Improve "bad parent" and "bad child list" assertions in line boxes
https://bugs.webkit.org/show_bug.cgi?id=125656

Reviewed by Sam Weinig.

My previous fix for this problem was incomplete. This continuation of that fix addresses
the flaw in the original and adds additional lifetime checking so problems can be seen in
debug builds without a memory debugger.

* rendering/InlineBox.cpp:
(WebCore::InlineBox::assertNotDeleted): Added. Poor man's memory debugging helper.
(WebCore::InlineBox::~InlineBox): Refactored body into a new function named
invalidateParentChildList. Added code to update the deletion sentinel to record
that this object is deleted.
(WebCore::InlineBox::setHasBadParent): Moved here from header since this debug-only
feature does not need to be inlined. Added a call to assertNotDeleted.
(WebCore::InlineBox::invalidateParentChildList): Added. Refactored from the destructor,
this is used by RenderTextLineBoxes.

* rendering/InlineBox.h: Added the deletion sentinel, and called it in the parent
function. Also changed the expansion/setExpansion functions to use the type name "int",
since we don't use the type name "signed" in the WebKit coding style.

* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::~InlineFlowBox): Call setHasBadChildList rather than doing the
setHasBadParent work on children directly, to avoid code duplication.
(WebCore::InlineFlowBox::setHasBadChildList): Moved here from header. Added code to set
"has bad parent" on all children, something we previously did only on destruction. Also
added assertNotDeleted.
(WebCore::InlineFlowBox::checkConsistency): Added call to assertNotDeleted. Also tweaked
code style and variable names a little bit.

* rendering/InlineFlowBox.h: Moved setHasBadChildList out of the header when it's on.
The empty version for ASSERT_WITH_SECURITY_IMPLICATION_DISABLED is still in the header.

* rendering/RenderTextLineBoxes.cpp:
(WebCore::RenderTextLineBoxes::invalidateParentChildLists): Call the new
InlineBox::invalidateParentChildList function instead of calling setHasBadChildList directly.
The new function checks m_hasBadParent, something we couldn't do here.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164928 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Fix srcset related bugs
https://bugs.webkit.org/show_bug.cgi?id=129539

Source/WebCore:

Fixed a bug reported against Blink's srcset implementation at https://code.google.com/p/chromium/issues/detail?id=347998
When both src and srcset had only 1x descriptors and the DPR was higher than 1, the src's resource was picked.

Also fixed the invalid descriptor handling, which wasn't aligned with the spec, and therefore was not as forward compatible as it should be.
Invalid descriptors caused the entire resource to be ignored, rather than just the descriptors themselves.

Patch by Yoav Weiss <yoav@yoav.ws> on 2014-03-01
Reviewed by Andreas Kling.

Tests: fast/hidpi/image-srcset-invalid-descriptor.html
       fast/hidpi/image-srcset-src-selection-1x-both.html

* html/parser/HTMLParserIdioms.cpp:
(WebCore::parseDescriptors):
(WebCore::parseImagesWithScaleFromSrcsetAttribute):
(WebCore::bestFitSourceForImageAttributes):

LayoutTests:

These tests make sure that:
1. Invalid srcset descriptors are handled according to the spec. The invalid descriptors are ignored, but the resource is not.
2. When both src and srcset have only 1x descriptors and the DPR is higher than 1, the srcset's resource is picked.

I've also fixed the invalid inputs test, which was faulty.

Patch by Yoav Weiss <yoav@yoav.ws> on 2014-03-01
Reviewed by Andreas Kling.

* fast/hidpi/image-srcset-invalid-descriptor-expected.txt: Added.
* fast/hidpi/image-srcset-invalid-descriptor.html: Added.
* fast/hidpi/image-srcset-invalid-inputs-correct-src.html:
* fast/hidpi/image-srcset-src-selection-1x-both-expected.txt: Added.
* fast/hidpi/image-srcset-src-selection-1x-both.html: Added.
* fast/hidpi/resources/srcset-helper.js:
(runTest):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164929 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Some small modernizing tweaks to the coding style guide
https://bugs.webkit.org/show_bug.cgi?id=129427

Reviewed by Alexey Proskuryakov.

