Updated WebKit from /home/shausman/src/webkit/trunk to origin/qtwebkit-4.6-staging ( 9508ee9559a81a3401e2cd7e06ab74c590c84523 )

Changes in WebKit since the last update:

++ b/BugsSite/ChangeLog
2009-06-09  Eric Seidel  <eric@webkit.org>

        Reviewed by Adam Roben.

        Add support for displaying added png files in PrettyPatch diffs
        https://bugs.webkit.org/show_bug.cgi?id=26210

        Currently this is SVN only (git-send-bugzilla patches exclude binary data)
        and only works for PNG files but could easily be made to work for other images as needed.

        * PrettyPatch/PrettyPatch.rb:

++ b/ChangeLog
2009-06-20  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Jan Alonzo.

        Adding files for the new test case for loading statuses.

        * GNUmakefile.am:

2009-06-15  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Gustavo Noronha.

        Version bump in preparation for 1.1.10 release.

        * configure.ac:

2009-06-12  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Reviewed by Xan Lopez.

        Refactor handling of options in the build-webkit script

        Options are now defined in one place, and then reused when creating
        the usage help text, the arguments to GetOptions(), and when passing
        the options on to the underlying port-dependent build systems.

        This allows the Qt port to read the defaults for the options from the
        pro file (dynamically), and to pass the options on to qmake at build.

        * configure.ac:

2009-06-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Holger Freyther.

        [Qt] Fix release build detection
        https://bugs.webkit.org/show_bug.cgi?id=26267

        * WebKit.pri:

2009-06-10  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Xan Lopez.

        Add unit tests for our WebKitNetworkRequest object.

        * GNUmakefile.am:

2009-06-10  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Gustavo Noronha.

        Version bump in preparation for 1.1.9 release.

        * configure.ac:

2009-06-10  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Jan Alonzo.

        https://bugs.webkit.org/show_bug.cgi?id=25415
        [GTK][ATK] Please implement support for get_text_at_offset

        Add new dependency on the Gail utils library, needed for our a11y
        implementation.

        * GNUmakefile.am:
        * configure.ac:

++ b/JavaScriptCore/ChangeLog
2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
        Reviewed by Darin Adler.
        Inherits HashSet class from FastAllocBase, because it has been
        instantiated by 'new' in JavaScriptCore/runtime/Collector.h:116.
        * wtf/HashSet.h:
2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
        Reviewed by Darin Adler.
        Inherits Vector class from FastAllocBase because it has been
        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:633.
        * wtf/Vector.h:
2009-06-24  Norbert Leser  <norbert.leser@nokia.com>
        Reviewed by Maciej Stachoviak.
        The BytecodeGenerator objects were instantiated on stack, which takes up ~38kB per instance
        (each instance includes copy of JSC::CodeBlock with large SymbolTable, etc.).
        Specifically, since there is nested invocation (e.g., GlobalCode --> FunctionCode),
        the stack overflows immediately on Symbian hardware (max. 80 kB).
        Proposed change allocates generator objects on heap.
        Performance impact (if any) should be negligible and change is proposed as general fix,
        rather than ifdef'd for SYMBIAN.
        * parser/Nodes.cpp:
        (JSC::ProgramNode::generateBytecode):
        (JSC::EvalNode::generateBytecode):
        (JSC::EvalNode::bytecodeForExceptionInfoReparse):
        (JSC::FunctionBodyNode::generateBytecode):
        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
2009-06-23  Oliver Hunt  <oliver@apple.com>
        Reviewed by Gavin Barraclough.
        <rdar://problem/6992806> REGRESSION: Enumeration can skip new properties in cases of prototypes that have more than 64 (26593)
        <https://bugs.webkit.org/show_bug.cgi?id=26593>
        Do not attempt to cache structure chains if they contain a dictionary at any level.
        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::tryCachePutByID):
        (JSC::Interpreter::tryCacheGetByID):
        * runtime/Structure.cpp:
        (JSC::Structure::getEnumerablePropertyNames):
        (JSC::Structure::addPropertyTransition):
        * runtime/StructureChain.cpp:
        (JSC::StructureChain::isCacheable):
        * runtime/StructureChain.h:
2009-06-23  Yong Li  <yong.li@torchmobile.com>
        Reviewed by George Staikos.
        https://bugs.webkit.org/show_bug.cgi?id=26654
        Add the proper export define for the JavaScriptCore API when building for WINCE.
        * API/JSBase.h:
2009-06-23  Joe Mason  <joe.mason@torchmobile.com>
        Reviewed by Adam Treat.
        Authors: Yong Li <yong.li@torchmobile.com>, Joe Mason <joe.mason@torchmobile.com>
        https://bugs.webkit.org/show_bug.cgi?id=26611
        Implement currentThreadStackBase on WINCE by adding a global,
        g_stackBase, which must be set to the address of a local variable
        by the caller before calling any WebKit function that invokes JSC.
        * runtime/Collector.cpp:
        (JSC::isPageWritable):
        (JSC::getStackBase):
          Starts at the top of the stack and returns the entire range of
          consecutive writable pages as an estimate of the actual stack.
          This will be much bigger than the actual stack range, so some
          dead objects can't be collected, but it guarantees live objects
          aren't collected prematurely.
        (JSC::currentThreadStackBase):
          On WinCE, returns g_stackBase if set or call getStackBase as a
          fallback if not.
2009-06-23  Oliver Hunt  <oliver@apple.com>
        Reviewed by Alexey Proskuryakov.
        Fix stupid performance problem in the LiteralParser
        The LiteralParser was making a new UString in order to use
        toDouble, however UString's toDouble allows a much wider range
        of numberic strings than the LiteralParser accepts, and requires
        an additional heap allocation or two for the construciton of the
        UString.  To rectify this we just call WTF::dtoa directly using
        a stack allocated buffer to hold the validated numeric literal.
        * runtime/LiteralParser.cpp:
        (JSC::LiteralParser::Lexer::lexNumber):
        (JSC::LiteralParser::parse):
        * runtime/LiteralParser.h:
2009-06-22  Oliver Hunt  <oliver@apple.com>
        Reviewed by Alexey Proskuryakov.
        Bug 26640: JSON.stringify needs to special case Boolean objects
        <https://bugs.webkit.org/show_bug.cgi?id=26640>
        Add special case handling of the Boolean object so we match current
        ES5 errata.
        * runtime/JSONObject.cpp:
        (JSC::unwrapBoxedPrimitive): renamed from unwrapNumberOrString
        (JSC::gap):
        (JSC::Stringifier::appendStringifiedValue):
2009-06-22  Oliver Hunt  <oliver@apple.com>
        Bug 26591: Support revivers in JSON.parse
        <https://bugs.webkit.org/show_bug.cgi?id=26591>
        Add reviver support to JSON.parse.  This completes the JSON object.
        * runtime/JSONObject.cpp:
        (JSC::Walker::Walker):
        (JSC::Walker::callReviver):
        (JSC::Walker::walk):
        (JSC::JSONProtoFuncParse):
2009-06-21  Oliver Hunt  <oliver@apple.com>
        Reviewed by Darin Adler.
        Bug 26592: Support standard toJSON functions
        <https://bugs.webkit.org/show_bug.cgi?id=26592>
        Add support for the standard Date.toJSON function.
        * runtime/DatePrototype.cpp:
        (JSC::dateProtoFuncToJSON):
2009-06-21  Oliver Hunt  <oliver@apple.com>
        Bug 26594: JSC needs to support Date.toISOString
        <https://bugs.webkit.org/show_bug.cgi?id=26594>
        Add support for Date.toISOString.
        * runtime/DatePrototype.cpp:
        (JSC::dateProtoFuncToISOString):
2009-06-21  Oliver Hunt  <oliver@apple.com>
        Reviewed by NOBODY (Build fix).
        Remove dead code.
        * runtime/LiteralParser.cpp:
        (JSC::LiteralParser::parse):
2009-06-21  Oliver Hunt  <oliver@apple.com>
        Reviewed by Darin Adler and Cameron Zwarich.
        Bug 26587: Support JSON.parse
        <https://bugs.webkit.org/show_bug.cgi?id=26587>
        Extend the LiteralParser to support the full strict JSON
        grammar, fix a few places where the grammar was incorrectly
        lenient.   Doesn't yet support the JSON.parse reviver function
        but that does not block the JSON.parse functionality itself.
        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::callEval):
        * runtime/JSGlobalObjectFunctions.cpp:
        (JSC::globalFuncEval):
        * runtime/JSONObject.cpp:
        (JSC::JSONProtoFuncParse):
        (JSC::isSafeStringCharacter):
        (JSC::LiteralParser::parse):
        * runtime/LiteralParser.h:
        (JSC::LiteralParser::LiteralParser):
        (JSC::LiteralParser::tryJSONParse):
        (JSC::LiteralParser::):
        (JSC::LiteralParser::Lexer::Lexer):
2009-06-21  David Levin  <levin@chromium.org>
        Reviewed by NOBODY (speculative build fix for windows).
        Simply removed some whitespace form this file to make windows build wtf and
        hopefully copy the new MessageQueque.h so that WebCore picks it up.
        * wtf/Assertions.cpp:
2009-06-21  Drew Wilson  <atwilson@google.com>
        Reviewed by David Levin.
        <https://bugs.webkit.org/show_bug.cgi?id=25043>
        Added support for multi-threaded MessagePorts.
        * wtf/MessageQueue.h:
        (WTF::::appendAndCheckEmpty):
            Added API to test whether the queue was empty before adding an element.

2009-06-20  David D. Kilzer  <ddkilzer@webkit.org>
        Fix namespace comment in SegmentedVector.h
        * wtf/SegmentedVector.h: Updated namespace comment to reflect
        new namespace after r44897.
2009-06-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
        Bug 24986: ARM JIT port
        <https://bugs.webkit.org/show_bug.cgi?id=24986>
        An Iterator added for SegmentedVector. Currently
        only the pre ++ operator is supported.
        * wtf/SegmentedVector.h:
        (WTF::SegmentedVectorIterator::~SegmentedVectorIterator):
        (WTF::SegmentedVectorIterator::operator*):
        (WTF::SegmentedVectorIterator::operator->):
        (WTF::SegmentedVectorIterator::operator++):
        (WTF::SegmentedVectorIterator::operator==):
        (WTF::SegmentedVectorIterator::operator!=):
        (WTF::SegmentedVectorIterator::operator=):
        (WTF::SegmentedVectorIterator::SegmentedVectorIterator):
        (WTF::SegmentedVector::alloc):
        (WTF::SegmentedVector::begin):
        (WTF::SegmentedVector::end):
2009-06-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
        Bug 24986: ARM JIT port
        <https://bugs.webkit.org/show_bug.cgi?id=24986>
        Move SegmentedVector to /wtf subdirectory
        and change "namespace JSC" to "namespace WTF"
        Additional build file updates by David Kilzer.
        * GNUmakefile.am: Updated path to SegmentedVector.h.
        * JavaScriptCore.order: Updated SegmentedVector namespace from
        JSC to WTF in mangled C++ method name.
        Removed reference to bytecompiler\SegmentedVector.h.
        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added reference to
        wtf\SegmentedVector.h.
        * JavaScriptCore.xcodeproj/project.pbxproj: Moved
        SegmentedVector.h definition from bytecompiler subdirectory to
        wtf subdirectory.
        * bytecompiler/BytecodeGenerator.h: Updated #include path to
        SegmentedVector.h and prepended WTF:: namespace to its use.
        * parser/Lexer.h: Ditto.
        * wtf/SegmentedVector.h: Renamed from JavaScriptCore/bytecompiler/SegmentedVector.h.
        (WTF::SegmentedVector::SegmentedVector):
        (WTF::SegmentedVector::~SegmentedVector):
        (WTF::SegmentedVector::size):
        (WTF::SegmentedVector::at):
        (WTF::SegmentedVector::operator[]):
        (WTF::SegmentedVector::last):
        (WTF::SegmentedVector::append):
        (WTF::SegmentedVector::removeLast):
        (WTF::SegmentedVector::grow):
        (WTF::SegmentedVector::clear):
        (WTF::SegmentedVector::deleteAllSegments):
        (WTF::SegmentedVector::segmentExistsFor):
        (WTF::SegmentedVector::segmentFor):
        (WTF::SegmentedVector::subscriptFor):
        (WTF::SegmentedVector::ensureSegmentsFor):
        (WTF::SegmentedVector::ensureSegment):
2009-06-19  Gavin Barraclough  <barraclough@apple.com>
        Reviewed by NOBODY (build fix take 2 - rename FIELD_OFFSET to something that doesn't conflict with winnt.h).
        (JSC::JIT::emitGetVariableObjectRegister):
        (JSC::JIT::emitPutVariableObjectRegister):
        (JSC::JIT::compileOpCallInitializeCallFrame):
        (JSC::JIT::checkStructure):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_instanceof):
        (JSC::JIT::emit_op_get_scoped_var):
        (JSC::JIT::emit_op_put_scoped_var):
        (JSC::JIT::emit_op_construct_verify):
        (JSC::JIT::emit_op_resolve_global):
        (JSC::JIT::emit_op_jeq_null):
        (JSC::JIT::emit_op_jneq_null):
        (JSC::JIT::emit_op_to_jsnumber):
        (JSC::JIT::emit_op_catch):
        (JSC::JIT::emit_op_eq_null):
        (JSC::JIT::emit_op_neq_null):
        (JSC::JIT::emit_op_convert_this):
        (JSC::JIT::emit_op_profile_will_call):
        (JSC::JIT::emit_op_profile_did_call):
        (JSC::JIT::emitSlow_op_get_by_val):
        * jit/JITPropertyAccess.cpp:
        (JSC::JIT::emit_op_get_by_val):
        (JSC::JIT::emit_op_put_by_val):
        (JSC::JIT::emit_op_method_check):
        (JSC::JIT::emit_op_put_by_id):
        (JSC::JIT::privateCompilePatchGetArrayLength):
        (JSC::JITThunks::JITThunks):
2009-06-19  Gavin Barraclough  <barraclough@apple.com>
        Reviewed by NOBODY (Windows build fix).
2009-06-19  Gabor Loki  <loki@inf.u-szeged.hu>
        Reorganize ARM architecture specific macros.
        Use PLATFORM_ARM_ARCH(7) instead of PLATFORM(ARM_V7).
        Bug 24986: ARM JIT port
        <https://bugs.webkit.org/show_bug.cgi?id=24986>
        * assembler/ARMv7Assembler.h:
        * assembler/AbstractMacroAssembler.h:
        (JSC::AbstractMacroAssembler::Imm32::Imm32):
        * assembler/MacroAssembler.h:
        * assembler/MacroAssemblerCodeRef.h:
        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
        (JSC::ExecutableAllocator::cacheFlush):
        * jit/JITInlineMethods.h:
        (JSC::JIT::restoreArgumentReferenceForTrampoline):
        * wtf/Platform.h:
        * yarr/RegexJIT.cpp:
        (JSC::Yarr::RegexGenerator::generateEnter):
        (JSC::Yarr::RegexGenerator::generateReturn):
2009-06-19  Gavin Barraclough  <barraclough@apple.com>
        Fix armv7 JIT build issues.
        Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it now contains non POD types),
        and the FIELD_OFFSET macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT macros.
        * Replace offsetofs with FIELD_OFFSETs (safe on C++ objects).
        * Move COMPILE_ASSERTs defending layout of JITStackFrame structure on armv7 into JITThunks constructor.
        (JSC::JIT::restoreArgumentReference):
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_catch):
        (JSC::JITThunks::JITThunks):
2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
        Blind attempt at build fix.
2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
        Inherits CallIdentifier struct from FastAllocBase because it has been
        instantiated by 'new' in JavaScriptCore/profiler/CallIdentifier.h:86.
        * wtf/HashCountedSet.h:
2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
        https://bugs.webkit.org/show_bug.cgi?id=26540
        Modify the test shell to add a new function 'checkSyntax' that will
        only parse the source instead of executing it. In this way we can test
        pure parsing performance against some of the larger scripts in the wild.
        (functionCheckSyntax):
2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
        Reviewed by Darin Adler.
        Inherits HashCountedSet class from FastAllocBase because it has been
        instantiated by 'new' in JavaScriptCore/runtime/Collector.cpp:1095.
        * wtf/HashCountedSet.h:
2009-06-19  Yong Li  <yong.li@torchmobile.com>
        Reviewed by George Staikos.
        https://bugs.webkit.org/show_bug.cgi?id=26558
        Declare these symbols extern for WINCE as they are provided by libce.
2009-06-19  Oliver Hunt  <oliver@apple.com>
        <rdar://problem/6988973> ScopeChain leak in interpreter builds
        Move the Scopechain destruction code in JSFunction outside of the ENABLE(JIT)
        path.
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::~JSFunction):
2009-06-19  Yong Li  <yong.li@torchmobile.com>
        Reviewed by George Staikos.
        https://bugs.webkit.org/show_bug.cgi?id=26543
        Windows CE uses 'GetLastError' instead of 'errno.'
2009-06-19  David Levin  <levin@chromium.org>
        Reviewed by NOBODY (Windows build fix).
        Add export for Windows corresponding to OSX export done in r44844.
2009-06-18  Oliver Hunt  <oliver@apple.com>
        Reviewed by Gavin "Viceroy of Venezuela" Barraclough.
        Bug 26532: Native functions do not correctly unlink from optimised callsites when they're collected
        <https://bugs.webkit.org/show_bug.cgi?id=26532> <rdar://problem/6625385>
        We need to make sure that each native function instance correctly unlinks any references to it
        when it is collected.  Allowing this to happen required a few changes:
            * Every native function needs a codeblock to track the link information
            * To have this codeblock, every function now also needs its own functionbodynode
              so we no longer get to have a single shared instance.
            * Identifying a host function is now done by looking for CodeBlock::codeType() == NativeCode
        (JSC::CodeBlock::CodeBlock):
           Constructor for NativeCode CodeBlock
        (JSC::CodeBlock::derefStructures):
        (JSC::CodeBlock::refStructures):
        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
        (JSC::CodeBlock::handlerForBytecodeOffset):
        (JSC::CodeBlock::lineNumberForBytecodeOffset):
        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
        (JSC::CodeBlock::setJITCode):
           Add assertions to ensure we don't try and use NativeCode CodeBlocks as
           a normal codeblock.
        * bytecode/CodeBlock.h:
        (JSC::CodeBlock::source):
        (JSC::CodeBlock::sourceOffset):
        (JSC::CodeBlock::evalCodeCache):
        (JSC::CodeBlock::createRareDataIfNecessary):
          More assertions.
        (JSC::JIT::privateCompileCTIMachineTrampolines):
        (JSC::JIT::linkCall):
          Update logic to allow native function caching
        * jit/JITStubs.cpp:
        (JSC::FunctionBodyNode::createNativeThunk):
        (JSC::FunctionBodyNode::isHostFunction):
        * runtime/JSFunction.cpp:
        (JSC::JSFunction::JSFunction):
        (JSC::JSFunction::~JSFunction):
        (JSC::JSFunction::mark):
        (JSC::JSGlobalData::~JSGlobalData):
2009-06-18  Gavin Barraclough  <barraclough@apple.com>
        Reviewed by NOBODY (Windows build fix).
        * wtf/DateMath.cpp:
        (WTF::calculateUTCOffset):
2009-06-18  Gavin Barraclough  <barraclough@apple.com>
        Reviewed by Geoff Garen.
        Timezone calculation incorrect in Venezuela.
        https://bugs.webkit.org/show_bug.cgi?id=26531
        <rdar://problem/6646169> Time is incorrectly reported to JavaScript in both Safari 3 and Firefox 3
        The problem is that we're calculating the timezone relative to 01/01/2000,
        but the VET timezone changed from -4 hours to -4:30 hours on 12/09/2007.
        According to the spec, section 15.9.1.9 states "the time since the beginning
        of the year", presumably meaning the *current* year.  Change the calculation
        to be based on whatever the current year is, rather than a canned date.
        No performance impact.
        * wtf/DateMath.cpp:
        (WTF::calculateUTCOffset):
2009-06-18  Gavin Barraclough  <barraclough@apple.com>
        Rubber Stamped by Mark Rowe (originally reviewed by Sam Weinig).
        (Reintroducing patch added in r44492, and reverted in r44796.)
        Change the implementation of op_throw so the stub function always modifies its
        return address - if it doesn't find a 'catch' it will switch to a trampoline
        to force a return from JIT execution.  This saves memory, by avoiding the need
        for a unique return for every op_throw.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_throw):
            JITStubs::cti_op_throw now always changes its return address,
            remove return code generated after the stub call (this is now
            handled by ctiOpThrowNotCaught).
            Add ctiOpThrowNotCaught definitions.
        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
            Change cti_op_throw to always change its return address.
        * jit/JITStubs.h:
            Add ctiOpThrowNotCaught declaration.
2009-06-18  Kevin McCullough  <kmccullough@apple.com>
        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
        - Exposed functions now needed by WebCore.
        * JavaScriptCore.exp:
2009-06-17  Darin Adler  <darin@apple.com>
        Bug 26429: Make JSON.stringify non-recursive so it can handle objects
        of arbitrary complexity
        https://bugs.webkit.org/show_bug.cgi?id=26429
        For marking I decided not to use gcProtect, because this is inside the engine
        so it's easy enough to just do marking. And that darned gcProtect does locking!
        Oliver tried to convince me to used MarkedArgumentBuffer, but the constructor
        for that class says "FIXME: Remove all clients of this API, then remove this API."
        * runtime/Collector.cpp:
        (JSC::Heap::collect): Add a call to JSONObject::markStringifiers.
        * runtime/CommonIdentifiers.cpp:
        (JSC::CommonIdentifiers::CommonIdentifiers): Added emptyIdentifier.
        * runtime/CommonIdentifiers.h: Ditto.
        (JSC::JSGlobalData::JSGlobalData): Initialize firstStringifierToMark to 0.
        * runtime/JSGlobalData.h: Added firstStringifierToMark.

        * runtime/JSONObject.cpp: Cut down the includes to the needed ones only.
        (JSC::unwrapNumberOrString): Added. Helper for unwrapping number and string
        objects to get their number and string values.
        (JSC::ReplacerPropertyName::ReplacerPropertyName): Added. The class is used
        to wrap an identifier or integer so we don't have to do any work unless we
        actually call a replacer.
        (JSC::ReplacerPropertyName::value): Added.
        (JSC::gap): Added. Helper function for the Stringifier constructor.
        (JSC::PropertyNameForFunctionCall::PropertyNameForFunctionCall): Added.
        The class is used to wrap an identifier or integer so we don't have to
        allocate a number or string until we actually call toJSON or a replacer.
        (JSC::PropertyNameForFunctionCall::asJSValue): Added.
        (JSC::Stringifier::Stringifier): Updated and moved out of the class
        definition. Added code to hook this into a singly linked list for marking.
        (JSC::Stringifier::~Stringifier): Remove from the singly linked list.
        (JSC::Stringifier::mark): Mark all the objects in the holder stacks.
        (JSC::Stringifier::stringify): Updated.
        (JSC::Stringifier::appendQuotedString): Tweaked and streamlined a bit.
        (JSC::Stringifier::toJSON): Renamed from toJSONValue.
        (JSC::Stringifier::appendStringifiedValue): Renamed from stringify.
        Added code to use the m_holderStack to do non-recursive stringify of
        objects and arrays. This code also uses the timeout checker since in
        pathological cases it could be slow even without calling into the
        JavaScript virtual machine.
        (JSC::Stringifier::willIndent): Added.
        (JSC::Stringifier::indent): Added.
        (JSC::Stringifier::unindent): Added.
        (JSC::Stringifier::startNewLine): Added.
        (JSC::Stringifier::Holder::Holder): Added.
        (JSC::Stringifier::Holder::appendNextProperty): Added. This is the
        function that handles the format of arrays and objects.
        (JSC::JSONObject::getOwnPropertySlot): Moved this down to the bottom
        of the file so the JSONObject class is not interleaved with the
        Stringifier class.
        (JSC::JSONObject::markStringifiers): Added. Calls mark.
        (JSC::JSONProtoFuncStringify): Streamlined the code here. The code
        to compute the gap string is now a separate function.

        * runtime/JSONObject.h: Made everything private. Added markStringifiers.

2009-06-17  Oliver Hunt  <oliver@apple.com>

        Reviewed by Gavin Barraclough.

        <rdar://problem/6974140> REGRESSION(r43849): Crash in cti_op_call_NotJSFunction when getting directions on maps.google.com

        Roll out r43849 as it appears that we cannot rely on the address of
        an objects property storage being constant even if the structure is
        unchanged.
        (JSC::JIT::compileGetDirectOffset):
2009-06-17  Gavin Barraclough  <barraclough@apple.com>
        Rubber Stamped by Mark Rowe.
        Fully revert r44492 & r44748 while we fix a bug they cause on internal builds <rdar://problem/6955963>.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_throw):
        * jit/JITStubs.cpp:
        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
        * jit/JITStubs.h:
2009-06-17  Gavin Barraclough  <barraclough@apple.com>
        <rdar://problem/6947426> sunspider math-cordic.js exhibits different intermediate results running 32-bit vs. 64-bit
        On 64-bit, NaN-encoded values must be detagged before they can be used in rshift.
        (JSC::JIT::emit_op_rshift):
2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
        Reviewed by George Staikos.
        https://bugs.webkit.org/show_bug.cgi?id=23155
        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
2009-06-17  George Staikos  <george.staikos@torchmobile.com>
        Reviewed by Adam Treat.
        https://bugs.webkit.org/show_bug.cgi?id=23155
        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
        * config.h:
        * jsc.cpp:
        * wtf/Assertions.cpp:
        * wtf/Assertions.h:
        * wtf/CurrentTime.cpp:
        (WTF::lowResUTCTime):
        * wtf/DateMath.cpp:
        (WTF::getLocalTime):
        * wtf/MathExtras.h:
        * wtf/StringExtras.h:
        * wtf/Threading.h:
        * wtf/win/MainThreadWin.cpp:
2009-06-17  Gavin Barraclough  <barraclough@apple.com>
        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
        Remove PropertySlot::putValue - PropertySlots should only be used for getting,
        not putting.  Rename JSGlobalObject::getOwnPropertySlot to hasOwnPropertyForWrite,
        which is what it really was being used to ask, and remove some other getOwnPropertySlot
        & getOwnPropertySlotForWrite methods, which were unused and likely to lead to confusion.
        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
2009-06-16  Gavin Barraclough  <barraclough@apple.com>
        Reviewed by Oliver hunt.
        Temporarily partially disable r44492, since this is causing some problems on internal builds.
        * jit/JITOpcodes.cpp:
        (JSC::JIT::emit_op_throw):
        * jit/JITStubs.cpp:
        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
2009-06-16  Sam Weinig  <sam@webkit.org>
        Fix windows build.
2009-06-16  Sam Weinig  <sam@webkit.org>
        Initialize m_bytecodeIndex to -1 in JIT, and correctly initialize
        it for each type of stub using the return address to find the correct
        offset.
        (JSC::JIT::compileGetByIdProto):
        (JSC::JIT::compileGetByIdChainList):
        * jit/JITStubCall.h:
        (JSC::JITStubCall::call):
== Rolled over to ChangeLog-2009-06-16 ==
++ b/JavaScriptGlue/ChangeLog
2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>

        Reviewed by Darin Adler.

        Add FastAllocBase.h to JavaScriptGlue's ForwardingHeaders/wtf, because it's needed by HashCountedSet.h on MAC.

        * ForwardingHeaders/wtf/FastAllocBase.h: Added.

++ b/LayoutTests/ChangeLog
2009-06-24  Oliver Hunt  <oliver@apple.com>
        Reviewed by NOBODY (attempted test fix).
        Attempting to make test more reliable.
        * media/video-canvas.html:
2009-06-05  Eric Seidel  <eric@webkit.org>
        https://bugs.webkit.org/show_bug.cgi?id=25922
        Fix dropEffect = "none" to work as expected.
        * fast/events/drag-to-navigate-expected.txt: Copied from LayoutTests/editing/selection/doubleclick-whitespace-img-crash-expected.txt.
        * fast/events/drag-to-navigate.html: Added.
        * fast/events/prevent-drag-to-navigate-expected.txt: Copied from LayoutTests/editing/selection/doubleclick-whitespace-img-crash-expected.txt.
        * fast/events/prevent-drag-to-navigate.html: Added.
        * fast/events/resources/file-for-drag-to-navigate.html: Added.
        * fast/events/resources/file-for-prevent-drag-to-navigate.html: Added.
2009-06-23  Oliver Hunt  <oliver@apple.com>
        Reviewed by NOBODY (missed a file).
        Add expected results for test i landed earlier
        * fast/js/dictionary-no-cache-expected.txt: Added.
2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
        Reviewed by Sam Weinig and Dave Hyatt.
        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
        <https://bugs.webkit.org/show_bug.cgi?id=25920>
        Add tests for drawing a video to the canvas element.
        * media/video-canvas-expected.txt: Added.
        * media/video-canvas.html: Added.
2009-06-23  Oliver Hunt  <oliver@apple.com>
        <rdar://problem/6992806> REGRESSION: Enumeration can skip new properties in cases of prototypes that have more than 64 (26593)
        <https://bugs.webkit.org/show_bug.cgi?id=26593>
        Add tests to ensure we correctly invalidate caching that depends on structure chains
        that include dictionaries.
        * fast/js/dictionary-no-cache.html: Added.
        * fast/js/dictionary-no-cache-expected.txt: Added.
        * fast/js/resources/dictionary-no-cache.js: Added.
2009-06-23  Ojan Vafai  <ojan@chromium.org>
        Reviewed by Mark Rowe.
        Resets the results for a test that was missed in
        http://trac.webkit.org/changeset/45016.
        * editing/execCommand/5142012-3-expected.txt:
2009-06-23  Sam Weinig  <sam@webkit.org>
        Test for https://bugs.webkit.org/show_bug.cgi?id=26516
        Add initial implementation of DataGridDataSource
        * fast/dom/HTMLDataGridElement: Added.
        * fast/dom/HTMLDataGridElement/DataGridDataSource-basic-expected.txt: Added.
        * fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html: Added.
2009-06-23  Ryosuke Niwa  <rniwa@google.com>
        Reviewed by Justin Garcia.
        Undo the changeset 21212 to fix the regression bug 14062.
        The changeset 21212 attempted to fix rdar://problem/5002441.
        The changeset 21212 modified InsertTextCommand::input so as to convert
        all spaces in text to non-breaking spaces for rdar://problem/5002441.
        However, the bug was originally caused by rebalanceWhitespaceAt
        and this workaround introduced a regression bug 14062.
        Because rebalanceWhitespaceAt appears to behave correctly now,
        the workaround introduced in 21212 is no longer needed.

        The following test cases are affected by this change.
        This patch removes unappropriate non-breaking spaces (&nbsp;) and
        inserts normal spaces instead.

