GitLab

        Reviewed by Alexey Proskuryakov.

        https://bugs.webkit.org/show_bug.cgi?id=25251
        Crash when frame creation removes it from the parent

        This brings us up-to-date with the expectations of sub-frame
        creation, following what Mac has done. It fixes crashes when
        calling init on the child frame removes it from the page.

        This makes the following test pass instead of crash:

          fast/loader/frame-creation-removal.html

        * WebCoreSupport/FrameLoaderClientGtk.cpp:
        (WebKit::FrameLoaderClient::createFrame):

git-svn-id: svn://svn.chromium.org/blink/trunk@42617 bbb929c8-8fbe-4397-9dbb-9b2b20218538

2009-04-17  Brady Eidson  <beidson@apple.com>

        Reviewed by Maciej Stachowiak

        <rdar://problem/5753299> "Private Browsing" doesn't affect HTML 5 Database storage

        If the Page is in private browsing mode when a statement is queued up, flag that 
        statement as read-only.

        It would be better to set the read-only flag on the database thread when it actually
        executes, but that would either require making Settings access a lock-protected operation
        or involve a synchronous callback to the WebCore thread, neither of which seem worth it.
        If it becomes an issue in practice, we can revisit this later.

        Test: storage/private-browsing-readonly.html

        * storage/Database.cpp:
        (WebCore::Database::setAuthorizerReadOnly):
        * storage/Database.h:

        * storage/DatabaseAuthorizer.cpp:  For all action types that would alter the database,
          deny when in read-only mode.
        (WebCore::DatabaseAuthorizer::reset):
        (WebCore::DatabaseAuthorizer::createTable):
        (WebCore::DatabaseAuthorizer::dropTable):
        (WebCore::DatabaseAuthorizer::allowAlterTable):
        (WebCore::DatabaseAuthorizer::createIndex):
        (WebCore::DatabaseAuthorizer::dropIndex):
        (WebCore::DatabaseAuthorizer::createTrigger):
        (WebCore::DatabaseAuthorizer::dropTrigger):
        (WebCore::DatabaseAuthorizer::createVTable):
        (WebCore::DatabaseAuthorizer::dropVTable):
        (WebCore::DatabaseAuthorizer::allowDelete):
        (WebCore::DatabaseAuthorizer::allowInsert):
        (WebCore::DatabaseAuthorizer::allowUpdate):
        (WebCore::DatabaseAuthorizer::setReadOnly):
        * storage/DatabaseAuthorizer.h:

        * storage/SQLStatement.cpp:
        (WebCore::SQLStatement::create): Add a m_readOnly flag.
        (WebCore::SQLStatement::SQLStatement): Ditto.
        (WebCore::SQLStatement::execute): If m_readOnly is set, tell the authorizer to change
          to read-only mode.
        * storage/SQLStatement.h:

        * storage/SQLTransaction.cpp:
        (WebCore::SQLTransaction::executeSQL): Flag the statement as read-only if the Page is
          currently in private browsing mode.

LayoutTests:

2009-04-17  Brady Eidson  <beidson@apple.com>

        Reviewed by Maciej Stachowiak

        <rdar://problem/5753299> "Private Browsing" doesn't affect HTML 5 Database storage

        * storage/private-browsing-readonly-expected.txt: Added.
        * storage/private-browsing-readonly.html: Added.



git-svn-id: svn://svn.chromium.org/blink/trunk@42616 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Sam Weinig.

        WebKit side of <rdar://problem/6449642>.
        
        * Plugins/Hosted/HostedNetscapePluginStream.h:
        (WebKit::HostedNetscapePluginStream::create):
        New function that creates a stream from a frame loader.
        
        * Plugins/Hosted/HostedNetscapePluginStream.mm:
        (WebKit::HostedNetscapePluginStream::HostedNetscapePluginStream):
        Add the constructor that takes a frame loader.
        
        * Plugins/Hosted/NetscapePluginHostManager.h:
        * Plugins/Hosted/NetscapePluginHostManager.mm:
        (WebKit::NetscapePluginHostManager::instantiatePlugin):
        Pass "fullFrame" to the plug-in host.
        
        * Plugins/Hosted/NetscapePluginHostProxy.mm:
        (WKPCCancelLoadURL):
        Call NetscapePluginInstanceProxy::cancelStreamLoad.
        
        * Plugins/Hosted/NetscapePluginInstanceProxy.h:
        (WebKit::NetscapePluginInstanceProxy::create):
        Pass "fullFrame" to the constructor.
        
