Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 140726)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,3 +1,2174 @@
+2013-01-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r140296.
+        http://trac.webkit.org/changeset/140296
+        https://bugs.webkit.org/show_bug.cgi?id=107857
+
+        Cause several regresssions (Requested by smfr on #webkit).
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+
+2013-01-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Rename JSValue.h/APIJSValue.h to JSCJSValue.h/JSValue.h
+        https://bugs.webkit.org/show_bug.cgi?id=107327
+
+        Reviewed by Filip Pizlo.
+
+        No new tests.
+
+        We're renaming these two files, so we have to replace the names everywhere.
+
+        * ForwardingHeaders/runtime/JSCJSValue.h: Copied from Source/WebCore/ForwardingHeaders/runtime/JSValue.h.
+        * ForwardingHeaders/runtime/JSValue.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSArrayBufferViewHelper.h:
+        * bindings/js/JSCustomXPathNSResolver.h:
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        * bindings/js/JSIntentConstructor.cpp:
+        * bindings/js/JSMessagePortCustom.h:
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JavaScriptCallFrame.cpp:
+        * bindings/js/ScriptCallStackFactory.cpp:
+        * bindings/js/ScriptValue.h:
+        * bindings/js/SerializedScriptValue.h:
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bridge/c/c_utility.h:
+        * bridge/testbindings.cpp:
+        * bridge/testbindings.mm:
+        * bridge/testqtbindings.cpp:
+        * plugins/PluginView.cpp:
+        * plugins/blackberry/PluginViewBlackBerry.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.mm:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2013-01-24  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix for Mac/Lion.
+
+        Protect Lion from the absence of VideoToolbox.h by wrapping in #if
+        guards.
+
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+
+2013-01-24  Anders Carlsson  <andersca@apple.com>
+
+        Add stubbed out StorageNamespaceProxy class
+        https://bugs.webkit.org/show_bug.cgi?id=107846
+
+        Reviewed by Sam Weinig.
+
+        Make StorageNamespace.h and StorageArea.h private headers.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2013-01-24  Tony Chang  <tony@chromium.org>
+
+        Remove document as a parameter from a few internals methods
+        https://bugs.webkit.org/show_bug.cgi?id=107757
+
+        Reviewed by Hajime Morita.
+
+        Remove document as a parameter since there's already one associated with internals.
+
+        No new tests, this refactors some testing code and is covered by
+        exisiting tests.
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::isPreloaded):
+        (WebCore::Internals::createContentElement):
+        (WebCore::Internals::absoluteCaretBounds):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2013-01-24  Mike West  <mkwst@chromium.org>
+
+        Web Inspector: 'console.debug' should generate messages at DebugMessageLevel.
+        https://bugs.webkit.org/show_bug.cgi?id=107816
+
+        Reviewed by Pavel Feldman.
+
+        'console.debug' is currently aliased to 'console.log'. Since we now
+        render debug-level messages differently to log messages, we should use
+        the proper message level for 'console.debug'.
+
+        * page/Console.cpp:
+        (WebCore::Console::debug):
+            Replace the alias to 'console.log' with message creation at
+            DebugMessageLevel.
+
+2013-01-24  Dima Gorbik  <dgorbik@apple.com>
+
+        Implement :past pseudo class for the WebVTT ::cue pseudo element
+        https://bugs.webkit.org/show_bug.cgi?id=105482
+
+        Reviewed by Eric Carlson.
+
+        It is good to have a designated pseudo class for this, though same could
+        be achieved by using a combination of ::cue and ::cue(:future).
+        Tests also check that nested timestamps work properly.
+
+        Test: media/track/track-css-matching-timestamps.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOne):
+
+2013-01-23  Jer Noble  <jer.noble@apple.com>
+
+        Mac: Avoid using k32BGRAPixelFormat on certain platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=107732
+
+        Reviewed by Eric Carlson.
+
+        Using a AVPlayerItemVideoOutput to generate ARGB pixel buffers is a potential performance
+        hit, as the AVPlayerItemVideoOutput will send YUV buffers through a VTPixeBufferTransferSession
+        to convert them to ARGB regardless of whether or not a given buffer will be used. Instead,
+        ask the AVPlayerItemVideoOutput for pixel buffers in the decoder's native pixel format and use
+        the VTPixelBufferTransferSession to convert to ARGB only those pixel buffers which were actually
+        requested.
+
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput): Ask for the decoder's native
+            pixel format.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer): Lazily create a VTPixelTransferSession
+            and convert output pixel buffers to k32BGRAPixelFormat.
+
+2013-01-24  Christian Biesinger  <cbiesinger@chromium.org>
+
+        Convert RenderFullScreen to use the non-deprecated flexbox
+        https://bugs.webkit.org/show_bug.cgi?id=107746
+
+        Reviewed by Ojan Vafai.
+
+        Tests: covered by existing tests in fullscreen/.
+
+        * rendering/RenderFullScreen.h:
+        * rendering/RenderFullScreen.cpp:
+        (RenderFullScreen::RenderFullScreen):
+        (RenderFullScreen::willBeDestroyed):
+        Inherit from RenderFlexibleBox
+
+        (createFullScreenStyle):
+        Use the new-style CSS properties (justify-content, etc)
+
+        * css/fullscreen.css:
+        (video:-webkit-full-screen, audio:-webkit-full-screen):
+        * css/fullscreenQuickTime.css:
+        (video:-webkit-full-screen::-webkit-media-controls-panel):
+        (video:-webkit-full-screen::-webkit-media-controls-seek-back-button):
+        (video:-webkit-full-screen::-webkit-media-controls-return-to-realtime-button):
+        (video:-webkit-full-screen::-webkit-media-controls-seek-forward-button):
+        * css/mediaControlsBlackBerryFullscreen.css:
+        (video:-webkit-full-screen::-webkit-media-controls-panel):
+        (video:-webkit-full-screen::-webkit-media-controls-button-group-container):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-time-display-container):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-play-button):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-timeline-container):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-current-time-display):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-time-remaining-display):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-timeline):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-fullscreen-button):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-button-divider):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-button-container, video:-webkit-full-screen::-webkit-media-controls-play-button-container):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-button-container):
+        (video:-webkit-full-screen::-webkit-media-controls-play-button-container):
+        (video:-webkit-full-screen::-webkit-media-controls-placeholder):
+        * css/mediaControlsQtFullscreen.css:
+        (video::-webkit-media-controls-panel):
+        (video::-webkit-media-controls-play-button):
+        Update fullscreen-related CSS to use the new flexbox
+
+2013-01-23  Jer Noble  <jer.noble@apple.com>
+
+        Mac: Video appears in wrong place during pinch operations
+        https://bugs.webkit.org/show_bug.cgi?id=107730
+
+        Reviewed by Eric Carlson.
+
+        Send the correct input and output rects, post translation and scaling,
+        to the CIContext for drawing.
+
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput):
+
+2013-01-24  Max Vujovic  <mvujovic@adobe.com>
+
+        [CSS Filters] CSS opacity property clips filter outsets
+        https://bugs.webkit.org/show_bug.cgi?id=106549
+
+        Reviewed by Dirk Schulze.
+
+        Expand the transparencyClipBox for filter outsets and pass the filter output rect instead of
+        the input rect to beginTransparencyLayers for clipping. Details below.
+
+        Test: css3/filters/css-opacity-with-drop-shadow.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore):
+        (WebCore::RenderLayer::setFilterBackendNeedsRepaintingInRect):
+            Replace filter outset calcuation with a call to expandRectForFilterOutsets.
+        (WebCore::expandRectForFilterOutsets):
+            New method to factor out repeated filter outset calculation code.
+        (WebCore::transparencyClipBox):
+            After expanding the clip rect for descendants and reflection, expand it for filter
+            outsets, so they don't get clipped when we begin a transparency layer.
+        (WebCore::RenderLayer::paintLayerContents):
+            Pass paintingInfo.paintDirtyRect instead of localPaintingInfo.paintDirtyRect to
+            beginTransparencyLayers for clipping. localPaintingInfo.paintDirtyRect (aka the filter
+            input rect) does not contain filter outsets, so they would get clipped. Now, we pass
+            paintingInfo.paintDirtyRect (the filter output rect), which includes the filter outsets.
+        (WebCore::RenderLayer::calculateLayerBounds):
+            Replace filter outset calcuation with a call to expandRectForFilterOutsets.
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+
+2013-01-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Fix a typo after r139838.
+
+        * dom/NodeRareData.h:
+        (NodeRareData):
+
+2013-01-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Abandoned Memory: SVGFontElement and Corresponding SVGDocument Never Deconstructed
+        https://bugs.webkit.org/show_bug.cgi?id=66438
+
+        Reviewed by Dirk Schulze.
+
+        The memory leak was caused by SVGFontFaceElement storing its own parent in a RefPtr.
+
+        Fixed the bug by storing a raw pointer instead, and clearing the pointer in removedFrom
+        when the node detached from the document. Also added several sanity check assertions.
+
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::SVGFontFaceElement):
+        (WebCore::SVGFontFaceElement::associatedFontElement):
+        (WebCore::SVGFontFaceElement::rebuildFontFace):
+        (WebCore::SVGFontFaceElement::insertedInto):
+        (WebCore::SVGFontFaceElement::removedFrom):
+        * svg/SVGFontFaceElement.h:
+        (SVGFontFaceElement):
+
+2013-01-22  Robert Hogan  <robert@webkit.org>
+
+        Inline Containing Only Collapsed Whitespace Not Getting a Linebox
+        https://bugs.webkit.org/show_bug.cgi?id=31397
+
+        Reviewed by David Hyatt.
+
+        Treat inlines containing only collapsed whitespace as empty. This allows them
+        to get a linebox.
+
+        Test: fast/inline/inline-containing-collapsed-whitespace-treated-as-empty.html
+
+        * dom/Position.cpp:
+        (WebCore::boundingBoxLogicalHeight):
+        (WebCore):
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        * rendering/InlineIterator.h:
+        (WebCore::isEmptyInline):
+        (WebCore):
+        (WebCore::bidiNextShared):
+        (WebCore::bidiFirstSkippingEmptyInlines):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::alwaysRequiresLineBox):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::LineBreaker::nextSegmentBreak):
+        * rendering/RenderText.cpp:
+        * rendering/RenderText.h:
+        (RenderText):
+
+2013-01-24  Andrey Lushnikov  <lushnikov@chromium.org>
+
+        Web Inspector: expand more chunks in DTE
+        https://bugs.webkit.org/show_bug.cgi?id=107698
+
+        Reviewed by Pavel Feldman.
