[CSS Shapes] shape-outside does not properly handle different writing modes
https://bugs.webkit.org/show_bug.cgi?id=128631

Reviewed by David Hyatt.

Source/WebCore:

Fix ShapeOutsideInfo to properly convert the line coordinates and
shape coordinates with respect to the writing mode and writing
direction for the lines that are affected by the shape. This is
notably different from shape inside in that shape outside needs to use
the writing mode of the container, not of the element that the shape
is applied to.

Tests: fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-border-box.html
       fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-content-box.html
       fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-margin-box.html
       fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-padding-box.html
       fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-border-box.html
       fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-content-box.html
       fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-margin-box.html
       fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-padding-box.html

* rendering/RenderBoxModelObject.h:
(WebCore::RenderBoxModelObject::borderWidth): Used by
    ShapeInfo::setReferenceBoxLogicalSize.
(WebCore::RenderBoxModelObject::borderHeight): Ditto.
* rendering/shapes/ShapeInfo.cpp:
(WebCore::ShapeInfo<RenderType>::setReferenceBoxLogicalSize): Use the
    container's writing mode to determine the logical dimensions in
    the case of shape outside.
(WebCore::ShapeInfo<RenderType>::computedShape): Use the new
    ShapeInfo::styleForWritingMode method.
(WebCore::borderBeforeInWritingMode): Determines the borderBefore for
    the passed in renderer using the writing mode passed in. The
    borderBefore method on the renderer is implemented in RenderStyle,
    unlike with the margin methods, so this was chosen instead of
    attempting to move the border method implementation into a place
    where it could take the writing mode as an argument.
(WebCore::borderAndPaddingBeforeInWritingMode): Determines the
    borderAndPaddingBefore for the passed in renderer using the
    given writihg mode. See above for why this method instead of doing
    it like margins.
(WebCore::borderStartWithStyleForWritingMode): Determines the
    borderStart for the passed in renderer using the writing mode and
    direction from the style passed in. See above for why this method
    instead of doing it like margins.
(WebCore::borderAndPaddingStartWithStyleForWritingMode): Determines
    the borderAndPaddingStart for the passed in renderer using the
    writing mode and direction from the style passed in. See above for
    why this method instead of doing it like margins.
(WebCore::ShapeInfo<RenderType>::logicalTopOffset): Use the
    container's writing mode to determine the logicalTopOffset in the
    case of shape outside.
(WebCore::ShapeInfo<RenderType>::logicalLeftOffset): Use the
    container's writing mode to determine the logicalTopOffset in the
    case of shape outside.
* rendering/shapes/ShapeInfo.h:
* rendering/shapes/ShapeInsideInfo.cpp:
(WebCore::ShapeInsideInfo::styleForWritingMode): Return the entire
    style because to determine start/end the writing direction is
    needed in addtion to the writing mode.
* rendering/shapes/ShapeInsideInfo.h:
* rendering/shapes/ShapeOutsideInfo.cpp:
(WebCore::ShapeOutsideInfo::updateDeltasForContainingBlockLine):
    Properly convert the containing block line into the reference box
    coordinates of the shape.
(WebCore::ShapeOutsideInfo::styleForWritingMode): Return the entire
    style because to determine start/end the writing direction is
    needed in addtion to the writing mode.
* rendering/shapes/ShapeOutsideInfo.h:

LayoutTests:

Tests for floats with shape-outside where the float writing mode or
writing direction are difference from that of the container.

* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-border-box-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-border-box.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-content-box-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-content-box.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-margin-box-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-margin-box.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-padding-box-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-direction-padding-box.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-border-box-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-border-box.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-content-box-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-content-box.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-margin-box-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-margin-box.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-padding-box-expected.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-different-writing-modes-padding-box.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164363 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add settings/preferences for enabling image controls
https://bugs.webkit.org/show_bug.cgi?id=129027

Reviewed by Jer Noble.

Source/WebCore:

* WebCore.exp.in:

* page/Settings.cpp:
(WebCore::Settings::Settings):
(WebCore::Settings::setImageControlsEnabled):
* page/Settings.h:
(WebCore::Settings::imageControlsEnabled):

Source/WebKit2:

* Shared/WebPreferencesStore.h:

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164364 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Setting playback rate on Media Controller modifies current time.
https://bugs.webkit.org/show_bug.cgi?id=129042

Patch by Piotr Grad <p.grad@samsung.com> on 2014-02-19
Reviewed by Jer Noble.

