Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 139576)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,3 +1,3377 @@
+2013-01-09  Tien-Ren Chen  <trchen@chromium.org>
+
+        Make caret repainting container-aware
+        https://bugs.webkit.org/show_bug.cgi?id=103955
+
+        Reviewed by Simon Fraser.
+
+        Only invalidate local rects on the caret's repaint container,
+        instead of invalidating an absolute rect on the whole view.
+
+        Test: fast/repaint/caret-with-transformation.html
+
+        * editing/FrameSelection.cpp:
+        (WebCore::caretRendersInsideNode):
+        (WebCore::caretRenderer):
+        (WebCore::FrameSelection::caretRenderer):
+        (WebCore::DragCaretController::caretRenderer):
+        (WebCore::repaintCaretForLocalRect):
+        (WebCore::FrameSelection::recomputeCaretRect):
+        (WebCore::CaretBase::invalidateCaretRect):
+        (WebCore::FrameSelection::focusedOrActiveStateChanged):
+        * editing/FrameSelection.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::repaintSelection):
+        * rendering/RenderView.h:
+
+2013-01-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Rebaseline the binding test after r139278.
+
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::JSTestEventTarget::getOwnPropertySlot):
+
+2013-01-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        [JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements
+        https://bugs.webkit.org/show_bug.cgi?id=105775
+
+        Reviewed by Sam Weinig.
+
+        Fixed the bug by respecting properties on ancestor classes.
+
+        Test: fast/dom/collection-length-should-not-be-overridden.html
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getStaticValueSlotEntryWithoutCaching): Added.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
+        hierarchy.
+
+2013-01-09  Kondapally Kalyan  <kalyan.kondapally@intel.com>
+
+        [EFL] [WebGL] Remove GLX dependencies from X11WindowResources..
+        https://bugs.webkit.org/show_bug.cgi?id=106319
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        This patch removes GLX specific calls from X11WindowResources.
+        This class is shared by both GLX and EGL implementations.
+
+        * platform/graphics/surfaces/glx/GLXSurface.cpp:
+        (WebCore::GLXTransportSurface::setGeometry):
+        * platform/graphics/surfaces/glx/X11WindowResources.cpp:
+        (WebCore::X11OffScreenWindow::reSizeWindow):
+
+2013-01-09  Huang Dongsung  <luxtella@company100.net>
+
+        Remove deviceScaleFactor argument in computeMinimumScaleFactorForContentContained().
+        https://bugs.webkit.org/show_bug.cgi?id=106500
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        deviceScaleFactor argument is not used after r139189.
+
+        No new tests. Refactoring only.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::computeMinimumScaleFactorForContentContained):
+        * dom/ViewportArguments.h:
+        (WebCore):
+
+2013-01-09  Elliott Sprehn  <esprehn@gmail.com>
+
+        Node::containingShadowRoot should be constant time
+        https://bugs.webkit.org/show_bug.cgi?id=106494
+
+        Reviewed by Dimitri Glazkov.
+
+        There's no reason to traverse up the tree to find the containing
+        ShadowRoot when we already know if we're in a ShadowRoot by looking at
+        the treeScope().
+
+        No new tests, just refactoring.
+
+        * dom/Node.cpp:
+        (WebCore::Node::containingShadowRoot):
+
+2013-01-09  Hajime Morrita  <morrita@google.com>
+
+        [Shadow DOM] Distribution related code on ElementShadow should be minimized.
+        https://bugs.webkit.org/show_bug.cgi?id=106294
+
+        Reviewed by Dimitri Glazkov.
+
+        This change moves ElementShadow::m_selectFeatures,
+        m_shouldCollectSelectFeatureSet and related methods to
+        ContentDistributor.
+
+        There are also some renaming and small refactorings for better fit
+        on new place:
+
+        - shouldCollectSelectFeatureSet is renamed needsSelectorRuleSet for conciseness.
+        - setShouldCollectSelectFeatureSet() which used recursion morphed into
+          iterative willAffectSelector().
+        - ensureDistributionFromDocument() becomes a static method.
+
+        No new tests. Refactoring.
+
+        * WebCore.exp.in:
+        * dom/Element.cpp:
+        (WebCore::Element::shouldInvalidateDistributionWhenAttributeChanged):
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::addShadowRoot):
+        (WebCore::ElementShadow::removeAllShadowRoots):
+        * dom/ElementShadow.h:
+        (ElementShadow):
+        (WebCore::ElementShadow::invalidateDistribution):
+        (WebCore::ElementShadow::ensureDistribution):
+        (WebCore::ElementShadow::didAffectSelector):
+        (WebCore::ElementShadow::willAffectSelector):
+        (WebCore::ElementShadow::containingShadow):
+        (WebCore):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ScopeContentDistribution::registerInsertionPoint):
+        (WebCore::ScopeContentDistribution::unregisterInsertionPoint):
+        (WebCore::ContentDistributor::ContentDistributor):
+        (WebCore::ContentDistributor::ensureDistribution):
+        (WebCore):
+        (WebCore::ContentDistributor::ensureDistributionFromDocument):
+        (WebCore::ContentDistributor::invalidateDistribution):
+        (WebCore::ContentDistributor::ensureSelectFeatureSet):
+        (WebCore::ContentDistributor::collectSelectFeatureSetFrom):
+        (WebCore::ContentDistributor::didAffectSelector):
+        (WebCore::ContentDistributor::willAffectSelector):
+        (WebCore::ContentDistributor::didShadowBoundaryChange):
+        * html/shadow/ContentDistributor.h:
+        (ScopeContentDistribution):
+        (WebCore::ContentDistributor::needsSelectFeatureSet):
+        (WebCore::ContentDistributor::setNeedsSelectFeatureSet):
+        (ContentDistributor):
+        (WebCore::ContentDistributor::setValidity):
+        (WebCore::ContentDistributor::needsInvalidation):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/HTMLContentElement.h:
+        * html/shadow/HTMLShadowElement.cpp:
+        (WebCore::HTMLShadowElement::olderShadowRoot):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::getDistributedNodes):
+        (WebCore::InsertionPoint::insertedInto):
+        (WebCore::InsertionPoint::removedFrom):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::InsertionPoint::canAffectSelector):
+        * testing/Internals.cpp:
+        (WebCore::Internals::hasSelectorForIdInShadow):
+        (WebCore::Internals::hasSelectorForClassInShadow):
+        (WebCore::Internals::hasSelectorForAttributeInShadow):
+        (WebCore::Internals::hasSelectorForPseudoClassInShadow):
+
+2013-01-09  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Assert triggered in SelectorChecker::checkOneSelector when scrollbar (e.g. :horizontal) selector is specified.
+        https://bugs.webkit.org/show_bug.cgi?id=106414
+
+        Reviewed by Dimitri Glazkov.
+
+        In SelectorChecker::checkOneSelector, scrollbar related pseudoType (e.g. :horizontal) is not handled anywhere.
+        This caused ASSERT triggered. We have to check them.
+
+        Test: fast/css/scrollbar-crash.html
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+
+2013-01-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build after http://trac.webkit.org/changeset/139262
+
+        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
+
+2013-01-09  Chris Rogers  <crogers@google.com>
+
+        Allow live/local audio input to be enabled only when needed
+        https://bugs.webkit.org/show_bug.cgi?id=106490
+
+        Reviewed by Kenneth Russell.
+        
+        WebAudio can process live/local audio input using a MediaStreamAudioSourceNode.
+        But currently the audio back-end is not able to know when/if audio input will be
+        needed, so it needs to assume the worst and initialize the system to support potential
+        audio input in all cases.  For some audio back-ends this can end up being less efficient
+        than initializing for audio output only.  This patch adds the ability for the audio back-end
+        to be able to initialize itself for audio input later on, only when/if it's needed.
+
+        * Modules/webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::createMediaStreamSource):
+        * Modules/webaudio/AudioDestinationNode.h:
+        (AudioDestinationNode):
+        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
+        (WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
+        (WebCore::DefaultAudioDestinationNode::initialize):
+        (WebCore::DefaultAudioDestinationNode::uninitialize):
+        (WebCore::DefaultAudioDestinationNode::createDestination):
+        (WebCore):
+        (WebCore::DefaultAudioDestinationNode::enableInput):
+        * Modules/webaudio/DefaultAudioDestinationNode.h:
+        (DefaultAudioDestinationNode):
+        * Modules/webaudio/OfflineAudioDestinationNode.h:
+        (OfflineAudioDestinationNode):
+        (WebCore::OfflineAudioDestinationNode::sampleRate):
+        * platform/audio/AudioDestination.h:
+        (AudioDestination):
+        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
+        (WebCore::AudioDestination::create):
+        * platform/audio/mac/AudioDestinationMac.cpp:
+        (WebCore::AudioDestination::create):
+
+2013-01-09  Tim Horton  <timothy_horton@apple.com>
+
+        Don't drop to huge tile mode if we're only slow-scrolling because of a page overlay
+        https://bugs.webkit.org/show_bug.cgi?id=106502
+        <rdar://problem/12959143>
+
+        Reviewed by Simon Fraser.
+
+        We only use the MainThreadScrollingReason "ForcedOnMainThread" if WebKit2 installs
+        a page overlay (TiledCoreAnimationDrawingArea::didInstallPageOverlay), which clients
+        can cause arbitrarily.
+
+        We probably should still use default-sized tiles in this case (this will also
+        prevent us from falling into gigantic tiles for WebKit2 find-in-page, among other things).
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::adjustTileCacheCoverage):
+
+2013-01-09  Takashi Sakamoto  <tasak@google.com>
+
+        border-radius with box-shadow is not rendered correctly
+        https://bugs.webkit.org/show_bug.cgi?id=106404
+
+        Reviewed by Hajime Morita.
+
+        RoundedRect::isRenderable is wrong. So RoundedRect::adjustRadii
+        is invoked for renderable RoundedRects.
+
+        Test: fast/borders/border-radius-with-box-shadow.html
+
+        * platform/graphics/RoundedRect.cpp:
+        (WebCore::RoundedRect::isRenderable):
+        Have to compare topLeft's height plus bottomLeft's height with
+        rect's height and to compare topRight's height plus bottomRight's
+        height with rect's height.
+
+2013-01-09  Joanmarie Diggs  <jdiggs@igalia.com>
+
+        [GTK] accessibility/aria-labelledby-overrides-label.html requires a proper baseline
+        https://bugs.webkit.org/show_bug.cgi?id=105638
+
+        Reviewed by Martin Robinson.
+
+        The test was failing for two reasons:
+        - AccessibilityRenderObject::correspondingLabelForControlElement() was
+          not ignoring the ARIA labelled-by property
+        - AccessibilityController::accessibleElementById() was not implemented
+
+        Because getting an element by ID cannot be done in the UIProcess, the
+        decision was made to expose the element's ID as an accessible attribute
+        of the object.
+
+        In addition, fixing the bug in AccessibilityRenderObject made it possible
+        to eliminate the Gtk platform-specific expectations for another test.
+
+        No new tests; instead, the failing test was unskipped and a proper baseline
+        provided.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::correspondingLabelForControlElement):
+        Return null for objects where hasTextAlternative() is true.
+        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
+        (webkitAccessibleGetAttributes): Expose the element's ID as an accessible
+        attribute.
+
+2013-01-09  Tony Gentilcore  <tonyg@chromium.org>
+
+        Remove unused includes from HTMLTreeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=106496
+
+        Reviewed by Levi Weintraub.
+
+        Noticed these while searching HTMLTreeBuilder for non-thread friendly deps.
+
+        No new tests because no new functionality.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+
+2013-01-09  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Shaders] Detached identifier after mesh box type is not applied
+        https://bugs.webkit.org/show_bug.cgi?id=105321
+
+        Reviewed by Dean Jackson.
+
+        Before this patch, if a "detached" identifier followed a mesh box type identifier, the
+        detached identifier was not applied. In other words, the mesh would still be attached.
+
+        For example:
+        -webkit-filter: custom(url(...) mix(url(...) normal source-atop), 1 1 border-box detached);
+
+        Although the mesh box type is being removed from the Filter Effects spec, for now, we
+        continue to accept the mesh box type in parsing because of existing content. Eventually,
+        custom filters will transition to an at-rule syntax, once it is defined.
+
+        Test: css3/filters/custom/custom-filter-detached-mesh-with-mesh-box-type.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseCustomFilter):
+            In CSSParser, do not add the mesh box type identifier to the list that will be passed to
+            StyleResolver. StyleResolver is expecting a "detached" identifier in that position and
+            does not interpret mesh box types.
+
+2013-01-09  Dan Winship  <danw@gnome.org>
+
+        [Soup] Handle redirection inside WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=61122
+        https://bugs.webkit.org/show_bug.cgi?id=88961
+
+        Reviewed by Martin Robinson.
+
+        Rather than using libsoup's built-in redirection handling (which
+        doesn't do everything exactly the way WebKit wants, and can't
+        handle redirects to non-http URIs anyway), process redirections
+        ourselves.
+
+        No new tests; unskips a few existing tests.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        (ResourceHandleInternal):
+        * platform/network/soup/ResourceError.h:
+        (ResourceError):
+        * platform/network/soup/ResourceErrorSoup.cpp:
+        (WebCore::ResourceError::transportError):
+        (WebCore):
+        (WebCore::ResourceError::httpError):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore):
+        (WebCore::gotHeadersCallback):
+        (WebCore::restartedCallback):
+        (WebCore::shouldRedirect):
+        (WebCore::doRedirect):
+        (WebCore::redirectCloseCallback):
+        (WebCore::redirectSkipCallback):
+        (WebCore::cleanupSoupRequestOperation):
+        (WebCore::sendRequestCallback):
+        (WebCore::createSoupMessageForHandleAndRequest):
+        (WebCore::createSoupRequestAndMessageForHandle):
+        (WebCore::ResourceHandle::start):
+
+2013-01-09  Florin Malita  <fmalita@chromium.org>
+
+        [Skia] Implement GraphicsContext::addRoundedRectClip() using SkCanvas::clipRRect()
+        https://bugs.webkit.org/show_bug.cgi?id=106461
+
+        Reviewed by Stephen White.
+
+        This patch adds a Skia-specific version of GraphicsContext::addRoundedRectClip() to take
+        advantage of the SkCanvas::clipRRect() primitive.
+
+        As a minor cleanup, the anonymous namespace in GraphicsContextSkia.cpp is extended to cover
+        all the local helper functions.
+
+        No new tests: coverage provided by existing tests.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addRoundedRectClip):
+        (WebCore):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (WebCore::PlatformContextSkia::clipRRect):
+        (WebCore):
+
+2013-01-09  Andreas Kling  <akling@apple.com>
+
+        SVG-as-image: Throw out cached bitmap renderings after they sit unused for some time.
+        <http://webkit.org/b/106484>
+        <rdar://problem/12983216>
+
+        Reviewed by Antti Koivisto.
+
+        Add a one-shot timer to SVGImageCache to self-clear the bitmap cache 30 seconds after last access.
+        This prevents us from keeping huge ImageBuffers around in memory for the lifetime of the elements
+        referencing that particular SVG file. (The ownership model is actually a bit more complicated
+        but that's irrelevant to this issue.)
+
+        10234kB progression on Membuster3.
+
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::SVGImageCache):
+        (WebCore::SVGImageCache::~SVGImageCache):
+        (WebCore::SVGImageCache::clearBitmapCache):
+        (WebCore::SVGImageCache::cacheClearTimerFired):
+        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2013-01-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Assertion failure in SubresourceLoader::didFail when reloading
+        https://bugs.webkit.org/show_bug.cgi?id=101416
+
+        Reviewed by Nate Chapin.
+
+        Test: http/tests/cache/network-error-during-revalidation.html
+
+        * loader/SubresourceLoader.cpp: (WebCore::SubresourceLoader::didFail): Handle revalidation.