        (WebKit::NetscapePluginInstanceProxy::manualStream):
        New getter for the manual stream.
        
        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
        (WebKit::NetscapePluginInstanceProxy::NetscapePluginInstanceProxy):
        Take the implicit request into account if we have a full frame plug-in.
        
        (WebKit::NetscapePluginInstanceProxy::setManualStream):
        Setter for the manual stream.
        
        (WebKit::NetscapePluginInstanceProxy::cancelStreamLoad):
        Cancel the manual stream if necessary.
        
        * Plugins/Hosted/WebHostedNetscapePluginView.h:
        WebHostedNetscapePluginView now conforms to the WebPluginManualLoader protocol.
        
        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
        (-[WebHostedNetscapePluginView createPlugin]):
        Pass "fullFrame" to instantiatePlugin.
        
        (-[WebHostedNetscapePluginView pluginView:receivedResponse:]):
        (-[WebHostedNetscapePluginView pluginView:receivedData:]):
        (-[WebHostedNetscapePluginView pluginView:receivedError:]):
        (-[WebHostedNetscapePluginView pluginViewFinishedLoading:]):
        Call the equivalent manual stream functions.
        
        * WebCoreSupport/WebFrameLoaderClient.mm:
        (WebFrameLoaderClient::createPlugin):
        Use a macro for getting the plug-in view type.



git-svn-id: svn://svn.chromium.org/blink/trunk@42615 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Adam Roben.

        * WebHistory.cpp:
        (WebHistory::data):



git-svn-id: svn://svn.chromium.org/blink/trunk@42614 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Move RenderPath and RenderSVGContainer onto a unified clippedOverflowRectForRepaint
        https://bugs.webkit.org/show_bug.cgi?id=25268

        Lots of minus lines.  Now we're sharing more sane code
        (which will respect -webkit-transforms! and scroll offsets correctly)

        Which means this fixes:
        https://bugs.webkit.org/show_bug.cgi?id=20769 too!

        We're no longer expanding the paint rect "for anti-aliasing", since
        I can't find a case where that's required.  If it is, repaintRectInLocalCoordinates()
        should be fixed to handle those cases instead of here.

        This fixes svg/custom/scroll-hit-test (now that we respect scroll offsets when repainting)
        as well as improves our focus ring drawing seen in svg/custom/focus-ring
        focus rings are now closer to transformed content by a couple pixels (they were needlessly outset by the antialiasing hack)
        Also, it fixes the dumped rects for markers, causing a progression in svg/custom/marker-overflow-clip

        * rendering/RenderPath.cpp:
        (WebCore::RenderPath::repaintRectInLocalCoordinates):
        (WebCore::RenderPath::setPath):
        * rendering/RenderPath.h:
        * rendering/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
        * rendering/RenderSVGContainer.h:
        * rendering/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::clippedOverflowRectForRepaint):
        (WebCore::RenderSVGModelObject::computeRectForRepaint):
        * rendering/RenderSVGModelObject.h:
        * rendering/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::computeRectForRepaint):
        * rendering/RenderSVGRoot.h:

git-svn-id: svn://svn.chromium.org/blink/trunk@42613 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        - remove tests affected by <rdar://problem/6661401> from the skip list,
          now that it is fixed.

        * platform/mac-snowleopard/Skipped:



git-svn-id: svn://svn.chromium.org/blink/trunk@42612 bbb929c8-8fbe-4397-9dbb-9b2b20218538

https://bugs.webkit.org/show_bug.cgi?id=25259

When a node becomes visible or hidden, accessibility needs to be told to update.



git-svn-id: svn://svn.chromium.org/blink/trunk@42611 bbb929c8-8fbe-4397-9dbb-9b2b20218538

git-svn-id: svn://svn.chromium.org/blink/trunk@42610 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Unreviewed build fix.

        Fix the build with enabled SVG filters

git-svn-id: svn://svn.chromium.org/blink/trunk@42609 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Simon Hausmann.

        https://bugs.webkit.org/show_bug.cgi?id=25242

        Remove QtCore 4.5 dependency from QWebElement test

git-svn-id: svn://svn.chromium.org/blink/trunk@42608 bbb929c8-8fbe-4397-9dbb-9b2b20218538

<https://bugs.webkit.org/show_bug.cgi?id=25027>

Contributed by Mihnea Ovidenie
Reviewed by Oliver Hunt

When dealing with negative numbers, parseInt should use ceil instead of floor.


git-svn-id: svn://svn.chromium.org/blink/trunk@42607 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Oliver Hunt.