        * editing/deleting/2610675-1-expected.txt: Replaced.
        * editing/deleting/2610675-2-expected.txt: Replaced.
        * editing/deleting/2610675-3-expected.txt: Replaced.
        * editing/inserting/insert-before-link-1-expected.txt: Replaced.
        * editing/inserting/space-after-removeformat-expected.txt: Added.
        * editing/inserting/space-after-removeformat.html: Added.
        * platform/mac/editing/execCommand/5482023-expected.checksum: Replaced.
        * platform/mac/editing/execCommand/5482023-expected.png: Replaced.
        * platform/mac/editing/execCommand/5482023-expected.txt: Replaced.
        * platform/mac/editing/input/text-input-controller-expected.txt: Replaced.
        * platform/mac/editing/inserting/editable-html-element-expected.checksum: Replaced.
        * platform/mac/editing/inserting/editable-html-element-expected.png: Replaced.
        * platform/mac/editing/inserting/editable-html-element-expected.txt: Replaced.
        * platform/mac/editing/pasteboard/4989774-expected.checksum: Replaced.
        * platform/mac/editing/pasteboard/4989774-expected.png: Replaced.
        * platform/mac/editing/pasteboard/4989774-expected.txt: Replaced.
        * platform/mac/editing/selection/4983858-expected.checksum: Replaced.
        * platform/mac/editing/selection/4983858-expected.png: Replaced.
        * platform/mac/editing/selection/4983858-expected.txt: Replaced.

2009-06-23  Beth Dakin  <bdakin@apple.com>
        Test for https://bugs.webkit.org/show_bug.cgi?id=26523 <col>
        elements width can't be changed with javascript
        * fast/dom/HTMLTableColElement: Added.
        * fast/dom/HTMLTableColElement/resize-table-using-col-width.html: Added.
        * platform/mac/fast/dom/HTMLTableColElement: Added.
        * platform/mac/fast/dom/HTMLTableColElement/resize-table-using-col-width-expected.checksum: Added.
        * platform/mac/fast/dom/HTMLTableColElement/resize-table-using-col-width-expected.png: Added.
        * platform/mac/fast/dom/HTMLTableColElement/resize-table-using-col-width-expected.txt: Added.
2009-06-23  Ojan Vafai  <ojan@chromium.org>
        This test hits an edge case where typingStyle would never get cleared.
        In addition to making every text insertion go into its own text node,
        this caused large performance problems.
        https://bugs.webkit.org/show_bug.cgi?id=26279
            These results match how they were before r43243. It's not clear to me
            why changes to font-size are affecting text-align styling though.
        * editing/inserting/font-size-clears-from-typing-style-expected.txt: Added.
        * editing/inserting/font-size-clears-from-typing-style.html: Added.
        * editing/inserting/resources/TEMPLATE.html: Copied from LayoutTests/editing/execCommand/resources/TEMPLATE.html.
        * editing/inserting/resources/font-size-clears-from-typing-style.js: Added.
2009-06-23  Kevin McCullough  <kmccullough@apple.com>
        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
        add a blank line to pasted Facebook content (under
        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
        * editing/inserting/return-with-object-element-expected.txt: Added.
        * editing/inserting/return-with-object-element.html: Added.
2009-06-23  Simon Fraser  <simon.fraser@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=24863
        Testcase for reflections on composited layers.
        * compositing/reflections/reflection-on-composited.html: Added.
        * platform/mac/compositing/reflections/reflection-on-composited-expected.txt: Added.
2009-06-23  Antti Koivisto  <antti@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26643
        Memory cache should respect Cache-Control: no-store
        Update the test to cover no-store.
        * http/tests/cache/subresource-expiration-expected.txt:
        * http/tests/cache/subresource-expiration.html:
2009-06-23  Kevin McCullough  <kmccullough@apple.com>
        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
        after manually quoting blank line then hitting return
        * editing/inserting/insert-br-quoted-007-expected.txt: Added.
        * editing/inserting/insert-br-quoted-007.html: Added.
2009-06-23  Eric Carlson  <eric.carlson@apple.com>
        Reviewed by NOBODY, layout tests fix.
        'timeupdate' events are, by definition, timing dependent so it isn't
        a good idea to log them in layout test results.
        * media/event-attributes-expected.txt:
        * media/event-attributes.html:
2009-06-23  Eric Carlson  <eric.carlson@apple.com>
        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
        * media/event-attributes-expected.txt: Added.
        * media/event-attributes.html: Added.
        * media/progress-event-total.html: Cleanup, use event handler attributes.
        * media/progress-event.html: Ditto.
        * media/video-size-intrinsic-scale.html: Remove duplicate 'waitForEvent("ratechange")'
        * media/video-source-add-src.html: Ditto.
        * media/video-source-error.html: Ditto.
        * media/video-timeupdate-during-playback.html: Ditto.
        * platform/gtk/Skipped: Skip new test.
2009-06-23  Adam Barth  <abarth@webkit.org>
        https://bugs.webkit.org/show_bug.cgi?id=26589
        More tests for the XSSAuditor.  (I converted the server side to Perl
        after Sam reviewed the patch because the PHP scripts didn't agree with
        the Tiger and Windows buildbots.)
        * http/tests/security/xssAuditor/img-onerror-tricky-expected.txt: Added.
        * http/tests/security/xssAuditor/img-onerror-tricky.html: Added.
        * http/tests/security/xssAuditor/link-onclick-expected.txt: Added.
        * http/tests/security/xssAuditor/link-onclick.html: Added.
        * http/tests/security/xssAuditor/property-escape-expected.txt: Added.
        * http/tests/security/xssAuditor/property-escape.html: Added.
        * http/tests/security/xssAuditor/resources/echo-intertag-post-and-notify.pl: Added.
        * http/tests/security/xssAuditor/resources/echo-intertag-post.pl: Added.
        * http/tests/security/xssAuditor/resources/echo-intertag-utf-7.pl: Added.
        * http/tests/security/xssAuditor/resources/echo-intertag.php: Removed.
        * http/tests/security/xssAuditor/resources/echo-intertag.pl: Added.
        * http/tests/security/xssAuditor/resources/echo-property.pl: Added.
        * http/tests/security/xssAuditor/resources/redir.php: Added.
        * http/tests/security/xssAuditor/resources/xss.js: Added.
        * http/tests/security/xssAuditor/script-tag-convoluted-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-convoluted.html: Added.
        * http/tests/security/xssAuditor/script-tag-open-redirect-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-open-redirect.html: Added.
        * http/tests/security/xssAuditor/script-tag-post-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-post.html: Added.
        * http/tests/security/xssAuditor/script-tag-redirect-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-redirect.html: Added.
        * http/tests/security/xssAuditor/script-tag-utf-7-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-utf-7.html: Added.
        * http/tests/security/xssAuditor/script-tag-with-source-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-with-source.html: Added.
        * http/tests/security/xssAuditor/script-tag.html:
2009-06-22  Shinichiro Hamaji  <hamaji@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=17820
        Skip layout tests for DST if the test runs not in PST/PDT.
        * fast/js/date-DST-time-cusps-expected.txt:
        * fast/js/date-big-setdate-expected.txt:
        * fast/js/resources/date-DST-time-cusps.js:
        * fast/js/resources/date-big-setdate.js:
2009-06-22  Oliver Hunt  <oliver@apple.com>
        Bug 26640: JSON.stringify needs to special case Boolean objects
        <https://bugs.webkit.org/show_bug.cgi?id=26640>
        Add tests for serialisation of wrapped and unwrapped primitives.
        * fast/js/JSON-stringify-expected.txt:
        * fast/js/resources/JSON-stringify.js:
        * fast/js/resources/json2-es5-compat.js:
          Modify Str() to match ES5 errata
2009-06-22  Sam Weinig  <sam@webkit.org>
        Add event handler attribute getter/setters to HTMLFrameSetElement
        as specified in HTML 5.  These match the ones on HTMLBodyElement.
        * fast/dom/event-attribute-availability-expected.txt:
        * fast/dom/resources/event-attribute-availability.js:
2009-06-22  Oliver Hunt  <oliver@apple.com>
        Bug 26591: Support revivers in JSON.parse
        <https://bugs.webkit.org/show_bug.cgi?id=26591>
        Test cases for JSON.parse with a reviver function.
        * fast/js/JSON-parse-expected.txt:
        * fast/js/resources/JSON-parse.js:
        (createTests.log):
        (createTests.result):
        (createTests.logOrder):
        (createTests.var):
        (createTests.throwAfterFifthCall):
        (createTests):
2009-06-22  Simon Fraser  <simon.fraser@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26430
        Testcase for a layer's composited position being affected by a later sibling.
        * compositing/sibling-positioning.html: Added.
        * platform/mac/compositing/sibling-positioning-expected.txt: Added.
2009-06-22  Sam Weinig  <sam@webkit.org>
        Add event handler attribute getter/setters to HTMLBodyElement
        as specified in HTML 5.
        * fast/dom/event-attribute-availability-expected.txt:
        * fast/dom/resources/event-attribute-availability.js:
2009-06-22  David Levin  <levin@chromium.org>
        Fix layout tests to account for removal of DOMStringList, which was done
        in http://trac.webkit.org/changeset/44943.
2009-06-22  David Levin  <levin@chromium.org>
        Reviewed by David Hyatt and Eric Seidel.
        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
        https://bugs.webkit.org/show_bug.cgi?id=26326
        Test that refreshing an iframe with custom scrollbars works without crashing.
        * scrollbars/resources/page-with-custom-scrollbars.html: Added.
        * scrollbars/scrollbar-crash-on-refresh-expected.txt: Added.
        * scrollbars/scrollbar-crash-on-refresh.html: Added.
2009-06-22  Dan Bernstein  <mitz@apple.com>
        - test for https://bugs.webkit.org/show_bug.cgi?id=23606
          <rdar://problem/6537777> CSS gradient not repainted when image load
          completes
        * fast/repaint/background-generated.html: Added.
        * platform/mac/fast/repaint/background-generated-expected.checksum: Added.
        * platform/mac/fast/repaint/background-generated-expected.png: Added.
        * platform/mac/fast/repaint/background-generated-expected.txt: Added.
2009-06-22  Darin Adler  <darin@apple.com>
        * platform/gtk/Skipped: Skip two new tests.
2009-06-22  Darin Adler  <darin@apple.com>
        * fast/js/JSON-stringify-expected.txt: Update results.
2009-06-21  Oliver Hunt  <oliver@apple.com>
        Bug 26592: Support standard toJSON functions
        Add tests of Date.toJSON.
        * fast/js/JSON-stringify-expected.txt:
        * fast/js/resources/JSON-stringify.js:
        (createTests.result):
        (createTests.result.push.):
2009-06-21  Oliver Hunt  <oliver@apple.com>
        Bug 26594: JSC needs to support Date.toISOString
        <https://bugs.webkit.org/show_bug.cgi?id=26594>
        A few basic correctness tests for Date.toISOString.
        * fast/js/date-toisostring-expected.txt: Added.
        * fast/js/date-toisostring.html: Added.
        * fast/js/resources/date-toisostring.js: Added.
2009-06-21  Sam Weinig  <sam@webkit.org>
        Test for https://bugs.webkit.org/show_bug.cgi?id=26596
        Only expose event handler attributes to elements and documents.
        * fast/dom/event-attribute-availability-expected.txt: Added.
        * fast/dom/event-attribute-availability.html: Added.
        * fast/dom/resources/event-attribute-availability.js: Added.
2009-06-21  Daniel Bates  <dbates@intudata.com>
        Reviewed by Adam Barth.
        Test for https://bugs.webkit.org/show_bug.cgi?id=26580
        Tests that XSSAuditor (if enabled) prevents script execution in child window.
        * http/tests/security/xssAuditor/link-opens-new-window-expected.txt: Added.
        * http/tests/security/xssAuditor/link-opens-new-window.html: Added.
        * http/tests/security/xssAuditor/resources/echo-intertag-and-notify.php: Added.
2009-06-21  Dan Bernstein  <mitz@apple.com>
        - make repaint tests more reliable when run in Safari
        * fast/repaint/resources/repaint.js:
        (runRepaintTest): Increased the timeout from 0 to 100, to ensure that
        painting occurs once before repaintTest() is called.
2009-06-21  Oliver Hunt  <oliver@apple.com>
        Reviewed by Darin Adler and Cameron Zwarich.
        Bug 26587: Support JSON.parse
        Add tests to cover basic usage of JSON.parse
        * fast/js/JSON-parse.html: Added.
        * fast/js/JSON-parse-expected.txt: Added.
        * fast/js/resources/JSON-parse.js: Added.
        (createTests.result):
        (createTests):
2009-06-21  Drew Wilson  <atwilson@google.com>

        Reviewed by David Levin.

        <https://bugs.webkit.org/show_bug.cgi?id=26448>
        New tests for MessagePort GC cases that weren't previously covered.
        * fast/events/message-channel-gc-4-expected.txt: Added.
        Test for case where both MessagePorts are in-transit (cloned) when a GC occurs.
        * fast/events/message-channel-gc-4.html-disabled: Added.
2009-06-21  Drew Wilson  <atwilson@google.com>
        Reviewed by David Levin.
        <https://bugs.webkit.org/show_bug.cgi?id=25043>
        Updated MessageChannel/MessagePorts tests to reflect latest spec (close event has been removed).
        Added more tests of port cloning.
        * fast/events/message-channel-gc-2-expected.txt:
        * fast/events/message-channel-gc-2.html-disabled:
        * fast/events/message-channel-gc-3-expected.txt:
        * fast/events/message-channel-gc-3.html-disabled:
        * fast/events/message-channel-gc-expected.txt:
        * fast/events/message-channel-gc.html-disabled:
        * fast/events/message-port-clone-expected.txt: Added.
        * fast/events/message-port-clone.html-disabled: Added.
        * fast/events/message-port-expected.txt:
        * fast/events/message-port-no-wrapper-expected.txt: Added.
        * fast/events/message-port-onclose-expected.txt: Removed.
        * fast/events/message-port-onclose.html-disabled: Removed.
        * fast/events/message-port.html-disabled:
2009-06-21  Dan Bernstein  <mitz@apple.com>
        - test for https://bugs.webkit.org/show_bug.cgi?id=15383
          <rdar://problem/5682745> resize: vertical does not restrict to vertical
          resize
        * fast/css/resize-single-axis-expected.txt: Added.
        * fast/css/resize-single-axis.html: Added.
2009-06-21  Sam Weinig  <sam@webkit.org>
        Test for https://bugs.webkit.org/show_bug.cgi?id=26578
        event.currentTarget for listener registered on window should point to the window object like in Firefox
        * fast/events/event-trace-expected.txt: Added.
        * fast/events/event-trace.html: Added.
2009-06-21  Dan Bernstein  <mitz@apple.com>
        - test for https://bugs.webkit.org/show_bug.cgi?id=9694
          resize value not compared
        * fast/css/resize-value-compared-expected.txt: Added.
        * fast/css/resize-value-compared.html: Added.
2009-06-21  Darin Adler  <darin@apple.com>
        * platform/gtk/Skipped: Skip one more test.
2009-06-20  Darin Adler  <darin@apple.com>
        * platform/gtk/Skipped: Skip some new tests.
2009-06-19  Alice Liu  <alice.liu@apple.com>
        Fix https://bugs.webkit.org/show_bug.cgi?id=26568
        Repro crash animating GIF if previously used in a closed window's back/forward list
        Also filed as <rdar://problem/6978362>
        Adding resource used in WebCore/manual-tests/animated-gif-bfcache-crash.html
        * http/tests/misc/resources/animated-gif-with-offsets.gif: Added.
2009-06-20  Sam Weinig  <sam@webkit.org>
        Reviewed by Adam Barth.
        Test for https://bugs.webkit.org/show_bug.cgi?id=26554
        Test writing to parent and top.
        * http/tests/security/cross-frame-access-put-expected.txt:
        * http/tests/security/cross-frame-access-put.html:
        * http/tests/security/resources/cross-frame-iframe-for-put-test.html:
2009-06-20  Mark Rowe  <mrowe@apple.com>
        Test for <https://bugs.webkit.org/show_bug.cgi?id=15106>.
        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
        * editing/selection/user-drag-element-and-user-select-none-expected.txt: Added.
        * editing/selection/user-drag-element-and-user-select-none.html: Added.
2009-06-20  Darin Adler  <darin@apple.com>
        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
        https://bugs.webkit.org/show_bug.cgi?id=26528
        rdar://problem/6985329
        * editing/selection/find-in-text-control-expected.txt: Updated to expect
        finding text in <input type="text"> and <input type="search">, but not
        in <input type="password">.
        * editing/selection/find-in-text-control.html: Added tests for <input>
        elements as well as <textarea> elements. Also tweaked result output
        format to accomodate multiple text nodes.
2009-06-20  Xan Lopez  <xlopez@igalia.com>
        Skip new accessibility test, we still lack and accessibilityController.
2009-06-20  Xan Lopez  <xlopez@igalia.com>
        We don't seem to support these new HTTP tests either, skip them.
2009-06-20  Xan Lopez  <xlopez@igalia.com>
        Skip test that requires eventSender.
2009-06-19  Ryosuke Niwa  <rniwa@google.com>
        This fixs the bug 26361. The original test case did not invoke the event that
        triggered the actual test. This patch adds code to invoke this event, and also
        converts it from a pixel test to a dumpAsText test.
        * editing/deleting/5156801-expected.txt: Added.
        * editing/deleting/5156801.html:
        * platform/mac/editing/deleting/5156801-expected.checksum: Removed.
        * platform/mac/editing/deleting/5156801-expected.png: Removed.
        * platform/mac/editing/deleting/5156801-expected.txt: Removed.
        * platform/qt/editing/deleting/5156801-expected.txt: Removed.
2009-06-19  David Hyatt  <hyatt@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26547
        Implement the IDL interface for HTMLDataGridColELement.
2009-06-19  Dan Bernstein  <mitz@apple.com>
        - text for <rdar://problem/6967596> Safari hung using 100% CPU when I
          tried to look up a word in Dictionary using command-control-d
        * editing/selection/move-by-line-005-expected.txt: Added.
        * editing/selection/move-by-line-005.html: Added.
2009-06-19  Dan Bernstein  <mitz@apple.com>
        Reviewed by Anders Carlsson.
        - update test results after r44806
        * platform/mac/fast/replaced/width100percent-searchfield-expected.txt:
2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=26426
        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
        The original number cannot be represented by mantissa of float
        (23bit) so that it caused some error.
        * fast/canvas/image-object-in-canvas.html:
        * platform/mac/fast/canvas/image-object-in-canvas-expected.txt:
2009-06-18  Adam Barth  <abarth@webkit.org>
        Reviewed by Sam Weinig.
        https://bugs.webkit.org/show_bug.cgi?id=26199
        Added a basic test for the XSSAuditor.
        * http/tests/security/xssAuditor/resources/echo-intertag.php: Added.
        * http/tests/security/xssAuditor/script-tag-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag.html: Added.
2009-06-18  Dirk Schulze  <krit@webkit.org>
        Test for feOffset with the primitiveUnits objectBoundingBox
        and userSpaceOnUse.
        * platform/mac/svg/filters/feOffset-expected.checksum: Added.
        * platform/mac/svg/filters/feOffset-expected.png: Added.
        * platform/mac/svg/filters/feOffset-expected.txt: Added.
        * svg/filters/feOffset.svg: Added.
2009-06-18  Dirk Schulze  <krit@webkit.org>
        Added a test of batik and a own one to check behavior of the
        new feTile effect in SVG.
        * platform/mac/svg/batik/filters/feTile-expected.checksum: Added.
        * platform/mac/svg/batik/filters/feTile-expected.png: Added.
        * platform/mac/svg/batik/filters/feTile-expected.txt: Added.
        * platform/mac/svg/filters/feTile-expected.checksum: Added.
        * platform/mac/svg/filters/feTile-expected.png: Added.
        * platform/mac/svg/filters/feTile-expected.txt: Added.
        * svg/batik/filters/feTile.svg: Added.
        * svg/filters/feTile.svg: Added.
2009-06-18  Dirk Schulze  <krit@webkit.org>
        Check the feMerge implementation.
        * platform/mac/svg/filters/feMerge-expected.checksum: Added.
        * platform/mac/svg/filters/feMerge-expected.png: Added.
        * platform/mac/svg/filters/feMerge-expected.txt: Added.
        * svg/filters/feMerge.svg: Added.
2009-06-18  Chris Fleizach  <cfleizach@apple.com>
        Test for Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely.
        Strangely the layout output for another test changed, but the actual test was ok.
        * accessibility/non-data-table-cell-title-ui-element-expected.txt: Added.
        * accessibility/non-data-table-cell-title-ui-element.html: Added.
        * platform/mac/accessibility/table-multi-bodies-expected.txt:
2009-06-18  Ryosuke Niwa  <rniwa@google.com>
        The following pixel tests have been converted into dumpastext tests. This
        fixes the bug 26336 partially.
        * editing/execCommand/insertHTML-expected.txt: Added.
        * editing/execCommand/insertHTML.html:
        * editing/execCommand/switch-list-type-expected.txt: Added.
        * editing/execCommand/switch-list-type.html:
        * platform/mac/editing/execCommand/insertHTML-expected.checksum: Removed.
        * platform/mac/editing/execCommand/insertHTML-expected.png: Removed.
        * platform/mac/editing/execCommand/insertHTML-expected.txt: Removed.
        * platform/mac/editing/execCommand/switch-list-type-expected.checksum: Removed.
        * platform/mac/editing/execCommand/switch-list-type-expected.png: Removed.
        * platform/mac/editing/execCommand/switch-list-type-expected.txt: Removed.
        * platform/qt/editing/execCommand/insertHTML-expected.txt: Removed.
        * platform/qt/editing/execCommand/switch-list-type-expected.txt: Removed.
2009-06-18  Ryosuke Niwa  <rniwa@google.com>
        The following pixel tests have been converted into dumpastext tests. This
        fixes the bug 26336 partially.

        * editing/execCommand/5207369-expected.txt: Added.
        * editing/execCommand/5207369.html:
        * editing/execCommand/5210032-expected.txt: Added.
        * editing/execCommand/5210032.html:
        * editing/execCommand/5432254-1-expected.txt: Added.
        * editing/execCommand/5432254-1.html:
        * platform/mac/editing/execCommand/5207369-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5207369-expected.png: Removed.
        * platform/mac/editing/execCommand/5207369-expected.txt: Removed.
        * platform/mac/editing/execCommand/5210032-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5210032-expected.png: Removed.
        * platform/mac/editing/execCommand/5210032-expected.txt: Removed.
        * platform/mac/editing/execCommand/5432254-1-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5432254-1-expected.png: Removed.
        * platform/mac/editing/execCommand/5432254-1-expected.txt: Removed.
        * platform/qt/editing/execCommand/5207369-expected.txt: Removed.
        * platform/qt/editing/execCommand/5210032-expected.txt: Removed.
        * platform/qt/editing/execCommand/5432254-1-expected.txt: Removed.

2009-06-18  Ryosuke Niwa  <rniwa@google.com>
        Reviewed by Eric Seidel.
        The following pixel tests have been converted into dumpastext tests. This
        fixes the bug 26336 partially.

        * editing/execCommand/5142012-3-expected.txt: Added.
        * editing/execCommand/5142012-3.html:
        * editing/execCommand/5144139-1-expected.txt: Added.
        * editing/execCommand/5144139-1.html:
        * editing/execCommand/5164796-expected.txt: Added.
        * editing/execCommand/5164796.html:
        * platform/mac/editing/execCommand/5142012-3-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5142012-3-expected.png: Removed.
        * platform/mac/editing/execCommand/5142012-3-expected.txt: Removed.
        * platform/mac/editing/execCommand/5144139-1-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5144139-1-expected.png: Removed.
        * platform/mac/editing/execCommand/5144139-1-expected.txt: Removed.
        * platform/mac/editing/execCommand/5164796-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5164796-expected.png: Removed.
        * platform/mac/editing/execCommand/5164796-expected.txt: Removed.
        * platform/qt/editing/execCommand/5142012-3-expected.txt: Removed.
        * platform/qt/editing/execCommand/5144139-1-expected.txt: Removed.
        * platform/qt/editing/execCommand/5164796-expected.txt: Removed.

2009-06-18  Ryosuke Niwa  <rniwa@google.com>
        Reviewed by Eric Seidel.
        The following pixel tests have been converted into dumpastext tests. This
        fixes the bug 26336 partially.

        * editing/execCommand/4916583-expected.txt: Added.
        * editing/execCommand/4916583.html:
        * editing/execCommand/5119244-expected.txt: Added.
        * editing/execCommand/5119244.html:
        * editing/execCommand/5120591-expected.txt: Added.
        * editing/execCommand/5120591.html:
        * platform/mac/editing/execCommand/4916583-expected.checksum: Removed.
        * platform/mac/editing/execCommand/4916583-expected.png: Removed.
        * platform/mac/editing/execCommand/4916583-expected.txt: Removed.
        * platform/mac/editing/execCommand/5119244-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5119244-expected.png: Removed.
        * platform/mac/editing/execCommand/5119244-expected.txt: Removed.
        * platform/mac/editing/execCommand/5120591-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5120591-expected.png: Removed.
        * platform/mac/editing/execCommand/5120591-expected.txt: Removed.
        * platform/qt/editing/execCommand/4916583-expected.txt: Removed.
        * platform/qt/editing/execCommand/5119244-expected.txt: Removed.
        * platform/qt/editing/execCommand/5120591-expected.txt: Removed.

2009-06-18  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Dan Bernstein.

        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
        starts sometimes (with hardware acceleration).

        * compositing/repaint/become-overlay-composited-layer.html: Added.
        * platform/mac/compositing/repaint/become-overlay-composited-layer-expected.txt: Added.

2009-06-18  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Maciej Stachowiak and Dave Levin.

        https://bugs.webkit.org/show_bug.cgi?id=26510
        Add tests for authentication behavior with cross-origin XMLHttpRequest

        * http/tests/xmlhttprequest/cross-origin-authorization-expected.txt: Added.
        * http/tests/xmlhttprequest/cross-origin-authorization.html: Added.
        * http/tests/xmlhttprequest/cross-origin-no-authorization-expected.txt: Added.
        * http/tests/xmlhttprequest/cross-origin-no-authorization.html: Added.
        * http/tests/xmlhttprequest/resources/cross-origin-authorization.php: Added.
        * http/tests/xmlhttprequest/resources/cross-origin-check-cookies.php: Added.
        * http/tests/xmlhttprequest/resources/cross-origin-no-authorization.php: Added.
        * http/tests/xmlhttprequest/resources/cross-origin-preset-authorization-frame.html: Added.
        * platform/mac-tiger/Skipped:
2009-06-17  Darin Adler  <darin@apple.com>
        Bug 26429: Make JSON.stringify non-recursive so it can handle objects
        of arbitrary complexity
        https://bugs.webkit.org/show_bug.cgi?id=26429
        * fast/js/JSON-stringify-expected.txt: Updated.
        * fast/js/resources/JSON-stringify.js: Changed the infinite object and
        infinite array tests to instead just test something a fixed number of
        levels deep. Otherwise we end up with an infinite loop in the test,
        which would lead to the slow-script dialog in the production web browser.
        Also raised the number from 512 to 2048 since there's no fixed limit any more.
2009-06-17  Erik Arvidsson  <arv@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=15189
        Test case for textarea input event.
        * fast/forms/resources/textarea-input-event.js: Added.
        (handleDivOnInput):
        (handleTextareaOnInput):
        * fast/forms/textarea-input-event-expected.txt: Added.
        * fast/forms/textarea-input-event.html: Added.
2009-06-18  Rob Buis  <rwlbuis@gmail.com>
        Reviewed by Niko.
        https://bugs.webkit.org/show_bug.cgi?id=26385
        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
        Also do the isValid check for outer <svg>.
        * platform/mac/svg/custom/outer-svg-unknown-feature-expected.checksum: Added.
        * platform/mac/svg/custom/outer-svg-unknown-feature-expected.png: Added.
        * platform/mac/svg/custom/outer-svg-unknown-feature-expected.txt: Added.
        * svg/custom/outer-svg-unknown-feature.svg: Added.
2009-06-18  Simon Fraser  <simon.fraser@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26499
        New expected results after making <video> elements get RenderLayers.
        * platform/mac/fast/replaced/border-radius-clip-expected.txt:
2009-06-18  Dan Bernstein  <mitz@apple.com>
        - test and updated result for <rdar://problem/6913221>
          REGRESSION (Safari 3-4): Search field on apple.com cuts entered text
        * fast/forms/search-vertical-alignment.html: Added.
        * platform/mac/fast/forms/search-vertical-alignment-expected.checksum: Added.
        * platform/mac/fast/forms/search-vertical-alignment-expected.png: Added.
        * platform/mac/fast/forms/search-vertical-alignment-expected.txt: Added.
        * platform/mac/fast/forms/search-zoomed-expected.checksum:
        * platform/mac/fast/forms/search-zoomed-expected.png:
        * platform/mac/fast/forms/search-zoomed-expected.txt:
2009-06-18  Chris Evans  <scarybeasts@gmail.com>
        Reviewed by Adam Barth.
        Added test for bug 26454 (broken 8-digit hex entities).
        https://bugs.webkit.org/show_bug.cgi?id=26454
        * fast/parser/eightdigithexentity-expected.txt: Added.
        * fast/parser/eightdigithexentity.html: Added.
2009-06-17  Gavin Barraclough  <barraclough@apple.com>
        Reviewed by Mark Rowe.
        Add tests to check shifts by non-constant amounts.
        * fast/js/kde/operators-expected.txt:
        * fast/js/kde/resources/operators.js:
2009-06-17  Simon Fraser  <simon.fraser@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26499
        New expected results after making <video> elements get RenderLayers.
        * platform/mac/media/video-aspect-ratio-expected.txt:
        * platform/mac/media/video-controls-rendering-expected.txt:
        * platform/mac/media/video-display-toggle-expected.txt:
        * platform/mac/media/video-empty-source-expected.txt:
        * platform/mac/media/video-zoom-controls-expected.txt:
        * platform/mac/media/video-zoom-expected.txt:
2009-06-17  Simon Fraser  <simon.fraser@apple.com>
        Update results after enabling 3d rendering on SnowLeopard.

        * platform/mac-leopard/fast/media/mq-transform-02-expected.checksum: Copied from LayoutTests/platform/mac/fast/media/mq-transform-02-expected.checksum.
        * platform/mac-leopard/fast/media/mq-transform-02-expected.png: Copied from LayoutTests/platform/mac/fast/media/mq-transform-02-expected.png.
        * platform/mac-leopard/fast/media/mq-transform-02-expected.txt: Copied from LayoutTests/platform/mac/fast/media/mq-transform-02-expected.txt.
        * platform/mac-leopard/fast/media/mq-transform-03-expected.checksum: Copied from LayoutTests/platform/mac/fast/media/mq-transform-03-expected.checksum.
        * platform/mac-leopard/fast/media/mq-transform-03-expected.png: Copied from LayoutTests/platform/mac/fast/media/mq-transform-03-expected.png.
        * platform/mac-leopard/fast/media/mq-transform-03-expected.txt: Copied from LayoutTests/platform/mac/fast/media/mq-transform-03-expected.txt.
        Copy the old "mac" results to "mac-leopard" since 3d-rendering is disabled there.