+
+2013-01-09  Alexandru Chiculita  <achicu@adobe.com>
+
+        Assertion Failure in WebCore::RenderLayerCompositor::updateCompositingLayers
+        https://bugs.webkit.org/show_bug.cgi?id=106419
+
+        Reviewed by Simon Fraser.
+
+        No new tests added, just un-skipped 3 existing tests.
+
+        RenderLayerCompositor::updateCompositingLayers is being called with a pending layout, so computing the
+        layers at that point would be useless & error-prone as they will be using incorrect layout values. If a layout is pending it means that 
+        RenderLayerCompositor::updateCompositingLayers would get called again after the pending layout ends, so any values calculated at that point would be
+        overwritten immediately. This patch removes the old ASSERT and makes it a return instead.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+
+2013-01-09  Robert Hogan  <robert@webkit.org>
+
+        REGRESSION(r111439): Focus ring is rendered incorrectly in fast/inline/continuation-outlines-with-layers.html
+        https://bugs.webkit.org/show_bug.cgi?id=106064
+
+        Reviewed by David Hyatt.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintObject): 
+
+2013-01-09  Gregg Tavares  <gman@google.com>
+
+        Add stub for CanvasProxy
+        https://bugs.webkit.org/show_bug.cgi?id=106275
+
+        Reviewed by Dean Jackson.
+
+        No new tests as no new fuctionality exposed.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/CanvasProxy.cpp: Added.
+        * html/canvas/CanvasProxy.h: Added.
+        * html/canvas/CanvasProxy.idl: Added.
+
+2013-01-09  Antti Koivisto  <antti@apple.com>
+
+        Release FastMalloc thread caches on memory warning
+        https://bugs.webkit.org/show_bug.cgi?id=106471
+
+        Reviewed by Geoff Garen.
+        
+        FastMalloc keeps some memory in per-thread caches (currently 2MB each). We currently flush these caches on memory warning 
+        for the main thread only. We should do it for other WebKit threads that use FastMalloc too.
+
+        Call WTF::releaseFastMallocFreeMemory in a bunch of WebCore support threads on memory warning. Unfortunately we don't have 
+        an uniform way of doing threads so this requires bunch of thread type specific code.
+        
+        Looks to be ~1% progression in membuster3 final and maximum numbers.
+
+        * platform/mac/MemoryPressureHandlerMac.mm:
+        (WebCore::MemoryPressureHandler::releaseMemory):
+        * storage/StorageTask.cpp:
+        (WebCore::StorageTask::performTask):
+        * storage/StorageTask.h:
+        (WebCore::StorageTask::createReleaseFastMallocFreeMemory):
+        * storage/StorageThread.cpp:
+        (WebCore::storageThreads):
+        (WebCore):
+        (WebCore::StorageThread::StorageThread):
+        (WebCore::StorageThread::~StorageThread):
+        (WebCore::StorageThread::releaseFastMallocFreeMemoryInAllThread):
+        * storage/StorageThread.h:
+        (StorageThread):
+        * workers/WorkerThread.cpp:
+        (WebCore::threadSetMutex):
+        (WebCore::workerThreads):
+        (WebCore::WorkerThread::workerThreadCount):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::~WorkerThread):
+        (WebCore::WorkerThread::releaseFastMallocFreeMemoryInAllThread):
+        (WebCore):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2013-01-09  Tony Gentilcore  <tonyg@chromium.org>
+
+        REGRESSION(r139141): Assertion failure in WebCore::HTMLConstructionSite::HTMLConstructionSite
+        https://bugs.webkit.org/show_bug.cgi?id=106412
+
+        Reviewed by Darin Adler.
+
+        This corrects the assertion added in r139141. The assertion was designed to make sure that we are using the
+        HTMLDocument class. XHTML documents also use HTMLDocument.
+
+        No new tests because no new functionality.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::HTMLConstructionSite):
+
+2013-01-08  Ojan Vafai  <ojan@chromium.org>
+
+        min-content gets the wrong value if min-width is set on some form controls
+        https://bugs.webkit.org/show_bug.cgi?id=106389
+
+        Reviewed by Tony Chang.
+
+        Simplify the logic. The only exposed change in behavior is that
+        m_minPreferredLogicalWidth gets set to m_maxPreferredLogicalWidth
+        instead of 0 when min-width is set.
+
+        Test: fast/forms/min-content-form-controls.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::computePreferredLogicalWidths):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::computePreferredLogicalWidths):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::computePreferredLogicalWidths):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::computePreferredLogicalWidths):
+
+2013-01-09  Abhishek Arya  <inferno@chromium.org>
+
+        Mitigate out-of-bounds access in InlineIterator
+        https://bugs.webkit.org/show_bug.cgi?id=104812
+
+        Reviewed by Levi Weintraub.
+
+        Share code between InlineIterator::current and InlineIterator::previousInSameNode,
+        thereby checking for access outside text renderer's length.
+
+        * rendering/InlineIterator.h:
+        (InlineIterator):
+        (WebCore::InlineIterator::characterAt):
+        (WebCore):
+        (WebCore::InlineIterator::current):
+        (WebCore::InlineIterator::previousInSameNode):
+
+2013-01-09  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        If ImageLoader's loadEventSender or errorEventSender fires after document is detached, the document will be leaked.
+
+        https://bugs.webkit.org/show_bug.cgi?id=106394
+
+        Reviewed by Alexey Proskuryakov.
+
+        ImageLoader's loadEventSender and errorEventSender schedule event dispatching in separate timers and refs
+        the Element in updatedHasPendingEvent.  If the Document is detached before either eventSender dispatches,
+        we would leak the Document since we bail out early in dispatchPendingLoadEvent or dispatchPendingErrorEvent,
+        without deref-ing the Element itself.
+
+        No new tests.  Verified manually by using heap tool to count the living HTMLDocuments.
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::dispatchPendingLoadEvent): also call updatedHasPendingEvent to deref the Element if
+                    the document is detached.
+        (WebCore::ImageLoader::dispatchPendingErrorEvent): ditto.
+
+2013-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r139143.
+        http://trac.webkit.org/changeset/139143
+        https://bugs.webkit.org/show_bug.cgi?id=106135
+
+        Broke Chromium content_browsertests.
+
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore::LevelDBDatabase::open):
+        (WebCore::LevelDBDatabase::openInMemory):
+
+2013-01-09  Sam Weinig  <sam@webkit.org>
+
+        Add Settings.in and make_settings.pl to the project.
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2013-01-09  Ojan Vafai  <ojan@chromium.org>
+
+        marquee special-case in RenderBlock is not needed
+        https://bugs.webkit.org/show_bug.cgi?id=106396
+
+        Reviewed by Simon Fraser.
+
+        This was added in http://trac.webkit.org/changeset/105772. The layout test
+        in that patch (which is disabled) works and the original site that was broken
+        also still works.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computePreferredLogicalWidths):
+
+2013-01-09  Tony Chang  <tony@chromium.org>
+
+        Automatically generate Settings::unifiedTextCheckerEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=106382
+
+        Reviewed by Adam Barth.
+
+        No new tests, no change in behavior. This is covered by existing editing/spelling tests.
+
+        * page/Settings.cpp:
+        (WebCore): Move default value into a global so we can generate the initializer.
+        (WebCore::Settings::Settings): Remove initializer code that is now generated.
+        * page/Settings.h:
+        (Settings): Remove getters and setters.
+        * page/Settings.in: Add entry to be generated.
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup): Remove backup since the generated code does this.
+        (WebCore::InternalSettings::Backup::restoreTo): Remove restore code since the generated code does this.
+        * testing/InternalSettings.h:
+        (InternalSettings): Remove member variable.
+        * testing/InternalSettings.idl: The getter was unused so it's being removed. The setter is now generated.
+
+2013-01-09  Alexis Menard  <alexis@webkit.org>
+
+        Implement CSS computed style value for transition shorthand
+        https://bugs.webkit.org/show_bug.cgi?id=105035
+
+        Reviewed by Dean Jackson.
+
+        Implement support for query the transition and webkit-transition
+        shorthand from the computed style.
+
+        Test: transitions/transitions-parsing.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::createTransitionPropertyValue): Factor the code to create the
+        correct value into a function to reuse it for the shorthand.
+        (WebCore::getTransitionPropertyValue):
+        (WebCore::createTimingFunctionValue): Little refactor, the intermediate
+        local variables are not needed.
+        (WebCore::getTimingFunctionValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2013-01-09  Hajime Morrita  <morrita@google.com>
+
+        Document::setActiveNode() should be Document::setActiveElement()
+        https://bugs.webkit.org/show_bug.cgi?id=106437
+
+        Reviewed by Ojan Vafai.
+
+        No new tests. No functoinal change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setActiveElement):
+        (WebCore::Document::updateHoverActiveState):
+        * dom/Document.h:
+        (Document):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::innerElement):
+        (WebCore):
+        * rendering/HitTestResult.h:
+        (HitTestResult):
+
+2013-01-09  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow DOM]: ShadowRoot has wrong nodeName attribute
+        https://bugs.webkit.org/show_bug.cgi?id=104995
+
+        Reviewed by Dimitri Glazkov.
+
+        According to the Shadow DOM spec, ShadowRoot.nodeName should return '#document-fragment' instead of '#shadow-root'.
+        We remove ShadowRoot::nodeName.
+
+        No new tests, covered by existing tests.
+
+        * dom/ShadowRoot.cpp:
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+
+2013-01-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        [CSS Regions] Selecting text through nested regions causes weird and unclearable selection  
+        https://bugs.webkit.org/show_bug.cgi?id=105641
+
+        Reviewed by David Hyatt.
+
+        If you have a region with a nested region inside what is rendered below the base region and you are trying select text
+        starting from the base region and ending it in the nested region, firstly you got a weird selection, secondly you can't
+        clear the selection. We could prevent this strange behavior by preventing the selection through different region flows.
+
+        Test: fast/regions/selecting-text-through-different-region-flows.html
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Don't allow selection when trying to select different region flows.
+
+2013-01-09  Hugo Parente Lima  <hugo.lima@openbossa.org>
+
+        Regression(r138681) : Add HAVE(ACCESSIBILITY) guard to atk files, fix for a fix.
+        https://bugs.webkit.org/show_bug.cgi?id=106448
+
+        Reviewed by Gyuyoung Kim.
+
+        Some atk files don't use HAVE(ACCESSIBILITY). It might make build errors when
+        the macro isn't enabled.
+
+        * accessibility/atk/WebKitAccessibleHyperlink.h:
+        * accessibility/atk/WebKitAccessibleInterfaceAction.h:
+        * accessibility/atk/WebKitAccessibleInterfaceComponent.h:
+        * accessibility/atk/WebKitAccessibleInterfaceHypertext.h:
+
+2013-01-09  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: native popup buttons should not use textUnderElement for their title
+        https://bugs.webkit.org/show_bug.cgi?id=106349
+
+        Reviewed by Ryosuke Niwa.
+
+        Chromium relies on the older title() method to return its title. As a result, we also
+        need to handle the case of <select> element pop up buttons returning the textUnderElement().
+
+        No new tests. Fix existing break.
+
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::title):
+
+2013-01-09  Jussi Kukkonen  <jussi.kukkonen@intel.com>
+
+        IndexedDB: Remove ASSERTs that can't assert but result in compiler warnings
+        https://bugs.webkit.org/show_bug.cgi?id=106442
+
+        Reviewed by Kentaro Hara.
+
+        IDBLevelDBCoding::m_metaDataType has been changed to unsigned
+        so ASSERT(m_metaDataType >= 0) is no longer useful: the compiler
+        warnings however create build difficulties at least with EFL.
+
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::metaDataType):
+        (WebCore::IDBLevelDBCoding::ObjectStoreMetaDataKey::compare):
+
+2012-12-29  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: Native Memory Instrumentation: fix instrumentation for already instrumented classes 1/N
+        https://bugs.webkit.org/show_bug.cgi?id=106445
+
+        Reviewed by Vsevolod Vlasov.
+
+        The patch has almost mechanical changes.
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8ValueCache.cpp:
+        (WTF):
+        (WebCore::StringCache::reportMemoryUsage):
+        (WebCore):
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/DocumentStyleSheetCollection.cpp:
+        (WebCore::DocumentStyleSheetCollection::reportMemoryUsage):
+        * dom/ElementRareData.cpp:
+        (WebCore::ElementRareData::reportMemoryUsage):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::reportMemoryUsage):
+        * page/Frame.cpp:
+        (WebCore::Frame::reportMemoryUsage):
+        * page/Page.cpp:
+        (WebCore::Page::reportMemoryUsage):
+        * platform/graphics/skia/NativeImageSkia.cpp:
+        (WebCore::NativeImageSkia::reportMemoryUsage):
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::reportMemoryUsage):
+        (WebCore):
+        (WebCore::FormDataElement::reportMemoryUsage):
+        * platform/network/FormData.h:
+        (FormDataElement):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::reportMemoryUsage):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::reportMemoryUsage):
+
+2013-01-09  Florin Malita  <fmalita@chromium.org>
+
+        [Skia] Implement GraphicsContext::fillRoundedRect() using SkCanvas::drawRRect()
+        https://bugs.webkit.org/show_bug.cgi?id=106366
+
+        Reviewed by Stephen White.
+
+        Skia provides rounded-rect primitives, so we can avoid degrading fillRoundedRect() to
+        drawPath().
+
+        Due to subtle pixel differences (not visually noticeable), switching from drawPath() to
+        drawRRect() requires rebaselining some of the existing results.
+
+        No new tests: coverage provided by existing tests.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRoundedRect):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (WebCore::PlatformContextSkia::drawRRect):
+        (WebCore):
+
+2013-01-09  Arnaud Renevier  <a.renevier@sisa.samsung.com>
+
+        Web Inspector: cannot undock inspector when window size is too small
+        https://bugs.webkit.org/show_bug.cgi?id=106054
+
+        Reviewed by Pavel Feldman.
+
+        Consider dockingUnavailable flag only when dockSide is in undocked
+        state.
+
+        * inspector/front-end/DockController.js:
+        (WebInspector.DockController.prototype._updateUI.get document):
+
+2013-01-09  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] WebGL content is incomplete when using multiple canvas
+        https://bugs.webkit.org/show_bug.cgi?id=106313
+
+        While we are using double buffering for WebGL,
+        we do not use a drawable that implements a mechanism
+        for swapping buffers.
+        Therefore we have to make sure that all GL commands
+        have been executed properly before copying the texture
+        onto the GraphicsSurface.
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext):
+
+2013-01-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing headers.
+
+2013-01-09  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt][Mac] GraphicsSurface does not need glEnable/glDisable for texture targets.
+        https://bugs.webkit.org/show_bug.cgi?id=106310
+
+        glEnable/glDisable for texture targets is only necessary
+        when using the fixed function pipeline.
+        Enabling or disabling the target might cause unexpected
+        behavior to texture bindings and is therefore considered harmful.
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
+        (WebCore::createTexture):
+        (WebCore::GraphicsSurfacePrivate::copyFromTexture):
+        (WebCore::GraphicsSurface::platformCopyToGLTexture):
+
+2013-01-09  Kunihiko Sakamoto  <ksakamoto@chromium.org>
+
+        INPUT_MULTIPLE_FIELDS_UI: min/max attributes should not make all fields read-only
+        https://bugs.webkit.org/show_bug.cgi?id=106422
+
+        Reviewed by Kent Tamura.
+
+        Do not make day-field of date input and month-field of month input readonly
+        even if min and max are the same.
+
+        Tests: fast/forms/date-multiple-fields/date-multiple-fields-readonly-subfield.html
+               fast/forms/month-multiple-fields/month-multiple-fields-readonly-subfield.html
+
+        * html/shadow/DateTimeEditElement.cpp:
+        (WebCore::DateTimeEditBuilder::visitField): Added check for date type.