        <rdar://problem/6744652> 32-bit to 64-bit: Javascript hash tables double in size

        Remove perfect hash optimization which removes 1 MB of overhead on 32-bit and almost 2 MB on 64-bit.  Removing the optimization was not a regression on SunSpider and the acid 3 test still passes.

        * create_hash_table:
        * runtime/Lookup.cpp:
        (JSC::HashTable::createTable):
        (JSC::HashTable::deleteTable):
        * runtime/Lookup.h:
        (JSC::HashEntry::initialize):
        (JSC::HashEntry::next):
        (JSC::HashTable::entry):
        * runtime/Structure.cpp:
        (JSC::Structure::getEnumerableNamesFromClassInfoTable):



git-svn-id: svn://svn.chromium.org/blink/trunk@42606 bbb929c8-8fbe-4397-9dbb-9b2b20218538

Reviewed by Gavin Barraclough

Basically to ensure we don't accidentally invalidate the cached callframe
we should be using the cached callframe rather than our own exec state.
While the old behaviour was wrong i have been unable to actually create a
test case where anything actually ends up going wrong.


git-svn-id: svn://svn.chromium.org/blink/trunk@42605 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Dimitri Glazkov.

        https://bugs.webkit.org/show_bug.cgi?id=25196
        Add a missing V8DOMMap include.

        * bindings/v8/WorkerScriptController.cpp: Included V8DOMMap.h.

git-svn-id: svn://svn.chromium.org/blink/trunk@42604 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=25260
        Finish V8 custom bindings for InspectorController.

        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL): Added.

git-svn-id: svn://svn.chromium.org/blink/trunk@42603 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Mark Rowe.

        Fix for heavy leakage of WebURLResponses seen during the stress test 

        * WebCoreSupport/WebFrameLoaderClient.cpp:
        (WebFrameLoaderClient::shouldCacheResponse):



git-svn-id: svn://svn.chromium.org/blink/trunk@42602 bbb929c8-8fbe-4397-9dbb-9b2b20218538

Switch to wxGraphicsBitmap when using wxGraphicsContext so that we're not doing unnecessary conversions internally when drawing bitmaps.
        
https://bugs.webkit.org/show_bug.cgi?id=25248


git-svn-id: svn://svn.chromium.org/blink/trunk@42601 bbb929c8-8fbe-4397-9dbb-9b2b20218538

2009-04-16  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Dan Bernstein.

        Performing a block style change in an editable root that contains only a br adds a newline
        https://bugs.webkit.org/show_bug.cgi?id=25256

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): Fix a bad check for an root
        block that didn't handle a root that contained a placeholder.

LayoutTests:

2009-04-16  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Dan Bernstein.
        
        Performing a block style change in an editable root that contains only a br adds a newline
        https://bugs.webkit.org/show_bug.cgi?id=25256

        * editing/execCommand/25256-expected.txt: Added.
        * editing/execCommand/25256.html: Added.



git-svn-id: svn://svn.chromium.org/blink/trunk@42600 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Fix computeContainerBoundingBox to respect viewport translations
        https://bugs.webkit.org/show_bug.cgi?id=25254

        Previously computeContainerBoundingBox was just adding the viewportTranslation.
        Which, although it has a confusing name, only contains the scale and translation
        for the viewBox/preserveAspectRatio adjustment.  It does not contain the
        translation for the x/y offset of the viewport.
        localToParentTransform() does contain this offset, so we use that instead
        of the previous hacky code.

        * rendering/RenderSVGContainer.h:
        * rendering/RenderSVGViewportContainer.h:
        * rendering/SVGRenderSupport.cpp:
        (WebCore::computeContainerBoundingBox):

git-svn-id: svn://svn.chromium.org/blink/trunk@42599 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Add a localToParentTransform() method which includes the
        full transform between local and parent local coordinates.
        https://bugs.webkit.org/show_bug.cgi?id=25226

        Moved m_localTransform up into RenderSVGTransformableContainer
        and added a comment to RenderSVGViewportContainer to make it more
        clear that it does not have a localTransform().

        This patch reveals two more failed design decisions:
        1.  Use of RenderBox::absoluteTransform() to mean "absoluteTransform()
            including only my localTransform()" callers are probably using it
            incorrectly anyway and are just masking bugs in the confused code.
        2.  computeContainerBoundingBox does not include viewport translations in
            its computed bounding box, so bounding boxes will be off for parents of
            inner <svg> elements.  I'll fix this an updated the results in a separate change.

