType::stepUpFromRenderer):

LayoutTests:

* fast/forms/number/number-type-update-by-change-event-expected.txt: Added.
* fast/forms/number/number-type-update-by-change-event.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167996 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164408 - Crash in WTF::StringBuilder::append()

https://bugs.webkit.org/show_bug.cgi?id=125817
<rdar://problem/15671883>

Reviewed by Oliver Hunt.

* wtf/text/StringBuilder.cpp:
(WTF::expandedCapacity):
Ensure that we return a new capacity of at least 'requiredLength' in
the case where requiredLength is large. Also, use unsigned rather than
size_t for the parameters and the return value, as callers pass
unsigned arguments and treat the result as an unsigned int.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167997 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164876 - Properly clear m_logicallyLastRun to remove use-after-free possibility
https://bugs.webkit.org/show_bug.cgi?id=129489

Reviewed by David Hyatt.

A use-after-free issue was caught in Blink because m_logicallyLastRun
is not cleared when the item it points to is deleted. Clearing it
turns the use-after-free into a segfault, and prevents any future
use-after-frees from happening.

* platform/text/BidiRunList.h:
(WebCore::BidiRunList<Run>::deleteRuns):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167998 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r164933 - Ensure keySplines is valid in SMIL animations
<http://webkit.org/b/129547>
<rdar://problem/15676128>

Reviewed by Darin Adler.

Merged from Blink (patch by Philip Rogers):
https://src.chromium.org/viewvc/blink?revision=156452&view=revision
http://crbug.com/276111

    This patch fixes a crash in SMIL animations when keySplines are not
    specified. The SMIL spec is clear on this:
    http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncCalcMode
    "If there are any errors in the keyTimes specification (bad values,
    too many or too few values), the animation will have no effect."

    This patch simply checks that keyTimes is not empty. Previously,
    splinesCount was set to be m_keySplines.size() + 1 in
    SVGAnimationElement.cpp; this patch changes splinesCount to be equal
    to m_keySplines.size() to make the logic easier to follow and to
    match other checks in SVGAnimationElement::startedActiveInterval.

Source/WebCore:

Test: svg/animations/animate-keysplines-crash.html

* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::startedActiveInterval):

LayoutTests:

* svg/animations/animate-keysplines-crash-expected.txt: Added.
* svg/animations/animate-keysplines-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@167999 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165138 - Fix crash in CompositeEditCommand::cloneParagraphUnderNewElement()
<http://webkit.org/b/129751>
<rdar://problem/16237965>

Reviewed by Jon Honeycutt.

Merged from Blink (patch by Yuta Kitamura):
https://src.chromium.org/viewvc/blink?revision=168160&view=revision
http://crbug.com/345005

    The root cause is CompositeEditCommand::moveParagraphWithClones() passing
    two positions |start| and |end| which do not follow the document order,
    i.e. in some situations |start| is located after |end| because of
    the difference in affinity.

    This patch fixes this crash by normalizing |end| to |start| in such situations.
    It also adds an ASSERT that checks the relationship between |start| and |end|.

Source/WebCore:

Test: editing/execCommand/format-block-crash.html

* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
(WebCore::CompositeEditCommand::moveParagraphWithClones):
* editing/CompositeEditCommand.h:

LayoutTests:

* editing/execCommand/format-block-crash-expected.txt: Added.
* editing/execCommand/format-block-crash.html: Added.
* editing/execCommand/resources/format-block-crash-iframe.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@168000 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165145 - ASSERT(newestManifest) fails in WebCore::ApplicationCacheGroup::didFinishLoadingManifest()
https://bugs.webkit.org/show_bug.cgi?id=129753
<rdar://problem/12069835>

Reviewed by Alexey Proskuryakov.

Fixes an issue where an assertion failure would occur when visiting a web site whose on-disk
app cache doesn't contain a manifest resource.

For some reason an app cache for a web site may be partially written to disk. In particular, the
app cache may only contain a CacheGroups entry. That is, the manifest resource and origin records
may not be persisted to disk. From looking over the code, we're unclear how such a situation can occur
and hence have been unable to create such an app cache. We were able to reproduce this issue using
an app cache database file that was provided by a person that was affected by this issue.

No test included because it's not straightforward to write a test for this change.

* loader/appcache/ApplicationCacheGroup.cpp:
(WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Assert that m_cacheBeingUpdated->manifestResource()
is non-null. Currently we only document this assumption in a code comment. Also separated a single assertion
expression into two assertion expressions to make it straightforward to identify the failing sub-expression
on failure.
* loader/appcache/ApplicationCacheStorage.cpp:
(WebCore::ApplicationCacheStorage::store): Modified to call ApplicationCacheStorage::deleteCacheGroupRecord()
to remove a cache group and associated cache records (if applicable) before inserting a cache group entry.
This replacement approach will ultimately repair incomplete app cache data for people affected by this bug.
(WebCore::ApplicationCacheStorage::loadCache): Log an error and return nullptr if the cache we loaded doesn't
have a manifest resource.
(WebCore::ApplicationCacheStorage::deleteCacheGroupRecord): Added.
(WebCore::ApplicationCacheStorage::deleteCacheGroup): Extracted deletion logic for cache group record into
ApplicationCacheStorage::deleteCacheGroupRecord().
* loader/appcache/ApplicationCacheStorage.h:

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@168001 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165339 - SerializedScriptValue may move Identifiers between worlds
https://bugs.webkit.org/show_bug.cgi?id=129979

Reviewed by Andreas Kling.