+
+        Mock DefaultTextEditor visible area as if it is slightly larger than real one and
+        do all chunk expandings and repaints based on this new area.
+
+        No new tests: no change in behaviour.
+
+        * inspector/front-end/DefaultTextEditor.js:
+        (WebInspector.TextEditorChunkedPanel.prototype.findVisibleChunks):
+
+2013-01-24  Victor Jaquez  <vjaquez@igalia.com>
+
+        [GStreamer] Implement setPreservesPitch()
+        https://bugs.webkit.org/show_bug.cgi?id=31155
+
+        Enables audio pitch preservation by using the scaletempo GStreamer
+        element when required by the MediaPlayer.
+
+        Reviewed by Philippe Normand.
+
+        No new tests, but a layout test shall be implemented at some point
+        using WebAudio API.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::setPreservesPitch):
+        (WebCore):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+
+2013-01-24  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
+
+        Removing deleted files from WebCore/Target.pri after r140399.
+        https://bugs.webkit.org/show_bug.cgi?id=107815
+
+        Reviewed by Csaba Osztrogonác.
+
+        * Target.pri:
+
+2013-01-24  Martin Robinson  <mrobinson@igalia.com>
+
+        Try to fix the Qt Windows build
+
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::decodeNamedEntity): Use a reinterpret_cast to const QChar* like StringQt.cpp.
+
+2013-01-24  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [Canvas] REGRESSION: stack traces in the replay log are gone
+        https://bugs.webkit.org/show_bug.cgi?id=107805
+
+        Reviewed by Pavel Feldman.
+
+        The V8's Error.prepareStackTrace is now called from the Error.captureStackTrace
+        function instead of the "stack" getter function.
+
+        Test: inspector/profiler/canvas2d/canvas-stack-trace.html
+
+        * inspector/InjectedScriptCanvasModuleSource.js:
+        (.):
+
+2013-01-23  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [Canvas] UI: add a selector to capture a single canvas frame vs consecutive frames
+        https://bugs.webkit.org/show_bug.cgi?id=107688
+
+        Reviewed by Pavel Feldman.
+
+        Allow capturing several canvas frames in a row.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InjectedScriptCanvasModule.cpp:
+        (WebCore::InjectedScriptCanvasModule::traceLog):
+        * inspector/InjectedScriptCanvasModule.h:
+        (InjectedScriptCanvasModule):
+        * inspector/InjectedScriptCanvasModuleSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorCanvasAgent.cpp:
+        (WebCore::InspectorCanvasAgent::getTraceLog):
+        * inspector/InspectorCanvasAgent.h:
+        (InspectorCanvasAgent):
+        * inspector/front-end/CanvasProfileView.js:
+        (WebInspector.CanvasProfileView):
+        (WebInspector.CanvasProfileView.prototype._didReceiveTraceLog):
+        (WebInspector.CanvasProfileView.prototype._requestTraceLog):
+        (WebInspector.CanvasProfileType):
+        (WebInspector.CanvasProfileType.prototype.get statusBarItems):
+        (WebInspector.CanvasProfileType.prototype.get buttonTooltip):
+        (WebInspector.CanvasProfileType.prototype.buttonClicked):
+        (WebInspector.CanvasProfileType.prototype._runSingleFrameCapturing):
+        (WebInspector.CanvasProfileType.prototype._startFrameCapturing):
+        (WebInspector.CanvasProfileType.prototype._stopFrameCapturing.didStopCapturing):
+        (WebInspector.CanvasProfileType.prototype._stopFrameCapturing):
+        (WebInspector.CanvasProfileType.prototype._didStartCapturingFrame):
+        (WebInspector.CanvasProfileType.prototype.setRecordingProfile):
+        (WebInspector.CanvasProfileType.prototype._isSingleFrameMode):
+        (WebInspector.CanvasProfileHeader):
+        (WebInspector.CanvasProfileHeader.prototype._updateCapturingStatus):
+        (WebInspector.CanvasProfileHeader.prototype._requestCapturingStatus):
+        * inspector/front-end/ProfileLauncherView.js:
+        (WebInspector.ProfileLauncherView):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype._onProfileTypeSelected):
+        (WebInspector.ProfilesPanel.prototype._reset):
+        (WebInspector.ProfilesPanel.prototype._showLauncherView):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._resize):
+
+2013-01-24  Andreas Kling  <akling@apple.com>
+
+        Add CSSSelectorList::isValid().
+        <http://webkit.org/b/107809>
+
+        Reviewed by Antti Koivisto.
+
+        Add an isValid() method to CSSSelectorList and use that where applicable instead of checking
+        if first() is a null pointer.
+
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::setSelectorText):
+        * css/CSSSelectorList.cpp:
+        * css/CSSSelectorList.h:
+        (WebCore::CSSSelectorList::isValid):
+        (WebCore::CSSSelectorList::first):
+        (CSSSelectorList):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::setSelectorText):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::validateSelect):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::checkStyleRuleSelector):
+
+2013-01-24  Kai Koehne  <kai.koehne@digia.com>
+
+        [Qt] Webkit debug build links against release binaries of ANGLE libEGL, libGLESv2
+        https://bugs.webkit.org/show_bug.cgi?id=106217
+
+        Reviewed by Jocelyn Turcotte.
+
+        Use libEGLd, libEGLSv2d if qtbase was compiled with ANGLE.
+
+        * WebCore.pri: Mirror logic of qtbase\mkspecs\features\win32\opengl.prf
+
+2013-01-24  Sergio Villar Senin  <svillar@igalia.com>
+
+        [GTK] Unreviewed build fix.
+
+        Do not include the header file WebKitDOMPerformanceEntryList.h in
+        the build sources because we do not want the DOM bindings
+        generator to include it in webkitdomdefes.h twice.
+
+        * bindings/gobject/GNUmakefile.am:
+
+2013-01-24  Julien BRIANCEAU   <jbrianceau@nds.com>
+
+        Fix Qt build (KO since r140610), typo error for QString::fromUtf16 function.
+        https://bugs.webkit.org/show_bug.cgi?id=107803
+
+        Reviewed by Andreas Kling.
+
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::decodeNamedEntity):
+
+2013-01-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: breakpoints are not restored upon reload for scripts with script mapping.
+        https://bugs.webkit.org/show_bug.cgi?id=107799
+
+        The problem is that source mapping is set after UISourceCode gets into the workspace.
+        Breakpoint manager will now only restore breakpoints upon setting the source maps.
+
+        Reviewed by Alexander Pavlov.
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeAdded):
+        (WebInspector.BreakpointManager.prototype._uiSourceCodeMappingChanged):
+        * inspector/front-end/CompilerScriptMapping.js:
+        (WebInspector.CompilerScriptMapping.prototype.get addScript.get this):
+        (WebInspector.CompilerScriptMapping.prototype.get addScript):
+
+2013-01-24  Kent Tamura  <tkent@chromium.org>
+
+        Refactoring: Use AtomicString for an InputType::create argument
+        https://bugs.webkit.org/show_bug.cgi?id=107791
+
+        Reviewed by Kentaro Hara.
+
+        A string passed to InputType::create is a 'type' attribute value, which
+        is an AtomicString. Also, InputTypeFactoryMap is created with members of
+        InputTypeName, which are AtomicStrings. We had better use AtomicStrings
+        for them.
+
+        No new tests. This is just a refactoring.
+
+        * html/InputType.cpp:
+        Change the key type of InputTypeFactoryMap from String to AtomicString.
+        (WebCore::InputType::create):
+        Change an argument type from const String& to const AtomicString&.
+        * html/InputType.h:
+        (InputType): Ditto.
+
+2013-01-24  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Build fix.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::isDOMWrapper):
+
+2013-01-24  Andreas Kling  <akling@apple.com>
+
+        AX: Fix the debug build after r140658. (Constructor initializer order.)
+
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::AccessibilityNodeObject):
+
+2013-01-24  Hajime Morrita  <morrita@google.com>
+
+        There are a few of wrong removeAllChildren() call
+        https://bugs.webkit.org/show_bug.cgi?id=107790
+
+        Reviewed by Ryosuke Niwa.
+
+        removeAllChildren() is designed for trashing deleting children out.
+        It doesn't detach() children and could have possible leak.
+        This change replaces such removeAllChildren() usage with safer removeChildren().
+
+        No new tests. Covered by existing tests.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseAttribute):
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::setMessageDOMAndStartTimer):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTag):
+
+2013-01-24  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: should init an AXObject only after AXObjectCache has added it
+        https://bugs.webkit.org/show_bug.cgi?id=107533
+
+        Reviewed by Chris Fleizach.
+
+        Initialize each AXObject after the AXObjectCache has
+        finished adding it to its hash maps, so that it's
+        impossible for initialization of an AXObject to result in
+        exploring the tree and creating another AXObject instance
+        that points to the same renderer / node.
+
+        Test: accessibility/duplicate-axrenderobject-crash.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::create):
+        * accessibility/AccessibilityARIAGridCell.cpp:
+        (WebCore::AccessibilityARIAGridCell::create):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::create):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::create):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::create):
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::create):
+        (WebCore::AccessibilityMediaControlsContainer::create):
+        (WebCore::AccessibilityMediaTimeline::create):
+        (WebCore::AccessibilityMediaTimeDisplay::create):
+        * accessibility/AccessibilityMenuList.cpp:
+        (WebCore::AccessibilityMenuList::create):
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::create):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::init):
+        (AccessibilityObject):
+        * accessibility/AccessibilityProgressIndicator.cpp:
+        (WebCore::AccessibilityProgressIndicator::create):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::create):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+            assert that the object has been initialized
+        * accessibility/AccessibilitySVGRoot.cpp:
+        (WebCore::AccessibilitySVGRoot::create):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::create):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::create):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::create):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::create):
+
+2013-01-23  Kentaro Hara  <haraken@chromium.org>
+
+        Implement MouseEvent constructor
+        https://bugs.webkit.org/show_bug.cgi?id=107630
+
+        Reviewed by Adam Barth.
