Merge 99067 - REGRESSION(r96870): WebKit generates background: transparent on blogger.com

Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 99392)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,3 +1,8886 @@
+2011-11-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r96870): WebKit generates background: transparent on blogger.com
+        https://bugs.webkit.org/show_bug.cgi?id=71203
+
+        Reviewed by Ojan Vafai.
+
+        Remove the transparent background color from inline style declarations in the pasted content.
+        Also fixed a bug in removeStyleFromRulesAndContext that it removes properties in inline style
+        declarations even if those properties were overridden.
+
+        Tests: editing/deleting/merge-paragraphs-with-transparent-background.html
+               editing/deleting/paste-with-transparent-background-color.html
+
+        * editing/EditingStyle.cpp:
+        (WebCore::removePropertiesInStyle):
+        (WebCore::EditingStyle::removeStyleFromRulesAndContext):
+        (WebCore::EditingStyle::removePropertiesInElementDefaultStyle):
+
+2011-11-02  Andreas Kling  <kling@webkit.org>
+
+        CSSStyleRule: Devirtualize selectorText()
+        https://bugs.webkit.org/show_bug.cgi?id=71364
+
+        Reviewed by Antti Koivisto.
+
+        Have CSSStyleRule::selectorText() redirect to CSSPageRule::pageSelectorText()
+        if type() is PAGE_RULE.
+
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::pageSelectorText):
+        * css/CSSPageRule.h:
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::selectorText):
+        * css/CSSStyleRule.h:
+
+2011-11-02  Andreas Kling  <kling@webkit.org>
+
+        CSSRule: Devirtualize cssText()
+        https://bugs.webkit.org/show_bug.cgi?id=71292
+
+        Reviewed by Antti Koivisto.
+
+        Have CSSRule::cssText() redirect to the appropriate subclass based on type().
+        This is one of the last steps of devirtualizing CSSRule completely, which will
+        allow us to get rid of its vtable, and each instance's pointer thereto.
+
+        * css/CSSCharsetRule.h:
+        * css/CSSFontFaceRule.h:
+        * css/CSSImportRule.h:
+        * css/CSSMediaRule.h:
+        * css/CSSRegionStyleRule.h:
+        * css/CSSRule.cpp:
+        (WebCore::CSSRule::cssText):
+        * css/CSSRule.h:
+        * css/CSSStyleRule.h:
+        * css/WebKitCSSKeyframeRule.h:
+        * css/WebKitCSSKeyframesRule.h:
+
+2011-11-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for !ENABLE(FILTERS) after r98989.
+
+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::clientLayoutChanged):
+
+2011-11-02  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [REGRESSION] Clicking in a CSS property/value being edited commits the editor
+        https://bugs.webkit.org/show_bug.cgi?id=71360
+
+        Reviewed by Pavel Feldman.
+
+        Selecting a selected TreeElement should be an idempotent operation.
+
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.prototype.select):
+
+2011-11-02  Ben Wells  <benwells@chromium.org>
+
+        Canvas filling paths or rects need to be invalidate larger rects for some compositing modes.
+        https://bugs.webkit.org/show_bug.cgi?id=70379
+
+        Reviewed by James Robinson.
+
+        Test: fast/canvas/canvas-composite-fill-repaint.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::fill):
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::didDrawEntireCanvas):
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2011-11-01  Levi Weintraub  <leviw@chromium.org>
+
+        Fix uses of LayoutUnit in Frame-, Scroll-, and RenderView
+        https://bugs.webkit.org/show_bug.cgi?id=71321
+
+        Reviewed by Darin Adler.
+
+        Updating the usage of LayoutUnits in the *View classes to mirror the proper use
+        as derived in the subpixellayout branch.
+
+        This entails scrolling only with integers (and rounding once we've made the switch)
+        and using integers for window coordinates, with LayoutUnits for content coordinates.
+
+        No new tests -- no change in behavior.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::invalidateRect):
+        (WebCore::FrameView::setFrameRect):
+        (WebCore::FrameView::zoomAnimatorTransformChanged):
+        (WebCore::FrameView::scrollContentsFastPath):
+        (WebCore::FrameView::scrollContentsSlowPath):
+        (WebCore::FrameView::scrollElementToRect):
+        (WebCore::FrameView::setScrollPosition):
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::scrollTo):
+        (WebCore::FrameView::updateScrollCorner):
+        * page/FrameView.h:
+        (WebCore::FrameView::trackedRepaintRects):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+        (WebCore::ScrollView::layoutWidth):
+        (WebCore::ScrollView::layoutHeight):
+        (WebCore::ScrollView::fixedLayoutSize):
+        (WebCore::ScrollView::setFixedLayoutSize):
+        (WebCore::ScrollView::contentsSize):
+        (WebCore::ScrollView::setContentsSize):
+        (WebCore::ScrollView::overhangAmount):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::rectToCopyOnScroll):
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::windowToContents):
+        (WebCore::ScrollView::screenToContents):
+        (WebCore::ScrollView::scrollbarAtPoint):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::visibleWidth):
+        (WebCore::ScrollView::visibleHeight):
+        (WebCore::ScrollView::contentsWidth):
+        (WebCore::ScrollView::contentsHeight):
+        (WebCore::ScrollView::adjustScrollPositionWithinRange):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paint):
+        (WebCore::RenderView::shouldRepaint):
+        (WebCore::RenderView::repaintViewRectangle):
+        (WebCore::RenderView::repaintRectangleInViewAndCompositedLayers):
+        (WebCore::RenderView::computeRectForRepaint):
+        (WebCore::RenderView::selectionBounds):
+        (WebCore::RenderView::viewRect):
+        (WebCore::RenderView::unscaledDocumentRect):
+        (WebCore::RenderView::documentRect):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::printRect):
+        (WebCore::RenderView::setPrintRect):
+
+2011-11-01  Anna Cavender  <annacc@chromium.org>
+
+        Small fixes for WebVTTParser.
+        https://bugs.webkit.org/show_bug.cgi?id=71334
+
+        Reviewed by Darin Adler.
+
+        No new tests.  This is needed to enable other tests, coming soon.
+
+        * html/track/WebVTTParser.cpp:
+        (WebCore::hasLongWebVTTIdentifier): changed to return true when header is
+            exactly "WEBVTT"
+        (WebCore::WebVTTParser::collectTimingsAndSettings): fix typos, position should
+            only progress once when checking the character after a timestamp.
+
+2011-11-01  Darin Adler  <darin@apple.com>
+
+        Change HTMLSelectElement::setSelectedIndex to use enums instead of bools
+        https://bugs.webkit.org/show_bug.cgi?id=70184
+
+        Reviewed by Kent Tamura.
+
+        Refactoring that does not require new tests.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Replaced setSelectedIndexByUser
+        call with a call to the renamed optionSelectedByUser, also removed one argument.
+        (-[DOMHTMLSelectElement _activateItemAtIndex:allowMultipleSelection:]): Ditto.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setSelected): Replaced setSelectedIndex call with a
+        call to the new optionSelectionStateChanged function.
+        (WebCore::HTMLOptionElement::insertedIntoTree): Ditto.
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement): Updated since m_userDrivenChange
+        was renamed to m_isProcessingUserDrivenChange.
+        (WebCore::HTMLSelectElement::optionSelectedByUser): Removed deselect argument,
+        which was always true for all callers. Updated comment.
+        (WebCore::HTMLSelectElement::hasPlaceholderLabelOption): Updated comment.
+        (WebCore::HTMLSelectElement::setOption): Call the new optionSelectionStateChanged
+        function. The code used to explicitly ask the function it calls to deselect base
+        on the value of m_multiple, but that is no longer needed because the selectOption
+        function itself takes care of that check.
+        (WebCore::HTMLSelectElement::dispatchChangeEventForMenuList): Renamed this function.
+        Also updated for name change to m_isProcessingUserDrivenChange.
+        (WebCore::HTMLSelectElement::setSelectedIndex): Moved the formerly-inlined function
+        here from the header and changed it to call the renamed selectOption function.
+        (WebCore::HTMLSelectElement::optionSelectionStateChanged): Added this function.
+        It is used by callers that were previously using setSelectedIndex and passing
+        "false" for the deselect argument. It's better now that setSelectedIndex is now a
+        pure DOM setter function without the multiple purposes it had before. This function
+        now has the logic that handles the special handling when deselecting an option,
+        which used to be at the top of the next function.
+        (WebCore::HTMLSelectElement::selectOption): Renamed this from setSelectedIndex.
+        Replaced boolean arguments with flags. Removed code to handle the special case
+        when we deselect an option; that's now handled in the optionSelectionStateChanged
+        function. Added an assertion to replace a comment and updated for other renaming.
+        (WebCore::HTMLSelectElement::dispatchBlurEvent): Updated for name change.
+        (WebCore::HTMLSelectElement::platformHandleKeydownEvent): Ditto.
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler): Changed to call the
+        new selectOption function and also updated for other name changes.
+        (WebCore::HTMLSelectElement::typeAheadFind): Ditto.
+        (WebCore::HTMLSelectElement::accessKeySetSelectedIndex): Ditto.
+
+        * html/HTMLSelectElement.h: Changed the setSelectedIndex to be a pure setter
+        function for the selectedIndex DOM property. Added a optionSelectedByUser function
+        for the other use of setSelectedIndex, but removed the always true "deselect"
+        argument from it. Added a optionSelectionStateChanged function for use in the
+        HTMLOptionElement implementation. Renamed menuListOnChange to
+        dispatchChangeEventForMenuList for clarity. Added a SelectOptionFlag and
+        SelectOptionFlags type for the arguments to the selectOption function, formerly
+        implemented as an overload of setSelectedIndex (and called setSelectedIndexInternal
+        before that). Renamed m_userDrivenChange to m_isProcessingUserDrivenChange.
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::valueChanged): Replaced setSelectedIndexByUser
+        call with a call to the renamed optionSelectedByUser, also removed one argument.
+
+2011-11-01  Sam Weinig  <sam@webkit.org>
+
+        Implement __lookupGetter__/__lookupSetter__ in terms of getPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=71336
+
+        Reviewed by Darin Adler.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * page/DOMWindow.idl:
+        Remove overrides of lookupGetter/lookupSetter, which are no longer needed
+        due to implementing getPropertyDescriptor.
+
+
+2011-11-01  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Move resource-releasing logic into CCProxy and cleanup setNeedsCommit
+        https://bugs.webkit.org/show_bug.cgi?id=71269
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setZoomAnimatorTransform):
+        (WebCore::CCLayerTreeHost::setNeedsCommit):
+        (WebCore::CCLayerTreeHost::setViewport):
+        (WebCore::CCLayerTreeHost::setVisible):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCProxy.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::doCommit):
+        (WebCore::CCSingleThreadProxy::setNeedsRedraw):
+        (WebCore::CCSingleThreadProxy::setVisible):
+        (WebCore::CCSingleThreadProxy::recreateContextIfNeeded):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (WebCore::CCSingleThreadProxy::setNeedsRedrawOnImplThread):
+        (WebCore::CCSingleThreadProxy::setNeedsCommitOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::setNeedsCommit):
+        (WebCore::CCThreadProxy::setNeedsAnimateOnImplThread):
+        (WebCore::CCThreadProxy::setVisible):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2011-11-01  Anna Cavender  <annacc@chromium.org>
+
+        Makes [Reflect] work for constants.
+        This is needed to avoid platform-specific define conflicts, specifically
+        TextTrack::ERROR conflicts with a windows define.
+        https://bugs.webkit.org/show_bug.cgi?id=70951
+
+        Reviewed by Darin Adler.
+
+        Test: media/track/track-constants.html
+
+        * bindings/scripts/CodeGenerator.pm:
+        (GenerateCompileTimeCheckForEnumsIfNeeded):
+            Check for [Reflect] and assign name accordingly.
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:  Update test file.
+        * bindings/scripts/test/JS/JSTestObj.cpp:  Update test file.
+        (WebCore::jsTestObjCONST_JAVASCRIPT):
+        * bindings/scripts/test/JS/JSTestObj.h:  Update test file.
+        * bindings/scripts/test/ObjC/DOMTestObj.h:  Update test file.
+        * bindings/scripts/test/TestObj.idl:  Update test file.
+        * bindings/scripts/test/V8/V8TestObj.cpp:  Update test file.
+
+        * html/LoadableTextTrack.cpp: Use new DOM const name.
+        (WebCore::LoadableTextTrack::cueLoadingStarted):
+        (WebCore::LoadableTextTrack::cueLoadingCompleted):
+        * html/TextTrack.cpp:  Use new DOM const name.
+        (WebCore::TextTrack::TextTrack):
+        (WebCore::TextTrack::setMode):
+        * html/TextTrack.h:  Use new DOM const name.
+        * html/TextTrack.idl:  Use Reflect for ERROR, but leave other DOM const names.
+
+2011-11-01  Levi Weintraub  <leviw@chromium.org>
+
+        Amend missing uses of LayoutUnit in RenderBlock
+        https://bugs.webkit.org/show_bug.cgi?id=71254
+
+        Reviewed by Darin Adler.
+
+        Switching relevant uses of integers in RenderBlock to LayoutUnits.
+
+        No new tests -- no changes in behavior.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::adjustFloatingBlock):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::paintContents):
+        (WebCore::clipOutPositionedObjects):
+        (WebCore::RenderBlock::removeFloatingObject):
+        (WebCore::RenderBlock::nextFloatLogicalBottomBelow):
+        (WebCore::RenderBlock::getClearDelta):
+        (WebCore::positionForPointRespectingEditingBoundaries):
+        (WebCore::RenderBlock::calcColumnWidth):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::RenderBlock::adjustRectForColumns):
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::setPaginationStrut):
+        (WebCore::RenderBlock::applyBeforeBreak):
+        (WebCore::RenderBlock::applyAfterBreak):
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::availableLogicalWidthForLine):
+        (WebCore::RenderBlock::paginationStrut):
+        (WebCore::RenderBlock::availableLogicalWidthForContent):
+        (WebCore::RenderBlock::FloatWithRect::FloatWithRect):
+        (WebCore::RenderBlock::MarginInfo::setPositiveMargin):
+        (WebCore::RenderBlock::MarginInfo::setNegativeMargin):
+        (WebCore::RenderBlock::MarginInfo::setPositiveMarginIfLarger):
+        (WebCore::RenderBlock::MarginInfo::setNegativeMarginIfLarger):
+        (WebCore::RenderBlock::MarginInfo::setMargin):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::FloatIntervalSearchAdapter):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::lowValue):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::highValue):
+        (WebCore::RenderBlock::RenderBlockRareData::positiveMarginBeforeDefault):
+        (WebCore::RenderBlock::RenderBlockRareData::negativeMarginBeforeDefault):
+        (WebCore::RenderBlock::RenderBlockRareData::positiveMarginAfterDefault):
+        (WebCore::RenderBlock::RenderBlockRareData::negativeMarginAfterDefault):
+
+2011-11-01  Luke Macpherson   <macpherson@chromium.org>
+
+        WIP: Add CSS property to control printing of backgrounds for individual elements.
+        https://bugs.webkit.org/show_bug.cgi?id=64583
+
+        Reviewed by Eric Seidel.
+
+        Added test LayoutTests/fast/css/webkit-color-adjust.html,
+        Updated tests under LayoutTests/fast/css/getComputedStyle
+        Updated test under LayoutTests/svg/css
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForDocument):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialForceBackgroundsToWhite):
+
+2011-11-01  Dominic Cooney  <dominicc@chromium.org>
+
+        Remove initErrorEvent method
+        https://bugs.webkit.org/show_bug.cgi?id=71338
+
+        Reviewed by Ojan Vafai.
+
+        * dom/ErrorEvent.cpp: Crush.
+        * dom/ErrorEvent.h: Kill.
+        * dom/ErrorEvent.idl: Destroy.
+
+2011-11-01  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Pack RenderTableCell bits
+        https://bugs.webkit.org/show_bug.cgi?id=71135
+
+        Reviewed by Darin Adler.
+
+        Tested by RenderTableCellTest unit test.
+        (unfortunately Chromium specific...)
+
+        This saves another 8 bytes on RenderTableCell on x86-64.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::RenderTableCell):
+        * rendering/RenderTableCell.h:
+        Changed the field order to use more strict packing.
+
+        (WebCore::RenderTableCell::setCol):
+        (WebCore::RenderTableCell::setRow):
+        Added overflow checks to the 2 previous methods. We
+        CRASH even in release to avoid potential badness
+        (the limit is currently above 2 billions rows or columns
+        which is high enough to prevent it being hit by accident)
+
+2011-11-01  Emil A Eklund  <eae@chromium.org>
+
+        Switch background/border image back to Int
+        https://bugs.webkit.org/show_bug.cgi?id=71240
+
+        Reviewed by Darin Adler.
+
+        Switch background- and border-image rendering back to int to align with
+        device pixels.
+
+        No new tests.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions):
+        (WebCore::RenderBoxModelObject::calculateFillTileSize):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::useFixedAttachment):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::clip):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::relativePhase):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        (WebCore::calculateAdjustedInnerBorder):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::destOrigin):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setDestOrigin):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::destRect):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setDestRect):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::phase):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setPhase):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::tileSize):
+        (WebCore::RenderBoxModelObject::BackgroundImageGeometry::setTileSize):
+
+2011-11-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::defineSetter
+        https://bugs.webkit.org/show_bug.cgi?id=71303
+
+        Reviewed by Darin Adler.
+
+        No new tests.
+
+        Added defineSetter to the MethodTable, changed all the virtual 
+        implementations of defineSetter to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineSetter):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::defineSetter):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+
+2011-11-01  Emil A Eklund  <eae@chromium.org>
+
+        Switch PopupMenuClient to layout abstraction
+        https://bugs.webkit.org/show_bug.cgi?id=71308
+
+        Reviewed by Darin Adler.
+
+        Switch PopupMenuClient and rendering classes implementing it to layout
+        type abstraction.
+
+        No new tests.
+
+        * platform/PopupMenuClient.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::listIndexAtOffset):
+        (WebCore::RenderListBox::panScroll):
+        (WebCore::RenderListBox::scrollToward):
+        (WebCore::RenderListBox::scrollSize):
+        (WebCore::RenderListBox::scrollPosition):
+        (WebCore::RenderListBox::setScrollOffset):
+        (WebCore::RenderListBox::verticalScrollbarWidth):
+        Revert scroll positions and scroll offsets to ints to align with device
+        pixels.
+        
+        * rendering/RenderListBox.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::showPopup):
+        (WebCore::RenderMenuList::clientPaddingLeft):
+        (WebCore::RenderMenuList::clientPaddingRight):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::hitInnerTextElement):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
+        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
+        * rendering/RenderTextControlSingleLine.h:
+
+2011-11-01  Nate Chapin  <japhet@chromium.org>
+
+        [chromium] As of r98380, ThreadableLoaderClients are having their
+        ResourceRequest::TargetType clobbered. They set their own
+        type, but CachedResourceRequest (through which they now flow)
+        sets a TargetType without bothering to see if one has already been set.
+        https://bugs.webkit.org/show_bug.cgi?id=70972
+
+        Reviewed by Darin Fisher.
+
+        No new tests, this is chromium-specific and only affects
+        behavior seen in full builds of chromium.
+
+        * loader/cache/CachedResourceRequest.cpp:
+        (WebCore::CachedResourceRequest::load):Don't setTargetType()
+            if the value is something other than the default already.
+        * platform/network/chromium/ResourceRequest.h: Change default
+            TargetType to TargetIsUnspecified.
+
+2011-11-01  Emil A Eklund  <eae@chromium.org>
+
+        Use IntPoint for screen coordinates in MouseEvent
+        https://bugs.webkit.org/show_bug.cgi?id=71327
+
+        Reviewed by Darin Adler.
+
+        Change mouse events to use int/IntPoint for screen/window coordinates and
+        LayoutUnit/LayoutPoint for coordinates adjusted for zooming.
+
+        No new tests.
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::MouseRelatedEvent):
+        (WebCore::MouseRelatedEvent::computeRelativePosition):
+        * dom/MouseRelatedEvent.h:
+        (WebCore::MouseRelatedEvent::screenLocation):
+        Revert screenLocation and windowLocation back to int.
+
+        * page/DragController.cpp:
+        (WebCore::elementUnderMouse):
+        Change elementUnderMouse to use a LayoutPoint for hit testing.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::currentMousePosition):
+        (WebCore::documentPointForWindowPoint):
+        (WebCore::EventHandler::fakeMouseMoveEventTimerFired):
+        * page/EventHandler.h:
+        Revert m_currentMousePosition to IntPoint as it represents a
+        screen coordinate.
+
+        * platform/PlatformMouseEvent.h:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        (WebCore::PlatformMouseEvent::pos):
+        (WebCore::PlatformMouseEvent::x):
+        (WebCore::PlatformMouseEvent::y):
+        (WebCore::PlatformMouseEvent::globalX):
+        (WebCore::PlatformMouseEvent::globalY):
+        * platform/mac/PlatformMouseEventMac.mm:
+        (WebCore::globalPoint):
+        (WebCore::pointForEvent):
+        (WebCore::globalPointForEvent):
+        Revert PlatformMouseEvent to int/IntPoint as it represents a screen
+        coordinate.
+
+2011-11-01  Tony Chang  <tony@chromium.org>
+
+        REGRESSION: -webkit-flex() should be an invalid value
+        https://bugs.webkit.org/show_bug.cgi?id=71320
+
+        Reviewed by Ojan Vafai.
+
+        This regressed in http://trac.webkit.org/changeset/98773 .
+
+        No new tests, covered by css3/flexbox/flex-parsing.html.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFlex):
+
+2011-11-01  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: get EventQueue from ScriptExecutionContext instead of Document
+        https://bugs.webkit.org/show_bug.cgi?id=71147
+
+        When IDB is used from a worker thread ScriptExecutionContext will
+        be a WorkerContext, not a Document.  This was the impetus behind
+        moving EventQueue into ScriptExecutionContext in r98656.
+
+        Reviewed by Nate Chapin.
+
+        No new tests. No new functionality yet.
+
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::close):
+        (WebCore::IDBDatabase::enqueueEvent):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::abort):
+        (WebCore::IDBRequest::enqueueEvent):
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::enqueueEvent):
+
+2011-11-01  Andreas Kling  <kling@webkit.org>
+
+        CSS: Remove unused virtual parseString() in style and keyframe rules.
+        https://bugs.webkit.org/show_bug.cgi?id=71300
+
+        Reviewed by Darin Adler.
+
+        * css/CSSStyleRule.cpp:
+        * css/CSSStyleRule.h:
+        * css/WebKitCSSKeyframeRule.cpp:
+        * css/WebKitCSSKeyframeRule.h:
+
+2011-11-01  Emil A Eklund  <eae@chromium.org>
+
+        Switch RenderObject to layout abstraction
+        https://bugs.webkit.org/show_bug.cgi?id=71249
+
+        Switch RenderObject to LayoutRect/Size/Point abstraction.
+
+        Reviewed by Darin Adler.
+
+        No new tests.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::addPDFURLRect):
+        (WebCore::RenderObject::absoluteBoundingBoxRect):
+        (WebCore::RenderObject::absoluteFocusRingQuads):
+        (WebCore::RenderObject::addAbsoluteRectForLayer):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::viewRect):
+        (WebCore::RenderObject::mapLocalToContainer):
+        (WebCore::RenderObject::localCaretRect):
+        (WebCore::RenderObject::addDashboardRegions):
+        (WebCore::RenderObject::maximalOutlineSize):
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::absoluteBoundingBoxRectIgnoringTransforms):
+        (WebCore::RenderObject::absoluteClippedOverflowRect):
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        (WebCore::RenderObject::absoluteOutlineBounds):
+        (WebCore::RenderObject::outlineBoundsForRepaint):
+        (WebCore::adjustForAbsoluteZoom):
+
+2011-11-01  Xiaomei Ji  <xji@chromium.org>
+
+        Refactor: change Scrollable::m_scrollOrigin from protected to private.
+        https://bugs.webkit.org/show_bug.cgi?id=71236
+
+        Reviewed by Darin Adler.
+
+        Only refactor, no new tests needed.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollXForFixedPosition):
+        (WebCore::FrameView::scrollYForFixedPosition):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::maximumScrollPosition):
+        (WebCore::ScrollView::minimumScrollPosition):
+        (WebCore::ScrollView::setScrollOffset):
+        (WebCore::ScrollView::scrollPosition):
+        (WebCore::ScrollView::overhangAmount):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::setScrollOrigin):
+        (WebCore::ScrollableArea::setScrollOriginX):
+        (WebCore::ScrollableArea::setScrollOriginY):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollTo):
+        (WebCore::RenderLayer::scrollPosition):
+        (WebCore::RenderLayer::minimumScrollPosition):
+        (WebCore::RenderLayer::maximumScrollPosition):
+        (WebCore::RenderLayer::computeScrollDimensions):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::scrollXOffset):
+        (WebCore::RenderLayer::scrollYOffset):
+
+2011-11-01  Dominic Cooney  <dominicc@chromium.org>
+
+        display: table-cell and box-sizing: border-box calculates content-box height
+        https://bugs.webkit.org/show_bug.cgi?id=69425
+
+        Reviewed by Dan Bernstein.
+
+        Test: fast/box-sizing/table-cell.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+
+2011-11-01  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Add testing for --enable-accelerated-drawing
+        https://bugs.webkit.org/show_bug.cgi?id=70822
+
+        Reviewed by James Robinson.
+
+        Test: platform/chromium/compositing/accelerated-drawing/alpha.html
+
+        * WebCore.exp.in:
+        * page/Settings.cpp:
+        * page/Settings.h:
+        (WebCore::Settings::setAcceleratedDrawingEnabled):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setAcceleratedDrawingEnabled):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2011-11-01  Tim Horton  <timothy_horton@apple.com>
+
+        SVG Filter on a group doesn't invalidate when children are moved
+        https://bugs.webkit.org/show_bug.cgi?id=70044
+        <rdar://problem/10281530>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Call SVGResourcesCache::clientLayoutChanged whenever the element or its children need layout. Previously,
+        invalidation was only performed if the element itself needed layout; now we also invalidate if any child
+        needs layout and there is a filter applied, as the cached filter result can depend on the layout of children.
+
+        Test: svg/filters/invalidate-on-child-layout.svg
+
+        * rendering/svg/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/svg/SVGResourcesCache.cpp:
+        (WebCore::SVGResourcesCache::clientLayoutChanged):
+
+2011-11-01  Jer Noble  <jer.noble@apple.com>
+
+        Four media tests failing on Lion due to incorrect cached times.
+        https://bugs.webkit.org/show_bug.cgi?id=69574
+
+        Reviewed by Eric Carlson.
+
+        Do not invalidate the cached time when receiving a mediaPlayerRateChanged notification
+        while paused. AVFoundation in particular can return different results for currentTime()
+        when asked after being paused, breaking layout tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerRateChanged):
+
+2011-11-01  Gavin Peters  <gavinp@chromium.org>
+
+        properly end requests when a bad status code return happens
+        https://bugs.webkit.org/show_bug.cgi?id=71122
+
+        Calling error without ending the request set up the CachedResourceRequest so that it could
+        actually send out two notifyFinished() events.  This probably was the root cause of
+        lots of crashing instability; I know from crbug.com/75604 that this bug was causing lots
+        of crashes in ScriptRunner/ScriptElement for instance.
+
+        The fix is easy: just properly end the request instead of just calling error, and we won't
+        re-notify.
+
+        Reviewed by Nate Chapin.
+
+        No new tests, as the problem wasn't very amenable to layout tests.
+        There is a chromium test going through code review at http://codereview.chromium.org/8404001/
+
+        * loader/cache/CachedResourceRequest.cpp:
+        (WebCore::CachedResourceRequest::didReceiveData):
+
+2011-11-01  Erik Arvidsson  <arv@chromium.org>
+
+        Remove LegacyDefaultOptionalArguments flag from CanvasRenderingContext2d
+        https://bugs.webkit.org/show_bug.cgi?id=64628
+
+        Reviewed by Adam Barth.
+
+        Covered by existing tests.
+
+        * html/canvas/CanvasRenderingContext2D.idl:
+
+2011-11-01  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        REGRESSION(98738): RenderTableSection::recalcCells does not properly shrink the RowStruct grid
+        https://bugs.webkit.org/show_bug.cgi?id=71246
+
+        Reviewed by Darin Adler.
+
+        Tests: fast/table/crash-empty-section-calcBorder.html
+               fast/table/crash-empty-section-fixed-layout-calcArray.html
+
+        The refactoring in r98738 changed the way we handle the size to avoid throwing off
+        the memory. The new logic would end up never shrinking the grid's size (prior to that
+        we would grow to the appropriate size and throw the excess capacity with shrinkToFit).
+        Not shrinking would mean that we would potentially read RowStruct with the default values
+        (for instance no |rowRenderer|).
+
+        addCell will properly grow the grid as needed to accomodate the rows and the protruding
+        cells with a rowspan so we introduce a variable to keep track of the size needed. At the
+        end, we just shrink it to this size.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::recalcCells):
+        Introduce a variable to keep the grid size and shrink to that size to match the old code.
+
+2011-11-01  Andrey Kosyakov  <caseq@chromium.org>
+
+        [Chromium] Some media/video-*.html layout tests occasionally crash on WIN GPU
+        https://bugs.webkit.org/show_bug.cgi?id=71277
+
+        Reviewed by Simon Fraser.
+
+        Disabled assert() in hasVisibleDescendant() until callers are fixed.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasVisibleDescendant):
+
+2011-11-01  Mike Reed  <reed@google.com>
+
+        [skia] call readPixels on canvas instead of device (will be private on device soon) and check for error
+        https://bugs.webkit.org/show_bug.cgi?id=71284
+
+        Reviewed by Stephen White.
+
+        No new tests. This is preparing for an API change to Skia.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+
+2011-11-01  Andreas Kling  <kling@webkit.org>
+
+        CSSStyleSheet: Operate directly on the rule vector internally.
+
+        Rubber-stamped by Antti Koivisto.
+
+        There's no need to go through the public, range-checking item() method
+        working on m_children. Also changed length() -> m_children.size().
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::~CSSStyleSheet):
+        (WebCore::CSSStyleSheet::insertRule):
+        (WebCore::CSSStyleSheet::addRule):
+        (WebCore::CSSStyleSheet::deleteRule):
+        (WebCore::CSSStyleSheet::isLoading):
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs):
+
+2011-11-01  Andreas Kling  <kling@webkit.org>
+
+        CSSRule: Devirtualize addSubresourceStyleURLs()
+        https://bugs.webkit.org/show_bug.cgi?id=71285
+
+        Reviewed by Antti Koivisto.
+
+        Move addSubresourceStyleURLs() into the rules that actually implement it.
+        Add type checks and casts at the (only) call site.
+
+        * css/CSSFontFaceRule.h:
+        * css/CSSImportRule.h:
+        * css/CSSRule.h:
+        * css/CSSStyleRule.h:
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs):
+
+2011-11-01  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: some popup buttons not announced by VoiceOver
+        https://bugs.webkit.org/show_bug.cgi?id=67743
+
+        Reviewed by Darin Adler.
+
+        Test: platform/mac/accessibility/aria-popup-buttons-on-native-elements.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+
+2011-11-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Style-based CSS properties are editable and toggleable
+        https://bugs.webkit.org/show_bug.cgi?id=71275
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+
+2011-11-01  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: do not switch panels on Cmd + ->  while in console.
+        https://bugs.webkit.org/show_bug.cgi?id=71281
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/InspectorView.js:
+        (WebInspector.InspectorView.prototype._keyDown):
+
+2011-11-01  Zeno Albisser  <zeno.albisser@nokia.com>
+
+        [Qt] bad codegen, pointer diff in JSC::JSCallbackConstructor::JSCallbackConstructor
+        https://bugs.webkit.org/show_bug.cgi?id=60951
+
+        Adjust symbols visibility for WebCore.
+
+        Reviewed by Simon Hausmann.
+
+        * WebCore.pro:
+
+2011-11-01  Pavel Feldman  <pfeldman@google.com>
+
+        Not reviewed: add InspectorView.js entry into WebKit.qrc
+
+        * inspector/front-end/WebKit.qrc:
+
+2011-11-01  Pavel Feldman  <pfeldman@google.com>
+
+
+        Web Inspector: introduce PanelContainer class, start moving panel management from inspector.js to the new class.
+        https://bugs.webkit.org/show_bug.cgi?id=71272
+
+        Reviewed by Yury Semikhatsky.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.switchToAndFocus):
+        (WebInspector.ElementsPanel.prototype.revealAndSelectNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.setVisible):
+        * inspector/front-end/InspectorView.js: Added.
+        (WebInspector.InspectorView):
+        (WebInspector.InspectorView.prototype.addPanel):
+        (WebInspector.InspectorView.prototype.currentPanel):
+        (WebInspector.InspectorView.prototype._keyDown):
+        (WebInspector.InspectorView.prototype._canGoBackInHistory):
+        (WebInspector.InspectorView.prototype._goBackInHistory):
+        (WebInspector.InspectorView.prototype._canGoForwardInHistory):
+        (WebInspector.InspectorView.prototype._goForwardInHistory):
+        (WebInspector.InspectorView.prototype._pushToHistory):
+        * inspector/front-end/KeyboardShortcut.js:
+        (WebInspector.KeyboardShortcut.eventHasCtrlOrMeta):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.show):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._toggleBreakpointsClicked):
+        * inspector/front-end/SearchController.js:
+        (WebInspector.SearchController.prototype.updateSearchMatchesCount):
+        (WebInspector.SearchController.prototype.updateCurrentMatchIndex):
+        (WebInspector.SearchController.prototype.updateSearchLabel):
+        (WebInspector.SearchController.prototype.handleShortcut):
+        (WebInspector.SearchController.prototype._performSearch):
+        * inspector/front-end/Toolbar.js:
+        (WebInspector.Toolbar.createPanelToolbarItem.onToolbarItemClicked):
+        (WebInspector.Toolbar.createPanelToolbarItem):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/externs.js:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector._panelSelected):
+        (WebInspector.addPanel):
+        (WebInspector.windowResize):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentCanCopy):
+        (WebInspector.documentCopy):
+        (WebInspector.showPanel):
+        (WebInspector.startUserInitiatedDebugging):
+        (WebInspector.inspect):
+        (WebInspector._showAnchorLocationInPanel):
+        (WebInspector._toolbarItemClicked):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.prototype.select):
+
+2011-11-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [WK2] Add WebGestureEvents to the Qt build and enable PlatformGestureEvent::TapType
+        https://bugs.webkit.org/show_bug.cgi?id=71274
+
+        Reviewed by Kenneth Christiansen.
+
+        * features.pri: Enable GESTURE_EVENTS.
+
+2011-11-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98847.
+        http://trac.webkit.org/changeset/98847
+        https://bugs.webkit.org/show_bug.cgi?id=71268
+
+        "Debugger test failures on multiple platforms" (Requested by
+        yurys on #webkit).
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        (WebInspector.DebuggerPresentationModel.prototype.setFormatSource):
+        (WebInspector.DebuggerPresentationModel.prototype._consoleCleared):
+        (WebInspector.DebuggerPresentationModel.prototype._rawSourceCodeForScriptWithURL):
+        (WebInspector.DebuggerPresentationModel.prototype._rawSourceCodeForScript):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptForRawSourceCode):
+        (WebInspector.DebuggerPresentationModel.prototype._createRawSourceCodeId):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.reset):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype._createSourceMapping.didRequestContent.didFormatContent):
+        (WebInspector.RawSourceCode.prototype._createSourceMapping.didRequestContent):
+        (WebInspector.RawSourceCode.prototype._createSourceMapping):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.editSource):
+
+2011-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        The GC should be parallel
+        https://bugs.webkit.org/show_bug.cgi?id=70995
+
+        Reviewed by Geoff Garen.
+        
+        Added parallel tracing to the GC. This required loosening some assertions,
+        since some code may now be called from outside the main thread.
+
+        No new tests, since no behavior was changed.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::parent):
+
+2011-10-31  Andy Estes  <aestes@apple.com>
+
+        Document pointer not null-checked in FrameView::isOnActivePage()
+        https://bugs.webkit.org/show_bug.cgi?id=71265
+        <rdar://problem/10374427>
+
+        Reviewed by Dan Bernstein.
+
+        Return false in FrameView::isOnActivePage() if m_frame->document() is
+        null. Other calls to m_frame->document() in FrameView also have a null
+        check. The frame can have a null document if the FrameLoader is loading
+        the initial empty document.
+
+        No test possible without triggering assertions in debug builds. This is
+        tracked by <http://webkit.org/b/71264>.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::isOnActivePage):
+
+2011-10-31  Jeremy Apthorp  <jeremya@google.com>
+
+        Fix a crash relating to anonymous block merging in
+        RenderFullScreen::unwrapRenderer.
+        https://bugs.webkit.org/show_bug.cgi?id=70705
+
+        Reviewed by Simon Fraser.
+
+        Test: fullscreen/anonymous-block-merge-crash.html
+
+        * rendering/RenderFullScreen.cpp:
+        (RenderFullScreen::unwrapRenderer):
+
+2011-10-31  Dave Michael  <dmichael@chromium.org>
+
+        V8MessageEvent::dataAccessorGetter does not return a reference to its caller
+        https://bugs.webkit.org/show_bug.cgi?id=71229
+
+        Reviewed by Adam Barth.
+
+        Test: fast/events/dispatch-message-string-data.html
+
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::dataAccessorGetter):
+
+2011-10-31  Renata Hodovan  <reni@webkit.org>
+
+        [Qt] Build fix after r98853.
+
+        Rubber-stamped by Andreas Kling.
+
+        * xml/XSLImportRule.cpp:
+        * xml/XSLImportRule.h:
+        (WebCore::XSLImportRule::parentStyleSheet):
+
+2011-10-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::defaultValue
+        https://bugs.webkit.org/show_bug.cgi?id=71146
+
+        Reviewed by Sam Weinig.
+
+        No new tests.
+
+        Added defaultValue to the MethodTable.  Replaced all virtual versions of 
+        defaultValue with static versions.  Replaced all call sites with lookups in the 
+        MethodTable.
+
+        * WebCore.exp.in:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::defaultValue):
+        * bridge/runtime_object.h:
+
+2011-10-31  Levi Weintraub  <leviw@chromium.org>
+
+        Switch RoundedRect back to integers
+        https://bugs.webkit.org/show_bug.cgi?id=71238
+
+        Reviewed by Darin Adler.
+
+        Changing RoundedRect back to ints from LayoutUnits. As further testing has shown, this graphics-
+        focused class should maintain values aligned to pixel boundaries, and therefor kept as integers.
+
+        No new tests -- no change in behavior.
