| Index: WebCore/ChangeLog | 
| =================================================================== | 
| --- WebCore/ChangeLog	(revision 72934) | 
| +++ WebCore/ChangeLog	(working copy) | 
| @@ -1,527 +1,3 @@ | 
| -2010-11-29  James Robinson  <jamesr@chromium.org> | 
| - | 
| -        [chromium] REGRESSION(72470): Crash in skia on some images | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50201 | 
| - | 
| -        Reverts r72470 | 
| - | 
| -        * platform/graphics/skia/ImageSkia.cpp: | 
| -        (WebCore::computeResamplingMode): | 
| -        (WebCore::drawResampledBitmap): | 
| - | 
| -2010-11-29  Dmitry Titov  <dimich@chromium.org> | 
| - | 
| -        Reviewed by David Levin. | 
| - | 
| -        Crash when iframe transfers from one page to another and has child frames. | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50200 | 
| - | 
| -        * page/Frame.cpp: | 
| -        (WebCore::Frame::transferChildFrameToNewDocument): | 
| -        avoid overriding 'didTransfer' which has the result of previous check. | 
| - | 
| -2010-11-19  Ryosuke Niwa  <rniwa@webkit.org> | 
| - | 
| -        Reviewed by David Hyatt. | 
| - | 
| -        up arrow doesn't work with RTL text with word wrapping | 
| -        https://bugs.webkit.org/show_bug.cgi?id=41987 | 
| - | 
| -        The bug was caused by positionForPoint's not returning the correct affinity when the x coordiate | 
| -        is to the left of the first line, and startOfLine's incorrectly moving position to the previous candidate. | 
| - | 
| -        Fixed the bug by returning upstream VisiblePosition in positionForPoint if the first inline text box's offset | 
| -        is greater than 0.  Also removed the code added by http://trac.webkit.org/changeset/23608 since this changeset | 
| -        does not add any test, and the problem described in the changelog reproduces regardless of the code's presence. | 
| - | 
| -        Tests: editing/selection/click-left-of-rtl-wrapping-text.html | 
| -               editing/selection/modify-up-on-rtl-wrapping-text.html | 
| - | 
| -        * editing/visible_units.cpp: | 
| -        (WebCore::startOfLine): | 
| -        * rendering/RenderText.cpp: | 
| -        (WebCore::RenderText::positionForPoint): | 
| - | 
| -2010-11-29  Ilya Sherman  <isherman@chromium.org> | 
| - | 
| -        Reviewed by Kent Tamura. | 
| - | 
| -        Ensure that option elements are rendered with normal font weight on Windows/Linux | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50055 | 
| - | 
| -        * WebCore.gyp/WebCore.gyp: include themeChromiumSkia.css | 
| -        * css/themeChromiumSkia.css: Added. | 
| -        (option): font-weight: normal !important; | 
| -        * rendering/RenderThemeChromiumSkia.cpp: | 
| -        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet): include themeChromiumSkia.css | 
| - | 
| -2010-11-29  Brent Fulgham  <bfulgham@webkit.org> | 
| - | 
| -        Unreviewed build fix. | 
| - | 
| -        * WebCore.vcproj/WebCoreCairo.vsprops: Provide missing WIN_CAIRO | 
| -          definition so that proper targets are build. | 
| -        * platform/graphics/win/cairo/FontPlatformData.h: | 
| -        (WebCore::FontPlatformData::orientation): Add missing implementation. | 
| - | 
| -2010-11-29  Chris Rogers  <crogers@google.com> | 
| - | 
| -        Reviewed by Kenneth Russell. | 
| - | 
| -        Switch web audio code to use FloatPoint3D instead of Vector3 | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50186 | 
| - | 
| -        No new tests since audio API is not yet implemented. | 
| - | 
| -        * platform/audio/Cone.cpp: | 
| -        (WebCore::ConeEffect::gain): | 
| -        * platform/audio/Cone.h: | 
| -        * platform/graphics/FloatPoint3D.h: | 
| -        (WebCore::FloatPoint3D::isZero): | 
| -        (WebCore::operator*): | 
| -        (WebCore::FloatPoint3D::distanceTo): | 
| -        * webaudio/AudioListener.h: | 
| -        (WebCore::AudioListener::setPosition): | 
| -        (WebCore::AudioListener::position): | 
| -        (WebCore::AudioListener::setOrientation): | 
