Merge 132961 (merge bug: http://crbug.com/158840) - Fix potential overflow in jpeg exif reader. Fou…

Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 133084)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,3 +1,1641 @@
+2012-10-30  Nico Weber  <thakis@chromium.org>
+
+        Fix potential overflow in jpeg exif reader. Found by aedla@google.com.
+        https://bugs.webkit.org/show_bug.cgi?id=100320
+
+        Reviewed by Eric Seidel.
+
+        Adding more than 1 element past an array is undefined, so don't do it.
+
+        No test, since in practice ifd will just overflow and `end - ifd` will
+        become much larget than 2 and the `if (end - ifd < 2)` a few lines
+        down will catch that case.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::readImageOrientation):
+
+2012-10-26  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Add the ValidatedCustomFilterOperation class
+        https://bugs.webkit.org/show_bug.cgi?id=100558
+
+        Reviewed by Dean Jackson.
+
+        Added the ValidatedCustomFilterOperation class. The file is now almost empty,
+        but more is going to come in the following patches.
+
+        Added the a filter operation type VALIDATED_CUSTOM and updated the compositors to ignore
+        such operations for now.
+        
+        No new tests, there is no new functionality yet.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createFilterOperations):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp:
+        (WebCore::LayerWebKitThread::filtersCanBeComposited):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::filtersCanBeComposited):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::copyWebCoreFilterOperationsToWebFilterOperations):
+        * platform/graphics/filters/FilterOperation.h:
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasCustomFilter):
+        (WebCore::FilterOperations::getOutsets):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.cpp: Added.
+        (WebCore):
+        (WebCore::ValidatedCustomFilterOperation::ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::~ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::blend):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.h: Added.
+        (WebCore):
+        (ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::create):
+        (WebCore::ValidatedCustomFilterOperation::affectsOpacity):
+        (WebCore::ValidatedCustomFilterOperation::movesPixels):
+        (WebCore::ValidatedCustomFilterOperation::blendingNeedsRendererSize):
+        (WebCore::ValidatedCustomFilterOperation::operator==):
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Ensure an identical FeatureDefine files across all projects. Changes:
+
+          - ENABLE_CSS_BOX_DECORATION_BREAK should be in all
+          - ENABLE_PDFKIT_PLUGIN should be in all
+          - ENABLE_RESOLUTION_MEDIA_QUERY should be in all
+          - ENABLE_ENCRYPTED_MEDIA should be in all
+          - ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING with corrected value
+          - Some alphabetical ordering cleanup
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Andreas Kling  <kling@webkit.org>
+
+        StylePropertySet: Convert more logic to use PropertyReference.
+        <http://webkit.org/b/100779>
+
+        Reviewed by Antti Koivisto.
+
+        Rewrite more of the StylePropertySet logic to use PropertyReference instead of CSSProperty.
+        This is cleanup before changing the internal storage layout of immutable StylePropertySet.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
+        * css/CSSComputedStyleDeclaration.h:
+        * css/CSSStyleDeclaration.h:
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+        * css/PropertySetCSSStyleDeclaration.h:
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::appendFontLonghandValueIfExplicit):
+        (WebCore::StylePropertySet::fontValue):
+        (WebCore::StylePropertySet::get4Values):
+        (WebCore::StylePropertySet::getPropertyCSSValue):
+        (WebCore::StylePropertySet::removeProperty):
+        (WebCore::StylePropertySet::propertyIsImportant):
+        (WebCore::StylePropertySet::getPropertyShorthand):
+        (WebCore::StylePropertySet::isPropertyImplicit):
+        (WebCore::StylePropertySet::setProperty):
+        (WebCore::StylePropertySet::mergeAndOverrideOnConflict):
+        (WebCore::StylePropertySet::findPropertyIndex):
+        (WebCore::StylePropertySet::findMutableCSSPropertyWithID):
+        (WebCore::StylePropertySet::propertyMatches):
+        (WebCore::StylePropertySet::removeEquivalentProperties):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::PropertyReference::shorthandID):
+        (WebCore::StylePropertySet::PropertyReference::isImplicit):
+
+2012-10-30  Eric Seidel  <eric@webkit.org>
+
+        Teach RenderTable how to use Vector::insert and Vector::append instead of its own custom memmove code
+        https://bugs.webkit.org/show_bug.cgi?id=100428
+
+        Reviewed by Julien Chaffraix.
+
+        RenderTable is now like all other clients of Vector instead of being
+        needlessly different. :)
+
+        insert, append and grow all use the same expandCapacity logic under the covers
+        and Vector::insert uses TypeOperations::moveOverlapping which should use memmove
+        by default for unknown types.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::splitColumn):
+        (WebCore::RenderTable::appendColumn):
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::ColumnStruct::ColumnStruct):
+
+2012-10-30  Vincent Scheib  <scheib@chromium.org>
+
+        Unreviewed, rolling out r132927.
+        http://trac.webkit.org/changeset/132927
+        https://bugs.webkit.org/show_bug.cgi?id=100558
+
+        Compile error on Chromium builders
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createFilterOperations):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp:
+        (WebCore::LayerWebKitThread::filtersCanBeComposited):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::filtersCanBeComposited):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::copyWebCoreFilterOperationsToWebFilterOperations):
+        * platform/graphics/filters/FilterOperation.h:
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasCustomFilter):
+        (WebCore::FilterOperations::getOutsets):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.cpp: Removed.
+        * platform/graphics/filters/ValidatedCustomFilterOperation.h: Removed.
+
+2012-10-30  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Restrict link highlights to targets that display a hand-cursor
+        https://bugs.webkit.org/show_bug.cgi?id=99862
+
+        Reviewed by James Robinson.
+
+        To avoid applying highlights to inappropriate targets, such as large divs with
+        click handlers installed, test candidate targets and only highlight them if they
+        would normally display a hand cursor on mouse over. This is a heuristic, but has
+        been tested and found effective in practice.
+
+        This CL refactors EventHandler::selectCursor() to make the logic for determining
+        if CURSOR_AUTO should resolve to CURSOR_POINTER available outside EventHandler.
+
+        Relies on existing cursor tests.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::useHandCursor):
+        (WebCore):
+        (WebCore::EventHandler::selectCursor):
+        * page/EventHandler.h:
+        (EventHandler):
+
+2012-10-30  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Remove CookieDatabaseBackingStore::upgradeTableIfNeeded
+        https://bugs.webkit.org/show_bug.cgi?id=100783
+
+        Reviewed by Yong Li.
+
+        PR 220513.
+
+        Remove CookieDatabaseBackingStore::upgradeTableIfNeeded, it was needed for backwards
+        compatibility, but not needed anymore.
+
+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp:
+        (WebCore::CookieDatabaseBackingStore::invokeOpen):
+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h:
+
+2012-10-30  Glenn Adams  <glenn@skynav.com>
+
+        [CSS] Expand -webkit-line-break value space
+        https://bugs.webkit.org/show_bug.cgi?id=100739
+
+        Reviewed by Eric Seidel.
+
+        (1) expand -webkit-line-break to include new values defined by CSS3 Text [1], i.e., 'auto', 'strict', 'loose';
+        (2) change default (initial) value for -webkit-line-break to 'auto' to match CSS3 Text;
+        (3) rename enum EKHTMLLineBreak to LineBreak, renaming enum values appropriately;
+
+        New tests to be added when functionality of new values is added. No rendering behavior change at this time.
