diff options
Diffstat (limited to 'src/3rdparty/webkit')
36 files changed, 636 insertions, 78 deletions
diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag index 1d1c8ed..0b414ab 100644 --- a/src/3rdparty/webkit/.tag +++ b/src/3rdparty/webkit/.tag @@ -1 +1 @@ -ad96ca2f9b57271da4ea7432022ac686ee0981c2 +e6e692bb056670e2781dd0bc473a60757ae53992 diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog index 8fa3a72..c09ad79 100644 --- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog +++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog @@ -1,3 +1,90 @@ +2010-07-02 Peter Varga <pvarga@inf.u-szeged.hu> + + Reviewed by Oliver Hunt. + + The alternativeFrameLocation value is wrong in the emitDisjunction function in + case of PatternTerm::TypeParentheticalAssertion. This value needs to be + computed from term.frameLocation instead of term.inputPosition. This mistake caused glibc + memory corruption in some cases. + Layout test added for checking of TypeParentheticalAssertion case. + https://bugs.webkit.org/show_bug.cgi?id=41458 + + * yarr/RegexInterpreter.cpp: + (JSC::Yarr::ByteCompiler::emitDisjunction): + +2010-07-03 Yong Li <yoli@rim.com> + + Reviewed by Darin Adler. + + Make Arguments::MaxArguments clamping work for numbers >= 0x80000000 in + the interpreter as well as the JIT. + + https://bugs.webkit.org/show_bug.cgi?id=41351 + rdar://problem/8142141 + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): Fix signed integer overflow problem + in op_load_varargs handling. 0xFFFFFFFF was read as -1. + +2010-07-04 Mark Rowe <mrowe@apple.com> + + Build fix after r62456. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): Be slightly more consistent in using uint32_t to prevent + warnings about comparisons between signed and unsigned types, and attempts to call an overload + of std::min that doesn't exist. + +2010-07-02 Oliver Hunt <oliver@apple.com> + + Reviewed by Gavin Barraclough. + + Clamp the number of arguments supported by function.apply + https://bugs.webkit.org/show_bug.cgi?id=41351 + <rdar://problem/8142141> + + Add clamping logic to function.apply similar to that + enforced by firefox. We have a smaller clamp than + firefox as our calling convention means that stack + usage is proportional to argument count -- the firefox + limit is larger than you could actually call. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * runtime/Arguments.h: + (JSC::Arguments::): + +2010-07-01 Oliver Hunt <oliver@apple.com> + + Reviewed by Geoff Garen. + + Improve reentrancy logic in polymorphic cache stubs + <https://bugs.webkit.org/show_bug.cgi?id=41482> + <rdar://problem/8094380> + + Make the polymorphic cache stubs handle reentrancy + better. + + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + (JSC::getPolymorphicAccessStructureListSlot): + +2009-10-30 Tor Arne Vestbø <tor.arne.vestbo@nokia.com> + + Reviewed by Kenneth Rohde Christiansen. + + [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml() + + This ensures that long-running JavaScript (for example due to a modal alert() dialog), + will not trigger a deferred load after only 500ms (the default tokenizer delay) while + still giving a reasonable timeout (10 seconds) to prevent deadlock. + + https://bugs.webkit.org/show_bug.cgi?id=29381 + + * runtime/TimeoutChecker.h: Add getter for the timeout interval + 2010-05-18 Anders Carlsson <andersca@apple.com> Reviewed by Sam Weinig. diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp index 2713fd4..73efc0d 100644 --- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp +++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008, 2009 Apple Inc. All rights reserved. + * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved. * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca> * * Redistribution and use in source and binary forms, with or without @@ -3454,9 +3454,10 @@ skip_id_custom_self: int argsOffset = vPC[2].u.operand; JSValue arguments = callFrame->r(argsOffset).jsValue(); - int32_t argCount = 0; + uint32_t argCount = 0; if (!arguments) { argCount = (uint32_t)(callFrame->argumentCount()) - 1; + argCount = min<uint32_t>(argCount, Arguments::MaxArguments); int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize; Register* newEnd = callFrame->registers() + sizeDelta; if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) { @@ -3464,9 +3465,9 @@ skip_id_custom_self: goto vm_throw; } ASSERT(!callFrame->callee()->isHostFunction()); - int32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount(); - int32_t inplaceArgs = min(argCount, expectedParams); - int32_t i = 0; + uint32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount(); + uint32_t inplaceArgs = min(argCount, expectedParams); + uint32_t i = 0; Register* argStore = callFrame->registers() + argsOffset; // First step is to copy the "expected" parameters from their normal location relative to the callframe @@ -3483,6 +3484,7 @@ skip_id_custom_self: if (asObject(arguments)->classInfo() == &Arguments::info) { Arguments* args = asArguments(arguments); argCount = args->numProvidedArguments(callFrame); + argCount = min<uint32_t>(argCount, Arguments::MaxArguments); int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize; Register* newEnd = callFrame->registers() + sizeDelta; if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) { @@ -3493,6 +3495,7 @@ skip_id_custom_self: } else if (isJSArray(&callFrame->globalData(), arguments)) { JSArray* array = asArray(arguments); argCount = array->length(); + argCount = min<uint32_t>(argCount, Arguments::MaxArguments); int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize; Register* newEnd = callFrame->registers() + sizeDelta; if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) { @@ -3503,6 +3506,7 @@ skip_id_custom_self: } else if (asObject(arguments)->inherits(&JSArray::info)) { JSObject* argObject = asObject(arguments); argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame); + argCount = min<uint32_t>(argCount, Arguments::MaxArguments); int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize; Register* newEnd = callFrame->registers() + sizeDelta; if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) { @@ -3510,7 +3514,7 @@ skip_id_custom_self: goto vm_throw; } Register* argsBuffer = callFrame->registers() + argsOffset; - for (int32_t i = 0; i < argCount; ++i) { + for (uint32_t i = 0; i < argCount; ++i) { argsBuffer[i] = asObject(arguments)->get(callFrame, i); CHECK_FOR_EXCEPTION(); } diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp index daa945c..e5fcdc4 100644 --- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp +++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp @@ -1330,17 +1330,18 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail) if (stubInfo->accessType == access_get_by_id_self) { ASSERT(!stubInfo->stubRoutine); polymorphicStructureList = new PolymorphicAccessStructureList(CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure); - stubInfo->initGetByIdSelfList(polymorphicStructureList, 2); + stubInfo->initGetByIdSelfList(polymorphicStructureList, 1); } else { polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList; listIndex = stubInfo->u.getByIdSelfList.listSize; - stubInfo->u.getByIdSelfList.listSize++; } + if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) { + stubInfo->u.getByIdSelfList.listSize++; + JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), ident, slot, slot.cachedOffset()); - JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), ident, slot, slot.cachedOffset()); - - if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1)) - ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic)); + if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1)) + ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic)); + } } else ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic)); return JSValue::encode(result); @@ -1365,13 +1366,14 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(Str case access_get_by_id_proto_list: prototypeStructureList = stubInfo->u.getByIdProtoList.structureList; listIndex = stubInfo->u.getByIdProtoList.listSize; - stubInfo->u.getByIdProtoList.listSize++; + if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) + stubInfo->u.getByIdProtoList.listSize++; break; default: ASSERT_NOT_REACHED(); } - ASSERT(listIndex < POLYMORPHIC_LIST_CACHE_SIZE); + ASSERT(listIndex <= POLYMORPHIC_LIST_CACHE_SIZE); return prototypeStructureList; } @@ -1446,21 +1448,24 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list) int listIndex; PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex); + if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) { + JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset); - JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset); - - if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1)) - ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full)); + if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1)) + ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full)); + } } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) { ASSERT(!asCell(baseValue)->structure()->isDictionary()); int listIndex; PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex); + + if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) { + StructureChain* protoChain = structure->prototypeChain(callFrame); + JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset); - StructureChain* protoChain = structure->prototypeChain(callFrame); - JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset); - - if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1)) - ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full)); + if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1)) + ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full)); + } } else ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail)); @@ -2129,6 +2134,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs) if (!arguments) { int providedParams = callFrame->registers()[RegisterFile::ArgumentCount].i() - 1; argCount = providedParams; + argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments)); int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize; Register* newEnd = callFrame->registers() + sizeDelta; if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) { @@ -2164,6 +2170,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs) if (asObject(arguments)->classInfo() == &Arguments::info) { Arguments* argsObject = asArguments(arguments); argCount = argsObject->numProvidedArguments(callFrame); + argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments)); int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize; Register* newEnd = callFrame->registers() + sizeDelta; if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) { @@ -2174,6 +2181,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs) } else if (isJSArray(&callFrame->globalData(), arguments)) { JSArray* array = asArray(arguments); argCount = array->length(); + argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments)); int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize; Register* newEnd = callFrame->registers() + sizeDelta; if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) { @@ -2184,6 +2192,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs) } else if (asObject(arguments)->inherits(&JSArray::info)) { JSObject* argObject = asObject(arguments); argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame); + argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments)); int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize; Register* newEnd = callFrame->registers() + sizeDelta; if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) { diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h index 9797e08..cca3cf2 100644 --- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h +++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h @@ -55,6 +55,10 @@ namespace JSC { class Arguments : public JSObject { public: + // Use an enum because otherwise gcc insists on doing a memory + // read. + enum { MaxArguments = 0x10000 }; + enum NoParametersType { NoParameters }; Arguments(CallFrame*); diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp index d3ef44c..ae9e038 100644 --- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp +++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp @@ -948,10 +948,10 @@ void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args) void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize) { - ASSERT(m_storage->m_length == maxSize); + ASSERT(m_storage->m_length >= maxSize); UNUSED_PARAM(maxSize); JSValue* vector = m_storage->m_vector; - unsigned vectorEnd = min(m_storage->m_length, m_vectorLength); + unsigned vectorEnd = min(maxSize, m_vectorLength); unsigned i = 0; for (; i < vectorEnd; ++i) { JSValue& v = vector[i]; @@ -960,7 +960,7 @@ void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSiz buffer[i] = v; } - for (; i < m_storage->m_length; ++i) + for (; i < maxSize; ++i) buffer[i] = get(exec, i); } diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h index 7bfa6d0..5925641 100644 --- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h +++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h @@ -40,6 +40,7 @@ namespace JSC { TimeoutChecker(); void setTimeoutInterval(unsigned timeoutInterval) { m_timeoutInterval = timeoutInterval; } + unsigned timeoutInterval() const { return m_timeoutInterval; } unsigned ticksUntilNextCheck() { return m_ticksUntilNextCheck; } diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp index c2cb1c2..647b20a 100644 --- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp +++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp @@ -1554,7 +1554,7 @@ public: } case PatternTerm::TypeParentheticalAssertion: { - unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion; + unsigned alternativeFrameLocation = term.frameLocation + RegexStackSpaceForBackTrackInfoParentheticalAssertion; atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation); emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0); diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION index 2e5ebd0..f8403fb 100644 --- a/src/3rdparty/webkit/VERSION +++ b/src/3rdparty/webkit/VERSION @@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from and has the sha1 checksum - ad96ca2f9b57271da4ea7432022ac686ee0981c2 + e6e692bb056670e2781dd0bc473a60757ae53992 diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog index a993a97..5189eb5 100644 --- a/src/3rdparty/webkit/WebCore/ChangeLog +++ b/src/3rdparty/webkit/WebCore/ChangeLog @@ -1,3 +1,249 @@ +2010-07-06 Nikolas Zimmermann <nzimmermann@rim.com> + + Reviewed by Dirk Schulze. + + <use> on <font-face> causes crashes, if SVGUseElement gets detached + https://bugs.webkit.org/show_bug.cgi?id=41621 + + Do not call removeFromMappedElementSheet() from the SVGFontFaceElement destructor, + as that can potentially cause the element to be reattached while destructing. + + In order to fix the crash in the testcase, the order of calling the base-class detach + method in SVGUseElement and the instance/shadow tree destruction has to be reversed, + matching the order in removedFromDocument(). + + Test: svg/custom/use-font-face-crash.svg + + * svg/SVGFontFaceElement.cpp: + (WebCore::SVGFontFaceElement::~SVGFontFaceElement): Remove removeFromMappedElementSheet() call. + * svg/SVGUseElement.cpp: + (WebCore::SVGUseElement::detach): Reverse order of calling base-class detach method and instance/shadow tree destruction. + +2010-07-06 Nikolas Zimmermann <nzimmermann@rim.com> + + Reviewed by Darin Adler. + + <use> on <font-face> causes crashes, if SVGUseElement gets detached + https://bugs.webkit.org/show_bug.cgi?id=41621 + + Do not call removeFromMappedElementSheet() from the destructor, as the call to document()->updateStyleSelector() that can potentially + cause the element to be reattached while destructing. It's not needed at all, because removedFromDocument() is called before destruction, + which already calls removeFromMappedElementSheet() - at this point it's still safe to update the style selector. + + The crash is reproducable when using <use> on <font-face>. + + Test: svg/custom/use-font-face-crash.svg + + * svg/SVGFontFaceElement.cpp: + (WebCore::SVGFontFaceElement::~SVGFontFaceElement): + +2010-07-05 Nikolas Zimmermann <nzimmermann@rim.com> + + Reviewed by Darin Adler. + + Memory corruption with SVG <use> element + https://bugs.webkit.org/show_bug.cgi?id=40994 + + Fix race condition in svgAttributeChanged. Never call svgAttributeChanged() from attributeChanged() + when we're synchronizing SVG attributes. It leads to either unnecessary extra work being done or + crashes. Especially together with <polyline>/<polygon> which always synchronize the SVGAnimatedPoints + datastructure with the points attribute, no matter if there are changes are not. This should be + furhter optimized, but this fix is sane and fixes the root of the evil races. + + Test: svg/custom/use-property-synchronization-crash.svg + + * svg/SVGElement.cpp: + (WebCore::SVGElement::attributeChanged): + +2010-06-11 Abhishek Arya <inferno@chromium.org> + + Reviewed by David Hyatt. + + Don't process floats if parent node is not a RenderBlock. + https://bugs.webkit.org/show_bug.cgi?id=40033 + + Test: svg/text/clear-floats-crash.svg + + * rendering/RenderBlock.cpp: + (WebCore::RenderBlock::clearFloats): + +2010-06-23 Nikolas Zimmermann <nzimmermann@rim.com> + + Reviewed by Eric Seidel. + + Reproducible crash in com.apple.WebCore 0x01ed3784 WebCore::RenderLineBoxList::appendLineBox(WebCore::InlineFlowBox*) + 36 + https://bugs.webkit.org/show_bug.cgi?id=40953 + + REGRESSION (r58209-58231): Memory corruption with invalid SVG + https://bugs.webkit.org/show_bug.cgi?id=40173 + + Fix several crashes, all related to <foreignObject> and/or invalid