Merge 96554 - A little more WebSQLDatabase thread safety.

Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 96741)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,3 +1,7631 @@
+2011-10-03  Michael Nordman  <michaeln@google.com>
+
+        A little more WebSQLDatabase thread safety.
+        https://bugs.webkit.org/show_bug.cgi?id=69277
+
+        - switch to using AtomicallyInitializedStatic where appropiate
+        - avoid using some Strings across threads
+
+        Reviewed by David Levin.
+
+        Existing tests apply.
+
+        * storage/AbstractDatabase.cpp:
+        (WebCore::guidMutex):
+        (WebCore::guidToVersionMap):
+        (WebCore::guidToDatabaseMap):
+        (WebCore::guidForOriginAndName):
+        (WebCore::AbstractDatabase::databaseInfoTableName):
+        (WebCore::AbstractDatabase::AbstractDatabase):
+        (WebCore::AbstractDatabase::performOpenAndVerify):
+        (WebCore::AbstractDatabase::getVersionFromDatabase):
+        (WebCore::AbstractDatabase::setVersionInDatabase):
+        * storage/AbstractDatabase.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::tracker):
+        * storage/chromium/QuotaTracker.cpp:
+        (WebCore::QuotaTracker::instance):
+
+2011-10-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Replace m_firstNodeInserted and m_lastLeafInserted in ReplaceSelectionCommand by positions
+        https://bugs.webkit.org/show_bug.cgi?id=68874
+
+        Reviewed by Enrica Casucci.
+
+        Replaced m_firstNodeInserted and m_lastLeafInserted by m_startOfInsertedContent and m_endOfInsertedContent
+        respectively. Also removed removeNodePreservingChildren and removeNodeAndPruneAncestors in ReplaceSelectionCommand
+        because they were not virtual in CompositeEditCommand and implicitly overriding the functions was confusing.
+        Since each of these two functions is used at exactly one place, just update positions and insertedNodes explicitly.
+
+        * editing/CompositeEditCommand.cpp:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
+        (WebCore::ReplaceSelectionCommand::positionAtEndOfInsertedContent):
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Update m_endOfInsertedContent by endingSelection().visibleEnd()
+        instead of m_lastLeafInserted with destination.previous() because moveParagraph could have removed leading whitespace in
+        the text node referenced by destination. This is tested by an existing layout test.
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::addSpacesForSmartReplace): Update positions as needed. All changes are tested
+        by the existing layout tests in editing/pasteboard.
+        (WebCore::ReplaceSelectionCommand::updateNodesInserted):
+        * editing/ReplaceSelectionCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::hasARenderedDescendant): Moved from CompositeEditCommand.cpp.
+        (WebCore::highestNodeToRemoveInPruning): Ditto.
+        * editing/htmlediting.h:
+
+2011-10-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r94274): cloned text input loses value
+        https://bugs.webkit.org/show_bug.cgi?id=69095
+
+        Reviewed by Darin Adler.
+
+        The bug was caused by copyNonAttributeProperties not updating inner element text after copying
+        m_valueIfDirty. Fixed the bug by calling updateInnerTextValue.
+
+        Test: fast/forms/clone-input-with-dirty-value.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::copyNonAttributeProperties):
+
+2011-10-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Leopard build fix after r96530.
+
+        * rendering/svg/RenderSVGResourcePattern.cpp:
+        (WebCore::RenderSVGResourcePattern::applyResource):
+
+2011-10-03  Sam Weinig  <sam@webkit.org>
+
+        Move ContentSecurityPolicy to the ScriptExecutionContext to prepare it for working with XHR and workers
+        https://bugs.webkit.org/show_bug.cgi?id=69294
+
+        Reviewed by Darin Adler.
+
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        Initialize the ContentSecurityPolicy by calling down to the ScriptExecutionContext.
+
+        * dom/Document.h:
+        Move the ContentSecurityPolicy member and getter from here to ScriptExecutionContext.h.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::setContentSecurityPolicy):
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::contentSecurityPolicy):
+        Add ContentSecurityPolicy member and getter/setter.
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+        (WebCore::ContentSecurityPolicy::reportViolation):
+        (WebCore::ContentSecurityPolicy::parseReportURI):
+        (WebCore::ContentSecurityPolicy::createCSPDirective):
+        * page/ContentSecurityPolicy.h:
+        (WebCore::ContentSecurityPolicy::create):
+        Replace Document with ScriptExecutionContext. Add temporary checked casts to document
+        where necessary.
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        Add initialization of the ContentSecurityPolicy.
+
+2011-10-03  Anders Carlsson  <andersca@apple.com>
+
+        Remove custom scrollbar painting hooks
+        https://bugs.webkit.org/show_bug.cgi?id=69163
+
+        Reviewed by Alexey Proskuryakov.
+
+        The custom scrollbar and scroll corner painting hooks aren't used by anyone
+        so go ahead and remove them. This removes the setter/getter and ChromeClient functions.
+
+        * page/Chrome.cpp:
+        * page/ChromeClient.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::paintScrollCorner):
+
+2011-09-22  Darin Adler  <darin@apple.com>
+
+        Rename many obviously-correct call sites in WebCore using releaseRef to use it by its new name leakRef
+        https://bugs.webkit.org/show_bug.cgi?id=68672
+
+        Reviewed by Daniel Bates.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        * css/CSSInitialValue.h:
+        (WebCore::CSSInitialValue::createExplicit):
+        (WebCore::CSSInitialValue::createImplicit):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::init):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::parseUASheet):
+        (WebCore::CSSStyleSelector::styleForElement):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        * platform/haiku/RenderThemeHaiku.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::resolve):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::releaseConnectionForDownload):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeQt::paintSearchFieldCancelButton):
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+        * rendering/RenderThemeWinCE.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::defaultStyle):
+        Call leakRef instead of releaseRef. I did this only in the cases where
+        it was obvious to me this was the right way to do it. I'll keep revisiting
+        sites still calling it releaseRef until they are all gone.
+
+2011-09-27  Ojan Vafai  <ojan@chromium.org>
+
+        remove dead code in flipForWritingMode
+        https://bugs.webkit.org/show_bug.cgi?id=68948
+
+        Reviewed by Hajime Morita.
+
+        ChildToParentFlippingAdjustment is never used, so the third argument
+        to flipForWritingMode always has the same value.
+
+        In addition, renamed to flipForWritingModeForChild to be more clear
+        that it's operating on the child and renamed flipFloatForWritingMode to match.
+
+        No new tests. This is just a code cleanup. No functional changes. 
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintChildren):
+        (WebCore::RenderBlock::flipFloatForWritingModeForChild):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::hitTestFloats):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::flipForWritingModeForChild):
+        (WebCore::RenderBox::topLeftLocation):
+        * rendering/RenderBox.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintObject):
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::nodeAtPoint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paintCell):
+        (WebCore::RenderTableSection::nodeAtPoint):
+
+2011-10-03  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed, rolling out r96526.
+        http://trac.webkit.org/changeset/96526
+        https://bugs.webkit.org/show_bug.cgi?id=68587
+
+        WEB_AUDIO has numerous 64->32 bit casting warnings, causing
+        build breakages where -Wall is enabled.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2011-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Web Inspector: rgb() with percentages shows wrong hex/hsl values
+        https://bugs.webkit.org/show_bug.cgi?id=69152
+
+        Reviewed by Pavel Feldman.
+
+        Previously we assumed rgb values were always in byte form,
+        but they could include percentage values. Ex. rgb(100%,0,0).
+        This patch fixes this, and in the process includes clamping
+        for invalid percentages, byte values, and alpha values.
+
+        Test: inspector/styles/styles-invalid-color-values.html
+
+        * inspector/front-end/Color.js:
+        (WebInspector.Color.prototype._clamp):
+        (WebInspector.Color.prototype._individualRGBValueToFloatValue):
+        (WebInspector.Color.prototype._individualRGBValueToHexValue):
+        (WebInspector.Color.prototype._rgbToHex):
+        (WebInspector.Color.prototype._rgbToHSL):
+        An individual rgb value can be either a decimal/float or a
+        percentage. Rewrite the conversion functions to handle either
+        input. Regardless of the type of input, always return a clamped
+        decimal/float value between 0 and 255.
+
+        (WebInspector.Color.prototype._rgbaToHSLA):
+        (WebInspector.Color.prototype._hslaToRGBA):
+        (WebInspector.Color.prototype._parse):
+        Clamp the alpha value between 0 and 1.
+
+2011-10-03  Dirk Schulze  <krit@webkit.org>
+
+        SVG Pattern tile pixelated on patternTransform
+        https://bugs.webkit.org/show_bug.cgi?id=69261
+
+        Reviewed by Rob Buis.
+
+        Scale the SVG pattern tile by the scale level of patternTransform to avoid pixelation.
+
+        Test: svg/custom/pattern-scaled-pattern-space.svg
+
+        * rendering/svg/RenderSVGResourcePattern.cpp:
+        (WebCore::RenderSVGResourcePattern::applyResource):
+
+2011-10-03  Jer Noble  <jer.noble@apple.com>
+
+        Enable WEB_AUDIO by default in the WebKit/mac port.
+        https://bugs.webkit.org/show_bug.cgi?id=68587
+
+        Reviewed by Simon Fraser.
+
+        No new tests; existing webaudio/ layout tests cover this.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.xcodeproj/project.pbxproj: Add a build step which copies audio resources to
+            the WebCore.framework bundle.
+
+2011-10-03  Chris Rogers  <crogers@google.com>
+
+        BiquadFilterNode .type attribute is not handled correctly
+        https://bugs.webkit.org/show_bug.cgi?id=69182
+
+        Reviewed by Kenneth Russell.
+
+        Test: webaudio/biquadfilternode-basic.html
+
+        * platform/audio/AudioDSPKernelProcessor.cpp:
+        (WebCore::AudioDSPKernelProcessor::initialize):
+        * webaudio/AudioBufferSourceNode.cpp:
+        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
+        * webaudio/AudioChannelMerger.cpp:
+        (WebCore::AudioChannelMerger::AudioChannelMerger):
+        * webaudio/AudioChannelSplitter.cpp:
+        (WebCore::AudioChannelSplitter::AudioChannelSplitter):
+        * webaudio/AudioDestinationNode.cpp:
+        (WebCore::AudioDestinationNode::AudioDestinationNode):
+        * webaudio/AudioGainNode.cpp:
+        (WebCore::AudioGainNode::AudioGainNode):
+        * webaudio/AudioNode.cpp:
+        (WebCore::AudioNode::AudioNode):
+        (WebCore::AudioNode::~AudioNode):
+        (WebCore::AudioNode::setNodeType):
+        (WebCore::AudioNode::ref):
+        (WebCore::AudioNode::finishDeref):
+        * webaudio/AudioNode.h:
+        (WebCore::AudioNode::nodeType):
+        * webaudio/AudioPannerNode.cpp:
+        (WebCore::AudioPannerNode::AudioPannerNode):
+        (WebCore::AudioPannerNode::notifyAudioSourcesConnectedToNode):
+        * webaudio/BiquadFilterNode.cpp:
+        (WebCore::BiquadFilterNode::BiquadFilterNode):
+        (WebCore::BiquadFilterNode::setType):
+        * webaudio/BiquadFilterNode.h:
+        * webaudio/BiquadFilterNode.idl:
+        * webaudio/BiquadProcessor.h:
+        (WebCore::BiquadProcessor::setType):
+        * webaudio/ConvolverNode.cpp:
+        (WebCore::ConvolverNode::ConvolverNode):
+        * webaudio/DelayNode.cpp:
+        (WebCore::DelayNode::DelayNode):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        * webaudio/HighPass2FilterNode.cpp:
+        (WebCore::HighPass2FilterNode::HighPass2FilterNode):
+        * webaudio/JavaScriptAudioNode.cpp:
+        (WebCore::JavaScriptAudioNode::JavaScriptAudioNode):
+        * webaudio/LowPass2FilterNode.cpp:
+        (WebCore::LowPass2FilterNode::LowPass2FilterNode):
+        * webaudio/MediaElementAudioSourceNode.cpp:
+        (WebCore::MediaElementAudioSourceNode::MediaElementAudioSourceNode):
+        * webaudio/RealtimeAnalyserNode.cpp:
+        (WebCore::RealtimeAnalyserNode::RealtimeAnalyserNode):
+        * webaudio/WaveShaperNode.cpp:
+        (WebCore::WaveShaperNode::WaveShaperNode):
+
+2011-10-03  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: support role mapping for HTML5 section elements
+        https://bugs.webkit.org/show_bug.cgi?id=69150
+
+        We need to map these HTML5 elements to appropriate ARIA roles. That mapping is:
+          article -> Document article
+          nav -> Landmark navigation
+          aside -> Landmark complementary
+          section -> Document region
+          address -> Landmark content info
+          header -> Landmark banner (unless it's in an article or section)
+          footer -> Landmark content info (unless it's in an article or section)
+
+        Reviewed by Darin Adler.
+
+        Test: platform/mac/accessibility/html-section-elements.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isDescendantOfElementType):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/AccessibilityRenderObject.h:
+
+2011-10-03  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: click point for AXHeadings often returns point on empty space (results in wrong context menu)
+        https://bugs.webkit.org/show_bug.cgi?id=69262
+
+        When the contextual menu is opened for a heading, often it will open on empty space because
+        the heading is wider than the content inside. The click point should thus use the content
+        inside the heading as the click point.
+
+        To accomplish this we need to query whether we have children using children() which is a non-const
+        method, hence the removal of const from clickPoint().
+
+        Reviewed by John Sullivan.
+
+        Test: platform/mac/accessibility/heading-clickpoint.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::clickPoint):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::clickPoint):
+        * accessibility/AccessibilityRenderObject.h:
+
+2011-10-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96500.
+        http://trac.webkit.org/changeset/96500
+        https://bugs.webkit.org/show_bug.cgi?id=69268
+
+        Breaks inspector, change landed with no test. (Requested by
+        pfeldman on #webkit).
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._linkifyLocation):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._consoleCleared):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.linkifyLocation.updateAnchor):
+        (WebInspector.DebuggerPresentationModel.prototype.linkifyLocation):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        ():
+        * inspector/front-end/Linkifier.js: Removed.
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView):
+        (WebInspector.NetworkLogView.prototype._reset):
+        (WebInspector.NetworkDataGridNode.prototype._refreshInitiatorCell):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.createCell):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._resetClicked):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._clearPanel):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyLocation):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyCallFrame):
+        (WebInspector.TimelinePanel.PopupContentHelper):
+        (WebInspector.TimelinePanel.PopupContentHelper.prototype._appendLinkRow):
+        (WebInspector.TimelinePanel.PopupContentHelper.prototype._appendStackTrace):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2011-09-30  Antti Koivisto  <antti@apple.com>
+
+        Add exact match attribute selectors to the fast path
+        https://bugs.webkit.org/show_bug.cgi?id=69159
+
+        Reviewed by Sam Weinig.
+
+        Attribute selectors are increasingly common and we have them in our default style sheet too.
+        [foo] and [foo="bar"] type selectors can be resolved quickly and easily in the fast path.
+        
+        - Implement fast path checking for simple attribute selectors.
+        - Get rid of the ill-defined CSSSelector::hasAttribute(), inline CSSSelector::attribute()
+        
+        This is ~20% progression in styleForElement() performance loading the full HTML5 spec (~0.8s).
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::selectorText):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::hasTag):
+        (WebCore::CSSSelector::attribute):
+        (WebCore::CSSSelector::isAttributeSelector):
+        * css/CSSSelectorList.cpp:
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::checkSelector):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::fastCheckRightmostSelector):
+        (WebCore::SelectorChecker::fastCheckSelector):
+        (WebCore::isFastCheckableMatch):
+        (WebCore::isFastCheckableRightmostSelector):
+        (WebCore::SelectorChecker::isFastCheckableSelector):
+        (WebCore::SelectorChecker::checkSelector):
+        (WebCore::htmlAttributeHasCaseInsensitiveValue):
+        (WebCore::anyAttributeMatches):
+        (WebCore::SelectorChecker::checkOneSelector):
+        * css/SelectorChecker.h:
+        (WebCore::SelectorChecker::attributeNameMatches):
+        (WebCore::SelectorChecker::checkExactAttribute):
+        (WebCore::SelectorChecker::fastCheckRightmostAttributeSelector):
+
+2011-10-03  Mike Reed  <reed@google.com>
+
+        respect other paint flags when setting flags for the font. No need to fiddle with DC(0) in paintSkiaText.
+        https://bugs.webkit.org/show_bug.cgi?id=69172
+
+        Reviewed by Stephen White.
+
+        No new tests. This is a cleanup/optimization, existing tests apply
+
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::getDefaultGDITextFlags):
+        (WebCore::setupPaintForFont):
+        (WebCore::paintSkiaText):
+
+2011-10-03  Andreas Kling  <kling@webkit.org>
+
+        FontFallbackList: Glyph pages waste a lot of memory.
+        https://bugs.webkit.org/show_bug.cgi?id=69260
+
+        Reviewed by Dan Bernstein.
+
+        Use a minimum hash table size of 16 (down from 64) for FontFallbackList's
+        glyph pages. This reduces memory consumption by ~900 kB when loading the
+        full HTML5 spec.
+
+        The cost is two additional rehash()es of FontFallbackList::m_pages when
+        adding the 32nd and 64th pages to the hash map.
+
+        * platform/graphics/FontFallbackList.h:
+
+2011-10-03  Konstantin Scheglov  <scheglov@google.com>
+
+        Right border missing from table with colspan and collapsing border
+        https://bugs.webkit.org/show_bug.cgi?id=14274
+
+        Reviewed by David Hyatt.
+
+        Test: fast/table/border-collapsing/bug14274.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::RenderTable):
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::colToEffCol):
+
+2011-10-03  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Fix make distcheck build
+        https://bugs.webkit.org/show_bug.cgi?id=69243
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+
+2011-10-03  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Build fix: Qt::escape is deprecated in Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=69162
+
+        Use QString::toHtmlEscaped in the Qt5 case.
+
+        Reviewed by Andreas Kling.
+
+        No new tests needed.
+
+        * WebCore.pro: adjust the include path accordingly
+        in the v8 case.
+
+2011-10-03  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: debuggerPresentatioModel.linkifyLocation leaks updateAnchor closure instances.
+        https://bugs.webkit.org/show_bug.cgi?id=69146
+
+        In many places we use linkifyLocation function to produce a link node which updates automatically when the source file is changed on the fly.
+        Such changes happen when we use pretty print or another operation that changes the source code somehow.
+        linkifyLocation associates a new instance of updateAnchor closure with the each link node and add the closure to the SourceMappingUpdated event's list.
+        As the result the node<->closure pairs wouldn't be collected until reset the UI and DebuggerPresentationModel.
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/performance/resources/network-append-30-requests.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessage.prototype._linkifyLocation):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._consoleCleared):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        ():
+        * inspector/front-end/Linkifier.js: Added.
+        (WebInspector.Linkifier):
+        (WebInspector.Linkifier.prototype.linkifyLocation):
+        (WebInspector.Linkifier.prototype.reset):
+        (WebInspector.Linkifier.prototype._updateSourceAnchors):
+        (WebInspector.Linkifier.prototype._updateAnchor):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView):
+        (WebInspector.NetworkLogView.prototype._reset):
+        (WebInspector.NetworkDataGridNode.prototype._refreshInitiatorCell):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.createCell):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._resetClicked):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._linkifyLocation):
+        (WebInspector.TimelinePanel.prototype._linkifyCallFrame):
+        (WebInspector.TimelinePanel.prototype._clearPanel):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.PopupContentHelper):
+        (WebInspector.TimelinePanel.PopupContentHelper.prototype._appendLinkRow):
+        (WebInspector.TimelinePanel.PopupContentHelper.prototype._appendStackTrace):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2011-10-03  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: more compilation fixes including making ConsoleMessage a part of console model.
+        https://bugs.webkit.org/show_bug.cgi?id=69253
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/Inspector.json:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessage.create):
+        (WebInspector.ConsoleMessage.createTextMessage):
+        (WebInspector.ConsoleMessageImpl):
+        * inspector/front-end/ConsoleModel.js:
+        (WebInspector.ConsoleModel.prototype._messageRepeatCountUpdated):
+        (WebInspector.ConsoleMessage.create):
+        (WebInspector.ConsoleMessage.createTextMessage):
+        (WebInspector.ConsoleDispatcher.prototype.messageAdded):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult):
+        (WebInspector.ConsoleCommandResult.prototype.toMessageElement):
+        * inspector/front-end/CookieParser.js:
+        (WebInspector.Cookie.prototype.get path):
+        (WebInspector.Cookie.prototype.get domain):
+        (WebInspector.Cookie.prototype.expires):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onAddConsoleMessage):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithResponse):
+        (WebInspector.NetworkDispatcher.prototype.requestWillBeSent):
+        (WebInspector.NetworkDispatcher.prototype.requestServedFromMemoryCache):
+        (WebInspector.NetworkDispatcher.prototype.webSocketCreated):
+        (WebInspector.NetworkDispatcher.prototype._createResource):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.setContent):
+        (WebInspector.Resource.prototype.searchInContent):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype._createResource):
+        * inspector/front-end/externs.js:
+        (WebInspector.linkifyStringAsFragmentWithCustomLinkifier):
+        (WebInspector.extensionServer.notifyResourceContentCommitted):
+        (WebInspector.resourceForURL):
+        (WebInspector.debuggerPresentationModel.linkifyLocation):
+        (WebInspector.ObjectPropertiesSection):
+        (WebInspector.ElementsTreeOutline):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+        * inspector/generate-protocol-externs:
+
+2011-10-03  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move console message formatting from ConsoleView.js into ConsoleMessage.js
+        https://bugs.webkit.org/show_bug.cgi?id=69244
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype._formatMessage.else.else.linkifier):
+        (WebInspector.ConsoleMessage.prototype._formatMessage):
+        (WebInspector.ConsoleMessage.prototype._format):
+        (WebInspector.ConsoleMessage.prototype._formatParameter):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsValue):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsObject):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsNode):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsArray):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsString):
+        (WebInspector.ConsoleMessage.prototype._printArray):
+        (WebInspector.ConsoleMessage.prototype._formatAsArrayEntry):
+        (WebInspector.ConsoleMessage.prototype._formatWithSubstitutionString):
+        * inspector/front-end/ConsoleView.js:
+
+2011-10-03  Dirk Schulze  <krit@webkit.org>
+
+        feColorMatrix saturation is not limited to range 0..1 anymore
+        https://bugs.webkit.org/show_bug.cgi?id=69245
+
+        Reviewed by Nikolas Zimmermann.
+        
+        Opera doesn't limit the range of values for saturation on feColorMatrix from 0 to 1. The limitation
+        was also removed from the new Filter Effects 1.0 specification. Values outside this range lead to
+        under- or oversaturation of the filter input image.
+        https://dvcs.w3.org/hg/FXTF/raw-file/tip/filters/publish/Filters.html#feColorMatrixElement
+
+        Test: svg/filters/feColorMatrix-saturate.svg
+
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::build):
+
+2011-10-03  Andreas Kling  <kling@webkit.org>
+
+        Shrink HTMLLIElement.
+        https://bugs.webkit.org/show_bug.cgi?id=69250
+
+        Reviewed by Antti Koivisto.
+
+        Don't cache the explicit "value" attribute on the HTMLLIElement,
+        but fetch it with fastGetAttribute when needed.
+        This shrinks HTMLLIElement by one CPU word.
+
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::HTMLLIElement):
+        (WebCore::HTMLLIElement::parseMappedAttribute):
+        (WebCore::HTMLLIElement::attach):
+        * html/HTMLLIElement.h:
+
+2011-10-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Add support for backend search in script content.
+        https://bugs.webkit.org/show_bug.cgi?id=69015
+
+        Reviewed by Pavel Feldman.
+
+        Tests: http/tests/inspector/search/search-in-concatenated-script.html
+               http/tests/inspector/search/search-in-script.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::searchInContent):
+        (WebCore::InspectorDebuggerAgent::getScriptSource):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/front-end/ContentProviders.js:
+        (WebInspector.ScriptContentProvider.prototype.requestContent):
+        (WebInspector.ScriptContentProvider.prototype.searchInContent):
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype.searchInContent.maybeCallback):
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype.searchInContent.searchCallback):
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype.searchInContent):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.requestSource):
+        (WebInspector.Script.prototype.searchInContent):
+
+2011-10-03  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move console message formatting from ConsoleView.js into ConsoleMessage.js
+        https://bugs.webkit.org/show_bug.cgi?id=69244
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype._formatMessage.else.else.linkifier):
+        (WebInspector.ConsoleMessage.prototype._formatMessage):
+        (WebInspector.ConsoleMessage.prototype._format):
+        (WebInspector.ConsoleMessage.prototype._formatParameter):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsValue):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsObject):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsNode):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsArray):
+        (WebInspector.ConsoleMessage.prototype._formatParameterAsString):
+        (WebInspector.ConsoleMessage.prototype._printArray):
+        (WebInspector.ConsoleMessage.prototype._formatAsArrayEntry):
+        (WebInspector.ConsoleMessage.prototype._formatWithSubstitutionString):
+        * inspector/front-end/ConsoleView.js:
+
+2011-10-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: restore partial front-end compilability
+        https://bugs.webkit.org/show_bug.cgi?id=69221
+
+        Removed unused isWhitespace; introduced missing classes in Inspector.json;
+        generated externs for the protocol types along with the commands.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/Inspector.json:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype._dispatchWhenDocumentAvailable.onDocumentAvailable):
+        (WebInspector.DOMAgent.prototype._dispatchWhenDocumentAvailable):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/front-end/ElementsTreeOutline.js:
+        ():
+        * inspector/front-end/Object.js:
+        * inspector/front-end/Popover.js:
+        (WebInspector.PopoverHelper.prototype._mouseMove):
+        * inspector/front-end/View.js:
+        * inspector/front-end/externs.js:
+        (Array.prototype.remove):
+        * inspector/generate-protocol-externs:
+
+2011-10-02  Kent Tamura  <tkent@chromium.org>
+
+        method/enctype/formMethod/formEnctype properties should be limited to known values.
+        https://bugs.webkit.org/show_bug.cgi?id=68887
+
+        Reviewed by Hajime Morita.
+
+        According to the standard and other browser behaviors, the
+        following IDL properties should be reflected to the corresponding
+        HTML attributes on setting, but should return normalized values on
+        getting.
+        - HTMLFormElement::method
+        - HTMLFormElement::enctype
+        - HTMLInputElement::formMethod
+        - HTMLInputElement::formEnctype
+        - HTMLButtonElement::formMethod
+        - HTMLButtonElement::formEnctype
+
+        Tests: fast/forms/enctype-attribute.html
+               fast/forms/method-attribute.html
+
+        * html/HTMLButtonElement.idl:
+        Replace 'Reflect' with 'ConvertNullToNullString' in order to use a
+        getter function.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formEnctype):
+        Normalizes the value by parseEncodingType().
+        (WebCore::HTMLFormControlElement::setFormEnctype):
+        Simply calls setAttribute()
+        (WebCore::HTMLFormControlElement::formMethod):
+        Normalizes the value by parseMethodType().
+        (WebCore::HTMLFormControlElement::setFormMethod):
+        Simply calls setAttribute()
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        Follow the Attributes function renaming.
+        (WebCore::HTMLFormElement::method):
+        Normalizes the value by parseMethodType().
+        * html/HTMLFormElement.idl:
+        Replace 'Reflect' with 'ConvertNullToNullString' in order to use a
+        getter function.
+        * html/HTMLInputElement.idl: ditto.
+        * loader/FormSubmission.cpp:
+        (WebCore::FormSubmission::Attributes::parseEncodingType):
+        New function made from a part of old parseEncodingType().
+        (WebCore::FormSubmission::Attributes::updateEncodingType):
+        Renamed from parseEncodingType().
+        (WebCore::FormSubmission::Attributes::parseMethodType):
+        New function made from a part of old parseMethodType().
+        (WebCore::FormSubmission::Attributes::updateMethodType):
+        Renamed from parseMethodType().
+        (WebCore::FormSubmission::create):
+        Follow the Attributes function renaming.
+        * loader/FormSubmission.h:
+        (WebCore::FormSubmission::Attributes::methodString):
+        A helper function to provide normalized strings for FormSubmission::Method.
+
+2011-10-02  Sam Weinig  <sam@webkit.org>
+
+        Strength reduce Mac only Frame::searchForLabelsBeforeElement and Frame::matchLabelsAgainstElement into callers
+        https://bugs.webkit.org/show_bug.cgi?id=69230
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.exp.in:
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+
+2011-10-02  Zeno Albisser  <zeno.albisser@nokia.com>
+
+        [Qt][WK2][Mac] WebKit2 does not build on mac after merge of Qt5 refactor branch.
+        https://bugs.webkit.org/show_bug.cgi?id=69223
+
+        Add a missing import (NSWindow.h) in WebVideoFullscreenHUDWindowController.
+        Add a missing include path and a missing objective source file to WebCore.pro.
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests, build fix.
+
+        * WebCore.pro:
+        * platform/mac/WebVideoFullscreenHUDWindowController.h:
+
+2011-10-02  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Remove an unused member in RenderTable::ColumnStruct
+        https://bugs.webkit.org/show_bug.cgi?id=69119
+
+        Reviewed by Darin Adler.
+
+        No test as there should be no change in behavior.
+
+        The member was added several years ago and its users were removed or changed. The code would
+        need a refactoring but this would be tricky to get right. This change just removes the member
+        to reap the short-term benefits.
+
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::ColumnStruct::ColumnStruct): Remove anything associated with m_width.
+
+2011-10-02  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r95502): Assertion failure in CSSPrimitiveValue::computeLengthDouble() when media query specifies unit-less length
+        https://bugs.webkit.org/show_bug.cgi?id=68760
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/media/invalid-lengths.html
+
+        Made length-comparison media queries accept only length values. In compatibility mode, numbers
+        are allowed as well, and they are interpreted as pixels.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::computeLength): Added this helper function.
+        (WebCore::device_heightMediaFeatureEval): Changed to use computeLength().
+        (WebCore::device_widthMediaFeatureEval): Ditto.
+        (WebCore::heightMediaFeatureEval): Ditto.
+        (WebCore::widthMediaFeatureEval): Ditto.
+
+2011-10-02  Dirk Schulze  <krit@webkit.org>
+
+        SVG Mask should take 'color-interpolation' into account to determine the color space of the mask image
+        https://bugs.webkit.org/show_bug.cgi?id=69076
+
+        Reviewed by Simon Fraser.
+        
+        SVG Masks should take 'color-interpolation' into account to determine the color space of the mask image.
+        The behavior was changed in SVG 1.1 SE. The color space of the mask image gets defined by the computed value of the
+        'color-interpolation' property. This will switch the default color space from linearRGB to sRGB for mask images and
+        is a performance improvement for platforms without native support for linearRGB color space. The
+        color space transformation can be avoided.
+
+        Test: svg/custom/grayscale-gradient-mask-2.svg
+
+        * rendering/svg/RenderSVGResourceMasker.cpp:
+        (WebCore::RenderSVGResourceMasker::applyResource):
+        (WebCore::RenderSVGResourceMasker::drawContentIntoMaskImage):
+        * rendering/svg/RenderSVGResourceMasker.h:
+
+2011-10-01  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        [chromium] Fixing draw matrix for composited layers. This
+        was a regression introduced by:
+        http://trac.webkit.org/changeset/96454
+
+        https://bugs.webkit.org/show_bug.cgi?id=69217
+
+        Reviewed by James Robinson.
+
+        Tests: compositor test now pass
+
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::CCTiledLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+
+2011-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed redundant helper functions for allocating Strong handles
+        https://bugs.webkit.org/show_bug.cgi?id=69218
+
+        Reviewed by Sam Weinig.
+
+        * ForwardingHeaders/heap/StrongInlines.h: Added.
+        * bindings/js/JSCallbackData.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCachedFrameData.cpp:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptState.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/js/WorkerScriptController.cpp:
+        * bridge/runtime_root.cpp:
+
+2011-10-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96421.
+        http://trac.webkit.org/changeset/96421
+        https://bugs.webkit.org/show_bug.cgi?id=69206
+
+        It broke Qt-WK2 build (Requested by ossy on #webkit).