| -        (WebCore::AudioListener::orientation): | 
| -        (WebCore::AudioListener::setUpVector): | 
| -        (WebCore::AudioListener::upVector): | 
| -        (WebCore::AudioListener::setVelocity): | 
| -        (WebCore::AudioListener::velocity): | 
| -        * webaudio/AudioPannerNode.cpp: | 
| -        (WebCore::AudioPannerNode::AudioPannerNode): | 
| -        (WebCore::AudioPannerNode::getAzimuthElevation): | 
| -        (WebCore::AudioPannerNode::dopplerRate): | 
| -        (WebCore::AudioPannerNode::distanceConeGain): | 
| -        * webaudio/AudioPannerNode.h: | 
| -        (WebCore::AudioPannerNode::position): | 
| -        (WebCore::AudioPannerNode::setPosition): | 
| -        (WebCore::AudioPannerNode::orientation): | 
| -        (WebCore::AudioPannerNode::setOrientation): | 
| -        (WebCore::AudioPannerNode::velocity): | 
| -        (WebCore::AudioPannerNode::setVelocity): | 
| - | 
| -2010-11-29  Xiaomei Ji  <xji@chromium.org> | 
| - | 
| -        Reviewed by David Hyatt. | 
| - | 
| -        Right-to-left pages should be scrollable to reveal left overflow. | 
| -        https://bugs.webkit.org/show_bug.cgi?id=23556 | 
| - | 
| -        For RTL page, save left layout overflow and include it into the document | 
| -        size during layout. Use the left layout overflow when scroll and paint | 
| -        the page. Behavior on LTR page should be untouched since left layout | 
| -        overflow is set as 0 for LTR page. | 
| - | 
| -        Tests: fast/dom/horizontal-scrollbar-in-rtl-doesnt-fire-onscroll.html | 
| -               fast/dom/horizontal-scrollbar-in-rtl.html | 
| -               fast/dom/horizontal-scrollbar-when-dir-change.html | 
| -               fast/dom/left-overflow-in-ltr.html | 
| -               fast/dom/right-overflow-in-rtl.html | 
| - | 
| -        * page/FrameView.cpp: | 
| -        (WebCore::FrameView::adjustViewSize): Save negative of left layout overflow as scroll X origin. And includes left layout overflow into document size. | 
| -        * page/mac/WebCoreFrameView.h: Add methods for setting and getting scroll X origin. | 
| -        * platform/ScrollView.cpp: | 
| -        (WebCore::ScrollView::ScrollView): | 
| -        (WebCore::ScrollView::maximumScrollPosition): Minus scroll X origin from maximum horizontal scroll position. | 
| -        (WebCore::ScrollView::minimumScrollPosition): | 
| -        (WebCore::ScrollView::adjustScrollPositionWithinRange): | 
| -        (WebCore::ScrollView::valueChanged): | 
| -        (WebCore::ScrollView::setScrollPosition): | 
| -        (WebCore::ScrollView::updateScrollbars): | 
| -        (WebCore::ScrollView::wheelEvent): | 
| -        * platform/ScrollView.h: | 
| -        * platform/mac/ScrollViewMac.mm: | 
| -        (WebCore::ScrollView::platformSetContentsSize): | 
| -        (WebCore::ScrollView::platformSetScrollPosition): | 
| -        (WebCore::ScrollView::platformSetScrollOriginX): | 
| -        * rendering/RenderBox.cpp: | 
| -        (WebCore::RenderBox::styleDidChange): | 
| -        (WebCore::RenderBox::paintRootBoxDecorations): Include left layout overflow into canvas size. | 
| -        * rendering/RenderView.cpp: | 
| -        (WebCore::RenderView::layout): Save left layout overflow. | 
| -        (WebCore::RenderView::docLeft): | 
| -        (WebCore::RenderView::docWidth): Include left layout overflow into doc width for RTL page. | 
| -        * rendering/RenderView.h: | 
| - | 
| -2010-11-29  Simon Fraser  <simon.fraser@apple.com> | 
| - | 
| -        Reviewed by Ojan Vafai. | 
| - | 
| -        bunch of pixel failures after http://trac.webkit.org/changeset/72839/ | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50188 | 
| - | 
| -        We need to call updateLayerTransform() for reflections, and | 
| -        table rows as well. | 
| - | 
| -        * rendering/RenderReplica.cpp: | 
| -        (WebCore::RenderReplica::layout): | 
| -        * rendering/RenderTableRow.cpp: | 
| -        (WebCore::RenderTableRow::layout): | 
| -        * rendering/RenderTableSection.cpp: | 
| -        (WebCore::RenderTableSection::layoutRows): | 