+
+        Spec: https://dvcs.w3.org/hg/d4e/raw-file/tip/source_respec.htm
+
+        The MouseEvent constructor should be implemented under a DOM4_EVENTS_CONSTRUCTOR flag.
+        This significantly simplifies JavaScript code to construct a MouseEvent.
+
+        Before:
+          event = document.createEvent("MouseEvents");
+          event.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
+
+        After:
+          event = new MouseEvent("click");
+
+        Test: fast/events/constructors/mouse-event-constructor.html
+
+        * bindings/scripts/CodeGenerator.pm:
+        (IsSubType):
+        (IsInheritExtendedAttribute):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateNamedConstructorCallback):
+        (GenerateImplementation):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore):
+        (WebCore::V8Float64Array::createWrapper):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore):
+        (WebCore::V8TestActiveDOMObject::createWrapper):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore):
+        (WebCore::V8TestCustomNamedGetter::createWrapper):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore):
+        (WebCore::V8TestEventConstructor::createWrapper):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore):
+        (WebCore::V8TestEventTarget::toEventTarget):
+        (WebCore::V8TestEventTarget::createWrapper):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (V8TestEventTarget):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore):
+        (WebCore::V8TestException::createWrapper):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore):
+        (WebCore::V8TestInterface::toActiveDOMObject):
+        (WebCore::V8TestInterface::createWrapper):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore):
+        (WebCore::V8TestMediaQueryListListener::createWrapper):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore):
+        (WebCore::V8TestNamedConstructor::toActiveDOMObject):
+        (WebCore::V8TestNamedConstructor::createWrapper):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore):
+        (WebCore::V8TestNode::toEventTarget):
+        (WebCore::V8TestNode::createWrapper):
+        * bindings/scripts/test/V8/V8TestNode.h:
+        (V8TestNode):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        (WebCore::V8TestObj::createWrapper):
+        * bindings/scripts/test/V8/V8TestOverloadedConstructors.cpp:
+        (WebCore):
+        (WebCore::V8TestOverloadedConstructors::createWrapper):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        (WebCore::V8TestSerializedScriptValueInterface::createWrapper):
+        * bindings/v8/Dictionary.cpp:
+        (WebCore::Dictionary::get):
+        (WebCore):
+        * bindings/v8/Dictionary.h:
+        (Dictionary):
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::isDOMWrapper):
+        (WebCore):
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WebCore::WrapperTypeInfo::toEventTarget):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore):
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEventInit::MouseEventInit):
+        (WebCore):
+        (WebCore::MouseEvent::create):
+        (WebCore::MouseEvent::MouseEvent):
+        * dom/MouseEvent.h:
+        (MouseEventInit):
+        (WebCore):
+        (MouseEvent):
+        (WebCore::MouseEvent::create):
+        (WebCore::MouseEvent::button):
+        (WebCore::MouseEvent::buttonDown):
+        (WebCore::MouseEvent::relatedTarget):
+        (WebCore::MouseEvent::setRelatedTarget):
+        (WebCore::MouseEvent::clipboard):
+        (WebCore::MouseEvent::dataTransfer):
+        * dom/MouseEvent.idl:
+
+2013-01-23  Kent Tamura  <tkent@chromium.org>
+
+        Add form-related instrumentations, and support 33+ features in FeatureObserver
+        https://bugs.webkit.org/show_bug.cgi?id=107770
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. This doesn't make behavior changes.
+
+        * page/FeatureObserver.h:
+        - Add form-related features.
+        - Add a Document* version of observe().
+        - Use BitVector to represent features to support 33+ features.
+        (WebCore::FeatureObserver::didObserve):
+        (FeatureObserver):
+        * page/FeatureObserver.cpp:
+        (WebCore::FeatureObserver::FeatureObserver):
+        (WebCore::FeatureObserver::~FeatureObserver):
+        (WebCore::FeatureObserver::observe):
+
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::create): Calls FeatureObserver::observe.
+        * html/DateInputType.cpp:
+        (WebCore::DateInputType::create): Ditto.
+        * html/DateTimeInputType.cpp:
+        (WebCore::DateTimeInputType::create): Ditto.
+        * html/DateTimeLocalInputType.cpp:
+        (WebCore::DateTimeLocalInputType::create): Ditto.
+        * html/EmailInputType.cpp:
+        (WebCore::EmailInputType::create): Ditto.
+        * html/HTMLDataListElement.cpp:
+        (WebCore::HTMLDataListElement::create): Ditto.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseAttribute): Ditto.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseAttribute): Ditto.
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::parseAttribute): Ditto.
+        * html/InputType.cpp:
+        (WebCore::InputType::create):
+        Record type=datetime and type=week even if these types are not enabled.
+        * html/MonthInputType.cpp:
+        (WebCore::MonthInputType::create): Calls FeatureObserver::observe.
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::create): Ditto.
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::create): Ditto.
+        * html/SearchInputType.cpp:
+        (WebCore::SearchInputType::create): Ditto.
+        * html/TelephoneInputType.cpp:
+        (WebCore::TelephoneInputType::create): Ditto.
+        * html/TimeInputType.cpp:
+        (WebCore::TimeInputType::create): Ditto.
+        * html/URLInputType.cpp:
+        (WebCore::URLInputType::create): Ditto.
+        * html/WeekInputType.cpp:
+        (WebCore::WeekInputType::create): Ditto.
+
+2013-01-23  Ken Kania  <kkania@chromium.org>
+
+        [Inspector] Add events for tracking page loads and scheduled navigations.
+        https://bugs.webkit.org/show_bug.cgi?id=104168
+
+        Reviewed by Pavel Feldman.
+
+        These events are needed for clients who need to be aware of when a page is
+        navigating or about to navigate. Some clients may wish to prevent interaction
+        with the page during this time. Two of the new events track loading start and
+        stop, as measured by the ProgressTracker. The other two events track when a
+        page has a new scheduled navigation and when it no longer has a scheduled
+        navigation. These latter two events won't allow the client to determine if
+        a load is going to happen in all circumstances, but is sufficient for many cases.
+        Make sure we hold a reference to the frame in NavigationScheduler::timerFired
+        in case the redirect causes the frame to be detached.
+
+        Also, minor update to InspectorInputAgent::dispatchMouseEvent to reorder params
+        to match dispatchKeyEvent.
+
+        Tests: inspector-protocol/page/frameScheduledNavigation.html
+               inspector-protocol/page/frameStartedLoading.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorInputAgent.cpp:
+        (WebCore::InspectorInputAgent::dispatchMouseEvent):
+        * inspector/InspectorInputAgent.h:
+        (InspectorInputAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::frameStartedLoadingImpl):
+        (WebCore::InspectorInstrumentation::frameStoppedLoadingImpl):
+        (WebCore::InspectorInstrumentation::frameScheduledNavigationImpl):
+        (WebCore::InspectorInstrumentation::frameClearedScheduledNavigationImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::frameStartedLoading):
+        (WebCore):
+        (WebCore::InspectorInstrumentation::frameStoppedLoading):
+        (WebCore::InspectorInstrumentation::frameScheduledNavigation):
+        (WebCore::InspectorInstrumentation::frameClearedScheduledNavigation):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::frameStartedLoading):
+        (WebCore):
+        (WebCore::InspectorPageAgent::frameStoppedLoading):
+        (WebCore::InspectorPageAgent::frameScheduledNavigation):
+        (WebCore::InspectorPageAgent::frameClearedScheduledNavigation):
+        * inspector/InspectorPageAgent.h:
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.PageDispatcher.prototype.frameDetached):
+        (WebInspector.PageDispatcher.prototype.frameStartedLoading):
+        (WebInspector.PageDispatcher.prototype.frameStoppedLoading):
+        (WebInspector.PageDispatcher.prototype.frameScheduledNavigation):
+        (WebInspector.PageDispatcher.prototype.frameClearedScheduledNavigation):
+        * loader/NavigationScheduler.cpp:
+        (WebCore::NavigationScheduler::clear):
+        (WebCore::NavigationScheduler::timerFired):
+        (WebCore::NavigationScheduler::startTimer):
+        (WebCore::NavigationScheduler::cancel):
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::progressStarted):
+        (WebCore::ProgressTracker::finalProgressComplete):
+
+2013-01-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Avoid creating background layers on pages with a fixed background, but no image
+        https://bugs.webkit.org/show_bug.cgi?id=107783
+        <rdar://problem/13074450>
+
+        Reviewed by Beth Dakin.
+        
+        http://www.nme.com has background-attachment: fixed on the <body>, but
+        not background image. In that case there's no point making a layer
+        for the fixed root background.
+
+        Test: platform/mac/tiled-drawing/fixed-background/fixed-background-no-image.html
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::allLayersAreFixed): Check to see if we have an image, as well
+        as fixed attachment.
+
+2013-01-23  Wei Jia  <wjia@chromium.org>
+
+        Enable autoplay when <video>'s src is from media stream
+        https://bugs.webkit.org/show_bug.cgi?id=105224
+
+        Reviewed by Eric Carlson.
+
+        Enable autoplay when <video>'s src is from media stream. This would avoid requesting multiple gestures when <video> is used for WebRTC.
+        The test is done by modifying platform/chromium/media/video-capture-preview.html.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+
+2013-01-23  Roger Fong  <roger_fong@apple.com>
+
+        Remove ForwardingHeaders/wtf from WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=107723
+
+        The folders are empty, nothings actually being copied over anymore from the ForwardingHeaders/wtf folder.
+
+        Reviewed by Benjamin Poulain.
+
+        * ForwardingHeaders/wtf: Removed.
+        * ForwardingHeaders/wtf/dtoa: Removed.
+        * ForwardingHeaders/wtf/text: Removed.
+        * ForwardingHeaders/wtf/unicode: Removed.
+        * ForwardingHeaders/wtf/unicode/icu: Removed.
+        * ForwardingHeaders/wtf/unicode/wince: Removed.
+        * ForwardingHeaders/wtf/url: Removed.
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+
+2013-01-23  Hayato Ito  <hayato@chromium.org>
+
+        Group parameters (firstRuleIndex and lastRuleIndex) into a parameter object, RuleRange.
+        https://bugs.webkit.org/show_bug.cgi?id=107095
+
+        Reviewed by Darin Adler.
+
+        This is a continued effort after r139817.
