Merge 137964

Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 138937)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,3 +1,335 @@
+2012-12-17  Matthew Dempsky  <mdempsky@google.com>
+
+        Regression causing DOM objects to have unstable NPObject* references with v8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=104921
+
+        Reviewed by Kentaro Hara.
+
+        Fix regression introduced by changeset 135804 resulting in
+        unstable NPObject* references for v8 objects.  In the iter !=
+        v8NPObjectMap->end() code path, objectVector was left unassigned
+        if the for loop terminated without returning.
+
+        Also, V8Object::GetIdentityHash() is documented as not being guaranteed
+        as unique.  As such, don't ASSERT() that two objects with the same hash
+        must therefor be the same object.
+
+        Tests: plugins/npruntime/embed-property-iframe-equality.html
+
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npCreateV8ScriptObject): Fix.
+
+2012-12-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Seamless iframe should not announce a new browsing context
+        https://bugs.webkit.org/show_bug.cgi?id=86317
+
+        Reviewed by Eric Seidel.
+
+        Introduce a new role for seamless frames so that the platforms can decide what to do
+        with this kind of object. For the mac, it's exposed as a group.
+
+        Test: platform/mac/accessibility/seamless-iframe.html
+
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore):
+        * accessibility/AccessibilityNodeObject.h:
+        (AccessibilityNodeObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isWebArea):
+        (WebCore::AccessibilityObject::isSeamlessWebArea):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+        (WebCore::AccessibilityRenderObject::parentObject):
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (createAccessibilityRoleMap):
+
+2012-12-17  KyungTae Kim  <ktf.kim@samsung.com>
+
+        Percentage width replaced element incorrectly rendered when intrinsic size changed
+        https://bugs.webkit.org/show_bug.cgi?id=102784
+
+        Reviewed by Tony Chang.
+
+        To make relayout when the image dimension is changed,
+        and if the logical width is percent type and the containing block fits to it.
+        In this case, the containing block's width need to be updated first,
+        because the 'newWidth' was calculated from the 'old containing block width'.
+
+        Test: fast/css/percent-width-img-src-change.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageDimensionsChanged):
+
+2012-12-17  Beth Dakin  <bdakin@apple.com>
+
+        DidHitRelevantRepaintedObjectsAreaThreshold should not use the viewRect since 
+        that varies
+        https://bugs.webkit.org/show_bug.cgi?id=105116
+        -and corresponding-
+        <rdar://problem/12889449>
+
+        Reviewed by Geoff Garen.
+
+        DidHitRelevantRepaintedObjectsAreaThreshold should not use the viewRect since that 
+        varies depending on window size. This can lead to a huge amount of variability in 
+        the heuristic which is not desired. Instead, we should use a hard-coded rect.
+        * page/Page.cpp:
+        (WebCore::relevantViewRect):
+        (WebCore):
+        (WebCore::Page::addRelevantRepaintedObject):
+        (WebCore::Page::addRelevantUnpaintedObject):
+
+2012-12-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix repositioning of fixed elements on zooming
+        https://bugs.webkit.org/show_bug.cgi?id=105223
+
+        Reviewed by Beth Dakin.
+
+        When zoomed, scrolling would move the layers of fixed-position
+        elements oddly. This happened because on the scrolling thread we
+        passed a scale of 1, rather than the actual page scale to 
+        scrollOffsetForFixedPosition().
+        
+        Fix by plumbing the page scale through the scrolling state node
+        to the scrolling node.
+
+        Test: platform/mac/tiled-drawing/fixed/four-bars-zoomed.html
+
+        * page/scrolling/ScrollingStateScrollingNode.cpp:
+        (WebCore::ScrollingStateScrollingNode::ScrollingStateScrollingNode):
+        (WebCore::ScrollingStateScrollingNode::setFrameScaleFactor):
+        (WebCore::ScrollingStateScrollingNode::dumpProperties):
+        * page/scrolling/ScrollingStateScrollingNode.h:
+        (WebCore::ScrollingStateScrollingNode::frameScaleFactor):
+        (ScrollingStateScrollingNode):
+        * page/scrolling/ScrollingTreeScrollingNode.cpp:
+        (WebCore::ScrollingTreeScrollingNode::ScrollingTreeScrollingNode):
+        (WebCore::ScrollingTreeScrollingNode::update):
+        * page/scrolling/ScrollingTreeScrollingNode.h:
+        (WebCore::ScrollingTreeScrollingNode::frameScaleFactor):
+        (ScrollingTreeScrollingNode):
+        * page/scrolling/mac/ScrollingCoordinatorMac.h:
+        (ScrollParameters):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::frameViewLayoutUpdated):
+        (WebCore::ScrollingCoordinatorMac::setScrollParametersForNode):
+        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeScrollingNodeMac::setScrollLayerPosition):
+
+2012-12-17  Dima Gorbik  <dgorbik@apple.com>
+
+        Implement matching cue by the class name with ::cue pseudo element
+        https://bugs.webkit.org/show_bug.cgi?id=104191
+
+        Reviewed by Antti Koivisto.