+
+        * platform/graphics/RoundedRect.cpp:
+        (WebCore::RoundedRect::Radii::scale):
+        (WebCore::RoundedRect::Radii::expand):
+        (WebCore::RoundedRect::inflateWithRadii):
+        (WebCore::RoundedRect::Radii::excludeLogicalEdges):
+        (WebCore::RoundedRect::RoundedRect):
+        * platform/graphics/RoundedRect.h:
+        (WebCore::RoundedRect::Radii::Radii):
+        (WebCore::RoundedRect::Radii::setTopLeft):
+        (WebCore::RoundedRect::Radii::setTopRight):
+        (WebCore::RoundedRect::Radii::setBottomLeft):
+        (WebCore::RoundedRect::Radii::setBottomRight):
+        (WebCore::RoundedRect::Radii::topLeft):
+        (WebCore::RoundedRect::Radii::topRight):
+        (WebCore::RoundedRect::Radii::bottomLeft):
+        (WebCore::RoundedRect::Radii::bottomRight):
+        (WebCore::RoundedRect::Radii::expand):
+        (WebCore::RoundedRect::Radii::shrink):
+        (WebCore::RoundedRect::rect):
+        (WebCore::RoundedRect::setRect):
+        (WebCore::RoundedRect::move):
+        (WebCore::RoundedRect::inflate):
+        (WebCore::RoundedRect::expandRadii):
+        (WebCore::RoundedRect::shrinkRadii):
+        * rendering/svg/SVGRenderSupport.h: Adding missing LayoutTypes.h include
+
+2011-10-31  Peter Kasting  <pkasting@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=70666
+        BitmapImage::dataChanged() needs to clear all incomplete frames.
+
+        Reviewed by James Robinson.
+
+        No tests, as I don't know of a way to send an image to the renderer in
+        small pieces (with script run between pieces no less).
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::dataChanged):
+
+2011-10-31  Levi Weintraub  <leviw@chromium.org>
+
+        Amend missing uses of LayoutUnits in RenderApplet, Button, and DeprecatedFlexibleBox
+        https://bugs.webkit.org/show_bug.cgi?id=71243
+
+        Reviewed by Eric Seidel.
+
+        Replacing remaining integer uses with LayoutUnits in the aforementioned classes.
+
+        No new tests -- no change in behavior.
+
+        * rendering/RenderApplet.cpp:
+        (WebCore::RenderApplet::intrinsicSize):
+        (WebCore::RenderApplet::createWidgetIfNecessary):
+        * rendering/RenderApplet.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::controlClipRect):
+        * rendering/RenderButton.h:
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::marginWidthForChild):
+        (WebCore::RenderDeprecatedFlexibleBox::computePreferredLogicalWidths):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
+        * rendering/RenderDeprecatedFlexibleBox.h:
+
+2011-10-31  Tommy Widenflycht  <tommyw@google.com>
+
+        [Chromium] Media Stream API: add the Chromium WebKit interfaces
+        https://bugs.webkit.org/show_bug.cgi?id=58550
+
+        Changes the PeerHandler platform interface so that embedders can more easily use it.
+
+        Reviewed by Darin Fisher.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * mediastream/PeerConnection.cpp:
+        (WebCore::PeerConnection::PeerConnection):
+        (WebCore::PeerConnection::didCompleteICEProcessing):
+        (WebCore::PeerConnection::didGenerateSDP):
+        (WebCore::PeerConnection::didReceiveDataStreamMessage):
+        (WebCore::PeerConnection::didAddRemoteStream):
+        (WebCore::PeerConnection::didRemoveRemoteStream):
+        * mediastream/PeerConnection.h:
+        * platform/mediastream/PeerConnectionHandlerClient.h: Copied from Source/WebCore/platform/mediastream/PeerHandler.cpp.
+        (WebCore::PeerConnectionHandlerClient::~PeerConnectionHandlerClient):
+        * platform/mediastream/chromium/PeerConnectionHandler.h: Copied from Source/WebCore/platform/mediastream/PeerHandler.h.
+        * platform/mediastream/gstreamer/PeerConnectionHandler.cpp: Copied from Source/WebCore/platform/mediastream/PeerHandler.cpp.
+        (WebCore::PeerConnectionHandler::create):
+        (WebCore::PeerConnectionHandler::PeerConnectionHandler):
+        (WebCore::PeerConnectionHandler::~PeerConnectionHandler):
+        (WebCore::PeerConnectionHandler::produceInitialOffer):
+        (WebCore::PeerConnectionHandler::handleInitialOffer):
+        (WebCore::PeerConnectionHandler::processSDP):
+        (WebCore::PeerConnectionHandler::processPendingStreams):
+        (WebCore::PeerConnectionHandler::sendDataStreamMessage):
+        (WebCore::PeerConnectionHandler::stop):
+        * platform/mediastream/gstreamer/PeerConnectionHandler.h: Renamed from Source/WebCore/platform/mediastream/PeerHandler.h.
+
+        Tests for the Media Stream API will be provided by the bug 56587, pending enough landed code.
+
+2011-10-31  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude SpellingCorrectionCommand.cpp and
+        JSRequestAnimationFrameCallback.cpp from all configurations. They are already getting
+        compiled via *AllInOne.cpp files.
+
+2011-10-31  Jonathon Jongsma  <jonathon.jongsma@collabora.co.uk>
+
+        [GStreamer] Don't use GOwnPtr for ref-counted objects
+        https://bugs.webkit.org/show_bug.cgi?id=71042
+
+        Reviewed by Martin Robinson.
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * platform/graphics/gstreamer/GOwnPtrGStreamer.cpp: Removed.
+        * platform/graphics/gstreamer/GOwnPtrGStreamer.h: Removed.
+        * platform/graphics/gstreamer/GStreamerGWorld.cpp:
+        (WebCore::GStreamerGWorld::enterFullscreen):
+        (WebCore::GStreamerGWorld::exitFullscreen):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::updateAudioSink):
+        (WebCore::MediaPlayerPrivateGStreamer::sourceChanged):
+
+2011-10-28  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Connect CCThreadProxy to FrameRateController and SchedulerStateMachine via CCScheduler
+        https://bugs.webkit.org/show_bug.cgi?id=71100
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.h:
+        (WebCore::CCDelayBasedTimeSource::monotonicallyIncreasingTime):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeHostClient::didCommitAndDrawFrame):
+        (WebCore::CCLayerTreeHost::didCommitAndDrawFrame):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCSchedulerFrameRateControllerClientAdapter::create):
+        (WebCore::CCSchedulerFrameRateControllerClientAdapter::~CCSchedulerFrameRateControllerClientAdapter):
+        (WebCore::CCSchedulerFrameRateControllerClientAdapter::beginFrame):
+        (WebCore::CCSchedulerFrameRateControllerClientAdapter::CCSchedulerFrameRateControllerClientAdapter):
+        (WebCore::CCScheduler::CCScheduler):
+        (WebCore::CCScheduler::~CCScheduler):
+        (WebCore::CCScheduler::setNeedsAnimate):
+        (WebCore::CCScheduler::setNeedsCommit):
+        (WebCore::CCScheduler::setNeedsRedraw):
+        (WebCore::CCScheduler::beginFrameComplete):
+        (WebCore::CCScheduler::didSwapBuffersComplete):
+        (WebCore::CCScheduler::didSwapBuffersAbort):
+        (WebCore::CCScheduler::onBeginFrame):
+        (WebCore::CCScheduler::processScheduledActions):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (WebCore::CCScheduler::create):
+        (WebCore::CCScheduler::commitPending):
+        (WebCore::CCScheduler::redrawPending):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::CCSchedulerStateMachine):
+        (WebCore::CCSchedulerStateMachine::nextAction):
+        (WebCore::CCSchedulerStateMachine::updateState):
+        (WebCore::CCSchedulerStateMachine::beginUpdateMoreResourcesComplete):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        (WebCore::CCSchedulerStateMachine::redrawPending):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::doCommit):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
+        (WebCore::CCTextureUpdater::hasMoreUpdates):
+        * platform/graphics/chromium/cc/CCTextureUpdater.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::requestReadbackOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsAnimateOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsCommitOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsRedrawOnImplThread):
+        (WebCore::CCThreadProxy::finishAllRenderingOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
+        (WebCore::CCThreadProxy::beginFrameAndCommit):
+        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
+        (WebCore::CCThreadProxy::hasMoreResourceUpdates):
+        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
+        (WebCore::CCThreadProxy::scheduledActionCommit):
+        (WebCore::CCThreadProxy::drawLayersAndSwapOnImplThread):
+        (WebCore::CCThreadProxy::didCommitAndDrawFrame):
+        (WebCore::CCThreadProxy::initializeImplOnImplThread):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwap):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2011-10-31  Nate Chapin  <japhet@chromium.org>
+
+        Rename the remaining uses of Cue in WebCore/loader/
+        to TextTrack.
+        https://bugs.webkit.org/show_bug.cgi?id=71231
+
+        Reviewed by Eric Carlson.
+
+        No new tests, strictly a renaming.
+
+        * loader/TextTrackLoader.cpp:
+        * loader/cache/CachedResource.cpp:
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResourceLoader.cpp:
+        * loader/cache/CachedResourceLoader.h:
+        * loader/cache/CachedResourceRequest.cpp:
+        * loader/cache/CachedTextTrack.cpp:
+        * platform/network/chromium/ResourceRequest.h:
+
+2011-10-27  Adam Klein  <adamk@chromium.org>
+
+        [MutationObservers] Support characterDataOldValue for characterData mutations
+        https://bugs.webkit.org/show_bug.cgi?id=70862
+
+        Reviewed by Ojan Vafai.
+
+        * dom/CharacterData.cpp:
+        (WebCore::hasOldValue):
+        (WebCore::isOldValueRequested):
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/MutationRecord.cpp:
+        (WebCore::MutationRecord::createCharacterData):
+        * dom/MutationRecord.h:
+
+2011-10-31  Sam Weinig  <sam@webkit.org>
+
+        Remove need for virtual JSObject::unwrappedObject
+        https://bugs.webkit.org/show_bug.cgi?id=71034
+
+        Reviewed by Geoffrey Garen.
+
+        Move the member containing the global object from the JSDOMWindowShell
+        down to the JSGlobalThis class, and update JSDOMWindowShell to go through
+        an inline helper (which just casts) to get the window.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::setWindow):
+        (WebCore::JSDOMWindowShell::className):
+        (WebCore::JSDOMWindowShell::getOwnPropertySlot):
+        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
+        (WebCore::JSDOMWindowShell::put):
+        (WebCore::JSDOMWindowShell::putWithAttributes):
+        (WebCore::JSDOMWindowShell::defineOwnProperty):
+        (WebCore::JSDOMWindowShell::deleteProperty):
+        (WebCore::JSDOMWindowShell::getPropertyNames):
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        (WebCore::JSDOMWindowShell::defineGetter):
+        (WebCore::JSDOMWindowShell::defineSetter):
+        (WebCore::JSDOMWindowShell::lookupGetter):
+        (WebCore::JSDOMWindowShell::lookupSetter):
+        (WebCore::JSDOMWindowShell::impl):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::window):
+        (WebCore::JSDOMWindowShell::setWindow):
+        (WebCore::JSDOMWindowShell::createStructure):
+
+2011-10-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        WebKit nests pre on copy and paste when the pre is the root editable element
+        https://bugs.webkit.org/show_bug.cgi?id=70800
+
+        Reviewed by Darin Adler.
+
+        Fixed the bug by removing nested block elements in removeRedundantStylesAndKeepStyleSpanInline.
+
+        Tests: editing/pasteboard/contenteditable-pre-2.html
+               editing/pasteboard/contenteditable-pre.html
+
+        * editing/ApplyStyleCommand.cpp:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline): Remove block
+        elements if it's identical to its parent and there are no contents between the two. Also remove
+        contenteditable attribute from an element if the parent is already richly editable.
+        (WebCore::ReplaceSelectionCommand::doApply): Remove redundant styles after removing the placeholder
+        br so that the above check doesn't get affected by the placeholder.
+        * editing/htmlediting.cpp:
+        (WebCore::areIdenticalElements): Moved from ApplyStyleCommand.
+        (WebCore::isNonTableCellHTMLBlockElement): Moved from markup.cpp.
+        * editing/htmlediting.h:
+        * editing/markup.cpp:
+
+2011-10-31  Vineet Chaudhary  <vineet.chaudhary@motorola.com>
+
+        text/plain form encoding ignored and incorrectly specified in request header.
+        https://bugs.webkit.org/show_bug.cgi?id=20795
+
+        Reviewed by Darin Adler.
+
+        This patch fixes the behaviour of forms where enctype is set to
+        text/plain, encoding is also text/plain.
+
+        Tests: fast/forms/form-get-textplain.html
+               http/tests/misc/form-post-textplain.html
+
+        * loader/FormSubmission.cpp:
+        (WebCore::FormSubmission::create):
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::create):
+        (WebCore::FormData::appendKeyValuePairItems):
+        * platform/network/FormData.h:
+        (WebCore::FormData::parseEncodingType):
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::FormDataBuilder::addKeyValuePairAsFormData): Modified encoding scheme for text/plain.
+        * platform/network/FormDataBuilder.h:
+
+2011-10-31  John Gregg  <johnnyg@google.com>
+
+        RenderImage.cpp calls SVGImage even if it's not defined
+        https://bugs.webkit.org/show_bug.cgi?id=71247
+
+        This fixes a compile error when ENABLE_SVG=0.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::embeddedContentBox):
+
+2011-10-31  Pavel Podivilov  <podivilov@chromium.org>
+
+        Update XMLHttpRequest.send idl declaration to match implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=71121
+
+        Reviewed by Adam Barth.
+
+        * xml/XMLHttpRequest.idl:
+
+2011-10-31  Anders Carlsson  <andersca@apple.com>
+
+        More work on making plug-ins work better with transforms
+        https://bugs.webkit.org/show_bug.cgi?id=71241
+
+        Reviewed by Darin Adler.
+
+        Export symbols used by WebKit2.
+
+        * WebCore.exp.in:
+
+2011-10-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::defineGetter
+        https://bugs.webkit.org/show_bug.cgi?id=71134
+
+        Reviewed by Darin Adler.
+
+        No new tests.
+
+        Added defineGetter to the MethodTable.  Replaced all virtual versions of defineGetter
+        with static versions.  Replaced all call sites with lookups in the MethodTable.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::defineGetter):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+
+2011-10-31  Arko Saha  <arko@motorola.com>
+
+        Microdata: Support for itemid attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=71007
+
+        Reviewed by Ryosuke Niwa.
+
+        itemid attribute: To give a global identifier for the Microdata items.
+        The itemid attribute, if specified, must have a value that is a valid URL potentially
+        surrounded by spaces.
+        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#attr-itemid
+
+        Tests: fast/dom/MicroData/itemid-attribute-test.html
+               fast/dom/MicroData/itemid-must-see-resolved-url.html
+
+        * html/HTMLElement.idl:
+
+2011-10-31  Yury Semikhatsky  <yurys@chromium.org>
+
+        window.onerror doesn't work with inline (attribute) scripts
+        https://bugs.webkit.org/show_bug.cgi?id=70991
+
+        Uncaught syntax errors in inline event handlers are now reported to
+        window.onerror handler.
+
+        Reviewed by Geoffrey Garen.
+
+        Tests: fast/events/window-onerror-exception-in-attr.html
+               fast/events/window-onerror-syntax-error-in-attr.html
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction): report exception as usual
+        if it happens during event handler compilation.
+
+2011-10-31  Emil A Eklund  <eae@chromium.org>
+
+        Overridden LayoutRect method still uses IntRects
+        https://bugs.webkit.org/show_bug.cgi?id=71166
+
+        Reviewed by Eric Seidel.
+
+        Change all virtual controlClipRect, windowResizerRect, windowClipRect,
+        visibleContentRect, scrollCornerRect, outlineBoundsForRepaint and
+        localCaretRect functions to have the same signature.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::windowClipRect):
+        (WebCore::FrameView::windowClipRectForLayer):
+        (WebCore::FrameView::windowResizerRect):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        * platform/ScrollableArea.h:
+        * rendering/RenderButton.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::visibleContentRect):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localCaretRect):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::outlineBoundsForRepaint):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+        (WebCore::RenderText::linesBoundingBox):
+        * rendering/RenderText.h:
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::localCaretRect):
+        * rendering/svg/RenderSVGInlineText.h:
+
+2011-10-31  Dmitry Lomov  <dslomov@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=70658
+        [JSC] Implement MessagePort transfer in JSC bindings implementation of webkitPostMessage.
+        Transfer of MessagePorts implemented.
+
+        Reviewed by David Levin.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneSerializer::serialize):
+        (WebCore::CloneSerializer::CloneSerializer):
+        (WebCore::CloneSerializer::dumpIfTerminal):
+        (WebCore::CloneDeserializer::deserialize):
+        (WebCore::CloneDeserializer::CloneDeserializer):
+        (WebCore::CloneDeserializer::readTerminal):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+
+2011-10-31  Andreas Kling  <kling@webkit.org>
+
+        CSSRule: Devirtualize insertedIntoParent()
+        https://bugs.webkit.org/show_bug.cgi?id=71223
+
+        Reviewed by Antti Koivisto.
+
+        Moved insertedIntoParent() down into CSSImportRule and renamed it to
+        requestStyleSheet(). CSSImportRule is the only user of this function.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::requestStyleSheet):
+        * css/CSSImportRule.h:
+        * css/CSSRule.h:
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::append):
+        (WebCore::CSSStyleSheet::insertRule):
+
+2011-10-31  Anna Cavender  <annacc@chromium.org>
+
+        Implement load notification and events for <track>.
+        https://bugs.webkit.org/show_bug.cgi?id=71054
+
+        Reviewed by Eric Carlson.
+
+        Tests: media/track/track-load-error-readyState.html
+               media/track/track-load-from-element-readyState.html
+               media/track/track-load-from-src-readyState.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::trackWasAdded):
+        (WebCore::HTMLMediaElement::trackWillBeRemoved):
+        (WebCore::HTMLMediaElement::trackSourceChanged):
+        * html/HTMLMediaElement.h:
+        * html/HTMLTrackElement.cpp:
+        (WebCore::HTMLTrackElement::insertedIntoTree):
+        (WebCore::HTMLTrackElement::willRemove):
+        (WebCore::HTMLTrackElement::parseMappedAttribute):
+        (WebCore::HTMLTrackElement::attributeChanged):
+        * html/HTMLTrackElement.h:
+        * html/LoadableTextTrack.cpp:
+        (WebCore::LoadableTextTrack::cueLoadingCompleted):
+
+2011-10-31  Andreas Kling  <kling@webkit.org>
+
+        CSSRule: Devirtualize type() and isFooRule()
+        https://bugs.webkit.org/show_bug.cgi?id=71221
+
+        Reviewed by Antti Koivisto.
+
+        Store the rule type in a CSSRule member (packed with the parent-is-rule flag)
+        and let the isFooRule() functions return type() == FOO_TYPE.
+
+        CSSPageRule will no longer return true for isStyleRule(), tweaked call sites
+        accordingly.
+
+        * css/CSSCharsetRule.cpp:
+        (WebCore::CSSCharsetRule::CSSCharsetRule):
+        * css/CSSCharsetRule.h:
+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::CSSFontFaceRule):
+        * css/CSSFontFaceRule.h:
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::CSSImportRule):
+        * css/CSSImportRule.h:
+        * css/CSSMediaRule.cpp:
+        (WebCore::CSSMediaRule::CSSMediaRule):
+        * css/CSSMediaRule.h:
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::CSSPageRule):
+        * css/CSSPageRule.h:
+        * css/CSSRegionStyleRule.cpp:
+        (WebCore::CSSRegionStyleRule::CSSRegionStyleRule):
+        * css/CSSRegionStyleRule.h:
+        * css/CSSRule.h:
+        (WebCore::CSSRule::type):
+        (WebCore::CSSRule::isCharsetRule):
+        (WebCore::CSSRule::isFontFaceRule):
+        (WebCore::CSSRule::isKeyframeRule):
+        (WebCore::CSSRule::isKeyframesRule):
+        (WebCore::CSSRule::isMediaRule):
+        (WebCore::CSSRule::isPageRule):
+        (WebCore::CSSRule::isStyleRule):
+        (WebCore::CSSRule::isRegionStyleRule):
+        (WebCore::CSSRule::isImportRule):
+        (WebCore::CSSRule::CSSRule):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::CSSStyleRule):
+        * css/CSSStyleRule.h:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleSet::addPageRule):
+        (WebCore::RuleSet::addRulesFromSheet):
+        (WebCore::RuleSet::addStyleRule):
+        * css/CSSUnknownRule.h:
+        (WebCore::CSSUnknownRule::CSSUnknownRule):
+        * css/WebKitCSSKeyframeRule.cpp:
+        (WebCore::WebKitCSSKeyframeRule::WebKitCSSKeyframeRule):
+        * css/WebKitCSSKeyframeRule.h:
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::WebKitCSSKeyframesRule):
+        * css/WebKitCSSKeyframesRule.h:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::asCSSStyleRule):
+
+2011-10-31  Pavel Feldman  <pfeldman@google.com>
+
+        Not reviewed: reorder inspector js files to fix remote mode.
+
+        * inspector/front-end/inspector.html:
+
+2011-10-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [refactoring] TextPrompt: ensure encapsulation, extract history management
+        https://bugs.webkit.org/show_bug.cgi?id=70936
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._attributesModified):
+        (WebInspector.StylePropertyTreeElement.prototype.selectElement):
+        (WebInspector.StylePropertyTreeElement.prototype.selectElement.context):
+        (WebInspector.StylePropertyTreeElement.prototype.selectElement.event):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.context.event):
+        ():
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt):
+        (WebInspector.TextPrompt.prototype.get proxyElement):
+        (WebInspector.TextPrompt.prototype.attach):
+        (WebInspector.TextPrompt.prototype.attachAndStartEditing):
+        (WebInspector.TextPrompt.prototype._attachInternal):
+        (WebInspector.TextPrompt.prototype.detach):
+        (WebInspector.TextPrompt.prototype.get text):
+        (WebInspector.TextPrompt.prototype.set text):
+        (WebInspector.TextPrompt.prototype._removeFromElement):
+        (WebInspector.TextPrompt.prototype._startEditing):
+        (WebInspector.TextPrompt.prototype._stopEditing):
+        (WebInspector.TextPrompt.prototype._selectStart.moveBackIfOutside):
+        (WebInspector.TextPrompt.prototype._selectStart):
+        (WebInspector.TextPrompt.prototype.defaultKeyHandler):
+        (WebInspector.TextPrompt.prototype._onKeyDown):
+        (WebInspector.TextPrompt.prototype.clearAutoComplete):
+        (WebInspector.TextPrompt.prototype.complete):
+        (WebInspector.TextPrompt.prototype._completionsReady):
+        (WebInspector.TextPrompt.prototype.isCaretInsidePrompt):
+        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
+        (WebInspector.TextPrompt.prototype.isCaretOnFirstLine):
+        (WebInspector.TextPrompt.prototype.isCaretOnLastLine):
+        (WebInspector.TextPrompt.prototype.moveCaretToEndOfPrompt):
+        (WebInspector.TextPrompt.prototype.upKeyPressed):
+        (WebInspector.TextPrompt.prototype.downKeyPressed):
+        (WebInspector.TextPrompt.prototype.tabKeyPressed):
+        (WebInspector.TextPromptConfig):
+        (WebInspector.TextPromptWithHistory):
+        (WebInspector.TextPromptWithHistory.prototype.get historyData):
+        (WebInspector.TextPromptWithHistory.prototype.setHistoryData):
+        (WebInspector.TextPromptWithHistory.prototype.pushHistoryItem):
+        (WebInspector.TextPromptWithHistory.prototype._pushCurrentText):
+        (WebInspector.TextPromptWithHistory.prototype._previous):
+        (WebInspector.TextPromptWithHistory.prototype._next):
+        (WebInspector.TextPromptWithHistory.prototype._currentHistoryItem):
+        (WebInspector.TextPromptWithHistory.prototype.defaultKeyHandler):
+
+2011-10-31  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move localization support into UIUtil.js, reduce externs.
+        https://bugs.webkit.org/show_bug.cgi?id=71220
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView.prototype.focus):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.afterShow):
+        * inspector/front-end/Drawer.js:
+        * inspector/front-end/GoToLineDialog.js:
+        (WebInspector.GoToLineDialog.prototype._hide):
+        * inspector/front-end/HelpScreen.js:
+        (WebInspector.HelpScreen.prototype.show):
+        (WebInspector.HelpScreen.prototype.hide):
+        (WebInspector.HelpScreen.prototype._onBlur):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        * inspector/front-end/KeyboardShortcut.js:
+        (WebInspector.KeyboardShortcut._keyName):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.wasShown):
+        * inspector/front-end/SearchController.js:
+        (WebInspector.SearchController.prototype._onSearchFieldManualFocus):
+        (WebInspector.SearchController.prototype._onKeyDown):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        * inspector/front-end/Toolbar.js:
+        (WebInspector.Toolbar.prototype._toolbarDragStart):
+        * inspector/front-end/UIUtils.js:
+        (WebInspector.startEditing.cleanUpAfterEditing):
+        (WebInspector.startEditing.var):
+        (WebInspector.startEditing):
+        (WebInspector.UIString):
+        (WebInspector.useLowerCaseMenuTitles):
+        (WebInspector.platform):
+        (WebInspector.isMac):
+        (WebInspector.platformFlavor):
+        (WebInspector.port):
+        (WebInspector.installPortStyles):
+        (WebInspector._windowFocused):
+        (WebInspector._windowBlurred):
+        (WebInspector.previousFocusElement):
+        (WebInspector.currentFocusElement):
+        (WebInspector._focusChanged):
+        (WebInspector.setCurrentFocusElement):
+        * inspector/front-end/externs.js:
+        (Event.prototype.initWebKitWheelEvent):
+        (window.getComputedStyle):
+        (InspectorBackend.runAfterPendingDispatches):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.addMainEventListeners):
+
+2011-10-31  Andreas Kling  <kling@webkit.org>
+
+        Kill StyleBase.
+        https://bugs.webkit.org/show_bug.cgi?id=71218
+
+        Reviewed by Antti Koivisto.
+
+        Remove the StyleBase class and make all subclasses stand alone. CSSRule and StyleSheet
+        now inherit from RefCounted<T> instead, and XSLImportRule doesn't even need that,
+        so StyleBase is replaced by nothing.
+
+        * css/StyleBase.cpp:
+        * css/StyleBase.h:
+
+            Removed.
+
+        * css/CSSRule.cpp:
+        * css/CSSRule.h:
+        (WebCore::CSSRule::~CSSRule):
+        (WebCore::CSSRule::useStrictParsing):
+        (WebCore::CSSRule::setParentStyleSheet):
+        (WebCore::CSSRule::setParentRule):
+        (WebCore::CSSRule::parentStyleSheet):
+        (WebCore::CSSRule::parentRule):
+        (WebCore::CSSRule::baseURL):
+        (WebCore::CSSRule::CSSRule):
+
+            CSSRule now inherits directly from RefCounted, and has either a CSSRule or a
+            CSSStyleSheet as its parent. Made these getters/setters inline since they are
+            trivial now.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+            Purge StyleBase.* from the build systems.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::root):
+
+            New root() functions for CSSRule and StyleSheet.
+
+        * bindings/js/JSNodeCustom.h:
+
+            Remove StyleBase.h include.
+
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::parentStyleSheet):
+
+            Added CSS-specific parentStyleSheet() so we don't have to cast it to a
+            CSSStyleSheet* at the call sites.
+
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::StyleSheet):
+        (WebCore::StyleSheet::parentStyleSheet):
+        (WebCore::StyleSheet::baseURL):
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::parentRule):
+        (WebCore::StyleSheet::setParentRule):
+        (WebCore::StyleSheet::isCSSStyleSheet):
+        (WebCore::StyleSheet::isXSLStyleSheet):
+
+            StyleSheet now inherits directly from RefCounted and always has a parent CSSRule
+            though it can be null. parentStyleSheet() returns that rule's parent style sheet.
+            Moved the relevant guts from StyleBase down here.
+
+        * loader/cache/CachedStyleSheetClient.h:
+
+            Remove unnecessary WTF_MAKE_FAST_ALLOCATED, we get it from CachedResourceClient.
+
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::XSLImportRule):
+        (WebCore::XSLImportRule::~XSLImportRule):
+        (WebCore::XSLImportRule::parentStyleSheet):
+        (WebCore::XSLImportRule::setXSLStyleSheet):
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLImportRule.h:
+        (WebCore::XSLImportRule::create):
+        (WebCore::XSLImportRule::setParentStyleSheet):
+
+            Remove inheritance from StyleBase, and have create() return a PassOwnPtr instead.
+            This is fine, since XSLStyleSheet is the only object that ever manages these rules.
+
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::insertedIntoDocument):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::~CSSStyleSheet):
+        (WebCore::CSSStyleSheet::ownerRule):
+        (WebCore::CSSStyleSheet::deleteRule):
+        (WebCore::CSSStyleSheet::checkLoaded):
+        (WebCore::CSSStyleSheet::document):
+        (WebCore::CSSStyleSheet::styleSheetChanged):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::~CSSImportRule):
+        (WebCore::CSSImportRule::setCSSStyleSheet):
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSMediaRule.cpp:
+        (WebCore::CSSMediaRule::CSSMediaRule):
+        (WebCore::CSSMediaRule::~CSSMediaRule):
+        (WebCore::CSSMediaRule::append):
+        (WebCore::CSSMediaRule::insertRule):
+        (WebCore::CSSMediaRule::deleteRule):
+        * css/CSSRegionStyleRule.cpp:
+        (WebCore::CSSRegionStyleRule::CSSRegionStyleRule):
+        (WebCore::CSSRegionStyleRule::~CSSRegionStyleRule):
+        * css/CSSRuleList.cpp:
+        (WebCore::CSSRuleList::deleteRule):
+        * css/CSSStyleDeclaration.h:
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::~WebKitCSSKeyframesRule):
+        (WebCore::WebKitCSSKeyframesRule::setName):
+        (WebCore::WebKitCSSKeyframesRule::append):
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::parseStyleSheet):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::parentStyleSheet):
+        * xml/XSLStyleSheet.h:
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet):
+        (WebCore::XSLStyleSheet::~XSLStyleSheet):
+        (WebCore::XSLStyleSheet::checkLoaded):
+        (WebCore::XSLStyleSheet::loadChildSheet):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::~XSLStyleSheet):
+
+            Use the new, more explicit, parenting functions of StyleSheet.
+
+2011-10-31  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        CSS 2.1 failure: background-intrinsic-*
+        https://bugs.webkit.org/show_bug.cgi?id=47156
+
+        SVGs do not work as tiled background images
+        https://bugs.webkit.org/show_bug.cgi?id=16281
+
+        Apply preserveAspectRatio and synthesize viewboxes in <img>
+        https://bugs.webkit.org/show_bug.cgi?id=34521
+
+        SVG background doesn't resize properly when dimensions are changed
+        https://bugs.webkit.org/show_bug.cgi?id=42944
+
+        Images with percent height inside a floated div should use intrinsic height.
+        https://bugs.webkit.org/show_bug.cgi?id=45439
+
+        SVG image in HTML changes size as the window is resized
+        https://bugs.webkit.org/show_bug.cgi?id=52045
+
+        Reviewed by Antti Koivisto.
+
+        Implement intrinsic sizing support for SVGImage (svg embedded through <html:img>/<svg:image>/background-image/border-image/...).
+        This is demanded by CSS 2.1, and covered by new layout tests in LayoutTests/css2.1 and several new custom testcases.
+
+        Tests: css2.1/20110323/background-intrinsic-001.htm
+               css2.1/20110323/background-intrinsic-002.htm
+               css2.1/20110323/background-intrinsic-003.htm
+               css2.1/20110323/background-intrinsic-004.htm
+               css2.1/20110323/background-intrinsic-005.htm
+               css2.1/20110323/background-intrinsic-006.htm
+               css2.1/20110323/background-intrinsic-007.htm
+               css2.1/20110323/background-intrinsic-008.htm
+               css2.1/20110323/background-intrinsic-009.htm
+               svg/as-background-image/background-image-preserveaspectRatio-support.html (adapted from testcase from bug 34521)
+               svg/as-background-image/background-image-tiled.html (reduction from bug 16281)
+               svg/as-background-image/same-image-two-instances-background-image.html
+               svg/as-image/img-preserveAspectRatio-support-1.html (reduction from bug 34521)
+               svg/as-image/same-image-two-instances.html
+               svg/as-image/svg-as-relative-image-with-explicit-size.html
+               svg/as-image/svg-image-change-content-size.xhtml (reduction from bug 42944)
+               svg/zoom/page/zoom-img-preserveAspectRatio-support-1.html
+               svg/zoom/page/zoom-svg-as-image.html
+               svg/zoom/page/zoom-svg-as-relative-image.html
+
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::addClient): Pass default zoom factor.
+        (WebCore::CSSImageGeneratorValue::getImage): Ditto.
+        * loader/cache/CachedImage.cpp: Enable SVGImage <-> IntSize cache.
+        (WebCore::CachedImage::lookupImageForSize): Use recently introduced ImageBySizeCache, to lookup an image for a certain size.
+        (WebCore::CachedImage::lookupOrCreateImageForRenderer): Use recently introduced ImageBySizeCache, to dynamically create copies of m_image if needed.
+        (WebCore::CachedImage::imageForRenderer): Lookup image by renderer, which first looks up a size for a renderer, then uses lookupImageForSize().
+        (WebCore::CachedImage::setContainerSizeForRenderer): For SVGImages, pass on container size handling to ImageBySizeCache.
+        (WebCore::CachedImage::imageSizeForRenderer): Figure out the image size, respecting per-renderer overrides, for a certain renderer.
+        (WebCore::CachedImage::computeIntrinsicDimensions): Remove unnecessary RenderObject parameter.
+        * loader/cache/CachedImage.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::isSVGImageChromeClient): Used to identify whether a RenderSVGRoot is embedded through a SVGImage. Returns false, by default.
+        * platform/graphics/Image.h:
+        (WebCore::Image::setImageObserver): Add helper.
+        * rendering/ImageBySizeCache.cpp: Cleanup code.
+        (WebCore::ImageBySizeCache::addClient): Assert the passed renderer is valid.
+        (WebCore::ImageBySizeCache::removeClient): Ditto. Allow removeClient() to be called w/o prio addClient() usage.
+        (WebCore::ImageBySizeCache::getImage): Add zoom parameter.
+        (WebCore::ImageBySizeCache::getRequestedSizeAndZoom): Add way to get requested size from cache, instead of actual cached sizes.
+        (WebCore::ImageBySizeCache::imageForSize): Respect empty sizes, just return 0, instead of asserting.
+        (WebCore::ImageBySizeCache::imageForRenderer): Added a helper that retrieves an image for a renderer, by lookup up its size and using imageForSize().
+        * rendering/ImageBySizeCache.h: Cleaup code, introduce struct that replaces the std::pair<IntSize, int>.
+        (WebCore::SizeZoomAndCount::SizeZoomAndCount):
+        * rendering/RenderBoxModelObject.cpp: Implement CSS 2.1 intrinsic size negotiation for images.
+        (WebCore::resolveWidthForRatio): New inline helper function used by calculateImageIntrinsicDimensions.
+        (WebCore::resolveHeightForRatio): Ditto.
+        (WebCore::resolveAgainstIntrinsicWidthOrHeightAndRatio): Ditto.
+        (WebCore::resolveAgainstIntrinsicRatio):  Ditto.
+        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions): New helper function, containing the main algorithm, which is a pure transcription of the spec.
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Use new calculateImageIntrinsicDimensions() helper to figure out the intrinsic size.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Propagate calculateFillTileSize() result to the image resource, via setContainerSizeForRenderer().
+        (WebCore::RenderBoxModelObject::paintNinePieceImage): Use new calculateImageIntrinsicDimensions() helper to figure out the intrinsic size.
+        * rendering/RenderBoxModelObject.h: Clarify some variable names, added calculateImageIntrinsicDimensions().
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::RenderImage): Use IntSize(), instead of IntSize(0, 0).
+        (WebCore::RenderImage::updateIntrinsicSizeIfNeeded): Refactored from imageDimensionsChanged().
+        (WebCore::RenderImage::imageDimensionsChanged): Use updateIntrinsicSizeIfNeeded().
+        (WebCore::RenderImage::computeReplacedLogicalWidth): Use RenderReplaced::computeReplacedLogicalWidth() exclusively. For this to work, the intrinsic size must be correct.
+        (WebCore::RenderImage::computeIntrinsicRatioInformation): Default implementation for non-SVGImages.
+        (WebCore::RenderImage::needsPreferredWidthsRecalculation): Return true, just like RenderPart, if embeddedContentBox is not null.
+        (WebCore::RenderImage::embeddedContentBox): Returns the RenderSVGRoot* renderer of the embedded SVG, if possible.
+        * rendering/RenderImage.h: Remove isLogicalWidth/HeightSpecified() / computeReplacedLogicalHeight() / calcAspectRatioLogicalWidth/Height().
+        * rendering/RenderImageResource.cpp:
+        (WebCore::RenderImageResource::setContainerSizeForRenderer): Pass around new "float containerZoomFactor" parameter.
+        * rendering/RenderImageResourceStyleImage.cpp:
+        (WebCore::RenderImageResourceStyleImage::image): embeddedContentBox() is now calling image() earlier than before. We now have to handle the case that the image is pending.
+        (WebCore::RenderImageResourceStyleImage::setContainerSizeForRenderer): Pass zoom factor.
+        * rendering/RenderImageResourceStyleImage.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::computePreferredLogicalWidths): Pass effective zoom to setContainerSizeForRenderer().
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computeIntrinsicLogicalWidth): Generalized this code, as RenderImage is using it as well now. Marginal changes needed.
+        (WebCore::RenderReplaced::computeIntrinsicLogicalHeight): Ditto.
+        (WebCore::RenderReplaced::computeReplacedLogicalWidth): Ditto.
+        * rendering/style/StyleCachedImage.cpp:
+        (WebCore::StyleCachedImage::computeIntrinsicDimensions): Stop passing m_renderer to CachedImage, it's no longer needed.
+        (WebCore::StyleCachedImage::setContainerSizeForRenderer): Add "float containerZoomFactor" parameter.
+        * rendering/style/StyleCachedImage.h: Add "float containerZoomFactor" parameter to setContainerSizeForRenderer.
+        * rendering/style/StyleGeneratedImage.h:
+        (WebCore::StyleGeneratedImage::setContainerSizeForRenderer): Ditto.
+        * rendering/style/StyleImage.h: Ditto.
+        * rendering/style/StylePendingImage.h:
+        (WebCore::StylePendingImage::setContainerSizeForRenderer): Ditto.
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout): Always supply a container size when embedding SVGs in <svg:image>.
+        * rendering/svg/RenderSVGRoot.cpp: Move "override container size" from SVGSVGElement into RenderSVGRoot, where it belongs.
+        (WebCore::RenderSVGRoot::isEmbeddedThroughImageElement): Add helper method to determine whether we're loaded through SVGImage.
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): If we have a valid container size, it has precendence (only supplied via external SVGImages).
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Ditto.
+        (WebCore::RenderSVGRoot::layout): Remove calcViewport() usage, no need to track/override the viewport size anymore, all done in coputeReplacedLogical* now.