+
+        * WebCore.pro:
+
+2011-09-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Track separate scroll deltas on the compositor thread
+        https://bugs.webkit.org/show_bug.cgi?id=69034
+
+        Reviewed by James Robinson.
+
+        Test: new tests in CCLayerTreeHostImplTest/CCLayerTreeHostTest
+
+        Track scroll deltas and maximum scrolls on LayerChromium/CCLayerImpl.
+        The CCLayerImpl tree is now able to adjust these scroll deltas
+        independent of the main thread. To push them back to the main thread,
+        CCLayerTreeHostImpl collects them all and then bakes them into the
+        scroll position during a begin frame and commit call. This allows new
+        deltas to be collected while the scroll position containing the old
+        delta and the old scroll position will be overwritten during the next
+        commit.
+
+        Only the main frame is supported right now for pushing this scroll
+        delta back into the authoritative WebKit source to keep both sides in
+        sync.
+
+        Move tilingTransform() to the impl tree because drawTransform() is now
+        updated using scroll deltas and so the results from calculating draw
+        transforms needs to be dynamic so that children are updated properly.
+
+        Also, exposed DebugScopedSetImplThread public because it's used in a
+        few places.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::maxScrollPosition):
+        (WebCore::LayerChromium::setMaxScrollPosition):
+        (WebCore::LayerChromium::scrollDelta):
+        (WebCore::LayerChromium::scrollable):
+        * platform/graphics/chromium/NonCompositedContentHost.cpp:
+        (WebCore::NonCompositedContentHost::setViewport):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::scrollBy):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::maxScrollPosition):
+        (WebCore::CCLayerImpl::setMaxScrollPosition):
+        (WebCore::CCLayerImpl::scrollDelta):
+        (WebCore::CCLayerImpl::setScrollDelta):
+        (WebCore::CCLayerImpl::scrollable):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::applyScrollDeltas):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::scrollRootLayer):
+        (WebCore::CCLayerTreeHostImpl::processScrollDeltas):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * platform/graphics/chromium/cc/CCProxy.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::start):
+        (WebCore::CCSingleThreadProxy::context):
+        (WebCore::CCSingleThreadProxy::finishAllRendering):
+        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
+        (WebCore::CCSingleThreadProxy::setNeedsCommit):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::recreateContextIfNeeded):
+        (WebCore::CCSingleThreadProxy::commitIfNeeded):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (WebCore::DebugScopedSetImplThread::DebugScopedSetImplThread):
+        (WebCore::DebugScopedSetImplThread::~DebugScopedSetImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::createBeginFrameAndCommitTaskOnCCThread):
+        (WebCore::CCThreadProxy::beginFrameAndCommit):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::CCTiledLayerImpl::tilingTransform):
+        (WebCore::CCTiledLayerImpl::draw):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+
+2011-09-30  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=69202
+        
+        [CSS3 Regions] Make positioned objects use the first region as the ICB when it
+        is their containing block. Make sure static distance computations take into
+        account the current region as well.
+
+        Reviewed by Sam Weinig.
+
+        Added new tests in fast/regions.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::startOffsetForContent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
+        (WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
+        (WebCore::computeInlineStaticDistance):
+        (WebCore::computeLogicalLeftPositionedOffset):
+        (WebCore::computeLogicalTopPositionedOffset):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::contentLogicalWidthOfFirstRegion):
+        (WebCore::RenderFlowThread::contentLogicalHeightOfFirstRegion):
+        (WebCore::RenderFlowThread::contentLogicalLeftOfFirstRegion):
+        * rendering/RenderFlowThread.h:
+
+2011-09-30  David Barr  <davidbarr@chromium.org>
+
+        Implement currentColor support for CSS gradients
+        https://bugs.webkit.org/show_bug.cgi?id=58730
+
+        Reviewed by Adam Barth.
+
+        Allow currentColor as a CSS3 gradient color-stop.
+
+        Test: fast/css/linear-gradient-currentcolor.html
+
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::isCacheable): Make currentColor uncacheable since the
+        background image may be invalidated if currentColor is used as a gradient stop and
+        the value of the 'color' property changes.
+        * css/CSSParser.cpp:
+        (WebCore::parseGradientColorOrKeyword): Accept the currentColor keyword.
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::image): Initialize document styleSelector so that
+        currentColor may be computed for a StyleGeneratedImage.
+
+2011-09-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove toStrictThisObject, toThisString, toThisJSString
+        https://bugs.webkit.org/show_bug.cgi?id=69203
+
+        Rubber stamped by Sam Weinig
+
+        These are no longer used.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+
+2011-09-30  Adam Barth  <abarth@webkit.org>
+
+        Remove ASSERT introduced in http://trac.webkit.org/changeset/96427
+        which is triggering all over the place.
+
+        Sorting this out is covered in this bug:
+        https://bugs.webkit.org/show_bug.cgi?id=69200
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+
+2011-09-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96426.
+        http://trac.webkit.org/changeset/96426
+        https://bugs.webkit.org/show_bug.cgi?id=69199
+
+        Broke a zillion image results on Chromium Skia Mac (Requested
+        by abarth|gardener on #webkit).
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::getFocusRingOutset):
+        (WebCore::GraphicsContext::drawFocusRing):
+
+2011-09-30  Ilya Sherman  <isherman@chromium.org>
+
+        Fix assertion failure in XSS Auditor
+        https://bugs.webkit.org/show_bug.cgi?id=69050
+        https://code.google.com/p/chromium/issues/detail?id=97346
+
+        Reviewed by Daniel Bates.
+
+        Test: fast/forms/xss-auditor-doesnt-crash.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::init): Don't try to decode the HTML body if it is empty.
+
+2011-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Loading page on potterybankids causes reproducible assertion failure in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=69185
+        <rdar://problem/10218241>
+
+        Reviewed by Simon Fraser.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeRepaintRects): Remove assert condition that isn't guaranteed
+        to be true.
+
+2011-09-30  Johnny Ding  <jnd@chromium.org>
+
+        Support -webkit-tap-highlight-color when enabling touch events support.
+        https://bugs.webkit.org/show_bug.cgi?id=48544
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Original code from the iOS WebCore code dump, extracted and modified by tijiang@rim and jnd@chromium.
+        Supports the new CSS property -webkit-tap-highlight-color on platforms which support touch events.
+        Platform can override WebCore::RenderTheme::platformTapHighlightColor to use its own platform
+        specific default tap highlight color. Otherwise RenderTheme::defaultTapHighlightColor will be
+        used as default tap highlight color.
+
+        Test: fast/events/touch/tap-highlight-color.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::tapHighlightColor):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::platformTapHighlightColor):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::initialTapHighlightColor):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::tapHighlightColor):
+        (WebCore::InheritedFlags::setTapHighlightColor):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+2011-09-30  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=69173
+        
+        RTL/LTR mixtures still not correct in regions. Simplify the loop once I realized it's only
+        your directionality that matters and not your containing block's.
+
+        Reviewed by Dan Bernstein.
+
+        Added new test in fast/regions.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::borderBoxRectInRegion):
+
+2011-09-30  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10208291> first-letter in generated before content with display: table is not updated
+
+        Reviewed by Sam Weinig.
+
+        Test: fast/css-generated-content/first-letter-in-nested-before.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent): Preserve the style type of anonymous
+        containers around the generated content when updating their style. This preserves the first-letter-ness
+        of the inline wrapping the first letter, which allows updateFirstLetter() to identify it later.
+
+2011-09-30  Cary Clark  <caryclark@google.com>
+
+        Inset focus ring (Skia on Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=69166
+        http://code.google.com/p/chromium/issues/detail?id=97956
+
+        This focus ring was drawn too large and was left tracks
+        in subsequent invalidations. Make it more closely match
+        the CG version.
+
+        Reviewed by Stephen White.
+
+        No new tests. This platform is not enabled.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::getFocusRingOutset):
+        (WebCore::GraphicsContext::drawFocusRing):
+
+2011-09-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96422.
+        http://trac.webkit.org/changeset/96422
+        https://bugs.webkit.org/show_bug.cgi?id=69170
+
+        Broke Windows build and kling wanted to roll it out as well
+        (Requested by rniwa on #webkit).
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::prevOnLineExists):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+
+2011-09-30  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=69167
+        
+        [CSS3 Regions] Fix some bugs in the computation of the logical left and width offsets
+        for blocks in variable width regions. Specifically, this patch addresses a minor bug
+        with overflow:hidden/scroll/auto block placement and with RTL directionality.
+
+        Reviewed by Sam Weinig.
+
+        Added five new tests in fast/regions.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        Avoid a double fetch of the border box in a given region by not calling
+        logicalLeftOffsetForContent. No correctness change here. It's just cleaner.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::borderBoxRectInRegion):
+        Change the shifted optimization to be cached for "self" rather than for "containing block".
+        Rework the adjustment loop to handle changes in directionality and to fix correctness
+        issues with RTL.
+
+        (WebCore::RenderBox::containingBlockLogicalWidthForContentInRegion):
+        Don't double adjust if an object uses line width as the containing block width. In that
+        case we already computed the line width in the region, so we don't need to apply any
+        additional fixup.
+
+        (WebCore::RenderBox::renderBoxRegionInfo):
+        * rendering/RenderBoxRegionInfo.h:
+        (WebCore::RenderBoxRegionInfo::RenderBoxRegionInfo):
+        (WebCore::RenderBoxRegionInfo::isShifted):
+        Changed the shifted code to be on self rather than on containing block.
+
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::layout):
+        Refactor the layout code for RenderFlowThread to properly set up region rects assuming
+        right alignment in RTL code. This change forces us to compute our maximum logical width
+        first before looping through the regions again to set their content rects.
+
+2011-09-30  Andreas Kling  <kling@webkit.org>
+
+        REGRESSION(r82611) InlineBox has 33 bits of bitset, causing alignment issues and extra memory use.
+        https://bugs.webkit.org/show_bug.cgi?id=64914
+
+        Reviewed by Antti Koivisto.
+
+        Remove InlineBox::prevOnLineExists() and its two accompanying bitfields
+        since nobody is using them anymore. nextOnLineExists() is still used by
+        GTK+ accessibility code.
+
+        Also added a compile-time assertion to guard against future bloating of
+        the InlineBox class.
+
+        * rendering/InlineBox.cpp:
+        (WebCore::SameSizeAsInlineBox::~SameSizeAsInlineBox):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+
+2011-09-30  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Build fix: Qt::escape is deprecated in Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=69162
+
+        Use QString::toHtmlEscaped in the Qt5 case.
+
+        Reviewed by Andreas Kling.
+
+        No new tests needed.
+
+        * WebCore.pro: adjust the include path accordingly
+        in the v8 case.
+
+2011-09-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove unused ReplaceSelectionCommand::copyStyleToChildren
+        https://bugs.webkit.org/show_bug.cgi?id=69153
+
+        Reviewed by Antonio Gomes.
+
+        Removed the function because it's no called anywhere.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        * editing/ReplaceSelectionCommand.h:
+
+2011-09-30  Aaron Colwell  <acolwell@chromium.org>
+
+        Fix EnabledAtRuntime support for constants.
+        https://bugs.webkit.org/show_bug.cgi?id=67311
+
+        Reviewed by Adam Barth.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementation):
+
+2011-09-29  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=69043
+        
+        [CSS3 Regions] Blocks split across regions with variable width need to size
+        differently in each region.
+        
+        This patch adds the capability for blocks to have variable width and positioning
+        when split across regions. It is very rudimentary and so far only operates on basic
+        normal flow RenderBlocks. Future patches will expand the support to cover other layout
+        constructs like flexible boxes and tables.
+
+        Reviewed by Sam Weinig.
+
+        Added new tests in fast/regions and updated existing results.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::HitTestResult):
+        (WebCore::HitTestResult::operator=):
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestResult::region):
+        (WebCore::HitTestResult::setRegion):
+        The hit test result now holds the active RenderRegion so that hit testing can adjust
+        block widths and positions when hit testing their border boxes.
+
+        * rendering/PaintInfo.h:
+        (WebCore::PaintInfo::PaintInfo):
+        The paint info struct now holds the active RenderRegion so that painting can adjust
+        block widths and positions when painting borders and backgrounds and shadows.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        If our width ever changes, we invalidate all of our cached RenderBoxRegionInfo in all
+        regions that we span.
+
+        (WebCore::RenderBlock::clearRenderBoxRegionInfo):
+        Called to clear out our cached region-specific information in all regions that we span.
+
+        (WebCore::RenderBlock::borderBoxRectInRegionAtPosition):
+        Returns the borderBoxRect for the region at the specified vertical offset. This rect
+        can be both shifted horizontally and have a different width from our original border rect.
+
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        Modified to call borderBoxRectInRegionAtPosition so that lines will fit inside
+        the content rect of the border box rect for the specific region.
+
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        Modified to call logicalLeftOffsetForContent since it's cleaner.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::borderBoxRectInRegion):
+        Called to compute the border box rect in a specific region. The result is cached in a HashMap
+        in the region itself so that subsequent lookups are fast.
+
+        (WebCore::RenderBox::nodeAtPoint):
+        Modified to use the border box rect in the active region when hit testing the backgrounds of boxes.
+
+        (WebCore::RenderBox::paintBoxDecorations):
+        Modified to use the border box rect in the active region when painting the backgrounds of boxes.
+
+        (WebCore::RenderBox::containingBlockLogicalWidthForContent):
+        (WebCore::RenderBox::containingBlockLogicalWidthForContentInRegion):
+        (WebCore::RenderBox::computeLogicalWidth):
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        Helpers for computing logical widths and margins in a specific region. The result is then cached
+        in a HashMap in the region.
+
+        (WebCore::RenderBox::renderBoxRegionInfo):
+        The function for obtaining the region-specific information for a given box.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderBoxRectInRegion):
+        New function for returning the border box rect in a given region.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        Make sure mask painting honors the active region.
+
+        * rendering/RenderBoxRegionInfo.h: Added.
+        (WebCore::RenderBoxRegionInfo::RenderBoxRegionInfo):
+        (WebCore::RenderBoxRegionInfo::logicalLeft):
+        (WebCore::RenderBoxRegionInfo::logicalWidth):
+        (WebCore::RenderBoxRegionInfo::containingBlockChainIsShifted):
+        New class held by RenderRegions that caches box-specific info for a given region. This will eventually
+        expand to include custom styles as well, but for now it is limited to a new logical left and a new
+        logical width, along with a bit for optimizing accumulated shifting when painting/hit testing to avoid
+        too much groveling up the containing block chain.
+
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::RenderFlowThread):
+        Removed the region fitting optimization, since eventually everyone is going to care, and there's no reason
+        to limit it with the results now being cached.
+
+        (WebCore::RenderFlowThread::layout):
+        All box-specific region information is always cleared whenever the regions are invalidated.
+
+        (WebCore::RenderFlowThread::computeLogicalWidth):
+        Modified to set up RenderBoxRegionInfo for the flow thread in all regions.
+        
+        (WebCore::RenderFlowThread::paintIntoRegion):
+        (WebCore::RenderFlowThread::hitTestRegion):
+        Modified to take the region instead of the region's rectangle so that painting and hit testing of the flow
+        thread layer tree can properly receive the active region.
+
+        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo):
+        Helper for removing a box's information from all regions. For now it grovels through every region, so eventually
+        we may want to have a cache of the start/end regions for a given box somewhere.
+
+        * rendering/RenderFlowThread.h:
+        Removal of the region fitting stuff.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintOverlayScrollbars):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::paintList):
+        (WebCore::RenderLayer::paintPaginatedChildLayer):
+        (WebCore::RenderLayer::paintChildLayerIntoColumns):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Modified to pass the current region down through painting functions so that it is known at paint time.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        Added a new bit to RenderObjects, inRenderFlowThread(), so that it is quick to determine whether or not an
+        object needs flow thread special casing.
+
+        (WebCore::RenderObject::enclosingRenderFlowThread):
+        Modified enclosingRenderFlowThread to be able to quickly return 0 if the object is not in a flow thread.
+
+        (WebCore::RenderObject::containerForRepaint):
+        Same.
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setParent):
+        setParent now updates inRenderFlowThread() state.
+
+        (WebCore::RenderObject::inRenderFlowThread):
+        (WebCore::RenderObject::setInRenderFlowThread):
+        Adding the new bit.
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode):
+        Make sure when an object is removed from a RenderFlowThread that it deletes its box-specific information
+        in all regions.
+
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::~RenderRegion):
+        (WebCore::RenderRegion::paintReplaced):
+        (WebCore::RenderRegion::nodeAtPoint):
+        (WebCore::RenderRegion::renderBoxRegionInfo):
+        (WebCore::RenderRegion::setRenderBoxRegionInfo):
+        (WebCore::RenderRegion::removeRenderBoxRegionInfo):
+        (WebCore::RenderRegion::deleteAllRenderBoxRegionInfo):
+        (WebCore::RenderRegion::matchesRenderFlowThreadLogicalWidth):
+        * rendering/RenderRegion.h:
+        Added the new HashMap for holding box-specific region information. Also added an additional optimization to
+        check if a specific region matches the overall width of the RenderFlowThread. If it does, we don't need to 
+        cache box-specific information for that region.
+
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/svg/SVGImageBufferTools.cpp:
+        (WebCore::SVGImageBufferTools::renderSubtreeToImageBuffer):
+        Modified the PaintInfo construction to include the region argument. It's not optional so that callers will
+        have to consider it (since masks illustrated this is necessary).
+
+2011-09-30  Tim Horton  <timothy_horton@apple.com>
+
+        feBlend uses a table of function pointers which reduces inlineability inside the main loop
+        https://bugs.webkit.org/show_bug.cgi?id=69154
+        <rdar://problem/10215221>
+
+        Reviewed by Darin Adler.
+
+        Don't use a table of function pointers inside the feBlend inner loop, instead
+        use switch and inline functions, bringing a 20% performance gain across the
+        board to feBlend.
+
+        No new tests, minor performance improvement.
+
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::normal):
+        (WebCore::multiply):
+        (WebCore::screen):
+        (WebCore::darken):
+        (WebCore::lighten):
+        (WebCore::FEBlend::apply):
+
+2011-09-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add getCallData to MethodTable in ClassInfo
+        https://bugs.webkit.org/show_bug.cgi?id=69024
+
+        Reviewed by Sam Weinig.
+
+        No new tests.
+
+        * WebCore.exp.in:
+
+        Changed getCallData from private to protected to allow subclasses who 
+        don't override getCallData themselves to reference it in their own 
+        method tables when calling the CREATE_METHOD_TABLE macro.
+        * bridge/runtime_method.h:
+
+2011-09-30  Ned Holbrook  <nholbrook@apple.com>
+
+        Complex spaces with synthetic bold are too wide
+        https://bugs.webkit.org/show_bug.cgi?id=69033
+
+        Reviewed by Dan Bernstein.
+
+        Test: fast/text/complex-synthetic-bold-space-width.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Subtract synthetic bold offset from spaceWidth.
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::shapeAndPlaceItem): Ditto.
+
+2011-09-30  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: [chromium] expose inspector protocol version to the embedder.
+        https://bugs.webkit.org/show_bug.cgi?id=69092
+
+        This change also introduces major/minor inspector version components.
+
+        Reviewed by Yury Semikhatsky.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * inspector/Inspector-0.1.json: Renamed from Source/WebCore/inspector/Inspector.draft-01.json.
+        * inspector/Inspector.json:
+        * inspector/generate-inspector-protocol-version: Renamed from Source/WebCore/inspector/validate-protocol-compatibility.
+
+2011-09-29  Antti Koivisto  <antti@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=69106
+        Universal attribute selectors disable style sharing
+
+        Reviewed by Dave Hyatt.
+
+        Selectors of type [foo="bar"] ended up marking every element style with the affectedByAttributeSelectors bit
+        rendering style sharing inoperative. This happens on http://www.whatwg.org/specs/web-apps/current-work/ for example.
+
+        Instead we now mark style with affectedByUncommonAttributeSelectors bit only if an attribute selector actually 
+        matches the element. Before sharing, we also check the current element against collected attribute rules.
+        We can share the style if neither element was affected.
+        
+        This speeds up style matching and applying ~15% on full HTML5 spec (=~0.7s). Sharing percentage goes from 0% to ~30%.
+        Increased sharing should also save a substantial amount of memory.
+
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::isAttributeSelector):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleData::containsUncommonAttributeSelector):
+        (WebCore::collectSpecialRulesInDefaultStyle):
+        (WebCore::assertNoSiblingRulesInDefaultStyle):
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::matchRules):
+        (WebCore::CSSStyleSelector::matchesRuleSet):
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::locateSharedStyle):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::selectorListContainsUncommonAttributeSelector):
+        (WebCore::isCommonAttributeSelectorAttribute):
+        (WebCore::containsUncommonAttributeSelector):
+        (WebCore::RuleData::RuleData):
+        (WebCore::collectFeaturesFromSelector):
+        (WebCore::collectFeaturesFromList):
+        * css/CSSStyleSelector.h:
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::affectedByUncommonAttributeSelectors):
+        (WebCore::InheritedFlags::setAffectedByUncommonAttributeSelectors):
+
+2011-09-30  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Add WebKit API for sending input events to the compositor thread
+        https://bugs.webkit.org/show_bug.cgi?id=69117
+
+        Reviewed by Darin Fisher.
+
+        Convert to using an externally-provided thread instead of one managed by CCThreadProxy internally. Most changes
+        in these files are mechanically changing references from ccThread to s_ccThread to reflect the class-static
+        nature of this pointer, the rest are removing the old thread creation codepath.
+
+        These changes are covered by the CC* unit tests and by the gpu layout tests when run with the
+        use_threaded_compositing=1 gyp define.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::setThread):
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::~CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::finishAllRendering):
+        (WebCore::CCThreadProxy::initializeLayerRenderer):
+        (WebCore::CCThreadProxy::setNeedsCommit):
+        (WebCore::CCThreadProxy::setNeedsCommitAndRedraw):
+        (WebCore::CCThreadProxy::setNeedsRedraw):
+        (WebCore::CCThreadProxy::start):
+        (WebCore::CCThreadProxy::stop):
+        (WebCore::CCThreadProxy::beginFrameAndCommit):
+        (WebCore::CCThreadProxy::scheduleDrawTaskOnCCThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2011-09-29  Fady Samuel  <fsamuel@chromium.org>
+
+        Fixed Hit testing on Framesets when Frameset is transformed
+        https://bugs.webkit.org/show_bug.cgi?id=67740
+
+        Reviewed by Simon Fraser.
+
+        Tests: fast/frames/frame-set-rotation-hit.html
+               fast/frames/frame-set-scaling-hit.html
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::userResize):
+
+2011-09-29  Dirk Pranke  <dpranke@chromium.org>
+
+        fix gyp warnings in chromium for renamed files
+        https://bugs.webkit.org/show_bug.cgi?id=69116
+
+        Reviewed by Adam Barth.
+
+        * WebCore.gypi:
+
+2011-09-29  Martin Robinson  <mrobinson@igalia.com>
+
+        [Freetype] Some text in Planet GNOME renders in the wrong place
+        https://bugs.webkit.org/show_bug.cgi?id=69099
+
+        Reviewed by Dirk Schulze.
+
+        Test: platform/gtk/fonts/synthetic-oblique-positioning.html
+
+        Fold the oblique transform into the font matrix itself rather than transforming
+        the CTM of the context at render time. Not only does this fix the issue, it
+        prevents unnecessary work on every paint.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        No longer set the synthetic oblique transformation matrix on the context
+        when rendering the text. Instead it is now folded into the TM of the font
+        itself.
+        * platform/graphics/freetype/FontPlatformDataFreeType.cpp:
+        (WebCore::FontPlatformData::initializeWithFontFace): Fold the oblique transform into the scaled font.
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Ditto.
+
+2011-09-29  Dan Bernstein  <mitz@apple.com>
+
+        Follow-up fix for <rdar://problem/10191243> Glyph variants (line final swashes) appear where they should not
+
+        Reviewed by Simon Fraser.
+
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::ctFont): Check for Hoefler Text Black Italic as well.
+
+2011-09-29  Cary Clark  <caryclark@google.com>
+
+        Enable LCD text in Skia on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=68734
+
+        Reviewed by Stephen White.
+
+        No new tests. Existing layout tests are generated
+        with LCD text disabled for pixel comparisons.
+
+        Duplicate the logic in FontMac.mm to pass settings
+        for antialiasing and smoothing. Also disable smoothing
+        for DumpRenderTree.
+ 
+        * platform/graphics/skia/FontSkia.cpp:
+        (WebCore::setupPaint):
+        (WebCore::Font::drawGlyphs):
+
+2011-09-29  Varun Jain  <varunjain@google.com>
+ 
+         Implement flick gesture in Chromium Gesture Recognizer
+         https://bugs.webkit.org/show_bug.cgi?id=67930
+ 
+         Reviewed by Dimitri Glazkov.
+ 
+         Test: Source/WebKit/chromium/tests/InnerGestureRecognizerTest.cpp 
+ 
+         * platform/chromium/GestureRecognizerChromium.cpp:
+         (WebCore::GestureRecognizerChromium::isOverMinFlickSpeed):
+         (WebCore::GestureRecognizerChromium::appendScrollGestureEnd):
+         (WebCore::GestureRecognizerChromium::updateValues):
+         (WebCore::GestureRecognizerChromium::scrollEnd):
+         * platform/chromium/GestureRecognizerChromium.h:
+
+2011-09-29  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] canvas.toDataURL("image/jpeg"): use libjpeg-turbo data swizzle
+        https://bugs.webkit.org/show_bug.cgi?id=67402
+
+        Reviewed by Kenneth Russell.
+
+        libjpeg-turbo can read directly from the input data for the premultiplied BRGX
+        (SkBitmap) encoding case.
+
+        No change in behavior, covered by existing canvas 2d/3d tests
+        canvas/philip/tests/toDataURL.jpeg.alpha.html
+        fast/canvas/webgl/premultiplyalpha-test.html
+
+        * platform/image-encoders/skia/JPEGImageEncoder.cpp:
+        (WebCore::encodePixels): If JCS_EXTENSIONS is defined (libjpeg-turbo), swizzle
+        the input BRGX pixels directly within libjpeg-turbo.
+
+2011-09-29  Adam Barth  <abarth@webkit.org>
+
+        Fixenate the build.
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::namedItemAdded):
+
+2011-09-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove direct reads to m_firstNodeInserted and m_lastLeafInserted in ReplaceSelectionCommand
+        https://bugs.webkit.org/show_bug.cgi?id=69023
+
+        Reviewed by Enrica Casucci.
+
+        Converted to removeUnrenderedTextNodesAtEnds to use InsertedNodes instead of m_firstNodeInserted
+        and m_lastLeafInserted. Extracted the logic to update nodes as InsertedNodes::willRemoveNode
+        (old one was renamed to InsertedNodes::willRemoveNodePreservingChildren).
+
+        Also extracted shouldPerformSmartReplace and addSpacesForSmartReplace out of doApply,
+        and rewrote the logic to obtain endNode and startNode using startOfInsertedContent and
+        endOfInsertedContent instead of m_firstNodeInserted and m_lastLeafInserted.
+
+        Finally, replaced the nullity checks of m_firstNodeInserted and m_lastLeafInserted in
+        completeHTMLReplacement by nullity checks of start and end positions.
+
+        * dom/Node.cpp:
+        (WebCore::Node::traversePreviousSibling): Added.
+        * dom/Node.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::InsertedNodes::willRemoveNodePreservingChildren): Renamed from
+        willRemoveNode.
+        (WebCore::ReplaceSelectionCommand::InsertedNodes::willRemoveNode): Extracted from
+        removeUnrenderedTextNodesAtEnds.
+        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline):
+        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
+        (WebCore::ReplaceSelectionCommand::positionAtEndOfInsertedContent): Made const.
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent): Made const.
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Takes firstNodeInserted instead of directly
+        accessing m_firstNodeInserted.
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::shouldPerformSmartReplace):
+        (WebCore::ReplaceSelectionCommand::addSpacesForSmartReplace):
+        (WebCore::ReplaceSelectionCommand::completeHTMLReplacement):
+        * editing/ReplaceSelectionCommand.h:
+
+2011-09-29  Andreas Kling  <kling@webkit.org>
+
+        Shrink HTMLAnchorElement on 32-bit.
+        https://bugs.webkit.org/show_bug.cgi?id=69094
+
+        Reviewed by Antti Koivisto.
+
+        * html/HTMLAnchorElement.h: Pack members into a bitfield.
+
+2011-09-29  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10191243> Glyph variants (line final swashes) appear where they should not
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/text/line-initial-and-final-swashes.html
+
+        Hoefler Text Italic enables line-initial and -final swashes by default, so disable them. This
+        change targets only this known-bad font rather than all fonts, because at least one font (Khmer MN)
+        incorrectly claims to have the line-initial feature enabled, but disabling it actually does
+        something different and bad (breaking some combining marks).
+
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::createFeatureSettingDictionary): Added this helper function.
+        (WebCore::cascadeToLastResortFontDescriptor): Deployed WTF_ARRAY_LENGTH().
+        (WebCore::cascadeToLastResortAndDisableSwashesFontDescriptor): Added. Returns a font descriptor
+        that, in addition to having a cascade list consisting of the last resort font, also has feature
+        settings to disable line-initial and line-final swashes.
+        (WebCore::FontPlatformData::ctFont): For Hoefler Text Italic, use cascadeToLastResortAndDisableSwashesFontDescriptor().
+
+2011-09-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unreviewed: resetting baseline for code generator bindings
+
+        Unreviewed build fix
+
+        No new tests.
+
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        * bindings/scripts/test/JS/JSTestObj.h:
+
+2011-09-29  Nate Chapin  <japhet@chromium.org>
+
+        [V8, chromium] More logging to determine cause of a null
+        v8::Context in V8DOMWindowShell::namedItemAdded().
+
+        https://bugs.webkit.org/show_bug.cgi?id=68099
+
+        Reviewed by Adam Barth.
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::namedItemAdded):
+
+2011-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=69040
+        ScrollbarThemeComposite requires a ScrollView to draw scroll corner
+
+        Reviewed by Simon Fraser.
+
+        No new tests. This will be needed later.
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::pageForScrollView):
+        (WebCore::ScrollbarThemeComposite::paintScrollCorner):
+        Use pageForScrollView() function which already existed in this file, used in another similar
+        location.
+
+        * platform/chromium/FramelessScrollView.cpp:
+        * platform/chromium/FramelessScrollView.h:
+        * platform/gtk/ScrollbarThemeGtk.cpp:
+        * platform/gtk/ScrollbarThemeGtk.h:
+        * platform/wx/ScrollbarThemeWx.cpp:
+        * platform/wx/ScrollbarThemeWx.h:
+        All these overrides are no longer needed, ScrollbarThemeComposite will do the right thing.
+
+        * platform/qt/ScrollbarThemeQt.cpp: (WebCore::ScrollbarThemeQt::paintScrollCorner):
+        Removed a special case for updatingControlTints phase. The same case is present in cross-platform
+        code now, and Qt doesn't have any custom subclasses of ScrollableArea or ScrollView to need
+        special handling.
+        This was added in r37377 without a bug or much ChangeLog explanation.
+
+2011-09-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::visitChildrenVirtual and remove all other visitChildrenVirtual methods
+        https://bugs.webkit.org/show_bug.cgi?id=68839
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        Removed the remaining visitChildrenVirtual methods.  This patch completes the process of 
+        de-virtualizing visitChildren.
+
+        * WebCore.exp.in:
+        * bindings/js/JSAttrCustom.cpp:
+        * bindings/js/JSAudioContextCustom.cpp:
+        * bindings/js/JSCSSRuleCustom.cpp:
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::finishCreation):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSJavaScriptAudioNodeCustom.cpp:
+        * bindings/js/JSMessageChannelCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        * bindings/js/JSNodeCustom.cpp:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        * bindings/js/JSStyleSheetCustom.cpp:
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        * bindings/js/JSXPathResultCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bridge/qt/qt_instance.cpp:
+        * bridge/qt/qt_runtime.cpp:
+        * bridge/qt/qt_runtime.h:
+
+2011-09-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix build against Qt5 after refactor of widgets out of QtGUi
+
+        QWidget and friends now live in the QtWidgets library. We update
+        includes in implementation files and private headers to us the
+        non-module-prefixed path, and leave the lookup for the include
+        path. For public headers we have to ifdef the includes as the
+        user might now have the modules we need in his QT config.
