Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 91476)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,11 +1,804 @@
-2011-07-20  James Robinson  <jamesr@chromium.org>
+2011-07-19  Steve Lacey  <sjl@chromium.org>
 
-        Speculative null pointer check to fix crashes seen in the field.
-        BUG=89193, cros bug 17121
+        [chromium] Media player controls do not fade out.
+        https://bugs.webkit.org/show_bug.cgi?id=64837
 
+        Media controls were not fading out when the mouse leaves the video
+        due to underlying changes in webkit media controls.
+        Fix was to copy missing code from MediaControlRootElement to
+        MediaControlRootElementChromium.
+
+        Reviewed by Dimitri Glazkov.
+
+        * html/shadow/MediaControlRootElementChromium.cpp:
+        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
+        (WebCore::MediaControlRootElementChromium::playbackProgressed):
+        (WebCore::MediaControlRootElementChromium::containsRelatedTarget):
+        (WebCore::MediaControlRootElementChromium::defaultEventHandler):
+        * html/shadow/MediaControlRootElementChromium.h:
+
+2011-07-19  Luke Macpherson   <macpherson@chromium.org>
+
+        Implement CSSPropertyCounterIncrement and CounterReset in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=64846
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyCounter
+        Added class to handle counter properties.
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        Initialize counter property handlers.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Remove old handlers.
+
+2011-07-19  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r89004): Video pauses and never resumes playing if scrubbed during playback.
+        https://bugs.webkit.org/show_bug.cgi?id=64314
+
+        Reviewed by Sam Weinig.
+
+        No new tests because it's hard to make a non-flaky test for this behavior.
+
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::handleMouseDownEvent):
+        Don't call SliderThumbElement::dragFrom() for events on the thumb.
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::defaultEventHandler):
+        Do not call setDefaultHandled() for mouse events in order to
+        propagate them to ancestor elements.
+
+2011-07-19  Matthew Delaney  <mdelaney@apple.com>
+
+        Add fast path for ImageBuffer::draw
+        https://bugs.webkit.org/show_bug.cgi?id=64535
+
+        Reviewed by Simon Fraser.
+
+        No new tests. This patch doesn't change behavior; current tests are sufficient.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage): Moved the main method version next to wrapper versions.
+
+        * platform/graphics/ImageBuffer.h:
+        1) Added BackingStoreCopy enum for choosing to copy backing store or not in copyImage().
+        2) Added copyNativeImage() behind USE(CG) - same as copyImage() but gives NativeImagePtr.
+        * platform/graphics/cg/ImageBufferCG.cpp: Added new methods described above.
+
+        * platform/graphics/GraphicsContext.h: Adding drawNativeImage() for fast draw path.
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawNativeImage): Added. Draws a nativeImagePtr into context.
+
+        * platform/graphics/Image.h: Added imageWithColorSpace behind CG platform ifdef
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw): Refactored out actual image drawing code into GraphicsContext,
+        so that it can be used by more than just BitmapImage without having to copy code.
+        (WebCore::Image::imageWithColorSpace): Made into an Image class function.
+
+        Updated copyImage() to for BackingStoreCopy:
+        * platform/graphics/qt/ImageBufferQt.cpp
+        * platform/graphics/filters/FETile.cpp
+        * platform/graphics/cairo/ImageBufferCairo.cpp
+        * platform/graphics/skia/ImageBufferSkia.cpp
+        * platform/graphics/wx/ImageBufferWx.cpp
+        * platform/graphics/wince/ImageBufferWinCE.cpp
+        * svg/SVGFEImageElement.cpp
+        * svg/graphics/SVGImage.cpp
+        * html/HTMLCanvasElement.cpp
+        * html/canvas/WebGLRenderingContext.cpp
+        * rendering/svg/RenderSVGResourcePattern.cpp
+
+2011-07-19  Leo Yang  <leoyang.webkit@gmail.com>
+
+        SVG: Missing implementation of <altGlyphDef>, <altGlyphItem> and <glyphRef>
+        https://bugs.webkit.org/show_bug.cgi?id=60850
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG spec: http://www.w3.org/TR/SVG/text.html#AlternateGlyphDefinitions.