+        Only externally visible change is default (initial) value returning 'auto' rather than 'normal', for which 3 existing
+        tests that were sensitive to this value have been updated. Note that until the functionality for the new values is
+        added, any actual use of the new values will be treated as the same as the pre-existing 'normal' value, i.e., the
+        default semantics.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Update from kthmlLineBreak() to lineBreak().
+
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        Update values supported for CSSPropertyWebkitLineBreak.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator LineBreak):
+        Update LineBreak enumeration values (previously EKHTMLLineBreak).
+
+        * css/CSSValueKeywords.in:
+        Update keywords used for -webkit-line-break.
+
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder):
+        Update names for line break style getter/setter.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        Remove khtml prefix on line break related state.
+
+        * rendering/style/RenderStyle.h:
+        Remove khtml prefix on line break related methods. Update to redefined LineBreak
+        enumeration type.
+
+        * rendering/style/RenderStyleConstants.h:
+        Rename EKHTMLLineBreak enumeration to LineBreak.
+        Redefine LineBreak enumeration to include new CSS3 Text modes (auto, loose, strict) and
+        use better names.
+
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        Remove khtml prefix on line break related state references.
+
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+        Remove khtml prefix on line break related state. Widen field to 3 bits to support 8 values,
+        of which 5 are now used.
+
+2012-10-30  Antti Koivisto  <antti@apple.com>
+
+        Avoid unnecessary style recalcs on class attribute mutation
+        https://bugs.webkit.org/show_bug.cgi?id=100776
+
+        Reviewed by Andreas Kling.
+
+        There is no need to invalidate element style on class attribute change if neither the added
+        or removed classes featured in any active stylesheet.
+
+        * css/RuleFeature.cpp:
+        (WebCore::RuleFeatureSet::add):
+        (WebCore::RuleFeatureSet::clear):
+        (WebCore::RuleFeatureSet::reportMemoryUsage):
+        * css/RuleFeature.h:
+        (RuleFeatureSet):
+        * css/RuleSet.cpp:
+        (WebCore::collectFeaturesFromSelector):
+        
+            Collect classes mentioned in CSS selectors the same way ids and attribute names are
+            already collected.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::hasSelectorForClass):
+        
+            Add a method to test if a given class name is mentioned anywhere in stylehseets.
+
+        (WebCore):
+        * css/StyleResolver.h:
+        * css/StyleScopeResolver.h:
+        (WebCore):
+        * dom/Element.cpp:
+        (WebCore::collectAddedAndRemovedClasses):
+        (WebCore):
+        (WebCore::Element::classAttributeChanged):
+        
+            Figure out which classes were added and removed. Test if they are present in any style
+            rule and invalidate the style only if they are.
+
+        * dom/SpaceSplitString.cpp:
+        (WebCore::SpaceSplitStringData::add):
+        (WebCore::SpaceSplitStringData::remove):
+        (WebCore::SpaceSplitString::add):
+        (WebCore::SpaceSplitString::remove):
+        
+            Added bool return value to indicate if anything was actually removed. Reorganized 
+            the code a bit to avoid unnecessary uniquing when nothing changes.
+
+        * dom/SpaceSplitString.h:
+        (SpaceSplitStringData):
+        (SpaceSplitString):
+
+2012-10-30  Robert Hogan  <robert@webkit.org>
+
+        white-space: nowrap inline element beside a floated element wraps incorrectly without trailing textnode/newline
+        https://bugs.webkit.org/show_bug.cgi?id=29648
+
+        Reviewed by Levi Weintraub.
+
+        A no-wrap child on a line inside an autowrap container should move to the next line if a float doesn't allow
+        it to fit. This will happen if there is trailing space after the no-wrap child but not if it's the last renderer
+        on the line. This is because nextLineBreak() is only interested in the white-space style of the current renderer 
+        and the renderer's next sibling (if there is one) when deciding whether it needs to fit below any floats that
+        push it beyond the edge of the container. There isn't any situation in which a no-wrap child shouldn't move 
+        below a float on an auto-wrap line though, so this check always needs to respect the container's white-space style too.
+
+        Test: fast/text/whitespace/no-wrap-child-in-auto-wrap-container.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
+2012-10-26  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Add the ValidatedCustomFilterOperation class
+        https://bugs.webkit.org/show_bug.cgi?id=100558
+
+        Reviewed by Dean Jackson.
+
+        Added the ValidatedCustomFilterOperation class. The file is now almost empty,
+        but more is going to come in the following patches.
+
+        Added the a filter operation type VALIDATED_CUSTOM and updated the compositors to ignore
+        such operations for now.
+        
+        No new tests, there is no new functionality yet.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createFilterOperations):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp:
+        (WebCore::LayerWebKitThread::filtersCanBeComposited):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::filtersCanBeComposited):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::copyWebCoreFilterOperationsToWebFilterOperations):
+        * platform/graphics/filters/FilterOperation.h:
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasCustomFilter):
+        (WebCore::FilterOperations::getOutsets):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.cpp: Added.
+        (WebCore):
+        (WebCore::ValidatedCustomFilterOperation::ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::~ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::blend):
+        * platform/graphics/filters/ValidatedCustomFilterOperation.h: Added.
+        (WebCore):
+        (ValidatedCustomFilterOperation):
+        (WebCore::ValidatedCustomFilterOperation::create):
+        (WebCore::ValidatedCustomFilterOperation::affectsOpacity):
+        (WebCore::ValidatedCustomFilterOperation::movesPixels):
+        (WebCore::ValidatedCustomFilterOperation::blendingNeedsRendererSize):
+        (WebCore::ValidatedCustomFilterOperation::operator==):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+        * platform/graphics/FontPlatformData.h:
+        (WebCore::FontPlatformData::hash):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        * platform/graphics/filters/CustomFilterProgramInfo.cpp:
+        (WebCore::CustomFilterProgramInfo::hash):
+        (WebCore::ProtectionSpaceHash::hash):
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+        (WebCore::setHTTPBody):
+        Add static_casts to prevent implicit type conversions in non-constant initializer lists.
+        
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::createDragImage):
+        * platform/mac/CursorMac.mm:
+        (WebCore::createNamedCursor):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformSetContentsSize):
+        Use NSMakePoint to prevent implicit type conversions in non-constant initializer lists.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::cookiesEnabled):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::shouldRelaxThirdPartyCookiePolicy):
+        Add explicit casts to NSHTTPCookieAcceptPolicy.
+
+        * platform/mac/WebCoreNSURLExtras.h:
+        * platform/mac/WebCoreNSURLExtras.mm:
+        (WebCore::URLByTruncatingOneCharacterBeforeComponent):
+        (WebCore::dataForURLComponentType):
+        * platform/network/ProtectionSpaceHash.h:
+        Use CFIndex instead of CFURLComponentType, the enum can be mangled differently in some cases, and these
+        functions are exported from WebCore.
+
+2012-10-30  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/12395187> REGRESSION (r121299): OS X Text Replacement forces cursor out of text fields
+        https://bugs.webkit.org/show_bug.cgi?id=100768
+
+        Reviewed by Anders Carlsson.
+
+        r121299 introduced code to restore the paragraph range by saving its length and start offset
+        relative to the document. The latter was obtained by iterating over the range starting at
+        the beginning of the document and ending at the beginning of the paragraph range. However,
+        such a range could not be constructed if the paragraph range was contained in a shadow DOM,
+        since a range must have both its endpoints within the same shadow tree (or not in a shadow
+        tree).