Source/WebCore:

In ClockGeneric: when setting playback rate or stoping timer,clock was restarted using current real time
instead of provided time by setCurrentTime.
Changed impl. so that m_offset is updated when clock stops to remember last clock position.
When playbackRate is changed m_offset is updated in order to not use old time interval for new playback rate.

Test: media/video-controller-currentTime-rate.html

* html/MediaController.cpp:
(MediaController::updatePlaybackState):
* platform/ClockGeneric.cpp:
(ClockGeneric::setPlayRate):
(ClockGeneric::start):
(ClockGeneric::stop):

LayoutTests:

* media/video-controller-currentTime-rate-expected.txt: Added.
* media/video-controller-currentTime-rate.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164365 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add FeatureDefines for image controls
https://bugs.webkit.org/show_bug.cgi?id=129022

Reviewed by Jer Noble.

Source/JavaScriptCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit/mac:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

* Configurations/FeatureDefines.xcconfig:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164366 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Do not dispatch change event twice in single step action
https://bugs.webkit.org/show_bug.cgi?id=116936
<rdar://problem/16086828>

Reviewed by Ryosuke Niwa.

Merged from Blink (patch by Kent Tamura):
https://src.chromium.org/viewvc/blink?view=rev&revision=151175

Source/WebCore:

Test: fast/forms/number/number-type-update-by-change-event.html

* html/InputType.cpp:
(WebCore::InputType::stepUpFromRenderer):

LayoutTests:

* fast/forms/number/number-type-update-by-change-event-expected.txt: Added.
* fast/forms/number/number-type-update-by-change-event.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164367 268f45cc-cd09-0410-ab3c-d52691b4dbfc
REGRESSION (r163560): Always treat SVG <tspan> and <textPath> as display inline
https://bugs.webkit.org/show_bug.cgi?id=128552
<rdar://problem/16029658>

Reviewed by Andreas Kling.

Source/WebCore:

Following <http://trac.webkit.org/changeset/163560>, SVG <tspan> and <textPath> may be treated as block-
level elements depending on their CSS styles (e.g. display: block). But such elements should always be
treated as inline-level elements.

Tests: svg/text/textpath-display-block.html
       svg/text/textpath-display-none.html
       svg/text/tspan-display-block.html

* css/StyleResolver.cpp:
(WebCore::StyleResolver::adjustRenderStyle):

LayoutTests:

Added tests to ensure that SVG <tspan> and <textPath> are always treated as inline-level
elements when explicitly or implicitly specified as a non-none, non-inline display type.

Additionally, added a test to ensure that we don't render a <textPath> when it has CSS
display none. Note, the test LayoutTests/svg/batik/text/textProperties2.svg ensures a
similar behavior for <tspan>.

* svg/text/textpath-display-block-expected.txt: Added.
* svg/text/textpath-display-block.html: Added.
* svg/text/textpath-display-none-expected.html: Added.
* svg/text/textpath-display-none.html: Added.
* svg/text/tspan-display-block-expected.txt: Added.
* svg/text/tspan-display-block.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164368 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Don't call to willBeDeletedFrom(Document&) when destructing document
https://bugs.webkit.org/show_bug.cgi?id=129013

Reviewed by Andreas Kling.
        
The document is half dead at this point.

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::~ContainerNode):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164369 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Windows gardening. Mark more flakes.

* platform/win/TestExpectations: Add flaky tests.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164370 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Dedicated worker crash caused by global DFG worklists + GC
https://bugs.webkit.org/show_bug.cgi?id=128537

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

The process-global DFG worklists were causing objects to participate in the garbage collections of VMs
other than the one they were allocated in. This started manifesting in the worker tests because they're
one of the few WebKit tests that do multithreaded JS.

The fix is to filter out Plans from other VMs during collection.

* dfg/DFGSafepoint.cpp:
(JSC::DFG::Safepoint::vm):
* dfg/DFGSafepoint.h:
* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::isActiveForVM):
(JSC::DFG::Worklist::suspendAllThreads):
(JSC::DFG::Worklist::resumeAllThreads):
(JSC::DFG::Worklist::visitChildren):
* dfg/DFGWorklist.h:
* heap/Heap.cpp:
(JSC::Heap::deleteAllCompiledCode):
* heap/SlotVisitorInlines.h:
(JSC::SlotVisitor::copyLater):

LayoutTests:

Reenable a previously skipped test.

* TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164371 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[WebRTC] Updating RTCConfiguration to match WebRTC editor's draft of 01/27/2014
https://bugs.webkit.org/show_bug.cgi?id=129000

Source/WebCore:

Reviewed by Eric Carlson.

Adding RTCIceTransports and RTCIdentityOption to RTCConfiguration object.

Existing test was updated.

* Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::parseConfiguration): Taking into account iceTransports and requestIdentity
parameters.
* platform/mediastream/RTCConfiguration.h:
(WebCore::RTCConfiguration::iceTransports): Added.
(WebCore::RTCConfiguration::setIceTransports): Added.
(WebCore::RTCConfiguration::requestIdentity): Added.
(WebCore::RTCConfiguration::setRequestIdentity): Added.
(WebCore::RTCConfiguration::RTCConfiguration): Initialize iceTransports and requestIdentity with the default
values.

LayoutTests:

Adding RTCIceTransports and RTCIdentityOption to RTCConfiguration object.

Reviewed by Eric Carlson.

* fast/mediastream/RTCPeerConnection-expected.txt:
* fast/mediastream/RTCPeerConnection.html:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164372 268f45cc-cd09-0410-ab3c-d52691b4dbfc
ASSERTION FAILED: (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0) in WTF::dateToDaysFrom1970
https://bugs.webkit.org/show_bug.cgi?id=128740

Source/JavaScriptCore:

Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970
DateConstructor will now check if the number fits into an Int32 before casting

Patch by Dániel Bátyai <dbatyai.u-szeged@partner.samsung.com> on 2014-02-19
Reviewed by Geoffrey Garen.

* runtime/DateConstructor.cpp:
(JSC::constructDate):
(JSC::dateUTC):

LayoutTests:

Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970
Added test case which checks for this

Patch by Dániel Bátyai <dbatyai.u-szeged@partner.samsung.com> on 2014-02-19
Reviewed by Geoffrey Garen.

* js/date-constructor-expected.txt:
* js/script-tests/date-constructor.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164373 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[Win][LLINT] Incorrect stack alignment.
https://bugs.webkit.org/show_bug.cgi?id=129045

Patch by peavo@outlook.com <peavo@outlook.com> on 2014-02-19
Reviewed by Michael Saboff.

LLINT expects the stack to be 16 byte aligned, but with MSVC it is not.
To align the stack, a new backend, X86_WIN, is created.

* llint/LLIntOfflineAsmConfig.h: Use X86_WIN backend on Windows.
* llint/LowLevelInterpreter.asm: Align stack to 16 byte boundaries. Otherwise, use same implementation for X86_WIN as for X86.
* llint/LowLevelInterpreter32_64.asm: Adjust stack offset to retrieve function parameters now that the stack is aligned.
* offlineasm/backends.rb: Added X86_WIN backend.
* offlineasm/x86.rb: Fix crash caused by incorrect assembly code for double types.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164374 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Add missing layout test results for
<http://trac.webkit.org/changeset/164323>.

Unreviewed.

* platform/mac/fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164375 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: AX: clarify reason for ignored state where possible (hidden, default for tag, etc)
https://bugs.webkit.org/show_bug.cgi?id=129037

Patch by James Craig <jcraig@apple.com> on 2014-02-19
Reviewed by Timothy Hatcher.

Source/WebCore:

Passing back hidden and ignoredByDefault attrs to clarify some reasons for "ignored" status.

Test Updated: inspector-protocol/dom/getAccessibilityPropertiesForNode.html

* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
* inspector/protocol/DOM.json:

Source/WebInspectorUI:

Passing back hidden and ignoredByDefault attrs to clarify some reasons for "ignored" status.

* Localizations/en.lproj/localizedStrings.js:
* UserInterface/DOMNode.js:
* UserInterface/DOMNodeDetailsSidebarPanel.js:

LayoutTests:

Test updates to support hidden and ignoredByDefault in accessibility properties.

* inspector-protocol/dom/getAccessibilityPropertiesForNode-expected.txt:
* inspector-protocol/dom/getAccessibilityPropertiesForNode.html:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164376 268f45cc-cd09-0410-ab3c-d52691b4dbfc
SegmentedVector::append() should take in rvalue reference, forward it to Vector::uncheckedAppend()
https://bugs.webkit.org/show_bug.cgi?id=128996

Patch by Zan Dobersek <zdobersek@igalia.com> on 2014-02-19
Reviewed by Brent Fulgham.