+        This patch is to implement SVG <altGlyphDef>, <altGlyphItem> and <glyphRef>
+        elements for alternative glyph features.
+
+        NOTE: x, y, dx, dy, format and glyphRef attributes on <glyphRef> are not
+        honored yet, so neither are the reaction of dynamic change of them. They
+        will be honored in separated patches.
+
+        Test: svg/W3C-SVG-1.1/text-altglyph-01-b.svg
+        With this patch this test works as expected.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * bindings/objc/DOMSVG.h:
+        * page/DOMWindow.idl:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGAltGlyphDefElement.cpp: Added.
+        (WebCore::SVGAltGlyphDefElement::SVGAltGlyphDefElement):
+        (WebCore::SVGAltGlyphDefElement::create):
+        (WebCore::SVGAltGlyphDefElement::hasValidGlyphElements):
+        * svg/SVGAltGlyphDefElement.h: Added.
+        * svg/SVGAltGlyphDefElement.idl: Added.
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::hasValidGlyphElements):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGAltGlyphItemElement.cpp: Added.
+        (WebCore::SVGAltGlyphItemElement::SVGAltGlyphItemElement):
+        (WebCore::SVGAltGlyphItemElement::create):
+        (WebCore::SVGAltGlyphItemElement::hasValidGlyphElements):
+        * svg/SVGAltGlyphItemElement.h: Added.
+        * svg/SVGAltGlyphItemElement.idl: Added.
+        * svg/SVGFontData.cpp:
+        (WebCore::SVGFontData::applySVGGlyphSelection):
+        * svg/SVGGlyphRefElement.cpp: Added.
+        (WebCore::SVGGlyphRefElement::SVGGlyphRefElement):
+        (WebCore::SVGGlyphRefElement::create):
+        (WebCore::SVGGlyphRefElement::hasValidGlyphElement):
+        (WebCore::SVGGlyphRefElement::parseMappedAttribute):
+        (WebCore::SVGGlyphRefElement::glyphRef):
+        (WebCore::SVGGlyphRefElement::setGlyphRef):
+        (WebCore::SVGGlyphRefElement::setX):
+        (WebCore::SVGGlyphRefElement::setY):
+        (WebCore::SVGGlyphRefElement::setDx):
+        (WebCore::SVGGlyphRefElement::setDy):
+        * svg/SVGGlyphRefElement.h: Added.
+        * svg/SVGGlyphRefElement.idl: Added.
+        * svg/svgtags.in:
+
+2011-07-19  Adam Roben  <aroben@apple.com>
+
+        Remove some unused code in FormDataStreamCFNet
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+
+2011-07-19  Simon Fraser  <simon.fraser@apple.com>
+
+        REGRESSION (r91136-r91146): 40 tests failing on Windows 7 Release (Tests)
+        https://bugs.webkit.org/show_bug.cgi?id=64808
+
+        Reviewed by Adam Roben.
+
+        Initializing m_uncommittedChanges to a non-zero value
+        caused the first call to noteLayerPropertyChanged() to
+        not call m_client->notifySyncRequired(). This resulted in
+        animations never getting committed on Windows, which broke
+        a lot of tests.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+
+2011-07-19  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRendererChromium shouldn't be a friend of RenderSurfaceChromium
+        https://bugs.webkit.org/show_bug.cgi?id=64834
+
+        Reviewed by Kenneth Russell.
+
+        Uses setters and getters to access RenderSurfaceChromium's private member variables instead of directly
+        accessing them via a friend declaration. This cleans up a minor code smell and will be helpful for future
+        refactoring.