+        (WebCore::RenderSVGRoot::paint): Use borderBoxRect() which now always matches the previously computed m_viewportSize. 
+        (WebCore::RenderSVGRoot::computeRectForRepaint): Ditto.
+        * rendering/svg/RenderSVGRoot.h: Move "override container size" from SVGSVGElement into RenderSVGRoot, where it belongs.
+        (WebCore::RenderSVGRoot::containerSize):
+        (WebCore::RenderSVGRoot::setContainerSize):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::determineViewport): Resolve lengths against override container size in documents embedded through SVGImage.
+        * svg/SVGSVGElement.cpp: Remove "override container size" handling from SVGSVGElement.
+        (WebCore::SVGSVGElement::SVGSVGElement): Ditto.
+        (WebCore::SVGSVGElement::currentViewBoxRect): Always synthesize a viewBox, if we're embedded through SVGImage, as demanded by SVG 1.1 2nd Edition.
+        * svg/SVGSVGElement.h:
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImageChromeClient::isSVGImageChromeClient): Return true, used to identify whether RenderSVGRoot is embedded through SVGImage.
+        (WebCore::SVGImage::createWithDataAndSize): Add new helper function.
+        (WebCore::SVGImage::setContainerZoom): Forwarded to Page::setPageZoomFactor.
+        (WebCore::SVGImage::setContainerSize): Assert that container size is not empty. We should never receive an empty container size.
+        (WebCore::SVGImage::usesContainerSize): Adapt to override container size changes, it now lives in RenderSVGRoot instead of SVGSVGElement.
+        (WebCore::SVGImage::size): New algorithm to figure out the size of an embedded SVG, as demanded by the CSS/SVG specs.
+        (WebCore::SVGImage::embeddedContentBox): Add helper which returns the RenderSVGRoot of the document.
+        (WebCore::SVGImage::computeIntrinsicDimensions): Implement intrinsic ratio calculation. 
+        (WebCore::SVGImage::dataChanged): Force calling FrameView::setCanHaveScrollbars(false), as SVG images now always synthesize a viewBox, and thus never receive scrollbars.
+        * svg/graphics/SVGImage.h:
+
+2011-10-31  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Add ResourcePreviewView.js to the list of inspector front-end
+        files on Qt.
+
+        * inspector/front-end/WebKit.qrc:
+
+2011-10-31  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: do not map scripts generated with document.write to the document resources.
+        https://bugs.webkit.org/show_bug.cgi?id=71114
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/debugger/bind-script-to-resource.html
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._bindScriptToRawSourceCode):
+        (WebInspector.DebuggerPresentationModel.prototype._rawSourceCodeForScriptWithURL):
+        (WebInspector.DebuggerPresentationModel.prototype._rawSourceCodeForScript):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptForRawSourceCode):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype._createSourceMapping.didRequestContent.didFormatContent):
+        (WebInspector.RawSourceCode.prototype._createSourceMapping.didRequestContent):
+        (WebInspector.RawSourceCode.prototype._createSourceMapping):
+        * inspector/front-end/Script.js:
+
+2011-10-31  Antti Koivisto  <antti@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=71012
+        Use StringHasher to generate the matched declaration cache hash
+
+        Reviewed by Sam Weinig.
+
+        Make sure the MatchedStyleDeclarations are fully zero-initialized as we calculate a hash over a raw memory array of these.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::MatchedStyleDeclaration::MatchedStyleDeclaration):
+        (WebCore::CSSStyleSelector::addMatchedDeclaration):
+        * css/CSSStyleSelector.h:
+
+2011-10-31  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck build.
+
+        * GNUmakefile.am: Add InFilesCompiler.pm to SCRIPTS_BINDINGS and
+        EXTRA_DIST. Also remove duplicated entries in EXTRA_DIST.
+
+2011-10-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: factor out ResourceUtils, clean up externs.
+        https://bugs.webkit.org/show_bug.cgi?id=71192
+
+        Reviewed by Yury Semikhatsky.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._linkifyLocation):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        * inspector/front-end/ProfilesPanel.js:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.displayName):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype._createResource):
+        * inspector/front-end/ResourceUtils.js: Added.
+        (WebInspector.resourceForURL):
+        (WebInspector.forAllResources):
+        (WebInspector.displayNameForURL):
+        (WebInspector.linkifyStringAsFragmentWithCustomLinkifier):
+        (WebInspector.registerLinkifierPlugin):
+        (WebInspector.linkifyStringAsFragment):
+        (WebInspector.linkifyURLAsNode):
+        (WebInspector.linkifyURL):
+        (WebInspector.formatLinkText):
+        (WebInspector.linkifyResourceAsNode):
+        (WebInspector.resourceURLForRelatedNode.callback):
+        (WebInspector.resourceURLForRelatedNode):
+        (WebInspector.populateHrefContextMenu):
+        (WebInspector.completeURL):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.selectElement):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/externs.js:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.networkResourceById):
+        * inspector/front-end/utilities.js:
+        (setupPrototypeUtilities.Element.prototype.selectionLeftOffset):
+
+2011-10-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Using keyboard to increment/decrement units is inconsistent
+        https://bugs.webkit.org/show_bug.cgi?id=71119
+
+        Reviewed by Pavel Feldman.
+
+        This change makes the behavior consistent with that described at http://trac.webkit.org/wiki/WebInspector
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.alteredFloatNumber):
+        (WebInspector.StylesSidebarPane.prototype._attributesModified):
+
+2011-10-29  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Switch to a backing store approach for painting WebKitWebView
+        https://bugs.webkit.org/show_bug.cgi?id=70213
+
+        Reviewed by Gustavo Noronha Silva.
+
+        No new tests. The changes to WebCore should not change
+        behavior. The changes in WebKit are covered by existing
+        tests.
+
+        * platform/cairo/WidgetBackingStore.h:
+        (WebCore::WidgetBackingStore::size): Added this getter for the size.
+        * platform/cairo/WidgetBackingStoreCairo.cpp:
+        (WebCore::WidgetBackingStore::WidgetBackingStore): Initialize size.
+        * platform/graphics/cairo/CairoUtilities.cpp:
+        (WebCore::copyRectFromCairoSurfaceToContext): Added this new helper.
+        (WebCore::copyRectFromOneSurfaceToAnother): Use the new helper.
+        * platform/graphics/cairo/CairoUtilities.h:
+        * platform/gtk/GtkWidgetBackingStoreX11.cpp:
+        (WebCore::WidgetBackingStore::WidgetBackingStore): Initialize the size.
+
+2011-10-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98803.
+        http://trac.webkit.org/changeset/98803
+        https://bugs.webkit.org/show_bug.cgi?id=71186
+
+        Causing test and assertion failures on some platforms
+        (Requested by anttik on #webkit).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyMatchedDeclarations):
+
+2011-10-29  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+
+2011-10-29  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+
+2011-10-29  Daniel Cheng  <dcheng@chromium.org>
+
+        Rename DataTransferItems to DataTransferItemList
+        https://bugs.webkit.org/show_bug.cgi?id=71151
+
+        Per feedback that Items and Item are hard to distinguish between, the HTML5 spec renamed
+        DataTransferItems to DataTransferItemList:
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html#the-datatransferitemlist-interface
+
+        Reviewed by Tony Chang.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Clipboard.h:
+        * dom/Clipboard.idl:
+        * dom/DataTransferItemList.cpp: Renamed from Source/WebCore/dom/DataTransferItems.cpp.
+        (WebCore::DataTransferItemList::DataTransferItemList):
+        (WebCore::DataTransferItemList::length):
+        (WebCore::DataTransferItemList::item):
+        (WebCore::DataTransferItemList::deleteItem):
+        (WebCore::DataTransferItemList::clear):
+        (WebCore::DataTransferItemList::add):
+        * dom/DataTransferItemList.h: Renamed from Source/WebCore/dom/DataTransferItems.h.
+        (WebCore::DataTransferItemList::~DataTransferItemList):
+        * dom/DataTransferItemList.idl: Renamed from Source/WebCore/dom/DataTransferItems.idl.
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::items):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/chromium/DataTransferItemListChromium.cpp: Renamed from Source/WebCore/platform/chromium/DataTransferItemsChromium.cpp.
+        (WebCore::DataTransferItemListChromium::create):
+        (WebCore::DataTransferItemListChromium::DataTransferItemListChromium):
+        (WebCore::DataTransferItemListChromium::addPasteboardItem):
+        * platform/chromium/DataTransferItemListChromium.h: Renamed from Source/WebCore/platform/chromium/DataTransferItemsChromium.h.
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::items):
+        * platform/qt/ClipboardQt.h:
+        * platform/qt/DataTransferItemListQt.cpp: Renamed from Source/WebCore/platform/qt/DataTransferItemsQt.cpp.
+        (WebCore::DataTransferItemListQt::create):
+        (WebCore::DataTransferItemListQt::DataTransferItemListQt):
+        (WebCore::DataTransferItemListQt::addPasteboardItem):
+        * platform/qt/DataTransferItemListQt.h: Renamed from Source/WebCore/platform/qt/DataTransferItemsQt.h.
+
+2011-10-03  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: block-non-replaced-width-008.htm
+        https://bugs.webkit.org/show_bug.cgi?id=69278
+
+        Reviewed by Simon Fraser.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalWidthUsing):
+          Include the margins in the calculation of logical width even when the containing block's
+          width is zero. This is required by section '10.3.3 Block-level, non-replaced elements in
+          normal flow' in the CSS 2.1 spec. Tested by block-non-replaced-width-008.htm in the CSS
+          test suite.
+
+2011-10-29  Anna Cavender  <annacc@chromium.org>
+
+        Make sure TextTracks are destructed if HTMLMediaElement goes away.
+        https://bugs.webkit.org/show_bug.cgi?id=71148
+
+        Reviewed by Eric Carlson.
+
+        Test: media/track/track-text-track-destructor-crash.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::~HTMLMediaElement):
+            Destroy the client (this) on TextTracks.
+        (WebCore::HTMLMediaElement::loadTextTracks):
+            Move TextTrack creation to loadNextTextTrack.
+        (WebCore::HTMLMediaElement::loadNextTextTrack):
+            Keep track of new TextTrack in a list.
+        (WebCore::HTMLMediaElement::addTrack):
+            Keep track of new TextTrack in a list.
+        * html/HTMLMediaElement.h:
+            Add m_textTracks and loadNextTextTrack().
+
+2011-10-29  Jochen Eisinger  <jochen@chromium.org>
+
+        Implement IDBFactory.deleteDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=62622
+
+        Reviewed by Tony Chang.
+
+        Tests: storage/indexeddb/factory-deletedatabase-interactions.html
+               storage/indexeddb/factory-deletedatabase.html
+
+        * storage/IDBBackingStore.h:
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::PendingDeleteCall::create):
+        (WebCore::IDBDatabaseBackendImpl::PendingDeleteCall::callbacks):
+        (WebCore::IDBDatabaseBackendImpl::PendingDeleteCall::PendingDeleteCall):
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        (WebCore::IDBDatabaseBackendImpl::openInternal):
+        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
+        (WebCore::IDBDatabaseBackendImpl::openConnection):
+        (WebCore::IDBDatabaseBackendImpl::deleteDatabase):
+        * storage/IDBDatabaseBackendImpl.h:
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::deleteDatabase):
+        * storage/IDBFactory.h:
+        * storage/IDBFactory.idl:
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::deleteDatabase):
+        * storage/IDBFactoryBackendImpl.h:
+        * storage/IDBFactoryBackendInterface.h:
+        * storage/IDBLevelDBBackingStore.cpp:
+        (WebCore::deleteRange):
+        (WebCore::IDBLevelDBBackingStore::deleteDatabase):
+        * storage/IDBLevelDBBackingStore.h:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::dispatchEvent):
+
+2011-10-28  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: dynamic-top-change-001 to 004 fail
+        https://bugs.webkit.org/show_bug.cgi?id=68149
+
+        Reviewed by David Hyatt.
+
+        In these tests a child inherits its top value from its parent and the parent's top value
+        is later updated by an onload event. The updated value is expected to cascade to the child.
+
+        The tests were failing because updating the value did not cascade immediately to the child inheriting it, though
+        it could be forced eventually with a full recalculation of the RenderStyle by changing the zoom factor
+        or opening the inspector.
+
+        The fix is to let the parent RenderStyle know that a child inherits a property explicitly and
+        recalculate children's style if the parent ever changes. This only happens if the property is inherited
+        explicitly, it does not apply to cases where the property is inherited by default.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setHasExplicitlyInheritedProperties):
+        (WebCore::InheritedFlags::hasExplicitlyInheritedProperties):
+
+2011-10-29  Antti Koivisto  <antti@apple.com>
+
+        Tighten font change conditions in matched declaration cache
+        https://bugs.webkit.org/show_bug.cgi?id=71026
+
+        Reviewed by Darin Adler.
+
+        We currently test if font description has changed to see if all properties need to be applied. However
+        only a few size related metrics can actually affect other properties. We can just test those, making 
+        the cache somewhat more effective while also making the equality test faster.
+        
+        * css/CSSStyleSelector.cpp:
+        (WebCore::fontDifferenceAffectsNonInherited):
+        (WebCore::CSSStyleSelector::applyMatchedDeclarations):
+    
+            Test for text computedSize, xHeight and orientation only. Other text properties don't affect computed
+            values of non-text CSS properties.
+
+2011-10-29  Adam Barth  <abarth@webkit.org>
+
+        DOMURL should keep its own state rather than storing it on ScriptExecutionContext
+        https://bugs.webkit.org/show_bug.cgi?id=71169
+
+        Reviewed by Eric Seidel.
+
+        This patch untwists this code.  I think this code was originally
+        twisted because these APIs moved onto DOMURL after they were first
+        implemented.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        * dom/ScriptExecutionContext.h:
+        * fileapi/FileWriter.h:
+        * html/DOMURL.cpp:
+        (WebCore::DOMURL::contextDestroyed):
+        (WebCore::DOMURL::createObjectURL):
+        (WebCore::DOMURL::revokeObjectURL):
+        * html/DOMURL.h:
+
+2011-10-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98795.
+        http://trac.webkit.org/changeset/98795
+        https://bugs.webkit.org/show_bug.cgi?id=71171
+
+        Causes worker tests to crash (Requested by abarth on #webkit).
+
+        * dom/ActiveDOMObject.cpp:
+        (WebCore::ContextDestructionObserver::contextDestroyed):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::contextDestroyed):
+        * dom/MessagePort.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::closeMessagePorts):
+
+2011-10-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Potential crash in ReplaceNodeWithSpanCommand
+        https://bugs.webkit.org/show_bug.cgi?id=71145
+
+        Reviewed by Ojan Vafai.
+
+        Fix a potential crash without tests because we don't have a reduction.
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        MessagePort should be a ContextDestructionObserver
+        https://bugs.webkit.org/show_bug.cgi?id=71167
+
+        Reviewed by Eric Seidel.
+
+        I couldn't quite get rid of all the uses of the
+        ScriptExecutionContext::m_messagePorts in this patch.  I hope to get
+        rid of them in the future as the "extra data" design for
+        ScriptExecutionContext emerges.
+
+        * dom/ActiveDOMObject.cpp:
+        (WebCore::ContextDestructionObserver::contextDestroyed):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::contextDestroyed):
+        * dom/MessagePort.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::closeMessagePorts):
+
+2011-10-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        The copy and paste result in nested scrollbars on http://dojotoolkit.org/widgets
+        https://bugs.webkit.org/show_bug.cgi?id=70799
+
+        Reviewed by Enrica Casucci.
+
+        The bug was caused by WebKit's treating a fully selected root with background property as a special common ancestor.
+        A variant of this bug was caused by treating any element with text-decoration property as a presentational element.
+
+        Fixed the above two bugs by not serializing the said nodes. The effective background color was already serialized
+        by wrappingStyleForSerialization, there was nothing to be done besides stop including it in highestAncestorToWrapMarkup.
+
+        For text-decoration property, added the logic to compute the effective value in EditingStyle::init. Also treat it
+        as a non-inheritable editing property so that the rest of EditingStyle just works.
+
+        Test: editing/pasteboard/avoid-copying-body-with-background.html
+
+        * editing/EditingStyle.cpp: Added CSSPropertyTextDecoration to the list of editing properties.
+        (WebCore::copyEditingProperties):
+        (WebCore::EditingStyle::init): Compute the effective text decoration when propertiesToInclude is
+        EditingPropertiesInEffect.
+        (WebCore::EditingStyle::prepareToApplyAt):
+        (WebCore::EditingStyle::mergeInlineStyleOfElement):
+        (WebCore::EditingStyle::wrappingStyleForSerialization):
+        (WebCore::EditingStyle::removeStyleFromRulesAndContext):
+        * editing/EditingStyle.h: Renamed EditingInheritablePropertiesAndBackgroundColorInEffect to
+        EditingPropertiesInEffect.
+        * editing/markup.cpp:
+        (WebCore::StyledMarkupAccumulator::appendStyleNodeOpenTag): Removed an assertion that's no longer valid.
+        (WebCore::isElementPresentational): Don't consider an element with text-decoration as a presentational element.
+        (WebCore::highestAncestorToWrapMarkup): Don't consider fully selected root as a special common ancestor ever.
+        Background color is computed property when we compute the wrapping style.
+        (WebCore::createMarkup):
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Rename ExceptionCodeDescription.in to DOMExceptions.in
+        https://bugs.webkit.org/show_bug.cgi?id=71157
+
+        Reviewed by Eric Seidel.
+
+        This file is now used for more than just the descriptions of the exceptions.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/action_makenames.py:
+        * dom/DOMExceptions.in: Copied from Source/WebCore/dom/ExceptionCodeDescription.in.
+        * dom/ExceptionCodeDescription.in: Removed.
+        * dom/make_dom_exceptions.pl: Copied from Source/WebCore/dom/make_exception_code_description.pl.
+        * dom/make_exception_code_description.pl: Removed.
+
+2011-10-28  Chris Rogers  <crogers@google.com>
+
+        SincResampler must be able to resample progressively
+        https://bugs.webkit.org/show_bug.cgi?id=71131
+
+        Reviewed by Kenneth Russell.
+
+        No new tests.  There is not yet an implementation using progressive resampling to test.
+
+        * platform/audio/SincResampler.cpp:
+        (WebCore::SincResampler::SincResampler):
+        (WebCore::SincResampler::consumeSource):
+        (WebCore::SincResampler::process):
+        * platform/audio/SincResampler.h:
+
+2011-10-28  Adam Klein  <adamk@chromium.org>
+
+        [MutationObservers] Support attributeOldValue for attribute mutations
+        https://bugs.webkit.org/show_bug.cgi?id=70861
+
+        Reviewed by Ryosuke Niwa.
+
+        Respect 'attributeOldValue' when passed to WebKitMutationObserver.observe().
+
+        If multiple observers have different attributeOldValue settings in
+        their registrations, two different MutationRecords are created (one is
+        a wrapper around the other).
+
+        If a single observer has multiple registrations that apply to a single
+        mutation, and those registrations have different values for
+        attributeOldValue, the observer is passed the oldValue.
+
+        * dom/Element.cpp:
+        (WebCore::hasOldValue):
+        (WebCore::enqueueAttributesMutationRecord):
+        (WebCore::Element::setAttribute):
+        * dom/MutationRecord.cpp:
+        (WebCore::MutationRecord::createAttributes):
+        (WebCore::MutationRecord::createWithNullOldValue):
+        * dom/MutationRecord.h:
+        (WebCore::MutationRecord::oldValue):
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Delete ExceptionCode.cpp, which is empty
+        https://bugs.webkit.org/show_bug.cgi?id=71159
+
+        Reviewed by Eric Seidel.
+
+        This file has been stripped down to nothing and can be removed.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/ExceptionCode.cpp: Removed.
+
+2011-10-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98776.
+        http://trac.webkit.org/changeset/98776
+        https://bugs.webkit.org/show_bug.cgi?id=71164
+
+        caused lots of test crashes (Requested by smfr on #webkit).
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateVisibilityStatus):
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::enableCompositingMode):
+
+2011-10-28  John Sullivan  <sullivan@apple.com>
+
+        Improvement to the fix for:
+        https://bugs.webkit.org/show_bug.cgi?id=71142
+        Whether backspace goes Back should be configurable
+
+        Reviewed by Dan Bernstein.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultBackspaceEventHandler):
+        Do the frame->settings() check after the !page check, since
+        a null page means null settings.
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Make DOMURL a ContextDestructionObserver
+        https://bugs.webkit.org/show_bug.cgi?id=71162
+
+        Reviewed by Eric Seidel.
+
+        This removes a bunch of hand-rolled ifdefed code.
+
+        * dom/ActiveDOMObject.h:
+            - One-argument constructors should be explicit.
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        * dom/ScriptExecutionContext.h:
+        * html/DOMURL.cpp:
+        (WebCore::DOMURL::DOMURL):
+        (WebCore::DOMURL::~DOMURL):
+        * html/DOMURL.h:
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Factor ContextDestructionObserver out of ActiveDOMObject
+        https://bugs.webkit.org/show_bug.cgi?id=71153
+
+        Reviewed by Sam Weinig.
+
+        This patch paves the way to make more objects observe the destruction
+        of ScriptExecutioContext without needing to add ifdefs to
+        ScriptExecutionContext.h/cpp.  (As an example, see DOMURL.)
+
+        * dom/ActiveDOMObject.cpp:
+        (WebCore::ContextDestructionObserver::ContextDestructionObserver):
+        (WebCore::ContextDestructionObserver::~ContextDestructionObserver):
+        (WebCore::ContextDestructionObserver::contextDestroyed):
+        (WebCore::ActiveDOMObject::ActiveDOMObject):
+        (WebCore::ActiveDOMObject::~ActiveDOMObject):
+        * dom/ActiveDOMObject.h:
+        (WebCore::ContextDestructionObserver::scriptExecutionContext):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::didCreateActiveDOMObject):
+        (WebCore::ScriptExecutionContext::willDestroyActiveDOMObject):
+        (WebCore::didCreateDestructionObserver):
+        (WebCore::willDestroyDestructionObserver):
+        * dom/ScriptExecutionContext.h:
+
+2011-10-28  Tim Horton  <timothy_horton@apple.com>
+
+        One more unreviewed build fix due to r98775.
+
+        No new tests.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2011-10-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Track wheel event handler registration and pass to input filter
+        https://bugs.webkit.org/show_bug.cgi?id=71078
+
+        Reviewed by Kenneth Russell.
+
+        This propagates mouse wheel registration notifications to the compositor input filter. If there are any handlers
+        registered, which includes JS handlers and scrollable areas other than the main view, the input filter will pass
+        mouse wheel events to the widget. Otherwise when threaded compositing is enabled the input filter translates
+        wheel events into root layer scrolling.
+
+        Only changes behavior with an off-by-default flag enabled, so no tests.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setHaveWheelEventHandlers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::haveWheelEventHandlers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore::CCLayerTreeHostImpl::setHaveWheelEventHandlers):
+        * platform/graphics/chromium/cc/CCScrollController.h:
+
+2011-10-28  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed build fix due to r98775.
+
+        No new tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+
+2011-10-28  Simon Fraser  <simon.fraser@apple.com>
+
+        If visibility changes while an accelerated animation is running, element jumps around
+        https://bugs.webkit.org/show_bug.cgi?id=29984
+
+        Reviewed by Chris Marrin.
+        
+        Compositing now affects whether RenderLayers for visibility:hidden elements
+        are included in z-order lists. So we have to dirty those lists when we enter
+        compopsiting mode.
+
+        Test: compositing/visibility/animation-visibility.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateVisibilityStatus): Removed trailing whitespace.
+        (WebCore::RenderLayer::dirtyZOrderLists): Call dirtyZOrderListsInternal(), which doesn't have
+        to ping the compositor.
+        (WebCore::RenderLayer::dirtyZOrderListsInternal):
+        (WebCore::RenderLayer::dirtyZOrderListsIncludingDescendants): Recursively dirty z-order
+        lists.
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::enableCompositingMode): When going into compositing mode,
+        dirty all z-order lists.
+
+2011-10-28  Tim Horton  <timothy_horton@apple.com>
+
+        Implement CSS3 Images cross-fade() image function
+        https://bugs.webkit.org/show_bug.cgi?id=52162
+        <rdar://problem/10209254>
+
+        Reviewed by Simon Fraser.
+
+        Parse -webkit-cross-fade according to the CSS3 Images Values specification.
+
+        Also, adjust other CSS parsing functions to support nested functions, by using a specific CSS value list
+        instead of the global one. This allows - for example - cross-fade to pass each of its arguments back into
+        parseFillImage and to successfully parse image functions in this fashion.
+
+        Test: fast/css/getComputedStyle/computed-style-cross-fade.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSCrossfadeValue.cpp: Added.
+        (WebCore::CSSCrossfadeValue::~CSSCrossfadeValue):
+        (WebCore::CSSCrossfadeValue::cssText):
+        (WebCore::CSSCrossfadeValue::fixedSize):
+        (WebCore::CSSCrossfadeValue::image):
+        * css/CSSCrossfadeValue.h: Added.
+        (WebCore::CSSCrossfadeValue::create):
+        (WebCore::CSSCrossfadeValue::isFixedSize):
+        (WebCore::CSSCrossfadeValue::setFromImage):
+        (WebCore::CSSCrossfadeValue::setToImage):
+        (WebCore::CSSCrossfadeValue::setPercentage):
+        (WebCore::CSSCrossfadeValue::CSSCrossfadeValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseContent):
+        (WebCore::CSSParser::parseFillImage):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::CSSParser::parseBorderImage):
+        (WebCore::CSSParser::parseDeprecatedGradient):
+        (WebCore::CSSParser::parseLinearGradient):
+        (WebCore::CSSParser::parseRadialGradient):
+        (WebCore::CSSParser::isGeneratedImageValue):
+        (WebCore::CSSParser::parseGeneratedImage):
+        (WebCore::CSSParser::parseCrossfade):
+        (WebCore::CSSParser::parseCanvas):
+        * css/CSSParser.h:
+
+2011-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Attempted build fix after r98765.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2011-10-28  Chris Marrin  <cmarrin@apple.com>
+
+        CSS grammar doesn't support functions with no parameters
+        https://bugs.webkit.org/show_bug.cgi?id=69110
+
+        Reviewed by Dean Jackson.
+
+        Add rule to grammar to accept functions with 0 args and return
+        this case with a CSSParserValueList with 0 values. Also fixed
+        filter creation function to properly handle filters with 0
+        arguments.
+
+        * css/CSSGrammar.y:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::createFilterOperations):
+
+2011-10-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98757.
+        http://trac.webkit.org/changeset/98757
+        https://bugs.webkit.org/show_bug.cgi?id=71150
+
+        crashes webkit_unit_tests on chromium windows (Requested by
+        johnny_g on #webkit).
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayersOntoRenderSurfaces):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Fix namespace indent in ScriptExecutionContext.h.
+
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::isDocument):
+        (WebCore::ScriptExecutionContext::isWorkerContext):
+        (WebCore::ScriptExecutionContext::setHasOpenDatabases):
+        (WebCore::ScriptExecutionContext::hasOpenDatabases):
+        (WebCore::ScriptExecutionContext::url):
+        (WebCore::ScriptExecutionContext::completeURL):
+        (WebCore::ScriptExecutionContext::securityOrigin):
+        (WebCore::ScriptExecutionContext::contentSecurityPolicy):
+        (WebCore::ScriptExecutionContext::activeDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendScriptedAnimationControllerCallbacks):
+        (WebCore::ScriptExecutionContext::resumeScriptedAnimationControllerCallbacks):
+        (WebCore::ScriptExecutionContext::messagePorts):
+        (WebCore::ScriptExecutionContext::domUrls):
+        (WebCore::ScriptExecutionContext::ref):
+        (WebCore::ScriptExecutionContext::deref):
+        (WebCore::ScriptExecutionContext::Task::Task):
+        (WebCore::ScriptExecutionContext::Task::isCleanupTask):
+
+2011-10-28  John Sullivan  <sullivan@apple.com>
+
+        WebCore part of:
+        https://bugs.webkit.org/show_bug.cgi?id=71142
+        Whether backspace goes Back should be configurable
+
+        Reviewed by Sam Weinig.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultBackspaceEventHandler):
+        Bail out if backspace navigation is not enabled.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        Initialize m_backspaceKeyNavigationEnabled to true to match current behavior.
+
+        * page/Settings.h:
+        Declared m_backspaceKeyNavigationEnabled.
+        (WebCore::Settings::setBackspaceKeyNavigationEnabled):
+        New function, simple setter.
+        (WebCore::Settings::backspaceKeyNavigationEnabled):
+        New function, simple getter.
+
+2011-10-28  Emil A Eklund  <eae@chromium.org>
+
+        Overridden clippedOverflowRectForRepaint() still uses IntRects
+        https://bugs.webkit.org/show_bug.cgi?id=71046
+
+        Reviewed by Simon Fraser.
+
+        Change all virtual clippedOverflowRectForRepaint functions to use the
+        same signature.
+
+        No new tests.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::rectWithOutlineForRepaint):
+        (WebCore::RenderObject::clippedOverflowRectForRepaint):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::clippedOverflowRectForRepaint):
+        * rendering/RenderText.h:
+
+2011-10-28  Adam Klein  <adamk@chromium.org>
+
+        Remove unused parsers for 'exception' and 'alias' IDL keywords
+        https://bugs.webkit.org/show_bug.cgi?id=71140
+
+        Reviewed by Adam Barth.
+
+        * bindings/scripts/IDLParser.pm:
+        (ParseInterface):
+        (DetermineParseMode):
+        (ProcessSection):
+        * bindings/scripts/IDLStructure.pm:
+
+2011-10-28  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10288006> Emoji characters are too close to each other in small font size
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformWidthForGlyph): If the font is a color bitmap font, use
+        -[NSFont advancementForGlyph:] instead of wkGetGlyphTransformedAdvances().
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Remove unused default constructor
+        https://bugs.webkit.org/show_bug.cgi?id=71136
+
+        Reviewed by Eric Seidel.
+
+        No one is calling this constructor anymore now that we've fixed the
+        callers.
+
+        * dom/make_exception_code_description.pl:
+        (generateHeader):
+
+2011-10-28  Ken Buchanan <kenrb@chromium.org>
+
+        Crash when splitting inline flows with generated floats
+        https://bugs.webkit.org/show_bug.cgi?id=70458
+
+        Reviewed by David Hyatt.
+
+        When lineBoxes on a RenderBlock are being deleted, we now check the floating object list to
+        ensure references to them are being cleared.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::deleteLineBoxTree): Remove references to lineBox when deleting them
+
+2011-10-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Remove Leopard-only code from GraphicsLayerCA
+        https://bugs.webkit.org/show_bug.cgi?id=71141
+
+        Reviewed by Chris Marrin.
+
+        Remove !HAVE_MODERN_QUARTZCORE code, which was only
+        used on Leopard. updateContentsTransform() became a no-op,
+        so could be removed.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::getValueFunctionNameForTransformOperation):
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::addAnimation):
+        (WebCore::GraphicsLayerCA::updateGeometry):
+        (WebCore::GraphicsLayerCA::setTransformAnimationEndpoints):
+        (WebCore::GraphicsLayerCA::setTransformAnimationKeyframes):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::defaultContentsOrientation):
+        (WebCore::GraphicsLayerCA::updateOpacityOnLayer):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+
+2011-10-28  Adrienne Walker  <enne@google.com>
+
+        [chromium] Implicitly skip render surfaces that won't be drawn
+        https://bugs.webkit.org/show_bug.cgi?id=71038
+
+        Rather than having redundant checks in three places for how to walk
+        through a render surface list, instead don't add render surfaces that
+        don't need to get rendered to the render surface list.
+
+        Reviewed by James Robinson.
+
+        Covered by existing layout tests.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayersOntoRenderSurfaces):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Autogenerate Exception-downcast code in bindings
+        https://bugs.webkit.org/show_bug.cgi?id=71108
+
+        Reviewed by Eric Seidel.
+
+        This patch uses the same generated code style as we're using for Events
+        to generate the downcasts for the Exception types in the bindings.
+        This cause me to refactor more code from make_event_factory.pl into
+        InFilesCompiler.pm.
+
+        After this patch, some of these files and scripts are misnamed.  I'll
+        rename them in a followup patch.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException):
+        * bindings/objc/ExceptionHandlers.mm:
+        (WebCore::raiseDOMException):
+        * bindings/scripts/InFilesCompiler.pm:
+        (initializeFromCommandLine):
+        (compile):
+        (interfaceForItem):
+        (toMacroStyle):
+        (generateInterfacesHeader):
+        (generateHeadersHeader):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+        * dom/ExceptionCodeDescription.in:
+        * dom/make_event_factory.pl:
+        (generateCode):
+        (generateImplementation):
+        * dom/make_exception_code_description.pl:
+        (defaultItemFactory):
+        (generateCode):
+
+2011-10-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix builds which have ACCELERATED_COMPOSITING disabled.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateZOrderLists):
+
+2011-10-28  Erik Arvidsson  <arv@chromium.org>
+
+        Remove LegacyDefaultOptionalArguments flag from inspector IDLs
+        https://bugs.webkit.org/show_bug.cgi?id=65748
+
+        Reviewed by Adam Barth.
+
+        Covered by existing tests.
+
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/JavaScriptCallFrame.idl:
+
+2011-10-28  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Database metadata changes should be tied to transaction
+        https://bugs.webkit.org/show_bug.cgi?id=70974
+
+        Reviewed by Tony Chang.
+
+        Database metadata (that is, the version string) was rolled back
+        on abort by an abort task. If the abort task didn't run e.g.
+        due to a crash, the metadata would not be reverted. All of the
+        other store/index/data changes were written into the transaction
+        itself, so the metadata now is too. Refactored the metadata
+        get/create/update methods for clarity as well.
+
+        Note that the new tests don't actually verify that the code handles
+        this case; that will need to be done with persistence tests
+        that span multiple runs of the browser and induce crashes.
+        The new tests do verify that these changes don't cause regressions
+        not caught by other tests.
+
+        Tests: storage/indexeddb/open-during-transaction.html
+               storage/indexeddb/version-change-abort.html
+
+        * storage/IDBBackingStore.h:
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        (WebCore::IDBDatabaseBackendImpl::setVersionInternal):
+        * storage/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::getIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::createIDBDatabaseMetaData):
+        (WebCore::IDBLevelDBBackingStore::updateIDBDatabaseMetaData):
+        * storage/IDBLevelDBBackingStore.h:
+
+2011-10-28  Luke Macpherson   <macpherson@chromium.org>
+
+        Use enum instead of bool to represent -webkit-column-span property.
+        https://bugs.webkit.org/show_bug.cgi?id=70867
+
+        Reviewed by Darin Adler.
+
+        Covered by existing tests.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ColumnSpan):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousColumnSpanBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::propagateStyleToAnonymousChildren):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::columnSpan):
+        (WebCore::InheritedFlags::setColumnSpan):
+        (WebCore::InheritedFlags::initialColumnSpan):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleMultiColData.h:
+
+2011-10-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize isGlobalObject, isVariableObject, isActivationObject, and isErrorInstance in JSObject
+        https://bugs.webkit.org/show_bug.cgi?id=70968
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        * bindings/js/JSDOMGlobalObject.h: Changed JSType provided to TypeInfo in createStructure since this 
+        class inherits from JSGlobalObject. 
+        (WebCore::JSDOMGlobalObject::createStructure):
+        * bindings/js/JSDOMWindowBase.h: Ditto
+        (WebCore::JSDOMWindowBase::createStructure):
+        * bindings/js/JSWorkerContextBase.h: Ditto
+        (WebCore::JSWorkerContextBase::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm: Added extra check to make sure subclasses of JSGlobalObject,
+        namely JSDOMWindow and JSWorkerContext, get their special JSType in their createStructure function.
+        (GenerateHeader):
+
+2011-10-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98736.
+        http://trac.webkit.org/changeset/98736
+        https://bugs.webkit.org/show_bug.cgi?id=71125
+
+        This patch broke perf/array-binary-search.html test (Requested
+        by annacc on #webkit).
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadTextTracks):
+        (WebCore::HTMLMediaElement::addTrack):
+        * html/HTMLMediaElement.h:
+        * html/HTMLTrackElement.cpp:
+        (WebCore::HTMLTrackElement::insertedIntoTree):
+        (WebCore::HTMLTrackElement::willRemove):
+        * html/HTMLTrackElement.h:
+        * html/LoadableTextTrack.cpp:
+        (WebCore::LoadableTextTrack::cueLoadingCompleted):
+
+2011-10-28  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        RenderTableSection::recalcCells should not free its grid
+        https://bugs.webkit.org/show_bug.cgi?id=71056
+
+        Reviewed by Darin Adler.
+
+        Refactoring only, no change in behavior.
+
+        r98614 had the bad side effect of clearing the row vector (m_grid) on
+        the RenderTableSection when doing a recalcCells. This change removes the
+        unneeded free and inline the |row| field into the RowStruct as it made
+        no sense to have it as a pointer.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::setRowLogicalHeightToRowStyleLogicalHeightIfNotRelative):
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::setCellLogicalWidths):
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        (WebCore::RenderTableSection::firstLineBoxBaseline):
+        (WebCore::RenderTableSection::appendColumn):
+        (WebCore::RenderTableSection::splitColumn):
+        Mechanical changes now that |row| is a member of RowStruct.
+
+        (WebCore::RenderTableSection::~RenderTableSection): Clear our row vector.
+
+        (WebCore::RenderTableSection::ensureRows):
+        (WebCore::RenderTableSection::recalcCells):
+        Those 2 functions were refactored to use fillRowsWithDefaultStartingAtPosition.
+
+        (WebCore::RenderTableSection::fillRowsWithDefaultStartingAtPosition):
+        Factored the code to fill the RowStruct structure with default values.
+
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::cellAt):
+        (WebCore::RenderTableSection::primaryCellAt):
+        More mechanical change after the |row| field change.
+
+2011-10-28  Anna Cavender  <annacc@chromium.org>
+
+        Implement load notification and events for <track>.
+        https://bugs.webkit.org/show_bug.cgi?id=71054
+
+        Reviewed by Eric Carlson.
+
+        Tests: media/track/track-load-error-readyState.html
+               media/track/track-load-from-element-readyState.html
+               media/track/track-load-from-src-readyState.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadTextTracks):
+        (WebCore::HTMLMediaElement::loadNextTextTrack):
+        (WebCore::HTMLMediaElement::trackWasAdded):
+        (WebCore::HTMLMediaElement::trackWillBeRemoved):
+        (WebCore::HTMLMediaElement::trackSourceChanged):
+        * html/HTMLMediaElement.h:
+        * html/HTMLTrackElement.cpp:
+        (WebCore::HTMLTrackElement::insertedIntoTree):
+        (WebCore::HTMLTrackElement::willRemove):
+        (WebCore::HTMLTrackElement::parseMappedAttribute):
+        (WebCore::HTMLTrackElement::attributeChanged):
+        * html/HTMLTrackElement.h:
+        * html/LoadableTextTrack.cpp:
+        (WebCore::LoadableTextTrack::cueLoadingCompleted):
+
+2011-10-28  Simon Fraser  <simon.fraser@apple.com>
+
+        The HTML5 video element in Safari does not respect "visibility:hidden" CSS property
+        https://bugs.webkit.org/show_bug.cgi?id=38829
+
+        Reviewed by James Robinson.