| - | 
| -2010-11-29  Xiaomei Ji  <xji@chromium.org> | 
| - | 
| -        Reviewed by David Hyatt. | 
| - | 
| -        Fix tab overflow problem when alignment is not left. | 
| -        https://bugs.webkit.org/show_bug.cgi?id=25459 | 
| - | 
| -        I checked WordPad in Windows, TextEdit in Mac, OpenOffice, and Google doc. | 
| -        In all of them, (when the writing mode is horizontal) when the alignment is not | 
| -        left alignment, the length of tab is computed based on the tab's position | 
| -        relative to the left start of line, not based on the tab's position relative | 
| -        to the left edge of the document. | 
| - | 
| -        WebKit should follow the same. | 
| - | 
| -        The m_xPos in each TextRun should be relative to the left start of the line, | 
| -        not left start of its containing block (in right alignment and center alignment, | 
| -        left start of the line is not the same as left start of the containing block). | 
| -        So, when the text is drawn, the width of tab is consistent with the width | 
| -        computed in RenderBlock::computeInlineDirectionPositionsForLine(). | 
| - | 
| -        I did not test vertical writing mode, but I think the same rule should apply. | 
| - | 
| -        Test: fast/dom/tab-in-right-alignment.html | 
| - | 
| -        * platform/graphics/TextRun.h: | 
| -        * rendering/InlineTextBox.cpp: | 
| -        (WebCore::InlineTextBox::textPos): | 
| -        * rendering/InlineTextBox.h: | 
| - | 
| -2010-11-29  Mikhail Naganov  <mnaganov@chromium.org> | 
| - | 
| -        Reviewed by Pavel Feldman. | 
| - | 
| -        WebInspector: Request JSON-serialized heap snapshot from JS engine. | 
| -        This simplifies heap snapshots interaction and API. Instead of | 
| -        having objects representing snapshot entities, the whole snapshot | 
| -        is transferred to WebInspector and parsed there. | 
| - | 
| -        https://bugs.webkit.org/show_bug.cgi?id=49974 | 
| - | 
| -        * bindings/js/ScriptHeapSnapshot.h: | 
| -        (WebCore::ScriptHeapSnapshot::OutputStream::~OutputStream): | 
| -        (WebCore::ScriptHeapSnapshot::~ScriptHeapSnapshot): | 
| -        (WebCore::ScriptHeapSnapshot::writeJSON): | 
| -        (WebCore::ScriptHeapSnapshot::ScriptHeapSnapshot): | 
| -        * bindings/v8/ScriptHeapSnapshot.cpp: | 
| -        (WebCore::ScriptHeapSnapshot::writeJSON): | 
| -        * bindings/v8/ScriptHeapSnapshot.h: | 
| -        (WebCore::ScriptHeapSnapshot::OutputStream::~OutputStream): | 
| -        * inspector/Inspector.idl: | 
| -        * inspector/InspectorProfilerAgent.cpp: | 
| -        (WebCore::InspectorProfilerAgent::getProfile): | 
| -        * inspector/front-end/HeapSnapshotView.js: | 
| -        (WebInspector.HeapSnapshotEdgesIterator): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype.get done): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype.get isElement): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype.get isHidden): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype.get name): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype.next): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype.get node): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype.get nodeIndex): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype._getNameOrIndex): | 
| -        (WebInspector.HeapSnapshotEdgesIterator.prototype._getType): | 
| -        (WebInspector.HeapSnapshotNodeWrapper): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype.get edges): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype.get edgesCount): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype.get instancesCount): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype.get isHidden): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype.get name): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype.get selfSize): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype._getName): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype._getEdges): | 