        * platform/mac/fast/media/mq-transform-02-expected.checksum:
        * platform/mac/fast/media/mq-transform-02-expected.png:
        * platform/mac/fast/media/mq-transform-02-expected.txt:
        * platform/mac/fast/media/mq-transform-03-expected.checksum:
        * platform/mac/fast/media/mq-transform-03-expected.png:
        * platform/mac/fast/media/mq-transform-03-expected.txt:
        New "mac" results for 3d rendering enabled.

        * platform/mac/transforms/3d/point-mapping/3d-point-mapping-2-expected.txt:
        * platform/mac/transforms/3d/point-mapping/3d-point-mapping-deep-expected.txt:
        * platform/mac/transforms/3d/point-mapping/3d-point-mapping-expected.txt:
        * platform/mac/transforms/3d/point-mapping/3d-point-mapping-origins-expected.txt:
        * platform/mac/transforms/3d/point-mapping/3d-point-mapping-preserve-3d-expected.txt:
        Update the results now that these tests are active.

2009-06-17  David Hyatt  <hyatt@apple.com>
        Reviewed by Anders Carlsson.
        Update window properties layout test for HTMLDataGridElement addition.
2009-06-17  Adam Roben  <aroben@apple.com>
        Fix Skipped file format after r44519
        * platform/qt/Skipped:
        * platform/win/Skipped:
        Removed bogus ": Added."s in these files.
2009-06-17  David Levin  <levin@chromium.org>
        Reviewed by NOBODY, layout tests fix.
        https://bugs.webkit.org/show_bug.cgi?id=26326
        This reverts commit r44751.
        Once that change was checked scrollbars/scrollbar-orientation.html started
        crashing on Windows.
        * scrollbars/resources/page-with-custom-scrollbars.html: Removed.
        * scrollbars/scrollbar-crash-on-refresh-expected.txt: Removed.
        * scrollbars/scrollbar-crash-on-refresh.html: Removed.
2009-06-16  David Levin  <levin@chromium.org>
        Reviewed by David Hyatt.
        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
        https://bugs.webkit.org/show_bug.cgi?id=26326
        Test that refreshing an iframe with custom scrollbars works without crashing.
        * scrollbars/resources/page-with-custom-scrollbars.html: Added.
        * scrollbars/scrollbar-crash-on-refresh-expected.txt: Added.
        * scrollbars/scrollbar-crash-on-refresh.html: Added.
2009-06-16  Xan Lopez  <xlopez@igalia.com>
        Disable another new test.
        * platform/gtk/Skipped:
2009-06-16  Jian Li  <jianli@chromium.org>
        Reviewed by Adam Barth and David Levin.
        Bug 26146: Change to use ThreadableLoader to load the worker script
        in order to check URL origin for redirection.
        https://bugs.webkit.org/show_bug.cgi?id=26146
        Add a layout test to cover the scenario that the worker script is
        loaded from different redirect origin.
        * http/tests/workers/resources/worker-redirect-target.js: Added.
        * http/tests/workers/worker-redirect-expected.txt: Added.
        * http/tests/workers/worker-redirect.html: Added.
2009-06-16  Xan Lopez  <xlopez@igalia.com>
        editing/deleting/4875189.html was changed from pixel to
        dumpAsText, so remove it from Skipped list.
        * platform/gtk/Skipped:
2009-06-16  Xan Lopez  <xlopez@igalia.com>
        Fix typo in test name.
        * platform/gtk/Skipped:
2009-06-16  Xan Lopez  <xlopez@igalia.com>
        Disable new tests.
        * platform/gtk/Skipped:
== Rolled over to ChangeLog-2009-06-16 ==
++ b/SunSpider/ChangeLog
2009-06-19  Adam Treat  <adam.treat@torchmobile.com>

        Reviewed by Oliver Hunt.

        https://bugs.webkit.org/show_bug.cgi?id=26540
        Currently the SunSpider test driver lacks an option to run a test suite that
        will test JavaScriptCore parsing performance only.  This patch adds just such
        a test suite and option to SunSpider as well as the jsc test shell.  I've included
        three large javascript source files found in the wild: jquery, mootools and prototype.
        Combined with the concatenation of all three, these form a new testsuite to measure
        and test pure JavaScriptCore parsing performance.

        * resources/sunspider-standalone-driver.js:
          Load the js with parse-only flag if it is part of the parse-only suite.
        * sunspider:
          Add the parse-only suite to the list of options.
        * sunspider-compare-results:
          Add the parse-only suite to the list of options.
        * tests/LIST-PARSE-ONLY: Added.
        * tests/parse-only/concat-jquery-mootools-prototype.js: Added.
          A very large concatenation of the scripts found below.  This js takes ~30ms to parse on my machine.
        * tests/parse-only/jquery-1.3.2.js: Added.
          Latest version from jquery.com.
        * tests/parse-only/mootools-1.2.2-core-nc.js: Added.
          Latest version from mootools.net.
        * tests/parse-only/prototype-1.6.0.3.js: Added.
          Latest version from prototypejs.org.

2009-06-13  Steve Falkenburg  <sfalken@apple.com>

        Update V8 benchmark to version 4.

        Reviewed by Cameron Zwarich.

        * tests/LIST-V8:
        * tests/v8-crypto.js:
        * tests/v8-deltablue.js:
        * tests/v8-earley-boyer.js:
        * tests/v8-raytrace.js:
        * tests/v8-regexp.js: Added.
        * tests/v8-richards.js:
        * tests/v8-splay.js: Added.

++ b/WebCore/ChangeLog
2009-06-24  Kevin Watters  <kevinwatters@gmail.com>
        Don't use an unsigned int for intervalInMS because we sometimes initialize
        it with a negative value.
        * platform/wx/SharedTimerWx.cpp:
        (WebCore::setSharedTimerFireTime):
2009-06-24  Eric Seidel  <eric@webkit.org>
        No review, build fix only.
        The previous checkin had an improper merge.  This fixes the build.
        (WebCore::DragController::tryDocumentDrag):
2009-06-05  Eric Seidel  <eric@webkit.org>
        https://bugs.webkit.org/show_bug.cgi?id=25922
        JS setting dropEffect = "none" causes tryDHTMLDrag
        to return DragOperationNone.  Which is also the value
        tryDHTMLDrag previously used to indicate JS did not
        want to handle the drag.
        Make it possible for the DragController::try* methods
        to return a bool to indicate if javascript accepted
        or rejected the drag event, separate from the DragOperation.
        Tests:
        - fast/events/drag-to-navigate.html
        - fast/events/prevent-drag-to-navigate.html
        (WebCore::defaultOperationForDrag):
2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
        Reviewed by Sam Weinig and Dave Hyatt.
        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
        <https://bugs.webkit.org/show_bug.cgi?id=25920>
        Add support for drawing the contents of the video element to the canvas
        in accordance with the current HTML5 draft.
        Test: media/video-canvas.html
        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
        (WebCore::JSCanvasRenderingContext2D::drawImage):
          Standard custom bindings stuff we need to do for all canvas methods.
        * html/CanvasRenderingContext2D.cpp:
        (WebCore::size): Helper function for finding the size of a video element
        (WebCore::CanvasRenderingContext2D::checkOrigin): moved up in the file.
        (WebCore::CanvasRenderingContext2D::drawImage): The various overloads of HTML5's drawImage(<video>)
        * html/CanvasRenderingContext2D.h:
        (WebCore::HTMLMediaElement::hasSingleSecurityOrigin):
          hasSingleSecurityOrigin is needed for security, currently all implementations are trivial
          as we force QT to maintain a single origin.
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::paint):
            Paint routine on video so we don't have to look at MediaPlayer directly
        * html/HTMLVideoElement.h:
        (WebCore::NullMediaPlayerPrivate::hasSingleSecurityOrigin):
        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
            Default implementations of hasSingleSecurityOrigin
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
            A video may need a player now even if it is not visible.
        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
            Always return true due to restrictions we've placed on QT.
        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
        (WebCore::MediaPlayerPrivate::paint):
            Jump through some hoops to allow windows QT to draw to an intermediate buffer.
            In the long term we'd like to cache the HDC, but this will do for now.
        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
            As for Mac we force QT to only allow same origin loads.
2009-06-23  Adam Langley  <agl@google.com>
        Chromium: Fix crash with inherited font-size in <option>
        https://bugs.webkit.org/show_bug.cgi?id=26656
        http://code.google.com/p/chromium/issues/detail?id=14853
        In r42597 (https://bugs.webkit.org/show_bug.cgi?id=25244), I changed
        the <select> handing for Chromium to fix a rendering bug. However,
        although the font-size is correctly ignored, getRowHeight wasn't
        updated and so was calculating the height of the rows in an
        inconsistent manner. This can lead to a crash.
        * manual-tests/optgroup-empty-and-nested.html: adding test case for crash
        (WebCore::PopupListBox::getRowHeight):
2009-06-23  Brady Eidson  <beidson@apple.com>
        Patch by Antti Koivisto.
        Reviewed by Brady Eidson.
        <rdar://problem/6988010> Failed resources not reloaded when built against Tiger SDK
        A latent bug that cache revalidation uncovered.  When a CachedResource failed to load,
        it should always be revalidated upon reload.
        * loader/CachedResource.cpp:
        (WebCore::CachedResource::canUseCacheValidator):
        (WebCore::CachedResource::mustRevalidate):
2009-06-23  Dan Bernstein  <mitz@apple.com>
        - fix <rdar://problem/6634228> Crash in [NSScroller mouseDown:] beneath
          EventHandler::passMouseDownEventToWidget()
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::passMouseDownEventToWidget): Surround the
        -mouseDown: call with calls to Widget::beforeMouseDown() and
        Widget::afterMouseDown(), which prevent the widget's view hierarchy from
        being removed from its parent view while the scroller is tracking the
        mouse.
2009-06-23  Sam Weinig  <sam@webkit.org>
        Fix for https://bugs.webkit.org/show_bug.cgi?id=26516
        Add initial implementation of DataGridDataSource
        - Initial implementation only supports the initialize callback function.
        Test: fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDataGridDataSource.cpp: Added.
        (WebCore::JSDataGridDataSource::JSDataGridDataSource):
        (WebCore::JSDataGridDataSource::~JSDataGridDataSource):
        (WebCore::JSDataGridDataSource::initialize):
        * bindings/js/JSDataGridDataSource.h: Added.
        (WebCore::JSDataGridDataSource::create):
        (WebCore::JSDataGridDataSource::isJSDataGridDataSource):
        (WebCore::JSDataGridDataSource::jsDataSource):
        (WebCore::asJSDataGridDataSource):
        * bindings/js/JSHTMLDataGridElementCustom.cpp: Added.
        (WebCore::JSHTMLDataGridElement::listener):
        (WebCore::JSHTMLDataGridElement::setListener):
        * html/DataGridDataSource.h: Added.
        (WebCore::DataGridDataSource::~DataGridDataSource):
        (WebCore::DataGridDataSource::isJSDataGridDataSource):
        * html/HTMLDataGridElement.cpp:
        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
        (WebCore::HTMLDataGridElement::setDataSource):
        (WebCore::HTMLDataGridElement::initializationTimerFired):
        * html/HTMLDataGridElement.h:
        (WebCore::HTMLDataGridElement::dataSource):
        * html/HTMLDataGridElement.idl:
2009-06-23  Ryosuke Niwa  <rniwa@google.com>
        Undo the changeset 21212 to fix the regression bug 14062.
        The changeset 21212 attempted to fix rdar://problem/5002441.
        The changeset 21212 modified InsertTextCommand::input so as to convert
        all spaces in text to non-breaking spaces for rdar://problem/5002441.
        However, the bug was originally caused by rebalanceWhitespaceAt
        and this workaround introduced a regression bug 14062.
        Because rebalanceWhitespaceAt appears to behave correctly now,
        the workaround introduced in 21212 is no longer needed.
        Test: editing/inserting/space-after-removeformat.html
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::input):
2009-06-23  Beth Dakin  <bdakin@apple.com>
        Reviewed by Dave Hyatt.
        Fix for https://bugs.webkit.org/show_bug.cgi?id=26523 <col>
        elements width can't be changed with javascript
        This patch both fixes setting the width attribute directly in
        JavaScript, and setting the width on the style attribute.
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseMappedAttribute): If we have a
        new width, call setNeedsLayoutAndPrefWidthsRecalc()
        Call calcPrefWidths() on the table cols.
        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::recalcColumn):
        * rendering/FixedTableLayout.cpp:
        (WebCore::FixedTableLayout::calcWidthArray):
        Call layoutIfNeeded on the table cols.
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::layout):
        * rendering/RenderTableCol.cpp:
        (WebCore::RenderTableCol::clippedOverflowRectForRepaint): Use new
        table() convenience function.
        (WebCore::RenderTableCol::calcPrefWidths): Just call
        setPrefWidthsDirty(false) on ourself and our children.
        (WebCore::RenderTableCol::table):
        * rendering/RenderTableCol.h:
2009-06-23  Ojan Vafai  <ojan@chromium.org>
        Reviewed by Dan Bernstein.
        Add logic to CSSStyleDeclaration::diff to deal with font-sizes that are
        keyword values. When diff is called on a CSSStyleDeclaration, we check
        the keywordSize to see if font-size matches a keyword value.
        This ensures that when we diff a CSSMutableStyleDeclaration returned from
        copyInheritableProperties on a CSSComputedStyleDeclaration that we
        correctly identify matching font-sizes.
        https://bugs.webkit.org/show_bug.cgi?id=26279
        Test: editing/inserting/font-size-clears-from-typing-style.html
        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
        * css/CSSStyleDeclaration.cpp:
        (WebCore::CSSStyleDeclaration::cssPropertyMatches):
        (WebCore::CSSStyleDeclaration::diff):
        * css/CSSStyleDeclaration.h:
2009-06-23  Kevin McCullough  <kmccullough@apple.com>
        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
        add a blank line to pasted Facebook content (under
        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
        - Just added null checks and I will create a new bug to prevent the
        bad behavior.
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
2009-06-23  Simon Fraser  <simon.fraser@apple.com>
        Build fix.
        Wrap shouldDoSoftwarePaint() in #if USE(ACCELERATED_COMPOSITING) to avoid warning when
        ACCELERATED_COMPOSITING is not defined.
        * rendering/RenderLayer.cpp:
2009-06-23  Simon Fraser  <simon.fraser@apple.com>
        Reviewed by Dave Hyatt.
        https://bugs.webkit.org/show_bug.cgi?id=24863
        Fix reflection painting on elements with compositing layers.
        Test: compositing/reflections/reflection-on-composited.html
        * rendering/RenderLayer.h:
        Add a new PaintLayerPaintingReflection flag which is set while painting inside
        reflections.
        (WebCore::RenderLayer::setPaintingInsideReflection):
        Add a setter so that RenderLayerBacking can call it.
        * rendering/RenderLayer.cpp:
        (WebCore::shouldDoSoftwarePaint):
        Utility to clarify the logic of when a composited layer should do a software paint.
        (WebCore::RenderLayer::paintLayer):
        Use shouldDoSoftwarePaint() to determine when to software-paint a reflected layer.
        Remove transform-related tests from the reflection-painting if test because they appear
        to be unnecessary.
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::paintIntoLayer):
        Add the code to paint reflections to the composited layer painting method.
        * rendering/RenderReplica.cpp:
        (WebCore::RenderReplica::paint):
        Set the PaintLayerPaintingReflection flag.
2009-06-23  Antti Koivisto  <antti@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26643
        Memory cache should respect Cache-Control: no-store
        Make resources with Cache-Control: no-store uncacheable in the memory cache.
        They get evicted immediately when all clients are gone and are always
        reloaded from the server.
        Conforms to RFC2616 14.9.2 and seems also match Firefox behavior.
        * loader/CachedResource.cpp:
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::canUseCacheValidator):
        (WebCore::CachedResource::mustRevalidate):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::ResourceResponseBase):
        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
        (WebCore::ResourceResponseBase::cacheControlContainsNoStore):
        * platform/network/ResourceResponseBase.h:
2009-06-23  Brady Eidson  <beidson@apple.com>
        Windows build fix.
        (QTMovieWin::play):
        (QTMovieWin::pause):
        (QTMovieWin::setRate):
        (QTMovieWin::setCurrentTime):
2009-06-23  Kevin McCullough  <kmccullough@apple.com>
        Reviewed by Adele Peterson.
        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
        after manually quoting blank line then hitting return
        If the insertion point is both the begining and ending visible position
        then we need to insert at the end instead of the begining, which is what
        would normally happen if the insertion point was as the begining.
2009-06-23  Brady Eidson  <beidson@apple.com>
        Reviewed by Sam Weinig, and looked over by Eric Carlson.
        <rdar://problem/6980466> Media elements should provide option for changing pitch correction
        Introduce a new boolean property to HTMLMediaElement called webkitPreservesPitch for script to control this.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Currently the platforms that have a flexible pitch preservation
          property (Quicktime on Mac and Win) have had it on by default, so continue that default for now.
        (WebCore::HTMLMediaElement::loadResource):
        (WebCore::HTMLMediaElement::webkitPreservesPitch):
        (WebCore::HTMLMediaElement::setWebkitPreservesPitch):
        * html/HTMLMediaElement.h:
        * html/HTMLMediaElement.idl:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::setPreservesPitch):
        (WebCore::MediaPlayer::MediaPlayer):
        (WebCore::MediaPlayer::preservesPitch):
        (WebCore::MediaPlayer::setPreservesPitch):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::setPreservesPitch):
        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
        (WebCore::MediaPlayerPrivate::createQTMovie): Rework to allow recreation of the movie with almost the
          exact same attributes as before, with pitch preservation being the difference.
        (WebCore::MediaPlayerPrivate::setPreservesPitch): Recreate the QTMovie if the flag actually changes.
        (WebCore::MediaPlayerPrivate::updateStates): Restore current time and rate if this is a recreated movie.
        (WebCore::MediaPlayerPrivate::timeChanged): Clear the time-to-be-restored, as this callback means it
          has been effectively overwritten.
        (WebCore::MediaPlayerPrivate::load):
        (WebCore::MediaPlayerPrivate::setPreservesPitch):
        (QTMovieWinPrivate::QTMovieWinPrivate):
        (QTMovieWinPrivate::~QTMovieWinPrivate):
        (QTMovieWinPrivate::task): Restore current time and rate if this is a re-created movie.
        (QTMovieWin::play): Clear the time-to-be-restored, as this effectively overwrites it.
        (QTMovieWin::pause): Ditto.
        (QTMovieWin::setRate): Ditto.
        (QTMovieWin::setCurrentTime): Ditto.
        (QTMovieWin::setPreservesPitch): Recreate the Movie if the flag actually changes.
        (QTMovieWin::load): Rework to allow recreation of the Movie with similar state as the movie before it,
          but changing the pitch preservation flag.
2009-06-23  Eric Carlson  <eric.carlson@apple.com>
        <rdar://problem/6998286> Crash after leaving page with <video>

        Don't try to post events after going into the page cache.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Cancel pending events and stop
        event timers so we won't try to post events after going into the cache.
2009-06-23  Jeremy Orlow  <jorlow@chromium.org>
        Reviewed by Brady Eidson.
        Simplify the interaction between LocalStorageArea/SessionStorageArea
        and StorageArea by creating a "blockUntilImportComplete()" function
        rather than bouncing back and forth between the child and parent
        classes in a somewhat unintuitive manner.
        This patch also paves the way for LocalStorageArea and
        SessionStorageArea being merged into one.  It's part of several in a
        set which are separating syncing (to disk) code from the rest of the
        implementation so that local storage and session storage's code can be
        unified.
        https://bugs.webkit.org/show_bug.cgi?id=25376
        * storage/LocalStorageArea.cpp:
        (WebCore::LocalStorageArea::blockUntilImportComplete):
        * storage/LocalStorageArea.h:
        * storage/StorageArea.cpp:
        (WebCore::StorageArea::length):
        (WebCore::StorageArea::key):
        (WebCore::StorageArea::getItem):
        (WebCore::StorageArea::setItem):
        (WebCore::StorageArea::removeItem):
        (WebCore::StorageArea::clear):
        (WebCore::StorageArea::contains):
        * storage/StorageArea.h:
        (WebCore::StorageArea::blockUntilImportComplete):
2009-06-23  Simon Fraser  <simon.fraser@apple.com>
        Reviewed by Dave Hyatt
        First part of https://bugs.webkit.org/show_bug.cgi?id=26652