+        
+        Make compositing and CSS visibility play nicely together.
+        
+        The main issue was that an old optimization (see bug 4377) caused
+        visibility:hidden layers to not appear in the z-order lists, but those
+        layers could still become composited, but would remain detached. In addition,
+        composited layers which were visibility:hidden would become visible sometimes.
+        
+        With this fix, the z-order lists always contain all layers when the page
+        is in compositing mode. GraphicsLayer is changed to ensure that visibility:hidden
+        layers show no content, and visible descendants of hidden layers work correctly.
+
+        Tests: compositing/visibility/visibility-composited-transforms.html
+               compositing/visibility/visibility-composited.html
+               compositing/visibility/visibility-image-layers-dynamic.html
+               compositing/visibility/visibility-image-layers.html
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer): Init m_contentsVisible to true.
+        (WebCore::GraphicsLayer::dumpProperties): Dump m_contentsVisible if not true.
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::contentsAreVisible): Getter for m_contentsVisible.
+        (WebCore::GraphicsLayer::setContentsVisible): Setter for m_contentsVisible.
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::setContentsVisible): Override setContentsVisible.
+        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers): Handle ContentsVisibilityChanged
+        flag
+        (WebCore::GraphicsLayerCA::updateSublayerList): Only parent the m_contentsLayer if the layer
+        has visible contents.
+        (WebCore::GraphicsLayerCA::updateContentsVisibility): For bits painted into the layer itself,
+        we hide it by clearing the backing store.
+        * platform/graphics/ca/GraphicsLayerCA.h: Removed obsolete comment on the DrawsContentChanged flag,
+        added ContentsVisibilityChanged flag.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateZOrderLists): If we're in compositing mode, include all layers
+        in the z-order lists.
+        (WebCore::RenderLayer::collectLayers): New param to specify whether we need to collect all layers.
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasVisibleDescendant): Add comment about the need for an assertion in hasVisibleContent()
+        , and assertion in hasVisibleDescendant().
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Call setContentsVisible() on the GraphicsLayer.
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): We can use simple container layers in cases
+        where visibility:hidden causes layer content to not be drawn.
+        (WebCore::RenderLayerBacking::hasVisibleNonCompositingDescendants): Renamed from hasNonCompositingDescendants()
+        because it now also looks at visibility to decide when things are visible.
+        * rendering/RenderLayerBacking.h: hasNonCompositingDescendants() renamed to hasVisibleNonCompositingDescendants().
+
+2011-10-22  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] Build fixes for glib 2.31 (current master)
+        https://bugs.webkit.org/show_bug.cgi?id=70679
+
+        Reviewed by Martin Robinson.
+
+        g_cond_new and g_mutex_new have been replaced by _init
+        functions. Same for _free, replaced by _clear.
+
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_init):
+        (webkit_video_sink_dispose):
+
+2011-10-28  Jochen Eisinger  <jochen@chromium.org>
+
+        Rename a number of methods mentioning JavaScript to just Script instead
+        https://bugs.webkit.org/show_bug.cgi?id=71105
+
+        Reviewed by Adam Barth.
+
+        * WebCore.exp.in:
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::canExecuteScripts):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::handleOutOfMemory):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowScript):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setScriptEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::isScriptEnabled):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2011-10-28  Pavel Feldman  <pfeldman@google.com>
+
+        Reset line numbers for scripts generated with document.write.
+        https://bugs.webkit.org/show_bug.cgi?id=71099
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: http/tests/inspector-enabled/document-write.html
+
+        * dom/Document.h:
+        (WebCore::Document::isInDocumentWrite):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::prepareScript):
+
+2011-10-28  Adam Roben  <aroben@apple.com>
+
+        Mac build fix after r98711
+
+        * WebCore.xcodeproj/project.pbxproj: Mark ExceptionCodeDescription.h private so WebKit can
+        find it.
+
+2011-10-28  Antti Koivisto  <antti@apple.com>
+
+        [Chromium] css3/font-feature-settings-rendering.html has incorrect image result after r98542
+        https://bugs.webkit.org/show_bug.cgi?id=71019
+
+        Reviewed by Andreas Kling.
+        
+        These properties need to be marked inherited too.
+        
+        Note that the new test case doesn't fail even without the patch. If I understand correctly
+        the image test in the title is pretty much the only way to see this. However the
+        new test improves code coverage and protects against future regressions.
+
+        Test: fast/css/inherited-properties-rare-text.html
+
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Remove getExceptionCodeDescription()
+        https://bugs.webkit.org/show_bug.cgi?id=71103
+
+        Reviewed by Eric Seidel.
+
+        This function serves no purpose.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException):
+        * bindings/objc/ExceptionHandlers.mm:
+        (WebCore::raiseDOMException):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        ():
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_method_that_requires_all_args_and_throws):
+        (webkit_dom_test_obj_method_with_exception):
+        (webkit_dom_test_obj_with_script_state_void_exception):
+        (webkit_dom_test_obj_with_script_state_obj_exception):
+        (webkit_dom_test_obj_get_attr_with_getter_exception):
+        (webkit_dom_test_obj_set_attr_with_getter_exception):
+        (webkit_dom_test_obj_set_attr_with_setter_exception):
+        (webkit_dom_test_obj_set_string_attr_with_getter_exception):
+        (webkit_dom_test_obj_set_string_attr_with_setter_exception):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+        * dom/ExceptionCode.cpp:
+        * dom/ExceptionCode.h:
+
+2011-10-19  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: CSS background-image applied inline shows a warning, but still works.
+        https://bugs.webkit.org/show_bug.cgi?id=70325
+
+        Reviewed by Antti Koivisto.
+
+        This change eliminates the "non-parsed property" warning displayed next to any
+        "background-image" property of an element's inline style.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseDeclaration):
+        * css/CSSParser.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::setPropertyText):
+        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fixenate Qt.
+
+        * CodeGenerators.pri:
+        * dom/make_event_factory.pl:
+        (toMacroStyle):
+
+2011-10-28  Adam Barth  <abarth@webkit.org>
+
+        ExceptionCode.cpp shouldn't need to know about every feature that throws exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=70890
+
+        Reviewed by Eric Seidel.
+
+        Generate the feature-specific parts of ExceptionCode.cpp from a ".in"
+        file.  This is an incremental step towards inlining
+        getExceptionCodeDescription into its callers and replacing the switch
+        statements at those locations with autogenerated code.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/action_makenames.py:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setDOMException):
+        * dom/DOMCoreException.cpp:
+        (WebCore::DOMCoreException::initializeDescription):
+        * dom/ExceptionCode.cpp:
+        (WebCore::getExceptionCodeDescription):
+        * dom/ExceptionCode.h:
+        * dom/ExceptionCodeDescription.in: Added.
+        * dom/make_exception_code_description.pl: Added.
+        (defaultItemFactory):
+        (generateCode):
+        (generateHeader):
+        (generateImplementation):
+
+2011-10-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: CallStackSidebarPane should remove discarded Placards from RawSourceCode listeners list
+        https://bugs.webkit.org/show_bug.cgi?id=70996
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/debugger/callstack-placards-discarded.html
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.createPlacard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype.discard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype._update):
+        * inspector/front-end/Placard.js:
+        (WebInspector.Placard.prototype.toggleSelected):
+        (WebInspector.Placard.prototype.discard):
+
+2011-10-28  Jochen Eisinger  <jochen@chromium.org>
+
+        Add allowScriptFromSource callback to FrameLoaderClient
+        https://bugs.webkit.org/show_bug.cgi?id=71013
+
+        Reviewed by Darin Fisher.
+
+        Test: platform/chromium/permissionclient/script-permissions.html
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowScriptFromSource):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+
+2011-10-27  Adam Barth  <abarth@webkit.org>
+
+        Refactor make_event_factory.pl to use InFilesCompiler.pm
+        https://bugs.webkit.org/show_bug.cgi?id=71094
+
+        Reviewed by Eric Seidel.
+
+        This refactoring helps share code with
+        make_exception_code_descriptions.pl, which is coming in a future patch.
+        I have a dream of refactoring make_names.pl to use this module as well.
+
+        * CodeGenerators.pri:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/scripts/action_makenames.py:
+        * bindings/scripts/InFilesCompiler.pm: Added.
+        (itemHandler):
+        (parameterHandler):
+        (new):
+        (compile):
+        (license):
+        * dom/make_event_factory.pl:
+        (defaultItemFactory):
+        (interfaceForEvent):
+        (generateCode):
+        (printFactoryFile):
+        (printMacroFile):
+        (printHeadersFile):
+
+2011-10-26  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Implement frame rate control portions of CCScheduler
+        https://bugs.webkit.org/show_bug.cgi?id=70713
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp: Added.
+        (WebCore::CCDelayBasedTimeSource::setActive):
+        (WebCore::CCDelayBasedTimeSource::postTickTask):
+        (WebCore::CCDelayBasedTimeSource::onTick):
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.h: Added.
+        (WebCore::CCDelayBasedTimeSource::CCDelayBasedTimeSource):
+        (WebCore::CCDelayBasedTimeSource::~CCDelayBasedTimeSource):
+        (WebCore::CCDelayBasedTimeSource::setClient):
+        (WebCore::CCDelayBasedTimeSource::monotonicallyIncreasingTime):
+        * platform/graphics/chromium/cc/CCFrameRateController.cpp: Added.
+        (WebCore::CCFrameRateControllerTimeSourceAdapter::create):
+        (WebCore::CCFrameRateControllerTimeSourceAdapter::~CCFrameRateControllerTimeSourceAdapter):
+        (WebCore::CCFrameRateControllerTimeSourceAdapter::onTimerTick):
+        (WebCore::CCFrameRateControllerTimeSourceAdapter::CCFrameRateControllerTimeSourceAdapter):
+        (WebCore::CCFrameRateController::CCFrameRateController):
+        (WebCore::CCFrameRateController::~CCFrameRateController):
+        (WebCore::CCFrameRateController::onTimerTick):
+        (WebCore::CCFrameRateController::didBeginFrame):
+        (WebCore::CCFrameRateController::didFinishFrame):
+        (WebCore::CCFrameRateController::didAbortAllPendingFrames):
+        * platform/graphics/chromium/cc/CCFrameRateController.h: Added.
+        (WebCore::CCFrameRateControllerClient::~CCFrameRateControllerClient):
+        (WebCore::CCFrameRateController::setClient):
+        (WebCore::CCFrameRateController::setActive):
+        * platform/graphics/chromium/cc/CCTimeSource.h: Added.
+        (WebCore::CCTimeSourceClient::~CCTimeSourceClient):
+        (WebCore::CCTimeSource::~CCTimeSource):
+
+2011-10-27  Kentaro Hara  <haraken@chromium.org>
+
+        Deprecate [V8ConstructorSetsActiveDOMWrapper] IDL
+        https://bugs.webkit.org/show_bug.cgi?id=71088
+
+        Reviewed by Adam Barth.
+
+        I introduced [V8ConstructorSetsActiveDOMWrapper] IDL in bug 66536,
+        but I found that it has the same meaning as [ActiveDOMObject] IDL.
+        This patch removes [V8ConstructorSetsActiveDOMWrapper] IDL.
+
+        No change in behavior.
+
+        Tests: fast/dom/global-constructors.html
+               fast/eventsource/eventsource-constructor.html
+               fast/eventsource/eventsource-attribute-listeners.html
+               fast/files/blob-slice-test.html
+               fast/files/file-reader-abort.html
+               ui_tests:WorkerTest.FLAKY_SharedWorkerFastConstructor
+               ui_tests:WorkerTest.FLAKY_SharedWorkerFastName
+               ui_tests:WorkerTest.FLAKY_WorkerConstructor
+               ui_tests:WorkerTest.FLAKY_WorkerEventListener
+
+        * bindings/scripts/CodeGeneratorV8.pm: Replaced "V8ConstructorSetsActiveDOMWrapper" with "ActiveDOMObject".
+        (GenerateConstructorCallback):
+        * bindings/scripts/test/TestInterface.idl: Ditto.
+        * bindings/scripts/test/JS/JSTestInterface.cpp: Updated a test result.
+        (WebCore::isObservable):
+        (WebCore::JSTestInterfaceOwner::isReachableFromOpaqueRoots):
+        (WebCore::JSTestInterfaceOwner::finalize):
+        * bindings/scripts/test/JS/JSTestInterface.h: Ditto.
+        (WebCore::wrapperOwner):
+        (WebCore::wrapperContext):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp: Ditto.
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h: Ditto.
+        * bindings/scripts/test/JS/JSTestObj.cpp: Ditto.
+        * bindings/scripts/test/JS/JSTestObj.h: Ditto.
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp: Ditto.
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h: Ditto.
+        * bindings/scripts/test/V8/V8TestInterface.cpp: Ditto.
+        (WebCore::V8TestInterface::toActiveDOMObject):
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestInterface.h: Ditto.
+        (WebCore::V8TestInterface::existingWrapper):
+        * fileapi/FileReader.idl: Removed [V8ConstructorSetsActiveDOMWrapper] IDL.
+        * mediastream/PeerConnection.idl: Ditto.
+        * page/EventSource.idl: Ditto.
+        * workers/SharedWorker.idl: Ditto.
+        * workers/Worker.idl: Ditto.
+
+2011-10-28  Yuta Kitamura  <yutak@chromium.org>
+
+        Race condition in SocketStreamHandleCFNet when PAC script is used
+        https://bugs.webkit.org/show_bug.cgi?id=70894
+
+        Reviewed by Alexey Proskuryakov.
+
+        Pass callback functions that call ref() or deref() as retain/release member
+        of CFStreamClientContext.
+
+        No new tests, as it is not possible to write a test with PAC script enabled.
+
+        * platform/network/cf/SocketStreamHandle.h:
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::scheduleStreams):
+        (WebCore::SocketStreamHandle::retainSocketStreamHandle):
+        (WebCore::SocketStreamHandle::releaseSocketStreamHandle):
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread):
+        This callback may be called after platformClose() is already called. We should
+        not create new streams in this case.
+        (WebCore::SocketStreamHandle::executePACFileURL):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        This manual ref/deref can be safely removed as m_readStream holds the reference.
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        Ditto.
+
+2011-10-27  Arthur Hsu  <arthurhsu@chromium.org>
+
+        Reland patch ensure font load before calling Skia during printing
+        https://bugs.webkit.org/show_bug.cgi?id=70390
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::paintSkiaText):
+
+2011-10-27  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Qt build.
+
+        * WebCore.pro:
+
+2011-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        binding test rebaseline after r98679.
+
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::constructJSTestInterface):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::jsTestMediaQueryListListenerPrototypeFunctionMethod):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::setJSTestObjStringAttr):
+        (WebCore::setJSTestObjStringAttrWithGetterException):
+        (WebCore::setJSTestObjStringAttrWithSetterException):
+        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionIntMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgs):
+        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
+        (WebCore::jsTestObjPrototypeFunctionSerializedValue):
+        (WebCore::jsTestObjPrototypeFunctionIdbKey):
+        (WebCore::jsTestObjPrototypeFunctionOptionsObject):
+        (WebCore::jsTestObjPrototypeFunctionCustomArgsAndException):
+        (WebCore::jsTestObjPrototypeFunctionWithDynamicFrameAndArg):
+        (WebCore::jsTestObjPrototypeFunctionWithDynamicFrameAndOptionalArg):
+        (WebCore::jsTestObjPrototypeFunctionWithDynamicFrameAndUserGesture):
+        (WebCore::jsTestObjPrototypeFunctionWithDynamicFrameAndUserGestureASAD):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod3):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
+        (WebCore::jsTestObjPrototypeFunctionClassMethodWithOptional):
+
+2011-10-27  Adam Barth  <abarth@webkit.org>
+
+        Move type-specific exception descriptions into the implementation files for each type
+        https://bugs.webkit.org/show_bug.cgi?id=71081
+
+        Reviewed by Eric Seidel.
+
+        There's no reason to centralize this information.  It belongs with each
+        exception type.  This patch is in preparation for autogenerating the central file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMCoreException.cpp: Added.
+        (WebCore::DOMCoreException::initializeDescription):
+        * dom/DOMCoreException.h:
+        * dom/EventException.cpp: Copied from Source/WebCore/xml/XMLHttpRequestException.h.
+        (WebCore::EventException::initializeDescription):
+        * dom/EventException.h:
+        * dom/ExceptionBase.h:
+        (WebCore::ExceptionBase::code):
+        (WebCore::ExceptionBase::name):
+        (WebCore::ExceptionBase::message):
+        (WebCore::ExceptionBase::description):
+        * dom/ExceptionCode.cpp:
+        (WebCore::getExceptionCodeDescription):
+        * dom/RangeException.cpp: Copied from Source/WebCore/xml/XPathException.h.
+        (WebCore::RangeException::initializeDescription):
+        * dom/RangeException.h:
+        * fileapi/FileException.cpp: Added.
+        (WebCore::FileException::initializeDescription):
+        * fileapi/FileException.h:
+        * fileapi/OperationNotAllowedException.cpp: Copied from Source/WebCore/xml/XMLHttpRequestException.h.
+        (WebCore::OperationNotAllowedException::initializeDescription):
+        * fileapi/OperationNotAllowedException.h:
+        * storage/IDBDatabaseException.cpp: Added.
+        (WebCore::IDBDatabaseException::initializeDescription):
+        * storage/IDBDatabaseException.h:
+        * storage/SQLException.cpp: Added.
+        (WebCore::SQLException::initializeDescription):
+        * storage/SQLException.h:
+        * svg/SVGException.cpp: Copied from Source/WebCore/dom/EventException.h.
+        (WebCore::SVGException::initializeDescription):
+        * svg/SVGException.h:
+        * xml/XMLHttpRequestException.cpp: Copied from Source/WebCore/xml/XMLHttpRequestException.h.
+        (WebCore::XMLHttpRequestException::initializeDescription):
+        * xml/XMLHttpRequestException.h:
+        * xml/XPathException.cpp: Copied from Source/WebCore/xml/XPathException.h.
+        (WebCore::XPathException::initializeDescription):
+        * xml/XPathException.h:
+
+2011-10-27  Kentaro Hara  <haraken@chromium.org>
+
+        Generate WebKitCSSMatrix constructor for JSC by [Constructor] IDL
+        https://bugs.webkit.org/show_bug.cgi?id=70215
+
+        Reviewed by Adam Barth.
+
+        This patch implements [Optional=CallWithNullValue] IDL for JSC.
+        While a parameter specified as [Optional=CallWithDefaultValue] is
+        handled as a string "undefined", a parameter specified as
+        [Optional=CallWithNullValue] is handled as a null string.
+        (Note: not a string "null", but a null string).
+
+        c.f. [Optional=CallWithNullValue] is implemented in V8 in bug 67458.
+
+        Tests: fast/dom/global-constructors.html
+               transforms/svg-vs-css.xhtml
+               transforms/cssmatrix-2d-interface.xhtml
+               transforms/cssmatrix-3d-interface.xhtml
+
+        * GNUmakefile.list.am: Removed JSWebKitCSSMatrixCustom.cpp.
+        * UseJSC.cmake: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSBindingsAllInOne.cpp: Ditto.
+        * bindings/js/JSDOMBinding.h: MAYBE_MISSING_PARAMETER(exec, index, policy) returns the index-th parameter, if the parameter exists. It returns an undefined value, if the index-th parameter is missing and the policy is MissingIsUndefined. It returns an empty value, otherwise (i.e. if the index-th parameter is missing and the policy is MissingIsEmpty).
+        * bindings/js/JSWebKitCSSMatrixCustom.cpp: Removed.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateParametersCheck): Supported [Optional=CallWithNullValue].
+        (GenerateConstructorDefinition): Supported [Optional=CallWithNullValue].
+        * css/WebKitCSSMatrix.idl: Removed [JSCustomConstructor].
+
+2011-10-27  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        RenderTableCell m_row and m_column should not be signed values
+        https://bugs.webkit.org/show_bug.cgi?id=70369
+
+        Reviewed by Darin Adler.
+
+        No new tests, refactoring only.
+
+        The gist of the change is to update row / column handling in the table's
+        rendering code to use unsigned values. Not all the code is switched over
+        to unsigned but this is a good start.
+
+        Using unsigned makes a lot more sense that allowing some negative indexes
+        to creep in the algorithms. Also it enables us to "free" the unused signed
+        bit on the 2 RenderTableCell fields that can be used to pack 2 bits in a
+        follow-up patch.
+
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+        Removed 2 casts to int as the left side now computes to an unsigned too.
+        Added some ASSERT to make sure we don't get negative values (colSpan / rowSpan
+        are always >= 1 by definition but better to be safe).
+
+        * accessibility/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObjectForSection):
+        * accessibility/AccessibilityTableColumn.h:
+        Switched m_columnIndex to unsigned to remove any signed / unsigned comparisons.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::splitColumn):
+        (WebCore::RenderTable::calcBorderEnd):
+        (WebCore::RenderTable::cellAbove):
+        (WebCore::RenderTable::cellBelow):
+        (WebCore::RenderTable::cellBefore):
+        (WebCore::RenderTable::cellAfter):
+        Mostly mechanical changes to avoid signed / unsigned comparisons or casts.
+
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::numEffCols):
+        (WebCore::RenderTable::colToEffCol):
+        Updated a couple of functions to use an unsigned.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::RenderTableCell):
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::col):
+        (WebCore::RenderTableCell::setCol):
+        (WebCore::RenderTableCell::row):
+        (WebCore::RenderTableCell::setRow):
+        Updated after switching the fields to unsigned. Also added 2 constants
+        to cover the not-initialized-yet value for row and column indexes.
+        Note: we don't enforce that you can't reach those indexes but neither
+        did the previous code!
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::ensureRows):
+        (WebCore::RenderTableSection::setCellLogicalWidths):
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::calcOuterBorderStart):
+        (WebCore::RenderTableSection::calcOuterBorderEnd):
+        (WebCore::RenderTableSection::recalcCells):
+        (WebCore::RenderTableSection::clearGrid):
+        (WebCore::RenderTableSection::numColumns):
+        (WebCore::RenderTableSection::appendColumn):
+        (WebCore::RenderTableSection::splitColumn):
+        Lots of mechanical: signed -> unsigned changes. However we had
+        to change the logic a bit as it assumed that m_cRow started at
+        -1 and increased from there. The new meaning of m_cRow is the
+        number of rows seen and m_cRow - 1 is where to insert your new
+        cells.
+
+        (WebCore::RenderTableSection::addCell):
+        Checked the callers and all increase m_cRow before calling the function.
+        Added an ASSERT to catch up wrong usage in the future.
+
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::numRows): Switched to unsigned.
+
+2011-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Assertion failure (m_text) in RenderText::RenderText() at icanhascheezburger.com
+        https://bugs.webkit.org/show_bug.cgi?id=71085
+
+        Reviewed by Jon Honeycutt.
+
+        Test: fast/css-generated-content/attr-missing.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): If the element does not have the attribute specified
+        in the attr() function in the content property, set the content to the empty string, per
+        <http://www.w3.org/TR/CSS21/generate.html#content>.
+
+2011-10-27  Helder Correia  <helder.correia@palm.com>
+
+        [Qt] Failure to build when QT_NO_CURSOR defined
+        https://bugs.webkit.org/show_bug.cgi?id=71060
+
+        Reviewed by Noam Rosenthal.
+
+        PlatformVideoWindowQt needs to wrap some code around #ifndef
+        QT_NO_CURSOR in order to build QtWebKit when QT_NO_CURSOR is defined.
+
+        Build fix, no new tests.
+
+        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
+        (FullScreenVideoWindow::FullScreenVideoWindow):
+        (FullScreenVideoWindow::closeEvent):
+        (FullScreenVideoWindow::hideCursor):
+        (FullScreenVideoWindow::showCursor):
+
+2011-10-27  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Track when CCLayerImpl properties have changed.
+        https://bugs.webkit.org/show_bug.cgi?id=70442
+
+        Reviewed by James Robinson.
+
+        To determine a good scissor rect, we must determine what
+        will change on the screen on the next redraw.  This patch
+        tracks the necessary information on CCLayerImpl and marks
+        a flag indicating whether this layer will "damage" the screen.
+        The other portion of "change", the updateRect, was already
+        landed in https://bugs.webkit.org/show_bug.cgi?id=69441.
+
+        New unit test added to CCLayerImplTest to test this patch.
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::scrollBy):
+        (WebCore::CCLayerImpl::noteLayerPropertyChangedForSubtree):
+        (WebCore::CCLayerImpl::noteLayerPropertyChangedForDescendants):
+        (WebCore::CCLayerImpl::setBounds):
+        (WebCore::CCLayerImpl::setMaskLayer):
+        (WebCore::CCLayerImpl::setReplicaLayer):
+        (WebCore::CCLayerImpl::setDrawsContent):
+        (WebCore::CCLayerImpl::setAnchorPoint):
+        (WebCore::CCLayerImpl::setAnchorPointZ):
+        (WebCore::CCLayerImpl::setMasksToBounds):
+        (WebCore::CCLayerImpl::setOpaque):
+        (WebCore::CCLayerImpl::setOpacity):
+        (WebCore::CCLayerImpl::setPosition):
+        (WebCore::CCLayerImpl::setPreserves3D):
+        (WebCore::CCLayerImpl::setSublayerTransform):
+        (WebCore::CCLayerImpl::setTransform):
+        (WebCore::CCLayerImpl::setDebugBorderColor):
+        (WebCore::CCLayerImpl::setDebugBorderWidth):
+        (WebCore::CCLayerImpl::setContentBounds):
+        (WebCore::CCLayerImpl::setScrollPosition):
+        (WebCore::CCLayerImpl::setScrollDelta):
+        (WebCore::CCLayerImpl::setDoubleSided):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::layerPropertyChanged):
+        (WebCore::CCLayerImpl::resetLayerPropertyChanged):
+
+2011-10-27  Anders Carlsson  <andersca@apple.com>
+
+        Add a Plugin::geometryDidChange that will work with transforms
+        https://bugs.webkit.org/show_bug.cgi?id=71072
+
+        Reviewed by Simon Fraser.
+
+        Export symbols needed by WebKit2.
+
+        * WebCore.exp.in:
+
+2011-10-27  Adam Barth  <abarth@webkit.org>
+
+        Exception subtypes have incorrect namespace indentation
+        https://bugs.webkit.org/show_bug.cgi?id=71075
+
+        Reviewed by Eric Seidel.
+
+        This patch is in preparation for editing these headers.  We decided to
+        not indent namespaces in headers and update the headers as we edited
+        them.
+
+        * dom/DOMCoreException.h:
+        (WebCore::DOMCoreException::create):
+        (WebCore::DOMCoreException::DOMCoreException):
+        * dom/EventException.h:
+        (WebCore::EventException::create):
+        (WebCore::EventException::EventException):
+        * dom/RangeException.h:
+        (WebCore::RangeException::create):
+        (WebCore::RangeException::RangeException):
+        * xml/XMLHttpRequestException.h:
+        (WebCore::XMLHttpRequestException::create):
+        (WebCore::XMLHttpRequestException::XMLHttpRequestException):
+        * xml/XPathException.h:
+        (WebCore::XPathException::create):
+        (WebCore::XPathException::XPathException):
+
+2011-10-27  Kenneth Russell  <kbr@google.com>
+
+        Implement new restrictions on uniform and attribute location lengths
+        https://bugs.webkit.org/show_bug.cgi?id=70981
+
+        Reviewed by Chris Marrin.
+
+        Tests: fast/canvas/webgl/attrib-location-length-limits.html
+               fast/canvas/webgl/uniform-location-length-limits.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::bindAttribLocation):
+        (WebCore::WebGLRenderingContext::getAttribLocation):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::validateLocationLength):
+        * html/canvas/WebGLRenderingContext.h:
+
+2011-10-27  Rafael Weinstein  <rafaelw@chromium.org>
+
+        [MutationObservers] Implement subtree observation of transiently disconnected nodes
+        https://bugs.webkit.org/show_bug.cgi?id=70788
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch adds support for observing all descendant nodes reachable from a subtree
+        observation until delivery of mutations -- even if they become detached. We do this by
+        introducing a "transient registration" which can exist for a short time along side
+        normal registrations on Node. Transient registrations have a reference to the node
+        which "owns" the subtree observation registration (the "registrationNode"). Transient
+        registrations are cleared immediately before mutations are delivered to an observer,
+        or when the observer re-observes at the registrationNode, in-effect resetting the
+        observation.
+
+        New tests added to fast/mutation/observe-subtree.html.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ChildListMutationScope.cpp:
+        (WebCore::MutationAccumulationRouter::ChildListMutationAccumulator::ChildListMutationAccumulator):
+        (WebCore::MutationAccumulationRouter::ChildListMutationAccumulator::enqueueMutationRecord):
+        (WebCore::MutationAccumulationRouter::MutationAccumulationRouter::incrementScopingLevel):
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Element.cpp:
+        (WebCore::enqueueAttributesMutationRecord):
+        * dom/Node.cpp:
+        (WebCore::addMatchingObservers):
+        (WebCore::Node::getRegisteredMutationObserversOfType):
+        (WebCore::Node::registerMutationObserver):
+        (WebCore::Node::unregisterMutationObserver):
+        (WebCore::Node::notifySubtreeObserversOfDisconnection):
+        * dom/Node.h:
+        * dom/NodeRareData.h:
+        (WebCore::MutationObserverEntry::MutationObserverEntry):
+        (WebCore::MutationObserverEntry::operator==):
+        * dom/WebKitMutationObserver.cpp:
+        (WebCore::WebKitMutationObserver::observe):
+        (WebCore::unregisterTransientEntries):
+        (WebCore::WebKitMutationObserver::disconnect):
+        (WebCore::WebKitMutationObserver::observedNodeDestructed):
+        (WebCore::WebKitMutationObserver::observedSubtreeWillDisconnect):
+        (WebCore::WebKitMutationObserver::clearTransientEntries):
+        (WebCore::WebKitMutationObserver::deliver):
+        * dom/WebKitMutationObserver.h:
+
+2011-10-27  Pratik Solanki  <psolanki@apple.com>
+
+        Ask CG to not parse image metadata
+        https://bugs.webkit.org/show_bug.cgi?id=71029
+
+        Reviewed by Simon Fraser.
+
+        We don't need CG to parse the image metadata since WebCore never uses it. Passing this
+        option shaves off time spent under CGImageSourceCopyPropertiesAtIndex. Under Instruments I
+        saw the time drop from ~75ms to ~25ms when loading http://boston.com/bigpicture and the
+        first link on that page.
+
+        No new tests because no change in functionality.
+
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::getHotSpot):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+
+2011-10-27  David Grogan  <dgrogan@chromium.org>
+
+        Move eventqueue from Document to ScriptExecutionContext so that it can be accessed from workers
+        https://bugs.webkit.org/show_bug.cgi?id=57789
+
+        Extract interface from EventQueue and create two new subclasses:
+        DocumentEventQueue and WorkerEventQueue.  DocumentEventQueue is the
+        old EventQueue implementation that uses DOMTimer(0) to post async
+        events.  WorkerEventQueue posts events to its thread's message loop.
+
+        Reviewed by David Levin.
+
+        No new tests - IndexedDB will use this but isn't ready yet.  I don't
+        know of any other API available in workers that I can test this with.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::eventQueue):
+        * dom/DocumentEventQueue.cpp: Renamed from Source/WebCore/dom/EventQueue.cpp.
+        (WebCore::shouldDispatchScrollEventSynchronously):
+        (WebCore::DocumentEventQueueTimer::DocumentEventQueueTimer):
+        (WebCore::DocumentEventQueueTimer::fired):
+        (WebCore::DocumentEventQueue::create):
+        (WebCore::DocumentEventQueue::DocumentEventQueue):
+        (WebCore::DocumentEventQueue::~DocumentEventQueue):
+        (WebCore::DocumentEventQueue::enqueueEvent):
+        (WebCore::DocumentEventQueue::enqueueOrDispatchScrollEvent):
+        (WebCore::DocumentEventQueue::cancelEvent):
+        (WebCore::DocumentEventQueue::close):
+        (WebCore::DocumentEventQueue::pendingEventTimerFired):
+        (WebCore::DocumentEventQueue::dispatchEvent):
+        * dom/DocumentEventQueue.h: Copied from Source/WebCore/dom/EventQueue.h.
+        * dom/EventQueue.h:
+        * dom/ScriptExecutionContext.h:
+        * page/EventHandler.cpp: Change EventQueue to DocumentEventQueue.
+        (WebCore::EventHandler::sendScrollEvent): Change EventQueue to DocumentEventQueue.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollTo): Change EventQueue to DocumentEventQueue.
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollTo): Change EventQueue to DocumentEventQueue.
+        * storage/IDBDatabase.cpp:
+        * storage/IDBRequest.cpp:
+        * storage/IDBTransaction.cpp:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::eventQueue):
+        * workers/WorkerContext.h:
+        * workers/WorkerEventQueue.cpp: Added.
+        (WebCore::WorkerEventQueue::create):
+        (WebCore::WorkerEventQueue::WorkerEventQueue):
+        (WebCore::WorkerEventQueue::~WorkerEventQueue):
+        (WebCore::WorkerEventQueue::EventDispatcherTask::create):
+        (WebCore::WorkerEventQueue::EventDispatcherTask::dispatchEvent):
+        (WebCore::WorkerEventQueue::EventDispatcherTask::performTask):
+        (WebCore::WorkerEventQueue::EventDispatcherTask::cancel):
+        (WebCore::WorkerEventQueue::EventDispatcherTask::EventDispatcherTask):
+        (WebCore::WorkerEventQueue::removeEvent):
+        (WebCore::WorkerEventQueue::enqueueEvent):
+        (WebCore::WorkerEventQueue::cancelEvent):
+        (WebCore::WorkerEventQueue::close):
+        * workers/WorkerEventQueue.h: Copied from Source/WebCore/dom/EventQueue.h.
+
+2011-10-27  Jonathon Jongsma  <jonathon.jongsma@collabora.co.uk>
+
+        [GStreamer] Prevent memory leak when fullscreening a video
+        https://bugs.webkit.org/show_bug.cgi?id=71043
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * platform/graphics/gstreamer/GStreamerGWorld.cpp:
+        (WebCore::GStreamerGWorld::GStreamerGWorld):
+        (WebCore::GStreamerGWorld::enterFullscreen):
+        (WebCore::GStreamerGWorld::exitFullscreen):
+        * platform/graphics/gstreamer/GStreamerGWorld.h:
+
+2011-10-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Make FeatureDefines Identical Across OS X Projects
+        https://bugs.webkit.org/show_bug.cgi?id=71051
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-10-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Correctly Guard Exported REQUEST_ANIMATION_FRAME Symbols
+        https://bugs.webkit.org/show_bug.cgi?id=71047
+
+        Reviewed by David Kilzer.
+
+        * WebCore.exp.in:
+
+2011-10-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98626.
+        http://trac.webkit.org/changeset/98626
+        https://bugs.webkit.org/show_bug.cgi?id=71066
+
+        Does not compile on cr-win (Requested by jamesr_ on #webkit).
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::paintSkiaText):
+
+2011-10-27  Tony Chang  <tony@chromium.org>
+
+        Fix a compiler warning caught by gcc 4.6.1. Need to return something.
+
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::nextAction):
+
+2011-10-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Advanced search style fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=71036
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView):
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/inspector.css:
+        (.search-view .search-panel):
+        (.search-view .search-panel input[type="search"].search-config-search):
+        (.search-view .search-panel input[type="checkbox"].search-config-checkbox):
+        (body:not(.platform-mac) .search-view .search-panel input[type="checkbox"].search-config-checkbox):
+        (body.platform-mac .search-view .search-panel input[type="checkbox"].search-config-checkbox):
+        (#drawer-status-bar .search-status-bar-progress):
+        (body:not(.platform-mac) #drawer-status-bar .search-status-bar-progress):
+        (body.platform-mac #drawer-status-bar .search-status-bar-progress):
+
+2011-10-27  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=71061
+        
+        [CSS Line Grid] Add support for parsing the line-grid property.
+
+        New tests in fast/line-grid.
+
+        Reviewed by Dan Bernstein.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::lineGrid):
+        (WebCore::InheritedFlags::setLineGrid):
+        (WebCore::InheritedFlags::initialLineGrid):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+2011-10-27  Fady Samuel  <fsamuel@chromium.org>
+
+        iframes seem to occasionally doubly scale or scale incorrectly when pageScaleFactor != 1.0
+        https://bugs.webkit.org/show_bug.cgi?id=70552
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/frames/iframe-double-scale-contents.html
+
+        The iframe's document style was using the page's scale factor, rather than the frame's (1.0).
+        If the page scale factor was set after layout was complete, then this would have no impact because the iframe's document style and layout is not recomputed, 
+        but if the page scale factor is set prior to creating and laying out the iframe, the iframe's content would be doubly scaled.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForDocument):
+
+2011-10-27  Nat Duca  <nduca@chromium.org>
+
+        Unreviewed, fix CCSchedulerStateMachine build errors.
+
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+
+2011-10-27  Tony Chang  <tony@chromium.org>
+
+        fix sizing of auto sized flexbox
+        https://bugs.webkit.org/show_bug.cgi?id=70839
+
+        Reviewed by David Hyatt.
+
+        Correctly set the height of the flexbox when we have a column flow
+        and the height is auto.
+
+        Tests: css3/flexbox/columns-auto-size.html
+               css3/flexbox/flex-flow-margins-auto-size.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock): Always computeLogicalHeight() after we're done placing children.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildrenInlineDirection): Set the height as we place children.
+
+2011-10-25  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Add support for creating compositing layers for fixed position elements.
+        https://bugs.webkit.org/show_bug.cgi?id=69796
+
+        position:fixed elements will get a compositing layer if:
+        1. Settings:acceleratedCompositingForFixedPositionEnabled() returns true, 
+        2. The element has its own stacking context (e.g. has a z-index), and
+        3. The element's container is the RenderView (e.g. not a descendant of a transformed element)
+
+        Reviewed by Simon Fraser.
+
+
+        Test: compositing/geometry/fixed-position-composited-switch.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setAcceleratedCompositingForFixedPositionEnabled):
+        (WebCore::Settings::acceleratedCompositingForFixedPositionEnabled):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
+        * rendering/RenderLayerCompositor.h:
+        * testing/Internals.cpp:
+        (WebCore::Internals::setEnableCompositingForFixedPosition):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2011-10-27  Arthur Hsu  <arthurhsu@chromium.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=70390
+        Ensure font load for Skia backend during printing.
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::paintSkiaText):
+
+2011-10-27  Michael Saboff  <msaboff@apple.com>
+
+        Investigate storing strings in 8-bit buffers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=66161
+
+        Changes to support 8 bit StringImpl changes.