+
+        Refactor only, no change in behavior.  Tested by compositing/ tests.
+
         * platform/graphics/chromium/LayerRendererChromium.cpp:
-        (WebCore::LayerRendererChromium::transferRootLayer):
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::paintLayerContents):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::updatePropertiesAndRenderSurfaces):
+        (WebCore::LayerRendererChromium::updateCompositorResources):
+        (WebCore::LayerRendererChromium::getOffscreenLayerTexture):
+        (WebCore::LayerRendererChromium::copyOffscreenTextureToDisplay):
+        (WebCore::LayerRendererChromium::useRenderSurface):
+        (WebCore::LayerRendererChromium::drawLayer):
+        (WebCore::LayerRendererChromium::setScissorToRect):
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::clearLayerList):
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (WebCore::RenderSurfaceChromium::layerList):
+        (WebCore::RenderSurfaceChromium::contentRect):
+        (WebCore::RenderSurfaceChromium::setContentRect):
+        (WebCore::RenderSurfaceChromium::drawOpacity):
+        (WebCore::RenderSurfaceChromium::setDrawOpacity):
+        (WebCore::RenderSurfaceChromium::drawTransform):
+        (WebCore::RenderSurfaceChromium::setDrawTransform):
+        (WebCore::RenderSurfaceChromium::maskLayer):
+        (WebCore::RenderSurfaceChromium::setMaskLayer):
+        (WebCore::RenderSurfaceChromium::originTransform):
+        (WebCore::RenderSurfaceChromium::setOriginTransform):
+        (WebCore::RenderSurfaceChromium::replicaDrawTransform):
+        (WebCore::RenderSurfaceChromium::setReplicaDrawTransform):
+        (WebCore::RenderSurfaceChromium::scissorRect):
+        (WebCore::RenderSurfaceChromium::setScissorRect):
+        (WebCore::RenderSurfaceChromium::skipsDraw):
+        (WebCore::RenderSurfaceChromium::setSkipsDraw):
+        (WebCore::RenderSurfaceChromium::contentsTexture):
 
+2011-07-19  Jessie Berlin  <jberlin@apple.com>
+
+        GTK + QT build fix.
+
+        Rubber-stamped by Daniel Bates and Alexey Proskuryakov.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didSendData):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoading):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::wasBlocked):
+        (WebCore::ResourceLoader::cannotShowURL):
+        (WebCore::ResourceLoader::shouldUseCredentialStorage):
+        (WebCore::ResourceLoader::willCacheResponse):
+
+2011-07-19  Chris Rogers  <crogers@google.com>
+
+        Fix web audio compile on mac port
+        https://bugs.webkit.org/show_bug.cgi?id=64836
+
+        Unreviewed build fix.
+
+        * bindings/js/JSAudioContextCustom.cpp:
+        (WebCore::JSAudioContextConstructor::constructJSAudioContext):
+        (WebCore::JSAudioContext::createBuffer):
+
+2011-07-19  Jessie Berlin  <jberlin@apple.com>
+
+        Work towards determining the cause of frequent crashes due to null frame below
+        ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache.
+        https://bugs.webkit.org/show_bug.cgi?id=62764
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make these unexpected cases crash in the WebKit nightlies so we can gather more
+        information and potentially find a repro case.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didSendData):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoading):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::wasBlocked):
+        (WebCore::ResourceLoader::cannotShowURL):
+        (WebCore::ResourceLoader::shouldUseCredentialStorage):
+        (WebCore::ResourceLoader::willCacheResponse):
+
+2011-07-19  Dan Bernstein  <mitz@apple.com>
+
+        Nothing printed when specifying a very large maximum layout width
+        https://bugs.webkit.org/show_bug.cgi?id=64831
+
+        Reviewed by Beth Dakin.
+
+        I am not adding a test because the DumpRenderTree printing test machinery is based on PrintContext,
+        which does not exercise the code path on which this bug lies.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::forceLayoutForPagination): Fixed an integer overflow.