        (WebCore::RenderLayer::paint):
        (WebCore::RenderLayer::):
        (WebCore::RenderReplica::paint):
        Replace the 3 boolean params to RenderLayer::paintLayer() with a bit mask for readability.
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::paintIntoLayer):
        (WebCore::RenderLayerBacking::paintContents):
        * rendering/RenderLayerBacking.h:
        Remove the unused 'haveTransparency' param to paintIntoLayer().
2009-06-23  Simon Fraser  <simon.fraser@apple.com>
        <rdar://problem/6997929> Assertion at WebCore::RenderLayer::updateClipRects with hardware acceleration
        The updatingControlTints() painting pass goes through compositing layer boundaries,
        so we need to ensure we don't cache clip rects computed with the wrong root by
        setting temporaryClipRects to true.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintLayer):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
        Remove a printf that I left in by mistake.
2009-06-23  Anders Carlsson  <andersca@apple.com>
        WebCore side of <rdar://problem/6946094>.
        * platform/win/ClipboardWin.cpp:
        (WebCore::ClipboardWin::setExternalDataObject):
        * platform/win/ClipboardWin.h:
2009-06-23  Darin Fisher  <darin@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=26650
        Add setFormContentType and setFormData since it is awkward for Chromium
        to use setFormInfoFromRequest to set the underlying members.  Also, add
        a clearChildren method that Chromium needs.  These methods are used as
        part of the Chromium code that serializes a HistoryItem for storing in
        the browser's session history.
        * history/HistoryItem.cpp:
        * history/HistoryItem.h:
2009-06-23  Eric Carlson  <eric.carlson@apple.com>
        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
        Test: media/event-attributes.html
        * html/HTMLAttributeNames.in: Add media event attribute names.
        (WebCore::HTMLMediaElement::parseMappedAttribute): Handle media event attributes.
2009-06-23  Thiago Macieira  <thiago.macieira@nokia.com>
        Reviewed by Simon Hausmann.
        Fix Qt build with Phonon.
        The #include <phonon> header no longer exists. And the <Phonon> or
        <Phonon/Phonon> headers have never existed (neither for us nor for the
        Phonon sources). You have to select each and every header that you do
        want now.
        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
        Reviewed by Simon Hausmann.
        Remove duplicated code in Qt & GTK logging initialization
        We now share the getChannelFromName() function in Logging.cpp
        * platform/gtk/LoggingGtk.cpp:
        * platform/qt/LoggingQt.cpp:
2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
        Reviewed by Simon Hausmann.
        Rename the plugin logging channel to plural form 'Plugins'
        This matches both the other logging channel names, as well as the
        WebKit logging channel used by Safari/Mac for plugins.
        * platform/Logging.cpp:
        * platform/Logging.h:
        * platform/gtk/LoggingGtk.cpp:
        * platform/mac/LoggingMac.mm:
        * platform/qt/LoggingQt.cpp:
        * platform/win/LoggingWin.cpp:
        * plugins/PluginDebug.h:
        * plugins/gtk/PluginPackageGtk.cpp:
        * plugins/mac/PluginViewMac.cpp:
2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
        Reviewed by Simon Hausmann.
        Fix NPAPI mouse translation issues on Mac
        The WindowRef we pass to the plugin refers to the the top level window,
        so the x and y positions have to be relative to this position, but we
        have to manually compensate for title bar decorations and other parents
        of the QWebView since contentsToWindow() only traverses to the QWebView.
        Previously we did this compensation when passing on mouse coordinates to
        the plugin, which caused various issues with translations such as not
        being able to close the Flash settings dialog, or the hand cursor not
        appearing over links.
        We now do the compensation as part of the call to NPP_SetWindow, and
        then pass mouse coordinates in global context without any compensation,
        similar to how both Safari and Mozilla does it.
        * plugins/mac/PluginViewMac.cpp:
        (WebCore::PluginView::updatePluginWidget):
        (WebCore::PluginView::globalMousePosForPlugin):
2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
        Rubber-stamped by Simon Hausmann.
        [Qt] Resolve absolute path to library install_name manually
        Since our target.path is set to the Qt directory (to be able
        to do 'make install') the 'absolute_library_soname' option
        to QMake did not do the right thing.
        We now compute the absolute path manually using DESTDIR.
2009-06-22  Simon Fraser  <simon.fraser@apple.com>
        <rdar://problem/6991146> Scrollbars in hardware layers don't change to the
        inactive look in background windows
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintLayer):
        Don't short-circuit the "painting" pass that is used to udpate control tints.
2009-06-22  Dimitri Glazkov  <dglazkov@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=26567
        Upstream V8 bindings code generator. With this change, also added interface ancestor
        traversal to IDL parser, which is necessary for V8 bindings. The traversal is used
        to determine whether an interface is a Node to facilitate proper casting and storage
        in V8DOMMap.
        * bindings/scripts/CodeGenerator.pm: Added parent traversal sub, needed
            by V8 bindings.
        * bindings/scripts/CodeGeneratorV8.pm: Added.
        * bindings/scripts/IDLParser.pm: Modified to allow limited parsing for
            parent traversal cases.
2009-06-22  Sam Weinig  <sam@webkit.org>
        Add event handler attribute getter/setters to HTMLFrameSetElement
        as specified in HTML 5.  These match the ones on HTMLBodyElement.
        (WebCore::HTMLFrameSetElement::onblur):
        (WebCore::HTMLFrameSetElement::setOnblur):
        (WebCore::HTMLFrameSetElement::onerror):
        (WebCore::HTMLFrameSetElement::setOnerror):
        (WebCore::HTMLFrameSetElement::onfocus):
        (WebCore::HTMLFrameSetElement::setOnfocus):
        (WebCore::HTMLFrameSetElement::onload):
        (WebCore::HTMLFrameSetElement::setOnload):
        (WebCore::HTMLFrameSetElement::onbeforeunload):
        (WebCore::HTMLFrameSetElement::setOnbeforeunload):
        (WebCore::HTMLFrameSetElement::onmessage):
        (WebCore::HTMLFrameSetElement::setOnmessage):
        (WebCore::HTMLFrameSetElement::onoffline):
        (WebCore::HTMLFrameSetElement::setOnoffline):
        (WebCore::HTMLFrameSetElement::ononline):
        (WebCore::HTMLFrameSetElement::setOnonline):
        (WebCore::HTMLFrameSetElement::onresize):
        (WebCore::HTMLFrameSetElement::setOnresize):
        (WebCore::HTMLFrameSetElement::onstorage):
        (WebCore::HTMLFrameSetElement::setOnstorage):
        (WebCore::HTMLFrameSetElement::onunload):
        (WebCore::HTMLFrameSetElement::setOnunload):
        * html/HTMLFrameSetElement.h:
        * html/HTMLFrameSetElement.idl:
2009-06-22  Darin Adler  <darin@apple.com>
        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
        https://bugs.webkit.org/show_bug.cgi?id=25425
        * bindings/scripts/CodeGeneratorJS.pm: Added handling for ReflectURL.
        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
        (WebCore::Element::getURLAttribute): Added. For use implementing getters
        for ReflectURL.
        * dom/Element.h: Added getURLAttribute.
        * html/HTMLImageElement.idl: Use Reflect and ReflectURL.
2009-06-22  Jian Li  <jianli@chromium.org>
        Bug 26626: Make WorkerContextExecutionProxy::toV8Object handle exception
        objects.
        https://bugs.webkit.org/show_bug.cgi?id=26626
        (WebCore::WorkerContextExecutionProxy::ToV8Object):
2009-06-22  David Hyatt  <hyatt@apple.com>
        Add RenderDataGrid to the build.  Give it some basic default styling (that more or less matches a listbox).  It has a default size
        of 300x150.
        * GNUmakefile.am:
        * WebCoreSources.bkl:
        * html/HTMLDataGridElement.cpp:
        (WebCore::HTMLDataGridElement::createRenderer):
        * html/HTMLDataGridElement.h:
        * html/HTMLDataGridElement.idl:
        * rendering/RenderDataGrid.cpp: Added.
        (WebCore::RenderDataGrid::RenderDataGrid):
        (WebCore::RenderDataGrid::~RenderDataGrid):
        (WebCore::RenderDataGrid::calcPrefWidths):
        (WebCore::RenderDataGrid::paintObject):
        (WebCore::RenderDataGrid::valueChanged):
        (WebCore::RenderDataGrid::invalidateScrollbarRect):
        (WebCore::RenderDataGrid::isActive):
        * rendering/RenderDataGrid.h: Added.
        (WebCore::RenderDataGrid::renderName):
        (WebCore::RenderDataGrid::canHaveChildren):
        (WebCore::RenderDataGrid::scrollbarCornerPresent):
2009-06-22  Simon Fraser  <simon.fraser@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26430
        <rdar://problem/6944442> Elements jump around when they become composited (WWDC checkers demo)
        <rdar://problem/6989006> Lots of time spent in RenderLayerCompositor::calculateCompositedBounds()
            during window resize when using hardware layers
        Fix an ordering dependency which caused the compositing position of a layer
        to be affected by some later sibling, which affected the compositing ancestor's
        composited bounds.
        The fix is to only update the compositing positions of layers in some subtree
        when updateAfterLayout() has been called on all the layers in that subtree,
        from the ancestor down.
        Also cache the composited bounds of a RenderLayerBacking, now that we can
        guarantee that those bounds are accurate.
        Test: compositing/sibling-positioning.html
        (WebCore::RenderLayer::updateLayerPositions):
        (WebCore::RenderLayerBacking::updateAfterLayout):
        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
        (WebCore::RenderLayerBacking::paintContents):
        (WebCore::RenderLayerBacking::compositedBounds):
        (WebCore::RenderLayerBacking::setCompositedBounds):
        (WebCore::RenderLayerCompositor::updateBacking):
        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
2009-06-22  Jeremy Orlow  <jorlow@chromium.org>
        First step in https://bugs.webkit.org/show_bug.cgi?id=25376
        Add StorageSyncManager.cpp/h
        In preparation for combining SessionStorage and LocalStorage into a
        single StorageManager, move the syncing bits out of LocalStorage and
        into its own class.
        The next step is to combine LocalStorageArea and SessionStorageArea
        into one.  Then SessionStorage and LocalStorage can be combined.
        Note that combining them will cut down on code paths that must be
        proxied, eliminate virtual dispatch, and allow Chromium to (eventually)
        write historical sessionStorage to disk when memory is getting tight.
        Also remove a couple bits of cruft including code for quotas which is
        unnecessary (since a meta-data db is unnecessary since you can just
        count bytes as you read the local storage databases into memory).
        * storage/LocalStorage.cpp:
        (WebCore::LocalStorage::LocalStorage):
        (WebCore::LocalStorage::storageArea):
        (WebCore::LocalStorage::close):
        * storage/LocalStorage.h:
        * storage/LocalStorageArea.cpp:
        (WebCore::LocalStorageArea::LocalStorageArea):
        (WebCore::LocalStorageArea::scheduleFinalSync):
        (WebCore::LocalStorageArea::syncTimerFired):
        (WebCore::LocalStorageArea::performImport):
        * storage/LocalStorageArea.h:
        (WebCore::LocalStorageArea::create):
        * storage/LocalStorageTask.cpp:
        (WebCore::LocalStorageTask::performTask):
        * storage/LocalStorageTask.h:
        (WebCore::LocalStorageTask::):
        (WebCore::LocalStorageTask::createImport):
        * storage/LocalStorageThread.h:
        * storage/SessionStorage.h:
        * storage/StorageSyncManager.cpp: Copied from WebCore/storage/LocalStorage.cpp.
        (WebCore::StorageSyncManager::create):
        (WebCore::StorageSyncManager::StorageSyncManager):
        (WebCore::StorageSyncManager::fullDatabaseFilename):
        (WebCore::StorageSyncManager::close):
        (WebCore::StorageSyncManager::scheduleImport):
        (WebCore::StorageSyncManager::scheduleSync):
        * storage/StorageSyncManager.h: Copied from WebCore/storage/LocalStorage.h.
        (WebCore::):
2009-06-22  Darin Fisher  <darin@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=26622
        Add ChromiumDataObject::copy()
        * platform/chromium/ChromiumDataObject.cpp:
        * platform/chromium/ChromiumDataObject.h:
2009-06-22  Timothy Hatcher  <timothy@apple.com>
        Add a silhouette image for the enable view of the Resource panel.
        Reviewed by Kevin McCullough.
        * inspector/front-end/Images/resourcesSilhouette.png: Added.
        * inspector/front-end/inspector.css:
2009-06-22  Kyle Prete  <kylep@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=26552
        Add V8 JS bindings for Audio Constructor.
        * bindings/v8/custom/V8CustomBinding.h:
        Added a callback declaration for audio ctor to macro.
        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
        Added the whole file.
2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
        Reviewed by David Levin.
        https://bugs.webkit.org/show_bug.cgi?id=26600
        StringImpl::copy() no longer copies empty string correctly
        * platform/text/StringImpl.cpp:
        (WebCore::StringImpl::ustring): Changed method calling syntax to look less like calling a
        static method.
        (WebCore::StringImpl::copy): Reverted part of r41917 that caused the problem.
2009-06-22  Xiaomei Ji  <xji@chromium.org>
        Reviewed by Eric Seidel
        Not auto-testable since it involves sending a keyboard event to
        the popup, which is not possible (eventSender sends the key
        events through webview, we want to go through the webwidget).
        This patch is one part of the fix for issue "keyboard selection in
        Hebrew select element does not work in Windows". The other part of the
        fix is in chromium's webkit/glue layer.
        https://bugs.webkit.org/show_bug.cgi?id=25899
        * manual-tests/keyboard_select_non_english.html: Added.
        (WebCore::isCharacterTypeEvent): Added. Check whether the event is a
        character type event. "Char" in Windows or "KeyDown" in Mac is character
        type event.
        (WebCore::PopupListBox::typeAheadFind): Since m_lastCharTime is used to
        indicate whether user types multiple characters continuely as a search
        prefix or not, it should be only assigned when the event is character
        type event.
2009-06-22  Kevin McCullough  <kmccullough@apple.com>
        <rdar://problem/6115819> Notify of profile start in console
        Put a message in the console that announces that a profile has started,
        similar to how a console message announces that a profile has finished.
        (WebCore::InspectorController::addProfile): Use renamed function.
        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
        Renamed.
        (WebCore::InspectorController::addStartProfilingMessageToConsole):
        New function that logs the message about the profile starting.
        (WebCore::InspectorController::startUserInitiatedProfiling): Ditto
        * inspector/InspectorController.h:
        * inspector/front-end/ProfilesPanel.js: Print the "run" of the profile's
        title if there are multiple profiles, and take into account the fact
        that titles are displayed twice as much now.
        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
        (WebCore::Console::profile): Call new function.
2009-06-22  David Hyatt  <hyatt@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26615
        Add IDL interface for datagrid cell elements.  Add a few more properties to the datagrid itself that
        correspond to ones you find on <select> elements.
        Add an expanded property to row elements.
        * html/HTMLAttributeNames.in:
        * html/HTMLDataGridCellElement.cpp: Added.
        (WebCore::HTMLDataGridCellElement::HTMLDataGridCellElement):
        (WebCore::HTMLDataGridCellElement::label):
        (WebCore::HTMLDataGridCellElement::setLabel):
        (WebCore::HTMLDataGridCellElement::focused):
        (WebCore::HTMLDataGridCellElement::setFocused):
        (WebCore::HTMLDataGridCellElement::checked):
        (WebCore::HTMLDataGridCellElement::setChecked):
        (WebCore::HTMLDataGridCellElement::indeterminate):
        (WebCore::HTMLDataGridCellElement::setIndeterminate):
        (WebCore::HTMLDataGridCellElement::progress):
        (WebCore::HTMLDataGridCellElement::setProgress):
        * html/HTMLDataGridCellElement.h: Added.
        (WebCore::HTMLDataGridCellElement::endTagRequirement):
        (WebCore::HTMLDataGridCellElement::tagPriority):
        * html/HTMLDataGridCellElement.idl: Added.
        * html/HTMLDataGridElement.cpp:
        (WebCore::HTMLDataGridElement::autofocus):
        (WebCore::HTMLDataGridElement::setAutofocus):
        (WebCore::HTMLDataGridElement::disabled):
        (WebCore::HTMLDataGridElement::setDisabled):
        (WebCore::HTMLDataGridElement::size):
        (WebCore::HTMLDataGridElement::setSize):
        * html/HTMLDataGridElement.h:
        * html/HTMLDataGridElement.idl:
        * html/HTMLDataGridRowElement.cpp:
        (WebCore::HTMLDataGridRowElement::checkDTD):
        (WebCore::HTMLDataGridRowElement::expanded):
        (WebCore::HTMLDataGridRowElement::setExpanded):
        * html/HTMLDataGridRowElement.h:
        * html/HTMLDataGridRowElement.idl:
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTagNames.in:
2009-06-22  Sam Weinig  <sam@webkit.org>
        Add event handler attribute getter/setters to HTMLBodyElement
        as specified in HTML 5.
        - Removes erroneous inclusion of the onresize and onunload event
        handler attributes in Element and Document.
        (WebCore::Document::getWindowAttributeEventListener):
        * dom/Node.cpp:
        * dom/Node.h: onblur, onerror, onfocus, and onload all need to be declared
        virtual, since their behavior for HTMLBodyElement differs from the base
        implementation.
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::onblur):
        (WebCore::HTMLBodyElement::setOnblur):
        (WebCore::HTMLBodyElement::onerror):
        (WebCore::HTMLBodyElement::setOnerror):
        (WebCore::HTMLBodyElement::onfocus):
        (WebCore::HTMLBodyElement::setOnfocus):
        (WebCore::HTMLBodyElement::onload):
        (WebCore::HTMLBodyElement::setOnload):
        (WebCore::HTMLBodyElement::onbeforeunload):
        (WebCore::HTMLBodyElement::setOnbeforeunload):
        (WebCore::HTMLBodyElement::onmessage):
        (WebCore::HTMLBodyElement::setOnmessage):
        (WebCore::HTMLBodyElement::onoffline):
        (WebCore::HTMLBodyElement::setOnoffline):
        (WebCore::HTMLBodyElement::ononline):
        (WebCore::HTMLBodyElement::setOnonline):
        (WebCore::HTMLBodyElement::onresize):
        (WebCore::HTMLBodyElement::setOnresize):
        (WebCore::HTMLBodyElement::onstorage):
        (WebCore::HTMLBodyElement::setOnstorage):
        (WebCore::HTMLBodyElement::onunload):
        (WebCore::HTMLBodyElement::setOnunload):
        * html/HTMLBodyElement.h:
        * html/HTMLBodyElement.idl:
2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
        Reviewed by Darin Adler.
        https://bugs.webkit.org/show_bug.cgi?id=26601
        Remove disabled code for appcache dynamic entries
        This also removes code for DOM 3 Core DOMStringList, which we don't use for anything else yet.
        * DerivedSources.cpp:
        * DerivedSources.make:
        * bindings/js/JSDOMStringListCustom.cpp: Removed.
        * bindings/v8/custom/V8CustomBinding.h:
        * bindings/v8/custom/V8DOMStringListCustom.cpp: Removed.
        * dom/DOMStringList.cpp: Removed.
        * dom/DOMStringList.h: Removed.
        * dom/DOMStringList.idl: Removed.
        * dom/StaticStringList.cpp: Removed.
        * dom/StaticStringList.h: Removed.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
        * loader/appcache/ApplicationCache.cpp:
        (WebCore::ApplicationCache::addResource):
        * loader/appcache/ApplicationCache.h:
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
        * loader/appcache/ApplicationCacheResource.cpp:
        (WebCore::ApplicationCacheResource::dumpType):
        * loader/appcache/ApplicationCacheResource.h:
        (WebCore::ApplicationCacheResource::):
        * loader/appcache/ApplicationCacheStorage.cpp:
        (WebCore::ApplicationCacheStorage::storeUpdatedType):
        * loader/appcache/DOMApplicationCache.cpp:
        * loader/appcache/DOMApplicationCache.h:
        * loader/appcache/DOMApplicationCache.idl:
        * page/DOMWindow.idl:
2009-06-22  Steve Falkenburg  <sfalken@apple.com>
        Windows build fix.
        * DerivedSources.cpp:
        * html/HTMLElementsAllInOne.cpp:
2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
        Japanese can't be input.
        WebKit uses a per-frame input context for most editable fields, and application's global
        context for password fields, manually controlling secure input state and the list of available
        input sources.
        We were setting TSMDocument property to disable non-Roman input methods after focus changed
        to a password field, but before selection was updated. This resulted in the property being
        applied to a wrong TSMDocument in some cases, because TSMGetActiveDocument() uses input
        context cached by +[NSApplication updateWindows], we change context based on selection,
        not on focus.
        * page/mac/FrameMac.mm: (WebCore::Frame::setUseSecureKeyboardEntry): Since there is only one
        context that we use for password fields - the global one - there is no need to get the active
        one.
2009-06-22  David Levin  <levin@chromium.org>
        Reviewed by David Hyatt and Eric Seidel.
        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
        https://bugs.webkit.org/show_bug.cgi?id=26326
        Test: scrollbars/scrollbar-crash-on-refresh.html
        (WebCore::Document::detach):
        Gives the FrameView a change to do any necessary cleanup on
        Document::detach() which is where the renderArena gets detroyed.
        (WebCore::FrameView::detachCustomScrollbars):
        Gets rid of any custom scrollbars (if the docment supplied them).
        * page/FrameView.h:
        * platform/Scrollbar.h:
        (WebCore::Scrollbar::isCustomScrollbar):
        (WebCore::RenderObject::destroy):
        Removed the check for document()->frame().  If frame() is 0 in this code,
        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
        * rendering/RenderScrollbar.h:
        (WebCore::RenderScrollbar::isCustomScrollbar):
2009-06-22  Dan Bernstein  <mitz@apple.com>
        - fix https://bugs.webkit.org/show_bug.cgi?id=23606
          <rdar://problem/6537777> CSS gradient not repainted when image load
          completes
        Test: fast/repaint/background-generated.html
        (WebCore::mustRepaintFillLayers): Return true if the layer does not
        specify a size and the image uses the container size.
2009-06-22  David Hyatt  <hyatt@apple.com>
        Reviewed by Sam Weinig.
        https://bugs.webkit.org/show_bug.cgi?id=26607
        Add IDL for HTMLDataGridRowElement.
        * html/HTMLAttributeNames.in:
        * html/HTMLDataGridColElement.cpp:
        (WebCore::HTMLDataGridColElement::primary):
        (WebCore::HTMLDataGridColElement::setPrimary):
        * html/HTMLDataGridColElement.h:
        * html/HTMLDataGridColElement.idl:
        * html/HTMLDataGridElement.cpp:
        (WebCore::HTMLDataGridElement::checkDTD):
        (WebCore::HTMLDataGridElement::multiple):
        (WebCore::HTMLDataGridElement::setMultiple):
        * html/HTMLDataGridElement.h:
        * html/HTMLDataGridElement.idl:
        * html/HTMLDataGridRowElement.cpp: Added.
        (WebCore::HTMLDataGridRowElement::HTMLDataGridRowElement):
        (WebCore::HTMLDataGridRowElement::selected):
        (WebCore::HTMLDataGridRowElement::setSelected):
        (WebCore::HTMLDataGridRowElement::focused):
        (WebCore::HTMLDataGridRowElement::setFocused):
        * html/HTMLDataGridRowElement.h: Added.
        (WebCore::HTMLDataGridRowElement::tagPriority):
        * html/HTMLDataGridRowElement.idl: Added.
        * html/HTMLTagNames.in:
2009-06-19  Yael Aharon <yael.aharon@nokia.com>
        Reviewed by Holger Freyther.
        https://bugs.webkit.org/show_bug.cgi?id=26556
        Fix a crash in case that the QNetworkReply::readReady signal is
        "stuck" in deferred mode due to JavaScript alert, and in the meantime,
        QNetworkreply::finished signal is received and processed before
        QNetworkReply::readReady is processed.
        * manual-tests/qt/unload-alert.html: Added.
        * platform/network/qt/QNetworkReplyHandler.cpp:
        (WebCore::QNetworkReplyHandler::setLoadMode):
        (WebCore::QNetworkReplyHandler::finish):
        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
        (WebCore::QNetworkReplyHandler::forwardData):
        (WebCore::QNetworkReplyHandler::start):
        (WebCore::QNetworkReplyHandler::sendQueuedItems):
        * platform/network/qt/QNetworkReplyHandler.h:
        (WebCore::QNetworkReplyHandler::):
2009-06-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
        Fix the Qt build.
2009-06-21  Darin Adler  <darin@apple.com>
        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
        https://bugs.webkit.org/show_bug.cgi?id=25425
        * bindings/scripts/CodeGeneratorJS.pm: Tweaked mechanism for includes to be a bit
        more consistent and to make SVGElement.h be included in the header rather than in
        every implementation file that includes the header. Added code to use getAttribute
        and setAttribute directly when the [Reflect] extended attribute is used.
        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
        * html/HTMLElement.idl: Used [Reflect] for all the attributes in this class that
        reflect content attributes. Restricting this to one class for now to keep the
        patch small and start out slowly.
2009-06-21  Sam Weinig  <sam@webkit.org>
        Fix for https://bugs.webkit.org/show_bug.cgi?id=26596
        Only expose event handler attributes to elements and documents.
        Test: fast/dom/event-attribute-availability.html
2009-06-21  Daniel Bates  <dbates@intudata.com>
        Reviewed by Adam Barth.
        https://bugs.webkit.org/show_bug.cgi?id=26580

        Fix to enable XSSAuditor on child windows.

        Test: http/tests/security/xssAuditor/link-opens-new-window.html

        * page/XSSAuditor.cpp:
        (WebCore::XSSAuditor::XSSAuditor):
        (WebCore::XSSAuditor::isEnabled):
        (WebCore::XSSAuditor::canEvaluate):
        (WebCore::XSSAuditor::canCreateInlineEventListener):
        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
        (WebCore::XSSAuditor::canLoadObject):
        * page/XSSAuditor.h: Removed method setXSSAuditorEnabled, and field m_isEnabled.
        Moved implementation of isEnabled to XSSAuditor.cpp and changed implementation
        to query Settings.
2009-06-21  David Levin  <levin@chromium.org>
        Reviewed by NOBODY.
        Speculative windows build fix (idea by Mark Rowe).
2009-06-21  David Levin  <levin@chromium.org>
        Reviewed by NOBODY (Speculative gtk build fix).
2009-06-21  David Levin  <levin@chromium.org>
        Reviewed by NOBODY.
        Speculative tiger build fix and a windows build fix.
        More fixes may still be in order.
        * WebCore.vcproj/WebCoreCommon.vsprops:
        * dom/default/PlatformMessagePortChannel.h:
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
2009-06-21  David Levin  <levin@chromium.org>
        Reviewed by NOBODY (Speculative tiger build fix).
        * dom/default/PlatformMessagePortChannel.h:
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::~MessagePortQueue):
2009-06-21  Drew Wilson  <atwilson@google.com>
        Reviewed by David Levin.
        <https://bugs.webkit.org/show_bug.cgi?id=26448>

        Added optimized GC for MessagePorts when the entangled port is run by the same thread.
        Fixed bug in isProxyFor() that was not properly throwing an exception when trying to clone the entangled port.
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::markActiveObjectsForContext):
        Now marks remotely entangled ports as in-use, in addition to those with pending activity.
        * bindings/js/JSMessagePortCustom.cpp:
        (WebCore::JSMessagePort::mark):
        Now checks if the entangled port is local (run by same thread) and if so mark()s it.
        * dom/MessagePort.cpp:
        (WebCore::MessagePort::postMessage):
        (WebCore::MessagePort::disentangle):
        Removes cloned ports from the ScriptExecutionContext - this allows cloned ports to be GC'd as otherwise they look like remotely entangled ports.
        (WebCore::MessagePort::start):
        (WebCore::MessagePort::locallyEntangledPort):
        Added API for fetching the entangled port if it is run by the same thread
        * dom/MessagePort.h:
        * dom/MessagePortProxyWrapper.h:
        * dom/default/MessagePortProxy.cpp:
        (WebCore::MessagePortProxyWrapper::locallyEntangledPort):
        Added API for fetching the entangled port if it is run by the same thread
        (WebCore::MessagePortProxy::hasPendingActivity):
        Changed definition of hasPendingActivity() to be stricter - only returns true if there are pending messages.
        (WebCore::MessagePortProxy::locallyEntangledPort):
        * dom/default/MessagePortProxy.h:
2009-06-21  Drew Wilson  <atwilson@google.com>
        Reviewed by David Levin.
        <https://bugs.webkit.org/show_bug.cgi?id=25043>
        Removed obsolete MessagePort.startConversation(), active and onclose APIs.
        Refactored MessagePortProxy into MessagePortChannel and a platform-dependent PlatformMessagePortChannel
        implementation. Modified APIs to simplify cross-process implementations by moving the messaging code
        entirely into the platform-dependent proxy.
        Created a thread-safe default PlatformMessagePortChannel implementation.
        Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how
        cross-thread MessagePorts work.

        * GNUMakefile.am:
            Added MessagePortChannel/PlatformMessagePortChannel files.
        * bindings/js/JSMessagePortCustom.cpp:
        (WebCore::JSMessagePort::mark):
            Changed ports to not mark their entangled pair as reachable, per the spec.
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        * dom/MessageChannel.cpp:
        (WebCore::MessageChannel::MessageChannel):
            Updated to use PlatformMessagePortChannel::createChannel() to entangle the ports.
        * dom/MessagePort.cpp:
        (WebCore::MessagePort::MessagePort):
        (WebCore::MessagePort::~MessagePort):
        (WebCore::MessagePort::postMessage):
        (WebCore::MessagePort::disentangle):
        (WebCore::MessagePort::messageAvailable):
        (WebCore::MessagePort::start):
        (WebCore::MessagePort::close):
        (WebCore::MessagePort::entangle):
        (WebCore::MessagePort::contextDestroyed):
        (WebCore::MessagePort::dispatchMessages):
        (WebCore::MessagePort::setOnmessage):
        (WebCore::MessagePort::hasPendingActivity):
            Changed these APIs to delegate to new PlatformMessagePortChannel APIs.
        * dom/MessagePort.h:
            Renamed isQueueOpen() to started().
        * dom/MessagePort.idl:
            Removed startConversation and onclose.
        * dom/MessagePortProxy.h: Removed.
        * dom/MessagePortChannel.cpp: Added.
        (WebCore::MessagePortChannel::EventData::create):
        (WebCore::MessagePortChannel::EventData::EventData):
        (WebCore::MessagePortChannel::~MessagePortChannel):
        * dom/MessagePortChannel.h: Added.
        (WebCore::MessagePortChannel::EventData::message):
        (WebCore::MessagePortChannel::EventData::channel):
            Changed EventData to hold a reference to a MessagePortChannel object instead of a MessagePort to enable cross-thread messaging.
        (WebCore::MessagePortChannel::MessagePortChannel):
        (WebCore::MessagePortChannel::create):
        (WebCore:ScriptExecutionContext::dispatchMessagePortEvents):
            Renamed isQueueOpen() to started().
        * dom/default/PlatformMessagePortChannel.cpp: Added.
        (WebCore::MessagePortChannel::entangleIfOpen):
        (WebCore::MessagePortChannel::disentangle):
        (WebCore::MessagePortChannel::postMessageToRemote):
        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
        (WebCore::MessagePortChannel::close):
        (WebCore::MessagePortChannel::isConnectedTo):
        (WebCore::MessagePortChannel::hasPendingActivity):
        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
        (WebCore::PlatformMessagePortChannel::createChannel):
        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
        (WebCore::PlatformMessagePortChannel::disentangle):
        (WebCore::PlatformMessagePortChannel::setRemotePort):
        (WebCore::PlatformMessagePortChannel::remotePort):
        (WebCore::PlatformMessagePortChannel::entangledChannel):
        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
        (WebCore::PlatformMessagePortChannel::isConnectedTo):
        (WebCore::PlatformMessagePortChannel::close):
        (WebCore::PlatformMessagePortChannel::closeInternal):
        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
        * dom/default/PlatformMessagePortChannel.h: Added.
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::create):
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::isEmpty):
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::MessagePortQueue):
        * page/DOMWindow.cpp:
        (WebCore::PostMessageTimer::PostMessageTimer):
            Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how cross-thread MessagePorts work.
        (WebCore::PostMessageTimer::event):
        (WebCore::DOMWindow::postMessage):
        (WebCore::DOMWindow::postMessageTimerFired):
2009-06-21  Dan Bernstein  <mitz@apple.com>
        - fix https://bugs.webkit.org/show_bug.cgi?id=15383
          <rdar://problem/5682745> resize: vertical does not restrict to vertical
          resize
        Test: fast/css/resize-single-axis.html
        (WebCore::RenderLayer::resize): Ignore movement along the non-resizing
        axis.
2009-06-21  Sam Weinig  <sam@webkit.org>
        Reviewed by Eric Seidel
        Fix for https://bugs.webkit.org/show_bug.cgi?id=26578
        event.currentTarget for listener registered on window should point to the window object like in Firefox
        Test: fast/events/event-trace.html
        (WebCore::Node::dispatchGenericEvent): Make the DOMWindow the currentTarget when events are dispatched
        to it. We previously used the document because DOMWindow was not yet an EventTarget.
2009-06-21  Dan Bernstein  <mitz@apple.com>
        - fix https://bugs.webkit.org/show_bug.cgi?id=9694
          resize value not compared
        Test: fast/css/resize-value-compared.html
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::operator==): Compare the resize
        member.
2009-06-19  Alice Liu  <alice.liu@apple.com>
        Fix https://bugs.webkit.org/show_bug.cgi?id=26568
        Repro crash animating GIF if previously used in a closed window's back/forward list
        Also filed as <rdar://problem/6978362>
        Reviewed by Maciej Stachowiak.
        Can't test this bug with an automated layout test since it requires b/f caching
        * manual-tests/animated-gif-bfcache-crash.html: Added.
        * manual-tests/resources/containsAnimatedGif.html: Added.
        Adding checks for hostWindow() since there is no guarantee that the Page is alive
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::scrollRectIntoViewRecursively):
        (WebCore::ScrollView::contentsToScreen):
        (WebCore::ScrollView::screenToContents):
        (WebCore::ScrollView::wheelEvent):
2009-06-20  Sam Weinig  <sam@webkit.org>
        Reviewed by Adam Barth.
        Fix for https://bugs.webkit.org/show_bug.cgi?id=26554
        Shadowing of top and parent
        * page/DOMWindow.idl:
2009-06-20  Mark Rowe  <mrowe@apple.com>
        Fix <https://bugs.webkit.org/show_bug.cgi?id=15106>.
        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
        We allow selections to begin within an element that has -webkit-user-select: none set,
        unless the element is draggable as dragging should take priority over starting a selection.
        Test: editing/selection/user-drag-element-and-user-select-none.html
        * dom/Node.cpp:
        (WebCore::Node::canStartSelection):
2009-06-20  Darin Adler  <darin@apple.com>
        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
        https://bugs.webkit.org/show_bug.cgi?id=26528
        rdar://problem/6985329
        (WebCore::TextIterator::handleReplacedElement): When entering a text control,
        start at the top of the shadow tree (by calling shadowTreeRootNode). Also
        remove assumption that innerTextElement will never be 0 since RenderTextControl
        doesn't really guarantee this.
2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
        Reviewed by NOBODY.
        Speculative Qt build fix - add HTMLDataGridColElement to the build script.
2009-06-19  Adam Barth  <abarth@webkit.org>
        https://bugs.webkit.org/show_bug.cgi?id=26561
        Remove a memcpy by retrieving the already existing copy of a string
        instead of making a new one.
        * bindings/js/ScriptSourceCode.h:
        (WebCore::ScriptSourceCode::ScriptSourceCode):
        (WebCore::ScriptSourceCode::source):
        * bindings/js/StringSourceProvider.h:
        (WebCore::StringSourceProvider::source):
2009-06-19  Brian Weinstein  <bweinstein@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=26488
        No Support for Single Finger or Two Finger Panning in Windows 7

        The code in WebCore allows us to interpret a Pan gesture as
        a mousewheel event, and we are able to reuse the scrolling code.
        Another constructor was created in WheelEventWin which takes data
        better suited to the pan guesture than what was currently there.

        Unable to add tests to simulate touch behavior/gestures.
        * platform/PlatformWheelEvent.h:
        * platform/win/WheelEventWin.cpp:
2009-06-19  Chris Marrin  <cmarrin@apple.com>
        Fixed a build error, which only shows up in the i386 compile
        * platform/graphics/mac/GraphicsLayerCA.mm:
        (WebCore::GraphicsLayerCA::animateTransform):
2009-06-19  Simon Fraser  <simon.fraser@apple.com>
        <rdar://problem/6988385> REGRESSION: In full page video player, movie's
        video track becomes detached from its controller.

        When in the media document, the MediaPlayer should not report that it
        is capable of hardware acceleration, because it renders via a QTMovieView
        which is already accelerated.
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
2009-06-19  Kevin Ollivier  <kevino@theolliviers.com>
        Adding XSSAuditor.cpp to the wx build.
2009-06-19  Chris Marrin  <cmarrin@apple.com>
        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
        https://bugs.webkit.org/show_bug.cgi?id=26544
        If I am doing a Matrix hardware animation and any matrix is singular, I revert to software.
        This is not really testable, since we can't see what the hardware animation is doing.
        * platform/graphics/mac/GraphicsLayerCA.mm:
        (WebCore::GraphicsLayerCA::animateTransform):
2009-06-19  Geoffrey Garen  <ggaren@apple.com>
        Reviewed by Maciej Stachowiak.

        An additional fix for Bug 26532: Native functions do not correctly unlink
        from optimised callsites when they're collected
        <https://bugs.webkit.org/show_bug.cgi?id=26532> | <rdar://problem/6625385>
        Use "NativeFunctionWrapper" instead of "PrototypeFunction" in cross-frame
        accessors, so the type of object you get to wrap a function is the same,
        regardless of whether the access to the function is cross-frame.

        This is faster and more idiomatic than what we had before. It also would
        have avoided Bug 26532 because it would have prevented a conflicting
        PrototypeFunction from being allocated to wrap postMessage, where a
        NativeFunctionWrapper had been allocated previously.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::objectToStringFunctionGetter):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::nonCachingStaticFunctionGetter):
2009-06-19  Simon Fraser  <simon.fraser@apple.com>
        Reviewed by John Sullivan
        <rdar://problem/6953673> Crash in RenderLayerCompositor::setCompositingParent

        Fix a crash that could occur in complex content due to timing issues
        when doing a partial layer tree rebuild which is required when painting;
        setCompositingParent() could be called with a parent which has not been made
        compositing yet.
2009-06-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
        Build fix. Adding missing HTMLDataGrid* files to the build.
2009-06-19  Peter Kasting  <pkasting@google.com>
        https://bugs.webkit.org/show_bug.cgi?id=26460 part three
        Make BMPImageReader a standalone class that is used by ICOImageDecoder
        and BMPImageDecoder to decode individual BMPs within a file.  These
        decoders now inherit directly from ImageDecoder.