        No functional changes, thus no tests.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::localToParentTransform):
        (WebCore::RenderObject::absoluteTransform):
        * rendering/RenderObject.h:
        * rendering/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::layout):
        * rendering/RenderSVGContainer.h:
        (WebCore::RenderSVGContainer::viewportTransform):
        * rendering/RenderSVGHiddenContainer.cpp:
        * rendering/RenderSVGHiddenContainer.h:
        (WebCore::RenderSVGHiddenContainer::absoluteTransform):
        * rendering/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::localToParentTransform):
        (WebCore::RenderSVGRoot::absoluteTransform):
        * rendering/RenderSVGRoot.h:
        * rendering/RenderSVGTransformableContainer.cpp:
        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
        (WebCore::RenderSVGTransformableContainer::localTransform):
        * rendering/RenderSVGTransformableContainer.h:
        * rendering/RenderSVGViewportContainer.cpp:
        (WebCore::RenderSVGViewportContainer::localToParentTransform):
        (WebCore::RenderSVGViewportContainer::absoluteTransform):
        * rendering/RenderSVGViewportContainer.h:
        * rendering/SVGRenderSupport.cpp:
        (WebCore::computeContainerBoundingBox):

git-svn-id: svn://svn.chromium.org/blink/trunk@42598 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Darin Fisher.

        Fix Chromium's rendering of <option> elements inside of <optgroups>.

        https://bugs.webkit.org/show_bug.cgi?id=25244

        Test (will included as a manual test by https://bugs.webkit.org/show_bug.cgi?id=24900):

        <select>
          <optgroup label="Should be bold">
            <option>Should not be bold</option>
          </optgroup>
        </select>

        * css/themeWin.css: adding comments
        * platform/chromium/PopupMenuChromium.cpp:
        (WebCore::PopupListBox::getRowFont): use menuStyle() rather than the item's style



git-svn-id: svn://svn.chromium.org/blink/trunk@42597 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Rubber-stamped by Simon Hausmann.

        Make the operator== and operator!= non inline to
        allow looking at the d-pointer in the future.

        * Api/qwebelement.cpp:
        (QWebElement::operator==):
        (QWebElement::operator!=):
        * Api/qwebelement.h:

git-svn-id: svn://svn.chromium.org/blink/trunk@42596 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Unreviewed build fix.

        * WebView.cpp:

git-svn-id: svn://svn.chromium.org/blink/trunk@42595 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Build fix: updated check-for-global-initializers to account for code motion.

        * Scripts/check-for-global-initializers:



git-svn-id: svn://svn.chromium.org/blink/trunk@42594 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Alexey Proskuryakov.

        https://bugs.webkit.org/show_bug.cgi?id=25218

        Make DOMWindow::inlineEventListenerForType not have the "inline"
        keyword. As this method gets used outside of DOMWindow.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::inlineEventListenerForType):



git-svn-id: svn://svn.chromium.org/blink/trunk@42593 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Antti Koivisto.

        Fix <rdar://problem/6766969>
        
        When deferred repaints are enabled and being reset and there is a active
        timer, stop the timer and do the deferred repaints immediately.

        * page/FrameView.cpp:
        (WebCore::FrameView::resetDeferredRepaintDelay):



git-svn-id: svn://svn.chromium.org/blink/trunk@42592 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Holger Freyther.

        http://bugs.webkit.org/show_bug.cgi?id=25042
        destroying webview widget directly causes crash.

        * tests/testwebframe.c:
        (test_webkit_web_frame_create_destroy): Add a test case for destroying
        a web view shortly after packing it in a window.

git-svn-id: svn://svn.chromium.org/blink/trunk@42591 bbb929c8-8fbe-4397-9dbb-9b2b20218538

2009-04-16  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Sam Weinig.

        https://bugs.webkit.org/show_bug.cgi?id=25241
        Remove superfluous NotImplemented.h includes.