+
+        Finally, QSGCanvas is no longer a QWidget but a QWindow, so we
+        have to update our code and use windowHandle() for setting the
+        parent relationships.
+
+        https://bugs.webkit.org/show_bug.cgi?id=68687
+
+        Reviewed by Andreas Kling.
+
+        * WebCore.pri:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+
+2011-09-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96340.
+        http://trac.webkit.org/changeset/96340
+        https://bugs.webkit.org/show_bug.cgi?id=69098
+
+        Caused 10 tests to crash in Debug (Requested by
+        abarth|gardener on #webkit).
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        (WebCore::AXObjectCache::~AXObjectCache):
+        (WebCore::AXObjectCache::remove):
+        (WebCore::AXObjectCache::childrenChanged):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityMenuList.cpp:
+        (WebCore::AccessibilityMenuList::childrenChanged):
+        * accessibility/AccessibilityMenuList.h:
+        * accessibility/AccessibilityMenuListPopup.cpp:
+        (WebCore::AccessibilityMenuListPopup::childrenChanged):
+        * accessibility/AccessibilityMenuListPopup.h:
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::childrenChanged):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::startOfContinuations):
+        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        * accessibility/AccessibilityRenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willBeDestroyed):
+
+2011-09-29  Andreas Kling  <kling@webkit.org>
+
+        Shrink FontFallbackList.
+        https://bugs.webkit.org/show_bug.cgi?id=69093
+
+        Reviewed by Antti Koivisto.
+
+        Reduce the size of FontFallbackList by one CPU word, decreasing memory
+        consumption by 300 kB (on 64-bit) when loading the full HTML5 spec.
+
+        * platform/graphics/FontCache.h:
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::generation):
+
+            Store the FontCache generation as an ushort rather than uint.
+
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        * platform/graphics/FontFallbackList.h:
+
+            Pack enum and bool members in a bitfield.
+
+2011-09-29  Adam Barth  <abarth@webkit.org>
+
+        We should ignore the return value of GetRealNamedProperty
+        https://bugs.webkit.org/show_bug.cgi?id=68840
+
+        Reviewed by Nate Chapin.
+
+        Instead of skipping the lookup process by using the result of real
+        named property, we should just indiciate that it wasn't handled by the
+        interceptor.
+
+        Test: http/tests/security/window-named-valueOf.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+
+2011-09-29  Chris Fleizach  <cfleizach@apple.com>
+
+        ARIA live regions don't trigger notifications for elements that aren't in the AX tree
+        https://bugs.webkit.org/show_bug.cgi?id=62289
+
+        If an ARIA Live region udpates an element that is not in the AX object cache, then the Live region
+        notification is not sent. To fix this, the childrenChanged() method needs to actually create
+        the appropriate objects, but since that method gets called during a render tree update, we've learned 
+        that it's generally not safe to create objects.
+
+        Instead a one shot timer can be fired that will update and create the necessary objects so that the
+        correct notification can be sent.
+
+        Reviewed by Darin Adler.
+
+        Test: platform/mac/accessibility/aria-liveregion-without-element-access.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        (WebCore::AXObjectCache::~AXObjectCache):
+        (WebCore::AXObjectCache::remove):
+        (WebCore::AXObjectCache::childrenUpdateTimerFired):
+        (WebCore::AXObjectCache::childrenChanged):
+        * accessibility/AXObjectCache.h:
+        * accessibility/AccessibilityMenuList.cpp:
+        (WebCore::AccessibilityMenuList::childrenChanged):
+        * accessibility/AccessibilityMenuList.h:
+        * accessibility/AccessibilityMenuListPopup.cpp:
+        (WebCore::AccessibilityMenuListPopup::childrenChanged):
+        * accessibility/AccessibilityMenuListPopup.h:
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::childrenChanged):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::startOfContinuations):
+        (WebCore::AccessibilityRenderObject::updateAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        * accessibility/AccessibilityRenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willBeDestroyed):
+
+2011-09-29  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Dragging a selection does not produce a drag image
+        https://bugs.webkit.org/show_bug.cgi?id=69064
+
+        Reviewed by Andreas Kling.
+
+        Moved Chromium's generic implementation of Frame::nodeImage and
+        Frame::dragImageForSeletion to Frame.cpp and simply excluded via
+        #ifdefs platforms that do not have their own implementation. Removed
+        all empty implementations of these functions and Qt's which was
+        functionally identical.
+
+        No new tests. Drag-and-drop drag image functionality changes
+        are incredibly difficult to test in a non-manual way.
+
+        * CMakeListsEfl.txt: Delist FrameEfl.cpp.
+        * GNUmakefile.list.am: Delist FrameGtk.cpp.
+        * WebCore.gypi: Delist removed Frame*.cpp.
+        * WebCore.pro: Delist FrameQt.cpp.
+        * page/Frame.cpp: Moved FrameChromium implementation here.
+        (WebCore::ScopedFramePaintingState::ScopedFramePaintingState):
+        (WebCore::ScopedFramePaintingState::~ScopedFramePaintingState):
+        (WebCore::Frame::nodeImage):
+        (WebCore::Frame::dragImageForSelection):
+        * page/chromium/FrameChromium.cpp: Removed.
+        * page/efl/FrameEfl.cpp: Removed.
+        * page/gtk/FrameGtk.cpp: Removed.
+        * page/qt/FrameQt.cpp: Removed.
+        * page/wx/FrameWx.cpp: Removed.
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::createDragImage): Call nodeImage to get
+        the drag image for a node.
+
+2011-09-29  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium skia] PNGImageEncoder: hoist constants out of the encoding loop
+        https://bugs.webkit.org/show_bug.cgi?id=68988
+
+        Reviewed by Kenneth Russell.
+
+        No new tests.  Covered by existing canvas 2d and 3d tests.
+        canvas/philip/tests/toDataURL.png.*.html
+        fast/canvas/toDataURL-alpha.html
+        fast/canvas/webgl/premultiplyalpha-test.html
+
+        * platform/image-encoders/skia/PNGImageEncoder.cpp:
+        (WebCore::encodePixels):  Move constant out of the encoding loop.
+        (WebCore::PNGImageEncoder::encode):  Consistency & style: call encodePixels()
+        just like we do in the JPEG encoder.
+
+2011-09-29  Iain Merrick  <husky@google.com>
+
+        Add unit test for CCLayerSorter
+        https://bugs.webkit.org/show_bug.cgi?id=68622
+
+        Minor refactoring for testability:
+        - Made pointInTriangle public.
+        - Added LayerShape to decouple LayerIntersector and GraphNode.
+        - Added a public wrapper function for LayerIntersector.
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
+        (WebCore::CCLayerSorter::pointInTriangle):
+        (WebCore::CCLayerSorter::calculateZDiff):
+        (WebCore::CCLayerSorter::LayerIntersector::LayerIntersector):
+        (WebCore::CCLayerSorter::LayerIntersector::go):
+        (WebCore::CCLayerSorter::LayerIntersector::checkZDiff):
+        (WebCore::CCLayerSorter::LayerIntersector::layerZFromProjectedPoint):
+        (WebCore::CCLayerSorter::checkOverlap):
+        (WebCore::CCLayerSorter::LayerShape::LayerShape):
+        (WebCore::CCLayerSorter::createGraphNodes):
+        * platform/graphics/chromium/cc/CCLayerSorter.h:
+        (WebCore::CCLayerSorter::LayerShape::LayerShape):
+        (WebCore::CCLayerSorter::GraphNode::GraphNode):
+
+2011-09-29  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: UI performance test for network panel is incorrect. The time is including a timeout between scheduled refresh and actual refresh.
+        https://bugs.webkit.org/show_bug.cgi?id=69087
+
+        The fix has the changes for the test and minor perf framework improvements.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._defaultRefreshDelay.500._scheduleRefresh):
+
+2011-09-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Make search-in-resource test simpler.
+        https://bugs.webkit.org/show_bug.cgi?id=69025
+
+        Changed search-in-resource test.
+        Removed error parameter from content provider's searchInContent callback.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::searchInResource):
+        (WebCore::InspectorPageAgent::searchInResources):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.searchInContent):
+
+2011-09-29  Hans Wennborg  <hans@chromium.org>
+
+        IndexedDB: Use LevelDB also for in-memory databases
+        https://bugs.webkit.org/show_bug.cgi?id=68903
+
+        Reviewed by Steve Block.
+
+        Add LevelDBDatabase::openInMemory() which uses leveldb::NewMemEnv()
+        to create in-memory LevelDB databases.
+
+        Use this in IDBLeveLDBBackingStore::open() when the caller passes in
+        an empty file path.
+        This happens in Chromium's incognito mode, and when running layout
+        tests.
+
+        Fix IDBSQLiteBackingStore::backingStoreExists() so it doesn't create
+        files when passed in an empty file path, but uses the in-memory mode
+        instead.
+
+        Existing layout tests will all be run in-memory.
+
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore::LevelDBDatabase::~LevelDBDatabase):
+        (WebCore::openDB):
+        (WebCore::LevelDBDatabase::open):
+        (WebCore::LevelDBDatabase::openInMemory):
+        * platform/leveldb/LevelDBDatabase.h:
+        * storage/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::open):
+        * storage/IDBSQLiteBackingStore.cpp:
+        (WebCore::IDBSQLiteBackingStore::backingStoreExists):
+
+2011-09-29  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: speed-up Network panel. Change _staleResources type from array to object.
+        https://bugs.webkit.org/show_bug.cgi?id=69081
+
+        There is a test with 30 requests.
+        For the each stage of loading a resource we have an entry in _staleResources array. There are at least 4 stages per request.
+        NetworkLogView._refresh function is creating/updating the resource row for the each such entry.
+        This array can be replaced with a hash map just because the resource associated with the entry is the same for all the entries with the same request id.
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/performance/resources/network-append-30-requests.html
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView):
+        (WebInspector.NetworkLogView.prototype._invalidateAllItems):
+        (WebInspector.NetworkLogView.prototype.refresh):
+        (WebInspector.NetworkLogView.prototype._reset):
+        (WebInspector.NetworkLogView.prototype._refreshResource):
+
+2011-09-28  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: make inspector protocol validation a part of the build process.
+        https://bugs.webkit.org/show_bug.cgi?id=68999
+
+        Since we'd like to commit to inspector protocol backwards compatibility, violating it
+        should be a build failure.
+
+        Reviewed by Yury Semikhatsky.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * inspector/Inspector.draft-01.json:
+        * inspector/Inspector.json:
+        * inspector/generate-inspector-idl:
+        * inspector/generate-protocol-externs:
+        * inspector/validate-protocol-compatibility:
+
+2011-09-27  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: Scripts panel without folders causes errors when creating content scripts section.
+        https://bugs.webkit.org/show_bug.cgi?id=68827
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addOptionToFilesSelect.insertOrdered.optionCompare):
+        (WebInspector.ScriptsPanel.prototype._addOptionToFilesSelect.insertOrdered):
+        (WebInspector.ScriptsPanel.prototype._addOptionToFilesSelect):
+
+2011-09-28  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: network log view refresh optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=69010
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype.refresh):
+
+2011-09-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: split SourceFile.js into RawSourceCode.js and UISourceCodeContentProviders.js.
+        https://bugs.webkit.org/show_bug.cgi?id=69068
+
+        Reviewed by Yury Semikhatsky.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/RawSourceCode.js: Renamed from Source/WebCore/inspector/front-end/SourceFile.js.
+        (WebInspector.RawSourceCode): Moved from SourceFile.js.
+        (WebInspector.UILocation): Moved from SourceFile.js.
+        * inspector/front-end/UISourceCodeContentProviders.js: Added. Moved ContentProvider implementations from SourceFile.js
+        (WebInspector.ScriptContentProvider):
+        (WebInspector.ScriptContentProvider.prototype.requestContent):
+        (WebInspector.ConcatenatedScriptsContentProvider):
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype.requestContent):
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype._concatenateScriptsContent.appendChunk):
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype._concatenateScriptsContent):
+        (WebInspector.ResourceContentProvider):
+        (WebInspector.ResourceContentProvider.prototype.requestContent):
+        (WebInspector.StaticContentProvider):
+        (WebInspector.StaticContentProvider.prototype.requestContent):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-09-29  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] 2 flaky media tests
+        https://bugs.webkit.org/show_bug.cgi?id=67407
+
+        Reviewed by Martin Robinson.
+
+        Workaround for GStreamer bug#639941. In GStreamer
+        0.10.35 basesink reports wrong duration in case of EOS and
+        negative playback rate. This workaround fixes two media tests,
+        media/video-timeupdate-reverse-play.html and
+        media/video-reverse-play-duration.html.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::prepareToPlay):
+        (WebCore::MediaPlayerPrivateGStreamer::currentTime):
+        (WebCore::MediaPlayerPrivateGStreamer::didEnd):
+
+2011-09-29  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] fullscreen video pause/play fails
+        https://bugs.webkit.org/show_bug.cgi?id=66936
+
+        Reviewed by Martin Robinson.
+
+        Don't use the identity element to avoid painting of the in-window
+        video. Instead simply make the sink aware of the fullscreen state
+        and ignore buffers if fullscreen and autovideosink are
+        active. Also fixed two deadlocks happening when a paused pipeline
+        is switched to fullscreen and when fullscreen is disabled for a
+        paused pipeline.
+
+        * platform/graphics/gstreamer/GStreamerGWorld.cpp:
+        (WebCore::GStreamerGWorld::enterFullscreen):
+        (WebCore::GStreamerGWorld::exitFullscreen):
+        * platform/graphics/gstreamer/GStreamerGWorld.h:
+        (WebCore::GStreamerGWorld::isFullscreen):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_render):
+        (webkit_video_sink_new):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.h:
+
+2011-09-29  Tim Horton  <timothy_horton@apple.com>
+
+        REGRESSION(87010): elements in ECMA-cloud neither filled nor blurred
+        https://bugs.webkit.org/show_bug.cgi?id=68679
+        <rdar://problem/10204649>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Strip prefixes from SVG attributes before testing if they're supported.
+        Namespaced attributes will be matched using their namespace instead of
+        the (user-choosable) prefix.
+
+        Test: svg/custom/xlink-custom-namespace.svg
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::isSupportedAttribute):
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::isSupportedAttribute):
+        * svg/SVGAnimateTransformElement.cpp:
+        (WebCore::SVGAnimateTransformElement::isSupportedAttribute):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::isSupportedAttribute):
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::isSupportedAttribute):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::isSupportedAttribute):
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        (WebCore::SVGComponentTransferFunctionElement::isSupportedAttribute):
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::isSupportedAttribute):
+        * svg/SVGElement.h:
+        (WebCore::SVGAttributeHashTranslator::hash):
+        (WebCore::SVGAttributeHashTranslator::equal):
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::isSupportedAttribute):
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::isSupportedAttribute):
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::isSupportedAttribute):
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::isSupportedAttribute):
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::isSupportedAttribute):
+        * svg/SVGFEConvolveMatrixElement.cpp:
+        (WebCore::SVGFEConvolveMatrixElement::isSupportedAttribute):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::isSupportedAttribute):
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::isSupportedAttribute):
+        * svg/SVGFEDropShadowElement.cpp:
+        (WebCore::SVGFEDropShadowElement::isSupportedAttribute):
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::isSupportedAttribute):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::isSupportedAttribute):
+        * svg/SVGFELightElement.cpp:
+        (WebCore::SVGFELightElement::isSupportedAttribute):
+        * svg/SVGFEMergeNodeElement.cpp:
+        (WebCore::SVGFEMergeNodeElement::isSupportedAttribute):
+        * svg/SVGFEMorphologyElement.cpp:
+        (WebCore::SVGFEMorphologyElement::isSupportedAttribute):
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::isSupportedAttribute):
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::isSupportedAttribute):
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::isSupportedAttribute):
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::isSupportedAttribute):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::isSupportedAttribute):
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::isSupportedAttribute):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::isSupportedAttribute):
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::isSupportedAttribute):
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::isSupportedAttribute):
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::isSupportedAttribute):
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::isSupportedAttribute):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::isSupportedAttribute):
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::isSupportedAttribute):
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::isSupportedAttribute):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::isSupportedAttribute):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::isSupportedAttribute):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::isSupportedAttribute):
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::isSupportedAttribute):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::isSupportedAttribute):
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::isSupportedAttribute):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::isSupportedAttribute):
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::isSupportedAttribute):
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::isSupportedAttribute):
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::isSupportedAttribute):
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::isSupportedAttribute):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::isSupportedAttribute):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::isSupportedAttribute):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::isSupportedAttribute):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::isSupportedAttribute):
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::isSupportedAttribute):
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::addSupportedAttributes):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::isSupportedAttribute):
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::isSupportedAttribute):
+
+2011-09-28  Kentaro Hara  <haraken@chromium.org>
+
+        "ScriptValue" arguments of PopStateEvent methods should be "const ScriptValue&"
+        https://bugs.webkit.org/show_bug.cgi?id=68984
+
+        Reviewed by Darin Adler.
+
+        Just a follow-up fix for the bug 68345. For performance,
+        "ScriptValue" arguments of PopStateEvent methods should be "const ScriptValue&".
+
+        Tests: fast/events/constructors/pop-state-event-constructor.html
+               fast/events/fire-popstate-event.html
+
+        * dom/PopStateEvent.cpp:
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::create):
+        (WebCore::PopStateEvent::initPopStateEvent):
+        * dom/PopStateEvent.h:
+
+2011-09-28  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Move drag-and-drop code which can be shared with WebKit2 to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=66890
+
+        Added a GtkDragAndDropHelper class to hold all the logic that is common
+        between WebKit1 and WebKit2. This will allow greater code sharing between
+        the two ports.
+
+        Reviewed by Philippe Normand.
+
+        No new tests. This patch should not change behavior.
+
+        * GNUmakefile.list.am: Added the GtkDragAndDropHelper to the sources list.
+        * platform/gtk/GtkDragAndDropHelper.cpp: Added.
+        * platform/gtk/GtkDragAndDropHelper.h: Added.
+
+2011-09-28  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10196497> first-letter after list marker not updated correctly
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/dynamic/first-letter-after-list-marker.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter): Improved the logic for continuing past list markers
+        when trying to locate a first letter to update.
+
+2011-09-28  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r93858): Can't type anything into input elements when maxlength is greater than 2^31
+        https://bugs.webkit.org/show_bug.cgi?id=68981
+
+        Reviewed by Darin Adler.
+
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::parseHTMLInteger):
+        Check the failure of charactersToIntStrict().
+        (WebCore::parseHTMLNonNegativeInteger):
+        Check the failure of charactersToUIntStrict().
+
+2011-09-28  Antoine Labour  <piman@chromium.org>
+
+        Remove unused createRootLayerPainter from CCLayerTreeHostClient
+        https://bugs.webkit.org/show_bug.cgi?id=69042
+
+        Reviewed by James Robinson.
+
+        No new test needed: no semantic change.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+
+2011-09-28  Luke Macpherson   <macpherson@chromium.org>
+
+        Only resolve direction aware properties when properties are direction aware.
+        https://bugs.webkit.org/show_bug.cgi?id=68968
+
+        Reviewed by Eric Seidel.
+
+        No new tests / no functionality changed.
+
+        Profiling showed a ~8% improvement in applyProperty by not calling resolveDirectionAwareProperty for every property.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2011-09-28  Simon Fraser  <simon.fraser@apple.com>
+
+        fast/dom/scroll-element-to-rect.html fails on WK1 Mac port
+        https://bugs.webkit.org/show_bug.cgi?id=68815
+
+        Reviewed by Dan Bernstein.
+        
+        FrameView::scrollElementToRect() was incorrectly using Element::boundsInWindowSpace(),
+        which is window-relative (not web view-relative), and has flipped coordinates
+        in WebKit1.
+        
+        Change to use Node::getRect() which is what the author intended.
+
+        * dom/Element.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollElementToRect):
+
+2011-09-28  Peter Beverloo  <peter@chromium.org>
+
+        Don't clamp cubic-bezier timing functions between 0 and 1
+        https://bugs.webkit.org/show_bug.cgi?id=45761
+
+        Remove the limitation of clamping the cubic-bezier timing function
+        values between 0 and 1, following the specification change made on
+        April 5 of this year.
+
+        Reviewed by Dean Jackson.
+
+        Tests: transitions/cubic-bezier-overflow-color.html
+               transitions/cubic-bezier-overflow-length.html
+               transitions/cubic-bezier-overflow-shadow.html
+               transitions/cubic-bezier-overflow-svg-length.html
+               transitions/cubic-bezier-overflow-transform.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseCubicBezierTimingFunctionValue):
+
+2011-09-28  Chris Rogers  <crogers@google.com>
+
+        DelayNode must set the context on delayTime AudioParam to support automation
+        https://bugs.webkit.org/show_bug.cgi?id=68828
+
+        Reviewed by Kenneth Russell.
+
+        Test: webaudio/delaynode-scheduling.html
+
+        * webaudio/DelayNode.cpp:
+        (WebCore::DelayNode::DelayNode):
+
+2011-09-28  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        JavaScript generated documents don't inherit the cookie URL
+        https://bugs.webkit.org/show_bug.cgi?id=69003
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/cookies/cookie-theft-with-javascript-doc.html
+
+        * dom/Document.h:
+        (WebCore::Document::setCookieURL):
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::replaceDocument):
+        (WebCore::DocumentWriter::begin):
+        * loader/DocumentWriter.h:
+
+2011-09-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        REGRESSION(r95573): Crash when loading SVG documents in a flattened frame or any SVG document in Chromium/Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=68938
+
+        Reviewed by David Hyatt.
+
+        Test: all svg tests in LayoutTests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeBlockPreferredLogicalWidths): Added a null-check for containingBlock.
+
+2011-09-28  Una Sabovic  <una.sabovic@palm.com>
+
+        Setting innerText to an empty string on editable div loses focus
+        https://bugs.webkit.org/show_bug.cgi?id=62092
+
+        Reviewed by Ryosuke Niwa.
+
+        When selection start or end node is being deleted do not clear the selection.
+        Instead update the start/end position to an equivalent parent-anchored positions.
+        When text is inserted/deleted update selection per range modification spec:
+        http://www.w3.org/TR/DOM-Level-2-Traversal-Range/ranges.html#Level-2-Range-Mutation
+
+        Tests: editing/selection/document-mutation.html
+               editing/selection/editable-div-clear-on-keydown.html
+
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::respondToNodeModification):
+        (WebCore::updatePositionAfterAdoptingTextReplacement):
+        (WebCore::FrameSelection::textWillBeReplaced):
+        * editing/htmlediting.cpp:
+        (WebCore::updatePositionForNodeRemoval):
+
+2011-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+
+        FTPDirectoryDocument Shows Garbled String for Last Modified Date
+        https://bugs.webkit.org/show_bug.cgi?id=69011
+
+        Reviewed by Dan Bernstein.
+
+        Force WTF::String concatenation instead of an accidental char* pointer addition.
+
+        * html/FTPDirectoryDocument.cpp:
+        (WebCore::processFileDateString):
+
+2011-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Fix a regression in r96060. ResourceLoader shouldn't get
+        initialized with a null DocumentLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=69004
+
+        Reviewed by Csaba Osztrogonác.
+
+        This should fix a debug crash in some platforms in
+        plugins/js-from-destroy.html
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::init): Move the activeDocumentLoader() null checks back
+            to SubresouceLoader::create().
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+
+2011-09-28  Adam Barth  <abarth@webkit.org>
+
+        CSP doesn't work for a wide variety of cases
+        https://bugs.webkit.org/show_bug.cgi?id=68921
+
+        Reviewed by Darin Adler.
+
+        Patch suggested by Sam Weinig.  It's unclear to me how to test this
+        change because all our tests run on non-default ports, which is why we
+        have this bug in the first place.  Mozilla uses a proxy while testing
+        so they can test with URLs like http://example.com, but we don't have
+        such a facility.
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPSource::portMatches):
+
+2011-09-28  Fady Samuel  <fsamuel@chromium.org>
+
+        [Chromium] Seperate GTK specific Gyp rules from X11 Gyp rules
+        https://bugs.webkit.org/show_bug.cgi?id=68936
+
+        Reviewed by Tony Chang.
+
+        Chromium need to be built without Gtk for future version of ChromiumOS.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-09-28  Tom Sepez  <tsepez@chromium.org>
+
+        Revert change which broke displaying end script tags in view-source, instead
+        deal with any trailing </script> tag included by mistake in the XSSAuditor
+        itself.  Correct tests to detect the missing close tags.
+        https://bugs.webkit.org/show_bug.cgi?id=68898
+
+        Reviewed by Adam Barth.
+
+        * html/parser/HTMLSourceTracker.cpp:
+        (WebCore::HTMLSourceTracker::end):
+        * html/parser/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::nextToken):
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::startsHTMLEndTagAt):
+        (WebCore::XSSAuditor::snippetForJavaScript):
+
+2011-09-28  Adam Barth  <abarth@webkit.org>
+
+        Remove empty directories.
+
+        * editing/brew: Removed.
+        * page/brew: Removed.
+        * platform/brew: Removed.
+        * platform/graphics/brew: Removed.
+        * platform/network/brew: Removed.
+        * platform/text/brew: Removed.
+
+2011-09-28  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: optional arguments support for the frontend needs to be extended.
+        https://bugs.webkit.org/show_bug.cgi?id=69005
+
+        Generator supports optional arguments but they are transferred by value.
+        It is not suitable if the used type doesn't have operator bool.
+        I'll transfer such arguments by pointer.
+
+        Reviewed by Pavel Feldman.
+
+        Build is the test.
+
+        * inspector/CodeGeneratorInspector.pm:
+        (generateFrontendFunction):
+        (paramTypeTraits):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didFailLoading):
+
+2011-09-28  Antaryami Pandia  <antaryami.pandia@motorola.com>
+
+        Reflected attribute input.size wraps on negative values (Chrome), or
+        returns them (Safari).
+        https://bugs.webkit.org/show_bug.cgi?id=44886
+
+        Reviewed by Darin Adler.
+
+        Test: fast/dom/HTMLInputElement/input-size-attribute.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+
+2011-09-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Add support for search in single resource to page agent.
+        https://bugs.webkit.org/show_bug.cgi?id=68998
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/search/search-in-resource.html
+
+        * inspector/ContentSearchUtils.cpp:
+        (WebCore::ContentSearchUtils::getRegularExpressionMatchesByLines):
+        * inspector/ContentSearchUtils.h:
+        * inspector/Inspector.json:
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::buildObjectForSearchMatch):
+        (WebCore::InspectorPageAgent::searchInResource):
+        * inspector/InspectorPageAgent.h:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.searchInContent):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.ResourceContentProvider.prototype.requestContent):
+        (WebInspector.ResourceContentProvider.prototype.searchInContent):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.ContentProvider.prototype.requestContent):
+        (WebInspector.ContentProvider.prototype.searchInContent):
+
+2011-09-28  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: It'd be useful to have performance stats for the back-end to front-end communication channel.
+        https://bugs.webkit.org/show_bug.cgi?id=69002
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/CodeGeneratorInspector.pm:
+
+2011-09-27  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: live edit cursor always appears at the beginning of the file.
+        https://bugs.webkit.org/show_bug.cgi?id=68900
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._updateSelectionOnStartEditing):
+
+2011-09-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Refactor searching in inspector, add test (fixed non regex search).
+        https://bugs.webkit.org/show_bug.cgi?id=68930
+
+        Reviewed by Yury Semikhatsky.
+
+        Search moved out from page agent.
+        Fixed search for non regex case which is not yet used.
+
+        Test: http/tests/inspector/search/search-in-resources.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/ContentSearchUtils.cpp: Added.
+        (WebCore::ContentSearchUtils::createSearchRegexSource):
+        (WebCore::ContentSearchUtils::createSearchRegex):
+        (WebCore::ContentSearchUtils::countRegularExpressionMatches):
+        * inspector/ContentSearchUtils.h: Added.
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::hasTextContent):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+        (WebCore::textContentForCachedResource):
+        (WebCore::buildObjectForSearchResult):
+        (WebCore::InspectorPageAgent::searchInResources):
+        * inspector/front-end/utilities.js:
+        ():
+
+2011-09-28  Kentaro Hara  <haraken@chromium.org>
+
+        Implement a PopStateEvent constructor for V8
+        https://bugs.webkit.org/show_bug.cgi?id=68896
+
+        Reviewed by Adam Barth.
+
+        Test: fast/events/constructors/pop-state-event-constructor.html
+
+        * bindings/v8/custom/V8EventConstructors.cpp: Added a PopStateEvent constructor.
+        * dom/PopStateEvent.idl: Added a 'V8CustomConstructor' attribute.
+
+2011-09-28  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Allow TextureMapperGL to work without a GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=68980
+
+        Reviewed by Andreas Kling.
+
+        Perform a null-check for m_context and initialize that variable.
+        If a graphics-context doesn't exist, we don't need to reset it.
+
+        No new functionality so no new tests.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::TextureMapperGL):
+        (WebCore::TextureMapperGL::beginPainting):
+        (WebCore::TextureMapperGL::endPainting):
+
+2011-09-28  Kentaro Hara  <haraken@chromium.org>
+
+        Implement an ErrorEvent constructor for V8
+        https://bugs.webkit.org/show_bug.cgi?id=68336
+
+        Reviewed by Adam Barth.
+
+        Test: fast/events/constructors/error-event-constructor.html
+
+        * bindings/v8/OptionsObject.cpp:
+        (WebCore::OptionsObject::getKeyValue): Returns an unsigned value corresponding to a given key.
+        * bindings/v8/OptionsObject.h:
+        * bindings/v8/custom/V8EventConstructors.cpp: Added the ErrorEvent constructor.
+        * dom/ErrorEvent.idl: Added a 'V8CustomConstructor' attribute.
+
+2011-09-27  Andy Estes  <aestes@apple.com>
+
+        WebKitLinkedOnOrAfter() check is ineffective for Solar Walk app-specific hack.
+        https://bugs.webkit.org/show_bug.cgi?id=68863
+
+        Reviewed by Darin Adler.
+
+        The SolarWalk binary does not link against WebKit.framework directly,
+        so calling NSVersionOfLinkTimeLibrary() will not return the version of
+        WebKit against which SolarWalk was linked. Since Solar Walk has
+        released an update that addresses the issue for which this app-specific
+        hack was originally added, we should just remove the hack.
+
+        * WebCore.exp.in: Remove applicationIsSolarWalkMac().
+        * platform/RuntimeApplicationChecks.cpp: Ditto.
+        * platform/RuntimeApplicationChecks.h: Ditto.
+
+2011-09-28  Tim Horton  <timothy_horton@apple.com>
+
+        Fix potential SVG performance regression (over-invalidation of caches) from 96052
+        https://bugs.webkit.org/show_bug.cgi?id=68941
+        <rdar://problem/10196224>
+
+        Reviewed by Zoltan Herczeg.
+
+        Only invalidate the cache of a filter when target style changes, as of the different types of cached
+        resources, only filters make use of the style of the target element and thus need to be invalidated
+        when the target style changes.
+
+        No new tests, performance improvement.
+
+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::clientUpdatedFromElement):
+
+2011-09-28  Adenilson Cavalcanti  <adenilson.silva@openbossa.org>
+
+        Missing initialization of member in ImageFrameQt class
+        https://bugs.webkit.org/show_bug.cgi?id=68943
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new tests, this fixes internal implementation detail.
+
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+        (WebCore::ImageFrame::ImageFrame):
+        (WebCore::ImageFrame::operator=):
+
+2011-09-27  Luke Macpherson   <macpherson@chromium.org>
+
+        Defer call to CSSValue::isPrimitiveValue(), saves ~4% in CSSStyleSelector::applyProperty().
+        https://bugs.webkit.org/show_bug.cgi?id=68964
+
+        Reviewed by Eric Seidel.
+
+        No new tests / no functionality changed.
+
+        Doing value->isPrimitiveValue() is relatviely expensive, so moving it after the early returns but
+        before the result is used saves a significant number of cycles. (Tested with Shark profiler in Safari).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2011-09-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Simplify ReplaceSelectionCommand::positionAtStartOfInsertedContent
+        https://bugs.webkit.org/show_bug.cgi?id=68939
+
+        Reviewed by Darin Adler.