+
+2011-07-19  Nate Chapin  <japhet@chromium.org>
+
+        [V8] Wait until no v8 context is on the stack before
+        cancelling pending indexed db transactions.
+        https://bugs.webkit.org/show_bug.cgi?id=64552
+
+        Reviewed by Adam Barth.
+
+        Test: storage/indexeddb/transaction-abort-with-js-recursion.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::didLeaveScriptContext):
+
+2011-07-19  MORITA Hajime  <morrita@google.com>
+
+        Crash in CompositeEditCommand::replaceTextInNodePreservingMarkers.
+        https://bugs.webkit.org/show_bug.cgi?id=64738
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/undo/replace-text-in-node-preserving-markers-crash.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::copyMarkers):
+        (WebCore::CompositeEditCommand::replaceTextInNodePreservingMarkers):
+
+2011-07-19  Mike West  <mkwst@chromium.org>
+
+        Sending a `Ping-From` header for cross-origin pings from non-HTTPS documents.
+        https://bugs.webkit.org/show_bug.cgi?id=64789
+
+        Also a drive-by cleanup of whitespace.
+
+        Reviewed by Nate Chapin.
+
+        * loader/PingLoader.cpp:
+        (WebCore::PingLoader::loadImage):
+        (WebCore::PingLoader::sendPing):
+
+2011-07-15  Luke Zarko  <lukezarko@gmail.com>
+
+       Bring V8's SerializedScriptValue implementation up to date.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63481
+
+        Reviewed by David Levin.
+        
+        The HTML5 Structured Clone algorithm (http://www.whatwg.org/specs/web-apps/current-work/multipage/urls.html#safe-passing-of-structured-data) has been updated since the V8 version of SerializedScriptValue was first implemented. This patch aims to bring this implementation up to date. It:
+        
+        - Introduces the new HTML5 DOM error codes for TIMEOUT_ERR, INVALID_NODE_TYPE_ERR, DATA_CLONE_ERR
+        - Handles cyclic structures and equality of reference preservation for cloned values
+        - Allows DataViews to be constructed on the native side using the existing wrapper techniques
+        - Amends tests and introduces new ones to check for correctness (the bulk of the patch)
+        - Tolerates the old version of the serialized object format
+        
+        The patch permits the cloning of JavaScript typed arrays. This functionality is in active use already and was supported (somewhat inefficiently) by the existing code through an artifact of implementation.
+
+        Tests: fast/dom/Window/window-postmessage-clone-deep-array.html
+               fast/dom/Window/window-postmessage-clone-really-deep-array.html
+               fast/dom/Window/window-postmessage-clone.html
+               fast/canvas/webgl/array-message-passing.html
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::V8ObjectMap::Writer::writeVersion):
+        (WebCore::V8ObjectMap::Writer::writeArrayBuffer):
+        (WebCore::V8ObjectMap::Writer::writeArrayBufferView):
+        (WebCore::V8ObjectMap::Writer::writeObjectReference):
+        (WebCore::V8ObjectMap::Writer::writeReferenceCount):
+        (WebCore::V8ObjectMap::Writer::writeGenerateFreshObject):
+        (WebCore::V8ObjectMap::Writer::writeGenerateFreshArray):
+        (WebCore::V8ObjectMap::Writer::doWriteArrayBuffer):
+        (WebCore::V8ObjectMap::Serializer::Serializer):
+        (WebCore::V8ObjectMap::Serializer::serialize):
+        (WebCore::V8ObjectMap::Serializer::StateBase::execDepth):
+        (WebCore::V8ObjectMap::Serializer::AbstractObjectState::AbstractObjectState):
+        (WebCore::V8ObjectMap::Serializer::AbstractObjectState::advance):