+
+        Factoring, no change in behavior.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRules):
+        (WebCore::StyleResolver::collectMatchingRulesForRegion):
+        (WebCore::StyleResolver::matchScopedAuthorRules):
+        (WebCore::StyleResolver::matchHostRules):
+        (WebCore::StyleResolver::matchAuthorRules):
+        (WebCore::StyleResolver::matchUserRules):
+        (WebCore::StyleResolver::matchUARules):
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        (WebCore::StyleResolver::styleSharingCandidateMatchesRuleSet):
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::RuleRange::RuleRange):
+        (RuleRange): Newly introduced to group parameters.
+        (StyleResolver):
+        (WebCore::StyleResolver::MatchRanges::UARuleRange):
+        (WebCore::StyleResolver::MatchRanges::authorRuleRange):
+        (WebCore::StyleResolver::MatchRanges::userRuleRange):
+
+2013-01-23  Luke Macpherson   <macpherson@chromium.org>
+
+        Support variables inside -webkit-box-reflect CSS property.
+        https://bugs.webkit.org/show_bug.cgi?id=106856
+
+        Reviewed by Tony Chang.
+
+        The primary change is to make the direction parameter a CSSPrimitiveValue style ident,
+        so that it can also be a variable reference.
+
+        Covered by existing LayoutTests/compositing/reflections/ tests.
+        Added Test: fast/css/variables/var-inside-box-reflect.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForReflection):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseReflect):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::operator CSSReflectionDirection):
+        (WebCore::CSSPrimitiveValue::convertToLength):
+        * css/CSSReflectValue.cpp:
+        (WebCore::CSSReflectValue::customCssText):
+        Use String addition operator instead of StringBuilder.
+        (WebCore):
+        (WebCore::CSSReflectValue::customSerializeResolvingVariables):
+        Use String addition operator instead of StringBuilder.
+        * css/CSSReflectValue.h:
+        (WebCore::CSSReflectValue::create):
+        (WebCore::CSSReflectValue::direction):
+        (CSSReflectValue):
+        (WebCore::CSSReflectValue::CSSReflectValue):
+        * css/CSSValue.cpp:
+        (WebCore::CSSValue::serializeResolvingVariables):
+        * css/StyleResolver.cpp:
+        (WebCore::hasVariableReference):
+        (WebCore::StyleResolver::applyProperty):
+
+2013-01-23  Abhishek Arya  <inferno@chromium.org>
+
+        Add ASSERT_WITH_SECURITY_IMPLICATION to detect bad casts in rendering
+        https://bugs.webkit.org/show_bug.cgi?id=107743
+
+        Reviewed by Eric Seidel.
+
+        * rendering/InlineFlowBox.h:
+        (WebCore::toInlineFlowBox):
+        * rendering/RenderBR.h:
+        (WebCore::toRenderBR):
+        * rendering/RenderBlock.h:
+        (WebCore::toRenderBlock):
+        * rendering/RenderBox.h:
+        (WebCore::toRenderBox):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::toRenderBoxModelObject):
+        * rendering/RenderButton.h:
+        (WebCore::toRenderButton):
+        * rendering/RenderCombineText.h:
+        (WebCore::toRenderCombineText):
+        * rendering/RenderCounter.h:
+        (WebCore::toRenderCounter):
+        * rendering/RenderDetailsMarker.h:
+        (WebCore::toRenderDetailsMarker):
+        * rendering/RenderEmbeddedObject.h:
+        (WebCore::toRenderEmbeddedObject):
+        * rendering/RenderFieldset.h:
+        (WebCore::toRenderFieldset):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::toRenderFileUploadControl):
+        * rendering/RenderFlowThread.h:
+        (WebCore::toRenderFlowThread):
+        * rendering/RenderFrame.h:
+        (WebCore::toRenderFrame):
+        * rendering/RenderFrameSet.h:
+        (WebCore::toRenderFrameSet):
+        * rendering/RenderFullScreen.h:
+        (WebCore::toRenderFullScreen):
+        * rendering/RenderIFrame.h:
+        (WebCore::toRenderIFrame):
+        * rendering/RenderImage.h:
+        (WebCore::toRenderImage):
+        * rendering/RenderInline.h:
+        (WebCore::toRenderInline):
+        * rendering/RenderLayerModelObject.h:
+        (WebCore::toRenderLayerModelObject):
+        * rendering/RenderListBox.h:
+        (WebCore::toRenderListBox):
+        * rendering/RenderListItem.h:
+        (WebCore::toRenderListItem):
+        * rendering/RenderListMarker.h:
+        (WebCore::toRenderListMarker):
+        * rendering/RenderMedia.h:
+        (WebCore::toRenderMedia):
+        * rendering/RenderMenuList.h:
+        (WebCore::toRenderMenuList):
+        * rendering/RenderMeter.h:
+        (WebCore::toRenderMeter):
+        * rendering/RenderMultiColumnBlock.h:
+        (WebCore::toRenderMultiColumnBlock):
+        * rendering/RenderMultiColumnSet.h:
+        (WebCore::toRenderMultiColumnSet):
+        * rendering/RenderNamedFlowThread.h:
+        (WebCore::toRenderNamedFlowThread):
+        * rendering/RenderPart.h:
+        (WebCore::toRenderPart):
+        * rendering/RenderProgress.h:
+        (WebCore::toRenderProgress):
+        * rendering/RenderQuote.h:
+        (WebCore::toRenderQuote):
+        * rendering/RenderRegion.h:
+        (WebCore::toRenderRegion):
+        * rendering/RenderRubyRun.h:
+        (WebCore::toRenderRubyRun):
+        * rendering/RenderScrollbarPart.h:
+        (WebCore::toRenderScrollbarPart):
+        * rendering/RenderSearchField.h:
+        (WebCore::toRenderSearchField):
+        * rendering/RenderSlider.h:
+        (WebCore::toRenderSlider):
+        * rendering/RenderSnapshottedPlugIn.h:
+        (WebCore::toRenderSnapshottedPlugIn):
+        * rendering/RenderTable.h:
+        (WebCore::toRenderTable):
+        * rendering/RenderTableCaption.h:
+        (WebCore::toRenderTableCaption):
+        * rendering/RenderTableCell.h:
+        (WebCore::toRenderTableCell):
+        * rendering/RenderTableCol.h:
+        (WebCore::toRenderTableCol):
+        * rendering/RenderTableRow.h:
+        (WebCore::toRenderTableRow):
+        * rendering/RenderTableSection.h:
+        (WebCore::toRenderTableSection):
+        * rendering/RenderText.h:
+        (WebCore::toRenderText):
+        * rendering/RenderTextControl.h:
+        (WebCore::toRenderTextControl):
+        * rendering/RenderTextControlMultiLine.h:
+        (WebCore::toRenderTextControlMultiLine):
+        * rendering/RenderTextControlSingleLine.h:
+        (WebCore::toRenderTextControlSingleLine):
+        * rendering/RenderVideo.h:
+        (WebCore::toRenderVideo):
+        * rendering/RenderView.h:
+        (WebCore::toRenderView):
+        * rendering/RenderWidget.h:
+        (WebCore::toRenderWidget):
+        * rendering/mathml/RenderMathMLBlock.h:
+        (WebCore::toRenderMathMLBlock):
+        * rendering/svg/RenderSVGContainer.h:
+        (WebCore::toRenderSVGContainer):
+        * rendering/svg/RenderSVGGradientStop.h:
+        (WebCore::toRenderSVGGradientStop):
+        * rendering/svg/RenderSVGImage.h:
+        (WebCore::toRenderSVGImage):
+        * rendering/svg/RenderSVGInlineText.h:
+        (WebCore::toRenderSVGInlineText):
+        * rendering/svg/RenderSVGRoot.h:
+        (WebCore::toRenderSVGRoot):
+        * rendering/svg/RenderSVGShape.h:
+        (WebCore::toRenderSVGShape):
+        * rendering/svg/RenderSVGText.h:
+        (WebCore::toRenderSVGText):
+
+2013-01-23  Elliott Sprehn  <esprehn@gmail.com>
+
+        Don't allocate rare data on every Element on removal
+        https://bugs.webkit.org/show_bug.cgi?id=107756
+
+        Reviewed by Eric Seidel.
+
+        We should not allocate an ElementRareData for every element
+        in Element::removedFrom. Previously calls to setIsInTopLayer
+        would unconditionally call ensureElementRareData(), and this was
+        called from Element::removedFrom meaning removing an element
+        made the entire subtree suddenly balloon to huge in size as each
+        one got an ElementRareData.
+
+        This is a regression from my patch on Bug 103912 where I removed a check
+        that avoided this allocation.
+
+        No new tests needed, covered by existing tests.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setIsInTopLayer):
+
+2013-01-23  Adam Barth  <abarth@webkit.org>
+
+        BackgroundHTMLParser should use more const references to avoid copy constructors
+        https://bugs.webkit.org/show_bug.cgi?id=107763
+
+        Reviewed by Tony Gentilcore.
+
+        I doubt this optimization is visible anywhere, but it's just a nit.
+
+        * html/parser/BackgroundHTMLParser.cpp:
+        (WebCore::BackgroundHTMLParser::BackgroundHTMLParser):
+        (WebCore::BackgroundHTMLParser::createPartial):
+        * html/parser/BackgroundHTMLParser.h:
+        (WebCore::BackgroundHTMLParser::create):
+        (BackgroundHTMLParser):
+
+2013-01-23  Abhishek Arya  <inferno@chromium.org>
+
+        Add support for ASSERT_WITH_SECURITY_IMPLICATION.
+        https://bugs.webkit.org/show_bug.cgi?id=107699
+
+        Reviewed by Eric Seidel.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::parserInsertBefore): Use ASSERT_WITH_SECURITY_IMPLICATION
+        for document confusion ASSERT(document() == newChild->document())
+        (WebCore::ContainerNode::parserAppendChild): same.
+
+2013-01-23  Ian Vollick  <vollick@chromium.org>
+
+        Unreviewed build fix.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rebuildZOrderLists):
+
+2013-01-23  Rafael Weinstein  <rafaelw@chromium.org>
+
+        Template element should parse in XHTML just as it does in HTML
+        https://bugs.webkit.org/show_bug.cgi?id=106491
+
+        Reviewed by Ryosuke Niwa.