+
+2013-01-09  Kunihiko Sakamoto  <ksakamoto@chromium.org>
+
+        INPUT_MULTIPLE_FIELDS_UI: Step-up/-down of week field should respect min/max attributes
+        https://bugs.webkit.org/show_bug.cgi?id=106416
+
+        Reviewed by Kent Tamura.
+
+        Make step-up/-down of the week field respect the min/max attributes of the element.
+        Note that it still accepts any keyboard inputs (the element
+        becomes 'invalid' state when out-of-range values entered).
+
+        Tests: fast/forms/week-multiple-fields/week-multiple-fields-readonly-subfield.html
+               fast/forms/week-multiple-fields/week-multiple-fields-stepup-stepdown-from-renderer.html
+
+        * css/html.css: Add a CSS rule for week field.
+        * html/shadow/DateTimeEditElement.cpp:
+        (WebCore::DateTimeEditBuilder::visitField):
+        Compute minimum/maximum values of week field from the min/max parameters of the element.
+        * html/shadow/DateTimeFieldElements.cpp:
+        (WebCore::DateTimeWeekFieldElement::DateTimeWeekFieldElement): Add mininum/maximum arguments.
+        (WebCore::DateTimeWeekFieldElement::create): Ditto.
+        (WebCore::DateTimeWeekFieldElement::clampValueForHardLimits): Added.
+        * html/shadow/DateTimeFieldElements.h:
+        (DateTimeWeekFieldElement): Add mininum/maximum arguments and declare clampValueForHardLimits.
+
+2013-01-08  Arpita Bahuguna  <arpitabahuguna@gmail.com>
+
+        Caret is incorrectly painted for a contenteditable <div> containing a <br> in vertical writing mode
+        https://bugs.webkit.org/show_bug.cgi?id=103621
+
+        Reviewed by Ryosuke Niwa.
+
+        While computing the caret rect for the given specific scenario, we
+        canonicalize our position. For the upstream (or downstream) block flow
+        candidates a check to ignore the nodes having renderers with zero height
+        is carried out. This is where we fail our check in the vertical writing mode.
+
+        In the vertical writing mode, instead of verifying the height of the descendants
+        of the candidate nodes, a check for their width should be carried out.
+
+        For our case, i.e. the <br> element contained inside the div, the bounding box
+        in the vertical writing mode would have a width greater than zero and height
+        equal to zero (as is to be expected in the vertical mode).
+
+        Thus, we need to make a check against the logical height. For the vertical
+        writing mode, the logical height should return the width of the computed
+        bounding box.
+
+        Test: editing/selection/caret-in-div-containing-br-in-vertical-mode.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        Have modified the code to verify against the logical height, instead
+        of simply the height, both in case of RenderText and RenderBox.
+        The logical height of the computed rects returns a value according
+        to the writing mode.
+
+        For the RenderText a new function, linesLogicalBoundingBox() is called
+        which returns the values depending on the writing mode.
+        Similarly, on the RenderBox, pixelSnappedLogicalHeight() is called which
+        too takes care of the writing mode internally. (borderBoundingBox()
+        internally calls on the pixelSnappedRect).
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::linesLogicalBoundingBox):
+        (WebCore):
+        * rendering/RenderText.h:
+        (RenderText):
+        New function is added to return the logical linesBoundingBox, i.e.,
+        the width and height of the linesBoundingBox are set according to
+        the writing mode.
+
+2013-01-08  Tony Gentilcore  <tonyg@chromium.org>
+
+        Remove a few unused includes from HTMLTreeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=106401
+
+        Reviewed by Adam Barth.
+
+        I happened to notice these while attempting to remove non-thread friendly deps from HTMLTreeBuilder.
+
+        No new tests because no new functionality.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+
+2013-01-08  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Regression(r138681): Add HAVE(ACCESSIBILITY) guard to atk files
+        https://bugs.webkit.org/show_bug.cgi?id=106290
+
+        Reviewed by Martin Robinson.
+
+        Some atk files don't use HAVE(ACCESSIBILITY). It might make build errors when
+        the macro isn't enabled.
+
+        * accessibility/atk/AXObjectCacheAtk.cpp:
+        * accessibility/atk/WebKitAccessibleHyperlink.h:
+        * accessibility/atk/WebKitAccessibleInterfaceAction.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceAction.h:
+        * accessibility/atk/WebKitAccessibleInterfaceComponent.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceDocument.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceDocument.h:
+        * accessibility/atk/WebKitAccessibleInterfaceEditableText.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceEditableText.h:
+        * accessibility/atk/WebKitAccessibleInterfaceHyperlinkImpl.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceHyperlinkImpl.h:
+        * accessibility/atk/WebKitAccessibleInterfaceHypertext.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceImage.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceImage.h:
+        * accessibility/atk/WebKitAccessibleInterfaceSelection.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceSelection.h:
+        * accessibility/atk/WebKitAccessibleInterfaceTable.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceTable.h:
+        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceText.h:
+        * accessibility/atk/WebKitAccessibleInterfaceValue.cpp:
+        * accessibility/atk/WebKitAccessibleInterfaceValue.h:
+        * accessibility/atk/WebKitAccessibleUtil.cpp:
+        * accessibility/atk/WebKitAccessibleUtil.h:
+        * accessibility/atk/WebKitAccessibleWrapperAtk.h:
+
+2013-01-08  Matt Falkenhagen  <falken@chromium.org>
+
+        Make NodeRenderingContext::parentRenderer and nextRenderer top layer aware
+        https://bugs.webkit.org/show_bug.cgi?id=103477
+
+        Reviewed by Hajime Morita.
+
+        Original patch by Elliott Sprehn (minor code and layout tests added).
+
+        Instead of using adjustInsertionPointForTopLayerElement and reassigning
+        pointers passed by reference we should just make nextRenderer and parentRenderer
+        handle the top layer properly. Right now they would return the wrong values
+        since we only correctly handle the top layer during renderer creation.
+
+        This makes handling of top layer elements consistent with handling of
+        other special renderering systems like flow threads.
+
+        Tests: fast/dom/HTMLDialogElement/modal-dialog-in-replaced-renderer.html
+               fast/dom/HTMLDialogElement/modal-dialog-in-table-column.html
+               fast/dom/HTMLDialogElement/modal-dialog-sibling.html
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::isRendererReparented): Added this helper function. We must skip
+        renderers that are reparented in nextRenderer and previousRenderer.
+        (WebCore):
+        (WebCore::adjustInsertionPointForTopLayerElement): Removed this method.
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::parentRenderer):
+        (WebCore::NodeRenderingContext::createRendererForElementIfNeeded):
+
+2013-01-08  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r135836): Invalid user input for input[type=number] should be cleared by input.value=""
+        https://bugs.webkit.org/show_bug.cgi?id=106284
+
+        Reviewed by Hajime Morita.
+
+        No new tests. Updates fast/forms/number/number/validity-badinput.html.
+
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::setValue):
+        If the new sanitized value is empty and innerTextValue is a bad input
+        (it means !valueChanged && !innerTextValue().isEmpty() because the new
+        sanitized value is empty), we need to update innerTextValue with the
+        empty string.
+        * html/NumberInputType.h:
+        (NumberInputType): Declare setValue.
+
+2013-01-08  Nate Chapin  <japhet@chromium.org>
+
+        REGRESSION(r138222?): [Mac WK1] http/tests/appcache/main-resource-redirect.html asserts in WebFrameLoaderClient::dispatchDidFinishLoading
+        https://bugs.webkit.org/show_bug.cgi?id=106123
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests, fixing an existing test.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterNavigationPolicy): Before calling m_resource->removeClient(this)
+            and potentially canceling the ResourceLoader, ensure it won't send resource load callbacks.
+        * loader/ResourceLoader.h:
+        (WebCore::ResourceLoader::setSendCallbackPolicy):
+
+2013-01-08  Alexandru Chiculita  <achicu@adobe.com>
+
+        Assert in RenderGeometryMap::mapToContainer
+        https://bugs.webkit.org/show_bug.cgi?id=106068
+
+        Reviewed by Simon Fraser.
+
+        The assert was due to a pending layout, so the values used to compute the layer bounding boxes were incorrect.
+        That was because of the Document::setVisualUpdatesAllowed mechanism, which triggers a compositor update
+        and a repaint, but before this patch didn't check whether a layout was pending or not.
+
+        Added a check in Document::setVisualUpdatesAllowed for pending layouts and bailed when such case happened.
+        A layout will come anyway and trigger the correct updates. Couldn't not force an inline layout at that time
+        as this function is sometimes called really soon, when the WebKit parts are not fully created yet and updates were
+        calling back into some client callbacks that were not ready.
+
+        Also added an assert in RenderLayerCompositor::updateCompositingLayers to check for other cases that might
+        try to update the layers with a layout pending. That one led to finding an issue in the RenderMarquee, which
+        was updating on a timer callback. It might happen that a layout is pending while this timer fires and it 
+        tries to update the scroll position of the layers while a layout is still due.
+
+        There was already a protection to bail if a layout is pending in RenderMarquee::timerFired, so I've just broadened the scope
+        to the whole RenderView to catch all the layout requests.
+
+        Tests: compositing/geometry/assert-layout-not-done.html
+               compositing/geometry/assert-marquee-timer.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setVisualUpdatesAllowed):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::timerFired):
+
+2013-01-08  Justin Novosad  <junov@google.com>
+
+        CanvasRenderingContext2D::setFont argument may reference destroyed object
+        https://bugs.webkit.org/show_bug.cgi?id=106385
+
+        Reviewed by Abhishek Arya.
+
+        No new tests: covered by fast/canvas/canvas-measureText.html
+
+        This is a re-write of r138994.  Fixing bug in setFont instead of
+        workaround at call site. 
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        (WebCore::CanvasRenderingContext2D::accessFont):
+
+2013-01-08  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Provide LevelDB with IDBEnv instead of Env::Default
+        https://bugs.webkit.org/show_bug.cgi?id=106135
+
+        Reviewed by Tony Chang.
+
+        IDBEnv only changes the name of the histogram where errors are logged.
+
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore::LevelDBDatabase::open):
+        (WebCore::LevelDBDatabase::openInMemory):
+
+2013-01-08  Brandon Jones  <bajones@chromium.org>
+
+        Make WebGLRenderingContext inherit from ActiveDOMObject
+        https://bugs.webkit.org/show_bug.cgi?id=104733
+
+        Reviewed by Adam Barth.
+
+        When ActiveDOMObject::stop is called on the WebGLRenderingContext the
+        DrawingBuffer and GraphicsContext3D instances are forcibly released in
+        order to keep GPU memory utilization to a minimum.
+
+        Incorporated new layout test based on one just added to the WebGL
+        conformance suite. Also tested manually by reloading and
+        navigating between many WebGL apps.
+
+        Test: fast/canvas/webgl/context-release-upon-reload.html
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+            Removed garbage collection hack added in Bug 76255.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::create):
+            Call suspendIfNeeded per ActiveDOMObject contract.
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+            Call ActiveDOMObject constructor.
+        (WebCore::WebGLRenderingContext::~WebGLRenderingContext):
+            Call destroyGraphicsContext3D.
+        (WebCore::WebGLRenderingContext::destroyGraphicsContext3D):
+            Drop DrawingBuffer backing store and delete GraphicsContext3D.
+        (WebCore::WebGLRenderingContext::hasPendingActivity):
+            Always return false.
+        (WebCore::WebGLRenderingContext::stop):
+            Force lost context upon page reload or navigation.
+        * html/canvas/WebGLRenderingContext.h:
+        (WebGLRenderingContext):
+            Inherit from ActiveDOMObject and override notifications.
+        * platform/graphics/blackberry/DrawingBufferBlackBerry.cpp:
+        (WebCore):
+        (WebCore::DrawingBuffer::clearPlatformLayer):
+            Add currently no-op implementation.
+        * platform/graphics/cairo/DrawingBufferCairo.cpp:
+        (WebCore):
+        (WebCore::DrawingBuffer::clearPlatformLayer):
+            Add currently no-op implementation.
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBufferPrivate::clearTextureId):
+            Clear texture ID from compositor's layer.
+        (DrawingBufferPrivate):
+        (WebCore::DrawingBuffer::framebuffer):
+            Moved around to reduce number of #ifdefs.
+        (WebCore):
+        (WebCore::DrawingBuffer::platformLayer):
+        (WebCore::DrawingBuffer::clearPlatformLayer):
+            Tell compositor to stop referencing DrawingBuffer's texture.
+        * platform/graphics/clutter/DrawingBufferClutter.cpp:
+        (WebCore):
+        (WebCore::DrawingBuffer::clearPlatformLayer):
+            Add currently no-op implementation.
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        (WebCore::DrawingBuffer::clear):
+            Call clearPlatformLayer before deleting OpenGL resources.
+        * platform/graphics/gpu/DrawingBuffer.h:
+        (DrawingBuffer):
+            Add clearPlatformLayer.
+        * platform/graphics/gpu/mac/DrawingBufferMac.mm:
+        (WebCore):
+        (WebCore::DrawingBuffer::clearPlatformLayer):
+            Add currently no-op implementation.
+        * platform/graphics/gpu/qt/DrawingBufferQt.cpp:
+        (WebCore):
+        (WebCore::DrawingBuffer::clearPlatformLayer):
+            Add currently no-op implementation.
+
+2013-01-08  Tony Gentilcore  <tonyg@chromium.org>
+
+        Remove dependency on Document from HTMLConstructionSite::inQuirksMode()
+        https://bugs.webkit.org/show_bug.cgi?id=106375
+
+        Reviewed by Adam Barth.
+
+        This is another step towards removing main thread object dependencies
+        from the parser.
+
+        No new tests because no new functionality.
+
+        * dom/Document.h:
+        * html/HTMLDocument.cpp:
+        * html/HTMLDocument.h:
+        (HTMLDocument):
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::HTMLConstructionSite):
+        (WebCore::HTMLConstructionSite::setDefaultCompatibilityMode):
+        (WebCore):
+        (WebCore::HTMLConstructionSite::setCompatibilityMode):
+        (WebCore::HTMLConstructionSite::setCompatibilityModeFromDoctype):
+        (WebCore::HTMLConstructionSite::insertDoctype):
+        (WebCore::HTMLConstructionSite::inQuirksMode):
+        * html/parser/HTMLConstructionSite.h:
+        (HTMLConstructionSite):
+
+2013-01-08  Florin Malita  <fmalita@chromium.org>
+
+        Remove unused GraphicsContext::addInnerRoundedRectClip()
+        https://bugs.webkit.org/show_bug.cgi?id=106376
+
+        Reviewed by Andreas Kling.
+
+        Since there don't seem to be any users left for it, remove addInnerRoundedRectClip().
+
+        No new tests: no functional changes.
+
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/openvg/GraphicsContextOpenVG.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore):
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+
+2013-01-08  Justin Novosad  <junov@google.com>
+
+        Color bleeding with rounded rectangles on high dpi displays
+        https://bugs.webkit.org/show_bug.cgi?id=106373
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/backgrounds/gradient-background-leakage-hidpi.html
+
+        Avoid using the BackgroundBleedShrinkBackground draw strategy for
+        RenderBox when border width is less than two layout units. This
+        is because rounded rectangles are always snapped to integer layout
+        coordinates, even with subpixel layout enabled.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::determineBackgroundBleedAvoidance):
+
+2013-01-08  Elliott Sprehn  <esprehn@chromium.org>
+
+        Merge getLineAtIndex into RenderBlock::lineAtIndex
+        https://bugs.webkit.org/show_bug.cgi?id=106379
+
+        Reviewed by Eric Seidel.
+
+        getLineAtIndex can be merged into lineAtIndex, which was it's only caller.