        This also makes these decoders decode on-demand in isSizeAvailable() and
        frameBufferAtIndex(), like the other decoders, instead of when setData()
        is called, like before.  This should provide a speedup on pages
        containing BMPs that aren't immediately onscreen.
        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
        (WebCore::BMPImageDecoder::BMPImageDecoder):
        (WebCore::BMPImageDecoder::setData):
        (WebCore::BMPImageDecoder::isSizeAvailable):
        (WebCore::BMPImageDecoder::frameBufferAtIndex):
        (WebCore::BMPImageDecoder::decodeWithCheckForDataEnded):
        (WebCore::BMPImageDecoder::decode):
        (WebCore::BMPImageDecoder::processFileHeader):
        * platform/image-decoders/bmp/BMPImageDecoder.h:
        (WebCore::BMPImageDecoder::readUint32):
        * platform/image-decoders/bmp/BMPImageReader.cpp:
        (WebCore::BMPImageReader::BMPImageReader):
        (WebCore::BMPImageReader::decodeBMP):
        (WebCore::BMPImageReader::readInfoHeaderSize):
        (WebCore::BMPImageReader::processInfoHeader):
        (WebCore::BMPImageReader::readInfoHeader):
        (WebCore::BMPImageReader::processBitmasks):
        (WebCore::BMPImageReader::processColorTable):
        (WebCore::BMPImageReader::processRLEData):
        (WebCore::BMPImageReader::processNonRLEData):
        (WebCore::BMPImageReader::setFailed):
        * platform/image-decoders/bmp/BMPImageReader.h:
        (WebCore::BMPImageReader::readUint16):
        (WebCore::BMPImageReader::readUint32):
        (WebCore::BMPImageReader::setBuffer):
        (WebCore::BMPImageReader::setData):
        (WebCore::BMPImageReader::):
        (WebCore::BMPImageReader::pastEndOfImage):
        (WebCore::BMPImageReader::readCurrentPixel):
        (WebCore::BMPImageReader::setRGBA):
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::ICOImageDecoder):
        (WebCore::ICOImageDecoder::setData):
        (WebCore::ICOImageDecoder::isSizeAvailable):
        (WebCore::ICOImageDecoder::size):
        (WebCore::ICOImageDecoder::frameBufferAtIndex):
        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded):
        (WebCore::ICOImageDecoder::decode):
        (WebCore::ICOImageDecoder::processDirectory):
        (WebCore::ICOImageDecoder::processDirectoryEntries):
        (WebCore::ICOImageDecoder::readDirectoryEntry):
        (WebCore::ICOImageDecoder::processImageType):
        * platform/image-decoders/ico/ICOImageDecoder.h:
        (WebCore::ICOImageDecoder::readUint16):
        (WebCore::ICOImageDecoder::readUint32):
2009-06-19  Adam Barth  <abarth@webkit.org>
        Reviewed by Dimitri Glazkov.
        https://bugs.webkit.org/show_bug.cgi?id=26555
        Fix the Chromium canary bot.  Turns out ScriptSourceCode doesn't have
        the same API in V8 and JSC.
        * WebCore/bindings/js/ScriptController.cpp:
        * WebCore/bindings/js/ScriptSourceCode.h:
        * WebCore/bindings/v8/ScriptController.cpp:
        * WebCore/page/XSSAuditor.cpp:
        * WebCore/page/XSSAuditor.h:
2009-06-19  David Hyatt  <hyatt@apple.com>
        Reviewed by Anders Carlsson.
        https://bugs.webkit.org/show_bug.cgi?id=26547

        Implement the IDL interface for HTMLDataGridColElement.
        * DerivedSources.make:
        * html/HTMLAttributeNames.in:
        * html/HTMLDataGridColElement.cpp: Added.
        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
        (WebCore::HTMLDataGridColElement::label):
        (WebCore::HTMLDataGridColElement::setLabel):
        (WebCore::HTMLDataGridColElement::type):
        (WebCore::HTMLDataGridColElement::setType):
        (WebCore::HTMLDataGridColElement::sortable):
        (WebCore::HTMLDataGridColElement::setSortable):
        (WebCore::HTMLDataGridColElement::sortDirection):
        (WebCore::HTMLDataGridColElement::setSortDirection):
        (WebCore::HTMLDataGridColElement::selected):
        (WebCore::HTMLDataGridColElement::setSelected):
        * html/HTMLDataGridColElement.h: Added.
        (WebCore::HTMLDataGridColElement::endTagRequirement):
        (WebCore::HTMLDataGridColElement::tagPriority):
        * html/HTMLDataGridColElement.idl: Added.
        * html/HTMLDataGridElement.h:
        * html/HTMLElementsAllInOne.cpp:
        * page/DOMWindow.idl:
2009-06-19  Chris Evans  <scarybeasts@gmail.com>
        There is no new test because this cannot be tested deterministically.
        I've not been able to cause a crash at all in the test framework, but
        I have verified that this is happening in the wild and that the patch
        fixes the likely cause in the debugger.
        * loader/TextResourceDecoder.cpp: careful not to iterate off the end
          of our input buffer looking for the end of the comment.
2009-06-19  Adam Barth  <abarth@webkit.org>
        Reviewed by Dimitri Glazkov.
        https://bugs.webkit.org/show_bug.cgi?id=26536
        Fix external-script-URL-location.html and
        write-external-script-open.html LayoutTests.
        implicitOpen is called from several places.  We need to setXSSAuditor
        each time, so I moved the call inside implicitOpen.
        (WebCore::Document::open):
        (WebCore::Document::implicitOpen):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::begin):
2009-06-19  Kent Tamura  <tkent@chromium.org>
        Reviewed by David Levin.
        Use WebCore::multipleFileUploadText() in Chromium to fix a problem
        that Chromium shows only the first filename even if a user selects
        multiple files for <input type=file multiple>.
        <https://bugs.webkit.org/show_bug.cgi?id=26502>
        * platform/chromium/FileChooserChromium.cpp:
2009-06-19  Dan Bernstein  <mitz@apple.com>
        Reviewed by Dave Hyatt.
        - fix <rdar://problem/6967596> Safari hung using 100% CPU when I tried
          to look up a word in Dictionary using command-control-d
        Test: editing/selection/move-by-line-005.html
        The root cause of this bug was searchAheadForBetterMatch() continuing
        past the first rendered text object after the given object. While we
        want to skip non-rendered text and empty containers, when we encounter
        rendered text object, we must return a text box for that object.
        * dom/Position.cpp:
        (WebCore::searchAheadForBetterMatch):
2009-06-19  Jungshik Shin  <jshin@chromium.org>
        Reviewed by David Levin
        https://bugs.webkit.org/show_bug.cgi?id=25657
        Chromium Linux port does not handle non-BMP characters properly.
        It's fixed with a 'UTF-16 iterator macro' to extract Unicode
        codepoints out of a UTF-16 input string.
        A manual test is added for non-BMP character rendering,
        which we can use until a small freely-distributable font
        covering non-BMP is added to the Webkit source tree.
        * platform/graphics/chromium/FontCacheLinux.cpp:
        * manual-tests/non-bmp.html: Added.
2009-06-19  Pavel Feldman  <pfeldman@chromium.org>
        Reviewed by Dimitri Glazkov.
        V8 Bindings: return proper state from the script stack.
        https://bugs.webkit.org/show_bug.cgi?id=26512
        * bindings/v8/ScriptCallStack.cpp:
        (WebCore::ScriptCallStack::ScriptCallStack):
        * bindings/v8/ScriptCallStack.h:
        (WebCore::ScriptCallStack::state):
2009-06-19  Jessie <jberlin@apple.com>
        Reviewed by Simon Fraser.
        Windows build fix.

        * platform/graphics/cg/PatternCG.cpp:
        (WebCore::Pattern::createPlatformPattern):
2009-06-19  Yael Aharon  <yael.aharon@nokia.com>
        Build fix after 44825.
        * platform/graphics/qt/ImageDecoderQt.cpp:
        (WebCore::ImageDecoderQt::isSizeAvailable):
        * platform/graphics/qt/ImageDecoderQt.h:
2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
        Bug 26426: Canvas: rotation of 'no-repeat' pattern is weird
        <https://bugs.webkit.org/show_bug.cgi?id=26426>
        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
        The original number cannot be represented by mantissa of float
        (23bit) so that it caused some error.
        Test: fast/canvas/image-object-in-canvas.html:
        * platform/graphics/cg/PatternCG.cpp:
2009-06-19  Adam Barth  <abarth@webkit.org>
        Unreviewed attempt to fix the Chromium build.
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::ScriptController):
        (WebCore::ScriptController::evaluate):
        * bindings/v8/ScriptController.h:
        (WebCore::ScriptController::xssAuditor):
        * bindings/v8/ScriptEventListener.cpp:
        (WebCore::createAttributeEventListener):
2009-06-18  Adam Barth  <abarth@webkit.org>
        https://bugs.webkit.org/show_bug.cgi?id=26199
        Added an experimental reflective XSS filter.  The filter is disabled by
        default.
        Test: http/tests/security/xssAuditor/script-tag.html
        * WebCore.base.exp:
        (WebCore::ScriptController::ScriptController):
        (WebCore::ScriptController::evaluate):
        * bindings/js/ScriptController.h:
        (WebCore::ScriptController::xssAuditor):
        * bindings/js/ScriptEventListener.cpp:
        (WebCore::createAttributeEventListener):
        * dom/Tokenizer.h:
        (WebCore::Tokenizer::xssAuditor):
        (WebCore::Tokenizer::setXSSAuditor):
        (WebCore::Tokenizer::Tokenizer):
        * html/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::scriptHandler):
        (WebCore::FrameLoader::requestObject):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::setXSSAuditorEnabled):
        * page/Settings.h:
        (WebCore::Settings::xssAuditorEnabled):
        * page/XSSAuditor.cpp: Added.
        (WebCore::isControlCharacter):
        (WebCore::XSSAuditor::XSSAuditor):
        (WebCore::XSSAuditor::~XSSAuditor):
        (WebCore::XSSAuditor::canEvaluate):
        (WebCore::XSSAuditor::canCreateInlineEventListener):
        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
        (WebCore::XSSAuditor::canLoadObject):
        (WebCore::XSSAuditor::decodeURL):
        (WebCore::XSSAuditor::findInRequest):
        * page/XSSAuditor.h: Added.
        (WebCore::XSSAuditor::isEnabled):
        (WebCore::XSSAuditor::setXSSAuditorEnabled):
2009-06-18  Dirk Schulze  <krit@webkit.org>
        feOffset and objectBoundingBox
        [https://bugs.webkit.org/show_bug.cgi?id=26441]
        If we use objectBoundingBox for primitiveUnits, the fractions given
        to dx or dy of feOffset must be multiplied with the referenced objects
        objectBoundingBox size.
        Test: svg/filters/feOffset.svg
        * svg/graphics/filters/SVGFEOffset.cpp:
        (WebCore::FEOffset::apply):
2009-06-18  Dirk Schulze  <krit@webkit.org>
        feTile implementation missing
        [https://bugs.webkit.org/show_bug.cgi?id=26419]
        Implementation of feTile, a pattern effect for SVG filters. It was
        necessary to modify FilterEffect since source inputs need a secial
        logic and we have to identify if an effect is a source input.
        Tests: svg/batik/filters/feTile.svg
               svg/filters/feTile.svg
        * platform/graphics/filters/FilterEffect.h:
        (WebCore::FilterEffect::isSourceInput):
        * platform/graphics/filters/SourceAlpha.h:
        (WebCore::SourceAlpha::isSourceInput):
        * platform/graphics/filters/SourceGraphic.h:
        (WebCore::SourceGraphic::isSourceInput):
        * svg/graphics/filters/SVGFETile.cpp:
        (WebCore::FETile::apply):
2009-06-18  Dirk Schulze  <krit@webkit.org>
        feMerge implementation
        [https://bugs.webkit.org/show_bug.cgi?id=26480]
        Added feMerge to the SVG Filter system.
        Test: svg/filters/feMerge.svg
        * svg/graphics/filters/SVGFEMerge.cpp:
        (WebCore::FEMerge::uniteChildEffectSubregions):
        (WebCore::FEMerge::apply):
        * svg/graphics/filters/SVGFEMerge.h:
2009-06-18  Mark Rowe  <mrowe@apple.com>
        Speculative Windows build fix.
        * page/win/FrameCGWin.cpp: Add missing #include.
2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
        Reviewed by Dave Levin.
        https://bugs.webkit.org/show_bug.cgi?id=26425
        Final refactorings, picking up a few places where BitmapInfo
        could be used.
        * page/win/FrameCGWin.cpp:
        (WebCore::imageFromRect):
        * platform/win/CursorWin.cpp:
        (WebCore::Cursor::Cursor):
        * platform/win/PopupMenuWin.cpp:
        (WebCore::PopupMenu::paint):
2009-06-18  Chris Fleizach  <cfleizach@apple.com>
        Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely
        https://bugs.webkit.org/show_bug.cgi?id=26522
        Test: accessibility/non-data-table-cell-title-ui-element.html
        * accessibility/AccessibilityTableCell.cpp:
        (WebCore::AccessibilityTableCell::titleUIElement):
2009-06-18  Kevin Ollivier  <kevino@theolliviers.com>
        wx build fix after recent RenderTheme changes.
        * platform/wx/RenderThemeWx.cpp:
        (WebCore::RenderThemeWx::~RenderThemeWx):
        (WebCore::RenderTheme::themeForPage):

2009-06-18  Peter Kasting  <pkasting@google.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26460 part two
        Attempt to minimize diff of following functional change by first landing
        non-functional change to:
        * Make readUintX() public and static (since they will need to be once
          BMPImageReader is included in *ImageDecoder via composition rather
          than inheritance).  Add wrappers in each class so callers can be
          simpler.  In the next patch, these wrappers will be beefed up slightly
          and the callers will get even simpler.
        * Change direct setting of m_failed to use setFailed(), since in the
          next patch much of this code won't even have direct access to m_failed
        * Add a helper function in ICOImageDecoder to determine the image type
          instead of simply doing it inline
        * Rewrap lines that used to be <=80 cols and slipped over it during the
          original landing of these decoders
        * Other misc. changes, e.g. adding constructor definitions, reordering
          functions, changing RGBA32Buffer& to RGBA32Buffer*, etc. that have no
          functional effect but minimize the subsequent diff for readability

        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
        (WebCore::BMPImageDecoder::BMPImageDecoder):
        (WebCore::BMPImageDecoder::processFileHeader):
        (WebCore::BMPImageDecoder::readUint32):
        * platform/image-decoders/bmp/BMPImageReader.cpp:
        (WebCore::BMPImageReader::decodeBMP):
        (WebCore::BMPImageReader::getInfoHeaderSize):
        (WebCore::BMPImageReader::processInfoHeader):
        (WebCore::BMPImageReader::readInfoHeader):
        (WebCore::BMPImageReader::processBitmasks):
        (WebCore::BMPImageReader::processColorTable):
        (WebCore::BMPImageReader::processRLEData):
        (WebCore::BMPImageReader::processNonRLEData):
        * platform/image-decoders/bmp/BMPImageReader.h:
        (WebCore::BMPImageReader::readUint16Helper):
        (WebCore::BMPImageReader::readUint32Helper):
        (WebCore::BMPImageReader::):
        (WebCore::BMPImageReader::readUint16):
        (WebCore::BMPImageReader::readUint32):
        (WebCore::BMPImageReader::readCurrentPixel):
        (WebCore::BMPImageReader::getComponent):
        (WebCore::BMPImageReader::setI):
        (WebCore::BMPImageReader::setRGBA):
        (WebCore::BMPImageReader::fillRGBA):
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::ICOImageDecoder):
        (WebCore::ICOImageDecoder::isSizeAvailable):
        (WebCore::ICOImageDecoder::size):
        (WebCore::ICOImageDecoder::decodeImage):
        (WebCore::ICOImageDecoder::processDirectory):
        (WebCore::ICOImageDecoder::processDirectoryEntries):
        (WebCore::ICOImageDecoder::isBetterEntry):
        (WebCore::ICOImageDecoder::processImageType):
        (WebCore::ICOImageDecoder::readUint16):
        (WebCore::ICOImageDecoder::readUint32):
2009-06-18  Peter Kasting  <pkasting@google.com>
        Fix build bustage.
        * platform/image-decoders/gif/GIFImageDecoder.h:
2009-06-18  Kevin McCullough  <kmccullough@apple.com>
        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
        Convert intptr_t to Strings so that we don't loose bits in the
        conversion to JS.  Previously they were being put into 32bit ints.
        * inspector/InspectorController.cpp: Convert the String back to an
        intptr_t.
        (WebCore::InspectorController::addBreakpoint):
        (WebCore::InspectorController::removeBreakpoint):
        * inspector/InspectorController.h:
        * inspector/InspectorController.idl: Use strings in JS to avoid 32bit
        truncation.
        * inspector/InspectorFrontend.cpp: Make the intptr_t into a String.
        (WebCore::InspectorFrontend::parsedScriptSource):
        * platform/text/PlatformString.h: Implemented the necessary conversion
        functions to be able to convert to and from an intptr_t.
        * platform/text/String.cpp: Ditto.
        (WebCore::String::toIntPtrStrict):
        (WebCore::String::toIntPtr):
        (WebCore::charactersToIntPtrStrict):
        (WebCore::charactersToIntPtr):
        * platform/text/StringImpl.cpp: Ditto.
        (WebCore::StringImpl::toIntPtrStrict):
        (WebCore::StringImpl::toIntPtr):
        * platform/text/StringImpl.h: Ditto.

2009-06-17  Brent Fulgham  <bfulgham@webkit.org>

        Reviewed by Eric Seidel.

        Final cleanups in this refactoring:
        (1) Move WindowsBitmap implementation from CG-specific file to
            the platform-common GraphicsContextWin.cpp, since it is
            equally useful on both platforms.
        (2) Revise the TransformationMatrix logic as suggested by
            Adam Roben in his review comments to Part #2 of this
            refactoring.
        * platform/graphics/win/GraphicsContextCGWin.cpp:
        * platform/graphics/win/GraphicsContextWin.cpp:
        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap):
        (WebCore::GraphicsContext::WindowsBitmap::~WindowsBitmap):
        (WebCore::GraphicsContext::createWindowsBitmap):
        (WebCore::GraphicsContext::getWindowsContext):
        (WebCore::GraphicsContextPlatformPrivate::scale):
        (WebCore::GraphicsContextPlatformPrivate::rotate):
        (WebCore::GraphicsContextPlatformPrivate::translate):
        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
2009-06-18  Peter Kasting  <pkasting@google.com>
        Reviewed by Eric Seidel.
        https://bugs.webkit.org/show_bug.cgi?id=26460 part one
        Make isSizeAvailable non-const, since it's not logically const (it
        triggers lazy decoding), and simplify all the implementations (without
        changing behavior; just make less verbose).  Remove some other
        inappropriate consts, which enables the removal of all the mutable
        declarations in the decoders.
        (WebCore::ImageDecoder::isSizeAvailable):
        (WebCore::ImageDecoder::setSize): Make public to avoid needing a friend declaration in the JPEG decoder, and because the ICO/BMP decoders will soon need this.
        (WebCore::GIFImageDecoder::isSizeAvailable):
        (WebCore::GIFImageDecoder::decode):
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::isSizeAvailable):
        * platform/image-decoders/ico/ICOImageDecoder.h:
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
        (WebCore::JPEGImageDecoder::isSizeAvailable):
        (WebCore::JPEGImageDecoder::decode):
        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageDecoder::isSizeAvailable):
        (WebCore::PNGImageDecoder::decode):
        * platform/image-decoders/png/PNGImageDecoder.h:
        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
        (WebCore::XBMImageDecoder::isSizeAvailable):
        (WebCore::XBMImageDecoder::frameBufferAtIndex):
        (WebCore::XBMImageDecoder::decode):
        * platform/image-decoders/xbm/XBMImageDecoder.h: Rename decodeXBM() to decode() for consistency with the JPEG/PNG decoders, and in the future the ICO/BMP decoders.
2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
        Move some common functions out of platform files and into
        the common implementation.
        https://bugs.webkit.org/show_bug.cgi?id=26425.
        Add a new platform context method (flush) so that the
        getWindowsContext method can be consolidated into the common
        GraphicsContextWin.cpp file.

        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
        (WebCore::GraphicsContextPlatformPrivate::flush):
        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
        (WebCore::GraphicsContextPlatformPrivate::flush):
        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove
          getWindowContext method.
        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
          getWindowContext method and fillWithClearColor methods.
        * platform/graphics/win/GraphicsContextWin.cpp:
        (WebCore::fillWithClearColor): Moved from *CairoWin.cpp
        (WebCore::GraphicsContext::getWindowsContext): Moved
          from *CairoWin.cpp
2009-06-18  Ojan Vafai  <ojan@chromium.org>
        Remove code that I accidentally committed in r44811.
        * editing/markup.cpp:
        (WebCore::createMarkup):
2009-06-18  Simon Fraser  <simon.fraser@apple.com>
        Reviewed by Dan Bernstein.
        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
        starts sometimes (with hardware acceleration).

        When deciding which RenderLayers should be composited, when a layer goes into
        compositing mode we repaint the old location. However, we did that before
        we'd looked at all the factors that may force a layer to composite, so missed
        some cases. Fix by doing the repaint once we really know whether it's going
        to composite.
        Test: compositing/repaint/become-overlay-composited-layer.html
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
2009-06-18  Simon Fraser  <simon.fraser@apple.com>
        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined, and
        the Tiger build where QTMovieLayer does not exist.
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
        (WebCore::MediaPlayerPrivate::currentRenderingMode):
        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
2009-06-18  Simon Fraser  <simon.fraser@apple.com>
        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined.
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivate::currentRenderingMode):
        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
2009-06-17  Erik Arvidsson  <arv@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=15189
        Adds the HTML5 input event support for textarea.

        Also, moves the oninput attribute parse handling to HTMLElement so that
        it can be set on any HTML element so that bubbling events can be handled
        using HTML attribute handlers.
        Test: fast/forms/textarea-input-event.html
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseMappedAttribute):
        (WebCore::HTMLInputElement::parseMappedAttribute):
        * rendering/RenderTextControlMultiLine.cpp:
        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
2009-06-18  Dirk Schulze  <krit@webkit.org>
        Share code between filterEffects
        [https://bugs.webkit.org/show_bug.cgi?id=26479]
        Share more code of filter effects. The imageBuffer creation can move to
        FilterEffect ant every effect asks for the GraphicsContext. Move the
        drawingRect calculation to FilterEffect.
        * platform/graphics/filters/FilterEffect.cpp:
        (WebCore::FilterEffect::calculateDrawingRect):
        (WebCore::FilterEffect::getEffectContext):
        * platform/graphics/filters/FilterEffect.h:
        * platform/graphics/filters/SourceGraphic.cpp:
        (WebCore::SourceGraphic::apply):
        * svg/graphics/filters/SVGFEFlood.cpp:
        (WebCore::FEFlood::apply):
        * svg/graphics/filters/SVGFEOffset.cpp:
        (WebCore::FEOffset::apply):
2009-06-18  Simon Fraser  <simon.fraser@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=26499

        Support hardware-accelerationed rendering of video elements.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
        (WebCore::HTMLMediaElement::mediaPlayerRepaint):
        Just move these methods to group the render-related methods together.

        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
        Call out method to ask the RenderLayerCompositor if presentation of this video
        can be acclerated. It might say no, if, for example, the video has a reflection.

        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
        Fetch the GraphicsLayer from the RenderVideo that will host the movie layer.

        * html/HTMLMediaElement.h:
        Reordered the rendering-related methods, and added two methods related to video
        acceleration.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::acceleratedRenderingStateChanged):
        Called by the rendering system when it determines that the video must go into, or
        fall off of the hardware-accelerated path.

        (WebCore::MediaPlayer::supportsAcceleratedRendering):
        Method to say whether the media engine supports accelerated rendering.

        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerRepaint):
        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged):
        Moved.

        (WebCore::MediaPlayerClient::mediaPlayerRenderingCanBeAccelerated):
        (WebCore::MediaPlayerClient::mediaPlayerGraphicsLayer):
        New methods to ask the client if the rendering system can support accelerated
        rendering, and to get a GraphicsLayer to plug the movie layer into.

        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::supportsAcceleratedRendering):
        (WebCore::MediaPlayerPrivateInterface::acceleratedRenderingStateChanged):
        Forwarding methods from MediaPlayer.

        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        Some new methods related to using a QTMovieLayer, and to simplify the rendering mode logic.
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
        Methods to create and destroy the QTMovieLayer.

        (WebCore::MediaPlayerPrivate::currentRenderingMode):
        (WebCore::MediaPlayerPrivate::preferredRenderingMode):
        Methods to clarify the code that decides which of the 3 rendering modes to use.

        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
        Changed to use the new rendering mode methods.

        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
        Destroy the layer if we have one.

        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
        Small utility method.

        (WebCore::MediaPlayerPrivate::updateStates):
        Move the call to setUpVideoRendering() to before we send out the state notifications,
        so that we will have created the rendering objects already.

        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
        Return true if we have QTMovieLayer.

        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
        We've been told that we went into or out of accelerated mode; maybe reset
        the renderer, and set the layer if we have to.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::rendererContentChanged):
        We may need to udpate compositing layers if the video went into accelerated mode.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::canUseDirectCompositing):
        Add smarts to deal with video, which allows us to avoid extra backing store.

        (WebCore::RenderLayerBacking::contentsBox):
        Use the videoBox to use the content layer for video layers.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
        Poke the RenderVideo if the state changed.

        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        Handle an edge case when the video element itself is a stacking context
        because of opacity or transform.

        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
        Allow video to throw us into compositing mode if the media engine supports it.

        * rendering/RenderLayerCompositor.h:
        New methods related to video.

        * rendering/RenderVideo.h:
        * rendering/RenderVideo.cpp:
        (WebCore::RenderVideo::updatePlayer):
        Call rendererContentChanged() to give the compositor a change to throw the video into
        compositing mode.

        (WebCore::RenderVideo::supportsAcceleratedRendering):
        (WebCore::RenderVideo::acceleratedRenderingStateChanged):
        (WebCore::RenderVideo::videoGraphicsLayer):
        Methods to allow the MediaPlayer to do rendering-related stuff via the media element.
2009-06-18  Rob Buis  <rwlbuis@gmail.com>
        Reviewed by Niko.
        https://bugs.webkit.org/show_bug.cgi?id=26385
        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
        Also do the isValid check for outer <svg>.
        Test: svg/custom/outer-svg-unknown-feature.svg
        * svg/SVGDocument.cpp:
        (WebCore::SVGDocument::childShouldCreateRenderer):
        * svg/SVGDocument.h:
2009-06-18  Dan Bernstein  <mitz@apple.com>
        - fix <rdar://problem/6913221> REGRESSION (Safari 3-4): Search field on
          apple.com cuts entered text
        Test: fast/forms/search-vertical-alignment.html
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::layout): Vertically center the
            the search field's inner block.
2009-06-18  Janne Koskinen  <janne.p.koskinen@digia.com>
        Fix compilation with Symbian WINSCW compiler, which produced
        multiple definitions of the CSSPrimitiveValue conversion operators.
        It turns out that they are defined inline but not declared inline.
        Adding the inline keyword to the declaration fixes the build.
2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>
        Reviewed by Simon Hausman.
        Clarify in docs how to compile with debug information.
2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
        [Qt] When writing an URL to the clipboard, save the corresponding title
        in the mime data as well.
        * platform/qt/ClipboardQt.cpp:
        (WebCore::ClipboardQt::writeURL):
2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
        [Qt] Fix build. Add HTMLDataGridElement.
2009-06-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
        Gtk build fix.
        Add HTMLDataGridElement header and IDL to the build script.
2009-06-18  Chris Evans  <scarybeasts@gmail.com>
        Reviewed by Adam Barth.
        Fix 8-digit long hex entities. Fixes bug 26454
        https://bugs.webkit.org/show_bug.cgi?id=26454
        Test: fast/parser/eightdigithexentity.html
        * html/HTMLTokenizer.cpp: fix off-by-ones.
2009-06-18  David Levin  <levin@chromium.org>
        Fix chromium linux build.
        Fixes a mistake that happened during the complicated merge for
        landing r44775, r44776, r44777.
        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore::RenderThemeChromiumLinux::create):
2009-06-17  Simon Fraser  <simon.fraser@apple.com>

        https://bugs.webkit.org/show_bug.cgi?id=26499

        First step to making video rendering be hardware-accelerated:
        make <video> elements get self-painting RenderLayers, and add
        an isVideo() virtual method to RenderObject.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setReadyState):
        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
        (WebCore::RenderLayer::isSelfPaintingLayer):
        (WebCore::RenderObject::isVideo):
        * rendering/RenderVideo.h:
        (WebCore::RenderVideo::requiresLayer):
        (WebCore::RenderVideo::isVideo):
2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
        Reviewed by Adam Roben.
        Refactor a few common routines in the various Windows ports
        and reduce some duplicated code.
        (1) Create TransformationMatrix XFORM casting operator, and
            switch various XFORM structure uses to utilize it.
        (2) Push concatCTM call to GraphicsContextWin now that the
            TransformationMatrix can directly create XFORM (rather
            than converting to CGAffineTransform/cairo_matrix_t first.)
        * WebCore.vcproj/WebCore.vcproj: Add new BitmapInfo structure.
        * platform/graphics/transforms/TransformationMatrix.h:
        * platform/graphics/win/GraphicsContextCGWin.cpp:
        * platform/graphics/win/GraphicsContextCairoWin.cpp:
        * platform/graphics/win/GraphicsContextWin.cpp:
        (WebCore::GraphicsContextPlatformPrivate::scale):
        (WebCore::GraphicsContextPlatformPrivate::rotate):
        (WebCore::GraphicsContextPlatformPrivate::translate):
        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
        (WebCore::TransformationMatrix::operator XFORM): New operator
2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
        Non-CG Windows build fix after @r44758.
        * rendering/RenderThemeWin.cpp:
        (WebCore::RenderTheme::themeForPage):
2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
        Reviewed by Adam Roben.
        Refactor a few common routines in the various Windows ports
        and reduce some duplicated code.
        https://bugs.webkit.org/show_bug.cgi?id=26425.
        Refactor use of BITMAPINFO for the new BitmapInfo structure.
        * platform/win/BitmapInfo.cpp: Added.
        (WebCore::bitmapInfoForSize):
        (WebCore::BitmapInfo::create):
        (WebCore::BitmapInfo::createBottomUp):
        * platform/win/BitmapInfo.h: Added.
        * platform/graphics/win/GraphicsContextCairoWin.cpp:
        * platform/graphics/win/GraphicsContextCGWin.cpp:
        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
        (WebCore::TransformationMatrix::operator XFORM): New operator
        * platform/win/DragImageCGWin.cpp:
        (WebCore::allocImage):
        * platform/win/DragImageCairoWin.cpp:
        (WebCore::allocImage):
        * platform/win/PasteboardWin.cpp:
        (WebCore::Pasteboard::writeImage):
        (WebCore::PopupMenu::paint):
2009-06-17  Adam Roben  <aroben@apple.com>
        Remove unnecessary 6th parameter from SOFT_LINK_OPTIONAL
        * platform/graphics/win/ColorSafari.cpp: Removed the 6th parameter and
        an unnecessary parameter name.
        * platform/win/SoftLinking.h: Removed the unused 6th parameter.
2009-06-17  Adam Roben  <aroben@apple.com>
        Make Settings::shouldPaintNativeControls default to true
        This matches the default up in WebKit (that was changed in r43318).
        Fixes Bug 26493: REGRESSION (r44758): First tab always uses Mac-style
        form controls
        <https://bugs.webkit.org/show_bug.cgi?id=26493>
        Reviewed by Darin Adler and Dave Hyatt.
        No test possible since DRT always uses Mac-style form controls.
        * page/Settings.cpp: Changed the initial value of
        gShouldPaintNativeControls to true.
        * rendering/RenderThemeSafari.cpp:
        (WebCore::RenderTheme::themeForPage): Added a FIXME about the design
        flaw here involving querying Settings before it's been initialized.
2009-06-17  David Levin  <levin@chromium.org>
        Fix chromium windows build.
        A mistake that happened during the complicated merge for
        landing r44775, r44776, r44777.
        * rendering/RenderThemeChromiumWin.h:
        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
2009-06-17  Eric Carlson  <eric.carlson@apple.com>
        Reviewed by Simon Fraser.
        <rdar://problem/6981193> Crash in MediaControlInputElement::attachToParent
        * rendering/MediaControlElements.cpp:
        (WebCore::MediaTextDisplayElement::attachToParent): NULL check element renderer or parent renderer.
        (WebCore::MediaControlInputElement::attachToParent): Ditto.
2009-06-17  David Hyatt  <hyatt@apple.com>
        Fix Windows build.  There's no HTMLDataGridElement.cpp file yet.
        * html/HTMLElementsAllInOne.cpp:
2009-06-17  David Hyatt  <hyatt@apple.com>
        Reviewed by Adam Roben and Anders Carlsson.
        Stub out the HTMLDataGridElement.
        * WebCoreSources.bkl:
        (WebCore::CSSStyleSelector::adjustRenderStyle):
        (WebCore::canHaveChildrenForEditing):
        * html/HTMLDataGridElement.h: Added.
        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
        (WebCore::HTMLDataGridElement::tagPriority):
        * html/HTMLDataGridElement.idl: Added.
        * html/HTMLTagNames.in:
2009-06-17  David Levin  <levin@chromium.org>
        Reviewed by NOBODY (chromium build fix).
        Fix typo in previous changes.
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
2009-06-17  Albert J. Wong  <ajwong@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=26148
        Remove common code from RenderThemeChromiumWin that is shared with
        RenderThemeChromiumSkia.
        Also move supportsControlTints to RenderThemeChromiumLinux since it
        is linux specific.
        There are no tests changed because this just removes functions with
        duplicate implementations between the base and derived classes.
        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore::RenderThemeChromiumLinux::supportsControlTints):
        * rendering/RenderThemeChromiumLinux.h:
        * rendering/RenderThemeChromiumSkia.cpp:
        * rendering/RenderThemeChromiumSkia.h:
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore::):
        (WebCore::getNonClientMetrics):
        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
        (WebCore::RenderThemeChromiumWin::systemFont):
        (WebCore::RenderThemeChromiumWin::paintCheckbox):
        (WebCore::RenderThemeChromiumWin::paintRadio):
        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
        (WebCore::RenderThemeChromiumWin::caretBlinkIntervalInternal):
        * rendering/RenderThemeChromiumWin.h:
2009-06-17  Albert J. Wong  <ajwong@chromium.org>
        https://bugs.webkit.org/show_bug.cgi?id=26148
        Move RenderThemeChromiumSkia into its own file.  This is purely a code move.
        * rendering/RenderThemeChromiumLinux.cpp:
        * rendering/RenderThemeChromiumLinux.h:
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::):
        (WebCore::setSizeIfAuto):
        (WebCore::mediaElementParent):
        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
        (WebCore::RenderThemeChromiumSkia::supportsHover):
        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
        (WebCore::RenderThemeChromiumSkia::systemFont):
        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
        (WebCore::RenderThemeChromiumSkia::paintRadio):
        (WebCore::RenderThemeChromiumSkia::setRadioSize):
        (WebCore::brightenColor):
        (WebCore::paintButtonLike):
        (WebCore::RenderThemeChromiumSkia::paintButton):
        (WebCore::RenderThemeChromiumSkia::paintTextField):
        (WebCore::RenderThemeChromiumSkia::paintTextArea):
        (WebCore::RenderThemeChromiumSkia::paintSearchField):
        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
        (WebCore::RenderThemeChromiumSkia::paintMenuList):
        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
        * rendering/RenderThemeChromiumSkia.h:
        (WebCore::RenderThemeChromiumSkia::supportsControlTints):