+
+        https://dvcs.w3.org/hg/webcomponents/raw-file/f33622c39c5e/spec/templates/index.html#parsing-xhtml-documents.
+        https://dvcs.w3.org/hg/webcomponents/raw-file/f33622c39c5e/spec/templates/index.html#serializing-xhtml-documents.
+
+        This patch modifies the XML parser in two ways: (1) when nodes are created, their owner document is
+        the owner document of the current node, rather than the containing document, and (2) when an HTMLTemplateElement
+        is encountered, its content document fragment is pushed onto the stack, rather than the element itself, so that children
+        are appended to the template content. Also, because XSLT operates on the serialized input document, transforms consider
+        template contents to be descendants.
+
+        Tests: fast/dom/HTMLTemplateElement/xhtml-parsing-and-serialization.xml
+               fast/xpath/xpath-template-element.html
+               fast/xsl/xslt-processor-template.html
+               fast/xsl/xslt-xhtml-template.xml
+
+        * xml/parser/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::enterText):
+        * xml/parser/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::startElementNs):
+        (WebCore::XMLDocumentParser::processingInstruction):
+        (WebCore::XMLDocumentParser::cdataBlock):
+        (WebCore::XMLDocumentParser::comment):
+
+2013-01-23  Tony Gentilcore  <tonyg@chromium.org>
+
+        Teach threaded HTML parser to update InspectorInstrumentation when writing HTML
+        https://bugs.webkit.org/show_bug.cgi?id=107755
+
+        Reviewed by Eric Seidel.
+
+        The current length is unused, so it doesn't cause any noticeable behavior difference to not pass it here.
+
+        No new tests because covered by existing tests.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::processTokensFromBackgroundParser):
+
+2013-01-23  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Make an Isolate parameter mandatory in NativeToJS()
+        https://bugs.webkit.org/show_bug.cgi?id=107663
+
+        Reviewed by Adam Barth.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateCallbackImplementation):
+        (NativeToJSValue):
+        * bindings/scripts/test/V8/V8TestCallback.cpp:
+        (WebCore::V8TestCallback::callbackWithClass1Param):
+        (WebCore::V8TestCallback::callbackWithClass2Param):
+        (WebCore::V8TestCallback::callbackWithStringList):
+        (WebCore::V8TestCallback::callbackWithBoolean):
+        (WebCore::V8TestCallback::callbackRequiresThisToPass):
+
+2013-01-23  Stephanie Lewis  <slewis@apple.com>
+
+        Add ordering for WebCore __DATA.
+        https://bugs.webkit.org/show_bug.cgi?id=107765
+        <rdar://problem/13019603>
+
+        Rubber stamped by Oliver Hunt.
+
+        No Change in functionality.
+
+        * WebCore.order:
+
+2013-01-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        RenderProgress does not repaint on value change
+        https://bugs.webkit.org/show_bug.cgi?id=106977
+
+        Reviewed by Joseph Pecoraro.
+
+        No test because the ouput depends on the code of RenderTheme, and
+        we use the platform theme for testing.
+
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::updateFromElement):
+        (WebCore::RenderProgress::updateAnimationState):
+        Previously, repaint() was only called on two occasions:
+        -On animationTimerFired().
+        -In response to updateFromElement() if and only if the RenderTheme start/stop an
+         animation previously stopped/running.
+
+        When changing the value of HTMLProgressElement, no repaint was called until
+        the next timer fired for the animation.
+        This is a problem if:
+        -The animation of RenderTheme is slow.
+        -If there is no animation (the element is never updated in that case).
+
+2013-01-23  Ian Vollick  <vollick@chromium.org>
+
+        Introduce the "stacking container" concept.
+        https://bugs.webkit.org/show_bug.cgi?id=107734
+
+        Reviewed by Simon Fraser.
+
+        A stacking container is treated just like a stacking context. That
+        is, it has z-order lists, it and its descendants are stacked as a
+        unit, and when the RenderLayerCompositor does its overlap testing,
+        the composited regions for all layer lists take effect only once the
+        stacking container is done being processed.
+
+        This patch also adds the function RenderLayer::isStackingContainer().
+        Currently, this is equivalent to RenderLayer::isStackingContext(),
+        but in future, the definition of stacking container will be broadened
+        to encompass more than just stacking contexts.
+
+        Other than the addition of this extra function, the patch is mostly
+        comprised of name changes. Any code that used to refer to the
+        stacking context concept, but didn't necessarily require a stacking
+        context in the strict, CSS-sense, was switched to refer to stacking
+        container. No functionality was changed.
+
+        No new tests, no change in functionality.
+
+        * inspector/InspectorLayerTreeAgent.cpp:
+        (WebCore::InspectorLayerTreeAgent::buildObjectForLayer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore):
+        (WebCore::RenderLayer::updatePagination):
+        (WebCore::RenderLayer::canBeStackingContainer):
+        (WebCore::RenderLayer::setHasVisibleContent):
+        (WebCore::RenderLayer::dirty3DTransformedDescendantStatus):
+        (WebCore::RenderLayer::stackingContainer):
+        (WebCore::compositingContainer):
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::RenderLayer::addChild):
+        (WebCore::RenderLayer::removeChild):
+        (WebCore::RenderLayer::updateNeedsCompositedScrolling):
+        (WebCore::RenderLayer::updateCompositingLayersAfterScroll):
+        (WebCore::RenderLayer::paintPaginatedChildLayer):
+        (WebCore::RenderLayer::hitTestPaginatedChildLayer):
+        (WebCore::RenderLayer::calculateLayerBounds):
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        (WebCore::RenderLayer::dirtyStackingContainerZOrderLists):
+        (WebCore::RenderLayer::collectLayers):
+        (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded):
+        (WebCore::RenderLayer::updateStackingContextsAfterStyleChange):
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+        (WebCore::RenderLayer::isStackingContainer):
+        (WebCore::RenderLayer::posZOrderList):
+        (WebCore::RenderLayer::negZOrderList):
+        (WebCore::RenderLayer::isDirtyStackingContainer):
+        (WebCore::RenderLayer::clearZOrderLists):
+        (WebCore::RenderLayer::updateZOrderLists):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::compositingOpacity):
+        (WebCore::RenderLayerBacking::hasVisibleNonCompositingDescendantLayers):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::enclosingNonStackingClippingLayer):
+        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
+        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+        (WebCore::isRootmostFixedOrStickyLayer):
+
+2013-01-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Have scrollperf logging log information about wheel event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=107761
+        <rdar://problem/12281015>
+
+        Reviewed by Tim Horton.
+
+        Log when the wheel event handler count of a ScrollingTreeScrollingNodeMac changes.
+
+        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeScrollingNodeMac::update):
+        (WebCore::logWheelEventHandlerCountChanged):
+
+2013-01-23  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Add an optional Isolate parameter to GetTemplate() and GetRawTemplate()
+        https://bugs.webkit.org/show_bug.cgi?id=107679
+
+        Reviewed by Adam Barth.
+
+        It is important to pass an Isolate to GetTemplate() and GetRawTemplate().
+        To proceed the work incrementally, this patch adds an optional Isolate parameter
+        to GetTemplate() and GetRawTemplate(). Once all call sites are updated, the
+        Isolate parameter will be made mandatory.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateNamedConstructorCallback):
+        (GenerateImplementation):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::V8Float64Array::GetRawTemplate):
+        (WebCore::V8Float64Array::GetTemplate):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (V8Float64Array):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::GetRawTemplate):
+        (WebCore::V8TestActiveDOMObject::GetTemplate):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (V8TestActiveDOMObject):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore::V8TestCustomNamedGetter::GetRawTemplate):
+        (WebCore::V8TestCustomNamedGetter::GetTemplate):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (V8TestCustomNamedGetter):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::GetRawTemplate):
+        (WebCore::V8TestEventConstructor::GetTemplate):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (V8TestEventConstructor):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::V8TestEventTarget::GetRawTemplate):
+        (WebCore::V8TestEventTarget::GetTemplate):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (V8TestEventTarget):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore::V8TestException::GetRawTemplate):
+        (WebCore::V8TestException::GetTemplate):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (V8TestException):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::GetRawTemplate):
+        (WebCore::V8TestInterface::GetTemplate):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (V8TestInterface):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::GetRawTemplate):
+        (WebCore::V8TestMediaQueryListListener::GetTemplate):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (V8TestMediaQueryListListener):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructor::GetTemplate):
+        (WebCore::V8TestNamedConstructor::GetRawTemplate):
+        (WebCore::V8TestNamedConstructor::GetTemplate):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (V8TestNamedConstructorConstructor):
+        (V8TestNamedConstructor):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::GetRawTemplate):
+        (WebCore::V8TestNode::GetTemplate):
+        * bindings/scripts/test/V8/V8TestNode.h:
+        (V8TestNode):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::GetRawTemplate):
+        (WebCore::V8TestObj::GetTemplate):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+        * bindings/scripts/test/V8/V8TestOverloadedConstructors.cpp:
+        (WebCore::V8TestOverloadedConstructors::GetRawTemplate):
+        (WebCore::V8TestOverloadedConstructors::GetTemplate):
+        * bindings/scripts/test/V8/V8TestOverloadedConstructors.h:
+        (V8TestOverloadedConstructors):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::GetRawTemplate):
+        (WebCore::V8TestSerializedScriptValueInterface::GetTemplate):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (V8TestSerializedScriptValueInterface):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WebCore::WrapperTypeInfo::getTemplate):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.h:
+        (V8HTMLImageElementConstructor):
+
+2013-01-23  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move V8DOMWrapper::getEventListener() to V8EventListerList
+        https://bugs.webkit.org/show_bug.cgi?id=107683
+
+        Reviewed by Adam Barth.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrSetter):
+        (GenerateEventListenerCallback):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::TestEventTargetV8Internal::addEventListenerCallback):
+        (WebCore::TestEventTargetV8Internal::removeEventListenerCallback):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::addEventListenerCallback):
+        (WebCore::TestObjV8Internal::removeEventListenerCallback):
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::getEventListener):
+        (WebCore):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore):
+        (V8EventListenerList):
+        (WebCore::V8EventListenerList::findWrapper):
+        (WebCore::V8EventListenerList::clearWrapper):
+        (WebCore::V8EventListenerList::doFindWrapper):
+        (WebCore::V8EventListenerList::getHiddenProperty):
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::addEventListenerCallback):
+        (WebCore::V8DOMWindow::removeEventListenerCallback):
+
+2013-01-23  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: AXObjectCache should be initialized with topDocument
+        https://bugs.webkit.org/show_bug.cgi?id=107638
+
+        Reviewed by Chris Fleizach.