+
+        Simplified ReplaceSelectionCommand::positionAtStartOfInsertedContent.
+
+        This change revealed a bug in removeUnrenderedTextNodesAtEnds that text nodes without any visible
+        text at ends are not removed when it has a render object. Fixed the bug by checking the length of
+        the rendered text. (Tested by editing/pasteboard/pasting-word-in-div-extra-line.html)
+
+        This further revealed that caretMaxRenderedOffset doesn't return an offset and caretMaxRenderedOffset
+        on InlineBox, InlineTextBox, RenderObject, RenderBR, RenderPlaced are never called. To address this
+        issue, renamed caretMaxRenderedOffset to renderedTextLength for RenderText and removed the rest.
+
+        * dom/Position.cpp:
+        (WebCore::Position::rendersInDifferentPosition):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::nodeHasVisibleRenderText): Added.
+        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds): Calls nodeHasVisibleRenderText.
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent): Simplified.
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): Calls renderedTextLength.
+        (WebCore::endOfParagraph): Ditto.
+        * rendering/InlineBox.cpp: Removed caretMaxRenderedOffset.
+        * rendering/InlineBox.h: Ditto.
+        * rendering/InlineTextBox.cpp: Ditto.
+        * rendering/InlineTextBox.h: Ditto.
+        * rendering/RenderBR.cpp: Ditto.
+        * rendering/RenderBR.h: Ditto.
+        * rendering/RenderObject.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * rendering/RenderReplaced.cpp: Ditto.
+        * rendering/RenderReplaced.h: Ditto.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::renderedTextLength): Renamed from caretMaxRenderedOffset.
+        * rendering/RenderText.h:
+
+2011-09-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRenderChromium asserts about leaking textures.
+        https://bugs.webkit.org/show_bug.cgi?id=68190
+
+        Reviewed by Kenneth Russell.
+
+        This introduces an interface TextureAllocator that the TextureManager uses to allocate/deallocate textures.
+        This means that TextureManager does not need to depend directly on GraphicsContext3D, other than for the format
+        enum type, making it more testable.  It also allows us to track the allocations by subclassing TextureAllocator
+        to make sure we aren't leaking any textures.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::releaseRenderSurfaceTextures):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::useRenderSurface):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::renderSurfaceTextureAllocator):
+        (WebCore::LayerRendererChromium::contentsTextureAllocator):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.cpp:
+        (WebCore::LayerTextureUpdaterBitmap::updateTextureRect):
+        (WebCore::LayerTextureUpdaterSkPicture::updateTextureRect):
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.h:
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        (WebCore::ManagedTexture::bindTexture):
+        (WebCore::ManagedTexture::framebufferTexture2D):
+        * platform/graphics/chromium/ManagedTexture.h:
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::memoryUseBytes):
+        (WebCore::TextureManager::deleteEvictedTextures):
+        (WebCore::TextureManager::evictAndDeleteAllTextures):
+        (WebCore::TextureManager::removeTexture):
+        (WebCore::TextureManager::allocateTexture):
+        (WebCore::TextureManager::requestTexture):
+        * platform/graphics/chromium/TextureManager.h:
+        (WebCore::TextureAllocator::~TextureAllocator):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp: Added.
+        (WebCore::TrackingTextureAllocator::TrackingTextureAllocator):
+        (WebCore::TrackingTextureAllocator::~TrackingTextureAllocator):
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        * platform/graphics/chromium/TrackingTextureAllocator.h: Copied from Source/WebCore/platform/graphics/chromium/ManagedTexture.h.
+        (WebCore::TrackingTextureAllocator::create):
+        (WebCore::TrackingTextureAllocator::currentMemoryUseBytes):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::updateCompositorResources):
+        (WebCore::VideoLayerChromium::updateTexture):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::deleteContentsTexturesOnCCThread):
+        (WebCore::CCLayerTreeHost::commitToOnCCThread):
+        (WebCore::CCLayerTreeHost::didRecreateGraphicsContext):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::contentsTextureAllocator):
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawSurface):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setNeedsCommit):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::recreateContextIfNeeded):
+        (WebCore::CCSingleThreadProxy::commitIfNeeded):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::commitOnCCThread):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnCCThread):
+2011-09-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Only initiate the beginFrameAndCommit sequence if a commit has been requested
+        https://bugs.webkit.org/show_bug.cgi?id=68967
+
+        Reviewed by Kenneth Russell.
+
+        When updating the scheduler state, we should only initiate a new commit flow if a commit has been requested (as
+        opposed to only a redraw).
+
+        Covered by the unit test CCLayerTreeHostTestSetNeedsRedraw with USE(THREADED_COMPOSITING) set to true.
+
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::updateSchedulerStateOnCCThread):
+
+2011-09-27  Kentaro Hara  <haraken@chromium.com>
+
+        Implement a PageTransitionEvent constructor for V8
+        https://bugs.webkit.org/show_bug.cgi?id=68067
+
+        Reviewed by Adam Barth.
+
+        Test: fast/events/constructors/page-transition-event-constructor.html
+
+        * bindings/v8/custom/V8EventConstructors.cpp: Added the PageTransitionEvent constructor.
+        * dom/PageTransitionEvent.idl: Added a 'V8CustomConstructor' attribute.
+
+2011-09-27  Kentaro Hara  <haraken@chromium.org>
+
+        Implement a MessageEvent constructor for JSC
+        https://bugs.webkit.org/show_bug.cgi?id=68883
+
+        Reviewed by Adam Barth.
+
+        The spec for MessageEvent is here:
+        http://www.whatwg.org/specs/web-apps/current-work/#messageevent
+
+        Currently, some tests in fast/events/constructors/message-event-constructor.html
+        are failing or crashing in DRT, as we commented in the test file.
+        This is because MessageEvent.data is implemented as SerializedScriptValue,
+        and thus it cannot keep ScriptValue passed by JavaScript.
+        This is the same issue as the bug (https://bugs.webkit.org/show_bug.cgi?id=68345).
+        We will soon make a follow-up patch to fix these failures, after this
+        patch is landed.
+
+        Test: fast/events/constructors/message-event-constructor.html
+
+        * bindings/generic/EventConstructors.h: Added a definition for the MessageEvent constructor.
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue): Generates MessagePortArray from the list of message ports in the format of JSValues.
+        * bindings/js/JSDictionary.h:
+        * bindings/js/JSEventConstructors.cpp: Added #includes for MessageEvent.
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEventInit::MessageEventInit):
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h: Added a definition for MessageEvent. Removed an extra leading spaces.
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::origin):
+        (WebCore::MessageEvent::lastEventId):
+        (WebCore::MessageEvent::source):
+        (WebCore::MessageEvent::ports):
+        (WebCore::MessageEvent::dataType):
+        (WebCore::MessageEvent::dataAsSerializedScriptValue):
+        (WebCore::MessageEvent::dataAsString):
+        (WebCore::MessageEvent::dataAsBlob):
+        (WebCore::MessageEvent::dataAsArrayBuffer):
+        * dom/MessageEvent.idl: Makes MessageEvent constructible.
+
+2011-09-27  Eric Uhrhane  <ericu@chromium.org>
+
+        [Chromium/FileWriter] race condition in FileWriter completion can lead to assert
+        https://bugs.webkit.org/show_bug.cgi?id=67684
+
+        Reviewed by David Levin.
+
+        Tests: fast/filesystem/file-writer-abort-continue.html
+               fast/filesystem/file-writer-abort.html
+
+        Track the state of the backend and be prepared for reentrant user
+        requests.  Limit recursion depth to an arbitrary small constant.
+        * fileapi/FileWriter.cpp: Lots of event-handling changes.
+        * fileapi/FileWriter.h:
+
+2011-09-27  Mihai Parparita  <mihaip@chromium.org>
+
+        Unreviewed, rolling out r96141.
+        http://trac.webkit.org/changeset/96141
+        https://bugs.webkit.org/show_bug.cgi?id=68190
+
+        Breaks PrerenderBrowserTest.PrerenderHTML5Video in
+        browser_tests
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::releaseRenderSurfaceTextures):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::createLayerTexture):
+        (WebCore::LayerRendererChromium::deleteLayerTexture):
+        (WebCore::LayerRendererChromium::useRenderSurface):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::setContentsTextureMemoryUseBytes):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.cpp:
+        (WebCore::LayerTextureUpdaterBitmap::updateTextureRect):
+        (WebCore::LayerTextureUpdaterSkPicture::updateTextureRect):
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.h:
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        (WebCore::ManagedTexture::bindTexture):
+        (WebCore::ManagedTexture::framebufferTexture2D):
+        * platform/graphics/chromium/ManagedTexture.h:
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::memoryUseBytes):
+        (WebCore::TextureManager::deleteEvictedTextures):
+        (WebCore::TextureManager::evictAndDeleteAllTextures):
+        (WebCore::TextureManager::removeTexture):
+        (WebCore::TextureManager::allocateTexture):
+        (WebCore::TextureManager::requestTexture):
+        * platform/graphics/chromium/TextureManager.h:
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp: Removed.
+        * platform/graphics/chromium/TrackingTextureAllocator.h: Removed.
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::updateCompositorResources):
+        (WebCore::VideoLayerChromium::updateTexture):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::deleteContentsTextures):
+        (WebCore::CCLayerTreeHost::commitTo):
+        (WebCore::CCLayerTreeHost::didRecreateGraphicsContext):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp.rej: Removed.
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawSurface):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setNeedsCommit):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::recreateContextIfNeeded):
+        (WebCore::CCSingleThreadProxy::commitIfNeeded):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::commitOnCCThread):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnCCThread):
+
+2011-09-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Guard accelerated skia drawing logic with its own define to remove dependency on USE(THREADED_COMPOSITING)
+        https://bugs.webkit.org/show_bug.cgi?id=68953
+
+        Reviewed by Kenneth Russell.
+
+        The accelerated drawing code is incompatible with threaded compositing. Rather than tying the two behaviors
+        together via USE(THREADED_COMPOSITING), this patch guards the accelerated drawing code with its own USE() guard
+        so the features can advance independently. Today, it's not safe to set both of these flags.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::createTextureUpdater):
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.cpp:
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.h:
+
+2011-09-27  Luke Macpherson   <macpherson@chromium.org>
+
+        Slightly improve performance of CSSStyleApplyProperty handler lookup.
+        https://bugs.webkit.org/show_bug.cgi?id=68868
+
+        Reviewed by Eric Seidel.
+
+        No new tests as no functionality changed.
+
+        * css/CSSStyleApplyProperty.h:
+        (WebCore::CSSStyleApplyProperty::propertyHandler):
+        Make propertyHandler() public and remove redirecting functions.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Perform property handler lookup once and reuse the result.
+
+2011-09-27  Kent Tamura  <tkent@chromium.org>
+
+        [V8] element.dataset.nonExistingKey should return undefined.
+        https://bugs.webkit.org/show_bug.cgi?id=68877
+
+        Reviewed by Nate Chapin.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::V8DOMStringMap::namedPropertyGetter): Uses v8StringOrUndefined() instead of v8String().
+
+2011-09-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::visitChildren
+        https://bugs.webkit.org/show_bug.cgi?id=68404
+
+        Reviewed by Darin Adler.
+
+        No new tests.
+
+        In this patch we just extract the bodies of the virtual visitChildren methods
+        throughout the JSCell inheritance hierarchy out into static methods, which are 
+        now called from the virtual methods.  This is an intermediate step in trying to 
+        move the virtual-ness of visitChildren into our own custom vtable stored in 
+        ClassInfo.  We need to convert the methods to static methods in order to be 
+        able to more easily store and refer to them in our custom vtable since normal 
+        member methods store some implicit information in their types, making it 
+        impossible to store them generically in ClassInfo.
+
+        * WebCore.exp.in:
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::visitChildrenVirtual):
+        (WebCore::JSAttr::visitChildren):
+        * bindings/js/JSAudioContextCustom.cpp:
+        (WebCore::JSAudioContext::visitChildrenVirtual):
+        (WebCore::JSAudioContext::visitChildren):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::JSCSSRule::visitChildrenVirtual):
+        (WebCore::JSCSSRule::visitChildren):
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::visitChildrenVirtual):
+        (WebCore::JSCSSStyleDeclaration::visitChildren):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::JSCanvasRenderingContext::visitChildrenVirtual):
+        (WebCore::JSCanvasRenderingContext::visitChildren):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::visitChildrenVirtual):
+        (WebCore::JSDOMGlobalObject::visitChildren):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::visitChildrenVirtual):
+        (WebCore::JSDOMWindow::visitChildren):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::visitChildrenVirtual):
+        (WebCore::JSDOMWindowShell::visitChildren):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSJavaScriptAudioNodeCustom.cpp:
+        (WebCore::JSJavaScriptAudioNode::visitChildrenVirtual):
+        (WebCore::JSJavaScriptAudioNode::visitChildren):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::visitChildrenVirtual):
+        (WebCore::JSMessageChannel::visitChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::visitChildrenVirtual):
+        (WebCore::JSMessagePort::visitChildren):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::visitChildrenVirtual):
+        (WebCore::JSNamedNodeMap::visitChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::visitChildrenVirtual):
+        (WebCore::JSNode::visitChildren):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::visitChildrenVirtual):
+        (WebCore::JSNodeFilter::visitChildren):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::visitChildrenVirtual):
+        (WebCore::JSNodeIterator::visitChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::visitChildrenVirtual):
+        (WebCore::JSSVGElementInstance::visitChildren):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::visitChildrenVirtual):
+        (WebCore::JSSharedWorker::visitChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::visitChildrenVirtual):
+        (WebCore::JSStyleSheet::visitChildren):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::visitChildrenVirtual):
+        (WebCore::JSTreeWalker::visitChildren):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::visitChildrenVirtual):
+        (WebCore::JSWebGLRenderingContext::visitChildren):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::visitChildrenVirtual):
+        (WebCore::JSWorkerContext::visitChildren):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::visitChildrenVirtual):
+        (WebCore::JSXMLHttpRequest::visitChildren):
+        * bindings/js/JSXPathResultCustom.cpp:
+        (WebCore::JSXPathResult::visitChildrenVirtual):
+        (WebCore::JSXPathResult::visitChildren):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObj::visitChildrenVirtual):
+        (WebCore::JSTestObj::visitChildren):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObject::visitChildrenVirtual):
+        (JSC::Bindings::QtRuntimeObject::visitChildren):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::visitChildrenVirtual):
+        (JSC::Bindings::QtRuntimeMetaMethod::visitChildren):
+        * bridge/qt/qt_runtime.h:
+        * workers/WorkerContext.h:
+
+<<<<<<< .mine
+2011-09-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::getCallData
+        https://bugs.webkit.org/show_bug.cgi?id=68741
+
+        Reviewed by Darin Adler.
+
+        No new tests.
+
+        In this patch we just extract the bodies of the virtual getCallData methods
+        throughout the JSCell inheritance hierarchy out into static methods, which are 
+        now called from the virtual methods.  This is an intermediate step in trying to 
+        move the virtual-ness of getCallData into our own method table stored in 
+        ClassInfo.  We need to convert the methods to static methods because static methods 
+        can be represented as function pointers rather than pointers to member functions, and
+        function pointers are smaller and faster to call than pointers to member functions.
+
+        * WebCore.exp.in:
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::JSHTMLAllCollection::getCallDataVirtual):
+        (WebCore::JSHTMLAllCollection::getCallData):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getCallDataVirtual):
+        (WebCore::JSHTMLAppletElement::getCallData):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getCallDataVirtual):
+        (WebCore::JSHTMLEmbedElement::getCallData):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getCallDataVirtual):
+        (WebCore::JSHTMLObjectElement::getCallData):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::evaluate):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectGetCallData):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::getCallDataVirtual):
+        (JSC::Bindings::ObjcFallbackObjectImp::getCallData):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::getCallDataVirtual):
+        (JSC::Bindings::QtRuntimeMetaMethod::getCallData):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::getCallDataVirtual):
+        (JSC::Bindings::QtRuntimeConnectionMethod::getCallData):
+        (JSC::Bindings::isJavaScriptFunction):
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getCallDataVirtual):
+        (JSC::RuntimeMethod::getCallData):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::getCallDataVirtual):
+        (JSC::Bindings::RuntimeObject::getCallData):
+        * bridge/runtime_object.h:
+
+=======
+2011-09-27  Dean Jackson  <dino@apple.com>
+
+        Unreviewed. Remove duplicate FilterOperation{s}.h that were
+        accidentally added to the top level of the Xcode project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+>>>>>>> .r96163
+2011-09-27  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68940
+
+        Narrow the float/lines pagination heuristic to only kick in if
+        the previous line broke cleanly and if the floats are occurring
+        at the start of the line.
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::positionNewFloatOnLine):
+
+2011-09-27  James Robinson  <jamesr@chromium.org>
+
+        Add a mechanism to test for the compositing tree mutated during painting
+        https://bugs.webkit.org/show_bug.cgi?id=68738
+
+        Reviewed by Adam Barth.
+
+        Sets a static bool during GraphicsLayer::paintGraphicsLayerContents and ASSERT()s that we never create or
+        destroy a GraphicsLayer inside this function. Painting should never mutate the GraphicsLayer tree.
+
+        Test: compositing/video/video-with-invalid-source.html
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::~GraphicsLayer):
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents):
+
+2011-09-27  Ojan Vafai  <ojan@chromium.org>
+
+        take padding/border on flexbox into account with direction:rtl
+        https://bugs.webkit.org/show_bug.cgi?id=68846
+
+        Reviewed by David Hyatt.
+
+        Use the logicalWidth of the flexbox instead of it's availableLogicalWidth
+        so that we include the flexbox's border and padding.
+        
+        Also, change all uses of availableLogicalWidth to contentLogicalWidth.
+        The former takes multi-column into account. Multi-column flexboxes don't
+        make any sense, so there's no point in calling availableLogicalWidth.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::flowAwareLogicalWidth):
+        (WebCore::RenderFlexibleBox::flowAwareContentLogicalWidth):
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidth):
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithmInlineDirection):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildrenInlineDirection):
+        * rendering/RenderFlexibleBox.h:
+
+2011-09-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96139.
+        http://trac.webkit.org/changeset/96139
+        https://bugs.webkit.org/show_bug.cgi?id=68933
+
+        Broke table-percent-height.html on Mac bots (Requested by
+        mwenge2 on #webkit).
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+        * rendering/RenderBox.h:
+
+2011-09-27  Tim Horton  <timothy_horton@apple.com>
+
+        REGRESSION(65665): Pattern size being clamped to SVG size can prevent transformed elements from being fully covered by userSpaceOnUse patterns
+        https://bugs.webkit.org/show_bug.cgi?id=67700
+        <rdar://problem/10125102>
+
+        Reviewed by Darin Adler.
+
+        Clamp all resources to the same size, 4096x4096 (arbitrarily chosen), instead of to the size
+        of the <svg> element. This fixes the case where a transformed element displays part of a resource
+        outside of the size of the <svg> element.
+
+        When drawing an oversized pattern into its tile image, scale the content down to fit. When drawing
+        the tile image to the screen, scale it back up to fit the expected area. This will cause pixelation
+        when patterns are over the 4k limit.
+
+        Tests: svg/custom/transformed-pattern-clamp-svg-root.svg, svg/custom/oversized-pattern-scale.svg
+
+        * rendering/svg/RenderSVGResourceClipper.cpp:
+        (WebCore::RenderSVGResourceClipper::applyClippingToContext):
+        * rendering/svg/RenderSVGResourceGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+        * rendering/svg/RenderSVGResourceMasker.cpp:
+        (WebCore::RenderSVGResourceMasker::applyResource):
+        * rendering/svg/RenderSVGResourcePattern.cpp:
+        (WebCore::RenderSVGResourcePattern::applyResource):
+        (WebCore::RenderSVGResourcePattern::createTileImage):
+        * rendering/svg/RenderSVGResourcePattern.h:
+        * rendering/svg/SVGImageBufferTools.cpp:
+        (WebCore::SVGImageBufferTools::clampedAbsoluteTargetRect):
+        * rendering/svg/SVGImageBufferTools.h:
+
+2011-09-27  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10098679> Assertion failure in RenderLayer::paintPaginatedChildLayer()
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/dynamic/layer-no-longer-paginated.html
+
+        FrameView::layout() calls adjustViewSize() before calling RenderLayer::updateLayerPositions().
+        The former may trigger painting with a layer tree that is not entirely up-to-date. Specifically,
+        the isPaginated() state of a layer may be incorrect, leading to the assertion in this bug. Instead
+        of asserting, return early and count on the upcoming updateLayerPositions() to repaint as needed.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintPaginatedChildLayer): Replaced the assertion with an early return.
+
+2011-09-27  Ojan Vafai  <ojan@chromium.org>
+
+        offsetTop/offsetLeft return the wrong values for horizontal-bt/vertical-rl writing modes
+        https://bugs.webkit.org/show_bug.cgi?id=68304
+
+        Reviewed by David Hyatt.
+
+        When grabbing the x/y values of the RenderBox, we need to take writing mode
+        flipping into account.
+
+        Test: fast/dom/offset-position-writing-modes.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::locationIncludingFlipping):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::yFlippedForWritingMode):
+        (WebCore::RenderBox::xFlippedForWritingMode):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::offsetLeft):
+        (WebCore::RenderBoxModelObject::offsetTop):
+
+2011-09-27  Tim Horton  <timothy_horton@apple.com>
+
+        Rapidly refreshing a feMorphology[erode] with r=0 can sometimes cause display corruption
+        https://bugs.webkit.org/show_bug.cgi?id=68816
+        <rdar://problem/10186468>
+
+        Reviewed by Simon Fraser.
+
+        If a filter returns without writing into its result buffer, make sure to return an cleared buffer.
+
+        Test: svg/filters/feMorphology-zero-radius.svg
+
+        * platform/graphics/filters/FEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * platform/graphics/filters/FETurbulence.cpp:
+        (WebCore::FETurbulence::apply):
+
+2011-09-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        CompositeEditCommand::prune should remove subtree at once
+        https://bugs.webkit.org/show_bug.cgi?id=68866
+
+        Reviewed by Darin Adler.
+
+        Extracted the logic to find the highest ancestor to remove as highestNodeToRemoveInPruning from prune.
+        This reduces the number of node removals from O(n) to O(1) where n is the depth of the tree.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::hasARenderedDescendant): Takes excludedNode in addition to node. excludedNode is used to ignore
+        the child node from which we climbed up the tree in highestNodeToRemoveInPruning.
+        (WebCore::highestNodeToRemoveInPruning): Extracted from prune.
+        (WebCore::CompositeEditCommand::prune):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+
+2011-09-27  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68922
+
+        Paginated floats should not grow the height of a block when they don't end
+        up being tied to a line. Floats encountered in skipLeadingWhitespace that
+        paginate can't immediately grow the height of the block, since there may not
+        end up being any actual line content. We only want to push the height of the
+        block down if we have actual line content that we want to keep with the
+        float.
+        
+        Make positionNewFloatOnLine check if the line is empty or not, and if it is,
+        it just puts the desired pagination strut into LineInfo. If and when actual
+        line content is encountered and setEmpty becomes false, we'll grow the block
+        height then.
+        
+        Reviewed by Dan Bernstein.
+
+        Added fast/multicol/float-paginate-empty-lines.html and
+        fast/regions/webkit-flow-double-pagination-float-push.html.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::LineWidth):
+        (WebCore::LineWidth::fitsOnLine):
+        (WebCore::LineWidth::currentWidth):
+        (WebCore::LineWidth::uncommittedWidth):
+        (WebCore::LineWidth::committedWidth):
+        (WebCore::LineWidth::availableWidth):
+        (WebCore::LineWidth::addUncommittedWidth):
+        (WebCore::LineWidth::commit):
+        (WebCore::LineWidth::computeAvailableWidthFromLeftAndRight):
+        (WebCore::LineWidth::updateAvailableWidth):
+        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded):
+        (WebCore::LineWidth::applyOverhang):
+        (WebCore::LineWidth::fitBelowFloats):
+        (WebCore::LineInfo::LineInfo):
+        (WebCore::LineInfo::floatPaginationStrut):
+        (WebCore::LineInfo::setEmpty):
+        (WebCore::LineInfo::setFloatPaginationStrut):
+        (WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace):
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        (WebCore::RenderBlock::positionNewFloatOnLine):
+
+2011-09-27  Dean Jackson  <dino@apple.com>
+
+        Add 'filter' value to RenderStyle
+        https://bugs.webkit.org/show_bug.cgi?id=68471
+
+        Reviewed by Simon Fraser.
+
+        Add a filter property to RenderStyle when ENABLE(CSS_FILTERS)
+        is turned on. Similar to -webkit-transform, -webkit-filter is a
+        list of FilterOperations, each identifying what type of operation
+        it is. This change simply adds the basic objects, it does not
+        parse the property to generate the list.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FilterOperation.h: Added.
+        (WebCore::FilterOperation::~FilterOperation):
+        (WebCore::FilterOperation::operator!=):
+        (WebCore::FilterOperation::getOperationType):
+        (WebCore::FilterOperation::isSameType):
+        (WebCore::FilterOperation::FilterOperation):
+        (WebCore::ReferenceFilterOperation::create):
+        (WebCore::ReferenceFilterOperation::reference):
+        (WebCore::ReferenceFilterOperation::operator==):
+        (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
+        (WebCore::BasicColorMatrixFilterOperation::create):
+        (WebCore::BasicColorMatrixFilterOperation::amount):
+        (WebCore::BasicColorMatrixFilterOperation::operator==):
+        (WebCore::BasicColorMatrixFilterOperation::BasicColorMatrixFilterOperation):
+        (WebCore::BasicComponentTransferFilterOperation::create):
+        (WebCore::BasicComponentTransferFilterOperation::amount):
+        (WebCore::BasicComponentTransferFilterOperation::operator==):
+        (WebCore::BasicComponentTransferFilterOperation::BasicComponentTransferFilterOperation):
+        (WebCore::GammaFilterOperation::create):
+        (WebCore::GammaFilterOperation::amplitude):
+        (WebCore::GammaFilterOperation::exponent):
+        (WebCore::GammaFilterOperation::offset):
+        (WebCore::GammaFilterOperation::operator==):
+        (WebCore::GammaFilterOperation::GammaFilterOperation):
+        (WebCore::BlurFilterOperation::create):
+        (WebCore::BlurFilterOperation::stdDeviationX):
+        (WebCore::BlurFilterOperation::stdDeviationY):
+        (WebCore::BlurFilterOperation::operator==):
+        (WebCore::BlurFilterOperation::BlurFilterOperation):
+        (WebCore::SharpenFilterOperation::create):
+        (WebCore::SharpenFilterOperation::radius):
+        (WebCore::SharpenFilterOperation::threshold):
+        (WebCore::SharpenFilterOperation::amount):
+        (WebCore::SharpenFilterOperation::operator==):
+        (WebCore::SharpenFilterOperation::SharpenFilterOperation):
+        (WebCore::DropShadowFilterOperation::create):
+        (WebCore::DropShadowFilterOperation::shadow):
+        (WebCore::DropShadowFilterOperation::operator==):
+        (WebCore::DropShadowFilterOperation::DropShadowFilterOperation):
+        * platform/graphics/filters/FilterOperations.cpp: Added.
+        (WebCore::FilterOperations::FilterOperations):
+        (WebCore::FilterOperations::operator==):
+        * platform/graphics/filters/FilterOperations.h: Added.
+        (WebCore::FilterOperations::operator!=):
+        (WebCore::FilterOperations::clear):
+        (WebCore::FilterOperations::operations):
+        (WebCore::FilterOperations::size):
+        (WebCore::FilterOperations::at):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::filter):
+        (WebCore::InheritedFlags::hasFilter):
+        (WebCore::InheritedFlags::setFilter):
+        (WebCore::InheritedFlags::initialFilter):
+        * rendering/style/StyleAllInOne.cpp: Added include of new StyleFilterData.
+        * rendering/style/StyleFilterData.cpp: Added.
+        (WebCore::StyleFilterData::StyleFilterData):
+        (WebCore::StyleFilterData::operator==):
+        * rendering/style/StyleFilterData.h: Added.
+        (WebCore::StyleFilterData::create):
+        (WebCore::StyleFilterData::copy):
+        (WebCore::StyleFilterData::operator!=):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h: New filter DataRef.
+
+2011-09-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRenderChromium asserts about leaking textures.
+        https://bugs.webkit.org/show_bug.cgi?id=68190
+
+        Reviewed by Kenneth Russell.
+
+        This introduces an interface TextureAllocator that the TextureManager uses to allocate/deallocate textures.
+        This means that TextureManager does not need to depend directly on GraphicsContext3D, other than for the format
+        enum type, making it more testable.  It also allows us to track the allocations by subclassing TextureAllocator
+        to make sure we aren't leaking any textures.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::releaseRenderSurfaceTextures):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::useRenderSurface):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::renderSurfaceTextureAllocator):
+        (WebCore::LayerRendererChromium::contentsTextureAllocator):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.cpp:
+        (WebCore::LayerTextureUpdaterBitmap::updateTextureRect):
+        (WebCore::LayerTextureUpdaterSkPicture::updateTextureRect):
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.h:
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        (WebCore::ManagedTexture::bindTexture):
+        (WebCore::ManagedTexture::framebufferTexture2D):
+        * platform/graphics/chromium/ManagedTexture.h:
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::memoryUseBytes):
+        (WebCore::TextureManager::deleteEvictedTextures):
+        (WebCore::TextureManager::evictAndDeleteAllTextures):
+        (WebCore::TextureManager::removeTexture):
+        (WebCore::TextureManager::allocateTexture):
+        (WebCore::TextureManager::requestTexture):
+        * platform/graphics/chromium/TextureManager.h:
+        (WebCore::TextureAllocator::~TextureAllocator):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp: Added.
+        (WebCore::TrackingTextureAllocator::TrackingTextureAllocator):
+        (WebCore::TrackingTextureAllocator::~TrackingTextureAllocator):
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        * platform/graphics/chromium/TrackingTextureAllocator.h: Copied from Source/WebCore/platform/graphics/chromium/ManagedTexture.h.
+        (WebCore::TrackingTextureAllocator::create):
+        (WebCore::TrackingTextureAllocator::currentMemoryUseBytes):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::updateCompositorResources):
+        (WebCore::VideoLayerChromium::updateTexture):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::deleteContentsTexturesOnCCThread):
+        (WebCore::CCLayerTreeHost::commitToOnCCThread):
+        (WebCore::CCLayerTreeHost::didRecreateGraphicsContext):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::contentsTextureAllocator):
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawSurface):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setNeedsCommit):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::recreateContextIfNeeded):
+        (WebCore::CCSingleThreadProxy::commitIfNeeded):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::commitOnCCThread):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnCCThread):
+
+2011-06-28  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Replaced elements squeezed when width is specified as percentage inside a table with Auto layout
+        https://bugs.webkit.org/show_bug.cgi?id=29447
+
+        If inserting a 'replaced' element (e.g. image, plugin) in a table cell that is not descendant from
+        a block with fixed layout then do not squeeze the element, let it use its intrinsic width and height.
+
+        Test: fast/replaced/table-percent-width.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::avoidSqueezingWidth):
+        (WebCore::avoidSqueezingHeight):
+        (WebCore::RenderBox::containingBlockReplacedLogicalWidthForContent):
+        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+        * rendering/RenderBox.h:
+
+2011-09-27  Simon Fraser  <simon.fraser@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=67858
+
+        Roll r96070 back in now that the crash has been fixed in r96130.
+
+        Reviewed by Darin Adler.
+        
+        When non-overlay scrollbars are hidden on a composited iframe, nothing invalidated
+        the scrollbar areas or the scroll corner, so the scrollbars appear to remain.
+        
+        Fix by invalidating the scrollbars and scroll corner when they are removed. Invalidation
+        on scrollbar creation appears to happen via updating the scrollbar style.
+
+        Tested by compositing/iframes/repaint-after-losing-scrollbars.html which no longer shows
+        stale scrollbars when run manually, even though the green squares are missing from the
+        pixel result (bug 67878).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateScrollCorner): Pass the corner rect into invalidateScrollCorner().
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar): Invalidate the scrollbar area if hiding it.