+        (WebCore::V8ObjectMap::Serializer::AbstractObjectState::execDepth):
+        (WebCore::V8ObjectMap::Serializer::execDepth):
+        (WebCore::V8ObjectMap::Serializer::push):
+        (WebCore::V8ObjectMap::Serializer::pop):
+        (WebCore::V8ObjectMap::Serializer::handleError):
+        (WebCore::V8ObjectMap::Serializer::writeAndGreyArrayBufferView):
+        (WebCore::V8ObjectMap::Serializer::writeArrayBuffer):
+        (WebCore::V8ObjectMap::Serializer::greyObject):
+        (WebCore::V8ObjectMap::Serializer::doSerialize):
+        (WebCore::V8ObjectMap::Reader::Reader):
+        (WebCore::V8ObjectMap::Reader::read):
+        (WebCore::V8ObjectMap::Reader::readVersion):
+        (WebCore::V8ObjectMap::Reader::setVersion):
+        (WebCore::V8ObjectMap::Reader::undoReadTag):
+        (WebCore::V8ObjectMap::Reader::readArrayBufferViewSubTag):
+        (WebCore::V8ObjectMap::Reader::doReadArrayBuffer):
+        (WebCore::V8ObjectMap::Reader::readArrayBuffer):
+        (WebCore::V8ObjectMap::Reader::readArrayBufferView):
+        (WebCore::V8ObjectMap::Deserializer::Deserializer):
+        (WebCore::V8ObjectMap::Deserializer::deserialize):
+        (WebCore::V8ObjectMap::Deserializer::newArray):
+        (WebCore::V8ObjectMap::Deserializer::consumeTopOfStack):
+        (WebCore::V8ObjectMap::Deserializer::completeArray):
+        (WebCore::V8ObjectMap::Deserializer::newObject):
+        (WebCore::V8ObjectMap::Deserializer::completeObject):
+        (WebCore::V8ObjectMap::Deserializer::completeSparseArray):
+        (WebCore::V8ObjectMap::Deserializer::pushObjectReference):
+        (WebCore::V8ObjectMap::Deserializer::tryGetObjectFromObjectReference):
+        (WebCore::V8ObjectMap::Deserializer::objectReferenceCount):
+        (WebCore::V8ObjectMap::Deserializer::openComposite):
+        (WebCore::V8ObjectMap::Deserializer::closeComposite):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::isHostObject):
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        (WebCore::V8DataView::constructorCallback):
+        * dom/DOMCoreException.idl:
+        * dom/ExceptionCode.cpp:
+        * dom/ExceptionCode.h:
+        * html/canvas/ArrayBuffer.cpp:
+        (WebCore::ArrayBuffer::create):
+        * html/canvas/ArrayBuffer.h:
+        * html/canvas/DataView.cpp:
+        (WebCore::DataView::create):
+        * html/canvas/DataView.h:
+
+2011-07-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Possible recursion in GraphicsLayerCA::updateGeometry()
+        https://bugs.webkit.org/show_bug.cgi?id=64815
+
+        Reviewed by Sam Weinig.
+        
+        It was possible to recurse via updateGeometry/swapFromOrToTiledLayer/
+        updateContentsScale because updateGeometry() and updateContentsScale()
+        used different sizes; updateGeometry() used the scaled size, while
+        updateContentsScale() used the unscaled size.
+        
+        Always use the unscaled size; the scaled size will be at most a couple
+        of pixels bigger, and our threshold is not close to the max texture
+        size limit, so using the slightly smaller size is OK.
+
+        Test: compositing/scaling/tiled-layer-recursion.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateGeometry):
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
+        (WebCore::GraphicsLayerCA::updateContentsScale):
+        (WebCore::GraphicsLayerCA::requiresTiledLayer):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+
+2011-07-19  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]Parse -webkit-region-overflow property
+        https://bugs.webkit.org/show_bug.cgi?id=64444
+
+        Reviewed by David Hyatt.