+
+        Implemented the ::cue() pseudo-element with an argument that may hold a simple selector list.
+        This enables matching cue objects by the class name.
+
+        Test: media/track/track-css-matching.html
+
+        * css/CSSGrammar.y.in: support parsing the ::cue() with an argument.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::detectFunctionTypeToken): tokenize the 'cue'.
+        (WebCore::CSSParser::updateSpecifiersWithElementName): do not set the tag for the cue pseudo-element because
+        the ::cue may match elements with different tags.
+        (WebCore::CSSParser::updateSpecifiers): the behavior for the PseudoCue selector should be same as for
+        unknown pseudo elements - the pseudo-element should stay on top of the selector chain.
+        * css/CSSSelector.cpp: added the type detection for the new selector.
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/RuleSet.cpp: add a new list to hold all the rulesets for the new pseudo element.
+        (WebCore::RuleSet::reportMemoryUsage):
+        (WebCore::RuleSet::addRule):
+        (WebCore::RuleSet::shrinkToFit):
+        * css/RuleSet.h:
+        (RuleSet):
+        (WebCore::RuleSet::cuePseudoRules):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+        * css/SelectorChecker.h:
+        (WebCore::SelectorChecker::SelectorCheckingContext::SelectorCheckingContext):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRules):
+        * dom/Element.cpp: an addition to the rare data to be able to find out if the node is a webvtt node.
+        (WebCore):
+        (WebCore::Element::isWebVTTNode):
+        (WebCore::Element::setIsWebVTTNode):
+        (WebCore::Element::cloneDataFromElement):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::NodeRareData):
+        (NodeRareData):
+        (WebCore::NodeRareData::isWebVTTNode):
+        (WebCore::NodeRareData::setIsWebVTTNode):
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::markNodesAsWebVTTNodes): mark the cloned nodes as WebVTT nodes.
+        (WebCore):
+        (WebCore::TextTrackCue::getCueAsHTML):
+        * html/track/TextTrackCue.h:
+        (TextTrackCue):
+        * html/track/WebVTTParser.cpp:
+        (WebCore::WebVTTParser::constructTreeFromToken):
+        * rendering/style/RenderStyleConstants.h:
+
+2012-12-17  Michael Pruett  <michael@68k.org>
+
+        IndexedDB: Don't use strings to represent serialized values
+        https://bugs.webkit.org/show_bug.cgi?id=104354
+
+        Reviewed by Kentaro Hara.
+
+        Use Vector<uint8_t> rather than String to represent serialized values
+        in IndexedDB. This change is necessary to implement IndexedDB for JSC.