+
+        Test: platform/mac/editing/spelling/autocorrection-in-textarea.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAndReplaceFor): Changed paragraphStartIndex to be relative to the
+        root container of paragraphRange, using the same logic used by
+        checkForDifferentRootContainer() in Range.cpp.
+
+2012-10-30  Dan Carney  <dcarney@google.com>
+
+        Remove ensureAuxiliaryContext
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Reviewed by Adam Barth.
+
+        Removed auxilliaryContext as use if it is problematic in IDB.
+
+        No new tests. No change in functionality.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::update):
+        (WebCore::IDBCursor::setValueReady):
+        * Modules/indexeddb/IDBCursor.h:
+        (IDBCursor):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::generateIndexKeysForValue):
+        (WebCore::IDBObjectStore::put):
+        (WebCore):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromScriptValueAndKeyPath):
+        (WebCore::deserializeIDBValue):
+        (WebCore::injectIDBKeyIntoScriptValue):
+        * bindings/v8/IDBBindingUtilities.h:
+        (WebCore):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toV8Context):
+        (WebCore):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.h:
+
+2012-10-30  Huang Dongsung  <luxtella@company100.net>
+
+        [CSS Shaders] Add CustomFilterRenderer to reuse this class by Accelerated Compositing.
+        https://bugs.webkit.org/show_bug.cgi?id=98989
+
+        Reviewed by Dean Jackson.
+
+        Extract CustomFilterRenderer class from the rendering part of FECustomFilter.
+        FECustomFilter now plays a role in extending FilterEffect and delegates
+        rendering CSS Shaders to CustomFilterRenderer.
+
+        CustomFilterRenderer does not know Filter and FilterEffect. We can
+        create a CustomFilterRenderer instance with only GraphicsContext3D and
+        CustomFilterValidatedProgram. It means that Accelerated Compositing can
+        create the CustomFilterRenderer instance if Accelerated Compositing has
+        GraphicsContext3D and CustomFilterOperation, and it is already possible.
+
+        This patch prepares to enable CSS Shaders on Accelerated Compositing.
+
+        No new tests. Covered by css3/filters/custom
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/CustomFilterRenderer.cpp: Added.
+        (WebCore):
+        (WebCore::orthogonalProjectionMatrix):
+        (WebCore::CustomFilterRenderer::create):
+        (WebCore::CustomFilterRenderer::CustomFilterRenderer):
+        (WebCore::CustomFilterRenderer::~CustomFilterRenderer):
+        (WebCore::CustomFilterRenderer::premultipliedAlpha):
+        (WebCore::CustomFilterRenderer::programNeedsInputTexture):
+        (WebCore::CustomFilterRenderer::draw):
+        (WebCore::CustomFilterRenderer::prepareForDrawing):
+        (WebCore::CustomFilterRenderer::initializeCompiledProgramIfNeeded):
+        (WebCore::CustomFilterRenderer::initializeMeshIfNeeded):
+        (WebCore::CustomFilterRenderer::bindVertexAttribute):
+        (WebCore::CustomFilterRenderer::unbindVertexAttribute):
+        (WebCore::CustomFilterRenderer::bindProgramArrayParameters):
+        (WebCore::CustomFilterRenderer::bindProgramNumberParameters):
+        (WebCore::CustomFilterRenderer::bindProgramTransformParameter):
+        (WebCore::CustomFilterRenderer::bindProgramParameters):
+        (WebCore::CustomFilterRenderer::bindProgramAndBuffers):
+        (WebCore::CustomFilterRenderer::unbindVertexAttributes):
+        * platform/graphics/filters/CustomFilterRenderer.h: Copied from Source/WebCore/platform/graphics/filters/FECustomFilter.h.
+        (WebCore):
+        (CustomFilterRenderer):
+          CustomFilterRenderer renders custom filters in GPU using a
+          GraphicsContext3D.
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter):
+        (WebCore::FECustomFilter::create):
+        (WebCore::FECustomFilter::deleteRenderBuffers):
+        (WebCore::FECustomFilter::drawFilterMesh):
+        (WebCore::FECustomFilter::prepareForDrawing):
+        (WebCore::FECustomFilter::applyShader):
+        (WebCore::FECustomFilter::resolveMultisampleBuffer):
+        (WebCore::FECustomFilter::resizeMultisampleBuffers):
+        (WebCore::FECustomFilter::resizeContext):
+        * platform/graphics/filters/FECustomFilter.h:
+        (WebCore):
+        (FECustomFilter):
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::createCustomFilterEffect):
+
+2012-10-30  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: Associate console messages with the requests that caused them.
+        https://bugs.webkit.org/show_bug.cgi?id=99941
+
+        Reviewed by Pavel Feldman.
+
+        The inspector currently supports the concept of a request's "initiator"
+        in order to add context to console messages that are generated in
+        response to a specific request. The initiator is used as the message's
+        anchor link iff a requestID is present, and no stack trace is present.
+
+        Currently, this functionality is only exposed to three specific
+        callsites: 'InspectorConsoleAgent::didFinishXHRLoading',
+        'InspectorConsoleAgent::didReceiveResponse', and
+        'InspectorConsoleAgent::didFailLoading'. This patch adds a generic
+        mechanism to associate requests with console messages by passing the
+        request's identifier through 'ScriptExecutionContext::addConsoleMessage'
+        or 'Console::addMessage' when relevant.
+
+        This patch should have no visible changes. It just installs some new
+        piping, and adjusts the three methods mentioned above to use it.
+        Existing tests shouldn't break.
+
+        * dom/Document.cpp:
+        (WebCore::Document::addMessage):
+        * dom/Document.h:
+        (Document):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to Console::addMessage.
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::addConsoleMessage):
+        * dom/ScriptExecutionContext.h:
+        (ScriptExecutionContext):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to the subclass' addMessage method.
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+            Accept an unsigned long instead of a string, and move the conversion
+            from WebCore request identifiers to Inspector request identifiers
+            into ConsoleMessage.
+        * inspector/ConsoleMessage.h:
+        (ConsoleMessage):
+            Add 'requestIdentifier' (defaulting to 0) to the
+            ConsoleMessage constructor that accepts a ScriptCallStack (it was
+            already part of the constructor that accepted a line number).
+        * inspector/IdentifiersFactory.cpp:
+        (WebCore::IdentifiersFactory::requestId):
+            If the provided request identifier is 0, return an empty string.
+            This simplifies the logic at the callsite.
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::addMessageToConsole):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to the 'ConsoleMessage' constructor after converting it to
+            an internal identifier via 'IdentifiersFactor::requestId'.
+        (WebCore::InspectorConsoleAgent::didFinishXHRLoading):
+        (WebCore::InspectorConsoleAgent::didReceiveResponse):
+        (WebCore::InspectorConsoleAgent::didFailLoading):
+            Use the new 'requestIdentifier' parameter on addMessageToConsole
+            rather than replicating the behavior in each of these three methods.
+        * inspector/InspectorConsoleAgent.h:
+        (InspectorConsoleAgent):
+            Add a 'requestIdentifier' parameter (defaulting to 0).
+        * inspector/InspectorConsoleInstrumentation.h:
+        (WebCore::InspectorInstrumentation::addMessageToConsole):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::addMessageToConsoleImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to lower levels of the stack.