+
+        Test: fast/regions/webkit-region-overflow-parsing.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator RegionOverflow):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::regionOverflow):
+        (WebCore::InheritedFlags::setRegionOverflow):
+        (WebCore::InheritedFlags::initialRegionOverflow):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2011-07-19  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        hover then un-hover makes state change
+        https://bugs.webkit.org/show_bug.cgi?id=56401
+
+        When a 'before' pseudo-element is re-added, we should check whether the insertion point is an anonymous
+        block with inline children. If it is, then we should change the insertion point to the first child of the
+        anonymous block, otherwise the 'before' pseudo-element ends up in a different block.
+
+        Reviewed by David Hyatt.
+
+        Test: fast/dynamic/hover-before-position-after-style-change.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2011-07-19  Luke Macpherson   <macpherson@chromium.org>
+
+        Implement CSSPropertyWebkitPerspectiveOrigin in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=64784
+
+        Reviewed by Simon Fraser.
+
+        No new tests / refactoring.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2011-07-19  Chris Rogers  <crogers@google.com>
+
+        Implement WaveShaperNode for Web Audio API
+        https://bugs.webkit.org/show_bug.cgi?id=64644
+
+        Reviewed by Kenneth Russell.
+        
+        No new tests since audio API is not yet implemented.
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWaveShaperNodeCustom.cpp: Added.
+        (WebCore::JSWaveShaperNode::setCurve):
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::createWaveShaper):
+        * webaudio/AudioContext.h:
+        * webaudio/AudioContext.idl:
+        * webaudio/AudioNode.h:
+        * webaudio/WaveShaperDSPKernel.cpp: Added.
+        (WebCore::WaveShaperDSPKernel::process):
+        * webaudio/WaveShaperDSPKernel.h: Added.
+        (WebCore::WaveShaperDSPKernel::WaveShaperDSPKernel):
+        (WebCore::WaveShaperDSPKernel::reset):
+        (WebCore::WaveShaperDSPKernel::waveShaperProcessor):
+        * webaudio/WaveShaperNode.cpp: Added.
+        (WebCore::WaveShaperNode::WaveShaperNode):
+        (WebCore::WaveShaperNode::setCurve):
+        (WebCore::WaveShaperNode::curve):
+        * webaudio/WaveShaperNode.h: Added.
+        (WebCore::WaveShaperNode::create):
+        (WebCore::WaveShaperNode::waveShaperProcessor):
+        * webaudio/WaveShaperNode.idl: Added.
+        * webaudio/WaveShaperProcessor.cpp: Added.
+        (WebCore::WaveShaperProcessor::WaveShaperProcessor):
+        (WebCore::WaveShaperProcessor::~WaveShaperProcessor):
+        (WebCore::WaveShaperProcessor::createKernel):
+        (WebCore::WaveShaperProcessor::setCurve):
+        (WebCore::WaveShaperProcessor::process):
+        * webaudio/WaveShaperProcessor.h: Added.
+        (WebCore::WaveShaperProcessor::curve):
+
+2011-07-19  Robert Hogan  <robert@webkit.org>
+
+        REGRESSION: Incorrect layout at recline-online.com
+        https://bugs.webkit.org/show_bug.cgi?id=64030
+
+        Reviewed by David Hyatt.
+
+        http://trac.webkit.org/changeset/68362 dropped the check for cases
+        where the render box is floating or inline. When the box is left or right
+        aligned it is considered to be floating and needs to its margins set appropriately.
+
+        Test: fast/table/align-right-within-left-aligned-div.html
+              created by Dominic Cooney <dominicc@chromium.org>
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+
+2011-07-19  Abhishek Arya  <inferno@chromium.org>
+
+        Crash when removing unrenderered nodes in replacement fragment.