        * html/CanvasRenderingContext2D.cpp:
        * html/CanvasStyle.cpp:
        * page/AccessibilityRenderObject.cpp:
        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
        * platform/graphics/GraphicsContext.cpp:
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        * platform/graphics/cairo/PathCairo.cpp:
        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
        * platform/graphics/gtk/FontGtk.cpp:
        * platform/graphics/gtk/IconGtk.cpp:
        * platform/graphics/qt/IconQt.cpp:
        * platform/graphics/qt/ImageQt.cpp:
        * platform/graphics/qt/ImageSourceQt.cpp:
        * platform/graphics/skia/ImageBufferSkia.cpp:
        * platform/graphics/skia/ImageSkia.cpp:
        * platform/graphics/win/ColorSafari.cpp:
        * platform/graphics/win/FontWin.cpp:
        * platform/graphics/win/GraphicsContextCGWin.cpp:
        * platform/graphics/win/GraphicsContextCairoWin.cpp:
        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
        * platform/graphics/wx/ImageWx.cpp:
        * platform/graphics/wx/TransformationMatrixWx.cpp:
        * platform/gtk/PlatformScreenGtk.cpp:
        * platform/gtk/PopupMenuGtk.cpp:
        * platform/gtk/ScrollViewGtk.cpp:
        * platform/gtk/ScrollbarGtk.cpp:
        * platform/network/cf/ResourceHandleCFNet.cpp:
        * platform/posix/FileSystemPOSIX.cpp:
        * platform/qt/DragDataQt.cpp:
        * platform/qt/FileSystemQt.cpp:
        * platform/qt/Localizations.cpp:
        * platform/qt/PopupMenuQt.cpp:
        * platform/win/EditorWin.cpp:
        * platform/win/PasteboardWin.cpp:
        * platform/wx/KeyboardEventWx.cpp:
        * platform/wx/PopupMenuWx.cpp:
        * platform/wx/SharedTimerWx.cpp:
        * plugins/gtk/PluginViewGtk.cpp:
        * plugins/mac/PluginPackageMac.cpp:
        * plugins/qt/PluginPackageQt.cpp:
        * plugins/win/PluginViewWin.cpp:
        * rendering/RenderThemeChromiumLinux.cpp:
        * svg/graphics/SVGImage.cpp:

WebKit/gtk:

2009-04-16  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Sam Weinig.

        https://bugs.webkit.org/show_bug.cgi?id=25241
        Remove superfluous NotImplemented.h includes.

        * webkit/webkitprivate.cpp:

WebKit/win:

2009-04-16  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Sam Weinig.

        https://bugs.webkit.org/show_bug.cgi?id=25241
        Remove superfluous NotImplemented.h includes

        * WebDownloadCFNet.cpp:
        * WebURLAuthenticationChallengeSender.cpp:
        * WebView.cpp:

git-svn-id: svn://svn.chromium.org/blink/trunk@42590 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Sam Weinig.

        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
        Unbounded memory growth when churning elements with anonymous event handler functions
        
        Some cleanup in event handling code.

        * bindings/js/JSDOMGlobalObject.cpp:
        * bindings/js/JSDOMGlobalObject.h: Removed findJSProtectedEventListener
        and findJSProtectedEventListener because they are now unused.

        * bindings/js/JSEventListener.cpp:
        * bindings/js/JSEventListener.h:
        (WebCore::JSEventListener::clearGlobalObject):
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::JSLazyEventListener):
        (WebCore::JSLazyEventListener::~JSLazyEventListener):
        (WebCore::JSLazyEventListener::globalObject):
        * bindings/js/JSLazyEventListener.h:
        (WebCore::JSLazyEventListener::clearGlobalObject): Nixed JSProtectedEventListener,
        and merged it with JSLazyEventListener, the only remaining event listener
        that still GC-protects its function and global object.

        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::ScriptController):
        * bindings/js/ScriptController.h:
        (WebCore::ScriptController::setEventHandlerLineNumber):
        (WebCore::ScriptController::eventHandlerLineNumber): Renamed handlerLineno =>
        handlerLineNumber, because anything less would be uncivilized. Removed
        createInlineEventListener because it mostly did irrelevent work, so it
        just got in the way of understanding how event handler creation works.

        * dom/Document.cpp:
        (WebCore::Document::createEventListener):
        * dom/XMLTokenizerLibxml2.cpp:
        (WebCore::XMLTokenizer::startElementNs):
        * html/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::processToken): Ditto.



git-svn-id: svn://svn.chromium.org/blink/trunk@42589 bbb929c8-8fbe-4397-9dbb-9b2b20218538

git-svn-id: svn://svn.chromium.org/blink/trunk@42588 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Dave Hyatt.