+        (WebCore::ScrollView::setHasVerticalScrollbar): Ditto.
+        (WebCore::ScrollView::updateScrollbars): In the case where both scrollbars are going away,
+        compute the scroll corner rect while we still have scrollbars, and then invalidate it
+        explicitly. (updateScrollCorner() doesn't, because it doesn't have access to the old corner
+        rect.)
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::invalidateScrollCorner): Pass the rect in, because we can't
+        compute it in the case where the scrollbars are going away.
+        * platform/ScrollableArea.h: Pass in a rect to invalidateScrollCorner(), which matches
+        invalidateScrollbar().
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::destroyRootLayer): Pass the corner rect into invalidateScrollCorner().
+        * rendering/RenderScrollbarPart.cpp: Ditto.
+        (WebCore::RenderScrollbarPart::imageChanged): Ditto.
+
+2011-09-27  Mihai Parparita  <mihaip@chromium.org>
+
+        Fix Chromium Mac build after r96130.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layerForOverhangAreas):
+
+2011-09-27  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        Autofocus on readonly inputs does not focus the element.
+        https://bugs.webkit.org/show_bug.cgi?id=24092
+
+        Reviewed by Ryosuke Niwa.
+
+        Readonly input elements should be autofocusable. Removed the check.
+
+        Tests: fast/forms/autofocus-readonly-attribute.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::shouldAutofocus):
+
+2011-09-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Clean up how FrameView accesses the RenderView
+        https://bugs.webkit.org/show_bug.cgi?id=68914
+
+        Reviewed by Sam Weinig.
+
+        Clean up how FrameView accesses the content renderer of its
+        frame. Previously, this was done in several different ways,
+        only some of which did null-checking.
+        
+        Use an inline method to avoid having to expose Frame
+        in the header.
+        
+        Standardize the terminology to use 'root' for this RenderView.
+
+        * page/FrameView.cpp:
+        (WebCore::rootRenderer):
+        (WebCore::FrameView::setFrameRect):
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::updateCompositingLayers):
+        (WebCore::FrameView::clearBackingStores):
+        (WebCore::FrameView::restoreBackingStores):
+        (WebCore::FrameView::layerForHorizontalScrollbar):
+        (WebCore::FrameView::layerForVerticalScrollbar):
+        (WebCore::FrameView::layerForScrollCorner):
+        (WebCore::FrameView::layerForOverhangAreas):
+        (WebCore::FrameView::syncCompositingStateForThisFrame):
+        (WebCore::FrameView::hasCompositedContent):
+        (WebCore::FrameView::enterCompositingMode):
+        (WebCore::FrameView::isSoftwareRenderable):
+        (WebCore::FrameView::didMoveOnscreen):
+        (WebCore::FrameView::willMoveOffscreen):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::embeddedContentBox):
+        (WebCore::FrameView::contentsInCompositedLayer):
+        (WebCore::FrameView::scrollContentsFastPath):
+        (WebCore::FrameView::scrollContentsSlowPath):
+        (WebCore::FrameView::maintainScrollPositionAtAnchor):
+        (WebCore::FrameView::scrollPositionChanged):
+        (WebCore::FrameView::repaintFixedElementsAfterScrolling):
+        (WebCore::FrameView::visibleContentsResized):
+        (WebCore::FrameView::scheduleRelayoutOfSubtree):
+        (WebCore::FrameView::needsLayout):
+        (WebCore::FrameView::setNeedsLayout):
+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::updateControlTints):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::forceLayoutForPagination):
+        (WebCore::FrameView::adjustPageHeightDeprecated):
+        (WebCore::FrameView::isVerticalDocument):
+        (WebCore::FrameView::isFlippedDocument):
+
+2011-09-27  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AXObjectCache cleared unnecessarily when non-top Document is detached.
+        https://bugs.webkit.org/show_bug.cgi?id=68636
+
+        Reviewed by Chris Fleizach.
+
+        Test: accessibility/deleting-iframe-destroys-axcache.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+
+2011-09-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96108, r96111, r96113, and r96116.
+        http://trac.webkit.org/changeset/96108
+        http://trac.webkit.org/changeset/96111
+        http://trac.webkit.org/changeset/96113
+        http://trac.webkit.org/changeset/96116
+        https://bugs.webkit.org/show_bug.cgi?id=68913
+
+        Wait for working Qt5 (Requested by ossy on #webkit).
+
+        * WebCore.pri:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+
+2011-09-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix ENABLE(SQL_DATABASE)=0 build after r95919
+        https://bugs.webkit.org/show_bug.cgi?id=68902
+
+        r95919 enabled OFFLINE_WEB_APPLICATIONS by default and
+        it needs SQLite stuff even if ENABLE_SQL_DATABASE=0.
+
+        Reviewed by Adam Barth.
+
+        * platform/sql/SQLiteAuthorizer.cpp:
+        * platform/sql/SQLiteDatabase.cpp:
+        * platform/sql/SQLiteFileSystem.cpp:
+        * platform/sql/SQLiteStatement.cpp:
+        * platform/sql/SQLiteTransaction.cpp:
+        * storage/DatabaseAuthorizer.cpp:
+
+2011-09-27  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Crash because CSSPrimitiveValue::computeLengthDouble assumes fontMetrics are available
+        https://bugs.webkit.org/show_bug.cgi?id=66291
+
+        Reviewed by Darin Adler.
+
+        Test: fast/canvas/crash-set-font.html
+
+        This is Yet Another Missing updateFont (similar to bug 57756 and likely others). Here the issue is that
+        applying one of the font properties could mutate the parent style's font if m_parentStyle == m_style.
+        We would then query the newly created font when applying CSSPropertyFontSize, which has no font fallback
+        list as Font::update was never called.
+
+        The right fix would be to refactor of how we handle fonts to avoid such manual updates (see bug 62390).
+        Until this happens, it is better not to crash.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Added updateFont() here as the fonts could have been
+        mutated by the previous property change. Also added a comment explaining why it is safe to do it
+        this way.
+
+2011-09-27  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Code cleanup: remove unused boundingRect/visibleRect calculations
+        https://bugs.webkit.org/show_bug.cgi?id=68897
+
+        Reviewed by Andreas Kling.
+
+        No new functionality so no new tests.
+
+        * platform/graphics/texmap/TextureMapperNode.cpp:
+        (WebCore::TextureMapperNode::computeAllTransforms):
+        (WebCore::TextureMapperNode::computeTiles):
+        (WebCore::TextureMapperNode::syncCompositingState):
+        * platform/graphics/texmap/TextureMapperNode.h:
+
+2011-09-27  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap][Qt] Refactor texture-upload to allow direct chunk update
+        https://bugs.webkit.org/show_bug.cgi?id=68808
+
+        Add a function to BitmapTexture for direct pixel updates.
+        Modify BitmapTextureGL::endPaint to use that function. Since the BGRA
+        to RGBA swizzling is done inside that function, there's no need for the 
+        RGBA32PremultipliedBuffer class to contain such function. Also,
+        RGBA32PremultipliedBuffer was renamed to BGRA32PremultipliedBuffer, correcting
+        an old mistake.
+
+        Reviewed by Andreas Kling.
+
+        No new tests. Existing tests in LayoutTests/compositing test this.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::beginPaint):
+        (WebCore::BitmapTextureGL::endPaint):
+        (WebCore::swizzleBGRAToRGBA):
+        (WebCore::BitmapTextureGL::updateContents):
+        * platform/graphics/opengl/TextureMapperGL.h:
+        (WebCore::BGRA32PremultimpliedBuffer::~BGRA32PremultimpliedBuffer):
+        * platform/graphics/qt/TextureMapperQt.cpp:
+        (WebCore::BitmapTextureQt::updateContents):
+        (WebCore::BGRA32PremultimpliedBufferQt::data):
+        (WebCore::BGRA32PremultimpliedBuffer::create):
+        * platform/graphics/qt/TextureMapperQt.h:
+        * platform/graphics/texmap/TextureMapper.h:
+
+2011-09-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix build against Qt5 after refactor of widgets out of QtGUi
+
+        QWidget and friends now live in the QtWidgets library. We update
+        includes in implementation files and private headers to us the
+        non-module-prefixed path, and leave the lookup for the include
+        path. For public headers we have to ifdef the includes as the
+        user might now have the modules we need in his QT config.
+
+        Finally, QSGCanvas is no longer a QWidget but a QWindow, so we
+        have to update our code and use windowHandle() for setting the
+        parent relationships.
+
+        https://bugs.webkit.org/show_bug.cgi?id=68687
+
+        Reviewed by Andreas Kling.
+
+        * WebCore.pri:
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+
+2011-09-27  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: split DOM.attributesUpdated into attributeModified and attributeRemoved.
+        Send attribute name and value within the event.
+        https://bugs.webkit.org/show_bug.cgi?id=68613
+
+        Reviewed by Yury Semikhatsky.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::removeAttribute):
+        * inspector/Inspector.draft-01.json:
+        * inspector/Inspector.json:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::didModifyDOMAttr):
+        (WebCore::InspectorDOMAgent::didRemoveDOMAttr):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didModifyDOMAttrImpl):
+        (WebCore::InspectorInstrumentation::didRemoveDOMAttrImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::didModifyDOMAttr):
+        (WebCore::InspectorInstrumentation::didRemoveDOMAttr):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._addAttribute):
+        (WebInspector.DOMNode.prototype._setAttribute):
+        (WebInspector.DOMNode.prototype._removeAttribute):
+        (WebInspector.DOMAgent.prototype._attributeModified):
+        (WebInspector.DOMAgent.prototype._attributeRemoved):
+        (WebInspector.DOMAgent.prototype._inlineStyleInvalidated):
+        (WebInspector.DOMAgent.prototype._loadNodeAttributes):
+        (WebInspector.DOMDispatcher.prototype.attributeModified):
+        (WebInspector.DOMDispatcher.prototype.attributeRemoved):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype._attributesUpdated):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane):
+        (WebInspector.MetricsSidebarPane.prototype._attributesUpdated):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylesSidebarPane.prototype._attributesModified):
+        (WebInspector.StylesSidebarPane.prototype._attributesRemoved):
+        (WebInspector.StylesSidebarPane.prototype._styleInvalidated):
+        (WebInspector.StylePropertyTreeElement.prototype.event):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/validate-protocol-compatibility:
+
+2011-09-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96070 and r96075.
+        http://trac.webkit.org/changeset/96070
+        http://trac.webkit.org/changeset/96075
+        https://bugs.webkit.org/show_bug.cgi?id=68893
+
+        WK2 tests started crashing after r96070 for SL and Qt
+        (Requested by torarne on #webkit).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateScrollCorner):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::invalidateScrollCorner):
+        * platform/ScrollableArea.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::destroyRootLayer):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::imageChanged):
+
+2011-09-27  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: JS exception upon clicking on "Word Wrap" checkbox in Settings screen
+        https://bugs.webkit.org/show_bug.cgi?id=68888
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._domWordWrapSettingChanged):
+
+2011-09-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: migrate RawSourceCode clients to SourceMapping class.
+        https://bugs.webkit.org/show_bug.cgi?id=68524
+
+        Clients should use uiSourceCode(), rawLocationToUILocation(), uiLocationToRawLocation() methods of SourceMapping class.
+        Initially, RawSourceCode may not have associated SourceMapping, so it is natural to extract this methods and associated state to a separate class.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype._materializeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._breakpointDebuggerLocationChanged):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.linkifyLocation.updateAnchor):
+        (WebInspector.DebuggerPresentationModel.prototype.linkifyLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._updateSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreConsoleMessages):
+        (WebInspector.DebuggerPresentationModel.prototype._consoleMessageAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._createPresentationMessage):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.PresentationCallFrame.prototype.get url):
+        (WebInspector.PresentationCallFrame.prototype.sourceLine.sourceMappingUpdated):
+        (WebInspector.PresentationCallFrame.prototype.sourceLine):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.canSetContent):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.setContent):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.RawSourceCode.prototype.get sourceMapping):
+
+2011-09-27  Vineet Chaudhary  <vineet.chaudhary@motorola.com>
+
+        wrap attribute of textarea element cannot be accessed by JavaScript.
+        https://bugs.webkit.org/show_bug.cgi?id=68592
+
+        Reviewed by Kent Tamura.
+
+        Added JS interface for wrap attribute to HTMLTextAreaElement.idl.
+
+        Test: fast/forms/textarea-wrap-attribute.html
+
+        * html/HTMLTextAreaElement.idl:
+
+2011-09-27  Xan Lopez  <xlopez@igalia.com>
+
+        [GTK] Add compatibility methods for DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=68884
+
+        Reviewed by Philippe Normand.
+
+        Add compatibility methods for our DOM bindings.
+
+        * bindings/gobject/WebKitDOMCustom.cpp:
+        (webkit_dom_blob_slice): alias to the new method name.
+        (webkit_dom_html_form_element_dispatch_form_change): this was
+        removed from WebCore, so just print a warning about it.
+        (webkit_dom_html_form_element_dispatch_form_input): ditto.
+        * bindings/gobject/WebKitDOMCustom.h:
+
+2011-09-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Encapsulate m_firstNodeInserted and m_lastLeafInserted in node insertion logic
+        https://bugs.webkit.org/show_bug.cgi?id=68875
+
+        Reviewed by Kent Tamura.
+
+        Added InsertedNode class inside ReplaceSelection to encapsulate m_firstNodeInserted and m_lastLeafInserted.
+        Deployed it in removeRedundantStylesAndKeepStyleSpanInline, doApply, and insertAsListItems of ReplaceSelectionCommand.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
+        * editing/ReplaceSelectionCommand.h:
+        (WebCore::ReplaceSelectionCommand::InsertedNodes::respondToNodeInsertion):
+        (WebCore::ReplaceSelectionCommand::InsertedNodes::willRemoveNode):
+        (WebCore::ReplaceSelectionCommand::InsertedNodes::firstNodeInserted):
+        (WebCore::ReplaceSelectionCommand::InsertedNodes::lastLeafInserted):
+        (WebCore::ReplaceSelectionCommand::InsertedNodes::pastLastLeaf):
+        * editing/htmlediting.cpp:
+        (WebCore::updatePositionForNodeRemoval): Moved from DeleteSelectionCommand.cpp.
+        * editing/htmlediting.h:
+
+2011-09-27  Arun Patole  <bmf834@motorola.com>
+
+        Audio element doesn't emit the 'playing' event every time it starts playing, after it has finished playing.
+        https://bugs.webkit.org/show_bug.cgi?id=60972
+
+        Reviewed by Philippe Normand.
+
+        The paused attribute should be set to true and the media element should emit a 'paused' at the end of playback.
+        WHATWG revision r6562: http://html5.org/tools/web-apps-tracker?from=6561&to=6562
+
+        Test: media/media-element-play-after-eos.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): set m_paused to true and schedule 'pause' event when playback ended.
+
+2011-09-27  Rakesh KN  <rakesh.kn@motorola.com>
+
+        <input> with autofocus doesn't lose focus when it has a certain onblur listener
+        https://bugs.webkit.org/show_bug.cgi?id=68513
+
+        Reviewed by Kent Tamura.
+
+        Test: fast/forms/autofocus-focus-only-once.html
+
+        These changes make sure that an element is focused only once when autofocus attribute is used.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::shouldAutofocus):
+        (WebCore::HTMLFormControlElement::attach):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::hasAutofocused):
+        (WebCore::HTMLFormControlElement::setAutofocused):
+
+2011-09-26  Kentaro Hara  <haraken@chromium.org>
+
+        Implement PopStateEvent.state with SerializedScriptValue and ScriptValue
+        https://bugs.webkit.org/show_bug.cgi?id=68345
+
+        Reviewed by Adam Barth.
+
+        Previously, the following test cases fail or crash:
+
+        - shouldBe("new PopStateEvent('eventType', { state: object1 }).state", "object1") -> FAIL
+        - new PopStateEvent('eventType', { state: document }).state -> CRASH in DRT
+
+        This is because PopStateEvent.state is implemented not as ScriptValue but as SerializedScriptValue.
+        However, we cannot simply change the type of PopStateEvent.state to ScriptValue,
+        since PopStateEvent can be constructed in the context that does not know ScriptValue.
+        For example, Document.cpp calls PopStateEvent::create() with SerializedScriptValue
+        popped from HistoryItem, but we cannot deserialize the SerializedScriptValue into
+        the corresponding ScriptValue here because the deserialization requires ExecState.
+        In other words, although we want to store PopStateEvent.state by ScriptValue internally,
+        PopStateEvent still needs to provide an API to construct it with SerializedScriptValue.
+        With these observations, this patch makes the following changes:
+
+        - If PopStateEvent is constructed with ScriptValue, it is stored as ScriptValue internally.
+        When PopStateEvent.state is called, the ScriptValue is returned.
+        - If PopStateEvent is constructed with SerializedScriptValue, it is stored as
+        SerializedScriptValue internally (since we cannot deserialize it into ScriptValue
+        at this point). When PopStateEvent.state is called, the SerializedScriptValue is
+        deserialized into the corresponding ScriptValue, and the ScriptValue is returned.
+
+        Tests: fast/events/constructors/pop-state-event-constructor.html
+               fast/events/fire-popstate-event.html
+
+        * GNUmakefile.list.am: Added JSPopStateEventCustom.cpp.
+        * UseJSC.cmake: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSBindingsAllInOne.cpp: Ditto.
+        * bindings/js/JSPopStateEventCustom.cpp:
+        (WebCore::JSPopStateEvent::state): Custom getter for PopStateEvent.state.
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        (WebCore::V8PopStateEvent::stateAccessorGetter): Custom getter for PopStateEvent.state.
+        * dom/PopStateEvent.cpp:
+        (WebCore::PopStateEventInit::PopStateEventInit): Added initialization code for PopStateEvent.m_state.
+        (WebCore::PopStateEvent::PopStateEvent): Ditto.
+        (WebCore::PopStateEvent::create): Ditto.
+        (WebCore::PopStateEvent::initPopStateEvent): Ditto.
+        * dom/PopStateEvent.h:
+        (WebCore::PopStateEvent::serializedState): Getter.
+        (WebCore::PopStateEvent::state): Getter.
+        * dom/PopStateEvent.idl: Change the type of 'stateArg' and 'state' to DOMObject. Added [CustomGetter] to 'state'.
+
+2011-09-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Pixel result shows that compositing/iframes/repaint-after-losing-scrollbars.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=67858
+
+        Reviewed by Darin Adler.
+        
+        When non-overlay scrollbars are hidden on a composited iframe, nothing invalidated
+        the scrollbar areas or the scroll corner, so the scrollbars appear to remain.
+        
+        Fix by invalidating the scrollbars and scroll corner when they are removed. Invalidation
+        on scrollbar creation appears to happen via updating the scrollbar style.
+
+        Tested by compositing/iframes/repaint-after-losing-scrollbars.html which no longer shows
+        stale scrollbars when run manually, even though the green squares are missing from the
+        pixel result (bug 67878).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateScrollCorner): Pass the corner rect into invalidateScrollCorner().
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar): Invalidate the scrollbar area if hiding it.
+        (WebCore::ScrollView::setHasVerticalScrollbar): Ditto.
+        (WebCore::ScrollView::updateScrollbars): In the case where both scrollbars are going away,
+        compute the scroll corner rect while we still have scrollbars, and then invalidate it
+        explicitly. (updateScrollCorner() doesn't, because it doesn't have access to the old corner
+        rect.)
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::invalidateScrollCorner): Pass the rect in, because we can't
+        compute it in the case where the scrollbars are going away.
+        * platform/ScrollableArea.h: Pass in a rect to invalidateScrollCorner(), which matches
+        invalidateScrollbar().
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::destroyRootLayer): Pass the corner rect into invalidateScrollCorner().
+        * rendering/RenderScrollbarPart.cpp: Ditto.
+        (WebCore::RenderScrollbarPart::imageChanged): Ditto.
+
+2011-09-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Translucent scrollbars on composited layers render incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=58515
+
+        Reviewed by Sam Weinig.
+        
+        Scrollbars in composited elements were getting drawn twice,
+        because r41203 moved the call to paintOverflowControls() out of
+        RenderLayer::paintLayer(), but forgot to change RenderLayerBacking::paintIntoLayer().
+
+        Test: compositing/scrollbar-painting.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2011-09-26  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Make CCThreadProxy draw
+        https://bugs.webkit.org/show_bug.cgi?id=67417
+
+        Update the CCThreadProxy to correctly implement the CCProxy
+        interface, do all the right committing and updating steps, and
+        draw a picture on the screen.
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/IntRect.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::~LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::enabled):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::~CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::commitTo):
+        (WebCore::CCLayerTreeHost::commitComplete):
+        (WebCore::CCLayerTreeHost::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::~CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::finishAllRendering):
+        (WebCore::CCSingleThreadProxy::setNeedsCommit):
+        (WebCore::CCSingleThreadProxy::commitIfNeeded):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::~CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::drawLayersAndReadbackOnCCThread):
+        (WebCore::CCThreadProxy::finishAllRendering):
+        (WebCore::CCThreadProxy::isStarted):
+        (WebCore::CCThreadProxy::setNeedsCommit):
+        (WebCore::CCThreadProxy::setNeedsCommitAndRedraw):
+        (WebCore::CCThreadProxy::setNeedsRedraw):
+        (WebCore::CCThreadProxy::start):
+        (WebCore::CCThreadProxy::stop):
+        (WebCore::CCThreadProxy::finishAllRenderingOnCCThread):
+        (WebCore::CCThreadProxy::createBeginFrameAndCommitTaskOnCCThread):
+        (WebCore::CCThreadProxy::beginFrameAndCommit):
+        (WebCore::CCThreadProxy::commitOnCCThread):
+        (WebCore::CCThreadProxy::scheduleDrawTaskOnCCThread):
+        (WebCore::CCThreadProxy::drawLayersAndPresentOnCCThread):
+        (WebCore::CCThreadProxy::drawLayersOnCCThread):
+        (WebCore::CCThreadProxy::updateSchedulerStateOnCCThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2011-09-26  Adam Klein  <adamk@chromium.org>
+
+        [MutationObservers] implement MutationRecord
+        https://bugs.webkit.org/show_bug.cgi?id=68824
+
+        Reviewed by Darin Adler.
+
+        Implements MutationRecord as specified in the thread at
+        http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/1622.html,
+        including some minor naming changes from the original proposal.
+
+        This is a small part of the MutationObserver API, see
+        https://bugs.webkit.org/show_bug.cgi?id=68729 for the metabug covering
+        this feature.
+
+        No new tests as this isn't yet exposed to the platform.
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/MutationRecord.cpp: Added.
+        (WebCore::MutationRecord::createChildList):
+        (WebCore::MutationRecord::createAttributes):
+        (WebCore::MutationRecord::createCharacterData):
+        (WebCore::MutationRecord::MutationRecord):
+        (WebCore::MutationRecord::~MutationRecord):
+        * dom/MutationRecord.h: Added.
+        (WebCore::MutationRecord::target):
+        (WebCore::MutationRecord::addedNodes):
+        (WebCore::MutationRecord::removedNodes):
+        (WebCore::MutationRecord::previousSibling):
+        (WebCore::MutationRecord::nextSibling):
+        (WebCore::MutationRecord::attributeName):
+        (WebCore::MutationRecord::attributeNamespace):
+        (WebCore::MutationRecord::oldValue):
+        (WebCore::MutationRecord::setOldValue):
+        * dom/MutationRecord.idl: Added.
+
+2011-09-26  Kentaro Hara  <haraken@chromium.org>
+
+        Implement a CloseEvent constructor for V8
+        https://bugs.webkit.org/show_bug.cgi?id=68793
+
+        Reviewed by Adam Barth.
+
+        Test: fast/events/constructors/close-event-constructor.html
+
+        * bindings/v8/OptionsObject.cpp:
+        (WebCore::OptionsObject::getKey): Just removed an extra space.
+        (WebCore::OptionsObject::getKeyValue): Returns an unsigned short value corresponding to the given key.
+        * bindings/v8/OptionsObject.h:
+        * bindings/v8/custom/V8EventConstructors.cpp: Added the CloseEvent constructor.
+        * websockets/CloseEvent.idl: Added a 'V8CustomConstructor' attribute.
+
+2011-09-26  Nate Chapin  <japhet@chromium.org>
+
+        Clean up CachedResource::load(). Collapse its
+        logic into a single callsite, taking just a
+        CachedResourceLoader and a ResourceLoaderOptions.
+
+        1. Its 'incremental' parameter is redundant.
+        2. With 'incremental' removed, the SecurityCheckPolicy is the only
+           parameter difference between the CachedResource::load() variants.
+           Making it a part of ResourceLoaderOptions removes yet another random
+           enum that is passed around individually.
+        3. We currently have to call setResourceLoaderOptions() before load() on a
+           new CachedResource, so we should just take the ResourceLoaderOptions in load().
+
+        https://bugs.webkit.org/show_bug.cgi?id=67443
+
+        Reviewed by Antti Koivisto.
+
+        No new tests, refactor only.
+
+        * loader/DocumentThreadableLoader.cpp:
+        * loader/FrameLoaderTypes.h: Move SecurityCheckPolicy to ResourceLoaderOptions.h.
+        * loader/MainResourceLoader.cpp:
+        * loader/NetscapePlugInStreamLoader.cpp:
+        * loader/ResourceLoadScheduler.cpp:
+        * loader/ResourceLoadScheduler.h:
+        * loader/ResourceLoader.cpp: Enforce SecurityCheckPolicy here instead of SubresourceLoader.
+        * loader/ResourceLoaderOptions.h: Store SecurityCheckPolicy on ResourceLoaderOptions.
+        * loader/SubresourceLoader.cpp:
+        * loader/SubresourceLoader.h:
+        * loader/cache/CachedFont.cpp:
+        * loader/cache/CachedFont.h:
+        * loader/cache/CachedImage.cpp:
+        * loader/cache/CachedImage.h:
+        * loader/cache/CachedResource.cpp:
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::defaultCachedResourceOptions): Define the default ResourceLoaderOptions for
+            CachedResource loads here instead of as a default parameter on requestResource().
+        * loader/cache/CachedResourceLoader.h:
+        * loader/cache/CachedResourceRequest.cpp:
+        (WebCore::CachedResourceRequest::didReceiveData): Remove m_incremental, since its purpose
+            is already enforced in the data() implementation of every CachedResource that doesn't want
+            incremental loads.
+        * loader/cache/CachedResourceRequest.h:
+
+2011-09-26  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Second half of IDBFactory.getDatabaseNames implementation
+        https://bugs.webkit.org/show_bug.cgi?id=68818
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/factory-basics.html
+
+        Adds ability to enumerate IndexedDB databases within an origin.
+
+        * bindings/v8/custom/V8IDBAnyCustom.cpp:
+        (WebCore::toV8):
+        * storage/IDBAny.cpp:
+        (WebCore::IDBAny::domStringList):
+        (WebCore::IDBAny::set):
+        * storage/IDBAny.h:
+        * storage/IDBBackingStore.h:
+        * storage/IDBCallbacks.h:
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::getDatabaseNames):
+        * storage/IDBFactory.h:
+        * storage/IDBFactory.idl:
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::getDatabaseNames):
+        (WebCore::IDBFactoryBackendImpl::open):
+        (WebCore::IDBFactoryBackendImpl::openBackingStore):
+        * storage/IDBFactoryBackendImpl.h:
+        * storage/IDBFactoryBackendInterface.h:
+        * storage/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::getDatabaseNames):
+        (WebCore::IDBLevelDBBackingStore::getObjectStores):
+        (WebCore::IDBLevelDBBackingStore::getIndexes):
+        * storage/IDBLevelDBBackingStore.h:
+        * storage/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::DatabaseNameKey::encodeMinKeyForOrigin):
+        (WebCore::IDBLevelDBCoding::DatabaseNameKey::encodeStopKeyForOrigin):
+        * storage/IDBLevelDBCoding.h:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        * storage/IDBRequest.h:
+        * storage/IDBSQLiteBackingStore.cpp:
+        (WebCore::IDBSQLiteBackingStore::getDatabaseNames):
+        * storage/IDBSQLiteBackingStore.h:
+
+2011-09-26  Tim Horton  <timothy_horton@apple.com>
+
+        <animateColor> applied to filtered ellipse does not update
+        https://bugs.webkit.org/show_bug.cgi?id=68457
+        <rdar://problem/10154777>
+
+        Reviewed by Darin Adler.
+
+        Invalidate the filter's cache when style changes take place so that style changes are respected.
+
+        Test: svg/filters/animate-fill.svg
+
+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::clientStyleChanged):
+        (WebCore::SVGResourcesCache::clientUpdatedFromElement):
+
+2011-09-26  Max Perepelitsyn  <pph34r@gmail.com>
+
+        Set but unused variables cleanup in v8 bindings (gcc 4.6)
+        https://bugs.webkit.org/show_bug.cgi?id=68079
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/websocket/tests/hybi/send-object-tostring-check.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::ConfigureV8TestMediaQueryListListenerTemplate):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::ConfigureV8TestObjTemplate):
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::addListener):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::V8HTMLOptionsCollection::lengthAccessorSetter):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::V8WebSocket::sendCallback):
+
+2011-09-26  Tony Chang  <tony@chromium.org>
+
+        switch the initial value of flex-order to 0
+        https://bugs.webkit.org/show_bug.cgi?id=68820
+
+        The spec changed from having an initial value of 1 to 0.
+
+        Reviewed by Ojan Vafai.
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialFlexOrder):
+
+2011-09-26  Chris Rogers  <crogers@google.com>
+
+        OfflineAudioDestinationNode must wait for thread completion in uninitialize()
+        https://bugs.webkit.org/show_bug.cgi?id=68725
+
+        Reviewed by Kenneth Russell.
+
+        No new tests.  This fixes internal implementation details.
+
+        * webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::uninitialize):
+
+2011-09-26  Xan Lopez  <xlopez@igalia.com>
+
+        [GTK] Do not ignore 'Replaceable' attributes in the DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=68837
+
+        Reviewed by Martin Robinson.
+
+        * bindings/scripts/CodeGeneratorGObject.pm: add getters (but not
+        setters) for 'Replaceable' attributes. Punt for the future
+        actually making them settable, since it seems non trivial.
+
+2011-09-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Leopard build fix.
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::setZoomAnimatorTransform):
+
+2011-09-26  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Null key path gets stored as empty string key path
+        https://bugs.webkit.org/show_bug.cgi?id=68726
+
+        Reviewed by Tony Chang.
+
+        Store additional flag to indicate if object store key path
+        is null vs. empty. Added additional runtime tests for integrity
+        of object store metadata.
+
+        * storage/IDBLevelDBBackingStore.cpp:
+        (WebCore::checkObjectStoreAndMetaDataType):
+        (WebCore::IDBLevelDBBackingStore::getObjectStores):
+        (WebCore::IDBLevelDBBackingStore::createObjectStore):
+        * storage/IDBLevelDBCoding.cpp:
+
+2011-09-26  John Bauman  <jbauman@chromium.org>
+
+        Fix nonpremultiplied webgl toDataURL to jpeg
+        https://bugs.webkit.org/show_bug.cgi?id=68366
+
+        The canvas spec says that toDataURL to formats without an alpha must
+        be "composited onto a solid black background using the source-over
+        operator." Do that.
+
+        Reviewed by Kenneth Russell.
+
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::CGImageToDataURL):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageDataToDataURL):
+        * platform/image-encoders/skia/JPEGImageEncoder.cpp:
+        (WebCore::RGBAtoRGB):
+
+2011-09-26  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Remove FindFreetype.cmake
+        https://bugs.webkit.org/show_bug.cgi?id=68778
+
+        Reviewed by Adam Barth.
+
+        CMake has provided its own FindFreetype.cmake forever, so there is no
+        need to have another implementation in WebKit.
+
+        No new tests, just a buildsystem change.
+
+        * CMakeListsEfl.txt: Use FREETYPE_{LIBRARIES,INCLUDE_DIRS} instead of
+        Freetype_{LIBRARIES,INCLUDE_DIRS}.
+
+2011-09-26  Alexei Svitkine  <asvitkine@chromium.org>
+
+        Fix full-page rubber band overhang appearing when gesturing during a slow page load.