My intent here was originally to do the nullptr style guide update, but that was already done.
I did some other improvements. There's still quite a bit to do -- the guide is out of date in
a number of subtle ways.

* coding/coding-style.html: Change "left side operator" example to be a more modern example
without non-WebKit-style abbreviations and such. Use auto& instead of const auto& in for loop
example, since that's normally preferred. Changed section title to say "zero" instead of "0".
Use words instead of abbreviations in code examples. Show that a modern C++ for loop is preferred
over index iteration in vector iteration example and also showed use of unsigned rather than
size_t since that is almost always what we want. Eliminated the use of PassOwnPtr in the "return
a newly created object" example. Use references instead of pointers in one example.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164930 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[iOS] selectionImageForcingBlackText should return autoreleased object
https://bugs.webkit.org/show_bug.cgi?id=129437
<rdar://problem/15810384>

Reviewed by Darin Adler.

Source/WebCore:

* bindings/objc/DOM.mm:
(-[DOMRange renderedImageForcingBlackText:renderedImageForcingBlackText:]):

Source/WebKit/mac:

* WebView/WebHTMLView.mm:
(-[WebHTMLView selectionImageForcingBlackText:selectionImageForcingBlackText:]):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164931 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Tighten minimumRegisterRequirements()
https://bugs.webkit.org/show_bug.cgi?id=129538

Reviewed by Andreas Kling.

Source/WebCore: 

Fix small things that made minimumRegisterRequirements() a little optimistic
when dealing with attributes.

Test: fast/selectors/adjacent-descendant-tail-register-requirement.html

* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):
Attribute Set does not do value matching, the case sensitive value matching is irrelevant
The problem is that flag is also used by minimumRegisterRequirements()
to find if one more register is needed.

Set the flag to case sensitive to avoid reserving one extra register.

(WebCore::SelectorCompiler::minimumRegisterRequirements):
Use a new backtrackingFlag to know if there is a descendant tail, thus a backtracking register
reserved.
This is better than using the backtracking action because the backtracking chain could be
an adjacent chain inside a descendant chain.

The flags are designed for that, just set one for minimumRegisterRequirements().

The 2 extra registers for the attribute count and address become limited to all attributes
except the last one. We don't keep a copy for the last matching, those registers were not needed.

(WebCore::SelectorCompiler::SelectorCodeGenerator::computeBacktrackingInformation):

LayoutTests: 

* fast/selectors/adjacent-descendant-tail-register-requirement-expected.txt: Added.
* fast/selectors/adjacent-descendant-tail-register-requirement.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164932 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Ensure keySplines is valid in SMIL animations
<http://webkit.org/b/129547>
<rdar://problem/15676128>

Reviewed by Darin Adler.

Merged from Blink (patch by Philip Rogers):
https://src.chromium.org/viewvc/blink?revision=156452&view=revision
http://crbug.com/276111

    This patch fixes a crash in SMIL animations when keySplines are not
    specified. The SMIL spec is clear on this:
    http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncCalcMode
    "If there are any errors in the keyTimes specification (bad values,
    too many or too few values), the animation will have no effect."

    This patch simply checks that keyTimes is not empty. Previously,
    splinesCount was set to be m_keySplines.size() + 1 in
    SVGAnimationElement.cpp; this patch changes splinesCount to be equal
    to m_keySplines.size() to make the logic easier to follow and to
    match other checks in SVGAnimationElement::startedActiveInterval.

Source/WebCore:

Test: svg/animations/animate-keysplines-crash.html

* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::startedActiveInterval):

LayoutTests:

* svg/animations/animate-keysplines-crash-expected.txt: Added.
* svg/animations/animate-keysplines-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164933 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix.

* html/parser/HTMLParserIdioms.cpp: Removed an unused function.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164934 268f45cc-cd09-0410-ab3c-d52691b4dbfc