        Fix for https://bugs.webkit.org/show_bug.cgi?id=20765 Website 
        crashes on load due to messy HTML in search form
        -and corresponding-
        <rdar://problem/6210633>

        Before this patch, <form>s were allowed to sit inside tables 
        without being wrapped by anonymous table parts. There was also a 
        concept that such a form could be "demoted" and would not be 
        allowed to have any children. This patch has the HTML parser mark 
        form elements that have been demoted as such, and then the demoted 
        forms are not given renderers. I also removed the code that allowed 
        forms to sit in tables without anonymous table sections. So now any 
        forms that do manage to get a renderer inside a table will also be 
        wrapped with appropriate table parts.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::HTMLFormElement):
        (WebCore::HTMLFormElement::rendererIsNeeded):
        * html/HTMLFormElement.h:
        (WebCore::HTMLFormElement::setDemoted):
        (WebCore::HTMLFormElement::isDemoted):
        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::insertNode):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addChild):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::addChild):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::addChild):



git-svn-id: svn://svn.chromium.org/blink/trunk@42587 bbb929c8-8fbe-4397-9dbb-9b2b20218538

2009-04-16  Beth Dakin  <bdakin@apple.com>

        Reviewed by Dave Hyatt.

        Fix for https://bugs.webkit.org/show_bug.cgi?id=20765 Website 
        crashes on load due to messy HTML in search form
        -and corresponding-
        <rdar://problem/6210633>

        Before this patch, <form>s were allowed to sit inside tables 
        without being wrapped by anonymous table parts. There was also a 
        concept that such a from could be "demoted" and would not be 
        allowed to have any children. This patch has the HTML parser mark 
        form elements that have been demoted as such, and then the demoted 
        forms are not given renderers. I also removed the code that allowed 
        forms to sit in tables without anonymous table sections. So now any 
        forms that do manage to get a renderer inside a table will also be 
        wrapped with appropriate table parts.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::HTMLFormElement):
        (WebCore::HTMLFormElement::rendererIsNeeded):
        * html/HTMLFormElement.h:
        (WebCore::HTMLFormElement::setDemoted):
        (WebCore::HTMLFormElement::isDemoted):
        * html/HTMLParser.cpp:
        (WebCore::HTMLParser::insertNode):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addChild):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::addChild):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::addChild):

LayoutTests:

2009-04-16  Beth Dakin  <bdakin@apple.com>

        Reviewed by Dave Hyatt.

        Tests for https://bugs.webkit.org/show_bug.cgi?id=20765 Website 
        crashes on load due to messy HTML in search form
        -and corresponding-
        <rdar://problem/6210633>

        New tests:
        * fast/forms/form-added-to-table.html: Added.
        * fast/forms/form-in-malformed-markup.html: Added.
        * platform/mac/fast/forms/form-added-to-table-expected.checksum: Added.
        * platform/mac/fast/forms/form-added-to-table-expected.png: Added.
        * platform/mac/fast/forms/form-added-to-table-expected.txt: Added.
        * platform/mac/fast/forms/form-in-malformed-markup-expected.checksum: Added.
        * platform/mac/fast/forms/form-in-malformed-markup-expected.png: Added.
        * platform/mac/fast/forms/form-in-malformed-markup-expected.txt: Added.

        Tests with new results:
        * platform/mac/fast/forms/formmove3-expected.txt:
        * platform/mac/fast/forms/preserveFormDuringResidualStyle-expected.txt:
        * platform/mac/fast/invalid/table-residual-style-crash-expected.txt:
        * platform/mac/fast/table/fixed-table-non-cell-in-row-expected.txt:
        * platform/mac/fast/table/inline-form-assert-expected.txt:
        * platform/mac/fast/table/insert-cell-before-form-expected.txt:
        * platform/mac/fast/table/insert-row-before-form-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug1318-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug2516-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug30559-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug32447-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug34538-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug4527-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug78162-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug96334-expected.txt:
        * platform/mac/tables/mozilla/bugs/bug96343-expected.txt:
        * platform/mac/tables/mozilla_expected_failures/bugs/bug1725-expected.txt:



git-svn-id: svn://svn.chromium.org/blink/trunk@42586 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Simon Fraser.