SVG documents. + - Only allow <svg> nodes, as direct children of a <foreignObject>, not any other "partial" SVG content. + - Assure to create RenderSVGRoot objects for <svg> nodes in <foreignObject>, treat them as "outermost SVG elements". + - Never allow any partial SVG content to appear in any document. Only <svg> elements are allowed. + + Tests: svg/custom/bug45331.svg + svg/foreignObject/disallowed-svg-nodes-as-direct-children.svg + svg/foreignObject/no-crash-with-svg-content-in-html-document.svg + svg/foreignObject/svg-document-as-direct-child.svg + svg/foreignObject/svg-document-in-html-document.svg + svg/foreignObject/text-tref-02-b.svg + + * dom/Element.cpp: Added childShouldCreateRenderer, with ENABLE(SVG) guards. + (WebCore::Element::childShouldCreateRenderer): Only create a renderer for a SVG child, if we're a SVG element, or if the child is a <svg> element. + * dom/Element.h: Added childShouldCreateRenderer, with ENABLE(SVG) guards. + * svg/SVGForeignObjectElement.cpp: + (WebCore::SVGForeignObjectElement::childShouldCreateRenderer): Disallow arbitary SVG content, only <svg> elements are allowed as direct children of a <foreignObject> + * svg/SVGSVGElement.cpp: + (WebCore::SVGSVGElement::isOutermostSVG): Be sure to create RenderSVGRoot objects for <svg> elements inside <foreignObject> + +2010-06-10 Abhishek Arya <inferno@chromium.org> + + Reviewed by Dave Hyatt. + + Do not render CSS Styles :first-letter and :first-line in a SVG text element context. + https://bugs.webkit.org/show_bug.cgi?id=40031 + + Test: svg/text/text-style-invalid.svg + + * rendering/RenderSVGText.cpp: + (WebCore::RenderSVGText::firstLineBlock): + (WebCore::RenderSVGText::updateFirstLetter): + * rendering/RenderSVGText.h: + +2010-07-01 Justin Schuh <jschuh@chromium.org> + + Reviewed by Dan Bernstein. + + Prevent crash on counter destruction + https://bugs.webkit.org/show_bug.cgi?id=40032 + + Added counter destruction to RenderWidget::destroy() + + Test: fast/css/counters/destroy-counter-crash.html + + * rendering/RenderWidget.cpp: + (WebCore::RenderWidget::destroy): + +2010-06-29 Dan Bernstein <mitz@apple.com> + + Reviewed by Darin Adler. + + <rdar://problem/7975842> Certain text is repeated after using splitText() + + Tests: fast/text/setData-dirty-lines.html + fast/text/splitText-dirty-lines.html + + * dom/CharacterData.cpp: + (WebCore::CharacterData::setData): Call RenderText::setTextWithOffset() rather than + setText(), because only the former correctly dirties line boxes. + * dom/Text.cpp: + (WebCore::Text::splitText): Ditto. + +2010-06-25 Dan Bernstein <mitz@apple.com> + + Reviewed by Sam Weinig. + + <rdar://problem/8000667> Certain text is repeated before and after a line break + + Test: fast/text/bidi-explicit-embedding-past-end.html + + * platform/text/BidiResolver.h: + (WebCore::::createBidiRunsForLine): Committing explicit embedding past the end of the range + creates BidiRuns up to the end of the range, so at that point, we can stop iterating. + +2010-06-10 Tony Chang <tony@chromium.org> + + Reviewed by Kent Tamura. + + crash when focus is changed while trying to focus next element + https://bugs.webkit.org/show_bug.cgi?id=40407 + + Test: fast/events/focus-change-crash.html + + * dom/Element.cpp: + (WebCore::Element::focus): + +2010-07-01 Andreas Kling <andreas.kling@nokia.com> + + Reviewed by Tor Arne Vestbø. + + [Qt] Clamp color stops passed to QGradient to 1.0 + [https://bugs.webkit.org/show_bug.cgi?id=41484 + + Fixes an issue where color stops would be silently dropped from radial gradients. + + * platform/graphics/qt/GradientQt.cpp: + (WebCore::Gradient::platformGradient): + +2010-07-07 Tor Arne Vestbø <tor.arne.vestbo@nokia.com> + + Reviewed by Darin Adler. + + Prevent assertion/duplicate loads for non-deferred subtitute-data loads + + https://bugs.webkit.org/show_bug.cgi?id=30879 + + MainResourceLoader uses the member m_initialRequest to store requests for future + deferred loads. When doing the actual load in handleDataLoadNow(), we therefore + have to clear this request so that subsequent entries into the loader will not + start yet another load. + + This can happen as a result of a PageGroupLoadDeferrer going out of scope when + returning from Chrome::runJavaScriptAlert(), which calls setDeferredLoading(false), + but only in the case of using both substitute-data and non-deferred main resource + load together. That's why two new DRT functions were added: + + * queueLoadHTMLString() + * setDeferMainResourceLoad() + + The change adds DRT hooks for Mac, Win and Qt for these two functions. For Mac + and Win the hook uses new SPI in WebDataSource. For Qt a new static member was + added to the FrameLoaderClientQt and accessed though DumpRenderTreeSupportQt. + + Test: fast/loader/non-deferred-substitute-load.html + + * loader/MainResourceLoader.cpp: + (WebCore::MainResourceLoader::handleDataLoadNow): + +2010-07-16 Antonio Gomes <tonikitoo@webkit.org> + + Reviewed by Simon Fraser. + + Spatial navigation: do not consider outline for focusable element boundaries + https://bugs.webkit.org/show_bug.cgi?id=42474 + + Test: fast/events/spatial-navigation/snav-zero-margin-content.html + + Currently in WebCore::renderRectRelativeToRootDocument function, we are calling + RenderObject::absoluteClippedOverflowRect to obtain the rect boundary of a given + renderer/element. This method deals with outline, which is out of elements boundary. + It makes spatial navigation to fail on common sites like google.gom: "Web, Images, Map, etc" + are inaccessible. + + Patch replaces RenderObject::absoluteClippedOverflowRect by Node::getRect, + which returns only the absolute bounding box rect of the Element. + + * page/SpatialNavigation.cpp: + (WebCore::renderRectRelativeToRootDocument): + (WebCore::checkNegativeCoordsForNode): + +2010-07-21 Kristian Amlie <kristian.amlie@nokia.com> + + Reviewed by Kenneth Rohde Christiansen. + + Added automatic sqlite extraction for Symbian