+        
+        Reviewed by Geoffrey Garen.
+        
+        No new tests, refactored StringImpl for 8 bit strings.
+
+        * platform/text/cf/StringImplCF.cpp:
+        (WTF::StringImpl::createCFString):
+
+2011-10-27  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Encapsulate state machine parts of scheduling in CCSchedulerStateMachine
+        https://bugs.webkit.org/show_bug.cgi?id=70714
+
+        Reland of ill-fated r98612.
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp: Added.
+        (WebCore::CCSchedulerStateMachine::nextAction):
+        (WebCore::CCSchedulerStateMachine::updateState):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h: Added.
+        (WebCore::CCSchedulerStateMachine::CCSchedulerStateMachine):
+        (WebCore::CCSchedulerStateMachine::operator=):
+        (WebCore::CCSchedulerStateMachine::commitPending):
+        (WebCore::CCSchedulerStateMachine::setNeedsRedraw):
+        (WebCore::CCSchedulerStateMachine::setNeedsCommit):
+        (WebCore::CCSchedulerStateMachine::beginFrameComplete):
+        (WebCore::CCSchedulerStateMachine::updateResourcesComplete):
+
+2011-10-27  Pavel Podivilov  <podivilov@chromium.org>
+
+        Get rid of optional parameters in the middle in IDLs.
+        https://bugs.webkit.org/show_bug.cgi?id=70816
+
+        Reviewed by Adam Barth.
+
+        Optional parameters in the middle are prohibited by WebIDL spec.
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateArgumentsCountCheck):
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::methodWithNonOptionalArgAndTwoOptionalArgsCallback):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * page/DOMWindow.idl:
+
+2011-10-27  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION(r98542): tables/mozilla_expected_failures/bugs/bug14007-2.html
+        https://bugs.webkit.org/show_bug.cgi?id=71032
+
+        Reviewed by Dave Hyatt.
+
+        If we apply an explicitly inherited property, we need to apply any further
+        non-inherited properties as the property might get overridden again.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForKeyframe):
+        (WebCore::CSSStyleSelector::styleForPage):
+        (WebCore::CSSStyleSelector::applyDeclaration):
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        * css/CSSStyleSelector.h:
+
+2011-10-27  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Remove RenderTableSection::m_gridRows
+        https://bugs.webkit.org/show_bug.cgi?id=70570
+
+        Reviewed by Darin Adler.
+
+        No new test, refactoring only.
+
+        Just nuke the old field that was duplicating
+        m_grid.size().
+
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::numRows):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::ensureRows):
+        (WebCore::RenderTableSection::setCellLogicalWidths):
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::calcOuterBorderBefore):
+        (WebCore::RenderTableSection::calcOuterBorderAfter):
+        (WebCore::RenderTableSection::calcOuterBorderStart):
+        (WebCore::RenderTableSection::calcOuterBorderEnd):
+        (WebCore::RenderTableSection::firstLineBoxBaseline):
+        (WebCore::RenderTableSection::paint):
+        (WebCore::RenderTableSection::paintObject):
+        (WebCore::RenderTableSection::clearGrid):
+        (WebCore::RenderTableSection::numColumns):
+        (WebCore::RenderTableSection::appendColumn):
+        (WebCore::RenderTableSection::splitColumn):
+        s/m_gridRows/m_grid.size()/.
+        Also updated the code as m_grid.size() is unsigned.
+
+        (WebCore::RenderTableSection::recalcCells):
+        The old code would keep the grid's memory but we have to clear it to properly
+        count the elements. To avoid lots of small reallocations, we reallocate the
+        buffer at the old capacity upfront.
+
+2011-10-27  Nat Duca  <nduca@chromium.org>
+
+        Unreviewed, rolling out r98612.
+        http://trac.webkit.org/changeset/98612
+        https://bugs.webkit.org/show_bug.cgi?id=70714
+
+        Broke build
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp: Removed.
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h: Removed.
+
+2011-10-24  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Encapsulate state machine parts of scheduling in CCSchedulerStateMachine
+        https://bugs.webkit.org/show_bug.cgi?id=70714
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp: Added.
+        (WebCore::CCSchedulerStateMachine::nextAction):
+        (WebCore::CCSchedulerStateMachine::updateState):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h: Added.
+        (WebCore::CCSchedulerStateMachine::CCSchedulerStateMachine):
+        (WebCore::CCSchedulerStateMachine::operator=):
+        (WebCore::CCSchedulerStateMachine::commitPending):
+        (WebCore::CCSchedulerStateMachine::setNeedsRedraw):
+        (WebCore::CCSchedulerStateMachine::setNeedsCommit):
+        (WebCore::CCSchedulerStateMachine::beginFrameComplete):
+        (WebCore::CCSchedulerStateMachine::updateResourcesComplete):
+
+2011-10-27  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10262205> Allow column progression to be independent of writing mode
+        https://bugs.webkit.org/show_bug.cgi?id=71028
+
+        Reviewed by Darin Adler.
+
+        Tests: fast/multicol/block-axis-horizontal-bt.html
+               fast/multicol/block-axis-horizontal-tb.html
+               fast/multicol/block-axis-vertical-lr.html
+               fast/multicol/block-axis-vertical-rl.html
+               fast/multicol/flipped-blocks-hit-test.html
+
+        Allow “columns” to be stacked along the block axis rather than the inline axis. This can facilitate
+        paginated interfaces. A column-axis property is added in order to enable this mode.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Handle the column-axis property.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Ditto.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Map ColumnAxis values to identifiers.
+        (WebCore::CSSPrimitiveValue::operator ColumnAxis): Map identifiers to ColumnAxis values.
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty): Updated to return false for the column-axis property.
+        * css/CSSPropertyNames.in: Added -webkit-column-axis.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Handle column-axis.
+        * rendering/ColumnInfo.h:
+        (WebCore::ColumnInfo::ColumnInfo): Added m_progressionAxis to the initialization list.
+        (WebCore::ColumnInfo::progressionAxis): Added this getter.
+        (WebCore::ColumnInfo::setProgressionAxis): Added this setter.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromChildren): Simplified, and thus also made this function work
+        with block-axis column progression.
+        (WebCore::RenderBlock::paintColumnRules): Added code to paint rules between columns with block-axis
+        progression.
+        (WebCore::RenderBlock::paintColumnContents): Adjusted the painting offset for the block-axis
+        column progression case.
+        (WebCore::RenderBlock::nodeAtPoint): Fixed hit-testing in flipped-blocks writing modes. This is
+        covered by flipped-blocks-hit-test.html.
+        (WebCore::RenderBlock::hitTestColumns): Adjusted the offset for the block-axis column progression
+        case.
+        (WebCore::RenderBlock::calcColumnWidth): Set the column width to the content logical width in
+        the block-axis column progression case. The column-width and column-count properties are ignored.
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth): Set the column progression axis based on
+        the style.
+        (WebCore::RenderBlock::columnCount): Broke up an assertion into two.
+        (WebCore::RenderBlock::columnRectAt): Updated for block-axis column progression.
+        (WebCore::RenderBlock::adjustPointToColumnContents): Ditto.
+        (WebCore::RenderBlock::adjustRectForColumns): Ditto.
+        (WebCore::RenderBlock::adjustForColumns): Ditto.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintChildLayerIntoColumns): Adjusted the offser for the block-axis column
+        progression case.
+        (WebCore::RenderLayer::hitTestChildLayerColumns): Ditto.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::columnAxis): Added this getter.
+        (WebCore::InheritedFlags::hasInlineColumnAxis): Added. Checks the column axis against the writing
+        mode.
+        (WebCore::InheritedFlags::specifiesColumns): Changed to return true if the specified column axis
+        is the block axis.
+        (WebCore::InheritedFlags::setColumnAxis): Added this setter.
+        (WebCore::InheritedFlags::initialColumnAxis): Added. Returns AutoColumnAxis.
+        * rendering/style/RenderStyleConstants.h: Added a ColumnAxis enum.
+        * rendering/style/StyleMultiColData.cpp:
+        (WebCore::StyleMultiColData::StyleMultiColData): Added m_axis to the initialization list.
+        (WebCore::StyleMultiColData::operator==): Compare m_axis.
+        * rendering/style/StyleMultiColData.h: Added m_axis member variable.
+
+2011-10-27  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]Flag regions with custom styling
+        https://bugs.webkit.org/show_bug.cgi?id=70733
+
+        Reviewed by David Hyatt.
+
+        Region elements that have custom region styling are now marked accordingly.
+
+        Test: fast/regions/render-region-custom-style-mark.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::checkRegionStyle):
+        * css/CSSStyleSelector.h:
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::RenderRegion):
+        (WebCore::RenderRegion::styleDidChange):
+        * rendering/RenderRegion.h:
+        (WebCore::RenderRegion::hasCustomRegionStyle):
+        (WebCore::RenderRegion::setHasCustomRegionStyle):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeRenderFlowThreads):
+
+2011-10-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98556.
+        http://trac.webkit.org/changeset/98556
+        https://bugs.webkit.org/show_bug.cgi?id=71031
+
+        The test added by the patch doesn't pass on Snow Leopard
+        (Requested by rniwa on #webkit).
+
+        * editing/TextCheckingHelper.cpp:
+        (WebCore::checkTextOfParagraph):
+        * testing/Internals.cpp:
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2011-10-27  Mike Reed  <reed@google.com>
+
+        [skia] replace offscreen technique with native support for antialiased clipping
+        https://bugs.webkit.org/show_bug.cgi?id=70748
+
+        Reviewed by Stephen White.
+
+        ~100 layout tests need to be rebaselined, as the native aa-clipping differs sometimes in the low
+        bits of the result. Other than that, the results should be the same, except that now the drawing
+        can go directly to the canvas, rather than being direct offscreen and then have that result
+        "clipped" during the restore. This has the effect of allowing LCD text to be drawing inside a
+        antialiased clip area.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::State::State):
+        (WebCore::PlatformContextSkia::State::cloneInheritedProperties):
+        (WebCore::PlatformContextSkia::clipPathAntiAliased):
+        (WebCore::PlatformContextSkia::restore):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2011-10-27  Tony Chang  <tony@chromium.org>
+
+        use main/cross instead of logical width/height when talking about flow direction
+        https://bugs.webkit.org/show_bug.cgi?id=70977
+
+        Reviewed by Ojan Vafai.
+
+        Flexbox code uses logical in function names to refer to the flow
+        direction. This is confusing because writing mode also uses logical,
+        but this is a diffent usage. To avoid confusion, be explicit about
+        main vs cross axis. Extent is used instead of width/height.
+
+        No new tests, just a refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::mainAxisLengthForChild):
+        (WebCore::RenderFlexibleBox::crossAxisLength):
+        (WebCore::RenderFlexibleBox::setCrossExtent):
+        (WebCore::RenderFlexibleBox::crossExtentForChild):
+        (WebCore::RenderFlexibleBox::mainExtentForChild):
+        (WebCore::RenderFlexibleBox::crossAxisExtent):
+        (WebCore::RenderFlexibleBox::mainAxisExtent):
+        (WebCore::RenderFlexibleBox::crossAxisContentExtent):
+        (WebCore::RenderFlexibleBox::mainAxisContentExtent):
+        (WebCore::RenderFlexibleBox::crossAxisBorderAndPaddingExtent):
+        (WebCore::RenderFlexibleBox::crossAxisMarginExtentForChild):
+        (WebCore::RenderFlexibleBox::flowAwareLocationForChild):
+        (WebCore::RenderFlexibleBox::setFlowAwareLocationForChild):
+        (WebCore::RenderFlexibleBox::mainAxisBorderAndPaddingExtentForChild):
+        (WebCore::RenderFlexibleBox::mainAxisScrollbarExtentForChild):
+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForFlexItem):
+        (WebCore::RenderFlexibleBox::layoutInlineDirection):
+        (WebCore::RenderFlexibleBox::positiveFlexForChild): Since flex only
+            matters in the main axis, there's no reason to deambiguate it here.
+        (WebCore::RenderFlexibleBox::negativeFlexForChild): Ditto.
+        (WebCore::RenderFlexibleBox::availableAlignmentSpaceForChild): Alignment is always
+            in the cross axis direction, so don't include that in the method name.
+        (WebCore::RenderFlexibleBox::marginBoxAscent):
+        (WebCore::RenderFlexibleBox::computePreferredMainAxisExtent):
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithmInlineDirection):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildrenInlineDirection):
+        (WebCore::RenderFlexibleBox::adjustAlignmentForChild):  Alignment is always
+            in the cross axis direction, so don't include that in the method name.
+        (WebCore::RenderFlexibleBox::alignChildrenBlockDirection):
+        * rendering/RenderFlexibleBox.h:
+
+2011-10-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::toThisObject
+        https://bugs.webkit.org/show_bug.cgi?id=70958
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        Converted all instances of toThisObject to static functions, 
+        added toThisObject to the MethodTable, and replaced all call sites
+        with a corresponding lookup in the MethodTable.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::toThisObject):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Invoke):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+
+2011-10-27  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r98512
+
+        * html/HTMLMediaElement.cpp: Moved a Web Audio-related #include inside an appropriate ENABLE
+        guard.
+
+2011-10-27  Adam Roben  <aroben@apple.com>
+
+        Regenerate WebCore's Localizable.strings file
+
+        All I did was run update-webkit-localizable-strings. A few localizer comments changed, and
+        some strings (which must have been hand-added) got moved to a different part of the file.
+
+        * English.lproj/Localizable.strings:
+
+2011-10-27  Daniel Cheng  <dcheng@chromium.org>
+
+        Clean up MicroDataItemValue to use const String& instead of String
+        https://bugs.webkit.org/show_bug.cgi?id=70978
+
+        Reviewed by Tony Chang.
+
+        * html/MicroDataItemValue.cpp:
+        (WebCore::MicroDataItemValue::MicroDataItemValue):
+        * html/MicroDataItemValue.h:
+
+2011-10-27  Antti Koivisto  <antti@apple.com>
+
+        Use StringHasher to generate the matched declaration cache hash
+        https://bugs.webkit.org/show_bug.cgi?id=71012
+
+        Reviewed by Kenneth Rohde Christiansen and Andreas Kling.
+
+        It is faster and better than the current custom function.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::computeDeclarationHash):
+
+2011-10-27  Kentaro Hara  <haraken@chromium.org>
+
+        Refactor OptionsObject.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=70572
+
+        Reviewed by Adam Barth.
+
+        For example, OptionsObject::getKeyBool() is an alias of
+        OptionsObject::getKeyValue(const String& key, bool& value).
+        We should remove OptionsObject::getKeyXXXX() (XXXX is some specific type)
+        and unify them into OptionsObject::get(const String& key, XXXX& value).
+        c.f. Corresponding JSC methods are unified into
+        JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue, XXXX&).
+
+        The result of git diff is weird, but this patch is making just the following changes:
+        - Replaced getKeyBool(), getKeyInt32(), getKeyDouble() and getKeyString() with get().
+        - Renamed getKeyStringWithUndefinedOrNullCheck() to getWithUndefinedOrNullCheck().
+        - Removed getKeyDOMStringList() and getKeyKeyRange(), since these are not used.
+        - Move definitions of get() from .h to .cpp.
+
+        No new tests. No change in behavior.
+
+        * bindings/v8/OptionsObject.cpp:
+        (WebCore::OptionsObject::get): Renamed from getKeyValue().
+        (WebCore::OptionsObject::getKey): No change to this method. git diff seems to misunderstand as if it is modified.
+        (WebCore::OptionsObject::getKeyDOMStringList): Removed, since no one is using it.
+        (WebCore::OptionsObject::getKeyKeyRange): Ditto.
+        (WebCore::OptionsObject::getWithUndefinedOrNullCheck): No change to this method. git diff seems to misunderstand as if it is modified.
+        * bindings/v8/OptionsObject.h: Moved definitions of get() to OptionsObject.cpp
+        * bindings/v8/custom/V8EventConstructors.cpp:
+        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
+        (WebCore::V8WebKitMutationObserver::observeCallback): Replaced getKeyXXXX() to get();
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::createObjectStore): Ditto.
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::createIndex): Ditto.
+
+2011-10-27  Andreas Kling  <kling@webkit.org>
+
+        StyleSheet.parentStyleSheet does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=70956
+
+        Reviewed by Antti Koivisto.
+
+        Since StyleSheet is only ever parented by a CSSRule, we need
+        to go through that rule when resolving the StyleSheet's parent.
+
+        Test: fast/css/stylesheet-parentStyleSheet.html
+
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::parentStyleSheet):
+
+2011-10-27  Antoine Labour  <piman@chromium.org>
+
+        Disable blending when drawing opaque layers
+        https://bugs.webkit.org/show_bug.cgi?id=70085
+
+        Reviewed by James Robinson.
+
+        Covered by compositing/ tests, as well as a new unit test:
+        CCLayerTreeHostImplTest.blendingOffWhenDrawingOpaqueLayers
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayer):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::setOpaque):
+        (WebCore::CCLayerImpl::opaque):
+
+2011-10-27  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Passing empty array to IDBDatabase.transaction should raise exception
+        https://bugs.webkit.org/show_bug.cgi?id=70251
+
+        Reviewed by Adam Barth.
+
+        IDBDatabase.transaction() supported being called with an empty array to
+        lock all object stores. Support for this was rejected from inclusion in
+        the IDB spec due to performance concerns. This patch removes that
+        functionality.
+
+        A special case in the spec (passing a string instead of an array) worked
+        in WebKit accidentally, by resolving the string to an empty array. This
+        needed explicit support. Support for DOMString[] is added to the binding
+        code generators (reliant on DOMStringList) to ensure JS arrays are not
+        coerced to DOMStrings. This matches the proposed IDL.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheckExpression):
+        (GetNativeType):
+        (JSValueToNative):
+        (IsArrayType):
+        * bindings/scripts/IDLStructure.pm:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::transaction):
+        * storage/IDBDatabase.h:
+        (WebCore::IDBDatabase::transaction):
+        * storage/IDBDatabase.idl:
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::objectStore):
+
+2011-10-27  Ken Buchanan <kenrb@chromium.org>
+
+        Crash due to nested first-letter selectors
+        https://bugs.webkit.org/show_bug.cgi?id=70457
+
+        Now only the lowest-level first-letter pseudostyle will be applied to
+        a given piece of text. Previously the last renderer to have layout
+        done would have its pseudostyle applied, no matter where it was in the
+        tree.
+
+        Reviewed by David Hyatt.
+
+        * renderer/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter): Use the pseudostyle from
+        the lowest level node to have one
+
+2011-10-27  Andras Becsi  <andras.becsi@nokia.com>
+
+        Fix the build if NO_LISTBOX_RENDERING is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=71009
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        If NO_LISTBOX_RENDERING is enabled RenderMenuList::listBoxSelectItem uses the
+        HTMLSelectElement::listBoxSelectItem function which was accidentally removed in r97533.
+        Reintroduce HTMLSelectElement::listBoxSelectItem with a NO_LISTBOX_RENDERING guard to unbreak this setup.
+
+        This is covered by:
+        Source/WebCore/manual-tests/no-listbox-rendering.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxSelectItem): Reintroduce.
+        * html/HTMLSelectElement.h:
+
+2011-10-27  Shinya Kawanaka  <shinyak@google.com>
+
+        Implement legacy text check emulation in unified text check interface.
+        https://bugs.webkit.org/show_bug.cgi?id=70299
+
+        Reviewed by Hajime Morita.
+
+        When UNIFIED_TEXT_CHECKING is off, WebCore::checkTextOfParagraph() emulates
+        TextCheckerClient::checkTextOfParagraph() using checkSpellingOfString and checkGrammarOfString.
+
+        This emulation can be used by setting the flag on.
+        This can be done by WebCore::Internals::setUnifiedTextCheckingEnabled.
+
+        Test: editing/spelling/spelling-unified-emulation.html
+
+        * editing/TextCheckingHelper.cpp:
+        (WebCore::findBadGrammars): Added.
+        (WebCore::findMisspellings): Added.
+        (WebCore::checkTextOfParagraph):
+          Emulates TextCheckerClients::checkTextOfParagraph if UNIFIED_TEXT_CHECKING is off.
+        * testing/Internals.cpp:
+        (WebCore::Internals::setUnifiedTextCheckingEnabled): flag setter.
+        (WebCore::Internals::unifiedTextCheckingEnabled): flag getter.
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2011-10-27  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, remove those un-needed files committed by error in
+        r98554.
+
+        * platform/audio/gstreamer/#AudioFileReaderGStreamer.h#: Removed.
+        * platform/audio/gstreamer/.#AudioFileReaderGStreamer.h: Removed.
+
+2011-10-27  Philippe Normand  <pnormand@igalia.com> and Zan Dobersek  <zandobersek@gmail.com>
+
+        [GStreamer] WebAudio AudioFileReader implementation
+        https://bugs.webkit.org/show_bug.cgi?id=69834
+
+        Reviewed by Martin Robinson.
+
+        Basic FileReader implementation, supporting one or 2 audio
+        channels. An empty AudioDestination is also provided, its complete
+        implementation is handled in bug 69835.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp: Added.
+        (WebCore::AudioDestination::create):
+        (WebCore::AudioDestination::hardwareSampleRate):
+        (WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
+        (WebCore::AudioDestinationGStreamer::~AudioDestinationGStreamer):
+        (WebCore::AudioDestinationGStreamer::start):
+        (WebCore::AudioDestinationGStreamer::stop):
+        * platform/audio/gstreamer/AudioDestinationGStreamer.h: Added.
+        (WebCore::AudioDestinationGStreamer::isPlaying):
+        (WebCore::AudioDestinationGStreamer::sampleRate):
+        (WebCore::AudioDestinationGStreamer::sourceProvider):
+        * platform/audio/gstreamer/AudioFileReaderGStreamer.cpp: Added.
+        (WebCore::getGStreamerAudioCaps):
+        (WebCore::getFloatFromByteReader):
+        (WebCore::copyGstreamerBuffersToAudioChannel):
+        (WebCore::onAppsinkNewBufferCallback):
+        (WebCore::messageCallback):
+        (WebCore::onGStreamerDeinterleavePadAddedCallback):
+        (WebCore::onGStreamerDeinterleaveReadyCallback):
+        (WebCore::onGStreamerDecodebinPadAddedCallback):
+        (WebCore::AudioFileReader::AudioFileReader):
+        (WebCore::AudioFileReader::~AudioFileReader):
+        (WebCore::AudioFileReader::handleBuffer):
+        (WebCore::AudioFileReader::handleMessage):
+        (WebCore::AudioFileReader::handleNewDeinterleavePad):
+        (WebCore::AudioFileReader::deinterleavePadsConfigured):
+        (WebCore::AudioFileReader::plugDeinterleave):
+        (WebCore::AudioFileReader::createBus):
+        (WebCore::createBusFromAudioFile):
+        (WebCore::createBusFromInMemoryAudioFile):
+        * platform/audio/gtk/AudioBusGtk.cpp: Added.
+        (WebCore::AudioBus::loadPlatformResource):
+
+2011-10-27  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rebaseline of the bindings tests after r98501 which
+        removed getOwnPropertySlotVirtual.
+
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        * bindings/scripts/test/JS/JSTestObj.h:
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+
+2011-10-27  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        WebInspector: View throughs the exception when a child view are removed by removeChildren call.
+        https://bugs.webkit.org/show_bug.cgi?id=71002
+
+        Another followup fix after r98225.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        (WebInspector.DatabaseTableView.prototype._queryError):
+
+2011-10-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Execution line in selected call frame should keep showing after toggling format source.
+        https://bugs.webkit.org/show_bug.cgi?id=70906
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/debugger/selected-call-frame-after-formatting-source.html
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.setFormatSource):
+
+2011-10-27  Steve Block  <steveblock@google.com>
+
+        Numerous debug build fixes
+
+        Unreviewed build fix.
+
+        No new tests, buuld fix only.
+
+        * loader/icon/IconDatabase.cpp: urlForLogging() is used by both LOG() and LOG_ERROR()
+        * storage/AbstractDatabase.h: databaseDebugName() is used by both LOG() and LOG_ERROR()
+        * storage/DatabaseTask.cpp: m_complete is only available when !LOG_DISABLED
+
+2011-10-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Refactor ScriptsPanel so that ConsoleView does not depend on it.
+        https://bugs.webkit.org/show_bug.cgi?id=70899
+
+        Moved methods used in console view to DebuggerPresentationModel.
+        Changed debuggerPaused handler logic so that selectedCallFrame is never null when debugger is paused.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype.getSelectedCallFrameVariables.propertiesCollected):
+        (WebInspector.DebuggerPresentationModel.prototype.getSelectedCallFrameVariables):
+        (WebInspector.DebuggerPresentationModel.prototype._dispatchExecutionLineChanged):
+        (WebInspector.DebuggerPresentationModel.prototype.get executionLineLocation):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._consoleCommandEvaluatedInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype._executionLineChanged):
+        (WebInspector.ScriptsPanel.prototype._updateExecutionLine):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.ScriptsPanel.prototype._updateCallFrame):
+
+2011-10-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Add support for advanced search in content scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=70923
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ScriptsSearchScope.js:
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+
+2011-10-27  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed one line fix for DOMStorageItemsView.
+        It have to use this.detachChildViews instead of this.element.removeChildren after r98225.
+
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+
+2011-10-27  Antti Koivisto  <antti@apple.com>
+
+        Matched declaration cache
+        https://bugs.webkit.org/show_bug.cgi?id=70931
+
+        Reviewed by Darin Adler.
+
+        Sets of style declarations are applied repeatedly for different elements when calculating the document style.
+        The same set of applied declarations results in the same non-inherited style, independent of the element and 
+        its context. We can use this to build a cache to speed up style applying and to share more style data for
+        reduced memory usage.
+        
+        The patch reduces RenderStyle memory use ~40% and total memory use by ~7% over HTML5 spec load.
+        It is also ~10% progression in PerformanceTests/Parser/html5-full-render.html.
+
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSProperty.h:
+        (WebCore::CSSProperty::CSSProperty):
+        (WebCore::CSSProperty::isInherited):
+        
+            We need to know which properties are inherited, something we didn't have available so far.
+        
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchAllRules):
+        
+            A set of declarations is only cacheable if it contains no element specific style. This way we
+            don't need to worry about cache invalidation. The whole style selector is reconstructed if the
+            stylesheets change, invalidating the cache too.
+    
+        (WebCore::CSSStyleSelector::styleForElement):
+        
+            Trigger image loads bit earlier so cached style will have them too.
+        
+        (WebCore::CSSStyleSelector::applyDeclaration):
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        
+            Allow skipping over non-inherited properties.
+        
+        (WebCore::CSSStyleSelector::computeDeclarationHash):
+        
+            Hash function for declartion cache lookups.
+        
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::CSSStyleSelector::findFromMatchedDeclarationCache):
+        
+            Lookup from cache.
+        
+        (WebCore::CSSStyleSelector::addToMatchedDeclarationCache):
+        
+            Add to cache.
+        
+        (WebCore::CSSStyleSelector::applyMatchedDeclarations):
+        
+            If cached style is found, copy the non-inherited properties from the cache and apply the inherited properties (if any) only.
+        
+            Font and zoom changes force full applying as they can affect values of other properties (this can be relaxed later).
+        
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::MatchResult::MatchResult):
+        
+            Cacheability bit.
+        
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::copyNonInheritedFrom):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::copyNonInheritedFrom):
+        * rendering/style/SVGRenderStyle.h:
+        
+            Functions for assembling RenderStyle from non-inherited parts of the cached style.
+
+2011-10-27  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [Extensions API] add ignoreCache flag to options of inspectedWindow.reload()
+        https://bugs.webkit.org/show_bug.cgi?id=70926
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/extensions-ignore-cache.html
+
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onReload):
+        * inspector/front-end/externs.js:
+        ():
+
+2011-10-26  Steve Falkenburg  <sfalken@apple.com>
+
+        ResourceError doesn't support custom domains on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=70983
+        <rdar://problem/10352145>
+
+        Reviewed by Oliver Hunt.
+
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::platformLazyInit): Add fallback case for unknown error types.
+
+2011-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Fix a slider thumb rendering regression in Chromium on OS X in r98520.
+
+        Reviewed by Anders Carlsson.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSliderThumb): Reverted the changes to the Chromium code path.
+
+2011-10-26  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Unreviewed, rolling out r98486.
+        http://trac.webkit.org/changeset/98486
+        https://bugs.webkit.org/show_bug.cgi?id=70748
+
+        Broke Chromium's test_expectation.txt
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::State::State):
+        (WebCore::PlatformContextSkia::State::cloneInheritedProperties):
+        (WebCore::PlatformContextSkia::clipPathAntiAliased):
+        (WebCore::PlatformContextSkia::restore):
+        (WebCore::PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2011-10-26  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10350775> REGRESSION (r97032): Slider thumb is not drawn
+        https://bugs.webkit.org/show_bug.cgi?id=70891
+
+        Reviewed by Anders Carlsson.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::ThemeMac::ensuredView): Set the WebCoreFlippedView’s size, because NSSliderCell
+        always shrinks the slider thumb to fit in the control view’s bounds.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSliderThumb): Removed workaround code no longer needed after
+        r97032.
+
+2011-10-26  Chris Rogers  <crogers@google.com>
+
+        Add AudioSourceProviderClient and setFormat() method so we can know audio stream format
+        https://bugs.webkit.org/show_bug.cgi?id=70155
+
+        Reviewed by Eric Carlson.
+
+        No new tests.  There isn't yet an implementation to test.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::createMediaPlayer):
+        (WebCore::HTMLMediaElement::setAudioSourceNode):
+        Let MediaPlayer know about the MediaElementAudioSourceNode so it can callback with audio stream format information.
+        * platform/audio/AudioSourceProvider.h:
+        (WebCore::AudioSourceProvider::setClient):
+        Add abstract setClient() method so a client may know about stream format information when it becomes available.
+        * platform/audio/AudioSourceProviderClient.h: Copied from Source/WebCore/webaudio/MediaElementAudioSourceNode.h.
+        (WebCore::AudioSourceProviderClient::~AudioSourceProviderClient):
+        Add abstract class AudioSourceProviderClient which implements setFormat() to receive audio stream format information.
+        * webaudio/MediaElementAudioSourceNode.cpp:
+        (WebCore::MediaElementAudioSourceNode::setFormat):
+        Concrete implementation of setFormat() so MediaElementAudioSourceNode can create necessary audio converters.
+        * webaudio/MediaElementAudioSourceNode.h:
+        Make MediaElementAudioSourceNode implement AudioSourceProviderClient so it can get audio stream format information
+        when its setFormat() method is called.
+
+2011-10-26  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Unreviewed, rolling out r98483.
+        http://trac.webkit.org/changeset/98483
+        https://bugs.webkit.org/show_bug.cgi?id=47156
+
+        Change is causing some crashes and ASSERTs.
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::lookupImageForSize):
+        (WebCore::CachedImage::lookupImageForRenderer):
+        (WebCore::CachedImage::lookupOrCreateImageForRenderer):
+        (WebCore::CachedImage::setContainerSizeForRenderer):
+        (WebCore::CachedImage::imageSizeForRenderer):
+        (WebCore::CachedImage::computeIntrinsicDimensions):
+        (WebCore::CachedImage::createImage):
+        * loader/cache/CachedImage.h:
+        * page/ChromeClient.h:
+        * rendering/ImageBySizeCache.cpp:
+        (WebCore::ImageBySizeCache::addClient):
+        (WebCore::ImageBySizeCache::removeClient):
+        (WebCore::ImageBySizeCache::imageForSize):
+        (WebCore::ImageBySizeCache::sizeForClient):
+        * rendering/ImageBySizeCache.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::RenderImage):
+        (WebCore::RenderImage::imageDimensionsChanged):
+        (WebCore::RenderImage::isLogicalWidthSpecified):
+        (WebCore::RenderImage::isLogicalHeightSpecified):
+        (WebCore::RenderImage::computeReplacedLogicalWidth):
+        (WebCore::RenderImage::computeReplacedLogicalHeight):
+        (WebCore::RenderImage::calcAspectRatioLogicalWidth):
+        (WebCore::RenderImage::calcAspectRatioLogicalHeight):
+        * rendering/RenderImage.h:
+        * rendering/RenderImageResource.cpp:
+        (WebCore::RenderImageResource::setContainerSizeForRenderer):
+        * rendering/RenderImageResourceStyleImage.cpp:
+        * rendering/RenderImageResourceStyleImage.h:
+        (WebCore::RenderImageResourceStyleImage::image):
+        (WebCore::RenderImageResourceStyleImage::setContainerSizeForRenderer):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::computePreferredLogicalWidths):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computeIntrinsicLogicalWidth):
+        (WebCore::RenderReplaced::computeIntrinsicLogicalHeight):
+        (WebCore::RenderReplaced::computeReplacedLogicalWidth):
+        * rendering/style/StyleCachedImage.cpp:
+        (WebCore::StyleCachedImage::computeIntrinsicDimensions):
+        (WebCore::StyleCachedImage::setContainerSizeForRenderer):
+        (WebCore::StyleCachedImage::addClient):
+        (WebCore::StyleCachedImage::removeClient):
+        * rendering/style/StyleCachedImage.h:
+        * rendering/style/StyleGeneratedImage.h:
+        (WebCore::StyleGeneratedImage::setContainerSizeForRenderer):
+        * rendering/style/StyleImage.h:
+        * rendering/style/StylePendingImage.h:
+        (WebCore::StylePendingImage::setContainerSizeForRenderer):
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeIntrinsicWidth):
+        (WebCore::RenderSVGRoot::computeIntrinsicHeight):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::calcViewport):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/svg/RenderSVGRoot.h:
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::determineViewport):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::relativeWidthValue):
+        (WebCore::SVGSVGElement::relativeHeightValue):
+        (WebCore::SVGSVGElement::currentViewBoxRect):
+        * svg/SVGSVGElement.h:
+        (WebCore::SVGSVGElement::setContainerSize):
+        (WebCore::SVGSVGElement::containerSize):
+        (WebCore::SVGSVGElement::hasSetContainerSize):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::setContainerSize):
+        (WebCore::SVGImage::usesContainerSize):
+        (WebCore::SVGImage::size):
+        (WebCore::SVGImage::hasRelativeWidth):
+        (WebCore::SVGImage::hasRelativeHeight):
+        (WebCore::SVGImage::draw):
+        (WebCore::SVGImage::computeIntrinsicDimensions):
+        (WebCore::SVGImage::dataChanged):
+        * svg/graphics/SVGImage.h:
+
+2011-10-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Constructors for all TextTrack interfaces should be available on DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=70734
+
+        Reviewed by Sam Weinig.
+        
+        window-properties-expected.txt and global-constructors-expected.txt updated for this change.
+
+        * page/DOMWindow.idl: Add HTMLTrackElement, TextTrack, and TextTrackCueList.
+
+2011-10-25  Andy Estes  <aestes@apple.com>
+
+        REGRESSION (r93108): Shadow DOM media controls created for plug-in backed media elements.
+        https://bugs.webkit.org/show_bug.cgi?id=70872
+
+        Reviewed by Eric Carlson.
+
+        r93108 added a call to HTMLMediaElement::configureMediaControls() in
+        HTMLMediaElement::prepareForLoad(), which creates shadow DOM media
+        controls and is only appropriate to call when media elements are not
+        backed by plug-in proxies.
+
+        Resolve this by refactoring configureMediaControls() to do the right
+        thing for the plug-in proxy case by calling MediaPlayer::setControls().
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::attributeChanged): Call
+        configureMediaControls() directly and remove the preprocessor
+        conditional.
+        (WebCore::HTMLMediaElement::configureMediaControls): Call
+        MediaPlayer::setControls() if PLUGIN_PROXY_FOR_VIDEO is enabled.
+
+2011-10-26  Jon Lee  <jonlee@apple.com>
+
+        selectedIndex gets set from -1 to 0 when modifying options
+        https://bugs.webkit.org/show_bug.cgi?id=70547
+        <rdar://problem/8388856>
+
+        Reviewed by Darin Adler.
+
+        Changing the text causes a recalculation of the list items, which in the menu list case
+        forces the first element to be selected. We check the value of the selected option prior,
+        and restore it if it differs.
+
+        Test: fast/dom/HTMLSelectElement/selected-index-preserved-when-option-text-changes.html
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText):
+        * html/HTMLSelectElement.h: promote usesMenuList() from private to public for use by HTMLOptionElement
+
+2011-10-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Embedded PDFs should be known to DocumentLoader
+        https://bugs.webkit.org/show_bug.cgi?id=70864
+
+        Reviewed by Darin Adler.
+
+        * WebCore.exp.in: Added exports.
+
+2011-10-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove getOwnPropertySlotVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=70741
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        Removed all declarations and definitions of getOwnPropertySlotVirtual.
+        Also replaced all call sites to getOwnPropertyVirtualVirtual with a 
+        corresponding lookup in the MethodTable.
+
+        * WebCore.exp.in:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::DialogHandler::returnValue):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertySlot):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneSerializer::getSparseIndex):
+        (WebCore::CloneSerializer::getProperty):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        (GenerateConstructorDeclaration):
+        (GenerateConstructorDefinition):
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/qt/qt_runtime.cpp:
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        * bridge/runtime_object.h:
+
+2011-10-26  Alejandro G. Castro  <alex@igalia.com>
+
+        [GTK] Fix distcheck compilation
+        https://bugs.webkit.org/show_bug.cgi?id=70921
+
+        Add EventTargetFactory.in to the dist files, required after
+        r98388.
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am:
+
+2011-10-26  Michael Saboff  <msaboff@apple.com>
+
+        Increase StringImpl Flag Bits for 8 bit Strings
+        https://bugs.webkit.org/show_bug.cgi?id=70937
+
+        Increased the number of bits used for flags in StringImpl
+        from 6 to 8 bits. This frees up 2 flag bits that will be
+        used for 8-bit string support. Updated hash methods accordingly.
+        Changed hash value masking from the low bits to the high
+        bits.
+
+        Reviewed by Darin Adler.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHashValue):
+
+2011-10-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        REGRESSION (r94887): Scrolling the HTML spec is more jerky now than it was (regression)
+        https://bugs.webkit.org/show_bug.cgi?id=70857
+
+        Revert r94887, because it regressed performance.
+
+        Rubber-stamped by Antti Koivisto.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::parentStylePreventsSharing):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        (WebCore::checkForSiblingStyleChanges):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::childrenAffectedByDirectAdjacentRules):
+        (WebCore::InheritedFlags::setChildrenAffectedByDirectAdjacentRules):
+
+2011-10-26  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Need workaround for the red crossed circle in the status bar not bringing up the console when clicked
+        https://bugs.webkit.org/show_bug.cgi?id=70928
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/inspector.css:
+        (#error-count-img):
+        (#error-count + #warning-count-img):
+        (#warning-count-img):
+        * inspector/front-end/inspector.js:
+        (WebInspector._updateErrorAndWarningCounts):
+
+2011-10-26  Mike Reed  <reed@google.com>
+
+        [skia] replace offscreen technique with native support for antialiased clipping
+        https://bugs.webkit.org/show_bug.cgi?id=70748
+
+        Reviewed by Stephen White.