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        * page/Console.h:
+        (Console):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to 'InspectorInstrumentation::addMessageToConsole'.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::addMessageToWorkerConsole):
+        * workers/WorkerContext.h:
+        (WorkerContext):
+            Add a 'requestIdentifier' parameter (defaulting to 0), and pipe it
+            through to 'InspectorInstrumentation::addMessageToConsole'.
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        String::createCFString should return a RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=100419
+
+        Reviewed by Andreas Kling.
+
+        Update callers of String::createCFString.
+
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::createFileURLForApplicationCacheResource):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createPropertyListRepresentation):
+        * platform/LocalizedStrings.cpp:
+        (WebCore::formatLocalizedString):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::keygenKeychainItemName):
+        (WebCore::imageTitle):
+        * platform/RuntimeApplicationChecks.cpp:
+        (WebCore::mainBundleIsEqualTo):
+        * platform/cf/FileSystemCF.cpp:
+        (WebCore::fileSystemRepresentation):
+        (WebCore::pathAsURL):
+        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+        (PlatformCAAnimation::PlatformCAAnimation):
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+        (resubmitAllAnimations):
+        (PlatformCALayer::addAnimationForKey):
+        (PlatformCALayer::removeAnimationForKey):
+        (PlatformCALayer::setName):
+        * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
+        (PlatformCALayerWinInternal::updateTiles):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::utiFromMIMEType):
+        * platform/graphics/cg/ImageSourceCGMac.mm:
+        (WebCore::MIMETypeForImageSourceType):
+        (WebCore::preferredExtensionForImageSourceType):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::cocoaTypeFromHTMLClipboardType):
+        (WebCore::utiTypeFromCocoaType):
+        * platform/mac/SSLKeyGeneratorMac.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/network/cf/AuthenticationCF.cpp:
+        (WebCore::createCF):
+        * platform/network/cf/CookieJarCFNet.cpp:
+        (WebCore::setCookies):
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::platformResolve):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::cfError):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::setDefaultMIMEType):
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::setPrivateBrowsingEnabled):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::cfURLResponse):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::SocketStreamHandle::addCONNECTCredentials):
+        (WebCore::SocketStreamHandle::copyCFStreamDescription):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::adjustMIMETypeIfNecessary):
+        * platform/text/cf/HyphenationCF.cpp:
+        (WebCore::::createValueForKey):
+        * platform/text/cf/StringCF.cpp:
+        (WTF::String::createCFString):
+        * platform/text/cf/StringImplCF.cpp:
+        (WTF::StringImpl::createCFString):
+        * platform/text/mac/StringImplMac.mm:
+        (WTF::StringImpl::operator NSString *):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::encode):
+        * platform/win/SearchPopupMenuWin.cpp:
+        (WebCore::autosaveKey):
+        (WebCore::SearchPopupMenuWin::saveRecentSearches):
+
+2012-10-30  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: Support embedded SVG objects in AX tree
+        https://bugs.webkit.org/show_bug.cgi?id=97571
+
+        Reviewed by Tim Horton.
+
+        This patch allows an SVG image from another resource to be hooked into the AX
+        hierarchy. This is done by creating an AX wrapper for the root SVG that holds onto
+        its native parent image. The SVGChromeClient is then used to connect to this SVG resource.
+
+        Test: accessibility/svg-remote-element.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::createFromRenderer):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isAccessibilitySVGRoot):
+        (AccessibilityObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::detach):
+        (WebCore::AccessibilityRenderObject::offsetBoundingBoxForRemoteSVGElement):
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        (WebCore::AccessibilityRenderObject::remoteSVGElementHitTest):
+        (WebCore::AccessibilityRenderObject::elementAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::isSVGImage):
+        (WebCore::AccessibilityRenderObject::detachRemoteSVGRoot):
+        (WebCore::AccessibilityRenderObject::remoteSVGRootElement):
+        (WebCore::AccessibilityRenderObject::addRemoteSVGChildren):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilitySVGRoot.cpp: Added.
+        (WebCore::AccessibilitySVGRoot::AccessibilitySVGRoot):
+        (WebCore::AccessibilitySVGRoot::~AccessibilitySVGRoot):
+        (WebCore::AccessibilitySVGRoot::create):
+        (WebCore::AccessibilitySVGRoot::parentObject):
+        * accessibility/AccessibilitySVGRoot.h: Added.
+        (AccessibilitySVGRoot): Class provides ability to wrap the SVG root of a remote accessibility element.
+        (WebCore::AccessibilitySVGRoot::setParent):
+        (WebCore::AccessibilitySVGRoot::isAccessibilitySVGRoot):
+        (WebCore::toAccessibilitySVGRoot):
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper position]): The position of AX elements within a remote SVG element needs to be handled 
+        in a special manner.
+        (createAccessibilityRoleMap):
+        * loader/EmptyClients.h:
+        (EmptyChromeClient): Expose isEmptyChromeClient() so Accessibility will know when to apply different policies for finding
+        the accessibility bounding rect of elements.
+        (WebCore::EmptyChromeClient::isEmptyChromeClient):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::isEmptyChromeClient):
+        (ChromeClient):
+        * svg/graphics/SVGImage.cpp:
+        * svg/graphics/SVGImageChromeClient.h: Added.
+        (SVGImageChromeClient): Expose the SVGImageChromeClient so that Accessibility can reference its image.
+        (WebCore::SVGImageChromeClient::SVGImageChromeClient):
+        (WebCore::SVGImageChromeClient::isSVGImageChromeClient):
+        (WebCore::SVGImageChromeClient::image):
+        (WebCore::SVGImageChromeClient::chromeDestroyed):
+        (WebCore::SVGImageChromeClient::invalidateContentsAndRootView):
+        (WebCore::toSVGImageChromeClient):
+
+2012-10-30  Dan Carney  <dcarney@google.com>
+
+        add 7 bit strings capabilities to the v8 binding layer
+        https://bugs.webkit.org/show_bug.cgi?id=91850
+
+        Reviewed by Adam Barth.
+
+        This change enables the v8 binding layer to make use of webkit's
+        8 bit string capabilities. Using 8 bit strings leads to certain
+        benchmark performance improvemnts as can be seen in
+        https://bug-91850-attachments.webkit.org/attachment.cgi?id=163334.
+
+        No new tests. Test coverage already extensive.
+
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore::V8PerIsolateData::visitExternalStrings):
+        * bindings/v8/V8StringResource.cpp:
+        (StringTraits):
+        (WebCore::false):
+        (WebCore):
+        (WebCore::true):
+        (WebCore::v8StringToWebCoreString):
+        * bindings/v8/V8ValueCache.cpp:
+        (WebCore::makeExternalString):
+        (WebCore::WebCoreStringResourceBase::visitStrings):
+        * bindings/v8/V8ValueCache.h:
+        (WebCore::WebCoreStringResourceBase::WebCoreStringResourceBase):
+        (WebCore::WebCoreStringResourceBase::~WebCoreStringResourceBase):
+        (WebCore::WebCoreStringResourceBase::atomicString):
+        (WebCoreStringResourceBase):
+        (WebCore::WebCoreStringResourceBase::memoryConsumption):
+
+2012-10-30  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [AC] Fix compilation warnings when enabling Accelerated Compositing
+        https://bugs.webkit.org/show_bug.cgi?id=100741
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix a few compilation warnings when building EFL port
+        with accelerated compositing enabled.