+        https://bugs.webkit.org/show_bug.cgi?id=68568
+
+        Chromium bug: http://code.google.com/p/chromium/issues/detail?id=97243
+
+        (This also happens on Safari.)
+
+        The problem was that ScrollView::overhangAmount() was returning a full-page overhang due to contentsSize() being 0 briefly during a page load, which was then getting used by ScrollAnimatorChromiumMac.mm to update the overhang on a gesture event. This change makes the relevant logic not return an overhang if the contentsSize() is empty.
+
+        Reviewed by Adam Barth.
+
+        No new tests, since this is highly timing-related.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::overhangAmount):
+        (WebCore::ScrollView::wheelEvent):
+
+2011-09-26  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Revise zoom animator backend to use full transform instead of just scale.
+        https://bugs.webkit.org/show_bug.cgi?id=68535
+
+        Reviewed by Kenneth Russell.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setZoomAnimatorScale):
+        (WebCore::Settings::zoomAnimatorScale):
+        (WebCore::Settings::setZoomAnimatorPosition):
+        (WebCore::Settings::zoomAnimatorPosX):
+        (WebCore::Settings::zoomAnimatorPosY):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::drawLayersInternal):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::setZoomAnimatorTransform):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::commitTo):
+        (WebCore::CCLayerTreeHost::setZoomAnimatorTransform):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::setZoomAnimatorTransform):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * testing/Internals.cpp:
+        (WebCore::Internals::setZoomAnimatorTransform):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2011-09-26  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r95926) Assert firing in svg/clip-path/clip-path-on-svg.svg
+        https://bugs.webkit.org/show_bug.cgi?id=68819
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::scheduleRelayout): Revert to using view() instead of the RenderView**
+        parameter of isRooted, since only the former returns 0 when the document is detached.
+
+2011-09-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: XMLHttpRequest console logging messages should link to network panel when possible.
+        https://bugs.webkit.org/show_bug.cgi?id=67399
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::resourceRetrievedByXMLHttpRequest):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::resourceRetrievedByXMLHttpRequestImpl):
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessage.prototype._formatMessage.else.else.linkifier):
+        (WebInspector.ConsoleMessage.prototype._formatMessage):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showAnchorLocation):
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyStringAsFragmentWithCustomLinkifier):
+        (WebInspector.linkifyStringAsFragment):
+
+2011-09-26  Jer Noble  <jer.noble@apple.com>
+
+        White flash when entering full-screen using element.webkitRequestFullScreen()
+        https://bugs.webkit.org/show_bug.cgi?id=68481
+
+        Reviewed by Simon Fraser.
+
+        No new tests; covered by existing full screen tests.
+
+        During an animation, renderers may try to paint into the FullScreenRenderer's 
+        GraphicsLayer, and an optimization we previously added for the FullScreenRenderer's 
+        background will cause these paints to fail. Remove this optimization in 
+        containsPaintedContent, and taking non-composited elements into full screen will
+        animate correctly.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::containsPaintedContent):
+
+2011-09-26  Mihai Parparita  <mihaip@chromium.org>
+
+        Unreviewed, rolling out r95960.
+        http://trac.webkit.org/changeset/95960
+        https://bugs.webkit.org/show_bug.cgi?id=58608
+
+        Significantly changes table border rendering
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+
+2011-09-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Repaint tests don't work in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=68453
+
+        Reviewed by Sam Weinig.
+
+        Have FrameView keep track of repaint rects when asked to, and
+        expose this set of repaint rects via private WebKit API for later
+        use by DumpRenderTree.
+        
+        The repaint rects are in WebView coordinates, so we have to
+        unapply the scroll offset.
+
+        * WebCore.exp.in:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::setTracksRepaints):
+        * page/FrameView.h:
+        (WebCore::FrameView::isTrackingRepaints):
+        (WebCore::FrameView::resetTrackedRepaints):
+        (WebCore::FrameView::trackedRepaintRects):
+
+2011-09-26  Antti Koivisto  <antti@apple.com>
+
+        Optimize matching of common pseudo classes
+        https://bugs.webkit.org/show_bug.cgi?id=68633
+
+        Reviewed by Dave Hyatt, Darin Adler, Dimitri Glazkov.
+        
+        :link, :visited and :focus are quite common. They often used as univeral selectors (including in our
+        default stylesheet) so we try to match them for all elements in the document. They take always the 
+        slow matching path. In addition we match link styles twice due to visited link pseudo style generation
+        so the overhead is doubled. As a result substantial portion of our style matching time is spent 
+        dealing with these pseudo classes. 
+        
+        This patch adds new lists to RuleSet for common pseudo class rules. The rules on the lists are only checked
+        if the element has approprate type and stat. ases where the rightmost pseudo class can then be rejected immediately.
+        We can also enable the fast path checking for the rest of the selector in many cases.
+    
+        This seems to be >30% progression in selector matching performance with typical style sheets. It saves ~0.9s
+        when loading the full HTML5 spec.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleData::hasRightmostSelectorMatchingHTMLBasedOnRuleHash):
+        (WebCore::RuleSet::idRules):
+        (WebCore::RuleSet::classRules):
+        (WebCore::RuleSet::tagRules):
+        (WebCore::RuleSet::shadowPseudoElementRules):
+        (WebCore::RuleSet::linkPseudoClassRules):
+        (WebCore::RuleSet::visitedPseudoClassRules):
+        (WebCore::RuleSet::focusPseudoClassRules):
+        (WebCore::RuleSet::universalRules):
+        (WebCore::RuleSet::pageRules):
+        
+            Add a new lists, some stylistic renamings.
+    
+        (WebCore::CSSStyleSelector::matchRules):
+        
+            New link and focus checks.
+
+        (WebCore::CSSStyleSelector::matchRulesForList):
+        (WebCore::CSSStyleSelector::checkSelector):
+        
+            Inline the rightmost selector tag checking, skip if unnecessary.
+        
+        (WebCore::isSelectorMatchingHTMLBasedOnRuleHash):
+        
+            Common pseudo classes now match based on early filtering (though it is not a hash in this case).
+
+        (WebCore::RuleData::RuleData):
+        (WebCore::RuleSet::~RuleSet):
+        (WebCore::RuleSet::addRule):
+        
+            Sort pseudo classes to new lists.
+        
+        (WebCore::RuleSet::collectFeatures):
+        (WebCore::RuleSet::shrinkToFit):
+        (WebCore::CSSStyleSelector::matchPageRules):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector):
+        
+            Adopt to expanded fast path (this is used by querySelectorAll).
+
+        (WebCore::SelectorChecker::fastCheckRightmostSelector):
+        (WebCore::SelectorChecker::fastCheckSelector):
+        
+            Rightmost selector is now checked differently than the rest. RuleSet based selection in CSSStyleSelector
+            is equivalent to fastCheckRightmostSelector().
+        
+        (WebCore::isFastCheckableRelation):
+        (WebCore::isFastCheckableMatch):
+        (WebCore::isFastCheckableRightmostSelector):
+        (WebCore::SelectorChecker::isFastCheckableSelector):
+        (WebCore::SelectorChecker::checkOneSelector):
+        (WebCore::SelectorChecker::commonPseudoClassSelectorMatches):
+        (WebCore::SelectorChecker::isFrameFocused):
+        * css/SelectorChecker.h:
+        (WebCore::SelectorChecker::isCommonPseudoClassSelector):
+        (WebCore::SelectorChecker::linkMatchesVisitedPseudoClass):
+        (WebCore::SelectorChecker::matchesFocusPseudoClass):
+        (WebCore::SelectorChecker::tagMatches):
+        
+            Refactor a bunch of shared checks into functions.
+
+2011-09-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r74971): Selection doesn't work correctly in BiDi Text
+        https://bugs.webkit.org/show_bug.cgi?id=57340
+
+        Reviewed by Eric Seidel.
+
+        This patch adds the end point adjustment mechanism at bidi boundaries similar to the one NSTextView implements.
+
+        To understand the problem, suppose we have strong RTL letters "ABC" in a LTR block (visually laid out as CBA).
+
+        Per NSTextView convention, logical offsets between each letter is placed as (0)C(2)B(1)A(3). In other words,
+        placing the caret visually on the left of CBA yields the position inside the text node of "ABC" at offset 0.
+        Likewise, placing it between C and B yields ("ABC", 2), and placing it on the right of CBA yields ("ABC", 3).
+
+        Now suppose a user attempts to select the letter A by a mouse drag from the right of CBA to a point between
+        B and A. First, the initial mouse down places the selection's base at ("ABC", 3). Then as the mouse pointer
+        moves to a point on the left of A, the selection's extent is set at ("ABC", 1), selecting "BC".
+
+        To mitigate this issue, NSTextView adjusts selection base and extent under certain conditions. In the above
+        example, NSTextView detects user's intent and changes the selection's base to ("ABC", 0) temporarily.
+
+        This patch implements a similar trick on WebKit. We adjust the base or the extent when they're at the left
+        end or at the right end of a bidi run and the other end is inside of the run. In the above example, the
+        base position on the right of A is the right end of a bidi run and the extent position between B and A is
+        inside the same run (CBA), so we would adjust the base to be ("ABC", 0) as NSTextView does.
+
+        Take another example abcABC. Note offsets are assigned as (0)a(1)b(2)c(3)C(5)B(4)A(6) When the user starts
+        a mouse drag from the right of A to a point between B and A, we adjust the selection base to be ("abcABC", 3)
+        because the base is at the right end of a bidi run and the extent is in the same run. We keep the adjustment
+        when the mouse pointer moves to a point between C and B. However, when the mouser pointer reaches a point
+        between letters b and c, the selection extent is placed at ("abcABC", 2). Because the extent is outside of
+        the bidi run started from the selection base, we restore the original base at this point. Had we not done this,
+        we'll end up selecting just "c".
+
+        While this algorithm is implemented in FrameSelection::setNonDirectionalSelectionIfNeeded, this patch adds
+        various member functions to RenderedPosition to facilitate abstraction around inline boxes and bidi runs.
+
+        Test: editing/selection/select-bidi-run.html
+
+        * editing/FrameSelection.cpp:
+        (WebCore::adjustEndpointsAtBidiBoundary): Added. Implements the endpoints adjustment algorithm.
+        (WebCore::FrameSelection::setNonDirectionalSelectionIfNeeded): Calls adjustEndpointsAtBidiBoundary, and
+        restores the original base as needed.
+        * editing/FrameSelection.h:
+        * editing/RenderedPosition.cpp:
+        (WebCore::RenderedPosition::RenderedPosition):
+        (WebCore::RenderedPosition::prevLeafChild): Added to cache prevLeafChild of the current inline box.
+        (WebCore::RenderedPosition::nextLeafChild): Ditto for nextLeafChild.
+        (WebCore::RenderedPosition::isEquivalent): Compares two RenderedPositions considering neighboring inline boxes
+        so that the rightmost position in a box and the leftmost position in the following box is considered equal.
+        (WebCore::RenderedPosition::bidiLevelOnLeft): Added. Returns the bidi level of the run on the left. We can't
+        add a generic bidiLevel to this class because it'll be ambiguous at bidi boundaries.
+        (WebCore::RenderedPosition::bidiLevelOnRight): Ditto for the run on the right.
+        (WebCore::RenderedPosition::leftBoundaryOfBidiRun): Added.
+        (WebCore::RenderedPosition::rightBoundaryOfBidiRun): Added.
+        (WebCore::RenderedPosition::atLeftBoundaryOfBidiRun): Added.
+        (WebCore::RenderedPosition::atRightBoundaryOfBidiRun): Added.
+        (WebCore::RenderedPosition::positionAtLeftBoundaryOfBiDiRun): Returns Position at the left edge of a bidi run
+        if RenderedPosition is at such a position. Asserts atLeftBoundaryOfBidiRun.
+        (WebCore::RenderedPosition::positionAtRightBoundaryOfBiDiRun): Ditto for the right edge.
+        * editing/RenderedPosition.h:
+        (WebCore::RenderedPosition::atLeftBoundaryOfBidiRun): Added.
+        (WebCore::RenderedPosition::atRightBoundaryOfBidiRun): Added.
+        (WebCore::RenderedPosition::atLeftmostOffsetInBox): Added.
+        (WebCore::RenderedPosition::atRightmostOffsetInBox): Added.
+        (WebCore::RenderedPosition::uncachedInlineBox): Added. We can't use a static const variable because gcc thinks
+        reinterpret_cast<InlineBox*>(1) is not an integral value.
+        (WebCore::RenderedPosition::RenderedPosition):
+        * editing/VisibleSelection.h:
+        (WebCore::VisibleSelection::visibleBase): Added.
+        (WebCore::VisibleSelection::visibleExtent): Added.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+
+2011-09-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r95256.
+        http://trac.webkit.org/changeset/95256
+        https://bugs.webkit.org/show_bug.cgi?id=68814
+
+        Temporary CRASH calls no longer needed (Requested by enne on
+        #webkit).
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::commitTo):
+
+2011-09-26  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/68809> IconDatabase::syncThreadMainLoop can assert if wakeSyncThread is called before thread starts executing
+
+        If wakeSyncThread is called before syncThreadMainLoop starts executing then m_syncThreadHasWorkToDo would be set
+        while executing the body of the sync thread loop, causing us to skip blocking on the condition variable. This would
+        lead to us hitting the assertion failure due to m_disabledSuddenTerminationForSyncThread being false, unless the main
+        thread happened to call wakeSyncThread a second time while the first loop iteration was executing.
+
+        Reviewed by Anders Carlsson.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::syncThreadMainLoop): Clear m_syncThreadHasWorkToDo to indicate that we're about to perform
+        all pending work.
+
+2011-09-26  Antaryami Pandia  <antaryami.pandia@motorola.com>
+
+        Groove/inset/outset borders show solid if the color is black.
+        https://bugs.webkit.org/show_bug.cgi?id=58608
+
+        Reviewed by Simon Fraser.
+
+        Lightened the border side colors when drawing borders with styles as
+        Outset/Inset/Groove/Ridge.
+
+        Tests: fast/borders/border-groove.html
+               fast/borders/border-inset.html
+               fast/borders/border-outset.html
+               fast/borders/border-ridge.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+
+2011-09-26  Abhishek Arya  <inferno@chromium.org>
+
+        Delete retired custom font data only on document
+        destruction, and not on recalc style.
+        https://bugs.webkit.org/show_bug.cgi?id=68805
+
+        Reviewed by Dave Hyatt.
+
+        Test: fast/text/custom-font-data-crash.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+
+2011-09-23  Adrienne Walker  <enne@google.com>
+
+        [chromium] Update VideoLayerChromium textures after texture resources are reclaimed
+        https://bugs.webkit.org/show_bug.cgi?id=68742
+
+        Reviewed by James Robinson.
+
+        If video textures are reclaimed (such as during a visibility change on
+        a tab), the dirty rect for the layer is empty and it skips out of
+        updating compositor resources, leaving the video textures invalid.
+        Instead, check the textures here to make sure they're still valid
+        first before early out so that they can get reupdated if necessary.
+
+        Additionally, fix a small bug in pushPropertiesTo where 1 plane RGB
+        videos would not get drawn because all 3 planes didn't have valid
+        textures.
+
+        Test: compositing/video-page-visibility.html
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::VideoLayerChromium):
+        (WebCore::VideoLayerChromium::cleanupResources):
+        (WebCore::VideoLayerChromium::updateCompositorResources):
+        (WebCore::VideoLayerChromium::pushPropertiesTo):
+        (WebCore::VideoLayerChromium::setLayerTreeHost):
+        (WebCore::VideoLayerChromium::texturesValid):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+
+2011-09-26  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: introduce protocol backwards compatibility validator.
+        https://bugs.webkit.org/show_bug.cgi?id=68800
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/Inspector.json:
+        * inspector/Inspector.draft-01.json: Copied from Source/WebCore/inspector/Inspector.json.
+        * inspector/validate-protocol-compatibility: Added.
+
+2011-09-26  Andreas Kling  <kling@webkit.org>
+
+        [Qt] Unused variable in QNetworkReplyHandler::sendNetworkRequest.
+        https://bugs.webkit.org/show_bug.cgi?id=68798
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendNetworkRequest):
+
+2011-09-26  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Second unreviewed build fix for r95941
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willCallFunctionImpl):
+
+2011-09-26  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for webkit builds after r95941.
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willCallFunctionImpl):
+
+2011-09-26  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [Extensions API] allow resources to hook on click on resource links
+        https://bugs.webkit.org/show_bug.cgi?id=68528
+
+        Reviewed by Yury Semikhatsky.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ExtensionAPI.js:
+        (injectedExtensionAPI.Console.prototype.get Severity):
+        (injectedExtensionAPI.Panels.prototype.create):
+        (injectedExtensionAPI.Panels.prototype.setOpenResourceHandler.else.callbackWrapper):
+        (injectedExtensionAPI.Panels.prototype.setOpenResourceHandler):
+        (injectedExtensionAPI.ExtensionServerClient.prototype.hasHandler):
+        (injectedExtensionAPI.ExtensionServerClient.prototype.deregisterHandler):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer):
+        (WebInspector.ExtensionServer.prototype._onSetOpenResourceHandler):
+        (WebInspector.ExtensionServer.prototype._handleAnchorClicked):
+        (WebInspector.ExtensionServer.prototype._addExtensions):
+        (WebInspector.ExtensionServer.prototype._addExtension):
+        (WebInspector.ExtensionServer.prototype._registerExtension):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+        (WebInspector.SettingsScreen.prototype._createCustomSetting):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/helpScreen.css:
+        (.help-content select):
+        (.help-content select:disabled):
+        (.help-content option):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set attached):
+        (WebInspector._showAnchorLocation):
+
+2011-09-23  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: Timeline: record root event for the function calls enforced by console eval.
+        https://bugs.webkit.org/show_bug.cgi?id=68695
+
+        In a complex web application developer might want to timeline a specific piece of code.
+
+        In this case he can do the next steps:
+        1) start timeline;
+        2) eval a command in console;
+        3) stop timeline.
+
+        I think it'd be nice to have a root event for the all the events that happened as the result of such eval.
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/timeline/timeline-injected-script-eval.html
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::makeCall):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willCallFunctionImpl):
+
+2011-09-26  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap][Qt] Enable TextureMapperGL in platforms where BGRA is not present
+        https://bugs.webkit.org/show_bug.cgi?id=65473
+
+        Reviewed by Andreas Kling.
+
+        For now, swap RGBA->BGRA in software if we're in OpenGL ES 2.
+        We do that by iterating on the pixels and manually swapping each pixel's red and blue
+        values. This can be done faster with shaders, but for now this is a working solution
+        for platforms without BGRA support.
+
+        No new tests. Existing layout tests cover this.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::endPaint):
+        * platform/graphics/opengl/TextureMapperGL.h:
+        * platform/graphics/qt/TextureMapperQt.cpp:
+        (WebCore::RGBA32PremultimpliedBufferQt::swapRGB):
+
+2011-09-26  Sergio Villar Senin  <svillar@igalia.com>
+
+        [GTK] Fix coding style bits in ResourceHandleSoup.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=68634
+
+        Reviewed by Martin Robinson.
+
+        No new tests needed.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::defaultSession):
+
+2011-09-26  James Robinson  <jamesr@chromium.org>
+
+        [mac] Timestamp parameter to requestAnimationFrame is busted in USE(REQUEST_ANIMATION_FRAME_TIMER) path
+        https://bugs.webkit.org/show_bug.cgi?id=68769
+
+        Reviewed by Simon Fraser.
+
+        Convert the time parameter from double to DOMTimeStamp using convertSecondsToDOMTimeStamp rather than relying on
+        implicit double->long conversion, which ignores the units of the value.
+
+        Test: fast/animation/request-animation-frame-timestamps-advance.html
+
+        * dom/ScriptedAnimationController.cpp:
+        (WebCore::ScriptedAnimationController::animationTimerFired):
+
+2011-09-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add custom vtable struct to ClassInfo struct
+        https://bugs.webkit.org/show_bug.cgi?id=68567
+
+        Reviewed by Oliver Hunt.
+
+        No new tests.
+
+        Added CREATE_METHOD_TABLE macro to generate the custom vtable for the 
+        specified class in its ClassInfo.  Also added to it the first function to use 
+        this macro, visitChildren.  This is part of the process of getting rid of all 
+        C++ virtual methods in JSCell.  Eventually all virtual functions in JSCell 
+        that can't easily be converted to non-virtual functions will be put into 
+        this custom vtable structure.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+
+        Changed the bindings generator to add the call to the CREATE_METHOD_TABLE macro where
+        necessary.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        (GenerateConstructorDefinition):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        * bridge/c/CRuntimeObject.cpp:
+        * bridge/c/c_instance.cpp:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        * bridge/jni/jsc/JavaRuntimeObject.cpp:
+        * bridge/objc/ObjCRuntimeObject.mm:
+        * bridge/objc/objc_instance.mm:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/qt/qt_instance.cpp:
+        * bridge/qt/qt_pixmapruntime.cpp:
+        * bridge/qt/qt_runtime.cpp:
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_method.cpp:
+        * bridge/runtime_object.cpp:
+
+2011-09-25  Eunmi Lee  <eunmi15.lee@samsung.com>
+
+        [EFL] Move GtkWidgetBackingStoreCairo to the cairo directory and modify to use in the EFL.
+        https://bugs.webkit.org/show_bug.cgi?id=63502
+
+        Reviewed by Martin Robinson.
+
+        The gtk/GtkWidgetBackingStoreCairo.cpp is moved to the cairo/WidgetBackingStoreCairo.cpp and
+        some codes for EFL are added.
+        WidgetBackingStoreCairo creates cairo_image_surface and has a role to copy reusable area
+        when scrolling. So, it will be used in the WebKit2 EFL port's BackingStore.
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.list.am:
+        * platform/cairo/WidgetBackingStore.h:
+        * platform/cairo/WidgetBackingStoreCairo.cpp: Renamed from Source/WebCore/platform/gtk/GtkWidgetBackingStoreCairo.cpp.
+        (WebCore::createSurfaceForBackingStore):
+        (WebCore::WidgetBackingStorePrivate::create):
+        (WebCore::WidgetBackingStorePrivate::WidgetBackingStorePrivate):
+        (WebCore::WidgetBackingStore::create):
+        (WebCore::WidgetBackingStore::WidgetBackingStore):
+        (WebCore::WidgetBackingStore::~WidgetBackingStore):
+        (WebCore::WidgetBackingStore::cairoSurface):
+        (WebCore::WidgetBackingStore::scroll):
+        * platform/gtk/GtkWidgetBackingStoreX11.cpp:
+
+2011-09-25  Adam Barth  <abarth@webkit.org>
+
+        Finish removing PLATFORM(BREWMP) by removing associated code
+        https://bugs.webkit.org/show_bug.cgi?id=68779
+
+        Reviewed by Sam Weinig.
+
+        When Geoffrey Garen removed PLATFORM(BREWMP) in
+        http://trac.webkit.org/changeset/95555, he did not remove all the
+        associated code.  This completes the work started in r95555 by removing
+        all the code assoicated with PLATFORM(BREWMP).
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/js/ScriptControllerBrew.cpp: Removed.
+        * editing/brew: Removed.
+        * editing/brew/EditorBrew.cpp: Removed.
+        * gyp/WebCore.gyp:
+        * page/brew: Removed.
+        * page/brew/ChromeClientBrew.h: Removed.
+        * page/brew/DragControllerBrew.cpp: Removed.
+        * page/brew/EventHandlerBrew.cpp: Removed.
+        * page/brew/FrameBrew.cpp: Removed.
+        * platform/brew: Removed.
+        * platform/brew/ClipboardBrew.cpp: Removed.
+        * platform/brew/ClipboardBrew.h: Removed.
+        * platform/brew/ContextMenuBrew.cpp: Removed.
+        * platform/brew/ContextMenuItemBrew.cpp: Removed.
+        * platform/brew/CursorBrew.cpp: Removed.
+        * platform/brew/DragDataBrew.cpp: Removed.
+        * platform/brew/EventLoopBrew.cpp: Removed.
+        * platform/brew/FileSystemBrew.cpp: Removed.
+        * platform/brew/KURLBrew.cpp: Removed.
+        * platform/brew/LanguageBrew.cpp: Removed.
+        * platform/brew/LocalizedStringsBrew.cpp: Removed.
+        * platform/brew/LoggingBrew.cpp: Removed.
+        * platform/brew/MIMETypeRegistryBrew.cpp: Removed.
+        * platform/brew/PasteboardBrew.cpp: Removed.
+        * platform/brew/PlatformKeyboardEventBrew.cpp: Removed.
+        * platform/brew/PlatformMouseEventBrew.cpp: Removed.
+        * platform/brew/PlatformTouchEventBrew.cpp: Removed.
+        * platform/brew/PlatformTouchPointBrew.cpp: Removed.
+        * platform/brew/PopupMenuBrew.cpp: Removed.
+        * platform/brew/PopupMenuBrew.h: Removed.
+        * platform/brew/SSLKeyGeneratorBrew.cpp: Removed.
+        * platform/brew/ScreenBrew.cpp: Removed.
+        * platform/brew/ScrollbarThemeBrew.cpp: Removed.
+        * platform/brew/ScrollbarThemeBrew.h: Removed.
+        * platform/brew/SearchPopupMenuBrew.cpp: Removed.
+        * platform/brew/SearchPopupMenuBrew.h: Removed.
+        * platform/brew/SharedBufferBrew.cpp: Removed.
+        * platform/brew/SharedTimerBrew.cpp: Removed.
+        * platform/brew/SoundBrew.cpp: Removed.
+        * platform/brew/SystemTimeBrew.cpp: Removed.
+        * platform/brew/TemporaryLinkStubs.cpp: Removed.
+        * platform/brew/WidgetBrew.cpp: Removed.
+        * platform/graphics/brew: Removed.
+        * platform/graphics/brew/IconBrew.cpp: Removed.
+        * platform/graphics/brew/ImageBrew.cpp: Removed.
+        * platform/graphics/brew/IntPointBrew.cpp: Removed.
+        * platform/graphics/brew/IntSizeBrew.cpp: Removed.
+        * platform/network/brew: Removed.
+        * platform/network/brew/DNSBrew.cpp: Removed.
+        * platform/network/brew/SocketStreamError.h: Removed.
+        * platform/network/brew/SocketStreamHandle.h: Removed.
+        * platform/network/brew/SocketStreamHandleBrew.cpp: Removed.
+        * platform/network/brew/SocketStreamHandlePrivate.h: Removed.
+        * platform/text/brew: Removed.
+        * platform/text/brew/TextBoundariesBrew.cpp: Removed.
+        * platform/text/brew/TextBreakIteratorBrew.cpp: Removed.
+        * platform/text/brew/TextCodecBrew.cpp: Removed.
+        * platform/text/brew/TextCodecBrew.h: Removed.
+
+2011-09-25  Kentaro Hara  <haraken@chromium.org>
+
+        Implement a CloseEvent constructor for JSC
+        https://bugs.webkit.org/show_bug.cgi?id=68340
+
+        Reviewed by Oliver Hunt.
+
+        The spec of the CloseEvent constructor is here:
+        http://dev.w3.org/html5/websockets/#closeevent
+
+        Test: fast/events/constructors/close-event-constructor.html
+
+        * bindings/generic/EventConstructors.h: Added a definition for the CloseEvent constructor.
+        * bindings/js/JSEventConstructors.cpp: Added #includes for CloseEvent.
+        * websockets/CloseEvent.h: Added a definition for CloseEventInit.
+        (WebCore::CloseEventInit::CloseEventInit):
+        (WebCore::CloseEvent::create):
+        (WebCore::CloseEvent::CloseEvent):
+        * websockets/CloseEvent.idl: Makes CloseEvent constructible.
+
+2011-09-25  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/10177824> IconDatabase’s use of ThreadCondition leads to assertion failures in the face of spurious wakeups
+
+        It's possible for ThreadCondition::wait to return spuriously without the condition having been signaled.
+        When that happens we should immediately return to waiting rather than doing our normal work, as some of that
+        work relies on wakeSyncThread having been called to signal the condition.
+
+        Reviewed by Sam Weinig.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::IconDatabase):
+        (WebCore::IconDatabase::wakeSyncThread): Note that we have work for the sync thread to do.
+        (WebCore::IconDatabase::syncThreadMainLoop): If we were woken with no work to do, immediately
+        go back to waiting on the condition variable. Otherwise, reset m_syncThreadHasWorkToDo and then
+        do that work. We also switch to moving m_disabledSuddenTerminationForSyncThread immediately in to
+        our local shouldReenableSuddenTermination variable since it can be updated by other threads while
+        we don't hold the lock. This makes it inappropriate to make assumptions about its value after dropping
+        and reacquiring the lock.
+        * loader/icon/IconDatabase.h:
+
+2011-09-25  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10156263> ASSERT in WebCore::FrameView::scheduleRelayoutOfSubtree
+
+        Reviewed by Sam Weinig.
+
+        Test: fast/dynamic/subtree-unrooted.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::scheduleRelayout): Replaced the check that the renderer is parented,
+        which was added in r21162, with a check that it is “rooted”.
+
+2011-09-24  Abhishek Arya  <inferno@chromium.org>
+
+        Issues with merging block children of a ruby
+        base with another ruby base having inline children. 
+        https://bugs.webkit.org/show_bug.cgi?id=66124
+
+        Reviewed by Dan Bernstein.
+
+        Test: fast/ruby/ruby-base-merge-block-children-crash.html
+
+        * rendering/RenderRubyBase.cpp:
+        (WebCore::RenderRubyBase::moveInlineChildren): add a firstChild()
+        check to prevent empty anonymous block addition, just like
+        moveBlockChildren method.
+        * rendering/RenderRubyBase.cpp:
+        (WebCore::RenderRubyBase::moveBlockChildren): This was incorrectly
+        doing optimizations to see if current ruby base has only inline
+        children before beforeChild and then trying to take out them from 
+        their parent anonymous blocks. The problem is those inlines could
+        be split and have continuations because of encountering a block
+        inside inline flow. In those cases, we cannot take the inline out.
+        So, we should just make children non-inline in the destination
+        block and transfer the children as it-is.
+        * rendering/RenderRubyBase.h: remove unncessary functions.
+
+2011-09-25  Adam Barth  <abarth@webkit.org>
+
+        Remove PLATFORM(HAIKU) and associated code
+        https://bugs.webkit.org/show_bug.cgi?id=68774
+
+        Reviewed by Sam Weinig.
+
+        As discussed on webkit-dev, the Haiku port has been inactive for over a
+        year.  A year and a half ago, we discussed removing the port, but folks
+        said they planned to work on it more.  That work does not appear to
+        have happened in the intervening time.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/js/ScriptControllerHaiku.cpp: Removed.
+        * editing/haiku: Removed.
+        * editing/haiku/EditorHaiku.cpp: Removed.
+        * gyp/WebCore.gyp:
+        * loader/cache/CachedFont.cpp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::eventInvertsTabsToLinksClientCallResult):
+        * page/haiku: Removed.
+        * page/haiku/DragControllerHaiku.cpp: Removed.
+        * page/haiku/EventHandlerHaiku.cpp: Removed.
+        * page/haiku/FrameHaiku.cpp: Removed.
+        * platform/ContextMenuItem.h:
+        * platform/Cursor.h:
+        * platform/DragData.h:
+        * platform/DragImage.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/PlatformMenuDescription.h:
+        * platform/PlatformMouseEvent.h:
+        * platform/Widget.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/ImageBufferData.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/IntSize.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/haiku: Removed.
+        * platform/graphics/haiku/ColorHaiku.cpp: Removed.
+        * platform/graphics/haiku/FloatPointHaiku.cpp: Removed.
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Removed.
+        * platform/graphics/haiku/FontCacheHaiku.cpp: Removed.
+        * platform/graphics/haiku/FontCustomPlatformData.cpp: Removed.
+        * platform/graphics/haiku/FontCustomPlatformData.h: Removed.
+        * platform/graphics/haiku/FontHaiku.cpp: Removed.
+        * platform/graphics/haiku/FontPlatformData.h: Removed.
+        * platform/graphics/haiku/GlyphPageTreeNodeHaiku.cpp: Removed.
+        * platform/graphics/haiku/GradientHaiku.cpp: Removed.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Removed.
+        * platform/graphics/haiku/IconHaiku.cpp: Removed.