+
+        ~100 layout tests need to be rebaselined, as the native aa-clipping differs sometimes in the low
+        bits of the result. Other than that, the results should be the same, except that now the drawing
+        can go directly to the canvas, rather than being direct offscreen and then have that result
+        "clipped" during the restore. This has the effect of allowing LCD text to be drawing inside a
+        antialiased clip area.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::State::State):
+        (WebCore::PlatformContextSkia::State::cloneInheritedProperties):
+        (WebCore::PlatformContextSkia::clipPathAntiAliased):
+        (WebCore::PlatformContextSkia::restore):
+
+2011-10-26  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        CSS 2.1 failure: background-intrinsic-*
+        https://bugs.webkit.org/show_bug.cgi?id=47156
+
+        SVGs do not work as tiled background images
+        https://bugs.webkit.org/show_bug.cgi?id=16281
+
+        Apply preserveAspectRatio and synthesize viewboxes in <img>
+        https://bugs.webkit.org/show_bug.cgi?id=34521
+
+        SVG background doesn't resize properly when dimensions are changed
+        https://bugs.webkit.org/show_bug.cgi?id=42944
+
+        Images with percent height inside a floated div should use intrinsic height.
+        https://bugs.webkit.org/show_bug.cgi?id=45439
+
+        SVG image in HTML changes size as the window is resized
+        https://bugs.webkit.org/show_bug.cgi?id=52045
+
+        Reviewed by Antti Koivisto.
+
+        Implement intrinsic sizing support for SVGImage (svg embedded through <html:img>/<svg:image>/background-image/border-image/...).
+        This is demanded by CSS 2.1, and covered by new layout tests in LayoutTests/css2.1 and several new custom testcases.
+
+        Tests: css2.1/20110323/background-intrinsic-001.htm
+               css2.1/20110323/background-intrinsic-002.htm
+               css2.1/20110323/background-intrinsic-003.htm
+               css2.1/20110323/background-intrinsic-004.htm
+               css2.1/20110323/background-intrinsic-005.htm
+               css2.1/20110323/background-intrinsic-006.htm
+               css2.1/20110323/background-intrinsic-007.htm
+               css2.1/20110323/background-intrinsic-008.htm
+               css2.1/20110323/background-intrinsic-009.htm
+               svg/as-background-image/background-image-preserveaspectRatio-support.html (adapted from testcase from bug 34521)
+               svg/as-background-image/background-image-tiled.html (reduction from bug 16281)
+               svg/as-background-image/same-image-two-instances-background-image.html
+               svg/as-image/img-preserveAspectRatio-support-1.html (reduction from bug 34521)
+               svg/as-image/same-image-two-instances.html
+               svg/as-image/svg-as-relative-image-with-explicit-size.html
+               svg/as-image/svg-image-change-content-size.xhtml (reduction from bug 42944)
+               svg/zoom/page/zoom-img-preserveAspectRatio-support-1.html
+
+        * loader/cache/CachedImage.cpp: Enable SVGImage <-> IntSize cache.
+        (WebCore::CachedImage::lookupImageForSize): Use recently introduced ImageBySizeCache, to lookup an image for a certain size.
+        (WebCore::CachedImage::lookupImageForRenderer): Lookup image by renderer, which first looks up a size for a renderer, then uses lookupImageForSize().
+        (WebCore::createSVGImage): Refactored from createImage(), contains the SVGImage creation part only.
+        (WebCore::CachedImage::lookupOrCreateImageForRenderer): Use recently introduced ImageBySizeCache, to dynamically create copies of m_image if needed.
+        (WebCore::CachedImage::setContainerSizeForRenderer): For SVGImages, pass on container size handling to ImageBySizeCache.
+        (WebCore::CachedImage::imageSizeForRenderer): Figure out the image size, respecting per-renderer overrides, for a certain renderer.
+        (WebCore::CachedImage::computeIntrinsicDimensions): Remove unnecessary RenderObject parameter.
+        (WebCore::CachedImage::addClientForRenderer): Special variant of addClient(), overriding the existing in CachedResource.
+        (WebCore::CachedImage::removeClientForRenderer): Special variant of removeClient(), that also clears the image in the ImageBySizeCache.
+        (WebCore::CachedImage::createImage): Refactor SVGImage creation into createSVGImage() free function, to be useable from lookupOrCreateImageForRenderer().
+        * loader/cache/CachedImage.h: Expose removeClientForRenderer().
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::isSVGImageChromeClient): Used to identify whether a RenderSVGRoot is embedded through a SVGImage. Returns false, by default.
+        * rendering/ImageBySizeCache.cpp:
+        (WebCore::ImageBySizeCache::addClient): Assert the passed renderer is valid.
+        (WebCore::ImageBySizeCache::removeClient): Ditto. Allow removeClient() to be called w/o prio addClient() usage.
+        (WebCore::ImageBySizeCache::setClient): New helper function, that combines the usage of addClient/removeClient, for the use in CachedImage.
+        (WebCore::ImageBySizeCache::imageForSize): Respect empty sizes, just return 0, instead of asserting.
+        (WebCore::ImageBySizeCache::imageForRenderer): Added a helper that retrieves an image for a renderer, by lookup up its size and using imageForSize().
+        * rendering/ImageBySizeCache.h: Expose setClient() & imageForRenderer().
+        * rendering/RenderBoxModelObject.cpp: Implement CSS 2.1 intrinsic size negotiation for images.
+        (WebCore::resolveWidthForRatio): New inline helper function used bz calculateImageIntrinsicDimensions.
+        (WebCore::resolveHeightForRatio): Ditto.
+        (WebCore::resolveAgainstIntrinsicWidthOrHeightAndRatio): Ditto.
+        (WebCore::resolveAgainstIntrinsicRatio):  Ditto.
+        (WebCore::RenderBoxModelObject::calculateImageIntrinsicDimensions): New helper function, containing the main algorithm, which is a pure transcription of the spec.
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Use new calculateImageIntrinsicDimensions() helper to figure out the intrinsic size.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Propagate calculateFillTileSize() result to the image resource, via setContainerSizeForRenderer().
+        (WebCore::RenderBoxModelObject::paintNinePieceImage): Use new calculateImageIntrinsicDimensions() helper to figure out the intrinsic size.
+        * rendering/RenderBoxModelObject.h: Clarify some variable names, added calculateImageIntrinsicDimensions().
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::RenderImage): Use IntSize(), instead of IntSize(0, 0).
+        (WebCore::RenderImage::updateIntrinsicSizeIfNeeded): Refactored from imageDimensionsChanged().
+        (WebCore::RenderImage::imageDimensionsChanged): Use updateIntrinsicSizeIfNeeded().
+        (WebCore::RenderImage::computeReplacedLogicalWidth): Use RenderReplaced::computeReplacedLogicalWidth() exclusively. For this to work, the intrinsic size must be correct.
+        (WebCore::RenderImage::computeIntrinsicRatioInformation): Default implementation for non-SVGImages.
+        (WebCore::RenderImage::needsPreferredWidthsRecalculation): Return true, just like RenderPart, if embeddedContentBox is not null.
+        (WebCore::RenderImage::embeddedContentBox): Returns the RenderSVGRoot* renderer of the embedded SVG, if possible.
+        * rendering/RenderImage.h: Remove isLogicalWidth/HeightSpecified() / computeReplacedLogicalHeight() / calcAspectRatioLogicalWidth/Height().
+        * rendering/RenderImageResource.cpp:
+        (WebCore::RenderImageResource::setContainerSizeForRenderer): Pass around new "float containerZoomFactor" parameter.
+        * rendering/RenderImageResourceStyleImage.cpp:
+        (WebCore::RenderImageResourceStyleImage::image): embeddedContentBox() is now calling image() earlier than before. We now have to handle the case that the image is pending.
+        (WebCore::RenderImageResourceStyleImage::setContainerSizeForRenderer): Pass zoom factor.
+        * rendering/RenderImageResourceStyleImage.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::computePreferredLogicalWidths): Pass effective zoom to setContainerSizeForRenderer().
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computeIntrinsicLogicalWidth): Generalized this code, as RenderImage is using it as well now. Marginal changes needed.
+        (WebCore::RenderReplaced::computeIntrinsicLogicalHeight): Ditto.
+        (WebCore::RenderReplaced::computeReplacedLogicalWidth): Ditto.
+        * rendering/style/StyleCachedImage.cpp:
+        (WebCore::StyleCachedImage::computeIntrinsicDimensions): Stop passing m_renderer to CachedImage, it's no longer needed.
+        (WebCore::StyleCachedImage::setContainerSizeForRenderer): Add "float containerZoomFactor" parameter.
+        (WebCore::StyleCachedImage::addClient): Forward to new addClientForRenderer().
+        (WebCore::StyleCachedImage::removeClient): Call new removeClientForRenderer() instead of removeClient(), so the ImageBySizeCache is also updated.
+        * rendering/style/StyleCachedImage.h: Add "float containerZoomFactor" parameter to setContainerSizeForRenderer.
+        * rendering/style/StyleGeneratedImage.h:
+        (WebCore::StyleGeneratedImage::setContainerSizeForRenderer): Ditto.
+        * rendering/style/StyleImage.h: Ditto.
+        * rendering/style/StylePendingImage.h:
+        (WebCore::StylePendingImage::setContainerSizeForRenderer): Ditto.
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout): Always supply a container size when embedding SVGs in <svg:image>.
+        * rendering/svg/RenderSVGRoot.cpp: Move "override container size" from SVGSVGElement into RenderSVGRoot, where it belongs.
+        (WebCore::RenderSVGRoot::isEmbeddedThroughImageElement): Add helper method to determine whether we're loaded through SVGImage.
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): If we have a valid container size, it has precendence (only supplied via external SVGImages).
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Ditto.
+        (WebCore::RenderSVGRoot::layout): Remove calcViewport() usage, no need to track/override the viewport size anymore, all done in coputeReplacedLogical* now.
+        (WebCore::RenderSVGRoot::paint): Use borderBoxRect() which now always matches the previously computed m_viewportSize. 
+        (WebCore::RenderSVGRoot::computeRectForRepaint): Ditto.
+        * rendering/svg/RenderSVGRoot.h: Move "override container size" from SVGSVGElement into RenderSVGRoot, where it belongs.
+        (WebCore::RenderSVGRoot::containerSize):
+        (WebCore::RenderSVGRoot::setContainerSize):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::determineViewport): Resolve lengths against override container size in documents embedded through SVGImage.
+        * svg/SVGSVGElement.cpp: Remove "override container size" handling from SVGSVGElement.
+        (WebCore::SVGSVGElement::SVGSVGElement): Ditto.
+        (WebCore::SVGSVGElement::currentViewBoxRect): Always synthesize a viewBox, if we're embedded through SVGImage, as demanded by SVG 1.1 2nd Edition.
+        * svg/SVGSVGElement.h:
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImageChromeClient::setObserver): Helper function.
+        (WebCore::SVGImageChromeClient::isSVGImageChromeClient): Return true, used to identify whether RenderSVGRoot is embedded through SVGImage.
+        (WebCore::SVGImage::setContainerZoom): Forwarded to Page::setPageZoomFactor.
+        (WebCore::SVGImage::setContainerSize): Assert that container size is not empty. We should never receive an empty container size.
+        (WebCore::SVGImage::usesContainerSize): Adapt to override container size changes, it now lives in RenderSVGRoot instead of SVGSVGElement.
+        (WebCore::SVGImage::size): New algorithm to figure out the size of an embedded SVG, as demanded by the CSS/SVG specs.
+        (WebCore::SVGImage::draw): Stop calling layout() while painting!
+        (WebCore::SVGImage::embeddedContentBox): Add helper which returns the RenderSVGRoot of the document.
+        (WebCore::SVGImage::computeIntrinsicDimensions): Implement intrinsic ratio calculation. 
+        (WebCore::SVGImage::dataChanged): Force calling FrameView::setCanHaveScrollbars(false), as SVG images now always synthesize a viewBox, and thus never receive scrollbars.
+        * svg/graphics/SVGImage.h:
+
+2011-10-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Properly suspend/resume Geolocation/DeviceMotion/DeviceOrientation objects
+        https://bugs.webkit.org/show_bug.cgi?id=70328
+
+        Reviewed by Simon Hausmann.
+
+        Also remove checks for m_client in DeviceMotionController as it can never be null.
+
+        No new tests, as the suspend/resume functionality is not fully working yet.
+
+        * dom/DeviceMotionController.cpp:
+        (WebCore::DeviceMotionController::timerFired):
+        (WebCore::DeviceMotionController::addListener):
+        (WebCore::DeviceMotionController::removeListener):
+        (WebCore::DeviceMotionController::removeAllListeners):
+        (WebCore::DeviceMotionController::suspend):
+        (WebCore::DeviceMotionController::resume):
+        * dom/DeviceMotionController.h:
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::suspend):
+        (WebCore::DeviceOrientationController::resume):
+        * dom/DeviceOrientationController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::suspendActiveDOMObjects):
+        (WebCore::Document::resumeActiveDOMObjects):
+        (WebCore::Document::stopActiveDOMObjects):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::GeolocationController):
+        (WebCore::GeolocationController::removeObserver):
+        (WebCore::GeolocationController::suspend):
+        (WebCore::GeolocationController::resume):
+        * page/GeolocationController.h:
+
+2011-10-26  Pavel Feldman  <pfeldman@google.com>
+
+        Not reviewed: follow up to 98236 - moved inspector settings initialization earlier to unbreak settings panel.
+
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel):
+
+2011-10-26  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Name viewport change event consistently.
+        https://bugs.webkit.org/show_bug.cgi?id=70901
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use ViewportPropertiesDidChange term consistently throughout WebKit.
+
+        No tests needed as the change is only method renaming.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::dispatchViewportPropertiesDidChange):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::dispatchViewportPropertiesDidChange):
+        * page/Page.cpp:
+        (WebCore::Page::updateViewportArguments):
+
+2011-10-25  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Canvas2D should rate-limit drawing to prevent swamping the GPU process.
+        https://bugs.webkit.org/show_bug.cgi?id=70367
+
+        Reviewed by James Robinson.
+
+        Sadly, we don't have infrastructure to test this kind of GPU swamping
+        yet.
+
+        * WebCore.gypi:
+        Add RateLimiter.* to the Chromium build.
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::contentChanged):
+        When the layer is notified that the contents have changed, ping the
+        rate limiter.
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
+        Call (new) virtual contentChanged() on a layer when its contents have
+        been changed (e.g., by a drawing call).
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::contentChanged):
+        New virtual contentChanged().
+        * platform/graphics/chromium/RateLimiter.cpp: Added.
+        (WebCore::RateLimiter::create):
+        Rate limiter factory function.
+        (WebCore::RateLimiter::RateLimiter):
+        (WebCore::RateLimiter::start):
+        Public API to start rate limiting a context.
+        (WebCore::RateLimiter::stop):
+        Public API to stop rate limiting a context.
+        (WebCore::RateLimiter::rateLimitContext):
+        Internal timer callback when a context should be rate limited.
+        * platform/graphics/chromium/RateLimiter.h: Added.
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::WebGLLayerChromium):
+        Remove rate limiting timer and extension check (moved to RateLimiter).
+        (WebCore::WebGLLayerChromium::contentChanged):
+        The function formerly known as setTextureUpdated(), now renamed to
+        match the base class virtual contentChanged().  Call rate limiter in
+        CCLayerTreeHost (local implementation removed).
+        (WebCore::WebGLLayerChromium::setContext):
+        When the context is changed, stop the pending rate limiter on the old
+        context.  Remove extension check (moved to RateLimiter).
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        Remove rate limiting timer and extension check (moved to RateLimiter).
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::startRateLimiter):
+        Public API for starting per-context rate limiter.
+        (WebCore::CCLayerTreeHost::stopRateLimiter):
+        Public API for stopping per-context rate limiter.
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        Implementation of per-GraphicsContext3D RateLimiter.
+
+
+2011-10-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fixing inspector extensions tests.
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onAddConsoleMessage):
+
+2011-10-26  Balazs Kelemen  <kbalazs@webkit.org>
+
+        ParallelJobs path of FEConvolveMatrix is erroneous
+        https://bugs.webkit.org/show_bug.cgi?id=70409
+
+        Reviewed by Zoltan Herczeg.
+
+        Covered by existing tests.
+
+        * platform/graphics/filters/FEConvolveMatrix.cpp:
+        (WebCore::FEConvolveMatrix::fastSetInteriorPixels):
+        Reject the silly idea that bytes per pixel ratio is 3 in preserveAlphaValues mode.
+        The bug was hidden so far because that computation has no effect when we are going
+        with the full inferior area in one round (in that case clipBottom and yEnd are equals
+        and the value of the expression is always 0). With ParallelJobs we process sub-areas
+        on each thread which has triggered the issue.
+
+2011-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98393.
+        http://trac.webkit.org/changeset/98393
+        https://bugs.webkit.org/show_bug.cgi?id=70892
+
+        "Compilation is broken on Chromium Webkit Mac Builder (dbg) "
+        (Requested by yurys on #webkit).
+
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::setMasksToBounds):
+        (WebCore::LayerChromium::setMaskLayer):
+
+2011-10-26  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: order console message parameters for better optional parameters handling.
+        https://bugs.webkit.org/show_bug.cgi?id=70809
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/Inspector.json:
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl):
+        (WebInspector.ConsoleMessageImpl.prototype._formatMessage):
+        * inspector/front-end/ConsoleModel.js:
+        (WebInspector.ConsoleModel.prototype._messageRepeatCountUpdated):
+        (WebInspector.ConsoleMessage.create):
+        (WebInspector.ConsoleDispatcher.prototype.messageAdded):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult):
+        (WebInspector.ConsoleMessage.create):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onAddConsoleMessage):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithResponse):
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2011-10-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Debugger fails when there is an invalid watch expression.
+        https://bugs.webkit.org/show_bug.cgi?id=70718
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/debugger/watch-expressions-panel-switch.html
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+
+2011-10-26  Fady Samuel  <fsamuel@chromium.org>
+
+        Page Scale Factor broken when navigating history on pages with child frames
+        https://bugs.webkit.org/show_bug.cgi?id=70459
+
+        Reviewed by Darin Fisher.
+
+        With frameScaleFactor now always returning 1.0 for subframes and pageScaleFactor for the mainFrame,
+        and there being only a single pageScaleFactor, history for scaling is broken. Scaling history is
+        saved on a per frame basis but restored, overriding the per-page pageScaleFactor multiple times.
+        As a result, sometimes pages that have subframes end up getting a scale factor of 1.0 instead
+        of the correct scale factor that was assigned to the main frame.
+
+        No new tests because I don't know how to test this.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::restoreScrollPositionAndViewState):
+
+2011-10-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98429.
+        http://trac.webkit.org/changeset/98429
+        https://bugs.webkit.org/show_bug.cgi?id=70881
+
+        "webkit_gpu_tests fail in Chromium" (Requested by yurys on
+        #webkit).
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::initialize):
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::layerRendererContext):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::enabled):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initialize):
+        (WebCore::CCLayerTreeHost::context):
+        (WebCore::CCLayerTreeHost::setNeedsAnimate):
+        (WebCore::CCLayerTreeHost::setNeedsCommitThenRedraw):
+        (WebCore::CCLayerTreeHost::setNeedsRedraw):
+        (WebCore::CCLayerTreeHost::composite):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCSettings::CCSettings):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::setThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2011-10-26  Ben Wells  <benwells@chromium.org>
+
+        Canvas drawImage with SourceIn, DestinationIn, SourceOut, DestinationAtop and Copy have errors
+        https://bugs.webkit.org/show_bug.cgi?id=66920
+
+        Reviewed by James Robinson.
+
+        Test: fast/canvas/canvas-composite-image.html
+
+        Use the same method as fills to handle composited drawImage calls that will affect the whole
+        canvas. To do this code used when doing fills has been factored into seperate functions and
+        used by drawImage. Some functions used to do these types of operations have also been renamed.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::isFullCanvasCompositeMode):
+        (WebCore::CanvasRenderingContext2D::fill):
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::calculateCompositingBufferRect):
+        (WebCore::CanvasRenderingContext2D::createCompositingBuffer):
+        (WebCore::CanvasRenderingContext2D::compositeBuffer):
+        (WebCore::CanvasRenderingContext2D::fullCanvasCompositedDrawImage):
+        (WebCore::CanvasRenderingContext2D::fullCanvasCompositedFill):
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2011-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98379.
+        http://trac.webkit.org/changeset/98379
+        https://bugs.webkit.org/show_bug.cgi?id=70875
+
+        Did not pass on JSC ports (Requested by abarth on #webkit).
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateArgumentsCountCheck):
+        (GenerateImplementation):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * page/DOMWindow.idl:
+
+2011-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98346.
+        http://trac.webkit.org/changeset/98346
+        https://bugs.webkit.org/show_bug.cgi?id=70874
+
+        Breaks JSC-based bots. (Requested by pfeldman on #webkit).
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+
+2011-10-25  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Enable threaded compositing via CCThreadProxy::hasThread only
+        https://bugs.webkit.org/show_bug.cgi?id=70838
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::initialize):
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::layerRendererContext):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::enabled):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initialize):
+        (WebCore::CCLayerTreeHost::context):
+        (WebCore::CCLayerTreeHost::setNeedsAnimate):
+        (WebCore::CCLayerTreeHost::setNeedsCommitThenRedraw):
+        (WebCore::CCLayerTreeHost::setNeedsRedraw):
+        (WebCore::CCLayerTreeHost::composite):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCSettings::CCSettings):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::hasThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+
+2011-10-25  Xiaomei Ji  <xji@chromium.org>
+
+        --webkit-visual-word does not work in multi-line
+        https://bugs.webkit.org/show_bug.cgi?id=61344
+
+        Reviewed by Ryosuke Niwa.
+
+        Get next or previous root inline box (which is not in the same
+        render object as the current root inline box) by traversing DOM node.
+
+        Test: editing/selection/move-by-word-visually-inline-block-positioned-element.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousRootInlineBox):
+        (WebCore::nextRootInlineBox):
+        (WebCore::leftInlineBox):
+        (WebCore::rightInlineBox):
+
+2011-10-25  Adam Barth  <abarth@webkit.org>
+
+        JSEventTarget.cpp has a bunch of unnessary includes
+        https://bugs.webkit.org/show_bug.cgi?id=70865
+
+        Reviewed by Eric Seidel.
+
+        In the process of removing these includes, I noticed we had a bunch of
+        non-autogenerated code in this file, which I've now autogenerated.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+            - One subtly here is the outter static_cast, which is caused by an
+              inheritance infelicity in JavaScriptAudioNode, which I've noted
+              with a FIXME.  In any case, the extra static_cast shouldn't cause
+              any trouble.
+        * webaudio/JavaScriptAudioNode.h:
+
+2011-10-25  Adam Barth  <abarth@webkit.org>
+
+        V8DOMWrapper.cpp has unneeded header includes
+        https://bugs.webkit.org/show_bug.cgi?id=70863
+
+        Reviewed by Eric Seidel.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Resetting baseline for test bindings
+
+        Unreviewed preemptive build fix
+
+        No new tests.
+
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        * bindings/scripts/test/JS/JSTestObj.h:
+
+2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove deletePropertyVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=70738
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        Removed all declarations and definitions of deletePropertyVirtual.
+        Also replaced all call sites to deletePropertyVirtual with a 
+        corresponding lookup in the MethodTable.
+
+        * WebCore.exp.in:
+        * bindings/js/JSDOMStringMapCustom.cpp:
+        (WebCore::JSDOMStringMap::deleteProperty):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::deleteProperty):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::deleteProperty):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::deleteProperty):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::deleteProperty):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::deleteProperty):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject removeWebScriptKey:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_RemoveProperty):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::removeMember):
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+        * bridge/runtime_object.cpp:
+        * bridge/runtime_object.h:
+
+2011-10-25  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: WebKit does not expose HTML label for slider elements
+        https://bugs.webkit.org/show_bug.cgi?id=70856
+
+        Reviewed by Darin Adler.
+
+        Test: platform/mac/accessibility/slider-allows-title-ui-element.html
+
+        * accessibility/AccessibilitySlider.h:
+        (WebCore::AccessibilitySlider::isControl):
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove putVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=70740
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        Removed all declarations and definitions of putVirtual.
+        Also replaced all call sites to putVirtual with a 
+        corresponding lookup in the MethodTable.
+
+        * WebCore.exp.in:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::put):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectCustomPut):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::putProperty):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetProperty):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::setMember):
+        (JavaJSObject::setSlot):
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+        * bridge/runtime_object.cpp:
+        * bridge/runtime_object.h:
+        * bridge/testqtbindings.cpp:
+        (main):
+
+2011-10-25  Adam Barth  <abarth@webkit.org>
+
+        EventTargetFactory.in is not sorted
+        https://bugs.webkit.org/show_bug.cgi?id=70855
+
+        Reviewed by Eric Seidel.
+
+        This patch sorts the file.  I was not able to measure a performance
+        difference using the microbenchmark included with this patch.
+
+        * dom/EventTargetFactory.in:
+
+2011-10-25  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Windows build.  Windows mashes all these files into
+        one, which doesn't respect the compilation unit rules of C++.
+
+        * bindings/js/JSEventCustom.cpp:
+        * bindings/js/JSEventTarget.cpp:
+
+2011-10-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Moving to the start of line should not place the caret outside of the table
+        https://bugs.webkit.org/show_bug.cgi?id=70757
+
+        Reviewed by Chang Shu.
+
+        The bug was caused by positionAvoidingFirstPositionInTable. Get rid of the function.
+
+        Test: editing/selection/table-lineboundary.html
+
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+
+2011-10-25  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=70852
+        Setting up a HiDPI base-level GraphicsContext should be more straightforward for 
+        WebKit2
+
+        Reviewed by Dan Bernstein.
+
+        This patch removes the old cg-only GraphicsContext::setBaseCTM() api, and adds 
+        platform-independent GraphicsContext::applyDeviceScaleFactor().
+        * WebCore.exp.in:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::platformApplyDeviceScaleFactor):
+        (WebCore::GraphicsContext::applyDeviceScaleFactor):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::platformApplyDeviceScaleFactor):
+
+        Since this patch removes GraphicsContext::setBaseCTM(), this code has been 
+        reverted to do what it used to do before that was added; it just calls into 
+        WebCoreSystemInterface directly.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+
+2011-10-25  Anders Carlsson  <andersca@apple.com>
+
+        Plug-ins have to use JavaScript to find out the current device scale factor
+        https://bugs.webkit.org/show_bug.cgi?id=67225
+
+        Reviewed by Darin Adler.
+
+        Test: platform/mac-wk2/plugins/contents-scale-factor.html
+
+        Add NPNVcontentsScaleFactor, as per https://wiki.mozilla.org/NPAPI:ContentsScaleFactor.
+
+        * plugins/npapi.h:
+
+2011-10-25  Adam Klein  <adamk@chromium.org>
+
+        Forward declare MutationObserverEntry as a struct to fix clang build
+        https://bugs.webkit.org/show_bug.cgi?id=70853
+
+        Reviewed by Ryosuke Niwa.
+
+        Node.h forward declared MutationObserverEntry as a class, and clang
+        complains if the two declarations don't match.
+
+        * dom/Node.h:
+
+2011-10-25  Dan Bernstein  <mitz@apple.com>
+
+        Caret can be positioned or repainted incorrectly in flipped-blocks multi-column blocks
+        https://bugs.webkit.org/show_bug.cgi?id=70851
+
+        Reviewed by Dave Hyatt.
+
+        * manual-tests/caret-in-columns-flipped.html: Added.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustForColumns): Removed flipped-blocks writing mode considerations
+        from this function, since not all callers were expecting it to account for flippedness. This makes
+        it similar to adjustRectForColumns() in not adjusting for flippedness.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer): In the columns case, account for flipped-blocks modes
+        by first mapping the point and the offset to non-flipped, non-columns space, then adjusting for
+        columns, then flipping.
+
+2011-10-25  Michal Mocny  <mmocny@google.com>
+
+        LayerRendererChromium::setVisible called needlessly without a visibility change
+        https://bugs.webkit.org/show_bug.cgi?id=70766
+
+        Reviewed by Kenneth Russell.
+
+        Check that visibility has actually changed before calling LayerRendererChromium::setVisible
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::setVisible):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+
+2011-10-25  Anders Carlsson  <andersca@apple.com>
+
+        REGRESSION(97821): HistoryController::itemsAreClones crashes a lot
+        https://bugs.webkit.org/show_bug.cgi?id=70827
+        <rdar://problem/10342925>
+
+        Reviewed by Adam Barth.
+
+        Check that m_currentItem is non-null before passing it to itemsAreClones. While I wasn't
+        able to make a test case that would reproduce this crash, we do check m_currentItem for null
+        everywhere else, and the crash log indicates that this would fix the crash.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::recursiveUpdateForCommit):
+
+2011-10-25  Adam Barth  <abarth@webkit.org>
+
+        EventTarget.h shouldn't need to know about every feature and ifdef
+        https://bugs.webkit.org/show_bug.cgi?id=70659
+
+        Reviewed by Darin Adler.
+
+        This patch follows the approach of Event.h and introduces an
+        interfaceName virtual function that returns the name of the DOM
+        interface for the concrete type of the object.  This function lets us
+        remove a large number of fake dynamic casts.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/action_makenames.py:
+            - Teach action_makenames how to handle the new "in" file.
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+            - Use the new autogenerated macro to remove a large amount of
+              feature-specific code.
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        * bindings/objc/DOM.mm:
+        (kit):
+            - The SVGElementInstance branch was never taken previously because
+              SVGElementInstance::toNode returns a non-NULL value. This code
+              was introduced in http://trac.webkit.org/changeset/42618 and
+              doesn't appear to have ever worked as the author intended.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+            - Use the new autogenerated macro to remove a large amount of
+              feature-specific code.
+        * dom/EventNames.cpp:
+        (WebCore::EventNames::EventNames):
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * dom/EventTargetFactory.in: Added.
+            - Add a new "in" file that lists all the EventTargets.
+        * dom/LocalMediaStream.cpp:
+        (WebCore::LocalMediaStream::interfaceName):
+        * dom/LocalMediaStream.h:
+        * dom/MediaStream.cpp:
+        (WebCore::MediaStream::interfaceName):
+        * dom/MediaStream.h:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::interfaceName):
+        * dom/MessagePort.h:
+        * dom/Node.cpp:
+        (WebCore::Node::toNode):
+        (WebCore::Node::interfaceName):
+        * dom/Node.h:
+        * dom/make_event_factory.pl:
+            - Generalize make_event_factory.pl to be able to generate
+              interfaces for different namespaces.
+        * fileapi/FileReader.cpp:
+        (WebCore::FileReader::interfaceName):
+        * fileapi/FileReader.h:
+        * fileapi/FileWriter.cpp:
+        (WebCore::FileWriter::interfaceName):
+        * fileapi/FileWriter.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::interfaceName):
+        * loader/appcache/DOMApplicationCache.h:
+        * notifications/Notification.cpp:
+        (WebCore::Notification::interfaceName):
+        * notifications/Notification.h:
+        (WebCore::Notification::scriptExecutionContext):
+        * p2p/PeerConnection.cpp:
+        (WebCore::PeerConnection::interfaceName):
+        * p2p/PeerConnection.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::interfaceName):
+        (WebCore::DOMWindow::toDOMWindow):
+        * page/DOMWindow.h:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::interfaceName):
+        * page/EventSource.h:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::interfaceName):
+        * storage/IDBDatabase.h:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::interfaceName):
+        * storage/IDBRequest.h:
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::interfaceName):
+        * storage/IDBTransaction.h:
+        * storage/IDBVersionChangeRequest.cpp:
+        (WebCore::IDBVersionChangeRequest::interfaceName):
+        * storage/IDBVersionChangeRequest.h:
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::interfaceName):
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::toNode):
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::interfaceName):
+        (WebCore::AudioContext::scriptExecutionContext):
+        * webaudio/AudioContext.h:
+        * webaudio/JavaScriptAudioNode.cpp:
+        (WebCore::JavaScriptAudioNode::interfaceName):
+        * webaudio/JavaScriptAudioNode.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::interfaceName):
+        * websockets/WebSocket.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::interfaceName):
+        * workers/DedicatedWorkerContext.h:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerConnectTask::performTask):
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::interfaceName):
+        * workers/SharedWorker.h:
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::interfaceName):
+        * workers/SharedWorkerContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::interfaceName):
+        * workers/Worker.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::interfaceName):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::interfaceName):
+        * xml/XMLHttpRequestUpload.h:
+
+2011-10-25  Pavel Podivilov  <podivilov@chromium.org>
+
+        Fix several minor problems in idls.
+        https://bugs.webkit.org/show_bug.cgi?id=70811
+
+        Reviewed by Adam Barth.
+
+        This patch does not have any effect on generated bindings.
+
+        * dom/DataTransferItems.idl:
+        * page/History.idl:
+        * storage/IDBIndex.idl:
+        * xml/XMLHttpRequest.idl:
+
+2011-10-25  Nate Chapin  <japhet@chromium.org>
+
+        Make DocumentThreadableLoader a CachedResourceClient.
+        This will allow us to cache ThreadableLoaderClients as
+        appropriate in a later patch.
+        https://bugs.webkit.org/show_bug.cgi?id=61225
+
+        Reviewed by Antti Koivisto.
+
+        No new tests, no functionality change intended.
+
+        * WebCore.gypi:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::notifyFinished): CachedResourceClients don't send separate callbacks
+            for didFail() and didFinishLoading(), so we need to differentiate here.
+        (WebCore::DocumentThreadableLoader::loadRequest): Call CachedResourceLoader::requestRawResource()
+            instead of ResourceLoadScheduler::scheduleSubresourceLoad().
+        * loader/DocumentThreadableLoader.h:
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::data): Handle the complexity of some ThreadableLoaderClients setting
+            DoNotBufferData in ResoureLoaderOptions. If the DataBufferingPolicy is BufferData, then the
+            'data' input parameter will contain all data received so far, and we need to determine the
+            incremental data to forward to the clients. If the policy is DoNotBufferData, 'data' is just
+            the incremental data.
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedResource.cpp:
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::preloadResult):
+        (WebCore::CachedResource::didSendData):
+        (WebCore::CachedResource::didDownloadData):
+        (WebCore::CachedResource::setLoadFinishTime):
+        (WebCore::CachedResource::loadFinishTime):
+        * loader/cache/CachedResourceClient.h: Add several new callbacks needed by DocumentThreadableLoader.
+        * loader/cache/CachedResourceRequest.cpp:
+        (WebCore::CachedResourceRequest::didReceiveResponse): CachedResource::setResponse() can now cancel
+            the request, so protect appropriately.
+        * loader/cache/CachedResourceRequest.h:
+        * loader/chromium/CachedRawResourceChromium.cpp: Added (plumb didDownloadData() to DocumentThreadableLoader).
+        * loader/chromium/CachedResourceRequestChromium.cpp: Added (plumb didDownloadData() to DocumentThreadableLoader).
+        * loader/chromium/DocumentThreadableLoaderChromium.cpp:
+        * platform/network/BlobResourceHandle.cpp:
+        (WebCore::BlobResourceHandle::notifyResponse): Protect before setting response, since it might kill us.
+
+2011-10-25  Pavel Podivilov  <podivilov@chromium.org>
+
+        Get rid of optional parameters in the middle in IDLs.
+        https://bugs.webkit.org/show_bug.cgi?id=70816
+
+        Reviewed by Adam Barth.
+
+        Optional parameters in the middle are prohibited by WebIDL spec.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateArgumentsCountCheck):
+        (GenerateImplementation):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * page/DOMWindow.idl:
+
+2011-10-25  Chris Evans  <cevans@google.com>
+
+        Manage the CSS property array length correctly
+        https://bugs.webkit.org/show_bug.cgi?id=70783
+
+        Reviewed by Adam Barth.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::addProperty): don't allow max length to get out of sync with the buffer.
+
+2011-10-25  Tony Chang  <tony@chromium.org>
+
+        avoid unnecessary layouts of flex items during the flex pass
+        https://bugs.webkit.org/show_bug.cgi?id=70557
+
+        Reviewed by Ojan Vafai.
+
+        If the preferred size of a flex item is provided, we don't need to
+        layout the flex item when computing the preferred size.  This allows
+        us to only call layout on each flex item once in the common case.
+
+        No new tests, covered by existing tests.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::flowAwareLogicalWidthLengthForChild):
+        (WebCore::RenderFlexibleBox::preferredLogicalContentWidthForFlexItem):
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidth):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildrenInlineDirection):
+        * rendering/RenderFlexibleBox.h:
+
+2011-10-25  Fady Samuel  <fsamuel@chromium.org>
+
+        Crash in WebCore::RenderTableSection::addChild due to assert failure
+        https://bugs.webkit.org/show_bug.cgi?id=70678
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/table/table-anonymous-cell-bug.html
+               fast/table/table-anonymous-row-bug.html
+               fast/table/table-anonymous-section-bug.html
+
+        If the child being added is not a Section/Row/Cell, and the previous sibling is not anonymous, 
+        we need to create a new anonymous Section/Row/Cell respectively, instead of failing an
+        assert.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+
+2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add getOwnPropertySlot to MethodTable
+        https://bugs.webkit.org/show_bug.cgi?id=69807
+
+        Reviewed by Oliver Hunt.
+
+        No new tests.
+
+        * bridge/runtime_method.h: Changed getOwnPropertySlot to be protected so 
+        subclasses can reference it in their MethodTables.
+
+2011-10-25  Simon Fraser  <simon.fraser@apple.com>
+
+        REGRESSION (r88580): Cursor fails to change to pointer on embedded Google maps popups
+        https://bugs.webkit.org/show_bug.cgi?id=62797
+
+        Reviewed by Chris Marrin.
+        
+        When hit testing through transformed layers, RenderLayer would simply use
+        the composited bounds of the layer as the localHitTestRect for hit testing sublayers.
+        However, this broke hit testing on pages that have a composited, non-transformed layer
+        which falls outside the bounds of its parent, composited-transformed layer, like Google
+        Maps.
+        
+        Fix by mapping the hitTestRect through transforms. However this is tricky, because
+        mapping a rect into the coordinate system of a layer can result in invalid rectangles
+        when point projection results in a negative w component. Fix TransformationMatrix::projectPoint()
+        to detect this case and replace X and Y with large values, and add boundsOfProjectedQuad(), which 
+        maps rectangles with possibly-infinite location or bounds into rects which are representable
+        in an IntRect.