+
+        No new tests, no behavior change.
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::GraphicsSurfacePrivate::GraphicsSurfacePrivate):
+        (WebCore::resolveGLMethods):
+        (WebCore::GraphicsSurface::platformCopyToGLTexture):
+        (WebCore::GraphicsSurface::platformLock):
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::updateContents):
+
+2012-10-30  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Animations jump when the page is suspended
+        https://bugs.webkit.org/show_bug.cgi?id=100673
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        GraphicsLayerAnimations::pause() should accept time from start and not an offset.
+
+        We need to support the "freeze" API before this can be reliably tested.
+        See https://bugs.webkit.org/show_bug.cgi?id=100703.
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::GraphicsLayerAnimation::pause):
+
+2012-10-30  Kondapally Kalyan  <kalyan.kondapally@intel.com>
+
+        [Qt][EFL][AC] While Using WebGL, MiniBrowser segfaults on Refreshing the page.
+        https://bugs.webkit.org/show_bug.cgi?id=100639.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        TextureMapperSurfaceBackingStore can import textures from a GraphicSurface.
+        In such cases GraphicsSurfaceGLX creates an XPixmap to read texture content
+        from a given WindowId, but doesn't create any new window.
+        However, OffScreenRootWindow always tries to unmap window (in its destructor) resulting in segfault.
+        With this patch OffScreenRootWindow would check for a valid window before trying to unmap it.
+
+        * platform/graphics/surfaces/qt/GraphicsSurfaceGLX.cpp:
+        (WebCore::OffScreenRootWindow::~OffScreenRootWindow):
+
+2012-10-30  Emil A Eklund  <eae@chromium.org>
+
+        [subixel] Change LineWidth::shrinkAvailableWidthForNewFloatIfNeeded to not pixel snap
+        https://bugs.webkit.org/show_bug.cgi?id=100742
+
+        Reviewed by Levi Weintraub.
+
+        As we no longer pixel snap values when computing the current width for a
+        line we should not do it in shrinkAvailableWidthForNewFloatIfNeeded
+        either.
+
+        Test: fast/sub-pixel/float-wrap-zoom.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::LineWidth): Remove unnecessary ifdef.
+        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded): Use float values instead of pixel snapped/floored values as the line width calculations uses floats.
+
+2012-10-30  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Reject vertex shaders with custom attributes
+        https://bugs.webkit.org/show_bug.cgi?id=98973
+
+        Reviewed by Dean Jackson.
+
+        Improved CSS Custom Filters shader validation. With this patch:
+        (1) Shaders with custom attributes do not execute (e.g. attribute float my_attribute;).
+        (2) Shaders with a_triangleCoord defined do not execute with an attached mesh.
+
+        Most of the changes are from renaming CustomFilterOperation::MeshType to
+        CustomFilterMeshType, and moving the enumeration to CustomFilterConstants.h. This avoids
+        pulling in CustomFilterOperation for classes that only care about the mesh type.
+
+        Note that in CSS Custom Filters, the a_triangleCoord attribute is only available in detached
+        meshes. In detached meshes, no vertices are shared between triangles. Thus, each vertex
+        belongs to a specific triangle, which a_triangleCoord identifies. In attached meshes,
+        vertices can belong to many triangles, which a_triangleCoord cannot identify because it's
+        only a vec3.
+
+        Tests:
+        Add two new checks to the test file:
+            css3/filters/custom/invalid-custom-filter-attribute-types.html
+        Add two new shaders:
+            css3/filters/resources/invalid-custom-attribute.vs
+            css3/filters/resources/invalid-a-triangle-coord-with-attached-mesh.vs
+
+        * WebCore.xcodeproj/project.pbxproj:
+            Update a broken reference to CustomFilterConstants.h in the Xcode project file.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+            Replace CustomFilterOperation::MeshType with CustomFilterMeshType.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createCustomFilterOperation): Ditto.
+        * platform/graphics/filters/CustomFilterConstants.h:
+            Add CustomFilterMeshType enum to share across the Custom Filters codebase, so that we
+            don't have to include CustomFilterOperation just to access the old
+            CustomFilterOperation::MeshType enum.
+        * platform/graphics/filters/CustomFilterMesh.cpp:
+        (WebCore::CustomFilterMesh::CustomFilterMesh):
+            Replace CustomFilterOperation::MeshType with CustomFilterMeshType.
+        * platform/graphics/filters/CustomFilterMesh.h:
+        (WebCore::CustomFilterMesh::create): Ditto.
+        (WebCore::CustomFilterMesh::meshType): Ditto.
+        (CustomFilterMesh): Ditto.
+        * platform/graphics/filters/CustomFilterMeshGenerator.cpp: Ditto.
+        (WebCore::CustomFilterMeshGenerator::CustomFilterMeshGenerator): Ditto.
+        (WebCore::CustomFilterMeshGenerator::dumpBuffers): Ditto.
+        * platform/graphics/filters/CustomFilterMeshGenerator.h:
+        (CustomFilterMeshGenerator): Ditto.
+        (WebCore::CustomFilterMeshGenerator::floatsPerVertex): Ditto.
+        (WebCore::CustomFilterMeshGenerator::verticesCount): Ditto.
+        * platform/graphics/filters/CustomFilterOperation.cpp: 
+        (WebCore::CustomFilterOperation::CustomFilterOperation): Ditto.
+        * platform/graphics/filters/CustomFilterOperation.h:
+        (WebCore::CustomFilterOperation::create): Ditto.
+        (WebCore::CustomFilterOperation::meshType): Ditto.
+        (CustomFilterOperation): Ditto.
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore::CustomFilterProgram::CustomFilterProgram):
+            Add a meshType constructor parameter because the program now needs to know the meshType
+            to properly validate.
+        (WebCore::CustomFilterProgram::programInfo):
+            Pass meshType to CustomFilterProgram constructor.
+        (WebCore::CustomFilterProgram::operator==):
+            Check the meshType in the equals operator.
+        * platform/graphics/filters/CustomFilterProgram.h:
+            Make vertexShaderString() and fragmentShaderString() public so that we don't have to ask
+            for a programInfo object just to get the shader strings in
+            CoordinatedGraphicsArgumentCoders.cpp.
+        * platform/graphics/filters/CustomFilterProgramInfo.cpp:
+        (WebCore::CustomFilterProgramInfo::CustomFilterProgramInfo):
+            Add a meshType constructor parameter.       
+        (WebCore::CustomFilterProgramInfo::hash):
+            Include the meshType in the validated program hash, since the same shader code can pass
+            or fail validation based on the meshType.
+        (WebCore::CustomFilterProgramInfo::operator==):
+            Check the meshType in the equals operator.
+        * platform/graphics/filters/CustomFilterProgramInfo.h:
+        (CustomFilterProgramInfo):
+            Update method prototype.
+        (WebCore::CustomFilterProgramInfo::meshType):
+            Add meshType getter.
+        * platform/graphics/filters/CustomFilterValidatedProgram.cpp:
+        (WebCore::CustomFilterValidatedProgram::validateSymbols):
+            If the author defines attribute that is is not found in the built-in attribute map,
+            reject the shader.
+            If the author defines a_triangleCoord without a detached mesh type, reject the shader.
+            Also, make this previously file-static function into a method of
+            CustomFilterValidatedProgram because it now needs to access the m_meshType.