+        * platform/graphics/haiku/ImageBufferDataHaiku.h: Removed.
+        * platform/graphics/haiku/ImageBufferHaiku.cpp: Removed.
+        * platform/graphics/haiku/ImageHaiku.cpp: Removed.
+        * platform/graphics/haiku/IntPointHaiku.cpp: Removed.
+        * platform/graphics/haiku/IntRectHaiku.cpp: Removed.
+        * platform/graphics/haiku/IntSizeHaiku.cpp: Removed.
+        * platform/graphics/haiku/PathHaiku.cpp: Removed.
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Removed.
+        * platform/graphics/haiku/StillImageHaiku.cpp: Removed.
+        * platform/graphics/haiku/StillImageHaiku.h: Removed.
+        * platform/haiku: Removed.
+        * platform/haiku/ClipboardHaiku.cpp: Removed.
+        * platform/haiku/ClipboardHaiku.h: Removed.
+        * platform/haiku/ContextMenuHaiku.cpp: Removed.
+        * platform/haiku/ContextMenuItemHaiku.cpp: Removed.
+        * platform/haiku/CookieJarHaiku.cpp: Removed.
+        * platform/haiku/CursorHaiku.cpp: Removed.
+        * platform/haiku/DragDataHaiku.cpp: Removed.
+        * platform/haiku/DragImageHaiku.cpp: Removed.
+        * platform/haiku/EventLoopHaiku.cpp: Removed.
+        * platform/haiku/FileSystemHaiku.cpp: Removed.
+        * platform/haiku/LocalizedStringsHaiku.cpp: Removed.
+        * platform/haiku/LoggingHaiku.cpp: Removed.
+        * platform/haiku/MIMETypeRegistryHaiku.cpp: Removed.
+        * platform/haiku/PasteboardHaiku.cpp: Removed.
+        * platform/haiku/PlatformKeyboardEventHaiku.cpp: Removed.
+        * platform/haiku/PlatformMouseEventHaiku.cpp: Removed.
+        * platform/haiku/PlatformWheelEventHaiku.cpp: Removed.
+        * platform/haiku/PopupMenuHaiku.cpp: Removed.
+        * platform/haiku/PopupMenuHaiku.h: Removed.
+        * platform/haiku/RenderThemeHaiku.cpp: Removed.
+        * platform/haiku/RenderThemeHaiku.h: Removed.
+        * platform/haiku/ScreenHaiku.cpp: Removed.
+        * platform/haiku/ScrollbarThemeHaiku.cpp: Removed.
+        * platform/haiku/ScrollbarThemeHaiku.h: Removed.
+        * platform/haiku/SearchPopupMenuHaiku.cpp: Removed.
+        * platform/haiku/SearchPopupMenuHaiku.h: Removed.
+        * platform/haiku/SharedBufferHaiku.cpp: Removed.
+        * platform/haiku/SharedTimerHaiku.cpp: Removed.
+        * platform/haiku/SoundHaiku.cpp: Removed.
+        * platform/haiku/TemporaryLinkStubs.cpp: Removed.
+        * platform/haiku/WidgetHaiku.cpp: Removed.
+        * platform/image-decoders/haiku: Removed.
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp: Removed.
+        * platform/text/UnicodeRange.h:
+        * platform/text/haiku: Removed.
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp: Removed.
+
+2011-09-25  Adam Barth  <abarth@webkit.org>
+
+        Attempted build fixes for GTK and Qt.
+
+        * GNUmakefile.list.am:
+        * WebCore.pro:
+
+2011-09-24  Adam Barth  <abarth@webkit.org>
+
+        Always enable ENABLE(OFFLINE_WEB_APPLICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=68767
+
+        Reviewed by Eric Seidel.
+
+        As discussed on webkit-dev, almost everyone has this enable turned on
+        and this feature is unlikely to be removed from the web platform given
+        its popularity.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.exp.in:
+        * WebCore.pro:
+        * bindings/cpp/WebDOMEventTarget.cpp:
+        (toWebKit):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toDOMApplicationCache):
+        * dom/EventTarget.h:
+        * features.pri:
+        * history/PageCache.cpp:
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::PageCache::canCachePageContainingThisFrame):
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::insertedByParser):
+        * html/HTMLHtmlElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::createFileURLForApplicationCacheResource):
+        (WebCore::HTMLMediaElement::loadResource):
+        * html/ImageDocument.cpp:
+        (WebCore::ImageDocument::createDocumentStructure):
+        * html/MediaDocument.cpp:
+        (WebCore::MediaDocumentParser::createDocumentStructure):
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::createDocumentStructure):
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        * inspector/InspectorApplicationCacheAgent.cpp:
+        * inspector/InspectorApplicationCacheAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::updateApplicationCacheStatusImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::networkStateChanged):
+        (WebCore::InspectorInstrumentation::updateApplicationCacheStatus):
+        * inspector/InstrumentingAgents.h:
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::setInspectorApplicationCacheAgent):
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::WorkerInspectorController::connectFrontend):
+        * inspector/generate-inspector-idl:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        (WebCore::DocumentLoader::mainReceivedError):
+        (WebCore::DocumentLoader::stopLoading):
+        (WebCore::DocumentLoader::detachFromFrame):
+        (WebCore::DocumentLoader::handledOnloadEvents):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCacheHost):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::reachedApplicationCacheOriginQuota):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        (WebCore::MainResourceLoader::didReceiveData):
+        (WebCore::MainResourceLoader::didFinishLoading):
+        (WebCore::MainResourceLoader::didFail):
+        (WebCore::MainResourceLoader::load):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::start):
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didSendData):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoading):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::wasBlocked):
+        (WebCore::ResourceLoader::cannotShowURL):
+        (WebCore::ResourceLoader::shouldUseCredentialStorage):
+        (WebCore::ResourceLoader::willCacheResponse):
+        * loader/ResourceLoader.h:
+        * loader/appcache/ApplicationCache.cpp:
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/appcache/ApplicationCacheHost.cpp:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheResource.cpp:
+        * loader/appcache/ApplicationCacheResource.h:
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl:
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * loader/appcache/ManifestParser.h:
+        * loader/chromium/ResourceLoaderChromium.cpp:
+        (WebCore::ResourceLoader::didDownloadData):
+        * page/ChromeClient.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::applicationCache):
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalApplicationCache):
+        * page/DOMWindow.idl:
+        * xml/parser/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::startElementNs):
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::parseStartElement):
+
+2011-09-24  Adam Barth  <abarth@webkit.org>
+
+        Remove ENABLE(WCSS) and associated code
+        https://bugs.webkit.org/show_bug.cgi?id=68759
+
+        Reviewed by Darin Adler.
+
+        As discussed on webkit-dev, we are removing this feature from trunk to
+        reduce the number of different configurations.
+
+        * CodeGenerators.pri:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSParser.h:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/WCSSPropertyNames.in: Removed.
+        * css/WCSSValueKeywords.in: Removed.
+        * features.pri:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        * html/HTMLInputElement.h:
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::sanitizeValue):
+        (WebCore::TextFieldInputType::handleBeforeTextInsertedEvent):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyleConstants.h:
+
+2011-09-24  Young Han Lee  <joybro@company100.net>
+
+        SVGAnimation does not support 'values' for from-to animations
+        https://bugs.webkit.org/show_bug.cgi?id=64859
+
+        Reviewed by Dirk Schulze.
+
+        If from-to animation have discrete calc-mode and have a 'keyTimes' list, values of
+        the keyTimes indicate the begin and the end of the animation respectively.[1][2]
+
+        When keyTimes is given, calculate the progress percentage of the animation with it
+        even for from-to animation.
+
+        [1] http://www.w3.org/TR/SVG/animate.html#ValueAttributes
+        [2] http://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncValues
+
+        Test: svg/animations/animate-from-to-keyTimes.html
+
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::calculatePercentForFromTo):
+        (WebCore::SVGAnimationElement::updateAnimation):
+        * svg/SVGAnimationElement.h:
+
+2011-09-23  Chris Fleizach  <cfleizach@apple.com>
+
+        WebKit does not expose AXPlaceholder value on password fields
+        https://bugs.webkit.org/show_bug.cgi?id=68745
+
+        Reviewed by Oliver Hunt.
+
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2011-09-23  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck): Get rid of the exit-time destructor.
+
+2011-09-23  Adam Barth  <abarth@webkit.org>
+
+        Canvas security checks show up on HTML5GamingTest benchmark
+        https://bugs.webkit.org/show_bug.cgi?id=68743
+
+        Reviewed by Oliver Hunt.
+
+        Prior to this patch, the canvas security checks took as much as 4% of
+        the time on the HTML5GamingTest benchmark:
+
+        http://craftymind.com/factory/guimark2/HTML5GamingTest.html
+
+        This patch uses a couple of AtomicStrings and shuffles around the order
+        of the security check to take this down to around 0.1% (which is near
+        the noise floor of what I can measure with my profiler).
+
+        * html/canvas/CanvasRenderingContext.cpp:
+        (WebCore::CanvasRenderingContext::wouldTaintOrigin):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+
+2011-09-23  Justin Novosad  <junov@chromium.org>
+
+        Unwarranted DOM Exception when canvas2D drawImage is called with src
+        rect out of bounds
+        https://bugs.webkit.org/show_bug.cgi?id=65709
+
+        Reviewed by Oliver Hunt.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        Return early without throwing an exception if source rectangle is out of 
+        bounds to match the spec.
+
+2011-09-23  Lukasz Slachciak  <l.slachciak@samsung.com>
+
+        Printing of notImplemented() when logging enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=64590
+
+        Printing of notImplemented() method was enabled on Debug builds only.
+        Now it is enabled when logging is enabled.
+
+        Reviewed by Oliver Hunt.
+
+        No new tests because there is no new functionality.
+
+        * platform/NotImplemented.h: Non-debug mode replaced with non-logging mode.
+
+2011-09-23  Mihai Parparita  <mihaip@chromium.org>
+
+        [Chromium] REGRESSION (r95725): Resizing a window doesn't resize the contents
+        https://bugs.webkit.org/show_bug.cgi?id=68730
+
+        Reviewed by James Robinson.
+
+        Adds a missing contentsResized() call in ScrollView::setFrameRect.
+
+        Test: fast/dom/Window/window-resize-contents.html
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setFrameRect):
+
+2011-09-23  Adam Klein  <adamk@chromium.org>
+
+        Add ENABLE_MUTATION_OBSERVERS feature flag
+        https://bugs.webkit.org/show_bug.cgi?id=68732
+
+        Reviewed by Ojan Vafai.
+
+        This flag will guard an implementation of the "Mutation Observers" proposed in
+        http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/1622.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+
+2011-09-23  Varun Jain  <varunjain@google.com>
+
+        Refactor WebViewImpl::scrollFocusedNodeIntoRect to a better place and add tests 
+        https://bugs.webkit.org/show_bug.cgi?id=68198
+
+        Reviewed by Dimitri Glazkov.
+
+        Tests: fast/dom/scroll-element-to-rect-centered.html
+               fast/dom/scroll-element-to-rect.html
+
+        * WebCore.exp.in:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollElementToRect):
+        * page/FrameView.h:
+        * testing/Internals.cpp:
+        (WebCore::Internals::scrollElementToRect):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2011-09-23  Mihai Parparita  <mihaip@chromium.org>
+
+        Unreviewed, rolling out r95860.
+        http://trac.webkit.org/changeset/95860
+        https://bugs.webkit.org/show_bug.cgi?id=68648
+
+        Breaks overhang rendering on Chromium Mac
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::ScrollbarThemeChromiumMac):
+        (WebCore::ScrollbarThemeChromiumMac::paintOverhangAreas):
+
+2011-09-23  Dean Jackson  <dino@apple.com>
+
+        Add -webkit-filter to CSSPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=68675
+
+        Reviewed by Simon Fraser.
+
+        Add property and rudimentary parsing for -webkit-filter. The
+        property value isn't preserved anywhere yet. Add
+        stub definition for computed style.
+
+        Test: css3/filters/filter-property.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFilter):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2011-09-23  Antoine Labour  <piman@chromium.org>
+
+        Remove preserves3D() from CCLayerDelegate, replacing it by setting the
+        value explicitly after creating a layer, or setting its delegate.
+        https://bugs.webkit.org/show_bug.cgi?id=68295
+
+        Reviewed by James Robinson.
+
+        Covered by compositing/ layeout tests.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerChromium::setupContentsLayer):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::setPreserves3D):
+        (WebCore::LayerChromium::preserves3D):
+
+2011-09-23  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Implicit conversion double to float in ShadowBlur::adjustBlurRadius
+        https://bugs.webkit.org/show_bug.cgi?id=68722
+
+        Reviewed by Simon Fraser.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::adjustBlurRadius): Added 2 explicit
+        conversions.
+
+2011-09-23  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10178576> REGRESSION (r95391): Crash in -[WebCascadeList objectAtIndex:] when a font-family list contains missing fonts
+        https://bugs.webkit.org/show_bug.cgi?id=68737
+
+        Reviewed by Darin Adler.
+
+        Test: fast/text/combining-character-sequence-fallback-crash.html
+
+        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
+        (-[WebCascadeList initWithFont:WebCore::character:]): Changed to intialize _count to the exact
+        number of FontData instances in the fallback list rather than the number of font families in the
+        font description.
+
+2011-09-23  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Fix CSS 3D corner anti-aliasing.
+        https://bugs.webkit.org/show_bug.cgi?id=68087
+
+        Reviewed by James Robinson.
+
+        Render sharp corners more correctly by adding bounding box
+        edges to anti-aliasing shaders.
+
+        Test: platform/chromium/compositing/3d-corners.html
+
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::FragmentShaderRGBATexAlphaAA::getShaderString):
+        (WebCore::FragmentShaderRGBATexClampAlphaAA::getShaderString):
+        (WebCore::FragmentShaderRGBATexClampSwizzleAlphaAA::getShaderString):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::getShaderString):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawLayer):
+        (WebCore::CCRenderSurface::drawSurface):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::CCTiledLayerImpl::draw):
+        (WebCore::CCTiledLayerImpl::drawTiles):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+
+2011-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Make write barriers actually do something when enabled
+        https://bugs.webkit.org/show_bug.cgi?id=68717
+
+        Reviewed by Geoffrey Garen.
+
+        Add a forwarding header, and fix an evaluation ordering
+        issue that shows up if you try to use write barriers.
+
+        * ForwardingHeaders/heap/CardSet.h: Added.
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::jsFunction):
+
+2011-09-23  James Robinson  <jamesr@chromium.org>
+
+        Avoid updating compositing state during paint
+        https://bugs.webkit.org/show_bug.cgi?id=68727
+
+        Reviewed by Simon Fraser.
+
+        We shouldn't update our compositing state in the middle of a paint. The call to
+        updateCompositingAndLayerListsIfNeeded() was added to RenderLayer::paintLayer in r45715, which was intended to
+        fix this exact issue. Based off the ChangeLog entries, I think that this was just a typo.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        * rendering/RenderLayerCompositor.h:
+
+2011-09-23  Fady Samuel  <fsamuel@chromium.org>
+
+        Refactor paintOverhangAreas to allow non-Mac Chromium platforms to reuse code
+        https://bugs.webkit.org/show_bug.cgi?id=68648
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests because there's no change in functionality (yet).
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::ScrollbarThemeChromium):
+        (WebCore::ScrollbarThemeChromium::~ScrollbarThemeChromium):
+        (WebCore::ScrollbarThemeChromium::paintOverhangAreas):
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::ScrollbarThemeChromiumMac):
+
+2011-09-23  Ojan Vafai  <ojan@chromium.org>
+
+        remove physical flex-flow values to match the updated spec
+        https://bugs.webkit.org/show_bug.cgi?id=68728
+
+        Reviewed by Tony Chang.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFlexFlow):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-09-23  Abhishek Arya  <inferno@chromium.org>
+
+        Style not updated for :before, :after content
+        in ruby text.
+        https://bugs.webkit.org/show_bug.cgi?id=68625
+
+        Reviewed by Dave Hyatt.
+
+        Test: fast/ruby/ruby-text-before-after-content.html
+
+        * rendering/RenderRubyText.cpp:
+        (WebCore::RenderRubyText::updateBeforeAfterContent):
+        * rendering/RenderRubyText.h:
+
+2011-09-22  Ojan Vafai  <ojan@chromium.org>
+
+        refactor RenderFlexibleBox to use flex-flow aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=68665
+
+        Reviewed by Tony Chang.
+
+        This is just a refactor. Just move the all the code that needs to
+        be flow aware into helper functions. Actually making them flow-aware
+        can be done in a followup patch.
+
+        * rendering/RenderBlock.cpp:
+        * rendering/RenderBlock.h:
+        Moved setLogicalLocationForChild into RenderFlexibleBox since that was the only caller.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::hasOrthogonalFlow):
+        (WebCore::RenderFlexibleBox::isHorizontalFlow):
+        (WebCore::RenderFlexibleBox::isLeftToRightFlow):
+        (WebCore::RenderFlexibleBox::setFlowAwareLogicalHeight):
+        (WebCore::RenderFlexibleBox::flowAwareLogicalHeightForChild):
+        (WebCore::RenderFlexibleBox::flowAwareLogicalWidthForChild):
+        (WebCore::RenderFlexibleBox::flowAwareLogicalHeight):
+        (WebCore::RenderFlexibleBox::flowAwareContentLogicalWidth):
+        (WebCore::RenderFlexibleBox::flowAwareAvailableLogicalWidth):
+        (WebCore::RenderFlexibleBox::flowAwareBorderStart):
+        (WebCore::RenderFlexibleBox::flowAwareBorderBefore):
+        (WebCore::RenderFlexibleBox::flowAwareBorderAfter):
+        (WebCore::RenderFlexibleBox::flowAwarePaddingStart):
+        (WebCore::RenderFlexibleBox::flowAwarePaddingBefore):
+        (WebCore::RenderFlexibleBox::flowAwarePaddingAfter):
+        (WebCore::RenderFlexibleBox::flowAwareMarginStartForChild):
+        (WebCore::RenderFlexibleBox::flowAwareMarginBeforeForChild):
+        (WebCore::RenderFlexibleBox::flowAwareMarginAfterForChild):
+        (WebCore::RenderFlexibleBox::setFlowAwareMarginStartForChild):
+        (WebCore::RenderFlexibleBox::setFlowAwareMarginEndForChild):
+        (WebCore::RenderFlexibleBox::setFlowAwareLogicalLocationForChild):
+        (WebCore::RenderFlexibleBox::logicalBorderAndPaddingWidthForChild):
+        (WebCore::RenderFlexibleBox::logicalScrollbarHeightForChild):
+        (WebCore::RenderFlexibleBox::marginStartStyleForChild):
+        (WebCore::RenderFlexibleBox::marginEndStyleForChild):
+        (WebCore::RenderFlexibleBox::preferredLogicalContentWidthForFlexItem):
+        (WebCore::RenderFlexibleBox::layoutInlineDirection):
+        (WebCore::RenderFlexibleBox::logicalPositiveFlexForChild):
+        (WebCore::RenderFlexibleBox::logicalNegativeFlexForChild):
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidth):
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithmInlineDirection):
+        (WebCore::RenderFlexibleBox::setLogicalOverrideSize):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildrenInlineDirection):
+        * rendering/RenderFlexibleBox.h:
+
+2011-09-23  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68719
+        
+        Push through multiple regions when an object doesn't fit in any of them. Unlike with pages and
+        columns, when regions have a non-uniform height, we may need to push through multiple regions
+        in order to find one that fits.
+        
+        Added an optimization for quickly noticing if regions do have a uniform height so that we can
+        treat them like columns and pages if so.
+
+        Also fixed the end line matchup to properly null out endLine when no next line box exists. The new
+        layout tests I wrote to cover this feature exposed this crasher, so fixing it in order to land
+        the new tests.
+
+        Reviewed by Anders Carlsson.
+
+        Added new tests in fast/regions.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+        (WebCore::RenderBlock::pushToNextPageWithMinimumLogicalHeight):
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::matchedEndLine):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::RenderFlowThread):
+        (WebCore::RenderFlowThread::layout):
+        * rendering/RenderFlowThread.h:
+
+2011-09-23  Konstantin Scheglov  <scheglov@google.com>
+
+        Redrawing dirty parts of a large table is very slow
+        https://bugs.webkit.org/show_bug.cgi?id=64546
+
+        Reviewed by David Hyatt.
+
+        Move CollapsedBorderValues into RenderTable.h.
+        Calculate collapsed borders only once and re-use during paintObject().
+        Invalidate cache when cell, row, row group, col, col group or table border is changed.
+
+        Tests: fast/table/border-collapsing/cached-cell-append.html
+               fast/table/border-collapsing/cached-cell-remove.html
+               fast/table/border-collapsing/cached-change-cell-border-color.html
+               fast/table/border-collapsing/cached-change-cell-border-width.html
+               fast/table/border-collapsing/cached-change-col-border-color.html
+               fast/table/border-collapsing/cached-change-col-border-width.html
+               fast/table/border-collapsing/cached-change-colgroup-border-color.html
+               fast/table/border-collapsing/cached-change-colgroup-border-width.html
+               fast/table/border-collapsing/cached-change-row-border-color.html
+               fast/table/border-collapsing/cached-change-row-border-width.html
+               fast/table/border-collapsing/cached-change-table-border-color.html
+               fast/table/border-collapsing/cached-change-table-border-width.html
+               fast/table/border-collapsing/cached-change-tbody-border-color.html
+               fast/table/border-collapsing/cached-change-tbody-border-width.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::RenderTable):
+        (WebCore::RenderTable::styleDidChange): Invalidate cache on border change.
+        (WebCore::RenderTable::layout): Invalidate cache if layout changed.
+        (WebCore::RenderTable::recalcCollapsedBorders): Ensures that cache is valid.
+        (WebCore::RenderTable::paintObject): Use cached collapsed borders.
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::invalidateCollapsedBorders): Accessor to mark cache invalid.
+        (WebCore::RenderTable::currentBorderValue): Rename to use word "value".
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleDidChange): If border changed, invalidate cache.
+
+        Rename to use word "value".
+        (WebCore::addBorderStyle):
+        (WebCore::RenderTableCell::collectBorderValues):
+        (WebCore::compareBorderValuesForQSort):
+        (WebCore::RenderTableCell::sortBorderValues):
+        (WebCore::RenderTableCell::paintCollapsedBorder):
+        * rendering/RenderTableCell.h:
+        
+        If border changed, invalidate cache.
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::styleDidChange):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleDidChange):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::styleDidChange):
+
+2011-09-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::visitChildren
+        https://bugs.webkit.org/show_bug.cgi?id=68404
+
+        Reviewed by Darin Adler.
+
+        No new tests.
+
+        In this patch we just extract the bodies of the virtual visitChildren methods
+        throughout the JSCell inheritance hierarchy out into static methods, which are 
+        now called from the virtual methods.  This is an intermediate step in trying to 
+        move the virtual-ness of visitChildren into our own custom vtable stored in 
+        ClassInfo.  We need to convert the methods to static methods in order to be 
+        able to more easily store and refer to them in our custom vtable since normal 
+        member methods store some implicit information in their types, making it 
+        impossible to store them generically in ClassInfo.
+
+        * WebCore.exp.in:
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::visitChildrenVirtual):
+        (WebCore::JSAttr::visitChildren):
+        * bindings/js/JSAudioContextCustom.cpp:
+        (WebCore::JSAudioContext::visitChildrenVirtual):
+        (WebCore::JSAudioContext::visitChildren):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::JSCSSRule::visitChildrenVirtual):
+        (WebCore::JSCSSRule::visitChildren):
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::visitChildrenVirtual):
+        (WebCore::JSCSSStyleDeclaration::visitChildren):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::JSCanvasRenderingContext::visitChildrenVirtual):
+        (WebCore::JSCanvasRenderingContext::visitChildren):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::visitChildrenVirtual):
+        (WebCore::JSDOMGlobalObject::visitChildren):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::visitChildrenVirtual):
+        (WebCore::JSDOMWindow::visitChildren):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::visitChildrenVirtual):
+        (WebCore::JSDOMWindowShell::visitChildren):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSJavaScriptAudioNodeCustom.cpp:
+        (WebCore::JSJavaScriptAudioNode::visitChildrenVirtual):
+        (WebCore::JSJavaScriptAudioNode::visitChildren):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::visitChildrenVirtual):
+        (WebCore::JSMessageChannel::visitChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::visitChildrenVirtual):
+        (WebCore::JSMessagePort::visitChildren):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::visitChildrenVirtual):
+        (WebCore::JSNamedNodeMap::visitChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::visitChildrenVirtual):
+        (WebCore::JSNode::visitChildren):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::visitChildrenVirtual):
+        (WebCore::JSNodeFilter::visitChildren):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::visitChildrenVirtual):
+        (WebCore::JSNodeIterator::visitChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::visitChildrenVirtual):
+        (WebCore::JSSVGElementInstance::visitChildren):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::visitChildrenVirtual):
+        (WebCore::JSSharedWorker::visitChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::visitChildrenVirtual):
+        (WebCore::JSStyleSheet::visitChildren):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::visitChildrenVirtual):
+        (WebCore::JSTreeWalker::visitChildren):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::visitChildrenVirtual):
+        (WebCore::JSWebGLRenderingContext::visitChildren):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::visitChildrenVirtual):
+        (WebCore::JSWorkerContext::visitChildren):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::visitChildrenVirtual):
+        (WebCore::JSXMLHttpRequest::visitChildren):
+        * bindings/js/JSXPathResultCustom.cpp:
+        (WebCore::JSXPathResult::visitChildrenVirtual):
+        (WebCore::JSXPathResult::visitChildren):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObj::visitChildrenVirtual):
+        (WebCore::JSTestObj::visitChildren):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObject::visitChildrenVirtual):
+        (JSC::Bindings::QtRuntimeObject::visitChildren):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::visitChildrenVirtual):
+        (JSC::Bindings::QtRuntimeMetaMethod::visitChildren):
+        * bridge/qt/qt_runtime.h:
+        * workers/WorkerContext.h:
+
+2011-09-23  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Remove extra space at the beginning of the last line.
+        https://bugs.webkit.org/show_bug.cgi?id=68710
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * platform/network/soup/SocketStreamHandleSoup.cpp:
+
+2011-09-23  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Fix coding style issues in ResourceRequestSoup.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=68707
+
+        Reviewed by Xan Lopez.
+
+        This patch fixes some issues as reported by check-webkit-style.
+
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2011-09-22  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+
+        Unreviewed: [Qt] Workaround MSVC2010 problems when linking QtWebKit
+
+        Include MSVC2010 in the list of compilers where incremental
+        build is disabled (INCREMENTAL:NO).
+
+        Change suggested by Simo Falt <simo.falt@nokia.com>, already present
+        in the Qt-4.8 repository where the problem was identified.
+
+        * WebCore.pri:
+
+2011-09-23  Darin Adler  <darin@apple.com>
+
+        Try to fix warning seen in some 32-bit builds.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::backgroundRectAdjustedForBleedAvoidance):
+        Use an explicit cast for the conversion from a double to a LayoutUnit.
+
+2011-09-23  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Clicking on error doesn't point on the correct line if user searched something
+        https://bugs.webkit.org/show_bug.cgi?id=68627
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/SearchController.js:
+        (WebInspector.SearchController.prototype.disableSearchUntilExplicitAction):
+        * inspector/front-end/inspector.js:
+        (WebInspector._showAnchorLocationInPanel):
+
+2011-09-23  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: InspectorStyleSheet should use stylesheet's original url, not final one.
+        https://bugs.webkit.org/show_bug.cgi?id=68631
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: http/tests/inspector/styles/styles-redirected-css.html
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
+
+2011-09-23  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: XHRs requests with the same url as main resource should have correct category.
+        https://bugs.webkit.org/show_bug.cgi?id=68646
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: http/tests/inspector/network/network-xhr-same-url-as-main-resource.html
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+
+2011-09-23  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Add context menu action to navigate from resources panel resource to network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=68657
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype.showAnchorLocation):
+        (WebInspector.NetworkPanel.prototype.revealAndHighlightResource):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.FrameResourceTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.FrameResourceTreeElement.prototype._appendOpenInNetworkPanelAction):
+        * inspector/front-end/inspector.js:
+        (WebInspector.openInNetworkPanelLabel):
+        (WebInspector.openRequestInNetworkPanel):
+
+2011-09-23  Deepak Sherveghar  <bpwv64@motorola.com>
+
+        [Gtk] Title attribute is not respected on option elements.
+        https://bugs.webkit.org/show_bug.cgi?id=68615
+
+        Reviewed by Martin Robinson.
+
+        Set tooltip on PopupMenuGtk items created from GtkActions.
+
+        * platform/gtk/GtkPopupMenu.cpp:
+        (WebCore::GtkPopupMenu::appendItem): Added a call to gtk_widget_set_tooltip_text()
+            to set the tooltip on menuitem. Tooltip text is retrieved from GtkAction.
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenuGtk::createGtkActionForMenuItem): Pass the tooltip text
+            from client when creating a GtkAction.
+
+2011-09-23  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Qt][Gtk] Wrong state when pausing a video in the "playing" event handler
+        https://bugs.webkit.org/show_bug.cgi?id=68589
+
+        Reviewed by Philippe Normand.
+
+        Test: media/video-playing-and-pause.html
+
+        As suggested by Alexis Menard on IRC, query gstreamer's state instead of using a cached value
+        in MediaPlayerGstreamerPrivate::paused(). 
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::paused):
+
+2011-09-15  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: skip overlapping scripts when displaying concatenated content.
+        https://bugs.webkit.org/show_bug.cgi?id=68144
+
+        Dynamically appended script tags have wrong offsets and cause troubles building concatenated content.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype._concatenateScriptsContent.appendChunk):
+        (WebInspector.ConcatenatedScriptsContentProvider.prototype._concatenateScriptsContent):
+
+2011-09-23  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: file open dialog appears when user clicks on the timeline bar in timeline panel.
+        https://bugs.webkit.org/show_bug.cgi?id=68312
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createFileSelector):
+
+2011-09-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r95383.
+        http://trac.webkit.org/changeset/95383
+        https://bugs.webkit.org/show_bug.cgi?id=68690
+
+        It broke WebInspector.Timeline.LoadFromFile feature.
+        (Requested by loislo on #webkit).
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createFileSelector):
+
+2011-09-23  Rob Buis  <rbuis@rim.com>
+
+        use after free in WebCore::SVGTRefElement::updateReferencedText
+        https://bugs.webkit.org/show_bug.cgi?id=67555
+
+        Reviewed by Nikolas Zimmermann.
+
+        Event listeners can outlive the tref element that created them when
+        the tref is cloned and then garbage collected, causing a dangling pointer to the
+        tref. To fix this do not install event listener until the tref is inserted into the document.
+
+        Test: svg/custom/tref-clone-crash.html
+
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::svgAttributeChanged):
+        (WebCore::SVGTRefElement::insertedIntoDocument):
+        * svg/SVGTRefElement.h:
+
+2011-09-23  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        ASSERTION FAILED: documentLoader in WebKit/Source/WebCore/inspector/InspectorInstrumentation.cpp(597)
+        https://bugs.webkit.org/show_bug.cgi?id=68291
+
+        Reviewed by Tony Chang.
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl):
+        (WebCore::InspectorInstrumentation::loadEventFiredImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFired):
+        (WebCore::InspectorInstrumentation::loadEventFired):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2011-09-22  Tony Chang  <tony@chromium.org>
+
+        implement -webkit-flex-order
+        https://bugs.webkit.org/show_bug.cgi?id=67432
+
+        Reviewed by Ojan Vafai.
+
+        flex-order can be an int (including negative), but we disallow the two
+        smallest values so we can put the numbers into a hash set.
+
+        Also, create two iterators: one that goes in render tree order (we use
+        this for the first pass and to collect the possible flex order values)
+        and one that goes in flex order.
+
+        Test: css3/flexbox/flex-order.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::FlexOrderHashTraits::emptyValue):
+        (WebCore::FlexOrderHashTraits::constructDeletedValue):
+        (WebCore::FlexOrderHashTraits::isDeletedValue):
+        (WebCore::RenderFlexibleBox::TreeOrderIterator::TreeOrderIterator): A simple iterator
+            that goes in render tree order.