* wtf/SegmentedVector.h:
(WTF::SegmentedVector::append): Take in an rvalue reference of the object that's to be appended and
then forward it to Vector::uncheckedAppend(). This avoids unnecessary copies in the current situation
where a const lvalue is accepted and passed on.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164377 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Use std::swap() in HashTable::swap()
https://bugs.webkit.org/show_bug.cgi?id=128995

Patch by Zan Dobersek <zdobersek@igalia.com> on 2014-02-19
Reviewed by Brent Fulgham.

Use std::swap() to swap the member variable values of two HashTable objects in HashTable::swap().

* wtf/HashTable.h:
(WTF::KeyTraits>::swap):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164378 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[GTK] Add new ARM build slave for GTK+
https://bugs.webkit.org/show_bug.cgi?id=128978

Patch by Gustavo Noronha Silva <gustavo.noronha@collabora.com> on 2014-02-19
Reviewed by Brent Fulgham.

* BuildSlaveSupport/build.webkit.org-config/config.json:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164379 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Missing box doesn't use border-box as reference box for clip-path
https://bugs.webkit.org/show_bug.cgi?id=129049

Reviewed by Simon Fraser.

Source/WebCore:

If no reference box was specified the default reference box should be
border-box. Previously to this patch the reference box was the bounding
client rect. This was not following the specification.
http://www.w3.org/TR/2014/WD-css-masking-1-20140213/#the-clip-path
The change affects content using -webkit-clip-path in Safari. Since the
bounding client box is equalvalent to the border box most of the time
there shouldn't be to much impact.

Existing tests cover the issue.

* rendering/RenderLayer.cpp:
(WebCore::computeReferenceBox):

LayoutTests:

Update the result for overflowing content. The clip-path uses the border-box instead of
the bounding client rect as reference box.
Change pixel test to reference text.

* css3/masking/clip-path-circle-relative-overflow-expected.html: Added.
* platform/mac/css3/masking/clip-path-circle-relative-overflow-expected.png: Removed.
* platform/mac/css3/masking/clip-path-inset-expected.png: Added. This was missing in the repo.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164380 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[wk2] REGRESSION (r162710): Open tab urls not restored after switching to new Safari build
https://bugs.webkit.org/show_bug.cgi?id=128536
<rdar://problem/15911839>

Reviewed by Dan Bernstein.

* UIProcess/cf/WebBackForwardListCF.cpp:
(WebKit::extractBackForwardListEntriesFromArray):
Don't fail to extract an entry if it doesn't have a snapshot UUID.

* UIProcess/cf/WebPageProxyCF.cpp:
It turns out that this was the wrong version to bump, and we don't support
reading different versions of the session state data.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164381 268f45cc-cd09-0410-ab3c-d52691b4dbfc
UIProcess needs to know the color of the page's extended background
https://bugs.webkit.org/show_bug.cgi?id=129004

Source/WebCore: 

Reviewed by Brent Fulgham.

This patch adds a new ChromeClient function, 
pageExtendedBackgroundColorDidChange() which will be called whenever the extended 
background color has changed.

New function.
* page/ChromeClient.h:
(WebCore::ChromeClient::pageExtendedBackgroundColorDidChange):

Store the extended background color in a member variable so that we can know if it 
changed even if we do not have an m_layerForOverhangAreas.
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::RenderLayerCompositor):
(WebCore::RenderLayerCompositor::setRootExtendedBackgroundColor):
* rendering/RenderLayerCompositor.h:

Source/WebKit2: 

Reviewed by Simon Fraser and Brent Fulgham.

New method on WKWebView and WKView will return the page’s extended background 
color.
* UIProcess/API/Cocoa/WKViewPrivate.h:
* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView pageExtendedBackgroundColor]):
* UIProcess/API/Cocoa/WKWebViewPrivate.h:
* UIProcess/API/ios/WKViewIOS.mm:
(-[WKView pageExtendedBackgroundColor]):

The color is stored in the WebPageProxy, and the ChromeClient sends a message to 
the WebPageProxy with the new color whenever it changes.
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::pageExtendedBackgroundColorDidChange):
* UIProcess/WebPageProxy.h:
(WebKit::WebPageProxy::pageExtendedBackgroundColor):
* UIProcess/WebPageProxy.messages.in:
* WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::pageExtendedBackgroundColorDidChange):
* WebProcess/WebCoreSupport/WebChromeClient.h:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164382 268f45cc-cd09-0410-ab3c-d52691b4dbfc