+
+        Initialize AXObjectCache with the top document, not the
+        document that axObjectCache happened to be called on, which
+        could be an iframe. Having an AXObjectCache with the wrong
+        document could cause a heap-use-after-free in
+        notificationPostTimerFired if the inner document was deleted
+        while notifications were pending.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+
+2012-12-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION: WebKit does not render selection in non-first ruby text nodes.
+        https://bugs.webkit.org/show_bug.cgi?id=92818
+
+        Reviewed by Levi Weintraub.
+
+        The patch is based on the one submitted by Sukolsak Sakshuwong.
+
+        The bug was caused by the fact isSelectionRoot was returning false on RenderRubyRun even though
+        it doesn't lay down its children in block direction.
+
+        The selection painting code assumes that all blocks in each selection root are laid down in
+        the containing block direction. In particular, InlineTextBox::paintSelection calls
+        RootInlineBox::selectionTopAdjustedForPrecedingBlock in order to determine the end of the previous
+        line, which in turn calls blockBeforeWithinSelectionRoot. blockBeforeWithinSelectionRoot goes
+        through block nodes that appears before "this" block, and selectionTopAdjustedForPrecedingBlock
+        assumes that to compute the end of the previous line.
+
+        Now suppose we have markup such as <ruby>Ichi<rt>One</rt></ruby><ruby>Ni<rt>Two</rt></ruby>. When
+        selectionTopAdjustedForPrecedingBlock is called on the line box generated for "Two", it tries to
+        determine the bottom of the inline box above that of "Two", which blockBeforeWithinSelectionRoot
+        determines to be that of "One". At this point, everything goes wrong and the selection height is
+        computed to be 0.
+
+        The fix to this problem is to allow RenderRubyRun to be a selection root. Since RenderRubyRun is
+        already an inline-block, it suffices to bypass the !nonPseudoNode() check. In fact, there is no
+        need to check this condition anymore as far as I can tell. The check was added in
+        http://trac.webkit.org/changeset/12986 but all tests added by this change set as well as the rest
+        of layout tests pass without this condition.
+
+        Test: fast/ruby/select-ruby.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::isSelectionRoot):
+
+2013-01-23  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Reduce usage of deprecatedV8String() and deprecatedV8Integer()
+        https://bugs.webkit.org/show_bug.cgi?id=107674
+
+        Reviewed by Adam Barth.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_Enumerate):
+        * bindings/v8/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::addListener):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::disableEval):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::removeBreakpoint):
+        (WebCore::ScriptDebugServer::setScriptSource):
+        (WebCore::ScriptDebugServer::ensureDebuggerScriptCompiled):
+        (WebCore::ScriptDebugServer::compileScript):
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptCallArgumentHandler::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::start):
+        (WebCore::ScriptProfiler::stop):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initializeIfNeeded):
+        (WebCore::V8DOMWindowShell::namedItemAdded):
+        (WebCore::V8DOMWindowShell::namedItemRemoved):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8MutationCallback.cpp:
+        (WebCore::V8MutationCallback::handleEvent):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::addListener):
+        * bindings/v8/custom/V8InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::createInjectedScript):
+
+2013-01-23  Martin Robinson  <mrobinson@igalia.com>
+
+        WebKit should support decoding multi-byte entities in XML content
+        https://bugs.webkit.org/show_bug.cgi?id=107459
+
+        Reviewed by Adam Barth.
+
+        Test: fast/parser/entities-in-xhtml.xhtml
+
+        * html/parser/HTMLEntityParser.cpp:
+        (WebCore::appendUChar32ToUCharArray): Added this helper function. Later patches
+        may try to move this code to somewhere that it can be shared more easily.
+        (WebCore::decodeNamedEntityToUCharArray): Modify this function to work on a UChar
+        array four elements long, so that multi-byte and multi-character entities can be resolved.
+        * html/parser/HTMLEntityParser.h: Updated function declaratoin.
+        * xml/parser/XMLDocumentParserLibxml2.cpp:
+        (WebCore): Modify the statically allocated entity string memory area to accommodate
+        up to two UTF-8 characters. Each UTF-8 character can be 4 bytes, so this brings the
+        total size to 9 bytes.
+        (WebCore::getXHTMLEntity): Use the new entity decoding API.
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::EntityResolver::resolveUndeclaredEntity): Ditto.
+        (WebCore::XMLDocumentParser::parse): Ditto.
+
+2013-01-23  Eric Seidel  <eric@webkit.org>
+
+        Stop the background-parser during HTMLDocumentParser::detatch to prevent crashes/asserts
+        https://bugs.webkit.org/show_bug.cgi?id=107751
+
+        Reviewed by Tony Gentilcore.
+
+        This appears to fix the 2 intermitent crashers we were seeing while
+        running fast/parser.  And definitely fixes 8 ASSERTs seen using a Debug build.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::detach):
+
+2013-01-23  Hans Muller  <hmuller@adobe.com>
+
+        [CSS Exclusions] Add support for computing first included interval position for polygons
+        https://bugs.webkit.org/show_bug.cgi?id=103429
+
+        Reviewed by Dirk Schulze.
+
+        Added support for computing the "first fit" location, i.e. the logical shape-inside
+        location where a line's layout begins. The algorithm for doing so is described here:
+        http://hansmuller-webkit.blogspot.com/2012/08/revised-algorithm-for-finding-first.html.
+
+        Tests: fast/exclusions/shape-inside/shape-inside-first-fit-001.html
+               fast/exclusions/shape-inside/shape-inside-first-fit-002.html
+               fast/exclusions/shape-inside/shape-inside-first-fit-003.html
+
+        * platform/graphics/FloatSize.h:
+        (WebCore::operator*): Scale a FloatSize. This simplified the final expression in VertexPair::intersection().
+        * rendering/ExclusionPolygon.cpp:
+        (WebCore::isPointOnLineSegment): Returns true if the specified point is collinear and within the line segement's bounds.
+        (WebCore::leftSide): Return a value > 0 if point is on the left side of the line segment, < 0 if it's on the right, 0 if it's collinear.
+        (WebCore::ExclusionPolygon::contains): Return true if the point is within the polygon or on an edge.
+        (WebCore::VertexPair::overlapsRect): Returns true if the line segment from vertex1 to vertex2 overlaps the specified FloatRect.
+        (WebCore::VertexPair::intersection): Finds the intersection of a pair of line segments defined by VertexPairs.
+        (WebCore::ExclusionPolygon::firstFitRectInPolygon): Returns true if none of the polygon's edges, except the two used
+            to define by the offset edges, overlap the FloatRect.
+        (WebCore::aboveOrToTheLeft): Defines the top/left preference for "first fit" locations.
+        (WebCore::ExclusionPolygon::firstIncludedIntervalLogicalTop): Replaced the stub implementation of this method.
+        * rendering/ExclusionPolygon.h:
+        (ExclusionPolygon): Added declarations noted above.
+        (VertexPair): Abstract class that defines a pair of FloatPoints.
+        (OffsetPolygonEdge): Represents an edge that's horizontally offset from a polygon edge.
+        (WebCore::OffsetPolygonEdge::edgeIndex): The ExclusionPolygon edge index used to define this OffsetEdge.
+
+2013-01-23  Dirk Schulze  <dschulze@adobe.com>
+
+        Implement Canvas Path object
+        https://bugs.webkit.org/show_bug.cgi?id=97333
+
+        Reviewed by Dean Jackson.
+
+        The Canvas part of the WHATWG specification defines a Path object. This Path object
+        shares several path segment functions (path methods) with the CanvasRenderingContext2D
+        interface. This patch introduces the Path object and shares the path segment functions
+        in the class CanvasPathMethods.
+        This patch does just implement the basic path functions that have a general agreement on
+        the WHAT WG and W3C mailing lists.
+        This feature is behind a flag and won't be activated by default.
+
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#path-objects
+
+        Test: fast/canvas/canvas-path-object.html
+
+        * CMakeLists.txt: Add DOMPath and CanvasPathMedthods to build system.
+        * DerivedSources.cpp: Ditto.
+        * DerivedSources.make: Ditto.
+        * DerivedSources.pri: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * html/canvas/CanvasPathMethods.cpp: Added.
+        (WebCore): This class shares the path segment functions (moveTo, lineTo, ...) between
+            DOMPath (the Path object) and CanvasRenderingContext2D.
+        (WebCore::CanvasPathMethods::closePath):
+        (WebCore::CanvasPathMethods::moveTo):
+        (WebCore::CanvasPathMethods::lineTo):
+        (WebCore::CanvasPathMethods::quadraticCurveTo):
+        (WebCore::CanvasPathMethods::bezierCurveTo):
+        (WebCore::CanvasPathMethods::arcTo):
+        (WebCore::CanvasPathMethods::arc):
+        (WebCore::CanvasPathMethods::rect):
+        * html/canvas/CanvasPathMethods.h: Added.
+        (WebCore):
+        (CanvasPathMethods):
+        (WebCore::CanvasPathMethods::~CanvasPathMethods):
+        (WebCore::CanvasPathMethods::transformIsInvertible):
+        (WebCore::CanvasPathMethods::CanvasPathMethods):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h: Remove the path segment functions here.
+        (CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::transformIsInvertible): This checks if the CTM
+            of the context is still invertible. Drawing should stop if it is not.
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/DOMPath.h: Added.
+        (WebCore):
+        (DOMPath):
+        (WebCore::DOMPath::create):
+        (WebCore::DOMPath::~DOMPath):
+        (WebCore::DOMPath::DOMPath):
+        * html/canvas/DOMPath.idl: Added.
+        * page/DOMWindow.idl: Added CTOR for Path.
+
+2013-01-23  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove IDBVersionChangeRequest
+        https://bugs.webkit.org/show_bug.cgi?id=107711
+
+        Reviewed by Tony Chang.
+
+        When the setVersion() API was removed from the Indexed DB spec the IDBVersionChangeRequest
+        interface was replaced with IDBOpenDBRequest. We switched over for open(), this completes
+        the work by switching over for deleteDatabase() and removing the old code. (On the Event
+        side we still need to combine IDBVersionChangeEvent and IDBUpgradeNeededEvent.)