+        * platform/graphics/filters/CustomFilterValidatedProgram.h:
+        (CustomFilterValidatedProgram):
+            Add a meshType constructor parameter because the program now needs to know the meshType
+            to properly validate.
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter):
+            Replace CustomFilterOperation::MeshType with CustomFilterMeshType.
+        (WebCore::FECustomFilter::create): Ditto.
+        (WebCore::FECustomFilter::bindProgramAndBuffers): Ditto.
+        (WebCore::FECustomFilter::unbindVertexAttributes): Ditto.
+        * platform/graphics/filters/FECustomFilter.h:
+        (FECustomFilter): Ditto.
+        * rendering/style/StyleCustomFilterProgram.h:
+        (WebCore::StyleCustomFilterProgram::create):
+            Add a meshType constructor parameter.
+        (WebCore::StyleCustomFilterProgram::StyleCustomFilterProgram): Ditto.
+
+2012-10-30  Andrey Lushnikov  <lushnikov@google.com>
+
+        Web Inspector: adds isOwnProperty to remote protocol
+        https://bugs.webkit.org/show_bug.cgi?id=100664
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/runtime/runtime-getProperties-isOwnProperty.html
+
+        Adds requested 'isOwn' property to the 'PropertyDescriptor' class of the
+        remote debugging protocol. 
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+
+2012-10-30  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt][Win] BitmapTextureGL::updateContents() broken after r132019.
+        https://bugs.webkit.org/show_bug.cgi?id=100680
+
+        When creating a temporary for swizzling the image data,
+        the temporary will have the target size.
+        Therefore no offset within the available image data
+        shall be applied in this case.
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::updateContents):
+
+2012-10-30  Kent Tamura  <tkent@chromium.org>
+
+        Remove unused code for old input[type=date] UI
+        https://bugs.webkit.org/show_bug.cgi?id=100734
+
+        Reviewed by Hajime Morita.
+
+        The old input[type=date] UI used in Google Chrome 20-23 (text field with
+        a fixed placeholder) was replaced with ENABLE_INPUT_MULTIPLE_FIELDS_UI.
+
+        No new tests because of no behavior changes.
+
+        * html/DateInputType.cpp: Remove ENABLE_INPUT_TYPE_DATE_LEGACY_UI code path.
+        * html/DateInputType.h: Ditto.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::supportsPlaceholder):
+        Remove fixed-placeholder feature.
+        * html/HTMLInputElement.h:
+        (HTMLInputElement): Ditto.
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement): isPlaceholderEmpty() is not needed to be virtual
+        * html/InputType.cpp: Remove fixed-placeholder feature.
+        * html/InputType.h: Ditto.
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::updatePlaceholderText): Ditto.
+
+        * platform/text/PlatformLocale.h:
+        (Locale): Remove dateFormatText.
+        * platform/text/LocaleICU.cpp: Ditto.
+        * platform/text/LocaleICU.h: Ditto.
+        * platform/text/LocaleNone.cpp: Ditto.
+        * platform/text/mac/LocaleMac.h: Ditto.
+        * platform/text/mac/LocaleMac.mm: Ditto.
+        * platform/text/win/LocaleWin.cpp: Ditto.
+        * platform/text/win/LocaleWin.h: Ditto.
+        * platform/LocalizedStrings.h:
+        (WebCore): Remove unused functions; calendarTodayText,
+        calendarClearText, dateFormatYearText, dateFormatMonthText,
+        dateFormatDayInMonthText
+
+2012-10-30  Kent Tamura  <tkent@chromium.org>
+
+        Fix crash by calendar picker or suggestion picker
+        https://bugs.webkit.org/show_bug.cgi?id=100728
+
+        Reviewed by Hajime Morita.
+
+        Change DateTimeChooser so that it is ref-coutned.
+
+        Test: platform/chromium/fast/forms/calendar-picker/calendar-picker-type-change-onchange.html
+
+        * platform/DateTimeChooser.h: Made DateTimeChooser RefCounted.
+        * page/ChromeClient.h:
+        (ChromeClient): openDateTimeChooser should return PassRefPtr<DateTimeChooser>.
+        * loader/EmptyClients.h:
+        (EmptyChromeClient): Follow the above change.
+        * loader/EmptyClients.cpp:
+        (WebCore::EmptyChromeClient::openDateTimeChooser): Ditto.
+
+        * html/shadow/PickerIndicatorElement.h:
+        (PickerIndicatorElement): Hold DateTimeChooser in RefPtr<DateTimeChooser>.
+        * html/shadow/PickerIndicatorElement.cpp:
+        (WebCore::PickerIndicatorElement::PickerIndicatorElement):
+        Remove unnecessary initialization.
+
+2012-10-30  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Timeline: promote "cpu activity" out of experiment
+        https://bugs.webkit.org/show_bug.cgi?id=100726
+
+        Reviewed by Pavel Feldman.
+
+        1. CPU actibity bars redesigned
+        2. Experiment setting removed
+        3. Feature setting added
+
+        * English.lproj/localizedStrings.js: Updated setting label.
+        * inspector/front-end/Settings.js: Replaced experiment with setting.
+        * inspector/front-end/SettingsScreen.js: Added new setting.
+        * inspector/front-end/TimelinePanel.js: Update cpu bars appearance.
+        * inspector/front-end/timelinePanel.css: Ditto.
+
+2012-10-30  Michelangelo De Simone  <michelangelo@webkit.org>
+
+        [CSS Shaders] Change the default compositing mode and the default CSS value for <fragmentShader>
+        https://bugs.webkit.org/show_bug.cgi?id=94020
+
+        Reviewed by Dean Jackson.
+
+        The default compositing mode has been changed from "normal source-over" to
+        "normal source-atop". This applies to the default fragment shader that will
+        kick in when there is no explicit fragment shader or mix function defined.
+
+        This has required to update all the existing tests; the dummy empty fragment
+        shader has also been removed because not needed.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter): An existence check
+        for the fragment shader has been added.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createCustomFilterOperation): The default program
+        has been updated: PROGRAM_TYPE_BLENDS_TEXTURE (compositing enabled) now is
+        the default.
+        * platform/graphics/filters/CustomFilterProgramInfo.h:
+        (WebCore::CustomFilterProgramMixSettings::CustomFilterProgramMixSettings):
+        New CustomFilterProgramMixSettings defaults to "source-atop" composite
+        operator.
+
+2012-10-30  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        [Qt][Mac] Unreviewed build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=100727.
+
+        Speculative build fix after 132858. Include missing CoreFoundation/CoreFoundation.h header.
+
+        * platform/text/cf/AtomicStringCF.cpp:
+
+2012-10-30  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Optimize vclip for NEON in VectorMath
+        https://bugs.webkit.org/show_bug.cgi?id=100737
+
+        Reviewed by Zoltan Herczeg.
+
+        Speed up vclip in VectorMath with NEON intrinsics.
+
+        * platform/audio/VectorMath.cpp:
+        (WebCore::VectorMath::vclip):
+
+2012-10-30  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Software and composited filters should have a common path
+        https://bugs.webkit.org/show_bug.cgi?id=100532
+
+        Reviewed by Dean Jackson.
+
+        Added computeFilterOperations as a common method between the software filters
+        and hardware composited ones. The method rejects custom filters that are not
+        loaded yet. In bug 100533 it will also convert the CustomFilterOperation to a 
+        ValidatedCustomFilterOperation. That will help us keep the loading and verification 
+        code for the custom filters common across all the ports.