to QtWebKit. + + Also added sqlite detection in case sqlite is not present in the SDK. + This is possible if WebKit is compiled standalone. + + The inclusion part is a consequence of commit c578c6c1d6d in the Qt + repository. It will not work on Qt versions < 4.7.1, but that is ok, + since the only build system it will affect is marked as experimental + in the whole 4.7 series. + + * WebCore.pro: + 2010-05-14 Abhishek Arya <inferno@chromium.org> Reviewed by David Hyatt. diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro index aaa4623..f892f9e 100644 --- a/src/3rdparty/webkit/WebCore/WebCore.pro +++ b/src/3rdparty/webkit/WebCore/WebCore.pro @@ -118,8 +118,16 @@ win32-g++* { QMAKE_LIBDIR_POST += $$split(TMPPATH,";") } -# Assume that symbian OS always comes with sqlite -symbian:!CONFIG(QTDIR_build): CONFIG += system-sqlite +symbian { + !CONFIG(QTDIR_build) { + # Test if symbian OS comes with sqlite + exists($${EPOCROOT}epoc32/release/armv5/lib/sqlite3.dso):CONFIG *= system-sqlite + } else:!symbian-abld:!symbian-sbsv2 { + # When bundled with Qt, all Symbian build systems extract their own sqlite files if + # necessary, but on non-mmp based ones we need to specify this ourselves. + include($$QT_SOURCE_TREE/src/plugins/sqldrivers/sqlite_symbian/sqlite_symbian.pri) + } +} diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp index 3c3dc37..cb12184 100644 --- a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp +++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp @@ -46,15 +46,15 @@ void CharacterData::setData(const String& data, ExceptionCode&) int oldLength = length(); RefPtr<StringImpl> oldStr = m_data; m_data = dataImpl; - + if ((!renderer() || !rendererIsNeeded(renderer()->style())) && attached()) { detach(); attach(); } else if (renderer()) - toRenderText(renderer())->setText(m_data); - + toRenderText(renderer())->setTextWithOffset(m_data, 0, oldLength); + dispatchModifiedEvent(oldStr.get()); - + document()->textRemoved(this, 0, oldLength); } diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp index a02bb4c..4c93020 100644 --- a/src/3rdparty/webkit/WebCore/dom/Element.cpp +++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp @@ -1311,8 +1311,12 @@ void Element::focus(bool restorePreviousSelection) return; } - if (Page* page = doc->page()) + RefPtr<Node> protect; + if (Page* page = doc->page()) { + // Focus and change event handlers can cause us to lose our last ref. + protect = this; page->focusController()->setFocusedNode(this, doc->frame()); + } // Setting the focused node above might have invalidated the layout due to scripts. doc->updateLayoutIgnorePendingStylesheets(); @@ -1535,4 +1539,15 @@ const QualifiedName& Element::rareIDAttributeName() const return rareData()->m_idAttributeName; } +#if ENABLE(SVG) +bool Element::childShouldCreateRenderer(Node* child) const +{ + // Only create renderers for SVG elements whose parents are SVG elements, or for proper <svg xmlns="svgNS"> subdocuments. + if (child->isSVGElement()) + return child->hasTagName(SVGNames::svgTag) || isSVGElement(); + + return Node::childShouldCreateRenderer(child); +} +#endif + } // namespace WebCore diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h index 348ed1c..36c4f1b 100644 --- a/src/3rdparty/webkit/WebCore/dom/Element.h +++ b/src/3rdparty/webkit/WebCore/dom/Element.h @@ -270,6 +270,10 @@ public: virtual void dispatchFormControlChangeEvent() { } +#if ENABLE(SVG) + virtual bool childShouldCreateRenderer(Node*) const; +#endif + protected: Element(const QualifiedName&, Document*, ConstructionType); diff --git a/src/3rdparty/webkit/WebCore/dom/Text.cpp b/src/3rdparty/webkit/WebCore/dom/Text.cpp index 1ce074a..229fa88 100644 --- a/src/3rdparty/webkit/WebCore/dom/Text.cpp +++ b/src/3rdparty/webkit/WebCore/dom/Text.cpp @@ -77,7 +77,7 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec) document()->textNodeSplit(this); if (renderer()) - toRenderText(renderer())->setText(dataImpl()); + toRenderText(renderer())->setTextWithOffset(dataImpl(), 0, oldStr->length()); return newText.release(); } diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp index 28587e2..54c5c34 100644 --- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp +++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp @@ -464,6 +464,10 @@ void MainResourceLoader::handleDataLoadNow(MainResourceLoaderTimer*) KURL url = m_substituteData.responseURL(); if (url.isEmpty()) url = m_initialRequest.url(); + + // Clear the initial request here so that subsequent entries into the + // loader will not think there's still a deferred load left to do. + m_initialRequest = ResourceRequest(); ResourceResponse response(url, m_substituteData.mimeType(), m_substituteData.content()->size(), m_substituteData.textEncoding(), ""); didReceiveResponse(response); diff --git a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp index a80626f..fdacebb 100644 --- a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp +++ b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp @@ -102,14 +102,9 @@ void distanceDataForNode(FocusDirection direction, Node* start, FocusCandidate& // FIXME: This function does not behave correctly with transformed frames. static IntRect renderRectRelativeToRootDocument(RenderObject* render) { - ASSERT(render); + ASSERT(render && render->node()); - IntRect rect(render->absoluteClippedOverflowRect()); - - if (rect.isEmpty()) { - Element* e = static_cast<Element*>(render->node()); - rect = e->getRect(); - } + IntRect rect = render->node()->getRect(); // In cases when the |render|'s associated node is in a scrollable inner // document, we only consider its scrollOffset if it is not offscreen. @@ -516,7 +511,7 @@ static bool checkNegativeCoordsForNode(Node* node, const IntRect& curRect) { ASSERT(node || node->renderer()); - if (curRect.x() > 0 && curRect.y() > 0) + if (curRect.x() >= 0 && curRect.y() >= 0) return true; bool canBeScrolled = false; diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp index 8b9e2d7..1ec3203 100644 --- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp +++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GradientQt.cpp @@ -65,7 +65,7 @@ QGradient* Gradient::platformGradient() lastStop = stopIterator->stop; if (m_radial && m_r0) lastStop = m_r0 / m_r1 + lastStop * (1.0f - m_r0 / m_r1); - m_gradient->setColorAt(lastStop, stopColor); + m_gradient->setColorAt(qMin(lastStop, qreal(1.0f)), stopColor); // Keep the lastStop as orginal value, since the following stopColor depend it lastStop = stopIterator->stop; ++stopIterator; diff --git a/src/3rdparty/webkit/WebCore/platform/text/BidiResolver.h b/src/3rdparty/webkit/WebCore/platform/text/BidiResolver.h index 286cdcd..a99fd01 100644 --- a/src/3rdparty/webkit/WebCore/platform/text/BidiResolver.h +++ b/src/3rdparty/webkit/WebCore/platform/text/BidiResolver.h @@ -806,35 +806,33 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo break; } - if (pastEnd) { - if (eor == current) { - if (!reachedEndOfLine) { - eor = endOfLine; - switch (m_status.eor) { - case LeftToRight: - case RightToLeft: - case ArabicNumber: - m_direction = m_status.eor; - break; - case EuropeanNumber: - m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : EuropeanNumber; - break; - default: - ASSERT(false); - } - appendRun(); + if (pastEnd && eor == current) { + if (!reachedEndOfLine) { + eor = endOfLine; + switch (m_status.eor) { + case LeftToRight: + case RightToLeft: + case ArabicNumber: + m_direction = m_status.eor; + break; + case EuropeanNumber: + m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : EuropeanNumber; + break; + default: + ASSERT(false); } - current = end; - m_status = stateAtEnd.m_status; - sor = stateAtEnd.sor; - eor = stateAtEnd.eor; - last = stateAtEnd.last; - reachedEndOfLine = stateAtEnd.reachedEndOfLine; - lastBeforeET = stateAtEnd.lastBeforeET; - emptyRun = stateAtEnd.emptyRun; - m_direction = OtherNeutral; - break; + appendRun(); } + current = end; + m_status = stateAtEnd.m_status; + sor = stateAtEnd.sor; + eor = stateAtEnd.eor; + last = stateAtEnd.last; + reachedEndOfLine = stateAtEnd.reachedEndOfLine; + lastBeforeET = stateAtEnd.lastBeforeET; + emptyRun = stateAtEnd.emptyRun; + m_direction = OtherNeutral; + break; } // set m_status.last as needed. @@ -887,8 +885,21 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo } increment(); - if (!m_currentExplicitEmbeddingSequence.isEmpty()) + if (!m_currentExplicitEmbeddingSequence.isEmpty()) { commitExplicitEmbedding(); + if (pastEnd) { + current = end; + m_status = stateAtEnd.m_status; + sor = stateAtEnd.sor; + eor = stateAtEnd.eor; + last = stateAtEnd.last; + reachedEndOfLine = stateAtEnd.reachedEndOfLine; + lastBeforeET = stateAtEnd.lastBeforeET; + emptyRun = stateAtEnd.emptyRun; + m_direction = OtherNeutral; + break; + } + } if (emptyRun && (dirCurrent == RightToLeftEmbedding || dirCurrent == LeftToRightEmbedding diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp index 798663e..e7fa753 100644 --- a/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp +++ b/src/3rdparty/webkit/WebCore/rendering/RenderBlock.cpp @@ -2981,6 +2981,12 @@ void RenderBlock::clearFloats() m_floatingObjects->clear(); } + // We should not process floats if the parent node is not a RenderBlock. Otherwise, we will add + // floats in an invalid context. This will cause a crash arising from a bad cast on the parent. + // See <rdar://problem/8049753>, where float property is applied on a text node in a SVG. + if (!parent() || !parent()->isRenderBlock()) + return; + // Attempt to locate a previous sibling with overhanging floats. We skip any elements that are // out of flow (like floating/positioned elements), and we also skip over any objects that may have shifted // to avoid floats. diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp index 76b8b86..de902e0 100644 --- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp +++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.cpp @@ -225,6 +225,19 @@ FloatRect RenderSVGText::repaintRectInLocalCoordinates() const return repaintRect; } +// Fix for <rdar://problem/8048875>. We should not render :first-line CSS Style +// in a SVG text element context. +RenderBlock* RenderSVGText::firstLineBlock() const +{ + return 0; +} + +// Fix for <rdar://problem/8048875>. We should not render :first-letter CSS Style +// in a SVG text element context. +void RenderSVGText::updateFirstLetter() +{ +} + } #endif // ENABLE(SVG) diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h index ab4b09b..f09e396 100644 --- a/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h +++ b/src/3rdparty/webkit/WebCore/rendering/RenderSVGText.h @@ -72,6 +72,9 @@ private: virtual RootInlineBox* createRootInlineBox(); + virtual RenderBlock* firstLineBlock() const; + virtual void updateFirstLetter(); + AffineTransform m_localTransform; }; diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp index 561bead..251a65d 100644 --- a/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp +++ b/src/3rdparty/webkit/WebCore/rendering/RenderWidget.cpp @@ -27,6 +27,7 @@ #include "AnimationController.h" #include "GraphicsContext.h" #include "HitTestResult.h" +#include "RenderCounter.h" #include "RenderView.h" #include "RenderWidgetProtector.h" @@ -114,6 +115,9 @@ void RenderWidget::destroy() if (RenderView* v = view()) v->removeWidget(this); + if (m_hasCounterNodeMap) + RenderCounter::destroyCounterNodes(this); + if (AXObjectCache::accessibilityEnabled()) { document()->axObjectCache()->childrenChanged(this->parent()); document()->axObjectCache()->remove(this); diff --git a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp index 41bbba4..974bf2a 100644 --- a/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp +++ b/src/3rdparty/webkit/WebCore/svg/SVGElement.cpp @@ -304,6 +304,15 @@ void SVGElement::attributeChanged(Attribute* attr, bool preserveDecls) return; StyledElement::attributeChanged(attr, preserveDecls); + + // When