+
+        Test: storage/indexeddb/intversion-long-queue.html
+              storage/indexeddb/intversion-upgrades.html
+
+        * CMakeLists.txt: Remove references to deleted code.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * Modules/indexeddb/IDBCallbacks.h: Remove unused onBlocked() overload.
+        * Modules/indexeddb/IDBDatabase.cpp: Remove references to deleted code.
+        * Modules/indexeddb/IDBDatabase.h: Ditto.
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::deleteDatabase): Fire onBlocked with current version.
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::openInternal): Don't need to specify source.
+        (WebCore::IDBFactory::deleteDatabase): Use an IDBOpenDBRequest.
+        * Modules/indexeddb/IDBFactory.h: Change return type of deleteDatabase()
+        * Modules/indexeddb/IDBFactory.idl: Ditto.
+        * Modules/indexeddb/IDBOpenDBRequest.cpp:
+        (WebCore::IDBOpenDBRequest::create): Always use a null source.
+        (WebCore::IDBOpenDBRequest::IDBOpenDBRequest): Pass null source to base class.
+        (WebCore::IDBOpenDBRequest::dispatchEvent): Don't assume result is a database in existing
+        special case.
+        * Modules/indexeddb/IDBOpenDBRequest.h: Don't need a source argument (always null).
+        * Modules/indexeddb/IDBVersionChangeRequest.cpp: Removed.
+        * Modules/indexeddb/IDBVersionChangeRequest.h: Removed.
+        * Modules/indexeddb/IDBVersionChangeRequest.idl: Removed.
+        * WebCore.gypi: Remove references to deleted code.
+        * WebCore.xcodeproj/project.pbxproj: Remove references to deleted code.
+        * dom/EventTarget.h: Remove references to deleted code.
+        * dom/EventTargetFactory.in: Ditto.
+
+2013-01-23  Scott Graham  <scottmg@chromium.org>
+
+        [Chromium] Fix inclusion of pch .cpp in webcore_platform and webcore_rendering
+        https://bugs.webkit.org/show_bug.cgi?id=107700
+
+        Reviewed by Dirk Pranke.
+
+        No new tests, Chromium should link on VS 2012.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2013-01-23  Jun Jiang  <jun.a.jiang@intel.com>
+
+        Avoid unnecessary format conversion for tex{Sub}Image2D() for ImageData of WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=107532
+
+        Reviewed by Kenneth Russell.
+
+        This patch removes the unnecessary format conversion in tex{Sub}Image2D() for ImageData in WebGL to improve performance.
+
+        Already covered by current tests.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+
+2013-01-23  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Should update compositing state when an out-of-view fixed position element becomes in-view
+        https://bugs.webkit.org/show_bug.cgi?id=107410
+
+        Reviewed by Simon Fraser.
+
+        When a non-compositing page contains some not-composited fixed position element because of bounds out-of-view, when the element changes position and RenderLayerCompositor::updateCompositingLayers() is called, the function may return early because of "if (!m_reevaluateCompositingAfterLayout && !m_compositing)" without updating the compositing layers.
+
+        Set m_reevaluateCompositingAfterLayout when a fixed position element is not composited because of bounds out-of-view.
+
+        Test: compositing/layer-creation/fixed-position-change-out-of-view-in-view.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
+
+2013-01-23  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, set svn:eol-style to CRLF on Windows .sln files.
+
+        * WebCore.vcproj/WebCore.sln: Modified property svn:eol-style.
+        * WebCore.vcproj/WebCore.submit.sln: Modified property svn:eol-style.
+
+2013-01-23  Adam Barth  <abarth@webkit.org>
+
+        BackgroundHTMLParser::sendTokensToMainThread should use bind
+        https://bugs.webkit.org/show_bug.cgi?id=107637
+
+        Reviewed by Eric Seidel.
+
+        This patch replaces our hand-written implementation of bind for
+        didReceiveTokensFromBackgroundParser with bind from Functional.h. To
+        use the generic version of bind, we need to switch to using WeakPtr to
+        hold a reference to the main thread parser in the BackgroundHTMLParser.
+
+        * html/parser/BackgroundHTMLParser.cpp:
+        (WebCore::BackgroundHTMLParser::BackgroundHTMLParser):
+        (WebCore::BackgroundHTMLParser::sendTokensToMainThread):
+        (WebCore::BackgroundHTMLParser::createPartial):
+        * html/parser/BackgroundHTMLParser.h:
+        (WebCore::BackgroundHTMLParser::create):
+        (BackgroundHTMLParser):
+        (ParserMap):
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::HTMLDocumentParser):
+        (WebCore::HTMLDocumentParser::startBackgroundParser):
+        (WebCore::HTMLDocumentParser::stopBackgroundParser):
+        * html/parser/HTMLDocumentParser.h:
+        (HTMLDocumentParser):
+
+2013-01-23  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Cleanup VS2010 WebCore project. 
+        Lots of files that no longer exist in solution.
+
+        * WebCore.vcxproj/WebCore.vcxproj:
+        * WebCore.vcxproj/WebCore.vcxproj.filters:
+
+2013-01-23  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        [CSS Grid Layout] Add support for max-content
+        https://bugs.webkit.org/show_bug.cgi?id=107604
+
+        Reviewed by Tony Chang.
+
+        Tests: fast/css-grid-layout/minmax-max-content-resolution-columns.html
+               fast/css-grid-layout/minmax-max-content-resolution-rows.html
+
+        This change implements max-content on top of the infrastructure introduced as part
+        of implementing min-content (bug 106474). No effort was made to share code, which
+        is what was done for min-content. The sharing will occur in follow-up refactoring(s)
+        to benefit from the extra testing but also the extra code to make the direction more
+        obvious.
+
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::maxContentForChild):
+        Added this helper, similar to minContentForChild.
+
+        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
+        Patched the function to handle max-content per the specification's algorithm.
+
+        * rendering/RenderGrid.h:
+        Added maxContentForChild.
+
+2013-01-23  Mark Lam  <mark.lam@apple.com>
+
+        Assert that Supplementable objects is only used in their creator thread.
+        https://bugs.webkit.org/show_bug.cgi?id=107717.
+
+        Reviewed by Adam Barth.
+
+        No new tests.
+
+        * platform/Supplementable.h:
+        (WebCore):
+        (WebCore::Supplementable::provideSupplement):
+        (WebCore::Supplementable::removeSupplement):
+        (WebCore::Supplementable::requireSupplement):
+        (Supplementable):
+        (WebCore::Supplementable::Supplementable):
+
+2013-01-23  Tony Chang  <tony@chromium.org>
+
+        Incorrect scrollable height during simplified layout
+        https://bugs.webkit.org/show_bug.cgi?id=107193
+
+        Reviewed by David Hyatt.
+
+        When computing overflow we need the height of the block before
+        it was clamped (i.e., before updateLogicalHeight() has been called).
+
+        During simplified layout, we don't have this information and we were
+        using the clamped height by mistake. To fix this, we now store the
+        pre-clamped height on RenderOverflow so we can properly compute
+        overflow.
+
+        Test: fast/overflow/height-during-simplified-layout.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeOverflow): Save the height if we have overflow.
+        (WebCore::RenderBlock::simplifiedLayout): If we have overflow, use the height that we saved
+        in computeOverflow.
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::layoutClientAfterEdge):
+        (WebCore::RenderOverflow::setLayoutClientAfterEdge):
+        (RenderOverflow): Add a member variable to save the height.
+
+2013-01-23  Tom Sepez  <tsepez@chromium.org>
+
+        [chromium] harden ScriptWrappable::m_wrapper against tampering
+        https://bugs.webkit.org/show_bug.cgi?id=107318
+
+        Reviewed by Adam Barth.
+
+        Patch is correct if existing tests past without crashing.
+
+        * bindings/v8/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::ScriptWrappable):
+        (WebCore::ScriptWrappable::wrapper):
+        (WebCore::ScriptWrappable::setWrapper):
+        (WebCore::ScriptWrappable::clearWrapper):
+        (WebCore::ScriptWrappable::disposeWrapper):
+        (WebCore::ScriptWrappable::reportMemoryUsage):
+        (ScriptWrappable):
+        (WebCore::ScriptWrappable::maskOrUnmaskPointer):
+
+2013-01-22  Roger Fong  <roger_fong@apple.com>
+
+        WebCore property sheets, modified build scripts, and project files for compiling in VS2010.
+        https://bugs.webkit.org/show_bug.cgi?id=106988
+
+        Reviewed by Brent Fulgham.
+
+        * WebCore.vcproj/WebCore.sln:
+        * WebCore.vcxproj: Added.
+        * WebCore.vcxproj/MigrateScripts: Added.
+        * WebCore.vcxproj/QTMovieWin: Added.
+        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj: Added.
+        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj.filters: Added.
+        * WebCore.vcxproj/QTMovieWin/QTMovieWin.vcxproj.user: Added.
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinCommon.props: Added.
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinDebug.props: Added.
+        * WebCore.vcxproj/QTMovieWin/QTMovieWinRelease.props: Added.
+        * WebCore.vcxproj/WebCore.vcxproj: Added.
+        * WebCore.vcxproj/WebCore.vcxproj.filters: Added.
+        * WebCore.vcxproj/WebCore.vcxproj.user: Added.
+        * WebCore.vcxproj/WebCoreCFNetwork.props: Added.
+        * WebCore.vcxproj/WebCoreCG.props: Added.
+        * WebCore.vcxproj/WebCoreCommon.props: Added.
+        * WebCore.vcxproj/WebCoreDebug.props: Added.
+        * WebCore.vcxproj/WebCoreGenerated.make: Added.
+        * WebCore.vcxproj/WebCoreGenerated.vcxproj: Added.
+        * WebCore.vcxproj/WebCoreGenerated.vcxproj.filters: Added.
+        * WebCore.vcxproj/WebCoreGenerated.vcxproj.user: Added.
+        * WebCore.vcxproj/WebCoreGeneratedCommon.props: Added.
+        * WebCore.vcxproj/WebCoreGeneratedDebug.props: Added.
+        * WebCore.vcxproj/WebCoreGeneratedRelease.props: Added.