+
+        No new tests, just refactoring.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lineAtIndex):
+        (WebCore::RenderBlock::lineCount):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+
+2013-01-08  Rafael Weinstein  <rafaelw@chromium.org>
+
+        [HTMLTemplateElement] Allow <template> content to be inspected
+        https://bugs.webkit.org/show_bug.cgi?id=105839
+
+        Reviewed by Pavel Feldman.
+
+        In addition to the plumbing which allows template contents to be
+        displayed within the inspector, this patch adds a manually-managed
+        weakref from the template document back to its host document (typically
+        the creator). This is required so that the inspector agent can be found
+        for template elements.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        (WebCore::Document::templateDocument):
+        * dom/Document.h:
+        (Document):
+        (WebCore::Document::setTemplateDocumentHost):
+        (WebCore::Document::templateDocumentHost):
+        * editing/markup.cpp:
+        (WebCore::createFragmentForInnerOuterHTML):
+        * html/HTMLTemplateElement.cpp:
+        (WebCore::HTMLTemplateElement::content):
+        * inspector/Inspector.json:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::instrumentingAgentsForDocument):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype.hasChildNodes):
+        (WebInspector.DOMNode.prototype._insertChild):
+        (WebInspector.DOMNode.prototype._setChildrenPayload):
+
+2013-01-08  Hajime Morrita  <morrita@google.com>
+
+        [Shadow DOM] Distribution related code on ShadowRoot should be minimized.
+        https://bugs.webkit.org/show_bug.cgi?id=106282
+
+        Reviewed by Dimitri Glazkov.
+
+        ShadowRoot had a certain amount of logic which is dedicated for
+        node distribution computation.  These code is going to be compiled
+        out (Bug 103339) and better be part of the node distribution
+        algorithm, which is ScopeContentDistribution class.
+
+        This change
+
+        - Renames ShadowRootContentDistributionData to
+          ScopeContentDistribution.  New name is concise and a bit more
+          meaningful: It owns per TreeScope distribution state.
+        - Moves distribution related code from ShadowRoot to ScopeContentDistribution
+
+        No new tests. Refactoring.
+
+        * WebCore.exp.in:
+        * css/StyleScopeResolver.cpp:
+        (WebCore::StyleScopeResolver::styleSharingCandidateMatchesHostRules):
+        (WebCore::StyleScopeResolver::matchHostRules):
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::nodeCanBeDistributed):
+        (WebCore::ComposedShadowTreeWalker::traverseBackToYoungerShadowRoot):
+        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):
+        (WebCore::AncestorChainWalker::parent):
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::collectSelectFeatureSetFrom):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::insertedInto):
+        (WebCore::ShadowRoot::removedFrom):
+        (WebCore::ShadowRoot::ensureScopeDistribution):
+        (WebCore::ShadowRoot::reportMemoryUsage):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (ShadowRoot):
+        (WebCore::ShadowRoot::scopeDistribution):
+        * html/shadow/ContentDistributor.cpp:
+        (WebCore::ScopeContentDistribution::ScopeContentDistribution):
+        (WebCore::ScopeContentDistribution::invalidateInsertionPointList):
+        (WebCore::ScopeContentDistribution::ensureInsertionPointList):
+        (WebCore::ScopeContentDistribution::registerInsertionPoint):
+        (WebCore::ScopeContentDistribution::unregisterInsertionPoint):
+        (WebCore::ScopeContentDistribution::hasShadowElement):
+        (WebCore):
+        (WebCore::ScopeContentDistribution::hasContentElement):
+        (WebCore::ScopeContentDistribution::countElementShadow):
+        (WebCore::ScopeContentDistribution::hasInsertionPoint):
+        (WebCore::ScopeContentDistribution::assignedTo):
+        (WebCore::ContentDistributor::distribute):
+        (WebCore::ContentDistributor::invalidate):
+        * html/shadow/ContentDistributor.h:
+        (ScopeContentDistribution):
+        (WebCore::ScopeContentDistribution::registerElementShadow):
+        (WebCore::ScopeContentDistribution::unregisterElementShadow):
+        (WebCore::ScopeContentDistribution::hasElementShadow):
+        * html/shadow/HTMLShadowElement.cpp:
+        (WebCore::HTMLShadowElement::olderShadowRoot):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::insertedInto):
+        (WebCore::InsertionPoint::removedFrom):
+        (WebCore::InsertionPoint::contains):
+        (WebCore):
+        (WebCore::resolveReprojection):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+        (WebCore):
+        * testing/Internals.cpp:
+        (WebCore::Internals::hasShadowInsertionPoint):
+        (WebCore::Internals::hasContentElement):
+        (WebCore::Internals::countElementShadow):
+
+2013-01-08  Tom Sepez  <tsepez@chromium.org>
+
+        Copy-paste preserves <embed> tags containing active content.
+        https://bugs.webkit.org/show_bug.cgi?id=77625
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/pasteboard/paste-noplugin.html
+
+        * dom/FragmentScriptingPermission.h:
+        (WebCore::scriptingContentIsAllowed):
+        (WebCore::pluginContentIsAllowed):
+        Add new permission to restrict plugin pasting.  Add inline functions to check
+        the implications of each permission rather than having a list of raw comparisions
+        sprinkled throughout the code. 
+        
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromMarkup):
+        Revert back to unsafe plugin pasting regardless of caller's intentions when
+        the settings allow it.
+
+        * dom/Element.cpp:
+        (WebCore::Element::parserSetAttributes):
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertScriptElement):
+        * xml/parser/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::endElementNs):
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::parseEndElement):
+        Use new inline functions to check implications of permissions rather than raw
+        comparisions.
+        
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        Check if plugin pasting is allowed before inserting applet/embed/oject elements.
+
+        * page/Settings.in:
+        Declaration of new unsafePluginPastingEnabled setting.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/blackberry/PasteboardBlackBerry.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asFragment):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asFragment):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::fragmentFromCFHTML):
+        (WebCore::fragmentFromHTML):
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        Pass DisallowScriptingAndPluginContent enum value.
+        
+2013-01-08  Alexis Menard  <alexis@webkit.org>
+
+        WebKit does not reject some cubic-bezier form values for transition-timing-function.
+        https://bugs.webkit.org/show_bug.cgi?id=106369
+
+        Reviewed by Dean Jackson.
+
+        http://www.w3.org/TR/css3-transitions/#transition-timing-function-property
+        describes restricitions on cubic-bezier values where the x values of
+        the curve should be between [0, 1] and y values can exceed this range.
+        WebKit was not following the specification by allowing x values
+        exceeding the range.
+        The spec also says that we should reject the defintion if the condition
+        is not respected which is what the new code does.
+
+        Test: transitions/transitions-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationTimingFunction):
+
+2013-01-08  Andreas Kling  <akling@apple.com>
+
+        Heap-use-after-free in bool WebCore::SelectorChecker::checkOneSelector.
+        <http://webkit.org/b/105834>
+
+        Reviewed by Antti Koivisto.
+
+        Suppress the DOMSubtreeModified event when synchronizing the "style" attribute and we've
+        instantiated an Attr node wrapper for the said attribute.
+
+        Also added an assertion that Document's StyleResolver isn't cleared during style recalc,
+        which will help us catch this kind of bug in the future.
+
+        Test: fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::styleResolverThrowawayTimerFired):
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeInternal):
+
+2013-01-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r139096.
+        http://trac.webkit.org/changeset/139096
+        https://bugs.webkit.org/show_bug.cgi?id=106367
+
+        not a complete fix (Requested by bweinstein on #webkit).
+
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::userDidClickSnapshot):
+
+2013-01-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Plug-ins shouldn’t be added to list to autostart if you start a plugin in private browsing.
+        https://bugs.webkit.org/show_bug.cgi?id=106348
+        <rdar://problem/12968442>
+
+        Reviewed by Anders Carlsson.
+
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::userDidClickSnapshot): Don't call addAutoStartOrigin if we are
+            in private browsing mode.
+
+2013-01-08  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: native popup buttons should not use textUnderElement for their title
+        https://bugs.webkit.org/show_bug.cgi?id=106349
+
+        Reviewed by Ryosuke Niwa.
+
+        Native popup buttons (<select> elements) were calculating its title based on the text
+        under the element. When Bug 103794 introduced a more complete way of getting render text,
+        it causes popup buttons to start returning a title.
+        The fix is that we should not be calculating a title for a native popup button from its children.
+
+        Existing tests cover this functionality. This will fix a failing test.
+
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::visibleText):
+
+2013-01-08  Ojan Vafai  <ojan@chromium.org>
+
+        text controls are sized too small when a percentage height is set
+        https://bugs.webkit.org/show_bug.cgi?id=106277
+
+        Reviewed by Tony Chang.
+
+        This makes our behavior match Firefox 17, IE 9 and Opera 12.
+        The current logic came from http://trac.webkit.org/changeset/13723,
+        which itself was copy-pasted from RenderReplaced and no longer has this clause..
+
+        Test: fast/forms/percent-height-auto-width-form-controls.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::computePreferredLogicalWidths):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::computePreferredLogicalWidths):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::computePreferredLogicalWidths):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::computePreferredLogicalWidths):
+
+2013-01-08  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Modify Android's user agent CSS to not set a border-radius on select elements
+        https://bugs.webkit.org/show_bug.cgi?id=106327
+
+        Reviewed by Adam Barth.
+
+        Android's user agent CSS overrides the style applied to <select>
+        elements with a @size or @multiple attribute, and then applies
+        (among other things) a border-radius of 5 pixels. While select
+        elements with a larger size or multiple selection should appear
+        as drop-down boxes for now, setting the border radius causes
+        Chromium to skip rendering the background and border, making
+        them hard to read when the page relies on the default styling.
+
+        This is covered by existing pixel tests.
+
+        * css/themeChromiumAndroid.css:
+        (select[size][multiple]):
+
+2013-01-08  Mike West  <mkwst@chromium.org>
+
+        CSP: 'none' should take effect only if no other source expression is present.
+        https://bugs.webkit.org/show_bug.cgi?id=106314
+
+        Reviewed by Adam Barth.
+
+        WebKit's handling of 'none' in Content Security Policy source lists
+        doesn't quite match the spec. Currently, we're treating any source list
+        that contains 'none' as its first token as an empty list. That is:
+        "script-src 'none'" is handled in the same way as
+        "script-src 'none' example.com". Based on a bit of public-webappsec@
+        discussion[1], the behavior we actually want should treat the first as
+        an empty list, while treating the second as "script-src example.com". In
+        other words, 'none' in a source list is a no-op, unless it is the _only_
+        item in the source list.
+
+        This patch adjusts our parsing behavior accordingly, and tweaks the
+        console log we emit for invalid source expressions to warn specifically
+        about this case.
+
+        [1]: http://lists.w3.org/Archives/Public/public-webappsec/2013Jan/0006.html
+
+        Test: http/tests/security/contentSecurityPolicy/source-list-parsing-none.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::isSourceListNone):
+            A new static method that returns true when given a string that
+            contains only 'none' (potentially surrounded by whitespace), and
+            false otherwise.
+        (WebCore):
+        (WebCore::CSPSourceList::parse):
+            Move the 'none' check into the initial layer of parsing, which means
+            that we can drop the 'isFirstSourceInList' check entirely.
+        (WebCore::CSPSourceList::parseSource):
+            Since we've already checked for 'none' in ::parse, we can at this
+            point safely treat any occurance of 'none' in the source list as an
+            invalid expression.
+        (WebCore::ContentSecurityPolicy::reportInvalidSourceExpression):
+            If the invalid expression is 'none', add a clarification to the
+            console message, noting that 'none' only has effect when it's all
+            alone.
+
+2013-01-08  Alok Priyadarshi  <alokp@chromium.org>
+
+        Added OpaqueRegionSkia::currentTrackingOpaqueRect
+
+        [chromium] Add OpaqueRegionSkia::currentTrackingOpaqueRect
+        https://bugs.webkit.org/show_bug.cgi?id=106267
+
+        Reviewed by Stephen White.
+
+        No new tests needed. No change in functionality.
+
+        * platform/graphics/skia/OpaqueRegionSkia.cpp:
+        (WebCore::OpaqueRegionSkia::applyOpaqueRegionFromLayer):
+        (WebCore::OpaqueRegionSkia::markRectAsOpaque):
+        (WebCore::OpaqueRegionSkia::markRectAsNonOpaque):
+        (WebCore::OpaqueRegionSkia::markAllAsNonOpaque):
+        (WebCore::OpaqueRegionSkia::currentTrackingOpaqueRect):
+        (WebCore):
+        * platform/graphics/skia/OpaqueRegionSkia.h:
+        (OpaqueRegionSkia):
+
+2013-01-08  Zan Dobersek  <zandobersek@gmail.com>
+
+        [GTK] Build failures when building with python 3.3
+        https://bugs.webkit.org/show_bug.cgi?id=106194
+
+        Reviewed by Dirk Pranke.
+
+        Python 3.3 introduced changes to dictionaries which can result in changed
+        iteration order. More about these changes:
+        http://docs.python.org/3.3/whatsnew/3.3.html#pep-412-key-sharing-dictionary
+        http://www.python.org/dev/peps/pep-0412/#cons
+
+        This causes the Source/WebCore/inspector/generate-inspector-protocol-version
+        script to fail the self-testing when using Python 3.3. These changes work
+        around this problem by not checking for expected errors in order but rather
+        for their presence in the error output sequence. The number of actual errors
+        is also checked to be equal to the number of expected errors.
+
+        No new tests - no new functionality.
+
+        * inspector/generate-inspector-protocol-version:
+        (self_test):
+
+2013-01-08  Antoine Quint  <graouts@apple.com>
+
+        <track> element's mode set to "disabled" after load although it was explicitly set to "hidden"
+        https://bugs.webkit.org/show_bug.cgi?id=105536
+
+        Remove all concept of "showing by default". This means removing the showingByDefault()
+        and setShowingByDefault() methods on TextTrack. As I was going  through this code,
+        I also noticed that in HTMLMediaElement::configureTextTrackGroup(), we would set
+        defaultTrack to textTrack.get() even though defaultTrack was created to be a RefPtr<TextTrack>.
+
+        As a result, we can now pass an additional 8 tests from the Opera-submitted test suite:
+
+        LayoutTests/media/track/opera/interfaces/TextTrack/addCue.html
+        LayoutTests/media/track/opera/interfaces/TextTrack/removeCue.html
+        LayoutTests/media/track/opera/interfaces/TextTrackCue/endTime.html
+        LayoutTests/media/track/opera/interfaces/TextTrackCue/startTime.html
+        LayoutTests/media/track/opera/interfaces/TextTrackCue/align.html
+        LayoutTests/media/track/opera/interfaces/TextTrackCue/id.html
+        LayoutTests/media/track/opera/interfaces/TextTrackCue/pauseOnExit.html
+        LayoutTests/media/track/opera/interfaces/TextTrackCue/track.html
+
+        Reviewed by Eric Carlson.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::configureTextTrackGroup):
+        (WebCore::HTMLMediaElement::toggleTrackAtIndex):
+        * html/track/TextTrack.cpp:
+        (WebCore::TextTrack::TextTrack):
+        (WebCore::TextTrack::setMode):
+        (WebCore::TextTrack::isRendered):
+        * html/track/TextTrack.h:
+        (WebCore::TextTrack::mode):
+        (TextTrack):
+
+2013-01-08  Mark Lam  <mark.lam@apple.com>
+
+        Removed the need for the ProposedDatabase mechanism.
+        https://bugs.webkit.org/show_bug.cgi?id=106292.
+
+        Reviewed by Sam Weinig.
+
+        No new tests.