+
+        Tests: storage/indexeddb/*
+
+        * Modules/indexeddb/IDBBackingStore.cpp:
+        (WebCore::IDBBackingStore::getRecord):
+        (WebCore::IDBBackingStore::putRecord):
+        (WebCore::ObjectStoreKeyCursorImpl::value):
+        (WebCore::ObjectStoreKeyCursorImpl::ObjectStoreKeyCursorImpl):
+        (WebCore::ObjectStoreCursorImpl::value):
+        (ObjectStoreCursorImpl):
+        (WebCore::ObjectStoreCursorImpl::loadCurrentRow):
+        (WebCore::IndexKeyCursorImpl::value):
+        (WebCore::IndexCursorImpl::value):
+        (WebCore::IndexCursorImpl::IndexCursorImpl):
+        (IndexCursorImpl):
+        (WebCore::IndexCursorImpl::loadCurrentRow):
+        * Modules/indexeddb/IDBBackingStore.h:
+        (IDBBackingStore):
+        (Cursor):
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::CursorPrefetchIterationOperation::perform):
+        * Modules/indexeddb/IDBCursorBackendImpl.h:
+        (WebCore::IDBCursorBackendImpl::value):
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::IndexReferencedValueRetrievalOperation::perform):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::ObjectStoreRetrievalOperation::perform):
+        (WebCore::IDBObjectStoreBackendImpl::ObjectStoreStorageOperation::perform):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore):
+        * bindings/js/SerializedScriptValue.h:
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::createFromWireBytes):
+        (WebCore):
+        (WebCore::SerializedScriptValue::toWireBytes):
+        * bindings/v8/SerializedScriptValue.h:
+        (SerializedScriptValue):
+
+2012-12-17  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Change SET_VAR, SET_BORDERVALUE_COLOR macro to require semicolon(;) at the end of the line
+        https://bugs.webkit.org/show_bug.cgi?id=104774
+
+        Reviewed by Eric Seidel.
+
+        Remove the last ; in SET_VAR, SET_BORDERVALUE_COLOR macro definition.
+        Add the omitted ; in RenderStyle.h | .cpp
+
+        No new tests, just style change.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setColor):
+        (WebCore::RenderStyle::setVisitedLinkColor):
+        (WebCore::RenderStyle::setHorizontalBorderSpacing):
+        (WebCore::RenderStyle::setVerticalBorderSpacing):
+        * rendering/style/RenderStyle.h:
+
+2012-12-17  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Deadlock caused by PluginViewPrivate::destroyBuffers()
+        https://bugs.webkit.org/show_bug.cgi?id=105215
+
+        Reviewed by Rob Buis.
+        Also internally reviewed by George Staikos.
+
+        PR# 266443
+        It should release mutexes before sending sync message.
+
+        * plugins/blackberry/PluginViewPrivateBlackBerry.cpp:
+        (WebCore::PluginViewPrivate::destroyBuffers):
+
+2012-12-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r137198.
+        http://trac.webkit.org/changeset/137198
+        https://bugs.webkit.org/show_bug.cgi?id=105212
+
+        This patch is causing API behavior compatibility problems
+        (Requested by zdobersek on #webkit).
+
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2012-12-17  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: textUnderElement should consider alt text, but skip links and controls
+        https://bugs.webkit.org/show_bug.cgi?id=101650
+
+        Reviewed by Chris Fleizach.
+
+        Getting inner text from an element now ignores focusable descendants
+        and containers, but uses alternative text.  The computation of
+        textUnderElement is now recursive and doesn't depend on text
+        iterators, which might not do the right thing for accessibility
+        anyways.
+
+        For GTK, the old behavior is retained so that support for
+        the object replacement character is still there. Filed a new
+        bug (105214) for GTK folks to look at this.
+
+        Test: accessibility/button-title-uses-inner-img-alt.html
+        Test: accessibility/focusable-div.html
+
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore):
+        (WebCore::shouldUseAccessiblityObjectInnerText):
+        (WebCore::AccessibilityNodeObject::textUnderElement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+
+2012-12-17  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Prevent CookieManager from blocking the WKT thread
+        https://bugs.webkit.org/show_bug.cgi?id=105111
+
+        Prevent CookieManager from blocking the WKT Thread.
+
+        PR 265603
+
+        Reviewed by Rob Buis.
+
+        Adding some guards to CookieManager so it will return immedately
+        if getCookie functions are called when the database isn't loaded yet.
+
+        setCookie functions will be redispatched until the database is ready.
+
+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::CookieManager::CookieManager):
+        (WebCore::CookieManager::setCookies):
+        (WebCore::CookieManager::getCookie):
+        (WebCore::CookieManager::generateHtmlFragmentForCookies):
+        (WebCore::CookieManager::getRawCookies):
+        (WebCore::CookieManager::removeAllCookies):
+        (WebCore::CookieManager::getBackingStoreCookies):
+        (WebCore::CookieManager::setPrivateMode):
+        (WebCore::CookieManager::removeCookieWithName):
+        * platform/blackberry/CookieManager.h:
+
 2012-12-17  Levi Weintraub  <leviw@chromium.org>
 
         Add support for tracking hit test rectangles to enable fast event rejection in the compositor