ASSERTION FAILED: span >= 1
https://bugs.webkit.org/show_bug.cgi?id=129148

Patch by Zsolt Borbely <borbezs@inf.u-szeged.hu> on 2014-03-10
Reviewed by Andreas Kling.

Source/WebCore:

Set the value of span to 1 if the given number is too big or zero.

Test: fast/table/incorrect-colgroup-span-values.html

* html/HTMLTableColElement.cpp:
(WebCore::HTMLTableColElement::parseAttribute):

LayoutTests:

Added test demonstrates the behavior of colgroup in case of large negative, large positive, zero and null span values.

* fast/table/incorrect-colgroup-span-values-expected.txt: Added.
* fast/table/incorrect-colgroup-span-values.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165395 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r159218): FrameView::layout() should destroy TemporaryChange<LayoutPhase>
before destroying Ref<FrameView>
https://bugs.webkit.org/show_bug.cgi?id=130034
<rdar://problem/15664288>

Reviewed by Alexey Proskuryakov.

We should always destroy TemporaryChange<LayoutPhase> before destroying Ref<FrameView>
in FrameView::layout() so as to ensure that the FrameView exists when we restore the
original layout phase value.

The existing test fast/frames/crash-remove-iframe-during-object-beforeload.html covers
this change. Although you must run the test with Guard Malloc enabled (i.e. run-webkit-tests -r).

* page/FrameView.cpp:
(WebCore::FrameView::layout): Move construction of variable protect before the construction of
variable layoutPhaseRestorer. Additionally, add a period to the end of the comment associated
with variable protect.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165396 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit2: Crash in WebPage::getPositionInformation.
https://bugs.webkit.org/show_bug.cgi?id=129936
<rdar://problem/16264550>
 
Reviewed by Eric Carlson.
 
Missing null check on the node renderer in one code path.
If the page body is smaller than the document, hit testing
will return HTMLHtmlElement that has no renderer.

* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::getPositionInformation):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165397 268f45cc-cd09-0410-ab3c-d52691b4dbfc
<rdar://problem/16278716> [Cocoa] Allow setting a custom group identifier on a WKWebView
https://bugs.webkit.org/show_bug.cgi?id=130033

Reviewed by Tim Horton.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView initWithFrame:configuration:]): Create a page group with the group identifier
from the configuration, if it’s non-empty.
* UIProcess/API/Cocoa/WKWebViewConfiguration.mm:
(-[WKWebViewConfiguration _groupIdentifier]): Added this accessor.
(-[WKWebViewConfiguration _setGroupIdentifier:]): Ditto.
* UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h: Declared _groupIdentifier property.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165398 268f45cc-cd09-0410-ab3c-d52691b4dbfc
iOS build fix after http://trac.webkit.org/changeset/165385

Unreviewed.

* accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
(-[WebAccessibilityObjectWrapper arrayOfTextForTextMarkers:attributed:]):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165400 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Out-line ScratchRegisterAllocator

Rubber stamped by Mark Hahnenberg.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGDriver.cpp:
(JSC::DFG::compileImpl):
* jit/ScratchRegisterAllocator.cpp: Added.
(JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
(JSC::ScratchRegisterAllocator::~ScratchRegisterAllocator):
(JSC::ScratchRegisterAllocator::lock):
(JSC::ScratchRegisterAllocator::allocateScratch):
(JSC::ScratchRegisterAllocator::allocateScratchGPR):
(JSC::ScratchRegisterAllocator::allocateScratchFPR):
(JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
(JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
(JSC::ScratchRegisterAllocator::desiredScratchBufferSize):
(JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
(JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
* jit/ScratchRegisterAllocator.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165401 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Start splitting CSS Selectors's pseudo types
https://bugs.webkit.org/show_bug.cgi?id=130003

Reviewed by Andreas Kling.

CSS Selectors pseudo types come in 3 flavors: page, pseudo class, pseudo elements.

The three types are mixed together in a single enum list named PseudoType. Only some combinations
of match type + pseudo type are valid, but this is implicitly defined from the code.