| -        (WebInspector.HeapSnapshotNodeWrapper.prototype._getType): | 
| -        (WebInspector.HeapSnapshot): | 
| -        (WebInspector.HeapSnapshot.prototype._init): | 
| -        (WebInspector.HeapSnapshot.prototype.get rootEdges): | 
| -        (WebInspector.HeapSnapshotView.prototype.snapshotLoaded): | 
| -        (WebInspector.HeapSnapshotView.prototype._loadProfile.processLoadedSnapshot): | 
| -        (WebInspector.HeapSnapshotView.prototype._loadProfile): | 
| -        (WebInspector.HeapSnapshotView.prototype._convertSnapshot): | 
| -        (WebInspector.HeapSnapshotView.prototype._prepareProfile.mergeRetainers): | 
| -        (WebInspector.HeapSnapshotView.prototype._prepareProfile): | 
| -        (WebInspector.HeapSnapshotView.prototype._sortData): | 
| -        * inspector/front-end/ProfilesPanel.js: | 
| -        (WebInspector.ProfilesPanel): | 
| -        (WebInspector.ProfilesPanel.prototype.addHeapSnapshotChunk): | 
| -        (WebInspector.ProfilesPanel.prototype.finishHeapSnapshot): | 
| -        * inspector/front-end/inspector.js: | 
| -        (WebInspector.addHeapSnapshotChunk): | 
| -        (WebInspector.finishHeapSnapshot): | 
| - | 
| -2010-11-29  Simon Fraser  <simon.fraser@apple.com> | 
| - | 
| -        Reviewed by Dave Hyatt. | 
| - | 
| -        layer()->currentTransform() is stale when layout changes the box size | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50175 | 
| - | 
| -        RenderLayer::updateTransform() is fairly expensive, so we | 
| -        have to avoid calling it from RenderBox::applyLayerTransformToRect() | 
| -        every time. This requires that we update the layer's transform | 
| -        during layout, instead of from updateLayerPositions() which is too late. | 
| - | 
| -        So call updateLayerTransform() from the various layout methods | 
| -        on renderers that can be transformed, and remove it from | 
| -        updateLayerPositions(). | 
| - | 
| -        Test: fast/overflow/overflow-update-transform.html | 
| - | 
| -        * rendering/RenderBlock.cpp: | 
| -        (WebCore::RenderBlock::layoutBlock): | 
| -        (WebCore::RenderBlock::layoutOnlyPositionedObjects): | 
| -        * rendering/RenderBox.cpp: | 
| -        (WebCore::RenderBox::applyLayerTransformToRect): | 
| -        (WebCore::RenderBox::updateLayerTransform): | 
| -        * rendering/RenderBox.h: | 
| -        * rendering/RenderEmbeddedObject.cpp: | 
| -        (WebCore::RenderEmbeddedObject::layout): | 
| -        * rendering/RenderFlexibleBox.cpp: | 
| -        (WebCore::RenderFlexibleBox::layoutBlock): | 
| -        * rendering/RenderIFrame.cpp: | 
| -        (WebCore::RenderIFrame::layout): | 
| -        * rendering/RenderLayer.cpp: | 
| -        (WebCore::RenderLayer::updateLayerPositions): | 
| -        * rendering/RenderReplaced.cpp: | 
| -        (WebCore::RenderReplaced::layout): | 
| -        * rendering/RenderTable.cpp: | 
| -        (WebCore::RenderTable::layout): | 
| - | 
| -2010-11-29  Chris Rogers  <crogers@google.com> | 
| - | 
| -        Reviewed by Kenneth Russell. | 
| - | 
| -        Add remaining custom JSC web audio bindings | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50172 | 
| - | 
| -        No new tests since audio API is not yet implemented. | 
| - | 
| -        * bindings/js/JSAudioBufferSourceNodeCustom.cpp: Added. | 
| -        (WebCore::JSAudioBufferSourceNode::setBuffer): | 
| -        * bindings/js/JSConvolverNodeCustom.cpp: Added. | 
| -        (WebCore::JSConvolverNode::setBuffer): | 
| -        * bindings/js/JSJavaScriptAudioNodeCustom.cpp: Added. | 
| -        (WebCore::JSJavaScriptAudioNode::markChildren): | 
| -        * webaudio/AudioBufferSourceNode.idl: | 
| -        * webaudio/ConvolverNode.idl: | 
| - | 
| -2010-11-29  Yael Aharon  <yael.aharon@nokia.com> | 
| - | 
| -        Reviewed by Darin Adler. | 
| - | 
| -        HTMLFormElement.elements doesn't include fieldsets | 
| -        https://bugs.webkit.org/show_bug.cgi?id=48193 | 
| - | 
| -        Add fieldset and keygen to the list of form collection elements, by making them enumeratable. | 