+
+        * Modules/webdatabase/AbstractDatabase.cpp:
+        (WebCore::AbstractDatabase::details):
+        (WebCore):
+        * Modules/webdatabase/AbstractDatabase.h:
+        (AbstractDatabase):
+        * Modules/webdatabase/DatabaseContext.cpp:
+        (WebCore::DatabaseContext::databaseExceededQuota):
+        * Modules/webdatabase/DatabaseContext.h:
+        (DatabaseContext):
+        * Modules/webdatabase/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::fullPathForDatabaseNoLock):
+        (WebCore::DatabaseTracker::detailsForNameAndOrigin):
+        * Modules/webdatabase/DatabaseTracker.h:
+        (DatabaseTracker):
+        * Modules/webdatabase/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::exceededDatabaseQuota):
+        * page/ChromeClient.h:
+        (ChromeClient):
+
+2013-01-08  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: PopUpButtons do not report that AXValueAttribute is supported
+        https://bugs.webkit.org/show_bug.cgi?id=106333
+
+        Reviewed by Ryosuke Niwa.
+
+        The Mac platform expects that AXPopUpButton's expose the AXValue attribute.
+
+        Test: platform/mac/accessibility/popup-button-exposes-axvalue.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isPopUpButton):
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+
+2013-01-08  Alexis Menard  <alexis@webkit.org>
+
+        transition-delay and transition-duration return incorrect values when querying using the computed style.
+        https://bugs.webkit.org/show_bug.cgi?id=105432
+
+        Reviewed by Dean Jackson.
+
+        When setting the transition-delay to 10ms for example the value of transition-delay
+        on the computed style was incorrect, it should return 0.01s but it was
+        returning something like 0.0099999999...s. In fact the bug was after
+        the parsing step when creating the Animation object where a conversion
+        from a double to float was done. This conversion is not needed as the
+        animation class expects double for delay and transition times.
+
+        Test: transitions/transitions-parsing.html
+
+        * css/CSSToStyleMap.cpp:
+        (WebCore::CSSToStyleMap::mapAnimationDelay):
+        (WebCore::CSSToStyleMap::mapAnimationDuration):
+
+2013-01-08  Hajime Morrita  <morrita@google.com>
+
+        [Shadow DOM] Refactoring: invalidateParentDistributionIfNecessary() calls are too intrusive
+        https://bugs.webkit.org/show_bug.cgi?id=106305
+
+        Reviewed by Dimitri Glazkov.
+
+        Scattering invalidateParentDistributionIfNecessary() looks bad because
+        - it has long name whose terminology is cryptic for people who don't know much about Shadow DOM standard.
+        - its calls are always paired with setNeedsStyleRecalc() and people do setNeedsStyleRecalc()
+          need to be aware about distribution feature bit tracking. Separate invalidateParentDistributionIfNecessary()
+          call doesn't help that recognition.
+
+        This change introduces Element::didAffectSelector() to replace a setNeedsStyleRecalc()-i37y() call sequence.
+        SelectRuleFeatureSet::FeatureRule is renamed AffectedSelectorType so that it explains its purpose
+        in a bit more plain WebKit term.
+
+        No new tests. Refactoring.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setCSSTarget): Adopted didAffectSelector.
+        * dom/Element.cpp:
+        (WebCore::Element::didAffectSelector): Added.
+        (WebCore):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::didAffectSelector): Morphed from invalidateParentDistributionIfNecessary().
+        * dom/ElementShadow.h:
+        (ElementShadow):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseAttribute): Adopted didAffectSelector
+        * html/HTMLDetailsElement.cpp:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::disabledAttributeChanged): Adopted didAffectSelector
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked): Adopted didAffectSelector
+        (WebCore::HTMLInputElement::setIndeterminate): Adopted didAffectSelector
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::parseAttribute): Adopted didAffectSelector
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::parseAttribute): Adopted didAffectSelector
+        (WebCore::HTMLOptionElement::setSelectedState): Adopted didAffectSelector
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::didElementStateChange): Adopted didAffectSelector
+        * html/HTMLSummaryElement.cpp:
+        * html/shadow/HTMLContentElement.cpp:
+        * html/shadow/SelectRuleFeatureSet.cpp:
+        (WebCore::SelectRuleFeatureSet::collectFeaturesFromSelector): Followed renaming.
+        * html/shadow/SelectRuleFeatureSet.h: Followed renaming.
+        (WebCore::SelectRuleFeatureSet::hasSelectorForChecked):
+        (WebCore::SelectRuleFeatureSet::hasSelectorForEnabled):
+        (WebCore::SelectRuleFeatureSet::hasSelectorForDisabled):
+        (WebCore::SelectRuleFeatureSet::hasSelectorForIndeterminate):
+        (WebCore::SelectRuleFeatureSet::hasSelectorForLink):
+        (WebCore::SelectRuleFeatureSet::hasSelectorForTarget):
+        (WebCore::SelectRuleFeatureSet::hasSelectorForVisited):
+        (WebCore::SelectRuleFeatureSet::hasSelectorFor):
+        (WebCore::SelectRuleFeatureSet::setSelectRuleFeature):
+
+2013-01-08  Sergio Villar Senin  <svillar@igalia.com>
+
+        [Qt] Fix build with --web-audio
+        https://bugs.webkit.org/show_bug.cgi?id=106328
+
+        Reviewed by Philippe Normand.
+
+        Build fix, no new tests required.
+
+        * Target.pri: addded missing OfflineAudioContext.[cpp|h].
+
+2013-01-08  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Login & password shown in browsers' URL entry after successful HTTP authentication
+        https://bugs.webkit.org/show_bug.cgi?id=105190
+
+        Reviewed by Carlos Garcia Campos.
+
+        Test: http/tests/misc/authentication-redirect-4/authentication-sent-to-redirect-same-origin-url.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback): After sending a redirect with credentials to libsoup, strip
+        the credentials from the request. This ensures that the credentials do not show up in
+        the user agent or in document.location.
+
+2013-01-08  Keishi Hattori  <keishi@webkit.org>
+
+        [Chromium] Don't confine page popups to root view on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=106315
+
+        Reviewed by Kent Tamura.
+
+        No new tests.
+
+        * Resources/pagepopups/pickerCommon.js:
+        (adjustWindowRect): Remove code to confine to root view.
+
+2012-12-12  Antonio Gomes  <a1.gomes@sisa.samsung.com>
+
+        Make RenderLayer::updateNeedsCompositedScrolling scrollbars agnostic
+        https://bugs.webkit.org/show_bug.cgi?id=95494
+
+        Reviewed by James Robinson.
+
+        Some ports (including Qt-wk1 and BlackBerry) allow disabling
+        scrollbars at FrameView creation level. That said, cheking for the
+        scrollbars presence in order to determine if we should promote a
+        RenderLayer to use composited scrolling is not ideal, as done in
+        RenderLayerCompositor::updateNeedsCompositedScrolling()
+
+        Instead, this patch makes the RenderLayer class to query its FrameView
+        if it has been cached as scrollable by the later.
+
+        Least, patch also takes this opportunity to remove RenderLayer::allowsScrolling,
+        which became unused.
+
+        No new tests added, since there is no *practical* behavior change: ports
+        like Chromium and others who currently check for the scrollbars presence
+        in order to determine either to promote or not layers to benefit of composited
+        scrolling should not be affected.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateNeedsCompositedScrolling):
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+
+2012-12-20  Antonio Gomes  <a1.gomes@sisa.samsung.com>
+
+        Introduce a compositing trigger for scrollable frames
+        https://bugs.webkit.org/show_bug.cgi?id=105573
+
+        Reviewed by James Robinson.
+
+        Make requiresCompositingForScrollableFrame to check the
+        newly added compositing trigger instead of the associated setting.
+
+        It introduces no have behavior change, so no new tests. Patch basically
+        does some preparation work for adding support to composite scrollable inner
+        frames independently from "force compositing mode" bit.
+
+        * page/ChromeClient.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags):
+        (WebCore::RenderLayerCompositor::requiresCompositingForScrollableFrame):
+
+2013-01-08  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add DeviceProximityController to support Device Proximity Events.
+        https://bugs.webkit.org/show_bug.cgi?id=97630
+
+        Reviewed by Hajime Morita.
+
+        Implement DeviceProximityController which is inherited from DeviceController to support Device Proximity Events.
+        DeviceProximityController has two major functionalities.
+        - When listener is added, DeviceProximityController stores DOMWindow pointer to m_listeners
+          and start gathering proximity event.
+        - When DeviceProximityController receives a proximity event from client, fire an event using m_listeners.
+        In addition, setDeviceProximity function is added to Internals for layout test.
+
+        Tests: proximity/add-listener-from-callback.html
+               proximity/basic-operation.html
+               proximity/create-event.html
+               proximity/event-after-navigation.html
+               proximity/multiple-frames.html
+               proximity/no-page-cache.html
+               proximity/optional-event-properties.html
+               proximity/updates.html
+               proximity/window-property.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/proximity/DeviceProximityClient.h: Added.
+        (WebCore):
+        (DeviceProximityClient):
+        (WebCore::DeviceProximityClient::~DeviceProximityClient):
+        * Modules/proximity/DeviceProximityController.cpp: Added.
+        (WebCore):
+        (WebCore::DeviceProximityController::DeviceProximityController):
+        (WebCore::DeviceProximityController::create):
+        (WebCore::DeviceProximityController::didChangeDeviceProximity):
+        (WebCore::DeviceProximityController::deviceProximityClient):
+        (WebCore::DeviceProximityController::hasLastData):
+        (WebCore::DeviceProximityController::getLastEvent):
+        (WebCore::DeviceProximityController::supplementName):
+        (WebCore::DeviceProximityController::from):
+        (WebCore::DeviceProximityController::isActiveAt):
+        (WebCore::provideDeviceProximityTo):
+        * Modules/proximity/DeviceProximityController.h: Added.
+        (WebCore):
+        (DeviceProximityController):
+        (WebCore::DeviceProximityController::~DeviceProximityController):
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * history/PageCache.cpp:
+        When a page has Device Proximity Event Listener, it has not to be cached like Device Orientation.
+        (WebCore::logCanCachePageDecision):
+        (WebCore::PageCache::canCache):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setDeviceProximity):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2013-01-03  Sergio Villar Senin  <svillar@igalia.com>
+
+        [GTK] Add WebP image support
+        https://bugs.webkit.org/show_bug.cgi?id=105915
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: add WTF_USE_WEBP definition.
+        * GNUmakefile.list.am: properly sort image decoders in the sources list.
+
+2013-01-08  Steve Block  <steveblock@chromium.org>
+
+        Rename 'IntSize toSize(const IntPoint&)' to 'toIntSize'
+        https://bugs.webkit.org/show_bug.cgi?id=106307
+
+        This matches other method names which distinguish between sizes and
+        points. See https://bugs.webkit.org/show_bug.cgi?id=105992#c4.
+
+        Reviewed by Kentaro Hara.
+
+        Refactoring only, no functional change.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::scrollTo):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::scrollOffset):
+        * platform/graphics/IntPoint.h:
+        (WebCore::toIntSize):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::positionNewlyCreatedOverflowControls):
+        (WebCore::RenderLayer::paintOverflowControls):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2013-01-08  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Dragging over an element with scrollbars should scroll the element when dragging near edges
+        https://bugs.webkit.org/show_bug.cgi?id=39725
+
+        Reviewed by Hajime Morita.
+
+        This patch introduces auto scrolling functionality during drag-and-drop
+        when drop source is near edge of scrollable element.
+
+        When drop source is inside 20px of scrollable element more than 200ms,
+        scrollable element is automatically scrolled every 50ms toward drop
+        source position, e.g. vertically scroll up when drop source is in top
+        edge.
+
+        Test: fast/events/drag-and-drop-autoscroll.html
+
+        * page/AutoscrollController.cpp:
+        (WebCore::AutoscrollController::AutoscrollController): Changed to initialize m_dragAndDropAutoscrollStartTime.
+        (WebCore::AutoscrollController::updateDragAndDrop): Added for start/stop autoscroll during drag-and-drop.
+        (WebCore::AutoscrollController::autoscrollTimerFired): Changed to add autoscroll for drag-and-drop, and to pass last know position to RenderBox::autoscroll().
+        * page/AutoscrollController.h:
+        (AutoscrollController): Changed to add updateDragAndDrop() and m_dragAndDropAutoscrollReferencePosition and m_dragAndDropAutoscrollStartTime.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop): Changed to call AutoscrollController::updateDragAndDrop().
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::autoscroll): Changed for new parameter position.
+        (WebCore::RenderBox::calculateAutoscrollDirection): Added for autoscroll.
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::autoscroll):  Changed for new parameter position and move updateSelectionForMouseDrag() to AutoscrollController.
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::autoscroll):  Changed for new parameter position.
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::autoscroll):  Changed for new parameter position.
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine):
+
+2013-01-08  Jochen Eisinger  <jochen@chromium.org>
+
+        REGRESSION(r139036): 'WebCore::DateTimeSymbolicFieldElement::isInRange' hides overloaded virtual function
+        https://bugs.webkit.org/show_bug.cgi?id=106311
+
+        Unreviewed build fix.
+
+        * html/shadow/DateTimeSymbolicFieldElement.cpp:
+        (WebCore::DateTimeSymbolicFieldElement::stepDown):
+        (WebCore::DateTimeSymbolicFieldElement::stepUp):
+        * html/shadow/DateTimeSymbolicFieldElement.h:
+        (WebCore::DateTimeSymbolicFieldElement::indexIsInRange): renamed method to avoid hiding Element::isInRange
+
+2013-01-08  Adam Barth  <abarth@webkit.org>
+
+        HTMLTreeBuilder shouldn't keep a Document pointer
+        https://bugs.webkit.org/show_bug.cgi?id=106268
+
+        Reviewed by Eric Seidel.
+
+        The tree builder shouldn't interact with the Document directly.
+        Instead, the tree builder should use the HTMLConstructionSite to
+        interact with the document.
+
+        Unfortunately, the HTMLTreeBuilder does need to read back one bit of
+        information (the quirks mode) from the Document. Currently the
+        HTMLConstructionSite reads the information directly from the Document.
+        If/when we move the parser onto its own thread, we'll need to keep
+        track of this bit on the parser thread. (We should be able to
+        encapsulate all that logic in the HTMLConstructionSite.)
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::setDefaultCompatibilityMode):
+        (WebCore):
+        (WebCore::HTMLConstructionSite::finishedParsing):
+        (WebCore::HTMLConstructionSite::inQuirksMode):
+        * html/parser/HTMLConstructionSite.h:
+        (HTMLConstructionSite):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::detach):
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::defaultForInitial):
+        (WebCore::HTMLTreeBuilder::finished):
+        * html/parser/HTMLTreeBuilder.h:
+        (HTMLTreeBuilder):
+
+2013-01-08  Yuki Sekiguchi  <yuki.sekiguchi@access-company.com>
+
+        Float block's logical top margin is illegal in vertical writing mode.
+        https://bugs.webkit.org/show_bug.cgi?id=96597
+
+        Reviewed by Hajime Morita.
+
+        flipFloatForWritingModeForChild() should use child->renderer()->width() not child->width() like horizontal writing mode.
+
+        Test: fast/writing-mode/vertical-float-margin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::flipFloatForWritingModeForChild):
+
+2013-01-07  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r137406): Text inside an empty optgroup prevents subsequent options from appearing
+        https://bugs.webkit.org/show_bug.cgi?id=106298
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: fast/forms/select/select-empty-optgroup.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcListItems):
+        Traverse to the first element within the 'current' only if it exists.
+
+2013-01-07  Steve Block  <steveblock@chromium.org>
+
+        Use toSize() to convert from Int/FloatPoint to Int/FloatSize
+        https://bugs.webkit.org/show_bug.cgi?id=105992
+
+        Reviewed by Kentaro Hara.