This patch is the beginning of a refactoring to add more clear boundaries between
valid and invalid combinations.

First, the handling of page pseudo types is completely split from the other values.
The parser use a different method for handling the value CSSParserSelector::parsePagePseudoSelector().

PagePseudo types no longer store their string in the CSSSelector either to reduce the redundancy
with m_pseudoType.
When we need to generate the string for those CSSSelector, we recreate the string as needed in
CSSSelector::selectorText().

The remaining two types are not yet split in this patch but this introduce the preliminary clean up
toward that goal.
The list of parsed pseudo types is now generated at compile time from the source in SelectorPseudoTypeMap.in.

* DerivedSources.make:
The mapping of strings to pseudo types is generated from SelectorPseudoTypeMap.in
by the new script makeSelectorPseudoTypeMap.py.

* WebCore.xcodeproj/project.pbxproj:
* css/CSSGrammar.y.in:
Split the parsing of Pseudo Types. Pseudo page get its own method. The others will need some work.

* css/CSSParserValues.cpp:
(WebCore::CSSParserSelector::parsePagePseudoSelector):
(WebCore::CSSParserSelector::setPseudoTypeValue):
* css/CSSParserValues.h:
* css/CSSSelector.cpp:
(WebCore::CSSSelector::specificityForPage):
This is an example of invalid combination that is hidden by the current code.
First, Left and Right could never appear in a pseudo class match.
(WebCore::CSSSelector::pseudoId):
(WebCore::CSSSelector::parsePseudoType):
(WebCore::appendPseudoTypeTailIfNecessary):
(WebCore::CSSSelector::selectorText):
* css/CSSSelector.h:
(WebCore::CSSSelector::pseudoType):
(WebCore::CSSSelector::matchesPseudoElement):
(WebCore::CSSSelector::setValue):
(WebCore::CSSSelector::CSSSelector):
* css/PageRuleCollector.cpp:
(WebCore::checkPageSelectorComponents):
* css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOne):
* css/SelectorPseudoTypeMap.h: Added.
* css/SelectorPseudoTypeMap.in: Added.
* css/makeSelectorPseudoTypeMap.py: Added.
(enumerablePseudoType):
(expand_ifdef_condition):
* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::addPseudoType):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165402 268f45cc-cd09-0410-ab3c-d52691b4dbfc
jsc commandline shouldn't have a "console" because that confuses some tests into thinking
that they're running in the browser.

Rubber stamped by Mark Hahnenberg.

* jsc.cpp:
(GlobalObject::finishCreation):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165403 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Generalize unobscured rect to all ports
https://bugs.webkit.org/show_bug.cgi?id=130036

Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-03-10
Reviewed by Simon Fraser.

Source/WebCore: 

iOS differentiates visible content and unobscured content. This patch moves the concept to all
ports to remove the #ifdefs from the call sites.

On everything but iOS, unobscuredRect and visibleRect are the same.

* WebCore.exp.in:
* page/DOMWindow.cpp:
(WebCore::DOMWindow::innerHeight):
(WebCore::DOMWindow::innerWidth):
* page/SpatialNavigation.cpp:
(WebCore::canScrollInDirection):
* platform/ScrollView.cpp:
(WebCore::ScrollView::updateScrollbars):
(WebCore::ScrollView::paint):
* platform/ScrollView.h:
(WebCore::ScrollView::unobscuredContentRectIncludingScrollbars):
(WebCore::ScrollView::unobscuredContentRect):
* rendering/RenderView.cpp:
(WebCore::RenderView::viewportSize):

Source/WebKit2: 

* WebProcess/WebPage/ViewGestureGeometryCollector.cpp:
(WebKit::ViewGestureGeometryCollector::collectGeometryForSmartMagnificationGesture):
(WebKit::ViewGestureGeometryCollector::collectGeometryForMagnificationGesture):
* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
(WebKit::TiledCoreAnimationDrawingArea::applyTransientZoomToPage):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@165404 268f45cc-cd09-0410-ab3c-d52691b4dbfc