        Fix https://bugs.webkit.org/show_bug.cgi?id=24527
        caret does not paint the first time you focus on a 0px right padding RTL div

        Test: fast/forms/caret-rtl.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::localCaretRect): When calculating x-axis if 
        alignment is alignRight, we need to subtract the caretWidth so that the
        caret at IntRect(x, y, caretWidth, height) is inside the block.



git-svn-id: svn://svn.chromium.org/blink/trunk@42585 bbb929c8-8fbe-4397-9dbb-9b2b20218538

git-svn-id: svn://svn.chromium.org/blink/trunk@42584 bbb929c8-8fbe-4397-9dbb-9b2b20218538

2009-04-16  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Simon Fraser.

        https://bugs.webkit.org/show_bug.cgi?id=25228
        SelectionController::absoluteCaretBounds returns an inflated caret (the caret repaint rect)
        
        Return the bounds of the transformed caret, not the transformed repaint rect for the caret (which is inflated).

        * editing/SelectionController.cpp:
        (WebCore::SelectionController::localCaretRect):
        (WebCore::SelectionController::absoluteBoundsForLocalRect):
        (WebCore::SelectionController::caretRepaintRect):
        (WebCore::SelectionController::recomputeCaretRect):
        * editing/SelectionController.h:

LayoutTests:

2009-04-16  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Simon Fraser.
        
        https://bugs.webkit.org/show_bug.cgi?id=25228
        SelectionController::absoluteCaretBounds returns an inflated caret (the caret repaint rect)

        * editing/selection/25228.html: Added.
        * platform/mac/editing/selection/25228-expected.checksum: Added.
        * platform/mac/editing/selection/25228-expected.png: Added.
        * platform/mac/editing/selection/25228-expected.txt: Added.



git-svn-id: svn://svn.chromium.org/blink/trunk@42583 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Adam Roben.

        Compare test's response mime type and dump test as text properly.

        * DumpRenderTree/gtk/DumpRenderTree.cpp:
        (dump):

git-svn-id: svn://svn.chromium.org/blink/trunk@42582 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Simon Fraser.

        https://bugs.webkit.org/show_bug.cgi?id=25187
        Bug 25187: <video> may not be rendered upon certain racy conditions

        Always create the video renderer when the load state reaches QTMovieLoadStateLoaded 
        and the element is visible, not only when the movie has just been opened.

        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivate::updateStates): Make sure we do not make false
        assumption on the state changes order. Create the renderer if none is present,
        when movie is loaded instead.


git-svn-id: svn://svn.chromium.org/blink/trunk@42581 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Add filterBoundingBox() to RenderSVGModelObject to share a tiny bit of code

        RenderSVGModelObject has much more interesting code it can share,
        but I'm just trying to get the commits out of my local branch and into
        the repository in any order I can. :)  This one was small.

        This will be used by the unified RenderSVGModelObject
        clippedOverflowRectForRepaint patch coming soon.

        * rendering/RenderPath.cpp:
        (WebCore::RenderPath::clippedOverflowRectForRepaint):
        * rendering/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::clippedOverflowRectForRepaint):
        * rendering/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::filterBoundingBox):
        * rendering/RenderSVGModelObject.h:

git-svn-id: svn://svn.chromium.org/blink/trunk@42580 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Reviewed by Eric Seidel and Adam Roben.

        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
        Unbounded memory growth when churning elements with anonymous event handler functions
        
        Simplified some EventHandler creation code.
        
        Removed a pile of code whose sole purpose was to allow SVG event handlers
        to supply a parameter named "evt" instead of the normal "event", and
        replaced it with a single parameter to JSLazyEventListener's constructor
        specifying the parameter name to use.

        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::JSLazyEventListener):
        (WebCore::JSLazyEventListener::parseCode):
        * bindings/js/JSLazyEventListener.h:
        (WebCore::JSLazyEventListener::create):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::createInlineEventListener):
        * bindings/js/ScriptController.h:
        * dom/Document.cpp:
        (WebCore::Document::createEventListener):



git-svn-id: svn://svn.chromium.org/blink/trunk@42579 bbb929c8-8fbe-4397-9dbb-9b2b20218538

        Split out objectBoundingBox and repaintRectInLocalCoordinates from relativeBBox
        in preparation for simplifying (and fixing) repaint logic in the SVG rendering tree.
        https://bugs.webkit.org/show_bug.cgi?id=25224

        objectBoundingBox() matches the SVG 1.1 concept of a "bounding box"

        repaintRectInLocalCoordinates() should return the a rect covering all painted content.
        However, repaintRectInLocalCoordinates() still only returns the "stroke bounding box"
        in this patch.  In a future patch, repaintRectInLocalCoordinates will be fixed to return
        a rect covering all painted content.  In order to avoid changing several hundred layout test results, I've left
        the behavior as-is for now.  The returned rect is used by various repaintRectInLocalCoordinates
        implementations and sometimes adjusted to include all painted content, but not always, and
        the places where the adjustments are made are sometimes wrong.  Again, will be fixed in
        an upcoming patch.