+
+        Refactoring only, no change in behavior.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::computePath):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::scrollOffset):
+        * platform/graphics/FloatPoint.h:
+        (WebCore::toFloatSize):
+        Add 'inline FloatSize toFloatSize(const FloatPoint&)' to match IntPoint.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2013-01-07  Kunihiko Sakamoto  <ksakamoto@chromium.org>
+
+        INPUT_MULTIPLE_FIELDS_UI: Step-up/-down of month/day field should respect min/max attributes
+        https://bugs.webkit.org/show_bug.cgi?id=106212
+
+        Reviewed by Kent Tamura.
+
+        Make step-up/-down of the month and day fields respect the min/max
+        attributes of the element.
+        Note that these fields still accept any keyboard inputs (the element
+        becomes 'invalid' state when out-of-bounds values entered).
+
+        Tests: fast/forms/date-multiple-fields/date-multiple-fields-readonly-subfield.html
+               fast/forms/date-multiple-fields/date-multiple-fields-stepup-stepdown-from-renderer.html
+               fast/forms/month-multiple-fields/month-multiple-fields-readonly-subfield.html
+               fast/forms/month-multiple-fields/month-multiple-fields-stepup-stepdown-from-renderer.html
+
+        * css/html.css: Add CSS rules for month and day fields.
+        * html/shadow/DateTimeEditElement.cpp:
+        (WebCore::DateTimeEditBuilder::visitField):
+        Compute minimum/maximum values of month/day fields from the min/max
+        parameters of the element. If minimum, maximum, and current value is
+        the same, makes the field read-only.
+        * html/shadow/DateTimeFieldElements.cpp:
+        (WebCore::DateTimeAMPMFieldElement::DateTimeAMPMFieldElement): Add mininum/maximum arguments.
+        (WebCore::DateTimeDayFieldElement::DateTimeDayFieldElement): Ditto.
+        (WebCore::DateTimeDayFieldElement::create): Ditto.
+        (WebCore::DateTimeDayFieldElement::clampValueForHardLimits): Added.
+        (WebCore::DateTimeMonthFieldElement::DateTimeMonthFieldElement): Add mininum/maximum arguments.
+        (WebCore::DateTimeMonthFieldElement::create): Ditto.
+        (WebCore::DateTimeMonthFieldElement::clampValueForHardLimits): Added.
+        (WebCore::DateTimeSymbolicMonthFieldElement::DateTimeSymbolicMonthFieldElement): Add mininum/maximum arguments.
+        (WebCore::DateTimeSymbolicMonthFieldElement::create): Ditto.
+        * html/shadow/DateTimeFieldElements.h:
+        (DateTimeDayFieldElement): Add mininum/maximum arguments and declare clampValueForHardLimits.
+        (DateTimeMonthFieldElement): Ditto.
+        (DateTimeSymbolicMonthFieldElement): Add mininum/maximum arguments.
+        * html/shadow/DateTimeSymbolicFieldElement.cpp:
+        (WebCore::DateTimeSymbolicFieldElement::DateTimeSymbolicFieldElement): Add mininum/maximum arguments.
+        (WebCore::DateTimeSymbolicFieldElement::maximum): Returns m_maximumIndex + 1 as it assumes 1-origin value.
+        (WebCore::DateTimeSymbolicFieldElement::minimum): Ditto.
+        (WebCore::DateTimeSymbolicFieldElement::stepDown): Restrict value to m_minimumIndex-m_maximumIndex.
+        (WebCore::DateTimeSymbolicFieldElement::stepUp): Ditto.
+        * html/shadow/DateTimeSymbolicFieldElement.h:
+        (DateTimeSymbolicFieldElement): Add m_minimumIndex and m_maximumIndex.
+        (WebCore::DateTimeSymbolicFieldElement::isInRange): Added.
+
+2013-01-07  Viatcheslav Ostapenko  <sl.ostapenko@samsung.com>
+
+        [EFL][WK2][WebGL] The top left side of the screen is shown inside the canvas element
+        https://bugs.webkit.org/show_bug.cgi?id=105136
+
+        Reviewed by Noam Rosenthal.
+
+        Use glXSwapBuffers to force resize of GL surface after X window resize.
+
+        Fixes fast/canvas/webgl/webgl-composite-modes.html pixel test on EFL platform.
+
+        * platform/graphics/surfaces/glx/X11WindowResources.cpp:
+        (WebCore::X11OffScreenWindow::reSizeWindow):
+
+2013-01-07  Steve Block  <steveblock@chromium.org>
+
+        Use explicit constructor to convert from Int/FloatSize to Int/FloatPoint
+        https://bugs.webkit.org/show_bug.cgi?id=106209
+
+        Reviewed by Kentaro Hara.
+
+        Refactoring only, no functional change.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2013-01-07  Viatcheslav Ostapenko  <sl.ostapenko@samsung.com>
+
+        [EFL][WebGL] Crash of WebKitTestRunner when running webgl layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=105936
+
+        Reviewed by Laszlo Gombos.
+
+        If canvas window becomes invalid don't create pixmap from it and don't 
+        use it for painting.
+
+        Improves stability of existing webgl layout tests.
+
+        * platform/graphics/surfaces/glx/GraphicsSurfaceGLX.cpp:
+        (WebCore::GraphicsSurfacePrivate::createPixmap):
+        (WebCore::GraphicsSurfacePrivate::size):
+        (WebCore::GraphicsSurface::platformGetTextureID):
+        (WebCore::GraphicsSurface::platformPaintToTextureMapper):
+
+2013-01-07  Hajime Morrita  <morrita@google.com>
+
+        Document::m_activeNode should be always an Element.
+        https://bugs.webkit.org/show_bug.cgi?id=106193
+
+        Reviewed by Ryosuke Niwa.
+
+        r137277 tightened an invariant that assumes that active node is
+        always an element. But Document::updateHoverActiveState() didn't
+        respect that assumption. This change forces it.
+
+        Test: svg/custom/text-use-click-crash.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+        (WebCore::Document::detach):
+        (WebCore::Document::setActiveNode):
+        (WebCore::Document::activeChainNodeDetached):
+        (WebCore::Document::updateHoverActiveState):
+        * dom/Document.h:
+        (WebCore::Document::activeElement): Renamed from m_activeNode for the clarification.
+        (Document):
+
+2013-01-07  Hajime Morrita  <morrita@google.com>
+
+        WebKit should compile on Mac with --shadow-dom
+        https://bugs.webkit.org/show_bug.cgi?id=105469
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests. Just changing build files.
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Element.idl:
+
+2013-01-07  Stephen White  <senorblanco@chromium.org>
+
+        Add a flag to control canvas antialiasing.
+        https://bugs.webkit.org/show_bug.cgi?id=106255
+
+        Reviewed by Darin Fisher.
+
+        This flag is not exposed through TestRunner or DRT, so no testing is
+        possible yet.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * page/Settings.in:
+
+2013-01-07  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        [CSS Grid Layout] Implement grid items sizing for fixed minmax grid tracks
+        https://bugs.webkit.org/show_bug.cgi?id=104700
+
+        Reviewed by Tony Chang.
+
+        This change implements parts of the minmax() track sizing algorithm. The chosen subset enables us
+        to resolve any sizing function that doesn't size based on the content (min-content, max-content).
+
+        Tests: fast/css-grid-layout/minmax-fixed-logical-height-only.html
+               fast/css-grid-layout/minmax-fixed-logical-width-only.html
+
+        * rendering/RenderGrid.cpp:
+        (WebCore::GridTrack::GridTrack):
+        Added a new member to hold the maximum track breadth.
+
+        (WebCore::RenderGrid::computePreferredLogicalWidths):
+        (WebCore::RenderGrid::computedUsedBreadthOfGridTracks):
+        Updated these functions to work on both min and max track breadth. In order to match
+        the specification, if max track breadth < min track breadth, we ignore the max track breadth.
+        For computedUsedBreadthOfGridTracks, it also involves calling distributeSpaceToTracks.
+
+        (WebCore::RenderGrid::computeUsedBreadthOfLength):
+        New helper function that compute a single length's size.
+
+        (WebCore::sortByGridTrackGrowthPotential):
+        Ordering function for the sorting the track: it orders the track per increasing potential
+        growth (defined as the difference between max breadth and the currently used breadth).
+
+        (WebCore::RenderGrid::distributeSpaceToTracks):
+        Added this function that matches the specification's algorithm. Only the relevant bits from
+        the specification were implemented for now (for example, SubsetOfTracksForGrowthBeyondTrackGrowthConstraint
+        is always the empty set so it was omitted).
+
+        * rendering/RenderGrid.h:
+        Added the new functions and declared GridTrack as public into the WebCore namespace.
+
+        * rendering/style/GridTrackSize.h:
+        (WebCore::GridTrackSize::minTrackBreadth):
+        (WebCore::GridTrackSize::maxTrackBreadth):
+        Removed 2 ASSERTs as the layout algorithm doesn't care if the min / max were
+        set from a single track breadth or through minmax().
+
+2013-01-07  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Add a setting to enable composited scrolling for frames
+        https://bugs.webkit.org/show_bug.cgi?id=104950
+
+        Reviewed by James Robinson.
+
+        Test: compositing/iframes/iframe-composited-scrolling.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::usesCompositedScrolling): Returns true if compositedScrollingForFramesEnabled and the frame is in forced compositing mode (which is set when forced compositing mode and compositing for scrollable frames are enabled), so that ScrollingCoordinator won't include the region of the frame in the nonFastScrollableRegion.
+        (WebCore):
+        * page/FrameView.h:
+        (FrameView):
+        * page/Settings.in: Add compositedScrollingForFramesEnabled setting.
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::ScrollingCoordinatorChromium::frameViewLayoutUpdated): Changed the comment about which ScrollableAreas are non-fast-scrollable.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidScroll): Let ScrollongCoordinator know when the scrolling changes for a frame with composited scrolling enabled.
+
+2013-01-07  Alexandre Elias  <aelias@chromium.org>
+
+        Divide gesture scroll delta by scale factor
+        https://bugs.webkit.org/show_bug.cgi?id=106263
+
+        Reviewed by Adam Barth.
+
+        Gesture scroll deltas were not being adjusted by the frame's scale
+        factors, resulting in overly fast main-thread scrolling when zoomed
+        in.
+
+        New test: fast/events/touch/gesture/touch-gesture-scroll-div-scaled.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureScrollCore):
+
+2013-01-07  Adam Barth  <abarth@webkit.org>
+
+        HTMLTreeBuilder should not depend on Frame
+        https://bugs.webkit.org/show_bug.cgi?id=106256
+
+        Reviewed by Eric Seidel.
+
+        Rather than have the tree builder ask the Frame whether scripting and
+        plugins are enabled, we now push that information to the tree builder
+        via HTMLParserOptions, letting us remove the Frame dependency from the
+        tree builder.
+
+        As a consequence of this change, the "script enabled" bit in the parser
+        is now locked in when the parser starts. This bit doesn't actually
+        control when script execute, only how the <noscript> element is parsed.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::tokenizerStateForContextElement):
+        (WebCore::HTMLDocumentParser::HTMLDocumentParser):
+        * html/parser/HTMLMetaCharsetParser.cpp:
+        (WebCore::HTMLMetaCharsetParser::HTMLMetaCharsetParser):
+        (WebCore::HTMLMetaCharsetParser::checkForMetaCharset):
+        * html/parser/HTMLParserOptions.cpp:
+        (WebCore::HTMLParserOptions::HTMLParserOptions):
+        * html/parser/HTMLParserOptions.h:
+        (HTMLParserOptions):
+        (WebCore::HTMLParserOptions::HTMLParserOptions):
+        * html/parser/HTMLPreloadScanner.cpp:
+        (WebCore::HTMLPreloadScanner::HTMLPreloadScanner):
+        (WebCore::HTMLPreloadScanner::processToken):
+        * html/parser/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::HTMLTokenizer::nextToken):
+        (WebCore::HTMLTokenizer::updateStateFor):
+        * html/parser/HTMLTokenizer.h:
+        (WebCore::HTMLTokenizer::create):
+        (HTMLTokenizer):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
+        * html/parser/HTMLTreeBuilder.h:
+        * html/parser/HTMLViewSourceParser.cpp:
+        (WebCore::HTMLViewSourceParser::HTMLViewSourceParser):
+        (WebCore::HTMLViewSourceParser::updateTokenizerState):
+
+2013-01-07  Tony Chang  <tony@chromium.org>
+
+        Remove more internals.settings that are autogenerated
+        https://bugs.webkit.org/show_bug.cgi?id=106253
+
+        Reviewed by Adam Barth.
+
+        Remove 8 methods that are autogenerated by Settings.in.
+
+        No new tests, this is a refactor and is convered by existing tests.
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::Backup::Backup): Remove backup.
+        (WebCore::InternalSettings::Backup::restoreTo): Remove restore.
+        * testing/InternalSettings.h:
+        (Backup): Remove member variables and functions.
+        (InternalSettings):
+        * testing/InternalSettings.idl: Remove functions.
+
+2013-01-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Another incremental build fix after r139013.
+
+        * mathml/MathMLAllInOne.cpp:
+
+2013-01-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Incremental build system on Windows port does not necessarily rebuild RenderBox.cpp after r139013.
+
+        * rendering/RenderingAllInOne.cpp:
+
+2013-01-07  Emil A Eklund  <eae@chromium.org>
+
+        REGRESSION(SUBPIXEL_LAYOUT): el.offsetWidth < el.clientWidth for elements of a certain size
+        https://bugs.webkit.org/show_bug.cgi?id=106107
+
+        Reviewed by Levi Weintraub.
+        
+        Add overloaded pixelSnappedOffsetWidth|Height methods to
+        RenderBox that do pixel snapping with the same offset
+        as clientWidth/height to ensure consistent rounding.
+
+        Test: fast/sub-pixel/client-and-offset-width.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pixelSnappedOffsetWidth):
+        (WebCore::RenderBox::pixelSnappedOffsetHeight):
+        Snap using the same offset as the clientWidth/height versions.
+        
+        * rendering/RenderBox.h:
+        Remove out of date FIXME and add OVERRIDE keyword.
+        
+        * rendering/RenderBoxModelObject.h:
+        Mark pixelSnappedOffsetWidth|Height as virtual.
+
+2013-01-07  Adam Barth  <abarth@webkit.org>
+
+        Introduce HTMLParserOptions to encapsulate HTML parser options
+        https://bugs.webkit.org/show_bug.cgi?id=106251
+
+        Reviewed by Eric Seidel.
+
+        Currently, the HTMLTreeBuilder (and potentially other parts of the
+        parser) use their Document* to read configuration information from the
+        Document (such as Settings). This patch introduces the
+        HTMLParserOptions class to encapsulate that information, making it
+        easier to move the HTML parser to a background thread (because the
+        HTMLTreeBuilder won't need to talk to the Document directly).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::HTMLDocumentParser):
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        (WebCore::HTMLDocumentParser::insert):
+        * html/parser/HTMLDocumentParser.h:
+        (HTMLDocumentParser):
+        * html/parser/HTMLPreloadScanner.cpp:
+        (WebCore::HTMLPreloadScanner::HTMLPreloadScanner):
+        * html/parser/HTMLPreloadScanner.h:
+        (WebCore):
+        (HTMLPreloadScanner):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
+        * html/parser/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::create):
+        (HTMLTreeBuilder):
+        * html/parser/HTMLViewSourceParser.cpp:
+        (WebCore::HTMLViewSourceParser::HTMLViewSourceParser):
+
+2013-01-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Minor improvements to HTMLMediaElement
+        https://bugs.webkit.org/show_bug.cgi?id=105353
+
+        Reviewed by Eric Carlson.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType):
+        (WebCore::createFileURLForApplicationCacheResource):
+        (WebCore::stringForNetworkState):
+        (WebCore::HTMLMediaElement::preload):
+        (WebCore::HTMLMediaElement::getPluginProxyParams):
+        Use ASCIILiteral for literal strings becoming WTFStrings.