2009-06-17  Albert J. Wong  <ajwong@chromium.org>
        Reviewed by Eric Seidel.
        https://bugs.webkit.org/show_bug.cgi?id=26148
        Extract RenderThemeChromiumSkia out of RenderThemeChromiumLinux.  This
        is mostly a code shuffle.  The non-suffle changes are:
           1) Creation of a caretBlinkIntervalInternal.
           2) Moving of some inline functions into the implementation files.
           3) Changing of defaultGUIFont into a static class constant from a
              static function.  Also the type is changed to String.
           4) Changing of defaultFontSize into a static class constant from a
              static variable in the file scope.
           5) The static supportsFocus function was collapsed into
              supportsFocusRing.
           6) Split the extraDefaultStyleSheet into Skia and Linux versions.
        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
        (WebCore::RenderThemeChromiumSkia::supportsHover):
        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
        (WebCore::RenderThemeChromiumSkia::systemFont):
        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
        (WebCore::RenderThemeChromiumSkia::paintRadio):
        (WebCore::RenderThemeChromiumSkia::setRadioSize):
        (WebCore::RenderThemeChromiumSkia::paintButton):
        (WebCore::RenderThemeChromiumSkia::paintTextField):
        (WebCore::RenderThemeChromiumSkia::paintTextArea):
        (WebCore::RenderThemeChromiumSkia::paintSearchField):
        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
        (WebCore::RenderThemeChromiumSkia::paintMenuList):
        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
        (WebCore::RenderThemeChromiumLinux::systemColor):
        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
        * rendering/RenderThemeChromiumLinux.h:
2009-06-17  Adam Roben  <aroben@apple.com>
        Add a SOFT_LINK_OPTIONAL macro
        This macro is useful when soft-linking functions that are present in
        only some versions of a particular library (e.g., APIs added in
        Windows Vista that aren't available on Windows XP).
        Reviewed by Ada Chan.
        * platform/graphics/win/ColorSafari.cpp:
        (WebCore::focusRingColor):
        Use the SoftLinking.h macros instead of doing the soft-link ourselves.
        Also removed an unused call to focusRingColor.isValid().
        * platform/win/SoftLinking.h: Added SOFT_LINK_OPTIONAL.
2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
        Reviewed by Gustavo Noronha.
        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26470.
        The use of zero-width or zero-height rectangles in generating
        gradients caused Windows Cairo to crash, and webkitgtk to
        produce invalid images.
        We now test for NaN in the phase argument, which is calculated
        using fmodf and can blow up when the width/height values passed
        are zero.
        Test: fast/gradients/border-image-gradient-sides-and-corners.html
        * platform/graphics/cairo/ImageCairo.cpp:
2009-06-17  Ojan Vafai  <ojan@chromium.org>
        Reviewed by Dimitri Glazkov.
        If loading a font fails because of the sandbox, we ask the browser process to
        try to load it by calling ensureFontLoaded. If it still fails after
        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.
        This case happens once in a while during browser shutdown. The browser will
        queue a message to the renderer to shutdown, and will then stop answering sync
        messages from the renderer. If the renderer is still loading a page during this
        time, it might try to call the browser process to ask to load a font. The
        browser process will ignore the request, and the font will fail to load, even
        after the second try.
        This is unfortunate, but there is no real risk here, since the renderer will be
        going away as soon as it processes another message.

        This can't be layout tested as it depends on the sandbox.

        https://bugs.webkit.org/show_bug.cgi?id=26484
        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
        (WebCore::fontContainsCharacter):
2009-06-17  Eric Carlson  <eric.carlson@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26482
        <rdar://problem/6978590> When setting playback rate to 0, the audio element stops
        playing (doesn't resume later)
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivate::setRate): Always set the rate, even when "paused".
        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
        (WebCore::MediaPlayerPrivate::setRate): Ditto.
2009-06-17  Adam Roben  <aroben@apple.com>
        Add all the generated JS*.cpp files back to WebCore.vcproj
        They are not compiled by the vcproj directly. Instead they are
        compiled as part of DerivedSources.cpp. Having them listed in the
        vcproj makes them be included in Project Find, etc.
        Rubber-stamped in advance by Steve Falkenburg.
2009-06-17  Kent Tamura  <tkent@chromium.org>
        Reviewed by Darin Fisher.
        Don't fire redundant 'change' events for a file upload form.
        https://bugs.webkit.org/show_bug.cgi?id=26471
        (WebCore::FileChooser::chooseFiles): Suppress change event if the
        existing selected files and the incoming selected files are equal.
        (WebCore::FileChooser::chooseIcon): Returns 0 if there is no selected
        files.
2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
        Reviewed by George Staikos.
        https://bugs.webkit.org/show_bug.cgi?id=23155
        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
        * platform/KeyboardCodes.h:
2009-06-17  George Staikos  <george.staikos@torchmobile.com>
        Reviewed by Adam Treat.
        https://bugs.webkit.org/show_bug.cgi?id=23155
        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
        (WebCore::GraphicsContext::getWindowsContext):
        * platform/win/SystemTimeWin.cpp:
        (WebCore::userIdleTime):
2009-06-17  Adam Roben  <aroben@apple.com>
        Speculative Mac build fix
        * page/Page.h: Forward-declare RenderTheme instead of including
        RenderTheme.h so that we don't need to make RenderTheme.h a private
        header for WebKit's benefit.
        * editing/SelectionController.cpp:
        * rendering/InlineTextBox.cpp:
        Added #includes of RenderTheme.h.
2009-06-17  Adam Roben  <aroben@apple.com>
        Speculative Mac build fix
        (WebCore::RenderTheme::create): Added.
2009-06-17  Adam Roben  <aroben@apple.com>
        Speculative Mac build fix
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderTheme::themeForPage): Remove the name of an unused
        parameter.
2009-06-17  Adam Roben  <aroben@apple.com>
        Speculative Mac build fix
        * page/Page.cpp:
        (WebCore::Page::Page): Change the initializer order to match the
        declaration order.
2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
        Reviewed by Simon Hausmann.
        Follow up to bug https://bugs.webkit.org/show_bug.cgi?id=26278
        Patch that make WebCore have a RenderTheme per page
        Make the Qt implementation of RenderTheme create a theme per page,
        and use the QStyle associated with the view of each page, in order
        to make the QWidget setStyle() method work as advertised.
        (WebCore::RenderThemeQt::RenderThemeQt):
        (WebCore::RenderThemeQt::qStyle):
        (WebCore::findFrameLineWidth):
        (WebCore::inflateButtonRect):
        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
        (WebCore::RenderThemeQt::setButtonPadding):
        (WebCore::RenderThemeQt::setPopupPadding):
2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
        Reviewed by Dave Hyatt and Adam Roben.
        https://bugs.webkit.org/show_bug.cgi?id=26278
        Patch that make WebCore have a RenderTheme per page
        Create a different RenderTheme per page, so that RenderTheme has
        access to page specific theming. This is needed for the Qt port, as Qt
        supports setting the theme (style) per widget.
        This change was suggested and discussed with Dave Hyatt.
        More detailed:
        1) Create a theme per page or one global one, depending on the needs
           of the platform.
        2) Add an accesser to the theme from RenderObject.
        3) Change all uses of the theming to access the theme through
           RenderObject, using the global default theme as fallback, when the
           document of RenderObject has no page.
           When we don't have access to a RenderObject, use the default theme.
        4) Modify all RenderTheme platform implementations to work with the
           above changes, still creating only one global theme.
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::boundingBoxRect):
        (WebCore::loadFullDefaultStyle):
        (WebCore::CSSStyleSelector::adjustRenderStyle):
        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::setActive):
        (WebCore::ContainerNode::setHovered):
        * editing/SelectionController.cpp:
        (WebCore::SelectionController::focusedOrActiveStateChanged):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::parseMappedAttribute):
        (WebCore::HTMLInputElement::setChecked):
        (WebCore::HTMLInputElement::setIndeterminate):
        * page/Frame.cpp:
        (WebCore::Frame::selectionLayoutChanged):
        * page/FrameView.cpp:
        (WebCore::FrameView::updateControlTints):
        * page/Page.cpp:
        (WebCore::Page::Page):
        * page/Page.h:
        (WebCore::Page::theme):
        * platform/chromium/PopupMenuChromium.cpp:
        (WebCore::PopupListBox::paintRow):
        * platform/gtk/RenderThemeGtk.cpp:
        (WebCore::RenderThemeGtk::create):
        (WebCore::RenderTheme::themeForPage):
        (WebCore::RenderThemeGtk::RenderThemeGtk):
        (WebCore::RenderThemeGtk::~RenderThemeGtk):
        (WebCore::RenderThemeGtk::gtkEntry):
        (WebCore::RenderThemeGtk::gtkTreeView):
        * platform/gtk/RenderThemeGtk.h:
        (WebCore::RenderThemeQt::create):
        (WebCore::RenderTheme::themeForPage):
        * rendering/RenderMediaControls.cpp:
        (WebCore::determineState):
        * platform/wx/RenderThemeWx.cpp:
        (WebCore::RenderThemeWx::create):
        (WebCore::RenderTheme::themeForPage):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paintTextMatchMarker):
        * rendering/MediaControlElements.cpp:
        (WebCore::MediaControlInputElement::hitTest):
        (WebCore::RenderObject::theme):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::adjustStyle):
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::defaultTheme):
        * rendering/RenderThemeChromiumLinux.cpp:
        (WebCore::RenderThemeChromiumLinux::create):
        (WebCore::RenderTheme::themeForPage):
        * rendering/RenderThemeChromiumLinux.h:
        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
        * rendering/RenderThemeChromiumMac.h:
        * rendering/RenderThemeChromiumMac.mm:
        (WebCore::RenderThemeChromiumMac::create):
        (WebCore::RenderTheme::themeForPage):
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore::RenderThemeChromiumWin::create):
        (WebCore::RenderTheme::themeForPage):
        * rendering/RenderThemeChromiumWin.h:
        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
        * rendering/RenderThemeMac.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderTheme::themeForPage):
        * rendering/RenderThemeSafari.cpp:
        (WebCore::RenderThemeSafari::create):
        (WebCore::RenderTheme::themeForPage):
        * rendering/RenderThemeSafari.h:
        (WebCore::RenderThemeWin::create):
        (WebCore::RenderTheme::themeForPage):
2009-06-17  Gavin Barraclough  <barraclough@apple.com>
        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
        JSDOMWindowCustom was using PropertySlot::putValue, however this interface
        appears to be fundaementally incorrect - PropertySlots are only used to get
        values, all puts use PutPropertySlot.  However PutPropertySlot cannot be
        used in the fashion desired here - it only reports the caching type of a
        write that has been performed.
        (This caused a bug where the put should have triggered a transition, and
        failed to do so.)
        Removing the faulty case from the optimization leads to a ~0.5% progression
        on in-browser SunSpider (presumably the very first case was not being hit
        often, and the simplification here is beneficial).
        (WebCore::JSDOMWindow::put):
2009-06-17  David Levin  <levin@chromium.org>
        Reviewed by NOBODY, layout tests fix.
        https://bugs.webkit.org/show_bug.cgi?id=26326
        This reverts commit r44751.
        Once that change was checked scrollbars/scrollbar-orientation.html started
        crashing on Windows.
        (WebCore::Document::detach):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::destroy):
        * rendering/RenderScrollbar.h:
2009-06-16  Kevin Watters  <kevinwatters@gmail.com>
        Reviewed by Kevin Ollivier.
        In ImageSource::setData, delete the old m_encoder before replacing it with a new one.

        https://bugs.webkit.org/show_bug.cgi?id=26458
        * platform/graphics/wx/ImageSourceWx.cpp:
        (WebCore::ImageSource::setData):
2009-06-16  David Levin  <levin@chromium.org>
        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
        https://bugs.webkit.org/show_bug.cgi?id=26326
        Test: scrollbars/scrollbar-crash-on-refresh.html
        * dom/Document.cpp:
        (WebCore::Document::detach):
        Gives the FrameView a change to do any necessary cleanup on
        Document::detach() which is where the renderArena gets detroyed.
        (WebCore::FrameView::detachCustomScrollbars):
        Gets rid of any custom scrollbars (if the docment supplied them).
        (WebCore::Scrollbar::isCustomScrollbar):
        (WebCore::RenderObject::destroy):
        Removed the check for document()->frame().  If frame() is 0 in this code,
        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
        * rendering/RenderScrollbar.h:
        (WebCore::RenderScrollbar::isCustomScrollbar):
2009-06-16  Brian Weinstein  <bweinstein@apple.com>
        Reviewed by Adele Peterson.
        Fix of <rdar://6967547> Ctrl-C copies null value erasing text in clipboard in Safari.
        This patch kept the way events were firing as they were before, and Windows events are
        consistent with Mac.
        * editing/Editor.cpp:
        (WebCore::Editor::tryDHTMLCopy): Added check for canCopy() before clearing PasteBoard
        (WebCore::Editor::tryDHTMLCut): Added check for canCut() before clearing PasteBoard
2009-06-16  Antti Koivisto  <antti@apple.com>
        Reviewed by Brady Eidson.
        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient + 53

        When revalidating a resource, calling addClient() on one client might cause another to get removed.

        - made CachedResource::addClient() non-virtual and added virtual didAddClient()
        - in CachedResource::switchClientsToRevalidatedResource() add all clients to the client set of the revalidated resource first
        - check if the client is still in the set before invoking didAddClient() for it

        No test case, I didn't manage to construct one. You need some combination of 304 revalidation, stylesheets that
        reference each other via @imports and reloading.
        * loader/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::didAddClient):
        * loader/CachedCSSStyleSheet.h:
        (WebCore::CachedFont::didAddClient):
        (WebCore::CachedImage::didAddClient):
        (WebCore::CachedResource::addClientToSet):
        (WebCore::CachedResource::switchClientsToRevalidatedResource):
        * loader/CachedScript.cpp:
        (WebCore::CachedScript::didAddClient):
        * loader/CachedScript.h:
        * loader/CachedXSLStyleSheet.cpp:
        (WebCore::CachedXSLStyleSheet::didAddClient):
        * loader/CachedXSLStyleSheet.h:
2009-06-16  Simon Fraser  <simon.fraser@apple.com>
        No Review
        Fix code inside an #ifdef that draws the video framerate.
        (WebCore::MediaPlayerPrivate::paint):
2009-06-16  Jian Li  <jianli@chromium.org>
        Reviewed by Dimitri Glazkov.
        Bug 26456: Hook up V8 bindings for Worker's importScripts functionality.
        https://bugs.webkit.org/show_bug.cgi?id=26456
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8WorkerCustom.cpp: Fixed missing exception code
          handling in Worker constructor for V8 bindings.
        (WebCore::CALLBACK_FUNC_DECL):
2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
        Reviewed by Maciej Stachowiak.
        Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
        Provide an assignment operator to avoid improper reference
        counts on the Cairo font objects.  This brings the Windows
        Cairo port in line with the GTK+ port.
        * platform/graphics/win/FontPlatformData.h:
        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
        (WebCore::FontPlatformData::FontPlatformData):
        (WebCore::FontPlatformData::operator=):
2009-06-16  Eric Carlson  <eric.carlson@apple.com>
        Reviewed by Simon Fraser.
        Fix for <rdar://problem/6890126> Theme code should fetch the MediaControlElementType from
        the MediaControlInputElement, rather than computing it again
        (WebCore::HTMLMediaElement::percentLoaded): New, utility function for controller implementation.
        * html/HTMLMediaElement.h:
        * rendering/MediaControlElements.h:
        (WebCore::MediaControlInputElement::displayType): New, return m_displayType.
        * rendering/RenderMediaControls.cpp:
        (WebCore::RenderMediaControls::paintMediaControlsPart): Stop using MediaPlayer object, get button
        state from the button itself and get movie state from HTMLMediaElement.
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintMediaMuteButton): Get state from button instead of MediaPlayer.
        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto.
2009-06-16  Jian Li  <jianli@chromium.org>
        Reviewed by David Levin.
        Bug 26450: Rename values of enum RedirectOriginCheck to make them
        clearer.
        https://bugs.webkit.org/show_bug.cgi?id=26450
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::create):
        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
        (WebCore::DocumentThreadableLoader::willSendRequest):
        * loader/DocumentThreadableLoader.h:
        * loader/ThreadableLoader.cpp:
        (WebCore::ThreadableLoader::create):
        (WebCore::ThreadableLoader::loadResourceSynchronously):
        * loader/ThreadableLoader.h:
        * workers/Worker.cpp:
        (WebCore::Worker::Worker):
        * workers/WorkerContext.cpp:
        (WebCore::WorkerContext::importScripts):
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
        * loader/WorkerThreadableLoader.h:
        (WebCore::WorkerThreadableLoader::create):
        * workers/WorkerScriptLoader.cpp:
        (WebCore::WorkerScriptLoader::loadSynchronously):
        (WebCore::WorkerScriptLoader::loadAsynchronously):
        * workers/WorkerScriptLoader.h:
        (WebCore::WorkerContext::importScripts):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
2009-06-16  Tony Chang  <tony@chromium.org>
        Reviewed by Darin Fisher.
        Fix a UMR in WebCore::BitStack by initializing new memory to 0.
        https://bugs.webkit.org/show_bug.cgi?id=26449
        No new tests, covered by purify.
        * editing/TextIterator.cpp:
        (WebCore::BitStack::push):
2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
        Reviewed by Xan Lopez.
        Test: fast/multicol/columns-shorthand-parsing.html
        Fixes https://bugs.webkit.org/show_bug.cgi?id=26453.
        Null Cairo contextwill crash Windows Cairo build.
        * platform/graphics/win/GraphicsContextCairoWin.cpp:
        (WebCore::GraphicsContextPlatformPrivate::syncContext):
          Add a check for null context before attempting to
          retrieve the Cairo surface.
2009-06-16  Peter Kasting  <pkasting@google.com>
        Reviewed by Xan Lopez.
        https://bugs.webkit.org/show_bug.cgi?id=26447
        Fix animated GIF breakage in Cairo/wx ports.
        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
        (WebCore::RGBA32Buffer::copyBitmapData):
        (WebCore::RGBA32Buffer::operator=):
        * platform/image-decoders/wx/ImageDecoderWx.cpp:
        (WebCore::RGBA32Buffer::copyBitmapData):
        (WebCore::RGBA32Buffer::operator=):
2009-06-16  Pierre d'Herbemont  <pdherbemont@apple.com>
        Reviewed by John Sullivan

        <rdar://problem/6937882>

        Tweak "time remaining" and "time elapsed" fields in the overlay video controller.
        * css/mediaControlsQT.css:
2009-06-16  Jian Li  <jianli@chromium.org>
        Reviewed by Adam Barth and David Levin.
        Bug 26146: Change to use ThreadableLoader to load the worker script
        in order to check URL origin for redirection.
        https://bugs.webkit.org/show_bug.cgi?id=26146
        Test: http/tests/workers/worker-redirect.html
        * workers/Worker.cpp:
        (WebCore::Worker::Worker):
        (WebCore::Worker::notifyFinished):
        * workers/Worker.h:
        * workers/WorkerContext.cpp:
        (WebCore::WorkerContext::importScripts):
        * workers/WorkerImportScriptsClient.cpp: Removed.
        * workers/WorkerImportScriptsClient.h: Removed.
        * workers/WorkerScriptLoader.cpp: Renamed from workers/WorkerImportScriptsClient.cpp.
          This to make it more generic so worker script loading could use it.
        (WebCore::WorkerScriptLoader::loadSynchronously):
        (WebCore::WorkerScriptLoader::loadAsynchronously):
        (WebCore::WorkerScriptLoader::didFinishLoading):
        (WebCore::WorkerScriptLoader::didFail):
        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
        (WebCore::WorkerScriptLoader::notifyFinished):
        * workers/WorkerScriptLoader.h: Renamed from workers/WorkerImportScriptsClient.h.
          This to make it more generic so worker script loading could use it.
        * workers/WorkerScriptLoaderClient.h: Added.
2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
        Use consistent GUID comparison functions.
        https://bugs.webkit.org/show_bug.cgi?id=26427
        * platform/win/WCDataObject.cpp:
        (WebCore::WCDataObject::QueryInterface):
2009-06-16  Xan Lopez  <xlopez@igalia.com>
        Reviewed by Gustavo Noronha.
        Fix compiler warning.
        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
        (webkit_accessible_class_init):
2009-06-16  Xan Lopez  <xlopez@igalia.com>
        Reviewed by Gustavo Noronha.
        Remove dummy AtkStreamableContent implementation.
        It's completely empty, we'll add it back (and conditionally
        instead of unconditionally) when it does something.
        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
        (GetAtkInterfaceTypeFromWAIType):
        (getInterfaceMaskFromObject):
== Rolled over to ChangeLog-2009-06-16 ==
++ b/WebKit/ChangeLog
2009-06-08  Dan Bernstein  <mitz@apple.com>

        Rubber-stamped by Mark Rowe.

        - updated the project after giving Objective-C++ the .mm extension

        * WebKit.xcodeproj/project.pbxproj:

++ b/WebKit/gtk/ChangeLog
2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Reviewed by Gustavo Noronha and Xan Lopez.

        [Gtk] Implement DRT XSS auditor support
        https://bugs.webkit.org/show_bug.cgi?id=26571

        Add a setting "enable-xss-auditor" to enable this feature.

        * webkit/webkitwebsettings.cpp:
        (webkit_web_settings_class_init):
        (webkit_web_settings_set_property):
        (webkit_web_settings_get_property):
        (webkit_web_settings_copy):
        * webkit/webkitwebview.cpp:
        (webkit_web_view_update_settings):
        (webkit_web_view_settings_notify):

2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Reviewed by Gustavo Noronha and Xan Lopez.

        webkit_web_back_forward_list_add_item() should add a ref for the history item
        https://bugs.webkit.org/show_bug.cgi?id=26517

        Add a ref to the WebHistoryItem when it's added to the back
        forward list through webkit_web_back_forward_list_add_item.
        This keeps the history item alive and prevents pywebkitgtk from
        crashing

        * tests/testwebbackforwardlist.c:
        (test_webkit_web_history_item_lifetime):
        (test_webkit_web_back_forward_list_order):
        (test_webkit_web_back_forward_list_add_item):
        * webkit/webkitwebbackforwardlist.cpp:
        (webkit_web_back_forward_list_add_item):

2009-06-20  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Jan Alonzo.

        Initial test case for loading statuses.

        * tests/testloading.c: Added.
        (load_finished_cb):
        (status_changed_cb):
        (test_loading_status):
        (main):

2009-06-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Rubber-stamped by Jan Alonzo.

        Fix the ordering in which the new load status goes into the enum
        to avoid ABI breakage.

        * webkit/webkitwebframe.h:

2009-06-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Reviewed by Xan Lopez and Christian Dywan.

        Add a new load status to report that the first visually non-empty
        layout has been done.

        * WebCoreSupport/FrameLoaderClientGtk.cpp:
        (WebKit::FrameLoaderClient::dispatchDidFirstVisuallyNonEmptyLayout):
        * webkit/webkitwebframe.h:

2009-06-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Reviewed by Xan Lopez.

        Fix parameters of navigation-policy-decision-requested callback,
        to be correct in number and type

        * tests/testhttpbackend.c:
        (navigation_policy_decision_requested_cb):

2009-06-18  Christian Dywan  <christian@twotoasts.de>

        Reviewed by Gustavo Noronha.

        * WebCoreSupport/FrameLoaderClientGtk.cpp:
        (WebKit::loadDone):
        (WebKit::FrameLoaderClient::dispatchDidFinishLoad):
        (WebKit::FrameLoaderClient::dispatchDidFailProvisionalLoad):
        (WebKit::FrameLoaderClient::dispatchDidFailLoad): Introduce the static
        function loadDone to emit "load-done" and update the status and update
        the relevent places. We missed some status notifications before.

2009-06-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Rubber-stamped by Xan Lopez.

        Be consistent in always using the term URI instead of URL in the
        documentation of WebKitWebView signals.

        * webkit/webkitwebview.cpp:
        (webkit_web_view_class_init):

2009-06-16  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Gustavo Noronha.

        Do not use g_assert_cmpint to test for NULL pointer, just
        g_assert.

        * tests/testnetworkrequest.c:
        (test_network_request_create_destroy):

2009-06-15  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Gustavo Noronha.

        https://bugs.webkit.org/show_bug.cgi?id=26377
        [GTK] Confusion about range of 'progress' property

        Range for the progress property is 0.0 .. 1.0, don't multiply it
        by 100 to make it a percentage.

        * webkit/webkitwebview.cpp:
        (webkit_web_view_get_progress):

2009-06-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Unreviewed. Add new symbols list for 1.1.10 release.

        * docs/webkitgtk-docs.sgml:

2009-06-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Rubber-stamped by Xan Lopez.

        Fix Since tags for the new uri and message properties.

        * webkit/webkitnetworkrequest.cpp:
        (webkit_network_request_class_init):

2009-06-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Unreviewed. Adding new documented API to the generated
        documentation.

        * docs/webkitgtk-sections.txt:

2009-06-15  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Gustavo Noronha.

        Update NEWS for 1.1.10 release.

        * NEWS:

2009-06-11  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Xan Lopez.

        Add a test to perform an actual download.

        * tests/testdownload.c:
        (navigation_policy_decision_requested_cb):
        (notify_status_cb):
        (download_requested_cb):
        (test_webkit_download_perform):
        (main):

2009-06-11  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Xan Lopez.

        Fix crash when downloading, caused by assuming SoupMessage would
        be there. This change factors the logic required to create a
        ResourceRequest from a WebKitNetworkRequest into a core()
        function, like we have for some other classes.

        * webkit/webkitdownload.cpp:
        (webkit_download_start):
        * webkit/webkitprivate.cpp:
        (WebKit::core):
        * webkit/webkitprivate.h:
        * webkit/webkitwebframe.cpp:
        (webkit_web_frame_load_request):

2009-06-10  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Xan Lopez.

        Make WebKitNetworkRequest a proper GObject, making URI and
        SoupMessage properties. Also adding unit tests for creation and
        destruction.

        * tests/testnetworkrequest.c: Added.
        (test_network_request_create_destroy):
        (test_network_request_properties):
        (main):
        * webkit/webkitnetworkrequest.cpp:
        (webkit_network_request_get_property):
        (webkit_network_request_set_property):
        (webkit_network_request_class_init):
        (webkit_network_request_init):
        (webkit_network_request_constructor):
        (webkit_network_request_new_with_core_request):
        (webkit_network_request_new):
        (webkit_network_request_set_uri):
        (webkit_network_request_get_uri):
        * webkit/webkitnetworkrequest.h:

2009-06-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Reviewed by Xan Lopez.

        News for 1.1.9.

        * NEWS:

2009-06-09  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Reviewed by Gustavo Noronha.

        Clear the frame name before we run each tests so we don't get
        "someFloaString" or "3" in the target frame name.

        * webkit/webkitprivate.h:
        * webkit/webkitwebframe.cpp:
        (webkit_web_frame_clear_main_frame_name):

2009-06-10  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Jan Alonzo.

        https://bugs.webkit.org/show_bug.cgi?id=25415
        [GTK][ATK] Please implement support for get_text_at_offset

        Update test for new implementation (it fixes two bugs and adds
        actual implementations for LINE boundaries).

        * tests/testatk.c:
        (test_webkit_atk_get_text_at_offset):

2009-06-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>

        Reviewed by Xan Lopez.

        https://bugs.webkit.org/show_bug.cgi?id=26104
        [GTK] Make NetworkRequest a proper GObject and expose SoupMessage

        Refactor how SoupMessage is handled, so that our ResourceRequest
        object doesn't have to store it as a member, which complicates
        managing ResourceRequest's lifetime.

        * tests/testhttpbackend.c:
        (navigation_policy_decision_requested_cb):
        (test_soup_message_lifetime):
        * webkit/webkitnetworkrequest.cpp:
        (WTF::SoupMessage):
        (webkit_network_request_new_with_core_request):

2009-06-08  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Jan Alonzo.

        https://bugs.webkit.org/show_bug.cgi?id=26240
        [GTK] Try again button loses query strings

        Only trigger reload, when try again is clicked, this way we do not
        lose the query strings, like we did when also triggering a form
        submission.

        * resources/error.html:

++ b/WebKit/mac/ChangeLog
2009-06-23  Brady Eidson  <beidson@apple.com>

        Reviewed by Darin Adler.