+        * WebCore.vcxproj/WebCoreMediaQT.props: Added.
+        * WebCore.vcxproj/WebCorePostBuild.cmd: Added.
+        * WebCore.vcxproj/WebCorePreBuild.cmd: Added.
+        * WebCore.vcxproj/WebCorePreLink.cmd: Added.
+        * WebCore.vcxproj/WebCorePthreads.props: Added.
+        * WebCore.vcxproj/WebCoreQuartzCore.props: Added.
+        * WebCore.vcxproj/WebCoreRelease.props: Added.
+        * WebCore.vcxproj/build-generated-files.sh: Added.
+        * WebCore.vcxproj/copyForwardingHeaders.cmd: Added.
+        * WebCore.vcxproj/copyWebCoreResourceFiles.cmd: Added.
+        * WebCore.vcxproj/migrate-scripts.sh: Added.
+        * WebCore.vcxproj/xcopy.excludes: Added.
+        * WebCorePrefix.h:
+        * config.h:
+
+2013-01-23  Eric Seidel  <eric@webkit.org>
+
+        HTMLCompactToken needs to include the forceQuirks bool from HTMLToken
+        https://bugs.webkit.org/show_bug.cgi?id=107713
+
+        Reviewed by Tony Gentilcore.
+
+        Before we were only getting "quirks mode" when the system/public identifiers
+        were known quirks identifiers.  Now we'll correctly get quirks mode for any
+        parse error during DOCTYPE parsing.
+        This passes a bunch more tests.
+
+        * html/parser/CompactHTMLToken.cpp:
+        (WebCore::CompactHTMLToken::CompactHTMLToken):
+        * html/parser/CompactHTMLToken.h:
+        (WebCore::CompactHTMLToken::doctypeForcesQuirks):
+        (CompactHTMLToken):
+        * html/parser/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+
+2013-01-23  Brady Eidson  <beidson@apple.com>
+
+        Recursion handling cancelled authentication challenges in NetworkProcess
+        <rdar://problem/13024541> and https://bugs.webkit.org/show_bug.cgi?id=107702
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCore.exp.in:
+
+2013-01-23  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=107628
+        Sometimes scroll position is jerky during rubber-band, affects nytimes.com
+        -and corresponding-
+        <rdar://problem/12679549>
+
+        Reviewed by Simon Fraser.
+
+        The basic problem here is that isRubberBandInProgress() was only implemented for 
+        main thread scrolling. So when we were actually scrolling on the scrolling thread, 
+        that function would always return false regardless.
+
+        New ScrollableArea virtual function isRubberBandInProgress() will allow us to ask 
+        the ScrollingCoordinator when the scrolling thread is scrolling, or the 
+        ScrollAnimator otherwise.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::isRubberBandInProgress):
+        * page/FrameView.h:
+        (FrameView):
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::isRubberBandInProgress):
+
+        New ScrollingCoordinator function isRubberBandInProgress() always returns false 
+        for non-Mac ports, and is overridden in ScrollingCoordinatorMac to consult the 
+        ScrollingTree.
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore::ScrollingCoordinator::isRubberBandInProgress):
+        * page/scrolling/mac/ScrollingCoordinatorMac.h:
+        (ScrollingCoordinatorMac):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinatorMac::isRubberBandInProgress):
+
+        New variable m_mainFrameIsRubberBanding keeps track of whether there is currently 
+        a rubber-band happening on the scrolling thread.
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::ScrollingTree):
+        (WebCore::ScrollingTree::isRubberBandInProgress):
+        (WebCore::ScrollingTree::setMainFrameIsRubberBanding):
+        * page/scrolling/ScrollingTree.h:
+        (ScrollingTree):
+        (WebCore::ScrollingTree::rootNode):
+
+        Call setMainFrameIsRubberBanding() whenever the stretchAmount is calculated and 
+        whenever we stop the rubber-band timer.
+        * page/scrolling/mac/ScrollingTreeScrollingNodeMac.mm:
+        (WebCore::ScrollingTreeScrollingNodeMac::stretchAmount):
+        (WebCore::ScrollingTreeScrollingNodeMac::stopSnapRubberbandTimer):
+
+        Consult FrameView for isRubberBandInProgress().
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2013-01-23  Robert Hogan  <robert@webkit.org>
+
+        Abspos Inline block not positioned correctly in text-aligned container
+        https://bugs.webkit.org/show_bug.cgi?id=105695
+
+        Reviewed by Ojan Vafai.
+
+        Inline positioned elements should still obey the text-alignment of their container
+        even when we don't do a line layout.
+
+        Test: fast/text/container-align-with-inlines.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::updateStaticInlinePositionForChild):
+        (WebCore):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::setStaticPositions):
+
+2013-01-23  Eric Seidel  <eric@webkit.org>
+
+        Remove DocType support from MarkupTokenBase now that NEW_XML is gone
+        https://bugs.webkit.org/show_bug.cgi?id=107709
+
+        Reviewed by Adam Barth.
+
+        Just moving code out of MarkupTokenBase and into HTMLToken.
+        The test for this change is if it compiles. :)  Which it does.
+
+        * html/parser/HTMLToken.h:
+        (DoctypeData):
+        (WebCore::DoctypeData::DoctypeData):
+        (WebCore):
+        (WebCore::HTMLToken::appendToName):
+        (WebCore::HTMLToken::name):
+        (HTMLToken):
+        (WebCore::HTMLToken::beginDOCTYPE):
+        (WebCore::HTMLToken::publicIdentifier):
+        (WebCore::HTMLToken::systemIdentifier):
+        (WebCore::HTMLToken::setPublicIdentifierToEmptyString):
+        (WebCore::HTMLToken::setSystemIdentifierToEmptyString):
+        (WebCore::HTMLToken::appendToPublicIdentifier):
+        (WebCore::HTMLToken::appendToSystemIdentifier):
+        (WebCore::HTMLToken::releaseDoctypeData):
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+        (AtomicHTMLToken):
+        * html/parser/HTMLTokenTypes.h:
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore):
+        (MarkupTokenBase):
+
+2013-01-23  Alexis Menard  <alexis@webkit.org>
+
+        transition-property accepts incorrect "all, none" as value
+        https://bugs.webkit.org/show_bug.cgi?id=105428
+
+        Reviewed by Dean Jackson.
+
+        http://www.w3.org/TR/css3-transitions/#transition-property-property
+        disallows any value like none, all or all, none as it doesn't make
+        sense. This patch fixes the problem by rejecting the value if set by
+        the user.
+
+        Test: transitions/transitions-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationProperty):
+        * css/CSSParser.h:
+
+2013-01-23  Eric Seidel  <eric@webkit.org>
+
+        Clarify some usage of shouldUseThreading vs m_haveBackgroundParser, fixing about:blank parsing
+        https://bugs.webkit.org/show_bug.cgi?id=107664
+
+        Reviewed by Adam Barth.
+
+        The HTMLDocumentParser can be "supposed" to use a background parser
+        but not end up ever doing so for blank documents.  It's important
+        that we spin the forground parser at least once, so we end up
+        actually creating the about:blank document.
+
+        shouldUseThreading() means that threading is enabled and we should use it if we can.
+        m_haveBackgroundParser means that we actually are already using threading.
+        When we add full document.write support this will get a bit trickier still as
+        we'll need to be using both the foreground and background parsers.
+
+        This fixes about 20 tests in fast/frames and many others outside of fast/frames. :)
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::prepareToStopParsing):
+        (WebCore::HTMLDocumentParser::resumeParsingAfterYield):
+        (WebCore::HTMLDocumentParser::finish):
+        (WebCore::HTMLDocumentParser::lineNumber):
+        (WebCore::HTMLDocumentParser::textPosition):
+
+2013-01-17  Roger Fong  <roger_fong@apple.com>
+
+        [Win] Remove dependence on Microsoft Embedded OpenType Font Engine (T2EMBED.DLL)  from FontCustomPlatformData.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=107153
+
+        Reviewed by Dan Bernstein.
+
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore):
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+
+2013-01-23  Andrey Lushnikov  <lushnikov@chromium.org>
+
+        Web Inspector: speedup highlight regex API in DefaultTextEditor
+        https://bugs.webkit.org/show_bug.cgi?id=107238
+
+        Reviewed by Pavel Feldman.
+
+        Move overlay highlight measurement (highlight regex API) from DefaultTextEditor._paintLine
+        method to the DefaultTextEditor._paintLines method which allows to relayout dom only
+        once. This is a significant improvement to the current state of the
+        art which does relayout on each regex occurence.
+        In addition, use "left" css attribute instead of "margin-left": this
+        way it will be possible to avoid an unnecessary relayouting during
+        appending overlay highlight.
+
+        No new tests: no change in behaviour.
+
+        * inspector/front-end/DefaultTextEditor.js:
+        (WebInspector.TextEditorMainPanel.prototype.markAndRevealRange):
+        (WebInspector.TextEditorMainPanel.prototype._paintLines):
+        (WebInspector.TextEditorMainPanel.prototype._measureRegexHighlight):
+        (WebInspector.TextEditorMainPanel.prototype._measureSpans):
+        (WebInspector.TextEditorMainPanel.prototype._appendOverlayHighlight):
+        (WebInspector.TextEditorMainPanel.prototype._paintLine):
+        (WebInspector.TextEditorMainPanel.ElementMetrics):
+        (WebInspector.TextEditorMainPanel.LineOverlayHighlight):
+        (WebInspector.TextEditorMainChunk.prototype.expand):
+
+2013-01-23  Ojan Vafai  <ojan@chromium.org>
+
+        Assert that computePreferredLogicalWidths never calls setNeedsLayout
+        https://bugs.webkit.org/show_bug.cgi?id=107613
+
+        Reviewed by Eric Seidel.
+
+        computePreferredLogicalWidths should only set m_minPreferredLogicalWidth
+        and m_maxPreferredLogicalWidth. It shouldn't have other side-effects.
+        The mathml bits can be removed once https://bugs.webkit.org/show_bug.cgi?id=107353
+        is resolved.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::minPreferredLogicalWidth):
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::computePreferredLogicalWidths):
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::computePreferredLogicalWidths):
+
 2013-01-23  Noam Rosenthal  <noam@webkit.org>
 
         REGRESSION(r140518): Broke Chromium Win build (gyp file not updated) (Requested by arv on #webkit).