+
+        (WebCore::HTMLMediaElement::setLoop):
+        By going through setAttribute, parseAttribute would already take care of
+        updating the disable sleep, so the call here is not needed.
+
+2013-01-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        String improvements in geolocation and notifications modules
+        https://bugs.webkit.org/show_bug.cgi?id=105352
+
+        Reviewed by Sam Weinig.
+
+        * Modules/geolocation/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::timerFired):
+        (WebCore::Geolocation::startRequest):
+        (WebCore::Geolocation::requestUsesCachedPosition):
+        (WebCore::Geolocation::makeCachedPositionCallbacks):
+        (WebCore::Geolocation::setIsAllowed):
+        (WebCore::Geolocation::cancelRequests):
+        (WebCore::Geolocation::handlePendingPermissionNotifiers):
+        * Modules/geolocation/GeolocationController.cpp:
+        (WebCore::GeolocationController::positionChanged):
+        * Modules/notifications/WorkerContextNotifications.cpp:
+        Use ASCIILiteral for constant strings becoming WTFStrings.
+
+        (WebCore::WorkerContextNotifications::from):
+        Use AtomicString::ConstructFromLiteral for the static local.
+
+2013-01-07  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: the text of render counters are not exposed to Accessibility
+        https://bugs.webkit.org/show_bug.cgi?id=103794
+
+        Reviewed by Ryosuke Niwa.
+
+        Support RenderText objects that don't have nodes (like RenderCounter).
+
+        Test: accessibility/render-counter-text.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+
+2013-01-07  Tim Horton  <timothy_horton@apple.com>
+
+        Tiled-layer TileCaches shouldn't unparent offscreen tiles
+        https://bugs.webkit.org/show_bug.cgi?id=106258
+        <rdar://problem/12969116>
+
+        Reviewed by Simon Fraser.
+
+        Add a setting on TiledBacking (implemented on TileCache) that controls whether or not
+        the TileCache should unparent offscreen tiles. We can't use this behavior for tiled-layer TileCaches
+        currently because m_isInWindow is not updated for tiled-layer TileCaches, and because we haven't
+        decided exactly what their behavior should be. So, revert to the old behavior for them.
+
+        * platform/graphics/TiledBacking.h:
+        * platform/graphics/ca/mac/TileCache.h:
+        (TileCache): Add setUnparentsOffscreenTiles/unparentsOffscreenTiles.
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::TileCache): m_unparentsOffscreenTiles defaults to false.
+        (WebCore::TileCache::revalidateTiles):
+        Return to the old behavior of always adding new layers to the layer tree regardless of m_isInWindow if m_unparentsOffscreenTiles is false.
+        Return to the old behavior of never unparenting tiles regardless of m_isInWindow if m_unparentsOffscreenTiles is false.
+        (WebCore::TileCache::ensureTilesForRect): Return to the old behavior of always ensuring tiles regardless of m_isInWindow if m_unparentsOffscreenTiles is false.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking): Tell primary TileCaches that it's OK to unparent offscreen tiles.
+
+2013-01-07  Justin Novosad  <junov@google.com>
+
+        Fixing memory read after free in CanvasRenderingContext2D::accessFont
+        https://bugs.webkit.org/show_bug.cgi?id=106244
+
+        Reviewed by Abhishek Arya.
+
+        Using a temporary String object to hold ref count on string that is
+        passed by reference in CanvasRenderingContext2D::accessFont.
+
+        Test: fast/canvas/canvas-measureText.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::accessFont):
+
+2013-01-07  Anders Carlsson  <andersca@apple.com>
+
+        DOMEvents.h should include DOMProgressEvent.h
+        https://bugs.webkit.org/show_bug.cgi?id=106250
+
+        Reviewed by Sam Weinig.
+
+        DOMProgressEvent.h is already installed as a public header, so it should also be included by DOMEvents.h.
+
+        * bindings/objc/DOMEvents.h:
+
+2013-01-07  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Add window.internals.nonFastScrollableRects for testing scrollable areas in fast/slow paths
+        https://bugs.webkit.org/show_bug.cgi?id=105546
+
+        Reviewed by James Robinson.
+
+        No new tests. Added test API for new tests of other bugs.
+
+        * WebCore.exp.in:
+        * page/Page.cpp:
+        (WebCore::Page::nonFastScrollableRects):
+        (WebCore):
+        * page/Page.h:
+        (WebCore):
+        (Page):
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::computeNonFastScrollableRegion): Change to public to allow Page::nonFastScrollableRects to access.
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+        * testing/Internals.cpp:
+        (WebCore::Internals::nonFastScrollableRects):
+        (WebCore):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2013-01-07  Tom Sepez  <tsepez@chromium.org>
+
+        Document::initSecurityContext() gives parent security context to iframes with invalid URLs.
+        https://bugs.webkit.org/show_bug.cgi?id=104960
+
+        Reviewed by Adam Barth.
+
+        Change covers the case of an invalid non-empty URL.  We know nothing
+        about that kind of URL and choose not to inherit origins.
+        
+        * dom/Document.cpp:
+        (WebCore::shouldInheritSecurityOriginFromOwner):
+
+2013-01-07  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: Regression: Contextual menu not following with VO cursor in HTML content when item is scrolled
+        https://bugs.webkit.org/show_bug.cgi?id=70075
+
+        Reviewed by Anders Carlsson.
+
+        On WK2 only, when accessibility opens a contextual menu, it does not honor the scroll offset. 
+        On WK1, the attachment views handle this conversion when it's needed, but on WK2 it needs to be done manually
+        (similar to how the accessibility position is calculated). 
+
+        No test. Cannot test the location of context menu popups on WK2 yet.
+
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityShowContextMenu]):
+
+2013-01-07  Abhishek Arya  <inferno@chromium.org>
+
+        Heap-buffer-overflow in WebCore::RenderBlock::clone.
+        https://bugs.webkit.org/show_bug.cgi?id=101984
+
+        Reviewed by Julien Chaffraix.
+
+        Add a global in RenderBlock to prevent recursion inside splitFlow.
+        While inside splitFlow (multi-column handling), we move many children
+        using fullRemoveInsert=true, causing RenderBlock::addChild to be called
+        and recursing in splitFlow. This messes the tree splitting happening in
+        RenderBlock::splitBlocks and can cause bad casts.
+
+        Test: fast/multicol/recursive-split-flow-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+
+2013-01-07  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Fix PlatformContextSkia::setDrawingToImageBuffer abuse
+        https://bugs.webkit.org/show_bug.cgi?id=104956
+
+        Reviewed by James Robinson.
+
+        Replaced PlatformContextSkia::SetDrawingToImageBuffer with GraphicsContext::setShouldSmoothFonts.
+
+        No new tests needed. No change in functionality.
+
+        * platform/graphics/chromium/CompositorHUDFontAtlas.cpp:
+        (WebCore::CompositorHUDFontAtlas::generateFontAtlas):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::couldUseLCDRenderedText):
+        (WebCore):
+
+2013-01-07  Enrica Casucci  <enrica@apple.com>
+
+        Some characters are not rotated properly in vertical text
+        https://bugs.webkit.org/show_bug.cgi?id=105663
+        <rdar://problem/12738911>
+
+        Reviewed by Dan Bernstein.
+
+        Test: platform/mac/fast/text/vertical-no-sideways.html
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::isCJKIdeographOrSymbol): Added several characters to the list.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::shouldIgnoreRotation): Added
+        (WebCore::Font::glyphDataAndPageForNonCJKCharacterWithGlyphOrientation): Added logic to avoid
+        rotation for all the characters listed in shouldIgnoreRotation.
+    
+2013-01-07  Mike West  <mkwst@chromium.org>
+
+        Make the IFRAME_SEAMLESS flag runtime-enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=106213
+
+        Reviewed by Ojan Vafai.
+
+        Seamless IFrames live behind the IFRAME_SEAMLESS compile-time flag, this
+        patch adds another layer to that in order to enable runtime decisions
+        about when it should be active. This will allow ports (Chromium, for
+        instance) to toggle the feature on/off for particular builds without
+        recompiling from scratch.
+
+        * WebCore.exp.in:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::seamlessIFramesEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSeamlessIFramesEnabled):
+            Add seamless IFrames to the set of runtime controlled features.
+        * dom/Document.cpp:
+        (WebCore::Document::shouldDisplaySeamlesslyWithParent):
+            If seamless IFrames aren't runtime enabled, always return false from
+            Document::shouldDisplaySeamlesslyWithParent. As this method already
+            acts as the single gate that controls the rest of the system, it's
+            the only place we need to make the runtime check.
+
+2013-01-07  Eric Carlson  <eric.carlson@apple.com>
+
+        LayoutUnit(unsigned long long value) compile failure
+        https://bugs.webkit.org/show_bug.cgi?id=106239
+
+        Cast the result of ('unsigned long long' * 'int') to an int before storing in m_value
+        to avoid compile failure on some platforms.
+
+        Reviewed by Ryosuke Niwa.
+
+        * platform/LayoutUnit.h:
+        (WebCore::LayoutUnit::LayoutUnit): Cast to int after multiplication.
+
+2013-01-07  Joe Mason  <jmason@rim.com>
+
+        [BlackBerry] Handle the new AuthRetry result code in NetworkJob::notifyAuthReceived
+        https://bugs.webkit.org/show_bug.cgi?id=106233
+
+        Reviewed by Rob Buis.
+
+        Internal PR: 270683
+        FilterStream::notifyAuthReceived has a new result code, AuthRetry. When it's received we
+        need to handle it by resending the request with the same credentials.
+
+        Reviewed internally by Leo Yang.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::notifyAuthReceived):
+        * platform/network/blackberry/NetworkJob.h:
+        (NetworkJob):
+
+2013-01-07  Philip Rogers  <pdr@google.com>
+
+        Clear pending container size requests as early as possible
+        https://bugs.webkit.org/show_bug.cgi?id=106162
+
+        Reviewed by Eric Seidel.
+
+        http://trac.webkit.org/changeset/137981 contained a bug where pending container size
+        requests were only cleared for images that use container sizes. Bitmap images do not use
+        container sizes so these requests were not being cleared. This patch does the trivial
+        refactoring so that container size requests are cleared as early as possible.
+
+        No new tests as this is just a refactoring of some messy code added in r137981.
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::createImage):
+
+2013-01-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r137632.
+        http://trac.webkit.org/changeset/137632
+        https://bugs.webkit.org/show_bug.cgi?id=106237
+
+        Caused major security regressions on ClusterFuzz (Requested by
+        inferno-sec on #webkit).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::startDelayUpdateScrollInfo):
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+
+2013-01-07  Victor Carbune  <victor@rosedu.org>
+
+        [Track] Rendering crash
+        https://bugs.webkit.org/show_bug.cgi?id=106199
+
+        Reviewed by Eric Carlson.
+
+        The browser is crashing if a text track is added through JavaScript,
+        due to the fact that the containing block is not marked as inline at
+        the time RenderTextTrackCue::layout() is called. The fix consists
+        of ensuring that the pseudo id is set, even if the track isn't
+        yet visible.
+
+        Test: media/track/track-cue-inline-assertion-crash.html
+
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::updateDisplayTree): The pseudo-id should
+        be set when the display tree is generated.
+        (WebCore::TextTrackCue::getDisplayTree): Added extra check to not
+        do unneccessary logic if the track will never be displayed.
+
+2013-01-07  Michael Pruett  <michael@68k.org>
+
+        [JSC] Copy non-index properties of arrays in SerializedScriptValue
+        https://bugs.webkit.org/show_bug.cgi?id=105575
+
+        Reviewed by Oliver Hunt.
+
+        The structured cloning algorithm requires copying all properties of
+        array objects, including non-index properties.
+
+        Tests: fast/storage/serialized-script-value.html
+               storage/indexeddb/structured-clone.html
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore):
+        (WebCore::CloneSerializer::serialize):
+        (WebCore::CloneDeserializer::putProperty):
+        (WebCore::CloneDeserializer::deserialize):
+
+2013-01-07  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Stub out async IDBDatabaseBackendInterface::createObjectStore
+        https://bugs.webkit.org/show_bug.cgi?id=106148
+
+        Reviewed by Adam Barth.
+
+        These methods are becoming async in multiprocess ports, so stub out
+        versions that have no return values.
+
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h:
+        (IDBDatabaseBackendInterface):
+
+2013-01-04  Alexey Proskuryakov  <ap@apple.com>
+
+        ResourceHandle::willLoadFromCache is evil
+        https://bugs.webkit.org/show_bug.cgi?id=106147
+
+        Reviewed by Brady Eidson.
+
+        For back/forward navigations to a page that's a result of form submission, we may
+        never silently re-submit the form. So, we show a warning dialog when about to re-submit,
+        but try to load from cache if possible.
+
+        This patch changes the logic so that we always try to fetch from cache, without
+        any preflighting. If cache load fails, we restart the load as a known re-submit.
+
+        No behavior change expected, so no tests.
+
+        * html/HTMLAnchorElement.cpp: (WebCore::HTMLAnchorElement::handleClick):
+        Added a FIXME.
+
+        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::startLoadingMainResource):
+        Amended a FIXME with some information about why this call may still be needed.
+
+        * loader/FrameLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURLIntoChildFrame): Pass an explicit argument for unchanged caching behavior.
+        (WebCore::FrameLoader::reloadWithOverrideEncoding): Added a FIXME. This function
+        can silently re-submit a form.
+        (WebCore::FrameLoader::addExtraFieldsToMainResourceRequest): Added a FIXME about
+        an incorrect use of current load type.
+        (WebCore::FrameLoader::addExtraFieldsToRequest): Make sure that a correct caching
+        policy is used for subresources even if main resource was loaded from cache. We
+        didn't need that before because initial request had wrong extra fields due to a use
+        of m_loadType when it was first called.
+        Removed code to change caching policy for b/f navigations. This function does not
+        have enough context to decide what the policy should be.
+        (WebCore::FrameLoader::loadDifferentDocumentItem): Added an argument telling the
+        function whether it should attempt loading from cache. It should do that on first
+        attempt to navigate to a form submission result, but not if that failed.
+        Pass a correct loadType - m_loadType is one for _previous_ load.
+        Removed a special case for https - we've long stopped prohibiting caching of https
+        resources, and using a resource that's already cached should definitely be allowed.
+        (WebCore::FrameLoader::loadItem): Pass an explicit argument for unchanged caching behavior.
+        (WebCore::FrameLoader::retryAfterFailedCacheOnlyMainResourceLoad): Added.
+
+        * loader/MainResourceLoader.cpp: (WebCore::MainResourceLoader::notifyFinished):
+        Removed a check for m_resource being null, because we were immediately dereferencing
+        it anyway.
+        Call retryAfterFailedCacheOnlyMainResourceLoad() to let FrameLoader restart the navigation.
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/blackberry/ResourceHandleBlackBerry.cpp:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        * platform/network/chromium/ResourceHandle.cpp:
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        * platform/network/mac/ResourceHandleMac.mm:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        * platform/network/win/ResourceHandleWin.cpp:
+        Removed willLoadFromCache() - the new logic is cross-platform.
+
+2013-01-07  Alberto Garcia  <agarcia@igalia.com>
+
+        [GTK] Disable deprecation warnings for GStaticRecMutex
+        https://bugs.webkit.org/show_bug.cgi?id=105918
+
+        Reviewed by Philippe Normand.
+
+        GStaticRecMutex is deprecated since glib 2.32, but we can't remove
+        it because it's needed by GStreamer 0.10. The solution is to
+        disable the deprecation warnings for that code alone.
+
+        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
+
+2013-01-07  Philip Rogers  <pdr@google.com>
+
+        Refactor client removal in CachedResource::switchClientsToRevalidatedResource
+        https://bugs.webkit.org/show_bug.cgi?id=106206
+
+        Previously switchClientsToRevalidatedResource() failed to call didRemoveClient() for each
+        client and instead simply cleared m_clients. This patch removes an incorrect comment and
+        refactors the code so that removeClient() and didRemoveClient() are properly called.