        <rdar://problem/6950660> REGRESSION: iSale 5.5.3 crashes after I click a template to load

        Due to some subtle WebKit changes - presumably some delegate callback behavior - a latent bug in
        iSale was uncovered where they aren't properly retaining their FrameLoadDelegate, and we ended up
        calling back to a dealloc'ed object.

        * WebView/WebView.mm:
        (-[WebView _needsAdobeFrameReloadingQuirk]): Use more intelligent C++-style initialization.
        (-[WebView _needsKeyboardEventDisambiguationQuirks]): Ditto.
        (-[WebView _needsFrameLoadDelegateRetainQuirk]): YES for iSale versions under 5.6
        (-[WebView dealloc]): Release the delegate if the quirk is in effect.
        (-[WebView setFrameLoadDelegate:]): Retain the new delegate if the quirk is in effect.

2009-06-23  Anders Carlsson  <andersca@apple.com>

        Reviewed by Darin Adler.

        - Fix <rdar://problem/6965672>

        Defer calls to WKPCInvalidateRect, so we don't try to invalidate while waiting for a reply, since
        that is too early.

        * Plugins/Hosted/NetscapePluginHostProxy.h:
        (WebKit::NetscapePluginHostProxy::isProcessingRequests):
        * Plugins/Hosted/NetscapePluginHostProxy.mm:
        (WebKit::NetscapePluginHostProxy::NetscapePluginHostProxy):
        (WebKit::NetscapePluginHostProxy::processRequests):
        (WKPCInvalidateRect):

2009-06-22  Timothy Hatcher  <timothy@apple.com>

        Add Mail on Tiger and Leopard to the list of applications that need the WebView init thread workaround.

        <rdar://problem/6929524> Console shows WebKit Threading Violations from Mail

        Reviewed by Anders Carlsson.

        * WebView/WebView.mm:
        (clientNeedsWebViewInitThreadWorkaround): Return true for com.apple.Mail.

2009-06-22  Dan Bernstein  <mitz@apple.com>

        Reviewed by Anders Carlsson.

        - speculative fix for <rdar://problem/6889082>
          Crash at -[WebHTMLView(WebPrivate) _updateMouseoverWithEvent:]

        The crash seems to happen because lastHitView points to a deleted
        object. Since -close calls -_clearLastHitViewIfSelf, I speculate that
        lastHitView has been set to an already-closed view.

        * WebView/WebHTMLView.mm:
        (-[WebHTMLView hitTest:]): Return nil if the view is closed.

2009-06-22  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by John Sullivan.

        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
        Japanese can't be input.

        * WebView/WebHTMLView.mm: (-[WebHTMLView _updateSelectionForInputManager]): Removed an
        unnecessary check - the function has an early return for null frame.

2009-06-22  Dan Bernstein  <mitz@apple.com>

        Reviewed by Dave Hyatt.

        - fix <rdar://problem/6990938> REGRESSION (r42787): After showing and
          hiding the Find banner, the WebHTMLView's height is not restored

        * WebView/WebFrameView.mm:
        (-[WebFrameView setFrameSize:]): Mark the FrameView for layout when the
        WebFrameView's size changes.
        * WebView/WebView.mm:
        (-[WebView setFrameSize:]): Left the resize logic here, but only for
        the single view model.

2009-06-20  Darin Adler  <darin@apple.com>

        Reviewed by Sam Weinig.

        <rdar://problem/6964221> Need more processing of pluginspage.

        * WebCoreSupport/WebFrameLoaderClient.mm:
        (WebFrameLoaderClient::createPlugin): Check protocolInHTTPFamily.

2009-06-18  Adam Barth  <abarth@webkit.org>

        Reviewed by Sam Weinig.

        https://bugs.webkit.org/show_bug.cgi?id=26199

        Added preference to enable the XSSAuditor.

        * WebView/WebPreferenceKeysPrivate.h:
        * WebView/WebPreferences.mm:
        (+[WebPreferences initialize]):
        (-[WebPreferences isXSSAuditorEnabled]):
        (-[WebPreferences setXSSAuditorEnabled:]):
        * WebView/WebPreferencesPrivate.h:
        * WebView/WebView.mm:
        (-[WebView _preferencesChangedNotification:]):

2009-06-18  Anders Carlsson  <andersca@apple.com>

        Reviewed by Sam Weinig.

        <rdar://problem/6926859>
        NPN_ConvertPoint doesn't give the right value when converting to/from NPCoordinateSpaceFlippedScreen

        When inverting Y, use the height of the first screen instead of the screen the window is on.

        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
        (WebKit::NetscapePluginInstanceProxy::windowFrameChanged):
        (WebKit::NetscapePluginInstanceProxy::mouseEvent):
        * Plugins/WebBaseNetscapePluginView.mm:
        (-[WebBaseNetscapePluginView convertFromX:andY:space:toX:andY:space:]):

2009-06-16  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Dan Bernstein

        <rdar://problem/6976766> Control-click on pages with accelerated compositing
        content does not work.

        Part deux. #ifdef the use of _private->layerHostingView with
        USE(ACCELERATED_COMPOSITING)

        * WebView/WebHTMLView.mm:
        (-[WebHTMLView hitTest:]):

2009-06-16  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Dan Bernstein

        <rdar://problem/6976766> Control-click on pages with accelerated compositing
        content does not work.

        Remove the WebLayerHostingView subclass of NSView, with its attempts to
        forward events to the WebHTMLView, and just fix -[WebHTMLView hitTest:]
        to ignore the layerHostingView.

        * WebView/WebHTMLView.mm:
        (-[WebHTMLView hitTest:]):
        (-[WebHTMLView attachRootLayer:]):

2009-06-15  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Mark Rowe.

        <rdar://problem/6974857>

        Define ENABLE_3D_RENDERING when building on 10.6, and move ENABLE_3D_RENDERING
        switch from config.h to wtf/Platform.h.

        * Configurations/FeatureDefines.xcconfig:
        * WebKitPrefix.h:

2009-06-15  Anders Carlsson  <andersca@apple.com>

        Reviewed by Dan Bernstein.

        <rdar://problem/6967569>
        CrashTracer: 15 crashes in Safari at com.apple.WebKit • WebKit::NetscapePluginHostManager::didCreateWindow + 85

        Make sure to remove the entry from the plug-in host map so we won't end up with an entry that has a null value.

        * Plugins/Hosted/NetscapePluginHostManager.mm:
        (WebKit::NetscapePluginHostManager::hostForPackage):

2009-06-15  Dan Bernstein  <mitz@apple.com>

        Reviewed by Tim Hatcher.

        - make the source code font in the Web Inspector match Mac defaults

        * WebCoreSupport/WebInspectorClient.mm:
        (-[WebInspectorWindowController init]): Set the default monospace font
        to 11px Menlo, except on Leopard and Tiger where it is 10px Monaco.

2009-06-09  Justin Garcia  <justin.garcia@apple.com>

        Reviewed by Eric Seidel.  Landed by Adam Barth.

        https://bugs.webkit.org/show_bug.cgi?id=26281

        REGRESSION: Copying from TextEdit/OmniGraffle and pasting into editable
        region loses images

        Prefer RTFD (RTF with inline images) over RTF.  In
        http://trac.webkit.org/changeset/19745 I accidently reversed their
        order.

        * WebView/WebHTMLView.mm:
        (-[WebHTMLView _documentFragmentFromPasteboard:inContext:allowPlainText:]):

2009-06-13  Adam Barth  <abarth@webkit.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=24492

        Move registerURLSchemeAsLocal from FrameLoader to SecurityOrigin

        * WebView/WebView.mm:
        (+[WebView registerURLSchemeAsLocal:]):

2009-06-12  Peter Kasting  <pkasting@google.com>

        Reviewed by Eric Seidel.

        * ChangeLog-2007-10-14: Change pseudonym "Don Gibson" to me (was used while Google Chrome was not public); update my email address.

2009-06-08  Dan Bernstein  <mitz@apple.com>

        Rubber-stamped by Mark Rowe.

        - gave Objective-C++ files the .mm extension

        * Carbon/HIWebView.m: Removed.
        * Carbon/HIWebView.mm: Copied from WebKit/mac/Carbon/HIWebView.m.
        * Misc/WebKitNSStringExtras.m: Removed.
        * Misc/WebKitNSStringExtras.mm: Copied from WebKit/mac/Misc/WebKitNSStringExtras.m.
        * Misc/WebStringTruncator.m: Removed.
        * Misc/WebStringTruncator.mm: Copied from WebKit/mac/Misc/WebStringTruncator.m.
        * WebInspector/WebNodeHighlight.m: Removed.
        * WebInspector/WebNodeHighlight.mm: Copied from WebKit/mac/WebInspector/WebNodeHighlight.m.
        * WebInspector/WebNodeHighlightView.m: Removed.
        * WebInspector/WebNodeHighlightView.mm: Copied from WebKit/mac/WebInspector/WebNodeHighlightView.m.
        * WebView/WebDynamicScrollBarsView.m: Removed.
        * WebView/WebDynamicScrollBarsView.mm: Copied from WebKit/mac/WebView/WebDynamicScrollBarsView.m.

++ b/WebKit/qt/ChangeLog
2009-06-19  Daniel <qt-info@nokia.com>

        Reviewed by Simon Hausmann.

        Remove warnings for QString() constructions from const char *

        By explicitly wrapping it with QLatin1String() / QLatin1Char()

        * Api/qwebelement.cpp:
        (QWebElement::classes): Use QLatin1String.
        (QWebElement::addClass): Ditto.
        (QWebElement::removeClass): Ditto.
        (QWebElement::toggleClass): Ditto.

2009-06-18  Friedemann Kleint  <Friedemann.Kleint@nokia.com>

        Reviewed by Simon Hausmann.

        Fixed MinGW compilation.

        * Api/qwebelement.cpp:
        (QWebElement::evaluateScript):

2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>

        Reviewed by Simon Hausman.

        Clarify in docs how to compile with debug information.

        * docs/qtwebkit.qdoc:

2009-06-17  Markus Goetz <Markus.Goetz@nokia.com>

        Reviewed by Simon Hausmann.

        QWebPage: Don't call supportsSsl()

        This stops QWebPage from loading the OpenSSL libs,
        certificates etc. when they are not needed for the non-HTTPS case.

        Loading the SSL libraries can be a very slow operation.

        * Api/qwebpage.cpp:
        (QWebPage::userAgentForUrl):

2009-06-15  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>

        Reviewed by Adam Treat.

        Support the back/forward/stop/refresh multimedia keys and accept the
        event when handling backspace and shift backspace as we should.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::keyPressEvent):

2009-06-15  Andre Pedralho  <andre.pedralho@openbossa.org>

        Reviewed by Adam Treat.

        https://bugs.webkit.org/show_bug.cgi?id=26351
        Remove bool QWebHitTestResult::isScrollBar() const and make sure a null QWebHitTestResult is returned instead.

        * Api/qwebframe.cpp:
        (QWebFrame::hitTestContent):
        * Api/qwebframe.h:
        * Api/qwebpage.cpp:
        (QWebPage::updatePositionDependentActions):

2009-06-15  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Adam Treat.

        Fix the logic for disabling the fixed layout feature, when an invalid
        QSize is set.

        * Api/qwebpage.cpp:
        (QWebPage::setFixedContentsSize):

2009-06-13  Adam Barth  <abarth@webkit.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=24492

        Move registerURLSchemeAsLocal from FrameLoader to SecurityOrigin.

        * Api/qwebpage.cpp:
        (QWebPage::acceptNavigationRequest):

        Rubber-stamped by Simon Hausmann.
2009-06-09  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Renamed QWebSettings::AllowUniversalAccessFromFileUrls to
        LocalContentCanAccessRemoteUrls, as discussed in the API review.

        * Api/qwebsettings.cpp:
        (QWebSettingsPrivate::apply):
        (QWebSettings::QWebSettings):
        * Api/qwebsettings.h:

2009-06-09  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Merged useFixedLayout property with fixedLayoutSize and
        renamed the latter to fixedContentsSize.

        * Api/qwebpage.cpp:
        (QWebPage::fixedContentsSize):
        (QWebPage::setFixedContentsSize):
        * Api/qwebpage.h:
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):

2009-06-09  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Renamed QWebHitTestResult::linkTarget to linkElement() and made it return
        a QWebElement. The link target itself is always the target DOM attribute.

        * Api/qwebframe.cpp:
        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
        (QWebHitTestResult::linkElement):
        * Api/qwebframe.h:
        * Api/qwebframe_p.h:
        * tests/qwebframe/tst_qwebframe.cpp:

++ b/WebKit/win/ChangeLog
2009-06-23  Anders Carlsson  <andersca@apple.com>
        WebKit side of <rdar://problem/6946094>.
        * Interfaces/IWebUIDelegate.idl:
        Add a newPasteboard out parameter to willPerformDragSourceAction.
        (WebDragClient::willPerformDragSourceAction):
        Implement this. If the client returns a new pasteboard, use it for the drag.
        * WebCoreSupport/WebInspectorDelegate.h:
        (WebInspectorDelegate::willPerformDragSourceAction):
        Add the new parameter.
2009-06-20  Darin Adler  <darin@apple.com>
        <rdar://problem/6964221> Need more processing of pluginspage.
        (WebFrameLoaderClient::createPlugin): Check protocolInHTTPFamily.
2009-06-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
        https://bugs.webkit.org/show_bug.cgi?id=26494
        Bug 26494: RenderTheme::themeForPage reads from Settings before it has
        been initialized by WebKit
        Get the shouldPaintNativeControls preference and update the settings
        before initializing the page, as the page depends on it after the
        themeForPage change.
2009-06-19  Brian Weinstein  <bweinstein@apple.com>
        https://bugs.webkit.org/show_bug.cgi?id=26488
        No Support for Single Finger or Two Finger Panning in Windows 7
        Added the code necessary for single finger and two-finger panning with
        window bounce. We now register for WM_GESTURENOTIFY and WM_GESTURE messages,
        and interpret the panning command. Also, added WindowsTouch.h which contains
        structs and #defines from the Windows 7 SDK.
        (WebView::gestureNotify): Checks if we are in a pannable region - IE: Not in the scrollbar
        (WebView::gesture): Handles the Panning gesture, creating the WheelEvent
        (WebViewWndProc): Added cases for WM_GESTURE and WM_GESTURENOTIFY
        * WindowsTouch.h: Added.
2009-06-18  Adam Barth  <abarth@webkit.org>
        Reviewed by Sam Weinig.
        https://bugs.webkit.org/show_bug.cgi?id=26199
        Added preference to enable the XSSAuditor.
        (WebPreferences::isXSSAuditorEnabled):
        (WebPreferences::setXSSAuditorEnabled):
2009-06-18  Brent Fulgham  <bfulgham@gmail.com>
        Reviewed by Dave Levin.
        Remove some boilerplate using the BitmapInfo struct.
        https://bugs.webkit.org/show_bug.cgi?id=26425
        (WebFrame::spoolPages):
        (createDIB):
        (WebNodeHighlight::update):
2009-06-17  Steve Falkenburg  <sfalken@apple.com>
        Consolidate WebKit COM interfaces.
        Moved IID from the highest numbered COM interface to the first interface and combined all methods.
        Numbered interfaces can be combined since the latest shipping Safari 4 supports the latest interfaces.
        * WebCoreSupport/WebChromeClient.cpp:
        * WebCoreSupport/WebChromeClient.h:
        * WebCoreSupport/WebContextMenuClient.cpp:
        * WebCoreSupport/WebFrameLoaderClient.cpp:
        * WebCoreSupport/WebInspectorDelegate.h:
2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
        Create a different RenderTheme per page, so that RenderTheme has
        access to page specific theming. This is needed for the Qt port, as Qt
        supports setting the theme (style) per widget.
        This change was suggested and discussed with Dave Hyatt.
        More detailed:
        1) Create a theme per page or one global one, depending on the needs
           of the platform.
        2) Add an accesser to the theme from RenderObject.
        3) Change all uses of the theming to access the theme through
           RenderObject, using the global default theme as fallback, when the
           document of RenderObject has no page.
           When we don't have access to a RenderObject, use the default theme.
        4) Modify all RenderTheme platform implementations to work with the
           above changes, still creating only one global theme.
        (WebViewWndProc): Get the theme from the associated page.
2009-06-16  Brian Weinstein  <bweinstein@apple.com>
        Switch Control+Mousewheel Zooming definitions to match other browsers on Windows.
        Control+Mousewheel-Down now zooms out, Control+Mousewheel-Up now zooms in.
        https://bugs.webkit.org/show_bug.cgi?id=25875.
        <rdar://problem/6903976>
        (WebView::mouseWheel):
2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
        Use consistent Windows GUID Comparison Functions.
        https://bugs.webkit.org/show_bug.cgi?id=26427.
        (EnumTextMatches::QueryInterface):
== Rolled over to ChangeLog-2009-06-16 ==
++ b/WebKit/wx/ChangeLog
2009-06-09  Kevin Ollivier  <kevino@theolliviers.com>

        wx build fix, adding JSCore/assembler to the list of include dirs.

        * presets/wxwebkit.bkl:

++ b/WebKitExamplePlugins/ChangeLog
2009-06-15  Anders Carlsson  <andersca@apple.com>

        Reviewed by Kevin Decker.

        Add Core Animation movie plug-in example.

        * NetscapeCoreAnimationMoviePlugin: Added.
        * NetscapeCoreAnimationMoviePlugin/English.lproj: Added.
        * NetscapeCoreAnimationMoviePlugin/English.lproj/InfoPlist.strings: Added.
        * NetscapeCoreAnimationMoviePlugin/Info.plist: Added.
        * NetscapeCoreAnimationMoviePlugin/MovieControllerLayer.h: Added.
        * NetscapeCoreAnimationMoviePlugin/MovieControllerLayer.m: Added.
        (createImageNamed):
        (-[MovieControllerLayer init]):
        (-[MovieControllerLayer dealloc]):
        (-[MovieControllerLayer _playPauseButtonRect]):
        (-[MovieControllerLayer _sliderRect]):
        (-[MovieControllerLayer _sliderThumbRect]):
        (-[MovieControllerLayer _innerSliderRect]):
        (-[MovieControllerLayer _drawPlayPauseButtonInContext:]):
        (-[MovieControllerLayer _drawSliderInContext:]):
        (-[MovieControllerLayer drawInContext:]):
        (-[MovieControllerLayer _currentTime]):
        (-[MovieControllerLayer _duration]):
        (-[MovieControllerLayer _isPlaying]):
        (-[MovieControllerLayer _updateTime:]):
        (-[MovieControllerLayer _rateDidChange:]):
        (-[MovieControllerLayer _timeDidChange:]):
        (-[MovieControllerLayer actionForKey:]):
        (-[MovieControllerLayer setMovie:]):
        (-[MovieControllerLayer _setNewTimeForThumbCenterX:]):
        (-[MovieControllerLayer handleMouseDown:]):
        (-[MovieControllerLayer handleMouseUp:]):
        (-[MovieControllerLayer handleMouseDragged:]):
        * NetscapeCoreAnimationMoviePlugin/NetscapeCoreAnimationMoviePlugin.xcodeproj: Added.
        * NetscapeCoreAnimationMoviePlugin/NetscapeCoreAnimationMoviePlugin.xcodeproj/project.pbxproj: Added.
        * NetscapeCoreAnimationMoviePlugin/Pause.tiff: Added.
        * NetscapeCoreAnimationMoviePlugin/Play.tiff: Added.
        * NetscapeCoreAnimationMoviePlugin/SliderTrackCenter.tiff: Added.
        * NetscapeCoreAnimationMoviePlugin/SliderTrackLeft.tiff: Added.
        * NetscapeCoreAnimationMoviePlugin/SliderTrackRight.tiff: Added.
        * NetscapeCoreAnimationMoviePlugin/Thumb.tiff: Added.
        * NetscapeCoreAnimationMoviePlugin/main.m: Added.
        (NP_Initialize):
        (NP_GetEntryPoints):
        (NP_Shutdown):
        (NPP_New):
        (NPP_Destroy):
        (NPP_SetWindow):
        (NPP_NewStream):
        (NPP_DestroyStream):
        (NPP_WriteReady):
        (NPP_Write):
        (NPP_StreamAsFile):
        (NPP_Print):
        (handleMouseDown):
        (togglePlayPause):
        (handleMouseUp):
        (handleMouseDragged):
        (handleMouseEntered):
        (handleMouseExited):
        (handleKeyDown):
        (handleScrollEvent):
        (NPP_HandleEvent):
        (NPP_URLNotify):
        (NPP_GetValue):
        (NPP_SetValue):
        * NetscapeCoreAnimationMoviePlugin/test.html: Added.

++ b/WebKitLibraries/ChangeLog
2009-06-16  Simon Fraser  <simon.fraser@apple.com>

        Rubber-stamped by Anders Carlsson.

        Update WebKitSystemInterface for <rdar://problem/6937882>.

        * libWebKitSystemInterfaceLeopard.a:
        * libWebKitSystemInterfaceSnowLeopard.a:
        * libWebKitSystemInterfaceTiger.a:

++ b/WebKitSite/ChangeLog
2009-06-17  Sam Weinig  <sam@webkit.org>

        Reviewed by Mark Rowe.

        * security/index.html: Fix some typos.

2009-06-17  Sam Weinig  <sam@webkit.org>

        Reviewed by Mark Rowe.

        Move security policy to security/index.html so that
        webkit.org/security/ works.

        * nav.inc:
        * security/index.html: Copied from security/security-policy.html.
        * security/security-policy.html: Removed.

2009-06-13  Sam Weinig  <sam@webkit.org>

        Reviewed by Timothy Hatcher.

        Add WebKit Security Policy and member list of the WebKit Security Group.

        * nav.inc:
        * security: Added.
        * security/security-group-members.html: Added.
        * security/security-policy.html: Added.

2009-06-12  Brady Eidson  <beidson@apple.com>

        Reviewed by Oliver Hunt

        Add a page indexing the various demo applications we have posted.

        * demos/index.html: Added.
        * nav.inc: Add a link to the demos page on the side bar
        * css/main.css:  Add a style for date stamps based on the blog.

        * demos/calendar/index.html: Added to redirect to Calendar.html.  I'm not moving Calendar.html to
          index.html as the Calendar.html url has already been published and we should keep it working.

        Move the drosera test code to /misc, as it is no longer a meaningful demo:
        * demos/drosera: Removed.
        * demos/drosera/demo.js: Removed.
        * demos/drosera/drosera.png: Removed.
        * demos/drosera/index.html: Removed.
        * misc/drosera: Copied from demos/drosera.

        Move the sticky notes example into /demos:
        * demos/sticky-notes: Added.
        * demos/sticky-notes/StickyNotes.manifest: Copied from misc/DatabaseExample.manifest.
        * demos/sticky-notes/deleteButton.png: Copied from misc/deleteButton.png.
        * demos/sticky-notes/deleteButtonPressed.png: Copied from misc/deleteButtonPressed.png.
        * demos/sticky-notes/index.html: Copied from misc/DatabaseExample.html.
        * misc/DatabaseExample.html: Changed to redirect to demos/sticky-notes/index.html.  I'm not removing
          it altogether as the misc/DatabaseExample.html url has already been published and we should keep it working.
        * misc/DatabaseExample.manifest: Removed.
        * misc/deleteButton.png: Removed.
        * misc/deleteButtonPressed.png: Removed.

2009-06-10  Brent Fulgham  <bfulgham@webkit.org>

        Reviewed by Eric Seidel.

        Fixes https://bugs.webkit.org/show_bug.cgi?id=26309.
        Update a few items in the testing language to:
        (1) Reflect results are now generated with Leopard (not Tiger)
        (2) Explain how to generate pixel-level layout tests.

        * quality/testing.html:
        * quality/testwriting.html:

++ b/WebKitSite/specs/CSSVisualEffects/ChangeLog
2009-06-16  Chris Marrin  <cmarrin@apple.com>

        Added spec directories from http://dev.w3.org/cvsweb/csswg/
        which is where they will live. We will edit them here and
        then push them to the W3C cvs server.

        css3-2d-transforms/:
        css3-3d-transforms/:
        css3-animations/:
        css3-transitions/:

2009-06-16  Chris Marrin  <cmarrin@apple.com>

        Removed all the specs because they are stale

        index.html: Redirected to point at w3c site

++ b/WebKitTools/ChangeLog
2009-06-24  Eric Seidel  <eric@webkit.org>
        Spell Maciej's name right and add Brady Eidson.
        * Scripts/modules/bugzilla.py:
2009-06-23  Eric Seidel  <eric@webkit.org>
        Reviewed by Dave Levin.
        Fix missing comment message during land-patches and SVN.commit_with_message respecting --dry-run
        https://bugs.webkit.org/show_bug.cgi?id=26669
        * Scripts/bugzilla-tool:
        * Scripts/modules/scm.py:
2009-06-23  Takeshi Yoshino  <tyoshino@google.com>
        Bug 26537: Builds from command-line fail if custom build product directory is set and ~/Library/Preferences/xcodebuild.plist exists
        https://bugs.webkit.org/show_bug.cgi?id=26537
        Let determineBaseProductDir subroutine remove
        ~/Library/Preferences/xcodebuild.plist. It can prevent xcodebuild from
        respecting global settings such as a custom build products directory
        (<rdar://problem/5585899>).
2009-06-23  Eric Seidel  <eric@webkit.org>
        Reviewed by Dave Levin.
        Make SCM.run_command smarter, and make all previous
        os.system and subprocess.popen use SCM.run_command instead.
        https://bugs.webkit.org/show_bug.cgi?id=26666
        This makes it easier to handle errors in a standard way throughout all the code.
        Since this new code raises by default when the exit_code != 0,
        we should prevent future problems of bugzilla-tool continuing after
        a git or svn command failed.
        * Scripts/modules/scm.py:
2009-06-23  Joe Mason  <joe.mason@torchmobile.com>
        Reviewed by Adam Treat.
        https://bugs.webkit.org/show_bug.cgi?id=26664
        * Scripts/prepare-ChangeLog: Added --git-index mode to list only the
        changes which are already staged in the index.  Useful to create an
        entry for what you're about to commit while ignoring unstaged changes.
2009-06-23  Anders Carlsson  <andersca@apple.com>
        Update for WebKit changes.
        * DumpRenderTree/win/UIDelegate.h:
        (UIDelegate::willPerformDragSourceAction):
2009-06-23  Eric Seidel  <eric@webkit.org>
        * Scripts/modules/scm.py: Fix commit_with_message to return the commit output.
2009-06-23  Eric Seidel  <eric@webkit.org>
        * Scripts/modules/scm.py: Fix error seen when commiting r44979.
2009-06-18  Eric Seidel  <eric@webkit.org>
        Reviewed by Dave Levin.
        WebKit needs a script to interact with bugzilla and automate
        parts of the patch posting and commit processes.
        https://bugs.webkit.org/show_bug.cgi?id=26283
        This is really a first-draft tool.
        It's to the point where it's useful to more people than just me now though.
        Git support works.  SVN support is written, but mostly untested.
        This tool requires BeautifulSoup and mechanize python modules to run:
        sudo easy_install BeautifulSoup
        sudo easy_install mechanize
        More important than the tool itself are the Bugzilla, Git and SVN class abstractions
        which I hope will allow easy writing of future tools.
        The tool currently implements 10 commands, described below.
        Helpers for scripting dealing with the commit queue:
        bugs-to-commit                 Bugs in the commit queue
        patches-to-commit              Patches attached to bugs in the commit queue
        Dealing with bugzilla:
        reviewed-patches BUGID         r+'d patches on a bug
        apply-patches BUGID            Applies all patches on a bug to the local working directory without committing.
        land-and-update BUGID          Lands the current working directory diff and updates the bug.
        land-patches [options] BUGID   Lands all patches on a bug optionally testing them first
        obsolete-attachments BUGID     Marks all attachments on a bug as obsolete.
        commit-message                 Prints a commit message suitable for the uncommitted changes.
        These effectively replace git-send-bugzilla:
        post-diff BUGID                Attaches the current working directory diff to a bug as a patch file.
        post-commits BUGID COMMITISH   Attaches a range of local commits to a bug as patch files.
        post-diff works for SVN and Git, post-commits only works for SCMs with local-commit support (like Git)
        land-* commands in a Git environment only work with simple patches due to svn-apply bugs:
        https://bugs.webkit.org/show_bug.cgi?id=26299
        https://bugs.webkit.org/show_bug.cgi?id=26300
        This script follows python style (similar to how for Obj-C we follow AppKit style)
        http://www.python.org/doc/essays/styleguide.html
        The Python community has a strong style culture and the WebKit style guide is silent re: Python.
        I've filed a bug to update the WebKit style guide to mention python:
        https://bugs.webkit.org/show_bug.cgi?id=26524
        * Scripts/bugzilla-tool: Added.
2009-06-22  Steve Falkenburg  <sfalken@apple.com>
        Remove errant line of code mistakenly checked in.
2009-06-22  Steve Falkenburg  <sfalken@apple.com>
        Pass correct value to setShouldPaintNativeControls.

        Rubber stamped by Mark Rowe.
2009-06-22  Steve Falkenburg  <sfalken@apple.com>
        Fix last DumpRenderTree change to correctly set preferences flag without crashing.

2009-06-21  Steve Falkenburg  <sfalken@apple.com>
        Set up global native controls flag before creating the first WebView.

2009-06-21  Mark Rowe  <mrowe@apple.com>
        Set a sensible user agent string for the HTTP requests that Sparkle makes (checking for and downloading updates).
        * WebKitLauncher/WebKitNightlyEnablerSparkle.m:
        (userAgentStringForSparkle):
        (initializeSparkle):
2009-06-21  Mark Rowe  <mrowe@apple.com>
        Add a hook to the WebKit launcher application to allow a link on the nightly build start page to
        trigger an update via the built-in software update mechanism.
        * WebKitLauncher/WebKitLauncher.xcodeproj/project.pbxproj:
        * WebKitLauncher/WebKitLauncherURLProtocol.h: Added.
        * WebKitLauncher/WebKitLauncherURLProtocol.m: Added.
        (+[WebKitLauncherURLProtocol load]):
        (+[WebKitLauncherURLProtocol canInitWithRequest:]): Only allow use of the x-webkit-launcher scheme from .webkit.org subdomains.
        (+[WebKitLauncherURLProtocol canonicalRequestForRequest:]):
        (-[WebKitLauncherURLProtocol startLoading]):
        (-[WebKitLauncherURLProtocol stopLoading]):
        (-[WebKitLauncherURLProtocol handleIsWebKitLauncherAvailableJS]): Return a brief JavaScript snippet that can be used to programatically
        determine whether the x-webkit-launcher is available and working.
        (-[WebKitLauncherURLProtocol handleCheckForUpdates]): Trigger a software update on the main thread.
        (-[WebKitLauncherURLProtocol resourceNotFound]): Fail with a generic "File does not exist" error.