+        https://bugs.webkit.org/show_bug.cgi?id=64801
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::removeUnrenderedNodes):
+
+2011-07-19  Rob Buis  <rbuis@rim.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64673
+        REGRESSION (Safari 5.0.5 - ToT): crash in SVG test http://dev.w3.org/SVG/profiles/1.1F2/test/harness/htmlObjectApproved/styling-pres-02-f.html
+
+        Reviewed by Nikolas Zimmermann.
+
+        Prevent calling back to the owning SVGTRefElement upon handling DOMSubtreeModified events.
+
+        Test: svg/W3C-SVG-1.1-SE/styling-pres-02-f.svg
+
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SubtreeModificationEventListener::handleEvent):
+
+2011-07-19  Tony Chang  <tony@chromium.org>
+
+        use more specific types in CSSFlexValue
+        https://bugs.webkit.org/show_bug.cgi?id=64763
+
+        Reviewed by Ojan Vafai.
+
+        No new tests because no change in functionality.
+
+        * css/CSSFlexValue.h:
+        (WebCore::CSSFlexValue::create):
+        (WebCore::CSSFlexValue::isFlexValue): Make it possible to tell if
+            we're a flex value or not.  Will be needed when we're copying
+            values to RenderStyle.
+        (WebCore::CSSFlexValue::positiveFlex): Use floats for positive and
+            negative flex because in the render code, we use floats.
+        (WebCore::CSSFlexValue::negativeFlex): Add accessors for these since
+            we'll need it when reading the flex values.
+        (WebCore::CSSFlexValue::preferredSize):
+        (WebCore::CSSFlexValue::CSSFlexValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValidPrimitive): Make the type more
+            specific.
+        (WebCore::CSSParser::parseFlex):
+        * css/CSSParser.h:
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isFlexValue):
+
+2011-07-19  Chris Fleizach  <cfleizach@apple.com>
+
+        If the control associated with a <label> is hidden, the label is also hidden (incorrectly)
+        https://bugs.webkit.org/show_bug.cgi?id=64752
+
+        Reviewed by Darin Adler.
+
+        Test: platform/mac/accessibility/label-element-with-hidden-control.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+
+2011-07-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Backend should provide network resource identifiers that are unique across navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=64746
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/IdentifiersFactory.cpp:
+        (WebCore::IdentifiersFactory::createIdentifier):
+        (WebCore::IdentifiersFactory::resourceId):
+        (WebCore::IdentifiersFactory::addProcessIdPrefixTo):
+        * inspector/IdentifiersFactory.h:
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::didReceiveResponse):
+        (WebCore::InspectorConsoleAgent::didFailLoading):
+        * inspector/InspectorPageAgent.h:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::markResourceAsCached):
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::didReceiveData):
+        (WebCore::InspectorResourceAgent::didFinishLoading):
+        (WebCore::InspectorResourceAgent::didFailLoading):
+        (WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorResourceAgent::setInitialScriptContent):
+        (WebCore::InspectorResourceAgent::setInitialXHRContent):
+        (WebCore::InspectorResourceAgent::didReceiveXHRResponse):
+        (WebCore::InspectorResourceAgent::didCreateWebSocket):
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorResourceAgent::didCloseWebSocket):
+        (WebCore::InspectorResourceAgent::getResourceContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::willReceiveResourceData):
+        (WebCore::InspectorTimelineAgent::willReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
+        (WebCore::NetworkResourcesData::resourceCreated):
+        (WebCore::NetworkResourcesData::responseReceived):
+        (WebCore::NetworkResourcesData::setResourceType):
+        (WebCore::NetworkResourcesData::resourceType):
+        (WebCore::NetworkResourcesData::setResourceContent):
+        (WebCore::NetworkResourcesData::maybeAddResourceData):
+        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):
+        (WebCore::NetworkResourcesData::addCachedResource):
+        (WebCore::NetworkResourcesData::addResourceSharedBuffer):
+        (WebCore::NetworkResourcesData::data):
+        (WebCore::NetworkResourcesData::clear):
+        (WebCore::NetworkResourcesData::ensureNoDataForResourceId):
+        (WebCore::NetworkResourcesData::ensureFreeSpace):
+        * inspector/NetworkResourcesData.h:
+        (WebCore::NetworkResourcesData::ResourceData::resourceId):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestData):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseData):
+        (WebCore::TimelineRecordFactory::createResourceFinishData):
+        (WebCore::TimelineRecordFactory::createReceiveResourceData):
+        * inspector/TimelineRecordFactory.h:
+
+2011-07-19  Jessie Berlin  <jberlin@apple.com>
+
+        Fix assertion failure seen in plugins/return-npobject.html on Windows XP Debug bots.