+
+        Reviewed by Nate Chapin.
+
+        No new tests as there are no observable changes from this refactoring.
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::switchClientsToRevalidatedResource):
+
+2013-01-07  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Support size_t multiplication and division operators on LayoutUnit
+        https://bugs.webkit.org/show_bug.cgi?id=83848
+
+        Reviewed by Emil A Eklund.
+
+        Per Darin's suggestion, adding a version of the operator for most unsigned types (excluding
+        only unsigned char). This should automatically cover size_t as it should be one of these.
+
+        Test: TestWebKitAPI/Tests/WebCore/LayoutUnit.cpp
+
+        * platform/LayoutUnit.h:
+        (WebCore::LayoutUnit::LayoutUnit):
+        (WebCore::operator*):
+        (WebCore::operator/):
+        Added the operators and (possibly saturating) constructors for unsigned short, unsigned long,
+        unsigned long long.
+
+2013-01-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r138944.
+        http://trac.webkit.org/changeset/138944
+        https://bugs.webkit.org/show_bug.cgi?id=106223
+
+        It made 28 tests crash (Requested by Ossy on #webkit).
+
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+
+2013-01-07  peavo@outlook.com  <peavo@outlook.com>
+
+        [WinCairo] Build fixes after r138413
+        https://bugs.webkit.org/show_bug.cgi?id=106087
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCore.vcproj/WebCore.vcproj: Added NetworkStorageSessionStub.cpp,
+        and removed NetworkStorageSessionCFNet.cpp for WinCairo build.
+        * platform/win/TemporaryLinkStubs.cpp: Include fix.
+
+2013-01-07  David Faure  <faure@kde.org>
+
+        [Qt] Major performance improvement in Qt's PluginDatabase implementation
+        https://bugs.webkit.org/show_bug.cgi?id=106140
+
+        Reviewed by Simon Hausmann.
+
+        No new tests, only a performance improvement.
+
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo): Don't do a full-fledged load(), load the module directly.
+        (WebCore::PluginPackage::load): Use existing module if fetchInfo created it.
+
+2013-01-07  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Optimizing RGBA16, RGB16, ARGB16, BGRA16 unpacking functions with NEON intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=103614
+
+        Reviewed by Zoltan Herczeg.
+
+        Optimizing RGBA16, RGB16, ARGB16, BGRA16 unpacking functions in GraphicsContext3D
+        with ARM NEON intrinsics. The optimized functions are 2-3x faster than the origin.
+
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore):
+        * platform/graphics/cpu/arm/GraphicsContext3DNEON.h:
+        (WebCore::SIMD::unpackOneRowOfRGBA16LittleToRGBA8):
+        (SIMD):
+        (WebCore::SIMD::unpackOneRowOfRGB16LittleToRGBA8):
+        (WebCore::SIMD::unpackOneRowOfARGB16LittleToRGBA8):
+        (WebCore::SIMD::unpackOneRowOfBGRA16LittleToRGBA8):
+
+2013-01-07  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Regression(r138786): Causes webaudio tests to crash
+        https://bugs.webkit.org/show_bug.cgi?id=106182
+
+        Reviewed by Philippe Normand.
+
+        Partially revert r138786 since it causes crashes in webaudio
+        tests. The WebProcess would actually become unresponsive due
+        to source element never going to PLAYING state.
+
+        Only the changes to webKitWebAudioSrcChangeState() were reverted.
+
+        No new tests, already covered by existing tests.
+
+        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
+        (webKitWebAudioSrcChangeState):
+
+2013-01-07  Hayato Ito  <hayato@chromium.org>
+
+        Cannot compile with ENABLE_SHADOW_DOM=0 and ENABLE_STYLE_SCOPED=1
+        https://bugs.webkit.org/show_bug.cgi?id=106207
+
+        Reviewed by Hajime Morita.
+
+        Guard StyleScopeResolver::addHostRule with SHADOW_DOM flag.
+
+        No tests, as no change in behavior.
+
+        * css/StyleScopeResolver.cpp:
+        (WebCore):
+
+2013-01-07  Jon Lee  <jonlee@apple.com>
+
+        Missing amendments to r138927. Amend Changelog to remove item about Timer.h, which was not changed.
+
+        * rendering/RenderSnapshottedPlugIn.cpp: Rename stopAndRestartDelayTimer() to resetDelayTimer().
+        (WebCore::RenderSnapshottedPlugIn::updateSnapshot):
+        (WebCore::RenderSnapshottedPlugIn::handleEvent):
+        (WebCore::RenderSnapshottedPlugIn::resetDelayTimer):
+        * rendering/RenderSnapshottedPlugIn.h:
+
+2013-01-06  Jon Lee  <jonlee@apple.com>
+
+        Show label automatically for plug-ins of significant size
+        https://bugs.webkit.org/show_bug.cgi?id=106146
+        <rdar://problem/12783010>
+
+        Reviewed by Simon Fraser.
+
+        For significantly sized plug-ins, trigger a timer that displays the label automatically
+        without requiring the user to mouse over the element first. The trickiness of the logic
+        here is that there are two delays involved-- one for whether the user mouses over (shorter),
+        and one for when the label is shown automatically (longer). Mousing over a plug-in that is
+        marked to show it automatically should have the timer delay switched. And if the label
+        showed automatically, mousing in and out of the element should not change that label's
+        state.
+
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore): Add constants that determine whether the plug-in is of a significant size.
+        (WebCore::shouldPlugInShowLabelAutomatically): Based on the size of the frame view and the
+        clipped plug-in size, determine whether the label should show automatically. If the plug-in is
+        not contained within the bounds of the frame view, or is not at least as large as the threshold
+        size, then do not show the label automatically.
+        (WebCore::HTMLPlugInImageElement::subframeLoaderWillCreatePlugIn): After we've determined that
+        the plug-in should not auto-start, make a check to see if the label should show automatically.
+        Also, update some of the logging.
+        (WebCore::HTMLPlugInImageElement::subframeLoaderDidCreatePlugIn): Update the logging.
+
+        * rendering/RenderSnapshottedPlugIn.h: Rename the timer to m_showLabelDelayTimer since
+        it can fire for two different reasons. Add some additional state variables, and an enum
+        to explain why the label appeared.
+        * rendering/RenderSnapshottedPlugIn.cpp:
+        (WebCore): Change hoverDelay to showLabelAfterMouseOverDelay. Add a new, longer delay for
+        when the plug-in is supposed to auto-show the label.
+        (WebCore::RenderSnapshottedPlugIn::RenderSnapshottedPlugIn): Initialize the member variables.
+        (WebCore::RenderSnapshottedPlugIn::updateSnapshot): When the snapshot image is updated,
+        start the timer to auto-show the label.
+        (WebCore::RenderSnapshottedPlugIn::paintLabel): Avoid painting the label only if the element
+        is not hovered and the user was mousing over the plug-in. Otherwise, the plug-in is supposed
+        to show automatically, and we should paint. Mark the renderer as having showed the label at
+        least once.
+        (WebCore::RenderSnapshottedPlugIn::showLabelDelayTimerFired): Renamed to reflect the
+        purpose of the timer.
+        (WebCore::RenderSnapshottedPlugIn::setShouldShowLabelAutomatically): Set the variable that
+        determines whether, in general, this plug-in should show the label automatically even
+        without user input.
+        (WebCore::RenderSnapshottedPlugIn::handleEvent): If the user mouses over the plug-in,
+        only reset the show timer is the label has never appeared before, or if it has, that
+        it's not because the label was supposed to show automatically. That is, if the label is
+        supposed to show automatically, the label should remain visible. This is also true when
+        the user mouses out of the plug-in. If the user moused out before the time had a chance
+        to fire and show the label for the first time, then we check to see if the plug-in should
+        be displaying the label automatically, and if so, restart the timer using the longer delay.
+        (WebCore::RenderSnapshottedPlugIn::stopAndRestartDelayTimer): Convenience function to
+        update the m_showReason variable, and reset the timer with the appropriate delay.
+
+2013-01-06  Abhishek Arya  <inferno@chromium.org>
+
+        Heap-use-after-free in DocumentLoader::stopLoading
+        https://bugs.webkit.org/show_bug.cgi?id=103656
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/dom/ready-state-change-crash.html
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::prepareToStopParsing): Bail out
+        if the parser is detached due to mutation event.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading): Move the protectors for
+        frame and document loader to the start of the function. Call to
+        m_frame->loader()->stopLoading() can change document ready state
+        and fire mutation event which might blow the document loader from
+        underneath.
+
+2013-01-06  Takashi Sakamoto  <tasak@google.com>
+
+        [Shadow DOM]: crash in WebCore::ElementShadow::setValidityUndetermined
+        https://bugs.webkit.org/show_bug.cgi?id=106203
+
+        Reviewed by Hajime Morita.
+
+        InsertionPoint should check whether ElementShadow is available or not
+        before invoking its methods.
+
+        No new tests. Webcomponents_fuzzer reported this bug. Would like to
+        use the fuzzer to check this issue.
+
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::getDistributedNodes):
+        (WebCore::InsertionPoint::childrenChanged):
+        (WebCore::InsertionPoint::insertedInto):
+        Added ifs to check whether ElementShadow is available or not before
+        invoking ElementShadow's methods, i.e. setValidityUndetermined,
+        invalidateDistribution, and ensureDistributionDocument.
+
+2013-01-06  Shinya Kawanaka  <shinyak@chromium.org>
+
+        RenderImage should not use shadowAncestorNode
+        https://bugs.webkit.org/show_bug.cgi?id=97871
+
+        Reviewed by Dimitri Glazkov.
+
+        Since shadowAncestorNode() does not return 0, this if-condition will never hold.
+        shadowHost() should be used instead.
+
+        No change in logic, refactoring.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::hostImageElement):
+
+2013-01-06  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Bug 106177 - [GStreamer] Don't call gst_video_info_from_caps() with non-fixed caps
+        https://bugs.webkit.org/show_bug.cgi?id=106177
+
+        Reviewed by Martin Robinson.
+
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (getVideoSizeAndFormatFromCaps):
+        Don't call gst_video_info_from_caps() with non-fixed caps as
+        it will cause assertions.
+
+2013-01-06  Abhishek Arya  <inferno@chromium.org>
+
+        Heap-use-after-free in WebCore::Document::implicitClose
+        https://bugs.webkit.org/show_bug.cgi?id=105655
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/dom/window-load-crash.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): RefPtr protect |this| document since it
+        can be destroyed in the dispatchWindowLoadEvent call.
+
+2013-01-06  Mike West  <mkwst@chromium.org>
+
+        Seamless: IFrame's padding isn't taken into account when calculating its height.
+        https://bugs.webkit.org/show_bug.cgi?id=106167
+
+        Reviewed by Eric Seidel.
+
+        IFrames rendered seamlessly don't currently calculate their height
+        correctly when padding is applied to the frame itself. This patch adds
+        padding calculations to RenderIFrame::layoutSeamlessly to ensure that
+        the seamless frame is correctly sized.
+
+        * rendering/RenderIFrame.cpp:
+        (WebCore::RenderIFrame::layoutSeamlessly):
+
+2013-01-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION: [Mac] Intermittent crashes in AXObjectCache::notificationPostTimerFired
+        https://bugs.webkit.org/show_bug.cgi?id=106106
+
+        Reviewed by Eric Seidel.
+
+        The crash was cause by notification post timer firing after the object destruction had taken place.
+        Clear the timer so that this won't happen. Also make sure the document doesn't go away while we're
+        going through m_notificationsToPost.
+
+        No new tests since crashes have been caught by various layout tests, and we can't easily
+        create a deterministic layout test for this particular crash.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::~AXObjectCache):
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+
+2013-01-05  Michael Pruett  <michael@68k.org>
+
+        IndexedDB: Replace int64 with int64_t
+        https://bugs.webkit.org/show_bug.cgi?id=106189
+
+        Reviewed by Sam Weinig.
+
+        Cleaning up coding inconsistencies, no change in behavior.
+
+        Tests: storage/indexeddb/*
+
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::GetOperation::create):
+
+2013-01-05  Elliott Sprehn  <esprehn@chromium.org>
+
+        Remove RenderObjectChildList::beforePseudoElementRenderer and afterPseudoElementRenderer
+        https://bugs.webkit.org/show_bug.cgi?id=106132
+
+        Reviewed by Abhishek Arya.
+
+        We no longer need the complicated traversals in beforePseudoElementRenderer
+        and afterPseudoElementRenderer since we can get the renderers of pseudo
+        elements through the node. This removes all that code and swaps it for
+        Element::pseudoElementRenderer.
+
+        This is possible now that r138850 removed all the now incorrect manual
+        management of pseudo element renderers from the render tree that was
+        left over from before the switch to DOM based pseudo elements.
+
+        No new tests, just refactoring.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoElementRenderer):
+            Added, gets the renderer of the pseudo element by PseudoId if it
+            exists.
+        * dom/Element.h:
+        (Element):
+        * dom/NodeRenderingTraversal.cpp:
+        (WebCore::NodeRenderingTraversal::nextSiblingSlow):
+        (WebCore::NodeRenderingTraversal::previousSiblingSlow):
+        * rendering/RenderCounter.cpp:
+        (WebCore::previousInPreOrder):
+        (WebCore::previousSiblingOrParent):
+        (WebCore::nextInPreOrder):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::lastChild):
+        * rendering/RenderObjectChildList.cpp:
+        * rendering/RenderObjectChildList.h:
+        (RenderObjectChildList):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::counterValueForElement):
+
+2013-01-05  Robert Hogan  <robert@webkit.org>
+
+        Heap-use-after-free in WebCore::RenderBlock::insertIntoTrackedRendererMaps
+        https://bugs.webkit.org/show_bug.cgi?id=105654
+
+        Reviewed by Simon Fraser.
+
+        As with position:relative, position:sticky does not apply to table sections.
+
+        Test: fast/block/sticky-position-containing-block-crash.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::adjustRenderStyle):
+
+2013-01-05  Mike West  <mkwst@chromium.org>
+
+        Cleanup: mayDisplaySeamlessWithParent -> mayDisplaySeamless_ly_WithParent
+        https://bugs.webkit.org/show_bug.cgi?id=106169
+
+        Reviewed by Eric Seidel.
+
+        This patch renames SecurityContext's 'm_mayDisplaySeamlessWithParent' to
+        'm_mayDisplaySeamlesslyWithParent'. Because adverbs matter.
+
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        (WebCore::Document::shouldDisplaySeamlesslyWithParent):
+        * dom/SecurityContext.cpp:
+        (WebCore::SecurityContext::SecurityContext):
+        * dom/SecurityContext.h:
+        (SecurityContext):
+
+2013-01-05  Mike West  <mkwst@chromium.org>
+
+        seamless iframes don't take border into account properly and make the iframe too small.
+        https://bugs.webkit.org/show_bug.cgi?id=90827
+
+        Reviewed by Ojan Vafai.
+
+        Seamless IFrames were incorrectly calculating their width; borders and
+        padding of the child document were accidentally left out of the end
+        result. This tiny patch adds the border/padding width to the calculated
+        width for the seamless IFrame, bringing things back into line with
+        expectations.
+
+        Test: fast/frames/seamless/seamless-border-padding.html
+
+        * rendering/RenderIFrame.cpp:
+        (WebCore::RenderIFrame::minPreferredLogicalWidth):
+        (WebCore::RenderIFrame::maxPreferredLogicalWidth):
+            Add borderAndPaddingLogicalWidth() to the result of both methods.
+
 2013-01-05  Min Qin  <qinmin@chromium.org>
 
         MediaControls::show() should make controls opaque