2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
        Reviewed by Gustavo Noronha and Xan Lopez.
        [Gtk] Implement DRT XSS auditor support
        https://bugs.webkit.org/show_bug.cgi?id=26571
        (LayoutTestController::setXSSAuditorEnabled):
2009-06-19  Darin Adler  <darin@apple.com>
        * Scripts/do-webcore-rename: More renaming ideas.
2009-06-15  Andre Pedralho  <andre.pedralho@openbossa.org>
        Reviewed by Tor Arne Vestbø.
        Only pass --makeargs along if an argument is given.
2009-06-19  Adam Barth  <abarth@webkit.org>
        Unreviewed attempt to fix Windows build.
        (LayoutTestController::setXSSAuditorEnabled):
2009-06-18  Adam Barth  <abarth@webkit.org>
        https://bugs.webkit.org/show_bug.cgi?id=26199
        Add support for testing the XSSAuditor.
        (setXSSAuditorEnabledCallback):
        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
        (LayoutTestController::setXSSAuditorEnabled):
        (LayoutTestController::setXSSAuditorEnabled):
        (LayoutTestController::setXSSAuditorEnabled):
        (LayoutTestController::setPopupBlockingEnabled):
        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
        (LayoutTestController::setXSSAuditorEnabled):
2009-06-18  Darin Adler  <darin@apple.com>
        Rubber stamped by Mark Rowe.
        * DumpRenderTree/mac/DumpRenderTreeWindow.mm:
        (-[DumpRenderTreeWindow close]): Resolved crashes seen during regression
        tests. The close method can be called on a window that's already closed
        so we can't assert here.
2009-06-17  Steve Falkenburg  <sfalken@apple.com>
        Updated for consolidated WebKit COM interfaces.

        * DumpRenderTree/win/FrameLoadDelegate.cpp:
        * DumpRenderTree/win/FrameLoadDelegate.h:
        * WinLauncher/WinLauncher.h:
2009-06-16  Adam Barth  <abarth@webkit.org>
        https://bugs.webkit.org/show_bug.cgi?id=26437
        Make the commit-log-editor match the ambient line endings in commit
        messages.
2009-06-16  Xan Lopez  <xlopez@igalia.com>
        Reviewed by Gustavo Noronha.
        Update GtkLauncher to recent API changes in the progress property,
        which now goes from 0.0 to 1.0.
        * GtkLauncher/main.c:
2009-06-16  Adam Barth  <abarth@webkit.org>
        https://bugs.webkit.org/show_bug.cgi?id=26000
        Teach prepare-ChangeLog to match the line ends that are already present
        in ChangeLog files.  This helps folks whose use cygwin perl with CR LF
        line endings on Windows.
        Also, teach prepare-ChangeLog to normalize backslashes in paths.  This
        helps folks who use Windows SVN prepare correct ChangeLogs.
== Rolled over to ChangeLog-2009-06-16 ==
++ b/WebKitTools/Scripts/prepare-ChangeLog
sub normalizeLineEndings($$);
sub normalizePath($);
my $gitIndex = "";
               "git-index" => \$gitIndex,
    print STDERR "  --git-index    Populate the ChangeLogs from the git index only\n";
die "--git-commit and --git-index are incompatible." if ($gitIndex && $gitCommit);

    # We want to match the ChangeLog's line endings in case it doesn't match
    # the native line endings for this version of perl.
    my $endl = "\n";
    if ($old_change_log[0] =~ /(\r?\n)/g) {
        $endl = "$1";
    }
    print CHANGE_LOG normalizeLineEndings("$date  $name  <$email_address>\n\n", $endl);
    print CHANGE_LOG normalizeLineEndings("        Reviewed by $reviewer.\n\n", $endl);
    print CHANGE_LOG normalizeLineEndings($description . "\n", $endl) if $description;
            print CHANGE_LOG normalizeLineEndings(testListForChangeLog(sort @addedRegressionTests), $endl);
            print CHANGE_LOG normalizeLineEndings("        WARNING: NO TEST CASES ADDED OR CHANGED\n\n", $endl);
        my $file_stem = normalizePath(substr $file, length $prefix);
        print CHANGE_LOG normalizeLineEndings("        * $file_stem:$function_lists{$file}\n", $endl);;
    print CHANGE_LOG normalizeLineEndings("\n", $endl), @old_change_log;
    return "--cached" if $gitIndex;
    return 0 if ($gitCommit || $gitIndex); # an existing commit or staged change cannot have conflicts

sub normalizeLineEndings($$)
{
    my ($string, $endl) = @_;
    $string =~ s/\r?\n/$endl/g;
    return $string;
}

sub normalizePath($)
{
    my ($path) = @_;
    $path =~ s/\\/\//g;
    return $path;
}

24 files changed, 460 insertions, 276 deletions

diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index b07f201..280ec93 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -125,7 +125,7 @@ bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*,
     return isCSSPropertyName(propertyName);
 }
 
-// FIXME: You can get these properties, and set them (see customPut below),
+// FIXME: You can get these properties, and set them (see putDelegate below),
 // but you should also be able to enumerate them.
 JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
@@ -156,7 +156,7 @@ JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& pro
 }
 
 
-bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
+bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (!isCSSPropertyName(propertyName))
         return false;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 76db871..398a679 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,11 +28,13 @@
 #include "FloatRect.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
+#include "HTMLVideoElement.h"
 #include "ImageData.h"
 #include "JSCanvasGradient.h"
 #include "JSCanvasPattern.h"
 #include "JSHTMLCanvasElement.h"
 #include "JSHTMLImageElement.h"
+#include "JSHTMLVideoElement.h"
 #include "JSImageData.h"
 #include <runtime/Error.h>
 
@@ -230,6 +232,29 @@ JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& ar
             default:
                 return throwError(exec, SyntaxError);
         }
+#if ENABLE(VIDEO)
+    } else if (o->inherits(&JSHTMLVideoElement::s_info)) {
+            HTMLVideoElement* video = static_cast<HTMLVideoElement*>(static_cast<JSHTMLElement*>(o)->impl());
+            switch (args.size()) {
+                case 3:
+                    context->drawImage(video, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
+                    break;
+                case 5:
+                    context->drawImage(video, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                       args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
+                    setDOMException(exec, ec);
+                    break;
+                case 9:
+                    context->drawImage(video, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                       args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                       FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                       args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
+                    setDOMException(exec, ec);
+                    break;
+                default:
+                    return throwError(exec, SyntaxError);
+        }
+#endif
     } else {
         setDOMException(exec, TYPE_MISMATCH_ERR);
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 4f58797..55f0e91 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -325,10 +325,10 @@ void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContex
     const HashSet<MessagePort*>& messagePorts = scriptExecutionContext->messagePorts();
     HashSet<MessagePort*>::const_iterator portsEnd = messagePorts.end();
     for (HashSet<MessagePort*>::const_iterator iter = messagePorts.begin(); iter != portsEnd; ++iter) {
-        if ((*iter)->hasPendingActivity()) {
+        // If the message port is remotely entangled, then always mark it as in-use because we can't determine reachability across threads.
+        if (!(*iter)->locallyEntangledPort() || (*iter)->hasPendingActivity()) {
             DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, *iter);
-            // A port with pending activity must have a wrapper to mark its listeners, so no null check.
-            if (!wrapper->marked())
+            if (wrapper && !wrapper->marked())
                 wrapper->mark();
         }
     }
@@ -545,7 +545,7 @@ KURL completeURL(ExecState* exec, const String& relativeURL)
 
 JSValue objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, objectProtoFuncToString);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, objectProtoFuncToString);
 }
 
 Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInfo* classInfo)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 4fd1139..0eefebe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -26,13 +26,9 @@
 #include "CString.h"
 #include "Console.h"
 #include "DOMWindow.h"
-#include "Element.h"
 #include "Frame.h"
-#include "HTMLCollection.h"
-#include "HTMLDocument.h"
 #include "InspectorController.h"
 #include "JSDOMWindowCustom.h"
-#include "JSHTMLCollection.h"
 #include "JSNode.h"
 #include "Logging.h"
 #include "Page.h"
@@ -75,88 +71,6 @@ ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
     return d()->impl->document();
 }
 
-JSValue JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
-}
-
-JSValue JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
-}
-
-JSValue JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    JSDOMWindowBase* thisObj = static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()));
-    Document* doc = thisObj->impl()->frame()->document();
-    ASSERT(thisObj->allowsAccessFrom(exec));
-    ASSERT(doc);
-    ASSERT(doc->isHTMLDocument());
-
-    RefPtr<HTMLCollection> collection = doc->windowNamedItems(propertyName);
-    if (collection->length() == 1)
-        return toJS(exec, collection->firstItem());
-    return toJS(exec, collection.get());
-}
-
-bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    // Check for child frames by name before built-in properties to
-    // match Mozilla. This does not match IE, but some sites end up
-    // naming frames things that conflict with window properties that
-    // are in Moz but not IE. Since we have some of these, we have to do
-    // it the Moz way.
-    if (impl()->frame()->tree()->child(propertyName)) {
-        slot.setCustom(this, childFrameGetter);
-        return true;
-    }
-
-    // Do prototype lookup early so that functions and attributes in the prototype can have
-    // precedence over the index and name getters.  
-    JSValue proto = prototype();
-    if (proto.isObject()) {
-        if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
-            if (!allowsAccessFrom(exec))
-                slot.setUndefined();
-            return true;
-        }
-    }
-
-    // FIXME: Search the whole frame hierachy somewhere around here.
-    // We need to test the correct priority order.
-
-    // allow window[1] or parent[1] etc. (#56983)
-    bool ok;
-    unsigned i = propertyName.toArrayIndex(&ok);
-    if (ok && i < impl()->frame()->tree()->childCount()) {
-        slot.setCustomIndex(this, i, indexGetter);
-        return true;
-    }
-
-    if (!allowsAccessFrom(exec)) {
-        slot.setUndefined();
-        return true;
-    }
-
-    // Allow shortcuts like 'Image1' instead of document.images.Image1
-    Document* document = impl()->frame()->document();
-    if (document->isHTMLDocument()) {
-        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
-        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
-            slot.setCustom(this, namedItemGetter);
-            return true;
-        }
-    }
-
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
-{
-    if (allowsAccessFrom(exec))
-        Base::put(exec, propertyName, value, slot);
-}
-
 String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
 {
     KURL originURL = asJSDOMWindow(other)->impl()->url();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 6d93196..113344f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -40,7 +40,6 @@ namespace WebCore {
 
     class JSDOMWindowBasePrivate;
 
-    // This is the only WebCore JS binding which does not inherit from DOMObject
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     protected:
@@ -52,9 +51,6 @@ namespace WebCore {
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-
         // Called just before removing this window from the JSDOMWindowShell.
         void willRemoveFromWindowShell();
 
@@ -62,15 +58,12 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
         virtual JSC::ExecState* globalExec();
-        
         virtual bool supportsProfiling() const;
-
         virtual bool shouldInterruptScript() const;
 
         bool allowsAccessFrom(JSC::ExecState*) const;
         bool allowsAccessFromNoErrorMessage(JSC::ExecState*) const;
         bool allowsAccessFrom(JSC::ExecState*, String& message) const;
-
         void printErrorMessage(const String&) const;
 
         // Don't call this version of allowsAccessFrom -- it's a slightly incorrect implementation used only by WebScriptObject
@@ -89,10 +82,6 @@ namespace WebCore {
             JSDOMWindowShell* shell;
         };
 
-        static JSC::JSValue childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValue namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
         
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index b8c30c7..22013eb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -31,11 +31,14 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLCollection.h"
+#include "HTMLDocument.h"
 #include "History.h"
 #include "JSAudioConstructor.h"
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSHTMLCollection.h"
 #include "JSHistory.h"
 #include "JSImageConstructor.h"
 #include "JSLocation.h"
@@ -58,6 +61,7 @@
 #include "Settings.h"
 #include "WindowFeatures.h"
 #include <runtime/JSObject.h>
+#include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
 
@@ -92,6 +96,199 @@ void JSDOMWindow::mark()
 #endif
 }
 
+template<NativeFunction nativeFunction, int length>
+JSValue nonCachingStaticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+{
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), length, propertyName, nativeFunction);
+}
+
+static JSValue childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
+}
+
+static JSValue indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
+}
+
+static JSValue namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSDOMWindowBase* thisObj = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    Document* document = thisObj->impl()->frame()->document();
+
+    ASSERT(thisObj->allowsAccessFrom(exec));
+    ASSERT(document);
+    ASSERT(document->isHTMLDocument());
+
+    RefPtr<HTMLCollection> collection = document->windowNamedItems(propertyName);
+    if (collection->length() == 1)
+        return toJS(exec, collection->firstItem());
+    return toJS(exec, collection.get());
+}
+
+bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
+    // are not affected by properties changed on the Window or anything in its prototype chain.
+    // This is consistent with the behavior of Firefox.
+
+    const HashEntry* entry;
+
+    // We don't want any properties other than "close" and "closed" on a closed window.
+    if (!impl()->frame()) {
+        // The following code is safe for cross-domain and same domain use.
+        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
+        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && !(entry->attributes() & Function) && entry->propertyGetter() == jsDOMWindowClosed) {
+            slot.setCustom(this, entry->propertyGetter());
+            return true;
+        }
+        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && (entry->attributes() & Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+            return true;
+        }
+
+        // FIXME: We should have a message here that explains why the property access/function call was
+        // not allowed. 
+        slot.setUndefined();
+        return true;
+    }
+
+    // We need to check for cross-domain access here without printing the generic warning message
+    // because we always allow access to some function, just different ones depending whether access
+    // is allowed.
+    String errorMessage;
+    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
+
+    // Look for overrides before looking at any of our own properties, but ignore overrides completely
+    // if this is cross-domain access.
+    if (allowsAccess && JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
+        return true;
+
+    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
+    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
+    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
+    // what prototype is actually set on this object.
+    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    slot.setUndefined();
+                    return true;
+                }
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.prototype.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            if (!allowsAccess) {
+                slot.setCustom(this, objectToStringFunctionGetter);
+                return true;
+            }
+        }
+    }
+
+    entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+
+    // Check for child frames by name before built-in properties to
+    // match Mozilla. This does not match IE, but some sites end up
+    // naming frames things that conflict with window properties that
+    // are in Moz but not IE. Since we have some of these, we have to do
+    // it the Moz way.
+    if (impl()->frame()->tree()->child(propertyName)) {
+        slot.setCustom(this, childFrameGetter);
+        return true;
+    }
+
+    // Do prototype lookup early so that functions and attributes in the prototype can have
+    // precedence over the index and name getters.  
+    JSValue proto = prototype();
+    if (proto.isObject()) {
+        if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
+            if (!allowsAccess) {
+                printErrorMessage(errorMessage);
+                slot.setUndefined();
+            }
+            return true;
+        }
+    }
+
+    // FIXME: Search the whole frame hierachy somewhere around here.
+    // We need to test the correct priority order.
+
+    // allow window[1] or parent[1] etc. (#56983)
+    bool ok;
+    unsigned i = propertyName.toArrayIndex(&ok);
+    if (ok && i < impl()->frame()->tree()->childCount()) {
+        slot.setCustomIndex(this, i, indexGetter);
+        return true;
+    }
+
+    if (!allowsAccess) {
+        printErrorMessage(errorMessage);
+        slot.setUndefined();
+        return true;
+    }
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = impl()->frame()->document();
+    if (document->isHTMLDocument()) {
+        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
+            slot.setCustom(this, namedItemGetter);
+            return true;
+        }
+    }
+
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    if (!impl()->frame())
+        return;
+
+    // Optimization: access JavaScript global variables directly before involving the DOM.
+    if (JSGlobalObject::hasOwnPropertyForWrite(exec, propertyName)) {
+        if (allowsAccessFrom(exec))
+            JSGlobalObject::put(exec, propertyName, value, slot);
+        return;
+    }
+
+    if (lookupPut<JSDOMWindow>(exec, propertyName, value, s_info.propHashTable(exec), this))
+        return;
+
+    if (allowsAccessFrom(exec))
+        Base::put(exec, propertyName, value, slot);
+}
+
 bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow deleting properties by frames in the same origin.
@@ -100,15 +297,15 @@ bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName
     return Base::deleteProperty(exec, propertyName);
 }
 
-bool JSDOMWindow::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
-        return true;
-    return false;
+        return;
+    Base::getPropertyNames(exec, propertyNames);
 }
 
-bool JSDOMWindow::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
     // Only allow getting property attributes properties by frames in the same origin.
     if (!allowsAccessFrom(exec))
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
index 52ef4a0..a0e1b8f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -21,7 +21,6 @@
 
 #include "JSDOMWindow.h"
 #include "JSDOMWindowShell.h"
-#include <runtime/PrototypeFunction.h>
 #include <wtf/AlwaysInline.h>
 
 namespace WebCore {
@@ -36,121 +35,6 @@ inline const JSDOMWindow* asJSDOMWindow(const JSC::JSGlobalObject* globalObject)
     return static_cast<const JSDOMWindow*>(globalObject);
 }
 
-template<JSC::NativeFunction nativeFunction, int length>
-JSC::JSValue nonCachingStaticFunctionGetter(JSC::ExecState* exec, const JSC::Identifier& propertyName, const JSC::PropertySlot&)
-{
-    return new (exec) JSC::PrototypeFunction(exec, length, propertyName, nativeFunction);
-}
-
-ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
-{
-    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
-    // are not affected by properties changed on the Window or anything in its prototype chain.
-    // This is consistent with the behavior of Firefox.
-
-    const JSC::HashEntry* entry;
-
-    // We don't want any properties other than "close" and "closed" on a closed window.
-    if (!impl()->frame()) {
-        // The following code is safe for cross-domain and same domain use.
-        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
-        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
-        if (entry && !(entry->attributes() & JSC::Function) && entry->propertyGetter() == jsDOMWindowClosed) {
-            slot.setCustom(this, entry->propertyGetter());
-            return true;
-        }
-        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-        if (entry && (entry->attributes() & JSC::Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
-            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
-            return true;
-        }
-
-        // FIXME: We should have a message here that explains why the property access/function call was
-        // not allowed. 
-        slot.setUndefined();
-        return true;
-    }
-
-    // We need to check for cross-domain access here without printing the generic warning message
-    // because we always allow access to some function, just different ones depending whether access
-    // is allowed.
-    bool allowsAccess = allowsAccessFromNoErrorMessage(exec);
-
-    // Look for overrides before looking at any of our own properties, but ignore overrides completely
-    // if this is cross-domain access.
-    if (allowsAccess && JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
-        return true;
-
-    // We need this code here because otherwise JSC::Window will stop the search before we even get to the
-    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
-    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
-    // what prototype is actually set on this object.
-    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & JSC::Function) {
-            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
-                if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
-                if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
-                if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
-                if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
-                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
-                    slot.setUndefined();
-                    return true;
-                }
-            }
-        }
-    } else {
-        // Allow access to toString() cross-domain, but always Object.prototype.toString.
-        if (propertyName == exec->propertyNames().toString) {
-            if (!allowsAccess) {
-                slot.setCustom(this, objectToStringFunctionGetter);
-                return true;
-            }
-        }
-    }
-
-    return false;
-}
-
-inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValue value, JSC::PutPropertySlot& slot)
-{
-    if (!impl()->frame())
-        return true;
-
-    // Optimization: access JavaScript global variables directly before involving the DOM.
-    JSC::PropertySlot getSlot;
-    bool slotIsWriteable;
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, getSlot, slotIsWriteable)) {
-        if (allowsAccessFrom(exec)) {
-            if (slotIsWriteable) {
-                getSlot.putValue(value);
-                if (getSlot.isCacheable())
-                    slot.setExistingProperty(this, getSlot.cachedOffset());
-            } else
-                JSGlobalObject::put(exec, propertyName, value, slot);
-        }
-        return true;
-    }
-
-    return false;
-}
-
 inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
 {
     if (allowsAccessFromPrivate(other))
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp
new file mode 100644
index 0000000..e75b10b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSDataGridDataSource.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "HTMLDataGridElement.h"
+#include "JSHTMLDataGridElement.h"
+#include "JSDOMWindowBase.h"
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSDataGridDataSource::JSDataGridDataSource(JSC::JSValue dataSource, Frame* frame)
+    : m_dataSource(dataSource)
+    , m_frame(frame)
+{
+}
+
+JSDataGridDataSource::~JSDataGridDataSource()
+{
+}
+
+void JSDataGridDataSource::initialize(HTMLDataGridElement* datagrid)
+{
+    if (!m_frame->script()->isEnabled())
+        return;
+
+    JSLock lock(false);
+    RefPtr<JSDataGridDataSource> protect(this);
+
+    ExecState* exec = m_frame->script()->globalObject()->globalExec();
+
+    if (!jsDataSource().isObject())
+        return;
+
+    JSValue initializeFunction = jsDataSource().get(exec, Identifier(exec, "initialize"));
+    CallData callData;
+    CallType callType = initializeFunction.getCallData(callData);
+    if (callType == CallTypeNone)
+        return;
+
+    MarkedArgumentBuffer args;
+    args.append(toJS(exec, datagrid));
+
+    JSDOMWindowBase::commonJSGlobalData()->timeoutChecker.start();
+    call(exec, initializeFunction, callType, callData, m_dataSource, args);
+    JSDOMWindowBase::commonJSGlobalData()->timeoutChecker.stop();
+
+    if (exec->hadException())
+        reportCurrentException(exec);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h
new file mode 100644
index 0000000..2537b00
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSDataGridDataSource_h
+#define JSDataGridDataSource_h
+
+#include "DataGridDataSource.h"
+#include <runtime/JSValue.h>
+#include <runtime/Protect.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Frame;
+class HTMLDataGridElement;
+
+class JSDataGridDataSource : public DataGridDataSource {
+public:
+    static PassRefPtr<JSDataGridDataSource> create(JSC::JSValue dataSource, Frame* frame)
+    {
+        return adoptRef(new JSDataGridDataSource(dataSource, frame));
+    }
+
+    virtual ~JSDataGridDataSource();
+
+    virtual bool isJSDataGridDataSource() const { return true; }
+    JSC::JSValue jsDataSource() const { return m_dataSource.get(); }
+
+    virtual void initialize(HTMLDataGridElement*);
+
+private:
+    JSDataGridDataSource(JSC::JSValue, Frame*);
+
+    JSC::ProtectedJSValue m_dataSource;
+    RefPtr<Frame> m_frame;
+};
+
+inline JSDataGridDataSource* asJSDataGridDataSource(DataGridDataSource* dataSource)
+{
+    ASSERT(dataSource->isJSDataGridDataSource());
+    return static_cast<JSDataGridDataSource*>(dataSource);
+}
+
+inline const JSDataGridDataSource* asJSDataGridDataSource(const DataGridDataSource* dataSource)
+{
+    ASSERT(dataSource->isJSDataGridDataSource());
+    return static_cast<const JSDataGridDataSource*>(dataSource);
+}
+
+} // namespace WebCore
+
+#endif // JSDataGridDataSource_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index de6565d..37561af 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -33,12 +33,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLAppletElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+bool JSHTMLAppletElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp
index ac088af..5aa0904 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,26 +24,27 @@
  */
 
 #include "config.h"
-#include "JSDOMStringList.h"
+#include "JSHTMLDataGridElement.h"
 
-#include "DOMStringList.h"
+#include "Document.h"
+#include "HTMLDataGridElement.h"
+#include "JSDataGridDataSource.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSDOMStringList::getByIndex(ExecState* exec, unsigned index)
+JSValue JSHTMLDataGridElement::dataSource(ExecState*) const
 {
-    return jsString(exec, impl()->item(index));
+    DataGridDataSource* dataSource = static_cast<HTMLDataGridElement*>(impl())->dataSource();
+    if (dataSource && dataSource->isJSDataGridDataSource())
+        return asJSDataGridDataSource(dataSource)->jsDataSource();
+    return jsNull();
 }
 
-JSValue JSDOMStringList::item(ExecState* exec, const ArgList& args)
+void JSHTMLDataGridElement::setDataSource(ExecState*, JSValue value)
 {
-    unsigned index = args.at(0).toUInt32(exec);
-    if (index >= impl()->length())
-        return jsNull();
-
-    return jsString(exec, impl()->item(index));
+    static_cast<HTMLDataGridElement*>(impl())->setDataSource(JSDataGridDataSource::create(value, impl()->document()->frame()));
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 19aae86..2570bc6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -33,12 +33,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLEmbedElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+bool JSHTMLEmbedElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index f7f12b9..a99e46c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -33,12 +33,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLObjectElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+bool JSHTMLObjectElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index 998a364..a3b15e1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -39,23 +39,23 @@ namespace WebCore {
 
 static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionBack);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionBack);
 }
 
 static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionForward);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionForward);
 }
 
 static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 1, propertyName, jsHistoryPrototypeFunctionGo);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsHistoryPrototypeFunctionGo);
 }
 
-bool JSHistory::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     // When accessing History cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::customGetOwnPropertySlot for additional details.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
 
     // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
     // allowed, return false so the normal lookup will take place.
@@ -92,7 +92,7 @@ bool JSHistory::customGetOwnPropertySlot(ExecState* exec, const Identifier& prop
     return true;
 }
 
-bool JSHistory::customPut(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
+bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
@@ -108,12 +108,12 @@ bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-bool JSHistory::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
-        return true;
-    return false;
+        return;
+    Base::getPropertyNames(exec, propertyNames);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index 9c5a834..e4f1653 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -39,20 +39,20 @@ namespace WebCore {
 
 static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionReplace);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionReplace);
 }
 
 static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsLocationPrototypeFunctionReload);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsLocationPrototypeFunctionReload);
 }
 
 static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionAssign);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionAssign);
 }
 
-bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame) {
@@ -61,7 +61,7 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
     }
 
     // When accessing Location cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::customGetOwnPropertySlot for additional details.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
 
     // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
     // allowed, return false so the normal lookup will take place.
@@ -93,7 +93,7 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
     return true;
 }
 
-bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame)
@@ -128,12 +128,12 @@ bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-bool JSLocation::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
-        return true;
-    return false;
+        return;
+    Base::getPropertyNames(exec, propertyNames);
 }
 
 void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
@@ -311,7 +311,7 @@ JSValue JSLocation::toString(ExecState* exec, const ArgList&)
     return jsString(exec, impl()->toString());
 }
 
-bool JSLocationPrototype::customPut(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&)
+bool JSLocationPrototype::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&)
 {
     return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index f4809ae..bfac375 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -43,9 +43,9 @@ void JSMessagePort::mark()
     DOMObject::mark();
 
     markIfNotNull(m_impl->onmessage());
-    markIfNotNull(m_impl->onclose());
 
-    if (MessagePortProxy* entangledPort = m_impl->entangledPort()) {
+    // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
+    if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
         if (wrapper && !wrapper->marked())
             wrapper->mark();
@@ -60,14 +60,6 @@ void JSMessagePort::mark()
     }
 }
 
-JSValue JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
-{
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
-    const UString& message = args.at(0).toString(exec);
-
-    return toJS(exec, impl()->startConversation(globalObject->scriptExecutionContext(), message).get());
-}
-
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index bc43d79..2d2d0f8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -64,17 +64,17 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return true;
 }
 
-bool JSStorage::customGetPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     ExceptionCode ec;
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier(exec, m_impl->key(i, ec)));
         
-    return false;
+    Base::getPropertyNames(exec, propertyNames);
 }
 
-bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
+bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     // Only perform the custom put if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 6824914..14bbe19 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -66,7 +66,7 @@ void JSWorkerContext::mark()
     }
 }
 
-bool JSWorkerContext::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     // Look for overrides before looking at any of our own properties.
     if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index e570293..3e59df9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -33,6 +33,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
+#include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
 #include <debugger/Debugger.h>
@@ -55,6 +56,7 @@ ScriptController::ScriptController(Frame* frame)
 #if PLATFORM(MAC)
     , m_windowScriptObject(0)
 #endif
+    , m_XSSAuditor(new XSSAuditor(frame))
 {
 #if PLATFORM(MAC) && ENABLE(MAC_JAVA_BRIDGE)
     static bool initializedJavaJSBindings;
@@ -79,9 +81,14 @@ ScriptController::~ScriptController()
 
 ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode) 
 {
+    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
+        // This script is not safe to be evaluated.
+        return JSValue();
+    }
+
     // evaluate code. Returns the JS return value or 0
     // if there was none, an error occured or the type couldn't be converted.
-    
+
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
 
     initScriptIfNeeded();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index f700cd9..4528495 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -58,6 +58,7 @@ class ScriptSourceCode;
 class ScriptValue;
 class String;
 class Widget;
+class XSSAuditor;
 
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
@@ -132,6 +133,8 @@ public:
     NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
     NPObject* windowScriptNPObject();
 #endif
+    
+    XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
 
 private:
     void initScriptIfNeeded()
@@ -164,6 +167,9 @@ private:
 #if PLATFORM(MAC)
     RetainPtr<WebScriptObject> m_windowScriptObject;
 #endif
+    
+    // The XSSAuditor associated with this ScriptController.
+    OwnPtr<XSSAuditor> m_XSSAuditor;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
index 0ce7bca..e5be1d6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -35,6 +35,7 @@
 #include "Document.h"
 #include "JSNode.h"
 #include "Frame.h"
+#include "XSSAuditor.h"
 
 #include <runtime/JSLock.h>
 
@@ -61,6 +62,11 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
     if (!scriptController->isEnabled())
         return 0;
 
+    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+        // This script is not safe to execute.
+        return 0;
+    }
+    
     JSDOMWindow* globalObject = scriptController->globalObject();
 
     // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
@@ -80,6 +86,11 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     ScriptController* scriptController = frame->script();
     if (!scriptController->isEnabled())
         return 0;
+    
+    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+        // This script is not safe to execute.
+        return 0;
+    }
 
     // 'globalObject' is the JavaScript wrapper that will mark the event listener we're creating.
     JSDOMWindow* globalObject = scriptController->globalObject();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
index 4a2403d..0a16265 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
@@ -53,6 +53,8 @@ public:
 
     const JSC::SourceCode& jsSourceCode() const { return m_code; }
 
+    const String& source() const { return static_cast<StringSourceProvider*>(m_code.provider())->source(); }
+
 private:
     JSC::SourceCode m_code;
 };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/StringSourceProvider.h b/src/3rdparty/webkit/WebCore/bindings/js/StringSourceProvider.h
index ab37a56..89dfa67 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/StringSourceProvider.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/StringSourceProvider.h
@@ -40,6 +40,7 @@ namespace WebCore {
         JSC::UString getRange(int start, int end) const { return JSC::UString(m_source.characters() + start, end - start); }
         const UChar* data() const { return m_source.characters(); }
         int length() const { return m_source.length(); }
+        const String& source() const { return m_source; }
 
     private:
         StringSourceProvider(const String& source, const String& url)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index dd391bc..bcf107b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -110,7 +110,7 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
-    m_workerContext->thread()->workerObjectProxy()->reportPendingActivity(m_workerContext->hasPendingActivity());
+    m_workerContext->thread()->workerObjectProxy().reportPendingActivity(m_workerContext->hasPendingActivity());
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
         return comp.value();