+
+        No new tests, just refactoring existing code.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeFilterOperations):
+        (WebCore):
+        (WebCore::RenderLayer::updateOrRemoveFilterEffect):
+        * rendering/RenderLayer.h:
+        (WebCore):
+        (RenderLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateFilters):
+
+2012-10-30  Alexei Filippov  <alph@chromium.org>
+
+        Web Inspector: Implement native memory snapshot grid view
+        https://bugs.webkit.org/show_bug.cgi?id=100656
+
+        Native memory snapshots are now shown as an expandable tree form
+        using the grid control.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemorySnapshotView):
+        (WebInspector.NativeSnapshotDataGrid):
+        (WebInspector.NativeSnapshotNode):
+        (WebInspector.NativeSnapshotNode.prototype.createCell):
+        (WebInspector.NativeSnapshotNode.prototype._createSizeCell):
+        (WebInspector.NativeSnapshotNode.prototype._populate):
+        (WebInspector.MemoryBlockViewProperties._initialize):
+        (WebInspector.MemoryBlockViewProperties._forMemoryBlock):
+        * inspector/front-end/dataGrid.css:
+        (.data-grid td):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.memory-bar-chart-bar):
+        (.native-snapshot-view):
+        (.native-snapshot-view.visible):
+        (.native-snapshot-view .data-grid):
+        (.native-snapshot-view .data-grid table):
+        (.native-snapshot-view .data-grid div.size-text):
+        (.native-snapshot-view .data-grid div.size-bar):
+        (.native-snapshot-view .data-grid div.percent-text):
+
+2012-10-30  Zoltan Nyul  <zoltan.nyul@intel.com>
+
+        3d rotation with [0, 0, 0] direction vector should not be applied
+        https://bugs.webkit.org/show_bug.cgi?id=100733
+
+        Reviewed by Levi Weintraub.
+
+        As stated in the specification (http://dev.w3.org/csswg/css3-3d-transforms/#transform-functions),
+        a direction vector that cannot be normalized, such as [0, 0, 0], will cause the rotation to not be applied,
+        but webkit applies it with [1, 0, 0] direction vector.
+
+        Test: transforms/3d/general/3dtransform-values.html
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::rotate3d):
+
+2012-10-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: report actual object address for CachedResourceClients
+        https://bugs.webkit.org/show_bug.cgi?id=100659
+
+        Reviewed by Alexander Pavlov.
+
+        Skipped pointers to objects that are not allocated on the heap directly.
+
+        To test this we need to compare addresses of objects traversed by the memory
+        insrumentation with those allocated by the memory allocator. The latter set
+        should include the former one.
+
+        * css/StyleResolver.cpp:
+        (WTF): skip pointers to RuleData structures as they are stored by value in RuleSet
+        objects and should not be reported separately.
+        * loader/cache/CachedResource.cpp:
+        (WTF): do not report memory occupied by CachedResourceClients as objects implementing
+        the interface may have address which differ from CachedResourceClient*. The clients
+        should be reachable from their instrumented owners where we know exact type of the
+        clients and hence can figure correct address.
+
+2012-10-29  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Refatoring] Remove ElementShadow::insertionPointFor
+        https://bugs.webkit.org/show_bug.cgi?id=100625
+
+        Reviewed by Hajime Morita.
+
+        Now that ElementShadow::insertionPointFor does not do any special things, and it's only used in
+        ComposedShadowTreeWalker. So we can remove it.
+
+        No new tests, simple refactoring.
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::resolveReprojection):
+        (WebCore::AncestorChainWalker::parent):
+        * dom/ElementShadow.cpp:
+        * dom/ElementShadow.h:
+        (ElementShadow):
+        * dom/ShadowRoot.h: ShadowRoot has insertionPointFor declaration, but we don't have any implementation.
+        We should remove it.
+
+2012-10-29  Andy Estes  <aestes@apple.com>
+
+        Fix a typo that caused SVG external resources to be blocked on
+        platforms other than Chromium.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+
+2012-10-29  Keishi Hattori  <keishi@webkit.org>
+
+        NSLocale leaks in LocaleMac
+        https://bugs.webkit.org/show_bug.cgi?id=97628
+
+        Reviewed by Kent Tamura.
+
+        We need to adopt the NSLocale object so it doesn't leak and
+        determineLocale() should return a NSLocale without additional retain.
+
+        No new tests.
+
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::determineLocale): Returns a RetainPtr<NSLocale>.
+        (WebCore::Locale::create):
+        (WebCore::LocaleMac::LocaleMac): m_locale should adopt the NSLocale object.
+        (WebCore::LocaleMac::create): LocaleMac constructor takes NSLocale without additional retain.
+
+2012-10-29  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Disable redirect to data scheme for potential fishing.
+        https://bugs.webkit.org/show_bug.cgi?id=100713
+
+        Reviewed by George Staikos.
+
+        We will disable redirect to data scheme to avoid potential security concern, 
+        described in klevjers.com/papers/phishing.pdf.
+
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleRedirect):
+
+2012-10-29  Vincent Scheib  <scheib@chromium.org>
+
+        Unreviewed, rolling out r132845.
+        http://trac.webkit.org/changeset/132845
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Broke chromium builds, linker errors from
+        IDBBindingUtilitiesTest
+
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        * Modules/indexeddb/IDBRequest.h:
+        (IDBRequest):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromScriptValueAndKeyPath):
+        (WebCore):
+        (WebCore::deserializeIDBValue):
+        (WebCore::injectIDBKeyIntoScriptValue):
+        (WebCore::idbKeyToScriptValue):
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore::V8PerIsolateData::ensureAuxiliaryContext):
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.h:
+        (V8PerIsolateData):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/WebCore.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Removed.
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        AtomicString(CFStringRef) shouldn't unconditionally create a StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=100701
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.exp.in:
+        Export AtomicString::add(CFStringRef).
+
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add AtomicStringCF.cpp 
+
+        * platform/text/cf/AtomicStringCF.cpp: Added.
+        (WTF::AtomicString::add):
+        When trying to add the atomic string to the table, first try to get a Latin-1 pointer
+        from the string. Second, try to get a Unicode pointer from the string.
+        If that also fails, copy the string to a temporary unicode buffer and add it from there.
+
+        * platform/text/cf/HyphenationCF.cpp:
+        (WebCore::::createValueForKey):
+        Update for AtomicString::createCFString being removed.
+
+2012-10-25  Stephen Chenney  <schenney@chromium.org>
+
+        feImage should not be allowed to self reference
+        https://bugs.webkit.org/show_bug.cgi?id=94652
+
+        Reviewed by Eric Seidel.
+
+        Add cycle detection for SVG filter application, and also fix a problem
+        with graphics context restore when filters are applied. This also
+        converts the flags in FilterData to a state tracking system, as the
+        number of flags was getting messy and only one flag is valid at any given time.
+
+        Test: svg/filters/feImage-self-and-other-referencing.html
+
+        * rendering/svg/RenderSVGResourceFilter.cpp: Convert to new FilterData
+        state management and enable cycle detection.
+        (WebCore):
+        (WebCore::RenderSVGResourceFilter::removeClientFromCache): Change isBuilt and markedForRemoval flags to state enums.
+        (WebCore::RenderSVGResourceFilter::applyResource): Change flags to state enums and detect cycles.