+
+        Tests: transforms/3d/hit-testing/composited-hit-test.html
+               transforms/3d/hit-testing/rotated-hit-test-with-child.html
+               transforms/3d/hit-testing/rotated-hit-test2.html
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::projectPoint):
+        (WebCore::TransformationMatrix::projectQuad):
+        (WebCore::clampEdgeValue):
+        (WebCore::TransformationMatrix::boundsOfProjectedQuad):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * rendering/HitTestingTransformState.cpp:
+        (WebCore::HitTestingTransformState::boundsOfMappedQuad):
+        * rendering/HitTestingTransformState.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2011-10-25  Adrienne Walker  <enne@google.com>
+
+        [chromium] Batch up texture uploads so that they can be updated incrementally
+        https://bugs.webkit.org/show_bug.cgi?id=70454
+
+        Reviewed by James Robinson.
+
+        Because texture uploads can sometimes take more than a frame to
+        complete, collect all the uploads that need to occur in a
+        CCTextureUpdater so that we can easily incrementally upload some of
+        them, interleaving input and drawing so that the compositor thread
+        continues to appear responsive during a commit.
+
+        This change doesn't actually interleave the commits, it just pushes
+        the infrastructure for doing so up to the CCProxy level so that a
+        future scheduler can make this decision.
+
+        VideoLayerChromium is the only layer type to not use this system. It
+        needs to be converted to use a texture updater first and it is less of
+        a priority than the tiled layers.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::beginCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setNeedsCommit):
+        (WebCore::CCSingleThreadProxy::doCommit):
+        (WebCore::CCSingleThreadProxy::commitIfNeeded):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp: Added.
+        (WebCore::CCTextureUpdater::CCTextureUpdater):
+        (WebCore::CCTextureUpdater::~CCTextureUpdater):
+        (WebCore::CCTextureUpdater::append):
+        (WebCore::CCTextureUpdater::update):
+        (WebCore::CCTextureUpdater::clear):
+        * platform/graphics/chromium/cc/CCTextureUpdater.h: Added.
+        (WebCore::CCTextureUpdater::allocator):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::commitOnImplThread):
+
+2011-10-24  Jer Noble  <jer.noble@apple.com>
+
+        compositing/video tests time out on Lion
+        https://bugs.webkit.org/show_bug.cgi?id=70448
+
+        Reviewed by Simon Fraser.
+
+        AVFoundation will not begin loading or decoding media until a consumer for that media is present.
+        For video-only media, this means that an AVPlayerLayer must be created and attached to the 
+        AVPlayer before the load state will ever reach "canPlayThrough". Once the metadata for a media
+        is loaded, create a AVPlayerLayer if the media has a video track.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::updateStates):
+
+2011-10-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Merge endOfLine with logicalEndOfLine and startOfLine with logicalStartOfLine
+        https://bugs.webkit.org/show_bug.cgi?id=70755
+
+        Reviewed by Chang Shu.
+
+        Merged endOfLine with logicalEndOfLine, and startOfLine with logicalStartOfLine
+        to reduce the code duplication.
+
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::startOfLine):
+        (WebCore::logicalStartOfLine):
+        (WebCore::endPositionForLine):
+        (WebCore::inSameLogicalLine):
+        (WebCore::endOfLine):
+        (WebCore::logicalEndOfLine):
+        * editing/visible_units.h:
+
+2011-10-25  Arko Saha  <arko@motorola.com>
+
+        Microdata: itemtype attribute should be space-separated list to allow multiple types.
+        https://bugs.webkit.org/show_bug.cgi?id=70501
+
+        Reviewed by Ryosuke Niwa.
+
+        Tests: fast/dom/MicroData/getitems-multiple-itemtypes.html
+               fast/dom/MicroData/itemtype-add-remove-tokens.html
+               fast/dom/MicroData/itemtype-attribute-test.html
+
+        * dom/MicroDataItemList.cpp:
+        (WebCore::MicroDataItemList::nodeMatches):
+        * html/DOMSettableTokenList.h:
+        (WebCore::DOMSettableTokenList::tokens):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        (WebCore::HTMLElement::setItemValueText):
+        (WebCore::HTMLElement::itemType):
+        (WebCore::HTMLElement::setItemType):
+        * html/HTMLElement.h:
+        * html/HTMLElement.idl:
+
+2011-10-25  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10337033> DOMRangeOfString:relativeTo:options has problems with -webkit-user-select: none
+
+        Reviewed by Adam Roben.
+
+        Test: added to TestWebKitAPI/Tests/mac/DOMRangeOfString.mm
+
+        * page/Page.cpp:
+        (WebCore::Page::rangeOfString): This function was incorrectly adding the StartInSelection option to
+        the initial search.
+
+2011-10-25  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: redesign workers sidebar pane
+        https://bugs.webkit.org/show_bug.cgi?id=70815
+
+        Changed workers sidebar pane design.
+
+        Now there is a link to worker inspector for each dedicated worker created
+        by inspected page. The sidebar display a link to a page with list of all
+        shared workers if there one is supported by the WebKit port. Also there
+        is a checkbox that allows pause all new workers on first statements.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._rebuildSectionsForStyleRules):
+        * inspector/front-end/WorkerManager.js:
+        (WebInspector.WorkerManager.prototype.openWorkerInspector):
+        (WebInspector.WorkerManager.prototype._workerInspectorClosing):
+        * inspector/front-end/WorkersSidebarPane.js:
+        (WebInspector.WorkerListSidebarPane):
+        (WebInspector.WorkerListSidebarPane.prototype._workerRemoved):
+        (WebInspector.WorkerListSidebarPane.prototype._workersCleared):
+        (WebInspector.WorkerListSidebarPane.prototype._addWorker):
+        (WebInspector.WorkerListSidebarPane.prototype._workerItemClicked):
+        (WebInspector.WorkerListSidebarPane.prototype._autoattachToWorkersClicked):
+        (WebInspector.WorkerListSidebarPane.prototype._createSharedWorkersLink.link.onclick):
+        (WebInspector.WorkerListSidebarPane.prototype._createSharedWorkersLink):
+        * inspector/front-end/elementsPanel.css:
+        * inspector/front-end/inspectorCommon.css:
+        (.sidebar-separator):
+        (.sidebar-label):
+        * inspector/front-end/scriptsPanel.css:
+        (.dedicated-worker-item):
+        (#shared-workers-list):
+        (#pause-workers-checkbox > input):
+
+2011-10-25  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Fix an ODR violation.
+        https://bugs.webkit.org/show_bug.cgi?id=70753
+
+        Reviewed by Anders Carlsson.
+
+        Both ScrollAnimatorNone and ScrollAnimatorMac define ScrollAnimator::create() on OS X.
+        Remove the unused one.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-10-25  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Debugger fails when there is an invalid watch expression.
+        https://bugs.webkit.org/show_bug.cgi?id=70718
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/debugger/watch-expressions-panel-switch.html
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+
+2011-10-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: fix empty line handling in source maps.
+        https://bugs.webkit.org/show_bug.cgi?id=70726
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/CompilerSourceMapping.js:
+        (WebInspector.ClosureCompilerSourceMapping.prototype._parseMappings):
+
+2011-10-25  Justin Schuh  <jschuh@chromium.org>
+
+        Check for empty string in parseArcFlag
+        https://bugs.webkit.org/show_bug.cgi?id=70763
+
+        Reviewed by Dirk Schulze.
+
+        Test: svg/path-invalid.html
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::parseArcFlag):
+
+2011-10-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: keep old source mapping when new one could not be loaded.
+        https://bugs.webkit.org/show_bug.cgi?id=70729
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype._updateSourceMapping.didCreateSourceMapping):
+        (WebInspector.RawSourceCode.prototype._updateSourceMapping):
+        (WebInspector.RawSourceCode.prototype._createSourceMapping.didLoadSourceMapping):
+
+2011-10-25  Sachin Puranik  <sachin.puranik@motorola.com>
+
+        Double number step=.5 should be considered valid in <input type="number" step=".5">
+        https://bugs.webkit.org/show_bug.cgi?id=70320
+
+        Reviewed by Kent Tamura.
+
+        Test: fast/forms/input-step-as-double.html
+
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::parseToDoubleForNumberType): Changed the function to consider
+        step as valid even if it starts with "."
+
+2011-10-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Chromium] Audits panel context menu for links not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=70813
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/AuditResultView.js:
+        (WebInspector.AuditResultView):
+        (WebInspector.AuditResultView.prototype._contextMenuEventFired):
+
+2011-10-25  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Resources panel: display the current search match index in the toolbar.
+        https://bugs.webkit.org/show_bug.cgi?id=66050
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/search/resources-search-match-index.html
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.performSearch.callback):
+        (WebInspector.ResourcesPanel.prototype.performSearch):
+        (WebInspector.ResourcesPanel.prototype._showSearchResult.callback):
+        (WebInspector.ResourcesPanel.prototype._showSearchResult):
+        (WebInspector.BaseStorageTreeElement.prototype.get searchMatchesCount):
+        (WebInspector.ResourcesSearchController):
+        (WebInspector.ResourcesSearchController.prototype.nextSearchResult):
+        (WebInspector.ResourcesSearchController.prototype.previousSearchResult):
+        (WebInspector.ResourcesSearchController.prototype._searchResult):
+        (WebInspector.SearchResultsTreeElementsTraverser.prototype.next):
+        (WebInspector.SearchResultsTreeElementsTraverser.prototype.previous):
+        (WebInspector.SearchResultsTreeElementsTraverser.prototype.matchIndex):
+        (WebInspector.SearchResultsTreeElementsTraverser.prototype._elementSearchMatchesCount):
+        (WebInspector.SearchResultsTreeElementsTraverser.prototype._traverseNext):
+        (WebInspector.SearchResultsTreeElementsTraverser.prototype._traversePrevious):
+        * inspector/front-end/treeoutline.js:
+
+2011-10-25  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: JS exception in JavaScriptSourceFrame.onShowPopover/showObjectPopover()
+        https://bugs.webkit.org/show_bug.cgi?id=70812
+
+        Reviewed by Pavel Feldman.
+
+        Check if highlighted element is present while displaying object popover.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.onShowPopover.showObjectPopover):
+        (WebInspector.JavaScriptSourceFrame.prototype.onShowPopover):
+
+2011-10-21  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Route Console::time and Console::timeEnd to trace_event
+        https://bugs.webkit.org/show_bug.cgi?id=70620
+
+        Reviewed by Pavel Feldman.
+
+        * page/Console.cpp:
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+
+2011-10-21  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [Extensions API] allow extensions to specify script to be injected on reload
+        https://bugs.webkit.org/show_bug.cgi?id=70600
+
+        Reviewed by Pavel Feldman.
+
+        - change webInspector.inspectedPage.reload() to accept multiple options in an object
+        - add an ability to inject a script upon a page reload
+        - return script id in addScriptToEvaluateOnLoad()
+        - provide removeScriptToEvaluateOnLoad()
+        - store scripts to evaluate on load in inspector state cookie
+
+        Test: inspector/extensions/extensions-reload.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::restore):
+        (WebCore::InspectorPageAgent::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorPageAgent::removeScriptToEvaluateOnLoad):
+        (WebCore::InspectorPageAgent::removeAllScriptsToEvaluateOnLoad):
+        (WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorPageAgent::frameNavigated):
+        * inspector/InspectorPageAgent.h:
+        * inspector/front-end/ExtensionAPI.js:
+        (injectedExtensionAPI.InspectedWindow.prototype.reload):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onReload):
+        * inspector/front-end/WorkersSidebarPane.js:
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation.callback):
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+
+2011-10-24  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: print expired message count before remaining messages.
+        https://bugs.webkit.org/show_bug.cgi?id=70736
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/Inspector-0.1.json:
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::enable):
+        (WebCore::InspectorConsoleAgent::restore):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/front-end/ConsoleModel.js:
+
+2011-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98309.
+        http://trac.webkit.org/changeset/98309
+        https://bugs.webkit.org/show_bug.cgi?id=70801
+
+        Test fails on mac (Requested by benwells on #webkit).
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::fill):
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::shouldDisplayTransparencyElsewhere):
+        (WebCore::CanvasRenderingContext2D::fillAndDisplayTransparencyElsewhere):
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2011-10-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Chromium build fix: #include window.h for HANDLE.
+
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+
+2011-10-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Include ThreadSafeRefCounted.h since the class declared in this header file
+        inherits from ThreadSafeRefCounted.
+
+        * storage/IDBIndexBackendInterface.h:
+
+2011-10-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Fix a typo.
+
+        * bindings/v8/JavaScriptCallFrame.h:
+
+2011-10-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed SharedUChar and tightened language around its previous uses
+        https://bugs.webkit.org/show_bug.cgi?id=70698
+
+        Reviewed by David Levin.
+
+        - Renamed "threadSafeCopy" and "crossThreadCopy" to "isolatedCopy" because
+        the former names gave the dangerous misimpression that the resulting object
+        was thread-safe, which is not true.
+        
+        - Updated a bunch of files for header dependency changes, now that
+        CrossThreadRefCounted is gone.
+
+        * ForwardingHeaders/wtf/CrossThreadRefCounted.h: Removed.
+        * WebCore.exp.in:
+        * bindings/js/ScriptHeapSnapshot.h:
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * css/CSSPropertySourceData.h:
+        * css/CSSValue.h:
+        * css/StyleMedia.h:
+        * css/WebKitCSSMatrix.h:
+        * dom/QualifiedName.h:
+        * fileapi/LocalFileSystem.h:
+        (WebCore::LocalFileSystem::SystemBasePath::operator String):
+        * history/CachedFrame.h:
+        * history/CachedPage.h:
+        * history/HistoryItem.h:
+        * html/canvas/CanvasStyle.h:
+        * inspector/InspectorResourceAgent.h:
+        * loader/FormState.h:
+        * loader/TextResourceDecoder.h:
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        (WebCore::IconDatabase::synchronousIconForPageURL):
+        (WebCore::IconDatabase::synchronousIconURLForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::databasePath):
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        (WebCore::ImportedIconURLForPageURLWorkItem::ImportedIconURLForPageURLWorkItem):
+        (WebCore::ImportedIconDataForPageURLWorkItem::ImportedIconDataForPageURLWorkItem):
+        * page/ContentSecurityPolicy.h:
+        * page/Coordinates.h:
+        (WebCore::Coordinates::isolatedCopy):
+        * page/Geoposition.h:
+        (WebCore::Geoposition::isolatedCopy):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::isolatedCopy):
+        * page/SecurityOrigin.h:
+        * page/animation/AnimationBase.h:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/FileChooser.h:
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/cf/SchedulePair.h:
+        * platform/network/BlobData.cpp:
+        (WebCore::BlobDataItem::detachFromCurrentThread):
+        (WebCore::BlobData::detachFromCurrentThread):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/MIMEHeader.h:
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceLoadInfo.h:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/sql/SQLValue.cpp:
+        (WebCore::SQLValue::SQLValue):
+        (WebCore::SQLValue::string):
+        * rendering/style/QuotesData.h:
+        * storage/AbstractDatabase.cpp:
+        (WebCore::updateGuidVersionMap):
+        (WebCore::AbstractDatabase::AbstractDatabase):
+        (WebCore::AbstractDatabase::performOpenAndVerify):
+        (WebCore::AbstractDatabase::stringIdentifier):
+        (WebCore::AbstractDatabase::displayName):
+        (WebCore::AbstractDatabase::fileName):
+        (WebCore::AbstractDatabase::setExpectedVersion):
+        (WebCore::AbstractDatabase::getCachedVersion):
+        * storage/ChangeVersionWrapper.cpp:
+        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::tableNames):
+        * storage/DatabaseDetails.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::setDatabaseDirectoryPath):
+        (WebCore::DatabaseTracker::databaseDirectoryPath):
+        (WebCore::DatabaseTracker::trackerDatabasePath):
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        (WebCore::DatabaseTracker::originPath):
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::populateOrigins):
+        (WebCore::DatabaseTracker::databaseNamesForOrigin):
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        (WebCore::DatabaseTracker::setQuota):
+        (WebCore::DatabaseTracker::recordCreatingDatabase):
+        (WebCore::DatabaseTracker::recordDeletingDatabase):
+        (WebCore::DatabaseTracker::recordDeletingOrigin):
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::trackOrigin):
+        (WebCore::OriginQuotaManager::addDatabase):
+        * storage/SQLError.h:
+        (WebCore::SQLError::message):
+        (WebCore::SQLError::SQLError):
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::SQLStatement):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageAreaSync.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::importItem):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::StorageTracker):
+        (WebCore::StorageTracker::syncImportOriginIdentifiers):
+        (WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::willDeleteAllOrigins):
+        * svg/SVGPathSeg.h:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::url):
+        (WebCore::SharedWorkerProxy::name):
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        (WebCore::PostMessageToPageInspectorTask::PostMessageToPageInspectorTask):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        (WebCore::WorkerRunLoop::Task::Task):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+
+2011-10-24  Adam Barth  <abarth@webkit.org>
+
+        Remove empty directory.
+
+        * p2p: Removed.
+
+2011-10-24  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor painting/updating/drawing code.
+        https://bugs.webkit.org/show_bug.cgi?id=70057
+
+        Reviewed by James Robinson.
+
+        This refactoring separates the "early exits" from the actual loop
+        that draws layers. As part of this, it was also appropriate to
+        clean up the way that masks and replicas are dealt with when
+        painting and updating. The purpose of all this is to make things
+        easier to test, and for a scissoring optimization that needs to
+        know exatly what gets drawn. Existing layout tests were able to
+        verify the refactoring did not change behavior.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayersOntoRenderSurfaces):
+        (WebCore::LayerRendererChromium::drawLayersInternal):
+        (WebCore::LayerRendererChromium::drawLayer):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::paintMaskAndReplicaForRenderSurface):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::layerShouldBeAppended):
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
+        (WebCore::CCLayerTreeHostCommon::calculateVisibleLayerRect):
+
+2011-10-24  Luke Macpherson   <macpherson@chromium.org>
+
+        REGRESSION(80893): HTML5 spec takes 2s longer to load due to time spent in CSSStyleSelector
+        https://bugs.webkit.org/show_bug.cgi?id=68944
+
+        Reviewed by Antti Koivisto.
+
+        No new tests / Covered by existing tests.
+
+        Removes all virtual dispatch from CSSStyleApplyProperty by converting to use static function pointers for dispatch.
+        Uses class templates instead of function templates to allow default parameters and also to share parameter declarations across static functions.
+        All constructor parameters become template parameters. This improves the level of compiler optimization that can be achieved.
+        Overall this achieved a ~2% overall speedup on run-safari PerformanceTests/Parser/html5-full-render.html,
+        and profiling showed a reduction in the time spent inside CSSStyleSelector::applyProperty().
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyExpanding::applyInheritValue):
+        (WebCore::ApplyPropertyExpanding::applyInitialValue):
+        (WebCore::ApplyPropertyExpanding::applyValue):
+        (WebCore::ApplyPropertyExpanding::createHandler):
+        (WebCore::ApplyPropertyDefaultBase::setValue):
+        (WebCore::ApplyPropertyDefaultBase::value):
+        (WebCore::ApplyPropertyDefaultBase::initial):
+        (WebCore::ApplyPropertyDefaultBase::applyInheritValue):
+        (WebCore::ApplyPropertyDefaultBase::applyInitialValue):
+        (WebCore::ApplyPropertyDefaultBase::applyValue):
+        (WebCore::ApplyPropertyDefaultBase::createHandler):
+        (WebCore::ApplyPropertyDefault::setValue):
+        (WebCore::ApplyPropertyDefault::applyValue):
+        (WebCore::ApplyPropertyDefault::createHandler):
+        (WebCore::ApplyPropertyStyleImage::applyValue):
+        (WebCore::ApplyPropertyStyleImage::createHandler):
+        (WebCore::ApplyPropertyAuto::setValue):
+        (WebCore::ApplyPropertyAuto::value):
+        (WebCore::ApplyPropertyAuto::hasAuto):
+        (WebCore::ApplyPropertyAuto::setAuto):
+        (WebCore::ApplyPropertyAuto::applyInheritValue):
+        (WebCore::ApplyPropertyAuto::applyInitialValue):
+        (WebCore::ApplyPropertyAuto::applyValue):
+        (WebCore::ApplyPropertyAuto::createHandler):
+        (WebCore::defaultInitialColor):
+        (WebCore::ApplyPropertyColor::applyInheritValue):
+        (WebCore::ApplyPropertyColor::applyInitialValue):
+        (WebCore::ApplyPropertyColor::applyValue):
+        (WebCore::ApplyPropertyColor::createHandler):
+        (WebCore::ApplyPropertyDirection::applyValue):
+        (WebCore::ApplyPropertyDirection::createHandler):
+        (WebCore::ApplyPropertyLength::setValue):
+        (WebCore::ApplyPropertyLength::applyValue):
+        (WebCore::ApplyPropertyLength::createHandler):
+        (WebCore::ApplyPropertyString::setValue):
+        (WebCore::ApplyPropertyString::applyValue):
+        (WebCore::ApplyPropertyString::createHandler):
+        (WebCore::ApplyPropertyBorderRadius::setValue):
+        (WebCore::ApplyPropertyBorderRadius::applyValue):
+        (WebCore::ApplyPropertyBorderRadius::createHandler):
+        (WebCore::ApplyPropertyFillLayer::applyInheritValue):
+        (WebCore::ApplyPropertyFillLayer::applyInitialValue):
+        (WebCore::ApplyPropertyFillLayer::applyValue):
+        (WebCore::ApplyPropertyFillLayer::createHandler):
+        (WebCore::ApplyPropertyComputeLength::setValue):
+        (WebCore::ApplyPropertyComputeLength::applyValue):
+        (WebCore::ApplyPropertyComputeLength::createHandler):
+        (WebCore::ApplyPropertyFont::applyInheritValue):
+        (WebCore::ApplyPropertyFont::applyInitialValue):
+        (WebCore::ApplyPropertyFont::applyValue):
+        (WebCore::ApplyPropertyFont::createHandler):
+        (WebCore::ApplyPropertyFontWeight::applyValue):
+        (WebCore::ApplyPropertyFontWeight::createHandler):
+        (WebCore::ApplyPropertyCounter::emptyFunction):
+        (WebCore::ApplyPropertyCounter::applyValue):
+        (WebCore::ApplyPropertyCounter::createHandler):
+        (WebCore::ApplyPropertyCursor::applyInheritValue):
+        (WebCore::ApplyPropertyCursor::applyInitialValue):
+        (WebCore::ApplyPropertyCursor::applyValue):
+        (WebCore::ApplyPropertyCursor::createHandler):
+        (WebCore::ApplyPropertyTextEmphasisStyle::applyInheritValue):
+        (WebCore::ApplyPropertyTextEmphasisStyle::applyInitialValue):
+        (WebCore::ApplyPropertyTextEmphasisStyle::applyValue):
+        (WebCore::ApplyPropertyTextEmphasisStyle::createHandler):
+        (WebCore::ApplyPropertyAnimation::setValue):
+        (WebCore::ApplyPropertyAnimation::value):
+        (WebCore::ApplyPropertyAnimation::test):
+        (WebCore::ApplyPropertyAnimation::clear):
+        (WebCore::ApplyPropertyAnimation::initial):
+        (WebCore::ApplyPropertyAnimation::map):
+        (WebCore::ApplyPropertyAnimation::accessAnimations):
+        (WebCore::ApplyPropertyAnimation::animations):
+        (WebCore::ApplyPropertyAnimation::applyInheritValue):
+        (WebCore::ApplyPropertyAnimation::applyInitialValue):
+        (WebCore::ApplyPropertyAnimation::applyValue):
+        (WebCore::ApplyPropertyAnimation::createHandler):
+        (WebCore::ApplyPropertyOutlineStyle::applyInheritValue):
+        (WebCore::ApplyPropertyOutlineStyle::applyInitialValue):
+        (WebCore::ApplyPropertyOutlineStyle::applyValue):
+        (WebCore::ApplyPropertyOutlineStyle::createHandler):
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleApplyProperty.h:
+        (WebCore::PropertyHandler::PropertyHandler):
+        (WebCore::PropertyHandler::applyInheritValue):
+        (WebCore::PropertyHandler::applyInitialValue):
+        (WebCore::PropertyHandler::applyValue):
+        (WebCore::PropertyHandler::isValid):
+        (WebCore::PropertyHandler::inheritFunction):
+        (WebCore::PropertyHandler::initialFunction):
+        (WebCore::PropertyHandler::applyFunction):
+        (WebCore::CSSStyleApplyProperty::propertyHandler):
+        (WebCore::CSSStyleApplyProperty::setPropertyHandler):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::invalidColor):
+
+2011-10-24  Ben Wells  <benwells@chromium.org>
+
+        Canvas drawImage with SourceIn, DestinationIn, SourceOut, DestinationAtop and Copy have errors
+        https://bugs.webkit.org/show_bug.cgi?id=66920
+
+        Reviewed by James Robinson.
+
+        Test: fast/canvas/canvas-composite-image.html
+
+        Use the same method as fills to handle composited drawImage calls that will affect the whole
+        canvas. To do this code used when doing fills has been factored into seperate functions and
+        used by drawImage. Some functions used to do these types of operations have also been renamed.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::isFullCanvasCompositeMode):
+        (WebCore::CanvasRenderingContext2D::fill):
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::calculateCompositingBufferRect):
+        (WebCore::CanvasRenderingContext2D::createCompositingBuffer):
+        (WebCore::CanvasRenderingContext2D::compositeBuffer):
+        (WebCore::CanvasRenderingContext2D::fullCanvasCompositedDrawImage):
+        (WebCore::CanvasRenderingContext2D::fullCanvasCompositedFill):
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2011-10-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98294 and r98306.
+        http://trac.webkit.org/changeset/98294
+        http://trac.webkit.org/changeset/98306
+        https://bugs.webkit.org/show_bug.cgi?id=70790
+
+        the first patch broke chromium-mac and the second gclient
+        (Requested by jchaffraix on #webkit).
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-10-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix after r98300.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+
+2011-10-24  Anders Carlsson  <andersca@apple.com>
+
+        It should be possible for Widget subclasses to control whether transforms affect the frame rect
+        https://bugs.webkit.org/show_bug.cgi?id=70787
+
+        Reviewed by Sam Weinig.
+
+        Currently RenderWidget sets the frame rect of it's hosted widget to the bounding box of the transformed
+        content box rect (unless the Widget is a frame view). It should be possible for Widget subclasses to override
+        this behavior and have the frame rect set to the absolute content box without any transforms applied.
+
+        * platform/Widget.h:
+        (WebCore::Widget::transformsAffectFrameRect):
+        Add new member function.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::updateWidgetGeometry):
+        Move shared code from setWidget and updateWidgetPosition out into a new function. If transformsAffectFrameRect returns 
+        false, just set the frame rect to the absolute content box.
+
+        (WebCore::RenderWidget::setWidget):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        Call updateWidgetGeometry.
+
+        * rendering/RenderWidget.h:
+
+2011-10-24  Arko Saha  <arko@motorola.com>
+
+        Microdata: Add itemprop, itemref, itemvalue attributes.
+        https://bugs.webkit.org/show_bug.cgi?id=69839
+
+        Reviewed by Ryosuke Niwa.
+
+        Tests: fast/dom/MicroData/itemprop-add-remove-tokens.html
+               fast/dom/MicroData/itemprop-for-an-element-must-be-correct.html
+               fast/dom/MicroData/itemprop-must-be-read-only.html
+               fast/dom/MicroData/itemprop-reflected-by-itemProp-property.html
+               fast/dom/MicroData/itemref-add-remove-tokens.html
+               fast/dom/MicroData/itemref-attribute-reflected-by-itemRef-property.html
+               fast/dom/MicroData/itemref-for-an-element-must-be-correct.html
+               fast/dom/MicroData/itemref-must-be-read-only.html
+               fast/dom/MicroData/itemvalue-reflects-data-attr-on-object-element.html
+               fast/dom/MicroData/itemvalue-reflects-href-attr.html
+               fast/dom/MicroData/itemvalue-reflects-src-attribute-on-img-element.html
+               fast/dom/MicroData/itemvalue-reflects-the-content-attr-on-meta-element.html
+               fast/dom/MicroData/itemvalue-reflects-the-src-attr.html
+               fast/dom/MicroData/itemvalue-returns-element-itself.html
+               fast/dom/MicroData/itemvalue-returns-null.html
+               fast/dom/MicroData/itemvalue-throws-excpetion-onsetting-001.html
+               fast/dom/MicroData/itemvalue-throws-excpetion-onsetting-002.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSHTMLElementCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::JSHTMLElement::itemValue):
+        (WebCore::JSHTMLElement::setItemValue):
+        * bindings/v8/custom/V8HTMLElementCustom.cpp:
+        (WebCore::toV8Object):
+        (WebCore::V8HTMLElement::itemValueAccessorGetter):
+        (WebCore::V8HTMLElement::itemValueAccessorSetter):
+        * dom/MicroDataItemList.cpp:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::itemValueText):
+        (WebCore::HTMLAnchorElement::setItemValueText):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::itemValueText):
+        (WebCore::HTMLAreaElement::setItemValueText):
+        * html/HTMLAreaElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        (WebCore::HTMLElement::itemProp): Returns element's itemprop content attribute.
+        (WebCore::HTMLElement::setItemProp): Sets itemprop value on changing elemet's
+        itemprop attribute.
+        (WebCore::HTMLElement::itemRef): Returns element's itemref content attribute.
+        (WebCore::HTMLElement::setItemRef): Sets itemref value on changing elemet's
+        itemref attribute.
+        (WebCore::HTMLElement::setItemValue): Sets element's itemvalue. If the element has no
+        itemprop attribute or if element has an itemscope attribute, it throws INVALID_ACCESS_ERR
+        exception.
+        (WebCore::HTMLElement::itemValue): Returns the elements itemvalue.
+
+        If the element has no itemprop attribute it returns null.
+        If the element has an itemscope attribute, it returns the element itself.
+        If the element is a meta element: It acts as it would if it was reflecting the element's
+        content content attribute.
+        If the element is an audio, embed, iframe, img, source, track, or video element: It acts
+        as it would if it was reflecting the element's src content attribute.
+        If the element is an a, area, or link element: It act as it would if it was reflecting the
+        href content attribute.
+        If the element is an object element: It acts as  it would if it was reflecting the element's
+        data content attribute.
+
+        (WebCore::HTMLElement::itemValueText):
+        (WebCore::HTMLElement::setItemValueText):
+        * html/HTMLElement.h:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::itemValueText):
+        (WebCore::HTMLEmbedElement::setItemValueText):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::itemValueText):
+        (WebCore::HTMLIFrameElement::setItemValueText):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::itemValueText):
+        (WebCore::HTMLImageElement::setItemValueText):
+        * html/HTMLImageElement.h:
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::itemValueText):
+        (WebCore::HTMLLinkElement::setItemValueText):
+        * html/HTMLLinkElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::itemValueText):
+        (WebCore::HTMLMediaElement::setItemValueText):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::itemValueText):
+        (WebCore::HTMLMetaElement::setItemValueText):
+        * html/HTMLMetaElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::itemValueText):
+        (WebCore::HTMLObjectElement::setItemValueText):
+        * html/HTMLObjectElement.h:
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::itemValueText):
+        (WebCore::HTMLSourceElement::setItemValueText):
+        * html/HTMLSourceElement.h:
+        * html/HTMLTrackElement.cpp:
+        (WebCore::HTMLTrackElement::itemValueText):
+        (WebCore::HTMLTrackElement::setItemValueText):
+        * html/HTMLTrackElement.h:
+        * html/MicroDataItemValue.cpp: Added.
+        (WebCore::MicroDataItemValue::MicroDataItemValue):
+        (WebCore::MicroDataItemValue::createFromString):
+        (WebCore::MicroDataItemValue::createFromNode):
+        * html/MicroDataItemValue.h: Added.
+        (WebCore::MicroDataItemValue::isNode):
+        (WebCore::MicroDataItemValue::getNode):
+        (WebCore::MicroDataItemValue::getString):
+
+2011-10-24  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Remove unused instance variable
+        https://bugs.webkit.org/show_bug.cgi?id=70750
+
+        Reviewed by Dimitri Glazkov.
+
+        * rendering/RenderTextControl.h:
+
+2011-10-24  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Fix an ODR violation.
+        https://bugs.webkit.org/show_bug.cgi?id=70753
+
+        Reviewed by Anders Carlsson.
+
+        Both ScrollAnimatorNone and ScrollAnimatorMac define ScrollAnimator::create() on OS X.
+        Remove the unused one.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-10-24  Tim Horton  <timothy_horton@apple.com>
+
+        feColorMatrix doesn't use the correct default "matrix" type when no type attribute is specified
+        https://bugs.webkit.org/show_bug.cgi?id=70035
+        <rdar://problem/10280177>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Make feColorMatrix's type attribute be "matrix" by default.
+
+        Test: svg/filters/feColorMatrix-default-type.svg
+
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::SVGFEColorMatrixElement):
+
+2011-10-24  Joshua Bell  <jsbell@chromium.org>
+
+        Unbreak binding generation tests
+        https://bugs.webkit.org/show_bug.cgi?id=70768
+
+        Reviewed by Darin Adler.
+
+        Update the expected output of V8 binding tests to match
+        results c/o https://bugs.webkit.org/show_bug.cgi?id=70065
+
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::idbKeyCallback):
+
+2011-10-21  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Add isTraceEventEnabled to PlatformSupport.
+        https://bugs.webkit.org/show_bug.cgi?id=70618
+
+        Reviewed by Darin Fisher.
+
+        * platform/chromium/PlatformSupport.h:
+
+2011-10-24  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Use StringBuilder in CSSRuleList::rulesText()/CSSSelectorList::selectorsText()
+        https://bugs.webkit.org/show_bug.cgi?id=70746
+
+        Reviewed by Tony Chang.
+
+        Covered by existing tests.
+
+        * css/CSSRuleList.cpp:
+        (WebCore::CSSRuleList::rulesText):
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::selectorsText):
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::cssText): Use CSSRuleList::rulesText() method instead of explicit loop.
+
+2011-10-24  Michael Saboff  <msaboff@apple.com>
+
+        WebKit doesn't build with recent changes to libdispatch
+        https://bugs.webkit.org/show_bug.cgi?id=70737
+
+        Added initialization for new WebKitSystemInterface function 
+        CreateVMPressureDispatchOnMainQueue.  Changed MemoryPressureHandler::install
+        to use new function.
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.  Moved functionality to WebKitSystemInterface.
+
+        * WebCore.exp.in:
+        * platform/mac/MemoryPressureHandlerMac.mm:
+        (WebCore::MemoryPressureHandler::install):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2011-10-24  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Throw DATA_ERR on invalid keys, remove null key support
+        https://bugs.webkit.org/show_bug.cgi?id=70065
+
+        Reviewed by Tony Chang.
+
+        Part 1 of a two-sided commit. Renames IDBKey::NullType to
+        IDBKey::InvalidType. JS binding yields this type rather
+        than throwing immediately so the correct exception type can
+        be raised. Checks for invalid keys added to front-end classes.
+
+        * bindings/js/JSIDBKeyCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (TypeCanFailConversion):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromValue):
+        * bindings/v8/custom/V8IDBKeyCustom.cpp:
+        (WebCore::toV8):
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::continueFunction):
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::cmp):
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * storage/IDBKey.cpp:
+        (WebCore::IDBKey::IDBKey):
+        (WebCore::IDBKey::compare):
+        * storage/IDBKey.h:
+        (WebCore::IDBKey::createInvalid):
+        * storage/IDBKeyRange.cpp:
+        (WebCore::IDBKeyRange::only):
+        (WebCore::IDBKeyRange::lowerBound):
+        (WebCore::IDBKeyRange::upperBound):
+        (WebCore::IDBKeyRange::bound):
+        * storage/IDBKeyRange.h:
+        (WebCore::IDBKeyRange::lowerBound):
+        (WebCore::IDBKeyRange::upperBound):
+        (WebCore::IDBKeyRange::bound):
+        * storage/IDBKeyRange.idl:
+        * storage/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeIDBKey):
+        (WebCore::IDBLevelDBCoding::decodeIDBKey):
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::get):
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::deleteFunction):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
+        * storage/IDBSQLiteBackingStore.cpp:
+        (WebCore::whereSyntaxForKey):
+        (WebCore::bindKeyToQuery):
+        (WebCore::lowerCursorWhereFragment):
+        (WebCore::upperCursorWhereFragment):
+        (WebCore::bindKeyToQueryWithNulls):
+        (WebCore::keyFromQuery):
+
+2011-10-24  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Make accelerated drawing work with threaded compositing
+        https://bugs.webkit.org/show_bug.cgi?id=70656
+
+        Reviewed by James Robinson.
+
+        Make sure that the compositor context is not used outside LayerTextureUpdater::updateTextureRect().
+        Created a FrameBuffer class that wraps skia gpu canvas and manages GL resources.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::createTextureUpdater):
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.cpp:
+        (WebCore::FrameBuffer::FrameBuffer::FrameBuffer):
+        (WebCore::FrameBuffer::FrameBuffer::~FrameBuffer):
+        (WebCore::FrameBuffer::FrameBuffer::initialize):
+        (WebCore::LayerTextureUpdaterSkPicture::LayerTextureUpdaterSkPicture):
+        (WebCore::LayerTextureUpdaterSkPicture::~LayerTextureUpdaterSkPicture):
+        (WebCore::LayerTextureUpdaterSkPicture::prepareToUpdate):
+        (WebCore::LayerTextureUpdaterSkPicture::updateTextureRect):
+        * platform/graphics/chromium/LayerTextureUpdaterCanvas.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initialize):
+
+2011-10-24  Adam Klein  <adamk@chromium.org>
+
+        Optimize Node::isInShadowTree to execute in constant-time
+        https://bugs.webkit.org/show_bug.cgi?id=67686
+
+        Reviewed by Dimitri Glazkov.
+
+        No expected change in behavior, so no new tests.
+
+        * dom/Node.cpp:
+        (WebCore::Node::isInShadowTree):
+
+2011-10-24  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose WebThread::postDelayedTask to CCThread
+        https://bugs.webkit.org/show_bug.cgi?id=70712
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCThread.h:
+
+2011-10-24  Levi Weintraub  <leviw@chromium.org>
+
+        <svg> fails to use explicit width and height inside <html> inside IFRAME
+        https://bugs.webkit.org/show_bug.cgi?id=64823
+
+        Reviewed by Nikolas Zimmermann.
+
+        Checking that embedded SVG is in an SVG document before negotiating size
+        with the host document.
+
+        Test: svg/as-object/svg-embedded-in-html-in-iframe.html
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::isEmbeddedThroughFrameContainingSVGDocument):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+
+2011-10-24  Rafael Weinstein  <rafaelw@chromium.org>
+
+        Node::registeredMutationObserversOfType should be prefixed by "get"
+        https://bugs.webkit.org/show_bug.cgi?id=70359
+
+        Reviewed by Ojan Vafai.
+
+        This change renames Node::registeredMutationObserversOfType to
+        Node::getRegisteredMutationObserversOfType per the WebKit style guide.