| -        This patch does not add object element to the list. A separate bug will do that. | 
| - | 
| -        Test: fast/forms/form-collection-elements.html | 
| - | 
| -        * html/HTMLFieldSetElement.h: | 
| -        (WebCore::HTMLFieldSetElement::isEnumeratable): | 
| -        * html/HTMLKeygenElement.h: | 
| -        (WebCore::HTMLKeygenElement::isEnumeratable): | 
| - | 
| -2010-11-29  Xan Lopez  <xlopez@igalia.com> | 
| - | 
| -        Reviewed by Martin Robinson. | 
| - | 
| -        Get distcheck going. | 
| - | 
| -        * GNUmakefile.am: | 
| - | 
| -2010-11-29  Alexey Proskuryakov  <ap@apple.com> | 
| - | 
| -        Reviewed by Darin Adler. | 
| - | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50181 | 
| -        CSS style declarations don't GC protect parents | 
| - | 
| -        Test: fast/dom/StyleSheet/gc-declaration-parent-rule.html | 
| - | 
| -        * bindings/js/JSCSSStyleDeclarationCustom.cpp: (WebCore::JSCSSStyleDeclaration::markChildren): | 
| -        Protect the parent rule. | 
| - | 
| -2010-11-29  Ilya Tikhonovsky  <loislo@chromium.org> | 
| - | 
| -        Reviewed by Pavel Feldman. | 
| - | 
| -        Web Inspector: UI fix. In Timeline, Paint events "Location" value is displayed | 
| -        in a confusing manner. The format string should be changed from %d x %d | 
| -        pattern to (%d, %d). | 
| - | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50178 | 
| - | 
| -        * English.lproj/localizedStrings.js: | 
| -        * inspector/front-end/TimelinePanel.js: | 
| -        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent): | 
| - | 
| -2010-11-29  Darin Adler  <darin@apple.com> | 
| - | 
| -        Reviewed by Andreas Kling. | 
| - | 
| -        Remove a couple unneeded overflow checks | 
| -        https://bugs.webkit.org/show_bug.cgi?id=49816 | 
| - | 
| -        * platform/text/TextCodecUTF16.cpp: | 
| -        (WebCore::TextCodecUTF16::encode): Use an ASSERT instead of | 
| -        an overflow check with CRASH. | 
| - | 
| -2010-11-29  Tony Chang  <tony@chromium.org> | 
| - | 
| -        Unreviewed, disable warnings again on chromium linux | 
| - | 
| -        * WebCore.gyp/WebCore.gyp: | 
| - | 
| -2010-11-29  Cosmin Truta  <ctruta@chromium.org> | 
| - | 
| -        Reviewed by Nikolas Zimmermann. | 
| - | 
| -        getBoundingClientRect: Do not truncate the coordinates to integers | 
| -        https://bugs.webkit.org/show_bug.cgi?id=48110 | 
| - | 
| -        Remove the float-to-int coordinate conversions inside getBoundingClientRect, | 
| -        to comply with the CSSOM View Module API. | 
| - | 
| -        Tests: fast/dom/Element/getBoundingClientRect.html | 
| -               fast/dom/Range/getBoundingClientRect.html | 
| -               svg/zoom/page/zoom-getBoundingClientRect.xhtml | 
| -               svg/zoom/page/zoom-zoom-coords.xhtml | 
| - | 
| -        * dom/ClientRect.cpp: | 
| -        (WebCore::ClientRect::ClientRect): Added overload to allow a FloatRect argument. | 
| -        * dom/ClientRect.h: | 
| -        (WebCore::ClientRect::create): Ditto. | 
| -        * dom/Element.cpp: | 
| -        (Element::getBoundingClientRect): Removed conversion from FloatRect to IntRect. | 
| -        * dom/Range.cpp: | 
| -        (WebCore::Range::getBoundingClientRect): Ditto. | 
| -        * rendering/RenderObject.h: | 
| -        (adjustIntRectForAbsoluteZoom): Removed. | 
| -        (adjustFloatRectForAbsoluteZoom): Added. | 
| -        * rendering/style/RenderStyle.h: | 
| -        (adjustFloatForAbsoluteZoom): Added. | 
| - | 
| -2010-11-29  Dimitri Glazkov  <dglazkov@chromium.org> | 
| - | 
| -        Reviewed by Darin Adler. | 
| - | 
| -        Converge means of querying a parent node into one way, which is Node::parentNode. | 
| -        https://bugs.webkit.org/show_bug.cgi?id=49686 | 
| - | 
| -        A follow-up to r72259, which explicitly forbids further use of Node::parent by | 
| -        making it private. | 
| - | 
| -        No change in behavior, so no new tests. | 
| - | 
| -        * dom/Document.cpp: | 