+        (WebCore::RenderSVGResourceFilter::postApplyResource): Change flags to state and add handling
+        for the various states.
+        (WebCore::RenderSVGResourceFilter::primitiveAttributeChanged): Change isBuilt flag to state enums.
+        * rendering/svg/RenderSVGResourceFilter.h:
+        (WebCore::FilterData::FilterData):
+        (FilterData): Convert to a state tracking system.
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced): Add a block around the
+        SVGRenderingContext so that it applies the filter and reverts the
+        context before the calling method restores the context.
+
+2012-10-29  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/12592716> REGRESSION (r132545): With full-page accelerated drawing, a
+        reproducible hang occurs at <http://www.cbsnews.com/stories/2010/01/24/ftn/main6136386.shtml>.
+
+        Reviewed by Anders Carlsson.
+
+        Work around <rdar://problem/12584492> by limiting the scope of the fix for <http://webkit.org/b/100413>.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::clipOut): Reverted to using CGContextGetClipBoundingBox() rather
+        than CGRectInfinite when the context is accelerated and has a transform that is not just
+        a translation or a scale.
+
+2012-10-29  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Simplify AuthenticationChallengeManager::instance
+        https://bugs.webkit.org/show_bug.cgi?id=100614
+
+        Reviewed by Yong Li.
+        Internally reviewed by Lyon Chen.
+
+        Use a standard Singleton pattern here, this makes sure we create lazily.
+
+        * platform/blackberry/AuthenticationChallengeManager.cpp:
+        (WebCore):
+        * platform/blackberry/AuthenticationChallengeManager.h:
+        (AuthenticationChallengeManager):
+
+2012-10-29  Adam Barth  <abarth@webkit.org>
+
+        Block SVG external references pending a security review
+        https://bugs.webkit.org/show_bug.cgi?id=100635
+
+        Reviewed by Eric Seidel.
+
+        We need to do a security review of loading external SVG references
+        before we're sure that it is safe.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::createFilterOperations):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+
+2012-10-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Crash on checking version of corrupt backing store
+        https://bugs.webkit.org/show_bug.cgi?id=100692
+
+        Reviewed by Tony Chang.
+
+        If the backing store fails to open (due to corruption, non-writeable disk, etc)
+        the subsequent schema version check dereferences a null pointer. Fix to only
+        do the schema check if the database opened.
+
+        Chromium tests will be included with crrev.com/11196029
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::open):
+
+2012-10-29  Philip Rogers  <pdr@google.com>
+
+        Let SVGElements have pending resources.
+        https://bugs.webkit.org/show_bug.cgi?id=99694
+
+        Reviewed by Eric Seidel.
+
+        Our SVG pending resource tracking is used for handling dynamic id changes. For example,
+        if an SVG element references an id that is not yet in the document (or has been removed),
+        the SVG element will be 'pending' an id. When styled elements are inserted into
+        the document, buildPendingResourcesIfNeeded() is called to force any pending elements
+        to resolve their dependencies. Only SVGStyledElement targets can be referenced using
+        this infrastructure, and that is not changed with this patch.
+
+        Previously, only SVGStyledElements could have pending resources. Some examples of where
+        this is violated are SVGAnimateElement and SVGMPathElement which are not a styled elements
+        but which can have pending references (they can reference styled elements and
+        paths, respectively). This patch changes the pending resource handling to allow
+        any SVGElement to have pending resources.
+
+        This patch is only a refactoring of code in preparation for WK99694 and does not
+        affect existing functionality or tests.
+
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::addPendingResource):
+        (WebCore::SVGDocumentExtensions::isElementPendingResources):
+        (WebCore::SVGDocumentExtensions::isElementPendingResource):
+        (WebCore::SVGDocumentExtensions::removeElementFromPendingResources):
+        (WebCore::SVGDocumentExtensions::removeElementFromPendingResourcesForRemoval):
+        * svg/SVGDocumentExtensions.h:
+        (WebCore):
+        (SVGDocumentExtensions):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::~SVGElement):
+        (WebCore::SVGElement::removedFrom):
+        (WebCore::SVGElement::hasPendingResources):
+        (WebCore):
+        (WebCore::SVGElement::setHasPendingResources):
+        (WebCore::SVGElement::clearHasPendingResourcesIfPossible):
+        * svg/SVGElement.h:
+        (SVGElement):
+        (WebCore::SVGElement::buildPendingResource):
+        * svg/SVGStyledElement.cpp:
+        (WebCore):
+        (WebCore::SVGStyledElement::buildPendingResourcesIfNeeded):
+        (WebCore::SVGStyledElement::removedFrom):
+        * svg/SVGStyledElement.h:
+        (SVGStyledElement):
+        (WebCore::SVGStyledElement::selfHasRelativeLengths):
+
+2012-10-29  Dan Carney  <dcarney@google.com>
+
+        Remove ensureAuxiliaryContext
+        https://bugs.webkit.org/show_bug.cgi?id=99975
+
+        Reviewed by Adam Barth.
+
+        Removed auxilliaryContext as use if it is problematic in IDB.
+
+        No new tests. No change in functionality.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::update):
+        (WebCore::IDBCursor::setValueReady):
+        * Modules/indexeddb/IDBCursor.h:
+        (IDBCursor):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::generateIndexKeysForValue):
+        (WebCore::IDBObjectStore::put):
+        (WebCore):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromScriptValueAndKeyPath):
+        (WebCore::deserializeIDBValue):
+        (WebCore::injectIDBKeyIntoScriptValue):
+        * bindings/v8/IDBBindingUtilities.h:
+        (WebCore):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toV8Context):
+        (WebCore):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.cpp:
+        (WebCore):
+        * bindings/v8/V8PerIsolateData.h:
+
+2012-10-29  Alpha Lam  <hclam@chromium.org>
+
+        [skia] Handle mask box image.
+        https://bugs.webkit.org/show_bug.cgi?id=100570
+
+        Reviewed by James Robinson.
+
+        When drawing an image with source rectangle it should intersect with image rectangle.
+        This should be the case for drawing single image and tiling an image.
+
+        Test: fast/images/mask-box-image-crash.html
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+
+2012-10-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Support captions when PLUGIN_PROXY_FOR_VIDEO
+        https://bugs.webkit.org/show_bug.cgi?id=100690
+
+        Reviewed by Simon Fraser.
+
+        When built with PLUGIN_PROXY_FOR_VIDEO, WebCore uses a plug-in for the media element's
+        platform media engine. Update this code path so the shadow DOM elements used to display
+        text tracks are created and configured correctly.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::configureMediaControls): Create media controls if necessary.
+
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::layout): Set the position and size of the shadow DOM when the
+            position of the embedded element changes.
+        * rendering/RenderEmbeddedObject.h:
+
+2012-10-29  Justin Novosad  <junov@google.com>
+
+        [Chromium] flickering observed when copying 2D canvas to webGL texture
+        https://bugs.webkit.org/show_bug.cgi?id=100691
+
+        Reviewed by Stephen White.
+
+        Added a flush to the webgl context after texture upload from an image
+        buffer to ensure proper graphics context synchronization with respect
+        to subsequent changes to the source image.
+
+        Tests: fast/canvas/webgl/canvas-2d-webgl-texture.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::copyToPlatformTexture):
+
 2012-10-29  Glenn Adams  <glenn@skynav.com>
 
         [CSSOM] Extraneous whitespace in CSSImportRule.cssText