Source/WebCore:

Test: fast/workers/worker-copy-shared-blob-url.html

Don't use Strings to store blob URLs as String's may be Identifiers
and they can only exist in one world/thread at a time.

* Modules/indexeddb/IDBObjectStore.cpp:
(WebCore::IDBObjectStore::put):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::deserializeString):
(WebCore::SerializedScriptValue::addBlobURL):
(WebCore::SerializedScriptValue::SerializedScriptValue):
* bindings/js/SerializedScriptValue.h:

LayoutTests:

Add test cases

* fast/workers/resources/worker-copy-shared-blob-url-worker.js: Added.
(count.0.onmessage):
* fast/workers/worker-copy-shared-blob-url-expected.txt: Added.
* fast/workers/worker-copy-shared-blob-url.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@168002 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165821 - Mutating rules returned by getMatchedCSSRules can result in crash
https://bugs.webkit.org/show_bug.cgi?id=130209

Source/WebCore:

Reviewed by Andreas Kling.

The non-standard getMatchedCSSRules API returns CSSStyleRule objects that don't
have parent stylesheet pointer (as we don't know which sheet the rule originated from).
Mutating the rule via such wrapper can lead to crashes later as we fail to invalidate
the underlying stylesheet.

Fix by disallowing mutation of style rules that don't have parent sheet pointer. CSSStyleRule
has two mutable properties selectorText and style. The latter gives back CSSStyleDeclaration.
This patch disallows mutations in both cases for CSSStyleRules that don't have parent stylesheet
pointer.

While it is technically possible to have CSSRules that are legitimately disconnected
from stylesheet (by removing rule from sheet while holding a reference to it) it never
makes sense to mutate such rule as there is no way to do anything with it afterwards.

Tests: fast/css/getMatchedCSSProperties-rule-mutation.html
       fast/css/getMatchedCSSRules-crash.html

* css/CSSStyleRule.cpp:
(WebCore::CSSStyleRule::setSelectorText):

    Bail out if parent stylesheet is null.

* css/PropertySetCSSStyleDeclaration.cpp:
(WebCore::PropertySetCSSStyleDeclaration::setCssText):
(WebCore::PropertySetCSSStyleDeclaration::setProperty):
(WebCore::PropertySetCSSStyleDeclaration::removeProperty):
(WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):

    Allow StyleRuleCSSStyleDeclaration subclass cancel the mutation via
    boolean return value from willMutate.

(WebCore::StyleRuleCSSStyleDeclaration::willMutate):

    Disallow mutation if the owning CSSStyleRule is null or has null stylesheet.

(WebCore::StyleRuleCSSStyleDeclaration::didMutate):

    We never get here with null rule or stylesheet anymore.

* css/PropertySetCSSStyleDeclaration.h:
(WebCore::PropertySetCSSStyleDeclaration::willMutate):

LayoutTests:

Reviewed by Andreas Kling.

* fast/css/getMatchedCSSProperties-rule-mutation-expected.txt: Added.
* fast/css/getMatchedCSSProperties-rule-mutation.html: Added.
* fast/css/getMatchedCSSRules-crash-expected.txt: Added.
* fast/css/getMatchedCSSRules-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@168003 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165902 - Update type of local vars to match the type of String length.
<https://webkit.org/b/130077>

Reviewed by Geoffrey Garen.

* runtime/JSStringJoiner.cpp:
(JSC::JSStringJoiner::join):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@168004 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r165921 - Crash with long selector list
https://bugs.webkit.org/show_bug.cgi?id=123006

Reviewed by Andreas Kling.

Source/WebCore:

Test: fast/css/long-selector-list-crash.html

* css/CSSSelectorList.cpp:
(WebCore::CSSSelectorList::CSSSelectorList):
(WebCore::CSSSelectorList::adoptSelectorVector):
(WebCore::CSSSelectorList::operator=):
* css/StyleRule.cpp:
(WebCore::StyleRule::create):

    Add a bunch of asserts.

(WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):

    This could produce a zero-length selector list.

LayoutTests:

* fast/css/long-selector-list-crash-expected.txt: Added.
* fast/css/long-selector-list-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@168005 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166090 - Source/WebCore: Fix a crash when assigning an object to document.location
https://bugs.webkit.org/show_bug.cgi?id=130213

Reviewed by Geoffrey Garen.

Convert location to string before we make use the document.
This prevents us from attempting to navigate a frame that
has already been removed.

Test: fast/dom/navigation-with-sideeffects-crash.html

* bindings/js/JSDocumentCustom.cpp:
(WebCore::JSDocument::location):
(WebCore::JSDocument::setLocation):

LayoutTests: Fix semantics of JS execution when assigning an object to document.location
https://bugs.webkit.org/show_bug.cgi?id=130213

Reviewed by Geoffrey Garen.

* fast/dom/navigation-with-sideeffects-expected.txt: Added.
* fast/dom/navigation-with-sideeffects.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@168006 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Merge r166304 - REGRESSION(r162679): Poster image visible under the video
https://bugs.webkit.org/show_bug.cgi?id=130783

Reviewed by Simon Fraser.

In the listed revision, we started checking for isRenderImage()
instead of isImage(). RenderMedias return 'true' for the first
but 'false' for the second. Change the if() statement to check
for isRenderMedia() in addition to !isRenderImage().

* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::isDirectlyCompositedImage):

git-svn-id: http://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.2@168007 268f45cc-cd09-0410-ab3c-d52691b4dbfc