+
+        Rubber-stamped by Adam Roben.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveData):
+        It is possible for a subclass to cancel the load from within didReceiveData, which would
+        set m_documentLoader to 0.
+        Remove the assertion I added that the DocumentLoader's frame is non-null.
+
+2011-07-19  Steve Block  <steveblock@google.com>
+
+        REGRESSION (r82194): jvalueToJavaValue() does not correctly set length of String property
+        https://bugs.webkit.org/show_bug.cgi?id=64730
+
+        Reviewed by Alexey Proskuryakov.
+
+        Covered by existing tests.
+
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::jvalueToJavaValue):
+
+2011-07-19  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        [V8] Don't put CSSRuleLists in object groups.
+        https://bugs.webkit.org/show_bug.cgi?id=64798
+
+        Reviewed by Pavel Feldman.
+
+        Retention of CSSRuleLists should be implemented using hidden
+        references from holder objects. By putting lists in groups we
+        artificially extend their lifetimes much more than necessary.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+
+2011-07-19  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [EFL] Add ewk_network.cpp|h files.
+        https://bugs.webkit.org/show_bug.cgi?id=63315
+
+        Enable setOnLine(bool) on EFL port as well as Android and Chromium.
+
+        Reviewed by Antonio Gomes.
+
+        * platform/network/NetworkStateNotifier.cpp:
+        * platform/network/NetworkStateNotifier.h:
+
+2011-07-19  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: implement import/export for timeline data.
+        https://bugs.webkit.org/show_bug.cgi?id=64601
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/timeline/timeline-load.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::FrontendMenuProvider::contextMenuItemSelected):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._createFileSelector):
+        (WebInspector.TimelinePanel.prototype._contextMenu):
+        (WebInspector.TimelinePanel.prototype._exportToFile):
+        (WebInspector.TimelinePanel.prototype._importFromFile):
+        (WebInspector.TimelinePanel.prototype._addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._clearPanel):
+        (WebInspector.TimelineModel):
+        (WebInspector.TimelineModel.prototype._addRecord):
+        (WebInspector.TimelineModel.prototype._importNextChunk):
+        (WebInspector.TimelineModel.prototype._importFromFile):
+        (WebInspector.TimelineModel.prototype._importFromFile.onError):
+        (WebInspector.TimelineModel.prototype._exportToFile):
+        (WebInspector.TimelineModel.prototype._reset):
+        * inspector/front-end/utilities.js:
+        ():
+
+2011-07-19  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Rename agentIdentifierPrefix to processId, move out from page agent and make static.
+        https://bugs.webkit.org/show_bug.cgi?id=64729
+
+        Reviewed by Pavel Feldman.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/IdentifiersFactory.cpp: Added.
+        (WebCore::IdentifiersFactory::createIdentifier):
+        * inspector/IdentifiersFactory.h: Added.
+        (WebCore::IdentifiersFactory::setProcessId):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setProcessId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::frameId):
+        (WebCore::InspectorPageAgent::loaderId):
+        * inspector/InspectorPageAgent.h:
+
 2011-07-19  Jeremy Moskovich  <jeremy@chromium.org>
 
         Fix microphone icon placement in speech input control for dir=rtl.