        This patch discovered a bug in Font::drawTextUsingSVGFont, which is probably causing
        bounding-box relative gradients on SVGFont glyphs to not paint correctly.
        I chose not to try and fix the bug in this patch and instead left a FIXME.

        This patch also discovered that at least tspan.getBBox() is broken.  This
        along with the foreignObject.getBBox() change will be tested (and fixed) in a
        later patch.  https://bugs.webkit.org/show_bug.cgi?id=25225

        No change in behavior (besides the above mentioned foreignObject.getBBox()), thus no tests.

        * rendering/RenderForeignObject.cpp:
        (WebCore::RenderForeignObject::objectBoundingBox): this is a behavior improvement for getBBox() test case coming in a later patch
        (WebCore::RenderForeignObject::repaintRectInLocalCoordinates): only really used for layout test results, might some day be used for repaint.
        * rendering/RenderForeignObject.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::objectBoundingBox): new methods, ASSERT if used but not implemented.
        (WebCore::RenderObject::repaintRectInLocalCoordinates):
        * rendering/RenderObject.h:
        * rendering/RenderPath.cpp:
        (WebCore::RenderPath::objectBoundingBox):
        (WebCore::RenderPath::repaintRectInLocalCoordinates):
        (WebCore::RenderPath::clippedOverflowRectForRepaint):
        (WebCore::RenderPath::lineHeight):
        (WebCore::RenderPath::baselinePosition):
        (WebCore::RenderPath::paint):
        (WebCore::RenderPath::addFocusRingRects):
        * rendering/RenderPath.h:
        * rendering/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::paint):
        (WebCore::RenderSVGContainer::objectBoundingBox):
        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
        * rendering/RenderSVGContainer.h:
        * rendering/RenderSVGGradientStop.h:
        (WebCore::RenderSVGGradientStop::objectBoundingBox):
        (WebCore::RenderSVGGradientStop::repaintRectInLocalCoordinates):
        * rendering/RenderSVGHiddenContainer.cpp:
        (WebCore::RenderSVGHiddenContainer::objectBoundingBox):
        (WebCore::RenderSVGHiddenContainer::repaintRectInLocalCoordinates):
        * rendering/RenderSVGHiddenContainer.h:
        * rendering/RenderSVGImage.cpp:
        (WebCore::RenderSVGImage::objectBoundingBox):
        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
        (WebCore::RenderSVGImage::calculateAbsoluteBounds):
        (WebCore::RenderSVGImage::addFocusRingRects):
        * rendering/RenderSVGImage.h:
        * rendering/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::paint):
        (WebCore::RenderSVGRoot::objectBoundingBox):
        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
        * rendering/RenderSVGRoot.h:
        * rendering/RenderSVGTSpan.h:
        (WebCore::RenderSVGTSpan::objectBoundingBox):
        (WebCore::RenderSVGTSpan::repaintRectInLocalCoordinates):
        * rendering/RenderSVGText.cpp:
        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
        (WebCore::RenderSVGText::absoluteRects):
        (WebCore::RenderSVGText::absoluteQuads):
        (WebCore::RenderSVGText::objectBoundingBox):
        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
        * rendering/RenderSVGText.h:
        * rendering/RenderSVGViewportContainer.cpp:
        (WebCore::RenderSVGViewportContainer::viewportTransform):
        * rendering/SVGRenderSupport.cpp:
        (WebCore::computeContainerBoundingBox):
        * rendering/SVGRenderSupport.h:
        * rendering/SVGRenderTreeAsText.cpp:
        (WebCore::operator<<):
        * svg/SVGFont.cpp:
        (WebCore::Font::drawTextUsingSVGFont):
        * svg/SVGLocatable.cpp:
        (WebCore::SVGLocatable::getBBox):
        * svg/SVGPatternElement.cpp:
        (WebCore::SVGPatternElement::buildPattern):
        * svg/graphics/SVGPaintServerGradient.cpp:
        (WebCore::createMaskAndSwapContextForTextGradient):
        (WebCore::clipToTextMask):
        (WebCore::SVGPaintServerGradient::setup):
        * svg/graphics/SVGPaintServerPattern.cpp:
        (WebCore::SVGPaintServerPattern::setup):

git-svn-id: svn://svn.chromium.org/blink/trunk@42578 bbb929c8-8fbe-4397-9dbb-9b2b20218538