an animated SVG property changes through SVG DOM, svgAttributeChanged() is called, not attributeChanged(). + // Next time someone tries to access the XML attributes, the synchronization code starts. During that synchronization + // SVGAnimatedPropertySynchronizer may call NamedNodeMap::removeAttribute(), which in turn calls attributeChanged(). + // At this point we're not allowed to call svgAttributeChanged() again - it may lead to extra work being done, or crashes + // see bug https://bugs.webkit.org/show_bug.cgi?id=40994. + if (m_synchronizingSVGAttributes) + return; + svgAttributeChanged(attr->name()); } diff --git a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp index 25b3aea..de646c6 100644 --- a/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp +++ b/src/3rdparty/webkit/WebCore/svg/SVGFontFaceElement.cpp @@ -59,7 +59,6 @@ SVGFontFaceElement::SVGFontFaceElement(const QualifiedName& tagName, Document* d SVGFontFaceElement::~SVGFontFaceElement() { - removeFromMappedElementSheet(); } static int cssPropertyIdForSVGAttributeName(const QualifiedName& attrName) diff --git a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp index d28e2a4..e7b5389 100644 --- a/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp +++ b/src/3rdparty/webkit/WebCore/svg/SVGForeignObjectElement.cpp @@ -125,6 +125,10 @@ RenderObject* SVGForeignObjectElement::createRenderer(RenderArena* arena, Render bool SVGForeignObjectElement::childShouldCreateRenderer(Node* child) const { + // Disallow arbitary SVG content. Only allow proper <svg xmlns="svgNS"> subdocuments. + if (child->isSVGElement()) + return child->hasTagName(SVGNames::svgTag); + // Skip over SVG rules which disallow non-SVG kids return StyledElement::childShouldCreateRenderer(child); } diff --git a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp index 4c06008..5237715 100644 --- a/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp +++ b/src/3rdparty/webkit/WebCore/svg/SVGSVGElement.cpp @@ -538,6 +538,10 @@ bool SVGSVGElement::isOutermostSVG() const if (!parentNode()) return true; + // We act like an outermost SVG element, if we're a direct child of a <foreignObject> element. + if (parentNode()->hasTagName(SVGNames::foreignObjectTag)) + return true; + // This is true whenever this is the outermost SVG, even if there are HTML elements outside it return !parentNode()->isSVGElement(); } diff --git a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp index 45bab6a..57d56e1 100644 --- a/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp +++ b/src/3rdparty/webkit/WebCore/svg/SVGUseElement.cpp @@ -572,8 +572,8 @@ void SVGUseElement::attach() void SVGUseElement::detach() { - SVGStyledTransformableElement::detach(); m_targetElementInstance = 0; + SVGStyledTransformableElement::detach(); } static bool isDirectReference(Node* n) diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp index cc7b11c..4fe784f 100644 --- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp +++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp @@ -959,6 +959,10 @@ void QWebFrame::load(const QNetworkRequest &req, The \a html is loaded immediately; external objects are loaded asynchronously. + If a script in the \a html runs longer than the default script timeout (currently 10 seconds), + for example due to being blocked by a modal JavaScript alert dialog, this method will return + as soon as possible after the timeout and any subsequent \a html will be loaded asynchronously. + When using this method WebKit assumes that external resources such as JavaScript programs or style sheets are encoded in UTF-8 unless otherwise specified. For example, the encoding of an external script can be specified through the charset attribute of the HTML script tag. It is also possible diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog index 63d5568..b2bff0c 100644 --- a/src/3rdparty/webkit/WebKit/qt/ChangeLog +++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog @@ -1,3 +1,83 @@ +2009-10-30 Tor Arne Vestbø <tor.arne.vestbo@nokia.com> + + Reviewed by Kenneth Rohde Christiansen. + + [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml() + + This ensures that long-running JavaScript (for example due to a modal alert() dialog), + will not trigger a deferred load after only 500ms (the default tokenizer delay) while + still giving a reasonable timeout (10 seconds) to prevent deadlock. + + https://bugs.webkit.org/show_bug.cgi?id=29381 + + * Api/qwebframe.cpp: Document the behaviour + * WebCoreSupport/FrameLoaderClientQt.cpp: set the custom tokenizer delay for substitute loads + * tests/qwebframe/tst_qwebframe.cpp: Add test + +2010-07-07 Tor Arne Vestbø <tor.arne.vestbo@nokia.com> + + Reviewed by Darin Adler. + + Prevent assertion/duplicate loads for non-deferred subtitute-data loads + + https://bugs.webkit.org/show_bug.cgi?id=30879 + + MainResourceLoader uses the member m_initialRequest to store requests for future + deferred loads. When doing the actual load in handleDataLoadNow(), we therefore + have to clear this request so that subsequent entries into the loader will not + start yet another load. + + This can happen as a result of a PageGroupLoadDeferrer going out of scope when + returning from Chrome::runJavaScriptAlert(), which calls setDeferredLoading(false), + but only in the case of using both substitute-data and non-deferred main resource + load together. That's why two new DRT functions were added: + + * queueLoadHTMLString() + * setDeferMainResourceLoad() + + The change adds DRT hooks for Mac, Win and Qt for these two functions. For Mac + and Win the hook uses new SPI in WebDataSource. For Qt a new static member was + added to the FrameLoaderClientQt and accessed though DumpRenderTreeSupportQt. + + * WebCoreSupport/DumpRenderTreeSupportQt.cpp: + (DumpRenderTreeSupportQt::setDeferMainResourceDataLoad): + * WebCoreSupport/DumpRenderTreeSupportQt.h: + * WebCoreSupport/FrameLoaderClientQt.cpp: + (WebCore::FrameLoaderClientQt::createDocumentLoader): + * WebCoreSupport/FrameLoaderClientQt.h: + +2010-07-23 David Boddie <dboddie@trolltech.com> + + Reviewed by Simon Hausmann. + + Doc: Fixed incorrect QML property type. + + * declarative/qdeclarativewebview.cpp: + +2010-07-23 Simon Hausmann <simon.hausmann@nokia.com> + + [Qt] Build fix for Qt apps + + Add webkit to QT_CONFIG. qconfig.pri will read qt_webkit_version.pri and + that's how it will pick up webkit in QT_CONFIG. + + * qt_webkit_version.pri: + +2010-07-09 Kent Hansen <kent.hansen@nokia.com> + + Reviewed by Kenneth Rohde Christiansen. + + [Qt] Skip test that never terminates on maemo5 + + Due to https://bugs.webkit.org/show_bug.cgi?id=38538 + the tst_QWebPage::infiniteLoopJS() autotest never terminates. + Skip the test so that the test case may run to completion. + + Patch by Dominik Holland <dominik.holland@nokia.com> + + * tests/qwebpage/tst_qwebpage.cpp: + (tst_QWebPage::infiniteLoopJS): + 2010-07-09 Simon Hausmann <simon.hausmann@nokia.com> Unreviewed trivial Symbian build fix. diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp index 686bfcc..713fa39 100644 --- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp +++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp @@ -38,6 +38,7 @@ #include "FrameTree.h" #include "FrameView.h" #include "DocumentLoader.h" +#include "JSDOMWindowBase.h" #include "MIMETypeRegistry.h" #include "ResourceResponse.h" #include "Page.h" @@ -141,6 +142,8 @@ static QString drtDescriptionSuitableForTestResult(const WebCore::ResourceRespon namespace WebCore { +bool FrameLoaderClientQt::deferMainResourceDataLoad = true; + FrameLoaderClientQt::FrameLoaderClientQt() : m_frame(0) , m_webFrame(0) @@ -812,8 +815,15 @@ bool FrameLoaderClientQt::shouldFallBack(const WebCore::ResourceError&) WTF::PassRefPtr<WebCore::DocumentLoader> FrameLoaderClientQt::createDocumentLoader(const WebCore::ResourceRequest& request, const SubstituteData& substituteData) { RefPtr<DocumentLoader> loader = DocumentLoader::create(request, substituteData); - if (substituteData.isValid()) + if (!deferMainResourceDataLoad || substituteData.isValid()) { loader->setDeferMainResourceDataLoad(false); + // Use the default timeout interval for JS as the HTML tokenizer delay. This ensures + // that long-running JavaScript will still allow setHtml() to be synchronous, while + // still giving a reasonable timeout to prevent deadlock. + double delay = JSDOMWindowBase::commonJSGlobalData()->timeoutChecker.timeoutInterval() / 1000.0f; + m_frame->page()->setCustomHTMLTokenizerTimeDelay(delay); + } else + m_frame->page()->setCustomHTMLTokenizerTimeDelay(-1); return loader.release(); } diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h index adeb31c..515cf9a 100644 --- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h +++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h @@ -211,6 +211,8 @@ namespace WebCore { QString chooseFile(const QString& oldFile); + static bool deferMainResourceDataLoad; + private: Frame *m_frame; QWebFrame *m_webFrame; diff --git a/src/3rdparty/webkit/WebKit/qt/declarative/qdeclarativewebview.cpp b/src/3rdparty/webkit/WebKit/qt/declarative/qdeclarativewebview.cpp index 0342c9f..9dcba60 100644 --- a/src/3rdparty/webkit/WebKit/qt/declarative/qdeclarativewebview.cpp +++ b/src/3rdparty/webkit/WebKit/qt/declarative/qdeclarativewebview.cpp @@ -612,7 +612,7 @@ QAction* QDeclarativeWebView::stopAction() const #endif // QT_NO_ACTION /*! - \qmlproperty real WebView::title + \qmlproperty string WebView::title This property holds the title of the web page currently viewed By default, this property contains an empty string. diff --git a/src/3rdparty/webkit/WebKit/qt/qt_webkit_version.pri b/src/3rdparty/webkit/WebKit/qt/qt_webkit_version.pri index ffd192c..d8cf06c 100644 --- a/src/3rdparty/webkit/WebKit/qt/qt_webkit_version.pri +++ b/src/3rdparty/webkit/WebKit/qt/qt_webkit_version.pri @@ -2,3 +2,4 @@ QT_WEBKIT_VERSION = 4.7.0 QT_WEBKIT_MAJOR_VERSION = 4 QT_WEBKIT_MINOR_VERSION = 7 QT_WEBKIT_PATCH_VERSION = 0 +QT_CONFIG *= webkit diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp index 76fdba3..e584f97 100644 --- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp +++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp @@ -598,6 +598,7 @@ private slots: void setHtml(); void setHtmlWithResource(); void setHtmlWithBaseURL(); + void setHtmlWithJSAlert(); void ipv6HostEncoding(); void metaData(); #if !defined(Q_WS_MAEMO_5) @@ -2485,6 +2486,33 @@ void tst_QWebFrame::setHtmlWithBaseURL() QCOMPARE(m_view->page()->history()->count(), 0); } +class MyPage : public QWebPage +{ +public: + MyPage() : QWebPage(), alerts(0) {} + int alerts; + +protected: + virtual void javaScriptAlert(QWebFrame*, const QString& msg) + { + alerts++; + QCOMPARE(msg, QString("foo")); + // Should not be enough to trigger deferred loading, since we've upped the HTML + // tokenizer delay in the Qt frameloader. See HTMLTokenizer::continueProcessing() + QTest::qWait(1000); + } +}; + +void tst_QWebFrame::setHtmlWithJSAlert() +{ + QString html("<html><head></head><body><script>alert('foo');</script><p>hello world</p></body></html>"); + MyPage page; + m_view->setPage(&page); + page.mainFrame()->setHtml(html); + QCOMPARE(page.alerts, 1); + QCOMPARE(m_view->page()->mainFrame()->toHtml(), html); +} + class TestNetworkManager : public QNetworkAccessManager { public: diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp index 0f2ca22..b7ffb8a 100644 --- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp +++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp @@ -219,6 +219,9 @@ public slots: void tst_QWebPage::infiniteLoopJS() { +#ifdef Q_WS_MAEMO_5 + QSKIP("Test never terminates on Maemo 5 : https://bugs.webkit.org/show_bug.cgi?id=38538", SkipAll); +#endif JSTestPage* newPage = new JSTestPage(m_view); m_view->setPage(newPage); m_view->setHtml(QString("<html><bodytest</body></html>"), QUrl()); |