| -        (WebCore::Document::styleForElementIgnoringPendingStylesheets): Changed to use parentNode. | 
| -        (WebCore::Document::hoveredNodeDetached): Ditto. | 
| -        (WebCore::Document::activeChainNodeDetached): Ditto. | 
| -        * dom/Node.h: Made Node::parent private. | 
| -        * page/SpatialNavigation.cpp: | 
| -        (WebCore::canBeScrolledIntoView): Changed to use parentNode. | 
| -        * xml/XSLTProcessorQt.cpp: | 
| -        (WebCore::XSLTProcessor::transformToString): Ditto. | 
| - | 
| -2010-11-29  Tony Chang  <tony@chromium.org> | 
| - | 
| -        Reviewed by James Robinson. | 
| - | 
| -        [chromium] try to enable WebCore compiler warnings on linux | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50168 | 
| - | 
| -        * WebCore.gyp/WebCore.gyp: | 
| -        * platform/graphics/chromium/FontLinux.cpp: | 
| -        (WebCore::TextRunWalker::setPadding): | 
| -        (WebCore::TextRunWalker::setGlyphXPositions): | 
| -        (WebCore::glyphIndexForXPositionInScriptRun): | 
| - | 
| -2010-11-29  Alexey Proskuryakov  <ap@apple.com> | 
| - | 
| -        Reviewed by Darin Adler. | 
| - | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50165 | 
| -        CSS style rules don't GC protect parents | 
| - | 
| -        Tests: fast/dom/StyleSheet/gc-parent-rule.html | 
| -               fast/dom/StyleSheet/gc-parent-stylesheet.html | 
| - | 
| -        * bindings/js/JSCSSRuleCustom.cpp: (WebCore::JSCSSRule::markChildren): Mark parents. The code | 
| -        is super naive compared to what we have for nodes - but CSSOM has shallow hierarchies, so | 
| -        it should be OK. | 
| - | 
| -        * css/CSSRule.idl: Added CustomMarkFunction. | 
| - | 
| -2010-11-29  Gavin Peters  <gavinp@chromium.org> | 
| - | 
| -        Reviewed by Adam Barth. | 
| - | 
| -        Web page can prevent WebKit from loading subresources on other | 
| -        pages (cache poisoning) | 
| -        https://bugs.webkit.org/show_bug.cgi?id=35404 | 
| - | 
| -        Tests: http/tests/misc/unloadable-script.html | 
| -               loader/reload-subresource-when-type-changes.html | 
| - | 
| -        * loader/cache/MemoryCache.cpp: | 
| -        (WebCore::MemoryCache::requestResource): | 
| - | 
| -2010-11-29  Simon Fraser  <simon.fraser@apple.com> | 
| - | 
| -        Reviewed by Dan Bernstein. | 
| - | 
| -        Crash in WebCore::CSSStyleSelector::loadPendingImages | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50149 | 
| - | 
| -        Null-check style->boxReflect() when loading pending style images. | 
| - | 
| -        Test: fast/reflections/pending-reflection-mask-crash.html | 
| - | 
| -        * css/CSSStyleSelector.cpp: | 
| -        (WebCore::CSSStyleSelector::loadPendingImages): | 
| - | 
| -2010-11-29  Pavel Feldman  <pfeldman@chromium.org> | 
| - | 
| -        Reviewed by Yury Semikhatsky. | 
| - | 
| -        Web Inspector: crash upon inspecting user style sheet. | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50109 | 
| - | 
| -        * inspector/InspectorStyleSheet.cpp: | 
| -        (WebCore::InspectorStyleSheet::resourceStyleSheetText): | 
| - | 
| -2010-11-29  Patrick Gansterer  <paroga@webkit.org> | 
| - | 
| -        Reviewed by Adam Roben. | 
| - | 
| -        [WINCE] Implement WebCore::directoryName | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50031 | 
| - | 
| -        Also fix handling of paths without path separator. | 
| - | 
| -        * platform/wince/FileSystemWinCE.cpp: | 
| -        (WebCore::reverseFindPathSeparator): | 
| -        (WebCore::makeAllDirectories): | 
| -        (WebCore::pathGetFileName): | 
| -        (WebCore::directoryName): | 
| - | 
| -2010-11-29  Patrick Gansterer  <paroga@webkit.org> | 
| - | 
| -        Reviewed by Adam Roben. | 
| - | 
| -        Simplify directoryName in FileSystemWin.cpp | 
| -        https://bugs.webkit.org/show_bug.cgi?id=50028 | 
| - | 
| -        * platform/win/FileSystemWin.cpp: | 
| -        (WebCore::directoryName): | 
| - | 
| 2010-11-24  Dimitri Glazkov  <dglazkov@chromium.org> | 
|  | 
| Reviewed by Darin Adler. | 
|  |