+        (WebCore::RenderFlexibleBox::TreeOrderIterator::next):
+        (WebCore::RenderFlexibleBox::TreeOrderIterator::reset):
+        (WebCore::RenderFlexibleBox::TreeOrderIterator::flexOrderValues):
+        (WebCore::RenderFlexibleBox::FlexOrderIterator::FlexOrderIterator): An iterator that
+            goes in flex-order order.  Creating this involves sorting, so only create it once
+            and pass it around.
+        (WebCore::RenderFlexibleBox::FlexOrderIterator::first):
+        (WebCore::RenderFlexibleBox::FlexOrderIterator::next):
+        (WebCore::RenderFlexibleBox::FlexOrderIterator::reset):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBlock):
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidth):
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithmInlineDirection):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildrenInlineDirection):
+        * rendering/RenderFlexibleBox.h:
+
+2011-09-22  Darin Adler  <darin@apple.com>
+
+        Use AffineTransform scale functions in ShadowBlur::adjustBlurRadius
+        https://bugs.webkit.org/show_bug.cgi?id=68667
+
+        Reviewed by Simon Fraser.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ShadowBlur::adjustBlurRadius): Use AffineTransform::xScale and
+        AffineTransform::yScale instead of the custom code here that seems to do
+        the same thing.
+
+2011-09-22  Darin Adler  <darin@apple.com>
+
+        Remove unneeded type conversion from background bleed code
+        https://bugs.webkit.org/show_bug.cgi?id=68669
+
+        Reviewed by Geoffrey Garen.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::backgroundRectAdjustedForBleedAvoidance): Use ceil instead of ceilf
+        and eliminate superflous conversion to float and use of FloatSize. Also added
+        a "why" comment.
+
+2011-09-22  Darin Adler  <darin@apple.com>
+
+        Refactor checks for antialiasing lines to share a single function
+        https://bugs.webkit.org/show_bug.cgi?id=68666
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnRules): Call shouldAntialiasLines.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBorder): Ditto.
+        (WebCore::RenderBoxModelObject::shouldAntialiasLines): Added.
+        * rendering/RenderBoxModelObject.h: Added shouldAntialiasLines function.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine): Call shouldAntialiasLines.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintCollapsedBorder): Ditto.
+
+2011-09-22  Antoine Labour  <piman@chromium.org>
+
+        Remove unused members from LayerChromium.
+        These members are never set, and never used.
+        Other members that are set but not used have been left (we may use them
+        later, e.g. m_opaque).
+        https://bugs.webkit.org/show_bug.cgi?id=68297
+
+        Reviewed by James Robinson.
+
+        No functional change, no new test needed.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+
+2011-09-22  Tom Sepez  <tsepez@chromium.org>
+
+        Make XSSAuditor extract meaningful snippet from script blocks for comparison
+        against the URL when checking for reflection.  Avoids getting caugh up in
+        trailing comments.
+        https://bugs.webkit.org/show_bug.cgi?id=68094
+
+        Reviewed by Adam Barth.
+
+        Tests: http/tests/security/xssAuditor/script-tag-with-trailing-comment.html
+               http/tests/security/xssAuditor/script-tag-with-trailing-comment2.html
+               http/tests/security/xssAuditor/script-tag-with-trailing-comment3.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::filterTokenAfterScriptStartTag):
+        (WebCore::XSSAuditor::extractCodeFragment):
+        * html/parser/XSSAuditor.h:
+
+2011-09-22  Nate Chapin  <japhet@chromium.org>
+
+        Remove didReceiveAuthenticationChallenge() from SubresourceLoaderClient.
+        Instead, add a load-specific policy for showing the user authentication
+        challenge down to ResourceLoaderOptions and enforce it in ResourceLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=65330
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests, refactor only.
+
+        * loader/DocumentThreadableLoader.cpp:
+        * loader/DocumentThreadableLoader.h:
+        * loader/MainResourceLoader.cpp:
+        * loader/NetscapePlugInStreamLoader.cpp:
+        * loader/ResourceLoadScheduler.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+           For resource types that always send a challenge to the embedder,
+           this patch doesn't change anything. For those that don't, we will
+           always try to continue without credentials when they are forbidden
+           and the platform supports it.
+           When continuing without credentials was initially implemented in
+           DocumentThreadableLoader, we sent the ThreadableLoaderClient a didFail(),
+           then canceled the SubresourceLoader. This was necessary because of the
+           quirks of ThreadableLoader cancellation (we sever the client/loader connections
+           before the load actually cancels), but a simple didFail() should suffice at
+           the ResourceLoader layer.
+        * loader/ResourceLoaderOptions.h:
+        * loader/SubresourceLoader.cpp:
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        * loader/cache/CachedResource.cpp:
+        * loader/cache/CachedResourceLoader.cpp:
+        * loader/cache/CachedResourceLoader.h:
+        * loader/icon/IconLoader.cpp: The ResourceLoader implementation of
+            didReceiveAuthenticationChallege means that IconLoader will now
+            try to continue with credentials on platforms that support it,
+            rather than just canceling outright. We still will never prompt
+            for authentication for icons.
+        * loader/icon/IconLoader.h:
+
+2011-09-22  Dean Jackson  <dino@apple.com>
+
+        Add ENABLE_CSS_FILTERS
+        https://bugs.webkit.org/show_bug.cgi?id=68652
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-22  Anders Carlsson  <andersca@apple.com>
+
+        Make sure to update scrollbars in ScrollView::setFrameRect
+        https://bugs.webkit.org/show_bug.cgi?id=68663
+
+        Reviewed by Sam Weinig.
+
+        Call updateScrollbars after setting the frame rect. This was previously done by the
+        call to setBoundsSize from RenderWidget::setWidgetGeometry but setBoundsSize was removed
+        completely in http://trac.webkit.org/changeset/95725.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setFrameRect):
+
+2011-09-22  Jon Lee  <jonlee@apple.com>
+
+        Progress control gets cropped on the bottom
+        https://bugs.webkit.org/show_bug.cgi?id=68302
+        <rdar://problem/10069915>
+
+        Reviewed by Kent Tamura.
+
+        As it turns out the smaller control type does not get rendered either, so this patch
+        fixes both.
+
+        * manual-tests/dom/progressbar.html: Altered to show both sizes of controls
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm: Added methods to inflate the drawing rect
+        (WebCore::RenderThemeMac::progressBarSizes):
+        (WebCore::RenderThemeMac::progressBarMargins):
+        (WebCore::RenderThemeMac::minimumProgressBarHeight):
+        (WebCore::RenderThemeMac::paintProgressBar): Inflate the rect based on minimum desired
+        control height and glow margin.
+
+2011-09-22  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68658
+
+        Make matchedEndLine smart enough to not match lines that have moved to new
+        regions with different available content logical widths. When this happens, we go ahead and treat
+        the line as failing to match.
+
+        Reviewed by Anders Carlsson.
+
+        Added new tests in fast/regions.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lineWidthForPaginatedLineChanged):
+        * rendering/RenderBlock.h:
+        Enhanced to take an optional delta, so that you can check a new position without having to move
+        the line box.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::checkPaginationAndFloatsAtEndLine):
+        New function that refactors checking for line width changes from region movement as well as the
+        float checks. Since the float checks were duplicated twice, this is a nice refactoring.
+
+        (WebCore::RenderBlock::matchedEndLine):
+        Changed to call the new helper function that will check both floats and pagination.
+
+2011-09-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement Function.prototype.bind
+        https://bugs.webkit.org/show_bug.cgi?id=26382
+
+        Reviewed by Sam Weinig.
+
+        Test: fast/js/function-bind.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+            - Function::create no longer requires functionStructure() to be passed.
+2011-09-22  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68650
+        
+        Make determineStartPosition smart enough to not skip over clean lines that have moved to a new
+        region with a different available content logical width. When this happens, we go ahead and treat
+        the line as dirty.
+
+        Reviewed by Sam Weinig.
+
+        Covered by existing fast/regions tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        Disable region fitting if we detect that the regions all have uniform widths. In this case we know
+        the content width can't vary, so there's no reason to waste time worrying about it.
+
+        (WebCore::RenderBlock::computeLogicalLocationForFloat):
+        Pull the content width checking code into computeLogicalLocationForFloat, since we've incorporated
+        region fitting into the fixed offsets now rather than the line functions.
+
+        (WebCore::RenderBlock::positionNewFloats):
+        Changed because more code moved from here into computeLogicalLocationForFloat.
+        
+        (WebCore::RenderBlock::adjustForRegionFittingIfNeeded):
+        No changes. Just moved the function above the left offset function.
+
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        Added. These new functions give the fixed left and right offsets for lines in a particular region.
+        When no regions are present or when all the regions have a uniform width, they are identical
+        to the versions of the functions that take no arguments.
+
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        Changed to no longer do region fitting, since that's built into logicalRightOffsetForContent now.
+
+        (WebCore::RenderBlock::lineWidthForPaginatedLineChanged):
+        New function that takes a root line box and compares its cached old content width with the width
+        available at the line's new location.
+    
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        Modified to call the logicalXXXOffsetForContent functions that take a block direction position.
+
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        Added the new functions that take a position so that they can fit to the correct region.
+
+        (WebCore::RenderBlock::availableLogicalWidthForContent):
+        New helper function that calls right - left (similar to the corresponding line function that includes
+        floats).
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::determineStartPosition):
+        Patched to check if a line has moved to a place with a different available content width. If so, the line
+        is dirtied so that line layout can re-run.
+
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
+        Sets the paginated line width from the current block logical height.
+
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::paginationStrut):
+        (WebCore::RootInlineBox::setPaginationStrut):
+        Fixed paginationStrut to be LayoutUnit instead of int.
+
+        (WebCore::RootInlineBox::paginatedLineWidth):
+        (WebCore::RootInlineBox::setPaginatedLineWidth):
+        Added paginatedLineWidth getter/setter for caching the content width for a given root line.
+
+2011-09-21  Anders Carlsson  <andersca@apple.com>
+
+        Remove Widget::beforeMouseDown and Widget::afterMouseDown
+        https://bugs.webkit.org/show_bug.cgi?id=68570
+
+        Reviewed by Darin Adler.
+
+        These two member functions were originally added to avoid crashes due to removing NSViews while they were
+        being tracked by AppKit. Since they were added, we've moved away from NSViews for form controls, and the bugs in
+        AppKit that lead to crashes have been fixed.
+
+        This patch was rolled out in r95743 because it broke a bunch of tests. The patch accidentally removed setting back
+        m_sendingEventToSubview to false.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/Widget.h:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::removeFromSuperview):
+
+        * rendering/RenderWidget.cpp:
+        Change widgetHierarchyUpdateSuspendCount to be an unsigned integer instead of a size_t.
+
+2011-09-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r95335 and r95645.
+        http://trac.webkit.org/changeset/95335
+        http://trac.webkit.org/changeset/95645
+        https://bugs.webkit.org/show_bug.cgi?id=68649
+
+        Wrong fix (Requested by rniwa on #webkit).
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState):
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::removeStyleAddedByNode):
+        * editing/EditingStyle.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline):
+        * editing/markup.cpp:
+        (WebCore::StyledMarkupAccumulator::serializeNodes):
+        (WebCore::ancestorToRetainStructureAndAppearance):
+        * editing/markup.h:
+
+2011-09-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Revert r95673 since it caused hundreds of tests to fail on Leopard / Snow Leopard.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/Widget.h:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::removeFromSuperview):
+        (WebCore::Widget::beforeMouseDown):
+        (WebCore::Widget::afterMouseDown):
+        * rendering/RenderWidget.cpp:
+
+2011-09-22  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68638
+        
+        Make RenderFlowThread cache whether or not it has regions of varying widths. This will
+        be relevant for performance as we begin adding code to do custom block painting and
+        layout based off regions not having the same width.
+
+        Reviewed by Dan Bernstein and Adam Roben.
+
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::RenderFlowThread):
+        (WebCore::RenderFlowThread::layout):
+        * rendering/RenderFlowThread.h:
+
+2011-09-22  Anders Carlsson  <andersca@apple.com>
+
+        FrameView::invalidateRect and FrameView::setFrameRect shouldn't take LayoutRects
+        https://bugs.webkit.org/show_bug.cgi?id=68639
+
+        Reviewed by David Hyatt.
+
+        FrameView::invalidateRect and FrameView::setFrameRect override Widget and ScrollView
+        member functions that take IntRects, and Widget coordinates are currently defined in terms of
+        IntRects (and probably always should since we want them to be pixel-aligned).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::invalidateRect):
+        (WebCore::FrameView::setFrameRect):
+        * page/FrameView.h:
+
+2011-09-22  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed build fix (fixes warning about too many parens).
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+
+2011-09-22  Anders Carlsson  <andersca@apple.com>
+
+        Widget::frameRect shouldn't be virtual
+        https://bugs.webkit.org/show_bug.cgi?id=68637
+
+        Reviewed by Sam Weinig.
+
+        Nobody overrides Widget::frameRect and nobody should.
+
+        * platform/Widget.h:
+
+2011-09-22  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        Ref protect shaders in V8WebGLRenderingContext::getAttachedShadersCallback
+        https://bugs.webkit.org/show_bug.cgi?id=68630
+
+        Reviewed by Adam Barth.
+
+        Test: fast/canvas/webgl/shader-deleted-by-accessor.html
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::getAttachedShaders):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getAttachedShaders):
+        * html/canvas/WebGLRenderingContext.h:
+
+2011-09-05  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: abspos-non-replaced-width-margin-000, abspos-replaced-width-margin-000
+        https://bugs.webkit.org/show_bug.cgi?id=47148
+
+        Reviewed by David Hyatt.
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::startOffsetForLine): Return offset from right, rather than offset from left + logicalwidth
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::startAlignedOffsetForLine): 
+              Return the correct alignment for RTL blocks too. Looks like neither FF or Opera do this correctly.
+              Covered by new test left-right-center-inline-alignment-in-ltr-and-rtl-blocks.html
+        * rendering/RenderBox.cpp:
+        (WebCore::computeInlineStaticDistance):
+            - The CSS 2.1 tests now require UAs to use the parent block's direction (rather than the
+              containing block's direction) when computing static distance. The container block's direction
+              is still used in the other width and offset related calculations.
+            - In the context of this function, the logicalRight value is just an element that will be used later to calculate 
+              the correct logicalLeft position for the RTL block. So whereas an LTR block can substract containerBlock->borderLogicalLeft() 
+              in this function directly, an RTL block has to add it here so that will be later subtracted from availableSpace to get 
+              logicalLeft in computePositionedLogicalWidthUsing().
+
+        (WebCore::RenderBox::computePositionedLogicalWidth):
+           - Update comments and use the container block's direction except when calculating the static distance.
+           - Remove the notion of a quirks mode in this function and for calculating the position of replaced and non-replaced
+             blocks generally. This is in line with both FF4 and Opera - neither of which have a quirks mode for them.
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
+           - Update comments and use the container block's direction except when calculating the static distance.
+        (WebCore::RenderBox::computePositionedLogicalHeight):
+           - Update comments.
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+           - Update comments and use the container block's direction except when calculating the static distance.
+           - If the containing block is RTL, always assume that values are over-constrained.
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+           - Update comments.
+
+2011-09-22  Anders Carlsson  <andersca@apple.com>
+
+        Get rid of Widget::setBoundsSize
+        https://bugs.webkit.org/show_bug.cgi?id=68491
+
+        Reviewed by Sam Weinig.
+
+        This basically reverts http://trac.webkit.org/changeset/79167 and http://trac.webkit.org/changeset/75897
+        which were added to make zoom gestures work with WebKit1, but since we don't support zoom gestures in WebKit1
+        anymore, it's better for code cleanliness to get rid of Widget::setBoundsSize and the associated code. While this
+        will unfortunately break transformed iframes in WebKit1, but Simon says that it's an acceptable tradeoff.
+
+        * WebCore.exp.in:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::create):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        (WebCore::Widget::resize):
+        * platform/chromium/PopupContainer.cpp:
+        (WebCore::PopupContainer::refresh):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::setWidget):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        * rendering/RenderWidget.h:
+
+2011-09-21  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68590
+        
+        Floats pushed to next page, column or region don't reposition properly if the amount of
+        available logical width at the new position changes. Refactor the code so that we can
+        run the float placement algorithm again when this happens.
+
+        Covered by an existing regions test that exposes the issue.
+
+        Reviewed by Adam Roben.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeLogicalLocationForFloat):
+        (WebCore::RenderBlock::positionNewFloats):
+        * rendering/RenderBlock.h:
+
+2011-09-22  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Fire TextInput events on speech input, but not set/add any inputMethod attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=60451
+
+        Reviewed by Ryosuke Niwa.
+
+        Introduce code to dispatch TextInput events when text is introduced via
+        the speech input feature. Handle also the cases where speech input is
+        started programmatically from the LayoutTestController.
+
+        Test: fast/speech/input-ontextinput-event.html
+
+        * dom/TextEventInputType.h:
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
+
+2011-09-20  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        Reviewed by Simon Fraser.
+
+        CSS outline property on a narrow element has rabbit ear artifacts
+        https://bugs.webkit.org/show_bug.cgi?id=36793
+
+        Patch by Jason Liu  <jason.liu@torchmobile.com.cn>
+        Patch updated by Robert Hogan <robert@webkit.org>
+
+        Test: fast/css/outline-narrowLine.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine):
+
+2011-09-22  Wajahat Siddiqui  <mdwajahatali.siddiqui@motorola.com>
+
+        [GTK]Popup drop-down menu contains extra empty spaces at beginning and 
+        occupies whole screen when items in popup reaches the height of display device.
+        https://bugs.webkit.org/show_bug.cgi?id=68533
+
+        When implementing the GTK+ menu position function, set pushIn to false, which tell
+        GTK+ not create a menu that is as big as the entire screen.
+
+        Reviewed by Martin Robinson.
+
+        * platform/gtk/GtkPopupMenu.cpp:
+        (WebCore::GtkPopupMenu::menuPositionFunction): Set pushIn to false in the menu position function.
+
+2011-09-22  Alpha Lam  <hclam@chromium.org>
+
+        Define export symbol correctly due to rename of pageScaleFactor to
+        frameScaleFactor.
+
+        Not reviewed. Build fix.
+
+        * WebCore.exp.in:
+
+2011-09-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Console is always scrolled to the top
+        https://bugs.webkit.org/show_bug.cgi?id=67483
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.wasShown):
+        (WebInspector.ConsoleView.prototype.storeScrollPositions):
+        (WebInspector.ConsoleView.prototype.restoreScrollPositions):
+        (WebInspector.ConsoleView.prototype.onResize):
+        (WebInspector.ConsoleView.prototype._immediatelyScrollIntoView):
+        (WebInspector.ConsoleView.prototype._cancelScheduledScrollIntoView):
+        (WebInspector.ConsoleView.prototype._consoleCleared):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype.resize):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        * inspector/front-end/inspector.js:
+        (WebInspector.animateStyle):
+        (WebInspector.animateStyle.forceComplete):
+
+2011-09-22  Alpha Lam  <hclam@chromium.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68081
+        Fix scroll in page scaling mode.
+
+        Reviewed by Simon Fraser.
+
+        The following things are done in this patch:
+        1. Rename Frame::pageScaleFactor() to Frame::frameScaleFactor() to better
+           reflect its purpose.
+        2. Frame::frameScaleFactor() returns the scale factor of this frame with
+           respect to the container. So for the main frame it'll return the scale
+           factor of the page, inner frames will return 1.0
+        3. scrollBy(), scrollX() and scrollY() to take into account of the frame
+           scale factor, causing incorrect coordinates reported to Javascript.
+
+        Tests: fast/events/scale-and-scroll-body.html
+               fast/events/scale-and-scroll-iframe-body.html
+               fast/events/scale-and-scroll-iframe-window.html
+               fast/events/scale-and-scroll-window.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::adjustForZoom):
+        (WebCore::HTMLBodyElement::setScrollLeft):
+        (WebCore::HTMLBodyElement::setScrollTop):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::scrollX):
+        (WebCore::DOMWindow::scrollY):
+        (WebCore::DOMWindow::scrollTo):
+        * page/Frame.cpp:
+        (WebCore::Frame::frameScaleFactor): Return page's scale factor if this is
+                                            main frame, otherwise 1.0
+        * page/Frame.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::applyOverflowToViewport):
+        (WebCore::FrameView::scrollXForFixedPosition):
+        (WebCore::FrameView::scrollYForFixedPosition):
+
+2011-09-22  Andreas Kling  <kling@webkit.org>
+
+        CSS: Implement 'font' property in CSSComputedStyle.
+        https://bugs.webkit.org/show_bug.cgi?id=66666
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/css/getComputedStyle/computed-style-font.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fontFamilyFromStyle): Factored out of getPropertyCSSValue().
+        This function will always return a CSSValueList, as opposed to the previous
+        implementation which would return a CSSPrimitiveValue if there was only one family.
+        getCSSPropertyValue() will return the first element of the list for 1-element lists
+        to preserve the current behavior of getPropertyCSSValue('font-family').
+
+        (WebCore::lineHeightFromStyle): Factored out of getPropertyCSSValue().
+        (WebCore::fontSizeFromStyle): Ditto.
+        (WebCore::fontStyleFromStyle): Ditto.
+        (WebCore::fontVariantFromStyle): Ditto.
+        (WebCore::fontWeightFromStyle): Ditto.
+
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Added
+        implementation of the computed 'font' property (CSSPropertyFont.)
+
+2011-09-22  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        [Qt] Redirection overflow errors have wrong error domain
+        https://bugs.webkit.org/show_bug.cgi?id=68612
+
+        Reviewed by Andreas Kling.
+
+        Redirection overflow currently puts the URL hostname in the errorDomain field.
+        Now redirection overflow errors will be classified as "HTTP" errors.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::redirect):
+
+2011-09-22  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed, rolling out r95699.
+        http://trac.webkit.org/changeset/95699
+        https://bugs.webkit.org/show_bug.cgi?id=67417
+
+        Makes many chromium compositor tests crash
+
+        * platform/CrossThreadCopier.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::~LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::enabled):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::~CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::commitTo):
+        (WebCore::CCLayerTreeHost::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCSettings::CCSettings):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::~CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::finishAllRendering):
+        (WebCore::CCSingleThreadProxy::setNeedsCommit):
+        (WebCore::CCSingleThreadProxy::commitIfNeeded):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::~CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::finishAllRendering):
+        (WebCore::CCThreadProxy::isStarted):
+        (WebCore::CCThreadProxy::initializeLayerRenderer):
+        (WebCore::CCThreadProxy::setNeedsCommit):
+        (WebCore::CCThreadProxy::setNeedsCommitAndRedraw):
+        (WebCore::CCThreadProxy::setNeedsRedraw):
+        (WebCore::CCThreadProxy::start):
+        (WebCore::CCThreadProxy::stop):
+        (WebCore::CCThreadProxy::beginFrameAndCommitOnCCThread):
+        (WebCore::CCThreadProxy::beginFrameAndCommit):
+        (WebCore::CCThreadProxy::commitOnCCThread):
+        (WebCore::CCThreadProxy::drawLayersOnCCThread):
+        (WebCore::CCThreadProxy::setNeedsCommitOnCCThread):
+        (WebCore::CCThreadProxy::setNeedsCommitAndRedrawOnCCThread):
+        (WebCore::CCThreadProxy::setNeedsRedrawOnCCThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2011-09-22  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Make CCThreadProxy draw
+        https://bugs.webkit.org/show_bug.cgi?id=67417
+
+        Update the CCThreadProxy to correctly implement the CCProxy
+        interface, do all the right committing and updating steps, and
+        draw a picture on the screen.
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/IntRect.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::~LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::enabled):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::~CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::commitTo):
+        (WebCore::CCLayerTreeHost::commitComplete):
+        (WebCore::CCLayerTreeHost::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::~CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::finishAllRendering):
+        (WebCore::CCSingleThreadProxy::setNeedsCommit):
+        (WebCore::CCSingleThreadProxy::commitIfNeeded):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::~CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::drawLayersAndReadbackOnCCThread):
+        (WebCore::CCThreadProxy::finishAllRendering):
+        (WebCore::CCThreadProxy::isStarted):
+        (WebCore::CCThreadProxy::setNeedsCommit):
+        (WebCore::CCThreadProxy::setNeedsCommitAndRedraw):
+        (WebCore::CCThreadProxy::setNeedsRedraw):
+        (WebCore::CCThreadProxy::start):
+        (WebCore::CCThreadProxy::stop):
+        (WebCore::CCThreadProxy::finishAllRenderingOnCCThread):
+        (WebCore::CCThreadProxy::createBeginFrameAndCommitTaskOnCCThread):
+        (WebCore::CCThreadProxy::beginFrameAndCommit):
+        (WebCore::CCThreadProxy::commitOnCCThread):
+        (WebCore::CCThreadProxy::scheduleDrawTaskOnCCThread):
+        (WebCore::CCThreadProxy::drawLayersAndPresentOnCCThread):
+        (WebCore::CCThreadProxy::drawLayersOnCCThread):
+        (WebCore::CCThreadProxy::updateSchedulerStateOnCCThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2011-09-21  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=67415
+        Text drawn via -webkit-background-clip:text is blurry at device scale factors >1.0
+        -and corresponding-
+        <rdar://problem/10060379>
+
+        Reviewed by Darin Adler.
+
+        New helper function RenderBoxModelObject scales the mask image by the 
+        deviceScaleFactor to get an image of the appropriate resolution. It also scales 
+        the image's GraphicsContext so that the clip is set up on the same scale. Back in 
+        paintFillLayerExtended() we still clip the image to the original maskRect to get 
+        everything scaled back to the appropriate size.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::createDeviceScaledImageBuffer):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+        Make the deviceScaleFactor convenience function just a namespace-level function in 
+        Page rather than a static member or Page.
+        * page/Page.cpp:
+        (WebCore::deviceScaleFactor):
+        * page/Page.h:
+        
+        Pre-existing callers of Page::deviceScaleFactor(Frame*) must now use 
+        WebCore::deviceScaleFactor(Frame*)
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageSizeForError):
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::drawPlatformResizerImage):
+
+2011-09-21  Tim Horton  <timothy_horton@apple.com>
+
+        [CG] ImageBufferData::getData has an invariant comparison in the inner part of a loop which doesn't get optimized out
+        https://bugs.webkit.org/show_bug.cgi?id=68588
+        <rdar://problem/10164955>
+
+        Reviewed by Simon Fraser.
+
+        Factor the unmultiplied check out of the inner loop, resulting in a
+        speed bump in ImageBufferData::getData.
+
+        No new tests, performance improvement.
+
+        * platform/graphics/cg/ImageBufferDataCG.cpp:
+        (WebCore::ImageBufferData::getData):
+
+2011-09-21  Sameer Patil  <mkrp87@motorola.com>
+
+        :hover selector fails when hovering over a child select element with size attribute
+        https://bugs.webkit.org/show_bug.cgi?id=67594
+
+        Reviewed by Darin Adler.
+
+        Test: fast/css/hover-affects-ancestor.html
+
+        This patch addresses the problem of deactivation of the ancestor element :hover rules
+        when hovered its contained elements.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateHoverActiveState):
+
+2011-09-21  Sergey Glazunov  <serg.glazunov@gmail.com>
+
+        [Chromium] Protect message ports from being deleted in V8MessageEvent::portsAccessorGetter
+        https://bugs.webkit.org/show_bug.cgi?id=68584
+
+        Reviewed by Adam Barth.
+
+        Test: fast/dom/message-port-deleted-by-accessor.html
+
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::portsAccessorGetter):
+
+2011-09-21  Anders Carlsson  <andersca@apple.com>
+
+        Add back protection against the NSView going away while handling mouseDown
+        https://bugs.webkit.org/show_bug.cgi?id=68585
+
+        Reviewed by Darin Adler.
+
+        Add calls to RenderWidget::suspendWidgetHierarchyUpdates() and RenderWidget::resumeWidgetHierarchyUpdates(),
+        as a followup fix to https://bugs.webkit.org/show_bug.cgi?id=68570.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+
+2011-09-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=68133
+
+        Reviewed by Darin Adler.
+
+        Tests: fast/css/webkit-mask-crash-fieldset-legend.html
+               fast/css/webkit-mask-crash-figure.html
+               fast/css/webkit-mask-crash-table.html
+               fast/css/webkit-mask-crash-td-2.html
+               fast/css/webkit-mask-crash-td.html
+
+        GraphicsContext::getCTM crashes if called with a GraphicsContext that has painting
+        disabled. RenderBox::paintMaskImages would thus crash if called in this condition.
+
+        This change just modifies the different GraphicsContext::getCTM method to bail early
+        if painting is disabled on the GraphicsContext. The rest of the change is exposing
+        paintControlTints that exposes this.
+
+        * WebCore.exp.in: Added symbols of the newly export window.internals function.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateControlTints): Split this function in 2 so that
+        I can expose the internal paintControlTints.
+
+        (WebCore::FrameView::paintControlTints):
+        This is the one exposed to Internals as we want to be testable regardless of
+        whether the platform supports control tints.
+
+        * page/FrameView.h: Added paintControlTints.
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::paintControlTints):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+        Added a way to force a fake painting so that we can easily reproduce the bugs.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        Fixed all our back-end to exit early if painting is disabled.
+
+2011-09-19  Jer Noble  <jer.noble@apple.com>
+
+        Add settings to control the availability of the Web Audio API to WebKit and WebKit2.
+        https://bugs.webkit.org/show_bug.cgi?id=68382
+
+        Reviewed by Darin Adler.
+
+        Only create a AudioContext object if the Web Audio feature is runtime-enabled in Settings.
+
+        No new tests, as this feature is not yet enabled by default.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webkitAudioContext):
+
+2011-09-21  Anders Carlsson  <andersca@apple.com>
+
+        Remove checks for Leopard-only Objective-C APIs
+        https://bugs.webkit.org/show_bug.cgi?id=68579
+
+        Reviewed by Sam Weinig.
+
+        We can always assume that OBJC_API_VERSION is at least 2, it's been 2 since Leopard.
+
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::methodsNamed):
+        (JSC::Bindings::ObjcClass::fieldNamed):
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::ObjcField):
+        * page/mac/EventHandlerMac.mm:
+
+2011-09-21  Anders Carlsson  <andersca@apple.com>
+
+        Remove Widget::beforeMouseDown and Widget::afterMouseDown
+        https://bugs.webkit.org/show_bug.cgi?id=68570
+
+        Reviewed by Sam Weinig.
+
+        These two member functions were originally added to avoid crashes due to removing NSViews while they were
+        being tracked by AppKit. Since they were added, we've moved away from NSViews for form controls, and the bugs in
+        AppKit that lead to crashes have been fixed.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/Widget.h:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::removeFromSuperview):
+
+        * rendering/RenderWidget.cpp:
+        Change widgetHierarchyUpdateSuspendCount to be an unsigned integer instead of a size_t.
+
+2011-09-21  Abhishek Arya  <inferno@chromium.org>
+
+        Not use anonymousContainer on beforeChild calculation
+        and let later code handle it. Fix style update on block-level
+        anonymous objects.
+        https://bugs.webkit.org/show_bug.cgi?id=67656
+
+        Reviewed by David Hyatt.
+
+        Test: fast/table/quote-text-around-iframe.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleDidChange):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::propagateStyleToAnonymousChildren):
+
+2011-09-21  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68562
+        
+        Pagination struts don't update properly when collapsing margin estimates are wrong.
+        
+        Refactor the pagination adjustments that happen during block layout to allow for
+        a 3-pass layout system instead of just a 2-pass layout system. The basic idea is
+        to come up with an estimate that includes collapsing, clearance and pagination.
+        
+        If the estimate only with collapsing and clearance was wrong, then we lay out again
+        using the correct collapsing margin values and clearance before applying pagination breaks.
+        
+        After this second layout, the normal code that runs when unpaginated compares estimates
+        and lays out a third time to account for adjustments as a result of pagination movement.
+
+        Reviewed by Sam Weinig.
+
+        Added fast/regions/text-regions-split-small-pagination.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::estimateLogicalTopPosition):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::adjustBlockChildForPagination):
+        * rendering/RenderBlock.h:
+
 2011-09-21  James Robinson  <jamesr@chromium.org>
 
         [chromium] SharedGraphicsContext3D's context should not be destroyed during atexit