+
+        No tests needed as the change is only method renaming.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ChildListMutationScope.cpp:
+        (WebCore::MutationAccumulationRouter::MutationAccumulationRouter::incrementScopingLevel):
+        * dom/Element.cpp:
+        (WebCore::enqueueAttributesMutationRecord):
+        * dom/Node.cpp:
+        (WebCore::Node::getRegisteredMutationObserversOfType):
+        * dom/Node.h:
+
+2011-10-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename static getOwnPropertySlot to getOwnPropertySlotByIndex
+        https://bugs.webkit.org/show_bug.cgi?id=70271
+
+        Reviewed by Darin Adler.
+
+        No new tests.
+
+        Renaming versions of getOwnPropertySlot that use an unsigned as the property
+        name to "getOwnPropertySlotByIndex" in preparation for adding them to the 
+        MethodTable, which requires unique names for each method.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneSerializer::getSparseIndex):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertySlotVirtual):
+        (JSC::RuntimeArray::getOwnPropertySlotByIndex):
+        * bridge/runtime_array.h:
+
+2011-10-24  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB add should fail adding an inline and passed key simultaneously
+        https://bugs.webkit.org/show_bug.cgi?id=58598
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/mozilla/key-requirements-inline-and-passed.html
+
+        Implement the spec clause: passing a key into add() or put() when
+        the object store has a key path ("inline key") is an error.
+
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::put):
+
+2011-10-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Improve debug compositing border colors
+        https://bugs.webkit.org/show_bug.cgi?id=70742
+
+        Reviewed by Dean Jackson.
+
+        Improve the appearance of the debug borders used to indicate compositing:
+        1. Use green for normal layers, orange for tiled layers
+        2. Make the repaint counter translucent
+        3. Change the color of the repaint counter to show when accelerated drawing is enabled.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::updateDebugIndicators):
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+
+2011-10-24  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Fix make distcheck build
+        https://bugs.webkit.org/show_bug.cgi?id=69745
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+
+2011-10-24  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Adding a new style rule breaks things
+        https://bugs.webkit.org/show_bug.cgi?id=70721
+
+        Reviewed by Pavel Feldman.
+
+        We had used to swap BlankStylePropertiesSection prototype and recently got rid of this hack,
+        but still had dependencies on the old behavior.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._refreshStyleRules):
+        (WebInspector.ComputedStylePropertiesSection.prototype.rebuildComputedTrace):
+        (WebInspector.BlankStylePropertiesSection.prototype.get isBlank):
+        (WebInspector.BlankStylePropertiesSection.prototype.expand):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.successCallback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal):
+
+2011-10-24  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: do not force document loading on reload (should happen on demand).
+        https://bugs.webkit.org/show_bug.cgi?id=70724
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._documentUpdated):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.wasShown):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.setVisible):
+
+2011-10-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Drop MutableTextTrack and make TextTrack always mutable
+        https://bugs.webkit.org/show_bug.cgi?id=62890
+
+        The MutableTextTrack type was removed from the spec, all text tracks are now mutable.
+
+        Reviewed by Sam Weinig.
+
+        No new tests needed, the changes just refactor existing code.
+
+        * CMakeLists.txt: Remove all traces of MutableTextTrack.
+        * CodeGenerators.pri: Ditto.
+        * DerivedSources.cpp: Ditto.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/gobject/GNUmakefile.am: Ditto.
+        * bindings/gobject/WebKitHTMLElementWrapperFactory.cpp: Ditto.
+        * bindings/js/JSBindingsAllInOne.cpp: Ditto.
+
+        * bindings/js/JSTextTrackCustom.cpp: Removed.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::addTrack): Return a TextTrack instead of a MutableTextTrack.
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+        * html/LoadableTextTrack.cpp:
+        (WebCore::LoadableTextTrack::LoadableTextTrack): Return a TextTrack instead of a MutableTextTrack.
+
+        * html/MutableTextTrack.cpp: Removed.
+        * html/MutableTextTrack.h: Removed.
+        * html/MutableTextTrack.idl: Removed.
+
+        * html/TextTrack.cpp:
+        (WebCore::TextTrack::TextTrack): Remove Type parameter.
+        (WebCore::TextTrack::addCue): New, moved from MutableTextTrack.
+        (WebCore::TextTrack::removeCue): Ditto.
+        (WebCore::TextTrack::newCuesLoaded): Ditto.
+        (WebCore::TextTrack::fetchNewestCues): Ditto.
+        * html/TextTrack.h:
+        (WebCore::TextTrack::create): Remove Type parameter
+        * html/TextTrack.idl: Add addCue and removeCue.
+
+2011-10-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: allow debugging dedicated worker initialization
+        https://bugs.webkit.org/show_bug.cgi?id=70723
+
+        Now it is possible to pause each new dedicated worker on start. The user
+        needs to select a checkbox and then each newly created dedicated worker
+        will be paused on the first statement until the user resumes it explicitely.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/Inspector.json: resume command is added. It is similar to GDB's run
+        command, i.e. worker execution will be paused until explicit "resume" command is
+        received.
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::shouldPauseDedicatedWorkerOnStartImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::shouldPauseDedicatedWorkerOnStart):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::resume):
+        (WebCore::InspectorRuntimeAgent::pauseWorkerContext):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/InspectorWorkerAgent.cpp:
+        (WebCore::InspectorWorkerAgent::shouldPauseDedicatedWorkerOnStart): returns true
+        if the user chose to automatically pause all new workers.
+        * inspector/InspectorWorkerAgent.h:
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::WorkerInspectorController::resume):
+        * inspector/front-end/WorkerManager.js:
+        (WebInspector.WorkerManager.loaded):
+        (WebInspector.WorkerManager.loadCompleted):
+        (WebInspector.WorkerManager.prototype._workerCreated):
+        (WebInspector.WorkerManager.prototype.openWorkerInspector):
+        (WebInspector.WorkerManager.prototype._openInspectorWindow):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext): additional flag specifying
+        worker initial state(paused/not paused) is added to the factory method. The flag
+        will be carried to the corresponding WorkerThread.
+        (WebCore::WorkerMessagingProxy::connectToInspector):
+        * workers/WorkerMessagingProxy.h:
+
+2011-10-21  Nikita Vasilyev  <me@elv1s.ru>
+
+        Web Inspector: Make indent configurable
+        https://bugs.webkit.org/show_bug.cgi?id=69986
+
+        Add a setting to choose an indent from "8 spaces", "4 spaces" (default), "2 spaces", or "Tab character".
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+        (WebInspector.SettingsScreen.prototype._createSelectSetting.get p):
+        (WebInspector.SettingsScreen.prototype._createSelectSetting.changeListener):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel):
+        * inspector/front-end/TextViewer.js:
+
+2011-10-17  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: add "Add to Watch" option to context menu on selection in source frame
+        https://bugs.webkit.org/show_bug.cgi?id=69924
+
+        Reviewed by Pavel Feldman.
+
+        - added 'Add to Watch' context menu item in scripts panel;
+        - include both default and custom items into a context menu if selection is present;
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.suggestedFileName):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.addToWatch):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.populateSelectionContextMenu):
+        (WebInspector.TextViewerDelegateForSourceFrame.prototype.populateSelectionContextMenu):
+        (WebInspector.SourceFrameDelegate.prototype.suggestedFileName):
+        (WebInspector.SourceFrameDelegate.prototype.addToWatch):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._contextMenu):
+        (WebInspector.TextViewerDelegate.prototype.populateSelectionContextMenu):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane.prototype.addExpression):
+        (WebInspector.WatchExpressionsSidebarPane.prototype._addButtonClicked):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+        (WebInspector.WatchExpressionsSection.prototype.addNewExpressionAndEdit):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::showContextMenu):
+
+2011-10-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Audits hang on pages without img[src] elements
+        https://bugs.webkit.org/show_bug.cgi?id=70604
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/audits/audits-panel-noimages-functional.html
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.getStyles):
+
+2011-10-24  Deepak Sherveghar  <bpwv64@motorola.com>
+
+        [Qt] fast/events/media-focus-in-standalone-media-document.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=70110
+
+        Reviewed by Simon Hausmann.
+
+        ExtensionMap should also include media files mapping.
+
+        * platform/qt/MIMETypeRegistryQt.cpp: Added media files mapping.
+
+2011-10-24  Pavel Feldman  <pfeldman@google.com>
+
+        Not reviewed: [chromium] follow up to 98228 - added missing css.
+
+        * WebCore.gypi:
+
+2011-10-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: Make CSS files load upon View demand; split inspector.css into views.
+        https://bugs.webkit.org/show_bug.cgi?id=70694
+
+        Reviewed by Yury Semikhatsky.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView):
+        * inspector/front-end/PanelEnablerView.js:
+        * inspector/front-end/ProfilesPanel.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        * inspector/front-end/ResourcesPanel.js:
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/TextViewer.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/WelcomeView.js:
+        (WebInspector.WelcomeView):
+        * inspector/front-end/auditsPanel.css: Renamed from Source/WebCore/inspector/front-end/audits.css.
+
+2011-10-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: make view load CSS files upon show.
+        https://bugs.webkit.org/show_bug.cgi?id=70696
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/view-css.html
+
+        * inspector/front-end/View.js:
+        (WebInspector.View):
+        (WebInspector.View.prototype._callOnVisibleChildren):
+        (WebInspector.View.prototype._processWillShow):
+        (WebInspector.View.prototype._processWasShown):
+        (WebInspector.View.prototype._processWillHide):
+        (WebInspector.View.prototype._processWasHidden):
+        (WebInspector.View.prototype._processOnResize):
+        (WebInspector.View.prototype.show):
+        (WebInspector.View.prototype.detach):
+        (WebInspector.View.prototype.registerRequiredCSS):
+        (WebInspector.View.prototype._loadCSSIfNeeded):
+        (WebInspector.View.prototype._doLoadCSS):
+        (WebInspector.View.prototype._disableCSSIfNeeded):
+        (WebInspector.View.prototype._doUnloadCSS):
+
+2011-10-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: make DataGrid a view
+        https://bugs.webkit.org/show_bug.cgi?id=70695
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/ApplicationCacheItemsView.js:
+        (WebInspector.ApplicationCacheItemsView.prototype._createDataGrid):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._updateWithCookies):
+        (WebInspector.SimpleCookiesTable):
+        (WebInspector.SimpleCookiesTable.prototype.setCookies):
+        * inspector/front-end/CookiesTable.js:
+        (WebInspector.CookiesTable):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype.onResize):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        (WebInspector.DatabaseQueryView.prototype._queryError):
+        (WebInspector.DatabaseQueryView.prototype._appendViewQueryResult):
+        (WebInspector.DatabaseQueryView.prototype._appendErrorQueryResult):
+        (WebInspector.DatabaseQueryView.prototype._appendQueryResult):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype.wasShown.profileCallback2):
+        (WebInspector.DetailedHeapshotView.prototype.wasShown):
+        (WebInspector.DetailedHeapshotView.prototype.onResize):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype.onResize):
+        (WebInspector.NetworkLogView.prototype._createTable):
+        * inspector/front-end/ProfileView.js:
+        * inspector/front-end/ResourceCookiesView.js:
+        (WebInspector.ResourceCookiesView.prototype._buildCookiesTable):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+
+2011-10-24  Yosifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Setting defaultValue should hide an input placeholder.
+        https://bugs.webkit.org/show_bug.cgi?id=70586
+
+        Reviewed by Kent Tamura.
+
+        Tests: fast/forms/placeholder-and-default-value-expected.html
+               fast/forms/placeholder-and-default-value.html
+
+        When input element has default value, we should not display
+        placeholder. Changing default value should tell rendering engine about
+        changing display of input element.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Calls updatePlaceholderVisibility for valueAttr if it doesn't have dirty value.
+
+2011-10-23  Darin Adler  <darin@apple.com>
+
+        Eliminate OptionElement (second and final part)
+        https://bugs.webkit.org/show_bug.cgi?id=70710
+
+        Reviewed by Kent Tamura.
+
+        * CMakeLists.txt: Removed OptionElement.h and OptionElement.cpp.
+        * GNUmakefile.list.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/DOMAllInOne.cpp: Ditto.
+
+        * dom/OptionElement.cpp: Removed.
+        * dom/OptionElement.h: Removed.
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::saveLastSelection): Eliminate use of the
+        toOptionElement function. Use hasTagName and toHTMLOptionElement instead.
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex): Ditto.
+        (WebCore::HTMLSelectElement::updateListBoxSelection): Ditto.
+        (WebCore::HTMLSelectElement::listBoxOnChange): Ditto.
+        (WebCore::HTMLSelectElement::recalcListItems): Ditto.
+        (WebCore::HTMLSelectElement::selectedIndex): Ditto.
+        (WebCore::HTMLSelectElement::setSelectedIndex): Ditto.
+        (WebCore::HTMLSelectElement::deselectItemsWithoutValidation): Ditto.
+        (WebCore::HTMLSelectElement::saveFormControlState): Ditto.
+        (WebCore::HTMLSelectElement::restoreFormControlState): Ditto.
+        (WebCore::HTMLSelectElement::appendFormData): Ditto.
+        (WebCore::HTMLSelectElement::reset): Ditto.
+        (WebCore::HTMLSelectElement::updateSelectedState): Ditto.
+        (WebCore::HTMLSelectElement::lastSelectedListIndex): Ditto.
+        (WebCore::HTMLSelectElement::typeAheadFind): Ditto.
+        (WebCore::HTMLSelectElement::accessKeySetSelectedIndex): Ditto.
+
+        * html/HTMLSelectElement.h: Changed the argument type of the
+        deselectItemsWithoutValidation function to HTMLElement* since that's
+        the type of an item in our items vector now.
+
+2011-10-23  Yuzo Fujishima  <yuzo@google.com>
+
+        [chromium] Attempt to fix compilation error for Chromium OS.
+
+        Unreviewed.
+
+        * mediastream/MediaStreamTrack.cpp:
+        (WebCore::MediaStreamTrack::kind):
+
+2011-10-23  Adam Barth  <abarth@webkit.org>
+
+        <img crossorigin> should fail to load when CORS check fails
+        https://bugs.webkit.org/show_bug.cgi?id=69732
+
+        Reviewed by Darin Adler.
+
+        When loading an image with the crossorigin attribute, the spec says
+        that we're not supposed to load the image if the CORS check fails.
+        This "fails fast" behavior is intended to help developers understand
+        whether they've configured CORS correctly (instead of only catching the
+        error later when trying to read back the canvas).
+
+        Our new behavior matches the spec and Firefox.
+
+        Test: http/tests/security/img-with-failed-cors-check-fails-to-load.html
+
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::notifyFinished):
+
+2011-10-23  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Remove GeolocationServiceGtk.{h,cpp} from the gyp projects
+        https://bugs.webkit.org/show_bug.cgi?id=70702
+
+        Reviewed by Kent Tamura.
+
+        platform/gtk/GeolocationServiceGtk.{h,cpp} were removed in r97746, so
+        remove references to these files from the gyp files.
+
+        * WebCore.gypi:
+
+2011-10-23  Andreas Kling  <kling@webkit.org>
+
+        Move StyleSheet::addSubresourceStyleURLs() to CSSStyleSheet.
+        https://bugs.webkit.org/show_bug.cgi?id=70690
+
+        Reviewed by Antti Koivisto.
+
+        This method isn't part of the StyleSheet DOM interface, nor is it used by
+        XSLStyleSheet, so move it down to CSSStyleSheet and make it non-virtual.
+        Also remove some nearby unneeded casts from CSSStyleSheet* to StyleSheet*.
+
+        * css/CSSStyleSheet.h:
+        * css/StyleSheet.h:
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::isLoading):
+        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::addSubresourceAttributeURLs):
+        (WebCore::HTMLStyleElement::disabled):
+        (WebCore::HTMLStyleElement::setDisabled):
+
+2011-10-23  Andreas Kling  <kling@webkit.org>
+
+        Remove style sheet constructors that take a style sheet parent.
+        https://bugs.webkit.org/show_bug.cgi?id=70692
+
+        Reviewed by Antti Koivisto.
+
+        Style sheets are never directly parented by other style sheets, they always
+        go via a rule (such as @import.)
+
+        * css/CSSStyleSheet.cpp:
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::create):
+        * css/StyleSheet.cpp:
+        * css/StyleSheet.h:
+
+2011-10-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add deleteProperty to the MethodTable
+        https://bugs.webkit.org/show_bug.cgi?id=70162
+
+        Reviewed by Sam Weinig.
+
+        No new tests.
+
+        * WebCore.exp.in:
+
+2011-10-23  Adam Barth  <abarth@webkit.org>
+
+        Update baselines for run-bindings-tests.
+
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+
+2011-10-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove getConstructDataVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=70638
+
+        Reviewed by Darin Adler.
+
+        No new tests.
+
+        Removed all declarations and definitions of getConstructDataVirtual.
+        Also replaced all call sites to getConstructDataVirtual with a 
+        corresponding lookup in the MethodTable.
+
+        * WebCore.exp.in:
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDeclaration):
+        (GenerateConstructorDefinition):
+        * bridge/runtime_object.cpp:
+        * bridge/runtime_object.h:
+
+2011-10-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Separated string lifetime bits from character buffer state bits
+        https://bugs.webkit.org/show_bug.cgi?id=70673
+
+        Reviewed by Anders Carlsson.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHashValue): Updated for string hashing changes in JavaScriptCore.
+
+2011-10-22  Pratik Solanki  <psolanki@apple.com>
+
+        HTTPBodyStream in NSURLRequest gets lost when using CFNetwork loader
+        https://bugs.webkit.org/show_bug.cgi?id=70583
+        <rdar://problem/10281227>
+
+        Reviewed by Darin Adler.
+
+        Call WebCore::setHTTPBody() only if we actually have a FormData. Unconditionally calling it
+        results in us passing 0 to wkCFURLRequestSetHTTPRequestBodyParts() which resets any input
+        stream specified by the user on the NSURLRequest. This code matches the behavior in the
+        Foundation version of doUpdatePlatformRequest().
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+
+2011-10-22  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Move all MediaStream and PeerConnection related non-platform files to WebCore/mediastream
+        https://bugs.webkit.org/show_bug.cgi?id=70233
+
+        Reviewed by Adam Barth.
+
+        Removed affected files from build systems that don't have a MEDIA_STREAM build flag.
+
+        No new tests since we're just moving files.
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * UseJSC.cmake:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * dom/DOMAllInOne.cpp:
+        * dom/DispatchTask.h: Removed unused file.
+        * dom/ScriptExecutionContext.cpp:
+        * mediastream/LocalMediaStream.cpp: Renamed from Source/WebCore/dom/LocalMediaStream.cpp.
+        (WebCore::LocalMediaStream::create):
+        (WebCore::LocalMediaStream::LocalMediaStream):
+        (WebCore::LocalMediaStream::stop):
+        (WebCore::LocalMediaStream::stopTimerFired):
+        (WebCore::LocalMediaStream::~LocalMediaStream):
+        (WebCore::LocalMediaStream::toLocalMediaStream):
+        * mediastream/LocalMediaStream.h: Renamed from Source/WebCore/dom/LocalMediaStream.h.
+        * mediastream/LocalMediaStream.idl: Renamed from Source/WebCore/dom/LocalMediaStream.idl.
+        * mediastream/MediaStream.cpp: Renamed from Source/WebCore/dom/MediaStream.cpp.
+        (WebCore::MediaStream::create):
+        (WebCore::MediaStream::MediaStream):
+        (WebCore::MediaStream::~MediaStream):
+        (WebCore::MediaStream::readyState):
+        (WebCore::MediaStream::toMediaStream):
+        (WebCore::MediaStream::streamEnded):
+        (WebCore::MediaStream::scriptExecutionContext):
+        (WebCore::MediaStream::eventTargetData):
+        (WebCore::MediaStream::ensureEventTargetData):
+        * mediastream/MediaStream.h: Renamed from Source/WebCore/dom/MediaStream.h.
+        (WebCore::MediaStream::label):
+        (WebCore::MediaStream::tracks):
+        (WebCore::MediaStream::descriptor):
+        (WebCore::MediaStream::refEventTarget):
+        (WebCore::MediaStream::derefEventTarget):
+        * mediastream/MediaStream.idl: Renamed from Source/WebCore/dom/MediaStream.idl.
+        * mediastream/MediaStreamClient.h: Renamed from Source/WebCore/page/MediaStreamClient.h.
+        (WebCore::MediaStreamClient::~MediaStreamClient):
+        * mediastream/MediaStreamController.cpp: Renamed from Source/WebCore/page/MediaStreamController.cpp.
+        (WebCore::MediaStreamController::Request::Request):
+        (WebCore::MediaStreamController::Request::localId):
+        (WebCore::MediaStreamController::Request::frameController):
+        (WebCore::MediaStreamController::MediaStreamController):
+        (WebCore::MediaStreamController::~MediaStreamController):
+        (WebCore::MediaStreamController::isClientAvailable):
+        (WebCore::MediaStreamController::unregisterFrameController):
+        (WebCore::MediaStreamController::registerRequest):
+        (WebCore::MediaStreamController::generateStream):
+        (WebCore::MediaStreamController::streamGenerated):
+        (WebCore::MediaStreamController::streamGenerationFailed):
+        * mediastream/MediaStreamController.h: Renamed from Source/WebCore/page/MediaStreamController.h.
+        * mediastream/MediaStreamEvent.cpp: Renamed from Source/WebCore/p2p/MediaStreamEvent.cpp.
+        (WebCore::MediaStreamEvent::create):
+        (WebCore::MediaStreamEvent::MediaStreamEvent):
+        (WebCore::MediaStreamEvent::~MediaStreamEvent):
+        (WebCore::MediaStreamEvent::initMediaStreamEvent):
+        (WebCore::MediaStreamEvent::stream):
+        * mediastream/MediaStreamEvent.h: Renamed from Source/WebCore/p2p/MediaStreamEvent.h.
+        (WebCore::MediaStreamEvent::isMediaStreamEvent):
+        * mediastream/MediaStreamEvent.idl: Renamed from Source/WebCore/p2p/MediaStreamEvent.idl.
+        * mediastream/MediaStreamFrameController.cpp: Renamed from Source/WebCore/page/MediaStreamFrameController.cpp.
+        (WebCore::MediaStreamFrameController::Request::~Request):
+        (WebCore::MediaStreamFrameController::Request::scriptExecutionContext):
+        (WebCore::MediaStreamFrameController::Request::isGenerateStreamRequest):
+        (WebCore::MediaStreamFrameController::Request::Request):
+        (WebCore::MediaStreamFrameController::GenerateStreamRequest::create):
+        (WebCore::MediaStreamFrameController::GenerateStreamRequest::~GenerateStreamRequest):
+        (WebCore::MediaStreamFrameController::GenerateStreamRequest::isGenerateStreamRequest):
+        (WebCore::MediaStreamFrameController::GenerateStreamRequest::abort):
+        (WebCore::MediaStreamFrameController::GenerateStreamRequest::successCallback):
+        (WebCore::MediaStreamFrameController::GenerateStreamRequest::errorCallback):
+        (WebCore::MediaStreamFrameController::GenerateStreamRequest::GenerateStreamRequest):
+        (WebCore::MediaStreamFrameController::RequestMap::abort):
+        (WebCore::MediaStreamFrameController::RequestMap::abortAll):
+        (WebCore::MediaStreamFrameController::MediaStreamFrameController):
+        (WebCore::MediaStreamFrameController::~MediaStreamFrameController):
+        (WebCore::MediaStreamFrameController::securityOrigin):
+        (WebCore::MediaStreamFrameController::scriptExecutionContext):
+        (WebCore::MediaStreamFrameController::pageController):
+        (WebCore::MediaStreamFrameController::enterDetachedState):
+        (WebCore::MediaStreamFrameController::isClientAvailable):
+        (WebCore::MediaStreamFrameController::disconnectPage):
+        (WebCore::MediaStreamFrameController::disconnectFrame):
+        (WebCore::MediaStreamFrameController::transferToNewPage):
+        (WebCore::MediaStreamFrameController::parseGenerateStreamOptions):
+        (WebCore::MediaStreamFrameController::generateStream):
+        (WebCore::MediaStreamFrameController::streamGenerated):
+        (WebCore::MediaStreamFrameController::streamGenerationFailed):
+        * mediastream/MediaStreamFrameController.h: Renamed from Source/WebCore/page/MediaStreamFrameController.h.
+        (WebCore::MediaStreamFrameController::IdGenerator::IdGenerator):
+        (WebCore::MediaStreamFrameController::IdGenerator::getNextId):
+        * mediastream/MediaStreamList.cpp: Renamed from Source/WebCore/dom/MediaStreamList.cpp.
+        (WebCore::MediaStreamList::create):
+        (WebCore::MediaStreamList::MediaStreamList):
+        (WebCore::MediaStreamList::~MediaStreamList):
+        (WebCore::MediaStreamList::length):
+        (WebCore::MediaStreamList::item):
+        (WebCore::MediaStreamList::append):
+        (WebCore::MediaStreamList::remove):
+        (WebCore::MediaStreamList::contains):
+        * mediastream/MediaStreamList.h: Renamed from Source/WebCore/dom/MediaStreamList.h.
+        * mediastream/MediaStreamList.idl: Renamed from Source/WebCore/dom/MediaStreamList.idl.
+        * mediastream/MediaStreamRegistry.cpp: Renamed from Source/WebCore/platform/MediaStreamRegistry.cpp.
+        (WebCore::MediaStreamRegistry::registry):
+        (WebCore::MediaStreamRegistry::registerMediaStreamURL):
+        (WebCore::MediaStreamRegistry::unregisterMediaStreamURL):
+        (WebCore::MediaStreamRegistry::mediaStream):
+        * mediastream/MediaStreamRegistry.h: Renamed from Source/WebCore/platform/MediaStreamRegistry.h.
+        * mediastream/MediaStreamTrack.cpp: Renamed from Source/WebCore/dom/MediaStreamTrack.cpp.
+        (WebCore::MediaStreamTrack::create):
+        (WebCore::MediaStreamTrack::MediaStreamTrack):
+        (WebCore::MediaStreamTrack::~MediaStreamTrack):
+        (WebCore::MediaStreamTrack::kind):
+        (WebCore::MediaStreamTrack::label):
+        (WebCore::MediaStreamTrack::enabled):
+        (WebCore::MediaStreamTrack::setEnabled):
+        * mediastream/MediaStreamTrack.h: Renamed from Source/WebCore/dom/MediaStreamTrack.h.
+        * mediastream/MediaStreamTrack.idl: Renamed from Source/WebCore/dom/MediaStreamTrack.idl.
+        * mediastream/MediaStreamTrackList.cpp: Renamed from Source/WebCore/dom/MediaStreamTrackList.cpp.
+        (WebCore::MediaStreamTrackList::create):
+        (WebCore::MediaStreamTrackList::MediaStreamTrackList):
+        (WebCore::MediaStreamTrackList::~MediaStreamTrackList):
+        (WebCore::MediaStreamTrackList::length):
+        (WebCore::MediaStreamTrackList::item):
+        * mediastream/MediaStreamTrackList.h: Renamed from Source/WebCore/dom/MediaStreamTrackList.h.
+        * mediastream/MediaStreamTrackList.idl: Renamed from Source/WebCore/dom/MediaStreamTrackList.idl.
+        * mediastream/PeerConnection.cpp: Renamed from Source/WebCore/p2p/PeerConnection.cpp.
+        (WebCore::PeerConnection::create):
+        (WebCore::PeerConnection::PeerConnection):
+        (WebCore::PeerConnection::~PeerConnection):
+        (WebCore::PeerConnection::processSignalingMessage):
+        (WebCore::PeerConnection::readyState):
+        (WebCore::PeerConnection::send):
+        (WebCore::PeerConnection::addStream):
+        (WebCore::PeerConnection::removeStream):
+        (WebCore::PeerConnection::localStreams):
+        (WebCore::PeerConnection::remoteStreams):
+        (WebCore::PeerConnection::close):
+        (WebCore::PeerConnection::iceProcessingCompleted):
+        (WebCore::PeerConnection::sdpGenerated):
+        (WebCore::PeerConnection::dataStreamMessageReceived):
+        (WebCore::PeerConnection::remoteStreamAdded):
+        (WebCore::PeerConnection::remoteStreamRemoved):
+        (WebCore::PeerConnection::toPeerConnection):
+        (WebCore::PeerConnection::scriptExecutionContext):
+        (WebCore::PeerConnection::stop):
+        (WebCore::PeerConnection::eventTargetData):
+        (WebCore::PeerConnection::ensureEventTargetData):
+        (WebCore::PeerConnection::scheduleInitialNegotiation):
+        (WebCore::PeerConnection::initialNegotiationTimerFired):
+        (WebCore::PeerConnection::ensureStreamChangeScheduled):
+        (WebCore::PeerConnection::streamChangeTimerFired):
+        (WebCore::PeerConnection::scheduleReadyStateChange):
+        (WebCore::PeerConnection::readyStateChangeTimerFired):
+        (WebCore::PeerConnection::changeReadyState):
+        * mediastream/PeerConnection.h: Renamed from Source/WebCore/p2p/PeerConnection.h.
+        (WebCore::PeerConnection::refEventTarget):
+        (WebCore::PeerConnection::derefEventTarget):
+        * mediastream/PeerConnection.idl: Renamed from Source/WebCore/p2p/PeerConnection.idl.
+        * mediastream/SignalingCallback.h: Renamed from Source/WebCore/p2p/SignalingCallback.h.
+        (WebCore::SignalingCallback::~SignalingCallback):
+        * mediastream/SignalingCallback.idl: Renamed from Source/WebCore/p2p/SignalingCallback.idl.
+        * page/Frame.cpp:
+        * page/Navigator.cpp:
+        * page/Page.cpp:
+
+2011-10-20  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: get rid of View::hide, View::set visible, View::attach,
+        View::set visible.
+        https://bugs.webkit.org/show_bug.cgi?id=70523
+
+        This change also introduces assetions that forces view attach / detach operations
+        to be performed explicitly.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/ApplicationCacheItemsView.js:
+        (WebInspector.ApplicationCacheItemsView.prototype.wasShown):
+        (WebInspector.ApplicationCacheItemsView.prototype.willHide):
+        (WebInspector.ApplicationCacheItemsView.prototype._updateCallback):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype.wasShown):
+        * inspector/front-end/ConsolePanel.js:
+        (WebInspector.ConsolePanel.prototype.wasShown):
+        (WebInspector.ConsolePanel.prototype.willHide):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.wasShown):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.wasShown):
+        (WebInspector.CookieItemsView.prototype.willHide):
+        (WebInspector.CookieItemsView.prototype._updateWithCookies):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.wasShown):
+        (WebInspector.DOMStorageItemsView.prototype.willHide):
+        * inspector/front-end/DatabaseQueryView.js:
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype.wasShown):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype.willHide):
+        (WebInspector.DetailedHeapshotView.prototype._changeView):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.hide):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.wasShown):
+        (WebInspector.ElementsPanel.prototype.willHide):
+        * inspector/front-end/EmptyView.js:
+        (WebInspector.EmptyView.prototype.wasShown):
+        * inspector/front-end/FontView.js:
+        (WebInspector.FontView.prototype.wasShown):
+        * inspector/front-end/IFrameView.js:
+        (WebInspector.IFrameView):
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView.prototype.wasShown):
+        * inspector/front-end/NetworkItemView.js:
+        (WebInspector.NetworkItemView.prototype.wasShown):
+        (WebInspector.ResourceContentView.prototype.wasShown):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype.wasShown):
+        (WebInspector.NetworkLogView.prototype.willHide):
+        (WebInspector.NetworkPanel.prototype.wasShown):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel):
+        (WebInspector.Panel.prototype.show):
+        (WebInspector.Panel.prototype.wasShown):
+        (WebInspector.Panel.prototype.willHide):
+        * inspector/front-end/PanelEnablerView.js:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.prototype.willHide):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.wasShown):
+        (WebInspector.ProfilesPanel.prototype._addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableDetailedHeapProfiles):
+        * inspector/front-end/ResourceCookiesView.js:
+        (WebInspector.ResourceCookiesView.prototype.wasShown):
+        * inspector/front-end/ResourceHTMLView.js:
+        (WebInspector.ResourceHTMLView.prototype.wasShown):
+        (WebInspector.ResourceHTMLView.prototype.willHide):
+        * inspector/front-end/ResourceJSONView.js:
+        (WebInspector.ResourceJSONView.parseJSON.WebInspector.ResourceJSONView.prototype.wasShown):
+        * inspector/front-end/ResourceTimingView.js:
+        (WebInspector.ResourceTimingView.prototype.wasShown):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.wasShown):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.wasShown):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.wasShown):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.wasShown):
+        (WebInspector.TimelinePanel.prototype.willHide):
+        * inspector/front-end/View.js:
+        (WebInspector.View):
+        (WebInspector.View.prototype.get visible):
+        (WebInspector.View.prototype.setHideOnDetach):
+        (WebInspector.View.prototype._wasShown):
+        (WebInspector.View.prototype._willHide):
+        (WebInspector.View.prototype._onResize):
+        (WebInspector.View.prototype.wasShown):
+        (WebInspector.View.prototype.willHide):
+        (WebInspector.View.prototype.onResize):
+        (WebInspector.View.prototype.show):
+        (WebInspector.View.prototype.detach):
+        (WebInspector.View.prototype.doResize):
+        (WebInspector.View.prototype.dispatchToSelfAndChildren):
+        (WebInspector.View.prototype.dispatchToChildren):
+        (WebInspector.View.prototype._handleInsertedIntoDocument):
+
+2011-10-22  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r92480): Passing uninitialized variable in HTMLElement::calculateAndAdjustDirectionality()
+        https://bugs.webkit.org/show_bug.cgi?id=70582
+
+        Reviewed by Darin Adler.
+
+        No new tests. It's very hard to make a reliable test.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::directionality):
+        Clear *strongDirectionalityTextNode even if hasStrongDirectionality is false.
+
+2011-10-21  Dan Bernstein  <mitz@apple.com>
+
+        Caret is drawn in the wrong place in multi-column blocks
+        https://bugs.webkit.org/show_bug.cgi?id=70662
+
+        Reviewed by Gavin Barraclough.
+
+        * manual-tests/caret-in-columns.html: Added.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret): Removed the call to offsetForContents(). That function takes
+        a point in local coordinates, whereas this function was applying it to a point in painting root
+        coordinates. The desired effect was only to undo the scroll adjustment done by the caller,
+        paintObject().
+        (WebCore::RenderBlock::paintObject): Pass the original, rather than scroll-adjusted, paint offset
+        to paintCaret().
+
+2011-10-21  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Make setVisibility extension- and thread-correct
+        https://bugs.webkit.org/show_bug.cgi?id=70635
+
+        Reviewed by Kenneth Russell.
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::setVisible):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::LayerRendererCapabilities::LayerRendererCapabilities):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::setVisible):
+
+2011-10-21  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=70647
+        Common but unreproducible crash under [ScrollbarPartAnimation setCurrentProgress:]
+        -and corresponding-
+        <rdar://problem/9542018>
+
+        Reviewed by Sam Weinig.
+
+        This patch implements two speculative fixes for this crash.
+
+        First, block exceptions around all of the code responsible for calling 
+        stopAnimation. If that code throws any exceptions, we want to make sure the other 
+        animations are still stopped.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[WebScrollbarPartAnimation scrollAnimatorDestroyed]):
+        (-[WebScrollbarPainterDelegate scrollAnimatorDestroyed]):
+        (WebCore::ScrollAnimatorMac::~ScrollAnimatorMac):
+
+        Only send AppKit these notifications for active pages. I originally made these 
+        assertions, and I found that they were hit a surprising number of times. If we 
+        only send notifications for active pages, then we should greatly reduce and 
+        possibly eliminate our chances of hitting this crash.
+        (WebCore::ScrollAnimatorMac::notifyPositionChanged):
+        (WebCore::ScrollAnimatorMac::contentAreaWillPaint):
+        (WebCore::ScrollAnimatorMac::mouseEnteredContentArea):
+        (WebCore::ScrollAnimatorMac::mouseExitedContentArea):
+        (WebCore::ScrollAnimatorMac::mouseMovedInContentArea):
+        (WebCore::ScrollAnimatorMac::willStartLiveResize):
+        (WebCore::ScrollAnimatorMac::contentsResized):
+        (WebCore::ScrollAnimatorMac::willEndLiveResize):
+        (WebCore::ScrollAnimatorMac::contentAreaDidShow):
+        (WebCore::ScrollAnimatorMac::contentAreaDidHide):
+        (WebCore::ScrollAnimatorMac::didBeginScrollGesture):
+        (WebCore::ScrollAnimatorMac::didEndScrollGesture):
+
+2011-10-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add put to the MethodTable
+        https://bugs.webkit.org/show_bug.cgi?id=70439
+
+        Reviewed by Oliver Hunt.
+
+        No new tests.
+
+        * WebCore.exp.in:
+        * bindings/js/JSDOMWindowCustom.cpp: Added static put since it was overlooked in 
+        previous patches.
+        (WebCore::JSDOMWindow::putVirtual):
+        (WebCore::JSDOMWindow::put):
+        * bindings/js/JSDOMWindowShell.cpp: Ditto.
+        (WebCore::JSDOMWindowShell::putVirtual):
+        (WebCore::JSDOMWindowShell::put):
+        * bindings/js/JSDOMWindowShell.h:
+
+2011-10-21  Dmitry Lomov  <dslomov@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=70580
+        [Chromium] Implement MessagePort transfer in chromium port of webkit.
+
+        Reviewed by David Levin.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::V8ObjectMap::Writer::writeTransferredMessagePort):
+        (WebCore::V8ObjectMap::Serializer::Serializer):
+        (WebCore::V8ObjectMap::Serializer::doSerialize):
+        (WebCore::V8ObjectMap::Reader::read):
+        (WebCore::V8ObjectMap::Deserializer::Deserializer):
+        (WebCore::V8ObjectMap::Deserializer::tryGetTransferredMessagePort):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::deserialize):
+
+2011-10-21  Ojan Vafai  <ojan@chromium.org>
+
+        r97693 caused 42 failures on the chromium mac bots
+        https://bugs.webkit.org/show_bug.cgi?id=70300
+
+        Can't test this until https://bugs.webkit.org/show_bug.cgi?id=70660
+        is fixed. The fix for that bug will test this codepath as well though.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeBlockPreferredLogicalWidths):
+
+2011-10-21  Vineet Chaudhary  <vineet.chaudhary@motorola.com>
+
+        Setting form.enctype reflected attribute behaves strangely.
+        https://bugs.webkit.org/show_bug.cgi?id=44879
+
+        Reviewed by Darin Adler.
+
+        The spec says form.enctype should be application/x-www-form-urlencoded,
+        So as "text", "plain", "multipart" or "form-data" these are not a valid value so must be ignored.
+
+        * loader/FormSubmission.cpp:
+        (WebCore::FormSubmission::Attributes::parseEncodingType):
+
+2011-10-21  Matthew Delaney  <mdelaney@apple.com>
+
+        Ensure periodic flushing of canvas drawing context
+        https://bugs.webkit.org/show_bug.cgi?id=70646
+
+        Reviewed by Simon Fraser.
+
+        No new tests. No current way to track tests that cause hangs or
+        non-deterministic drops in performance.
+
+        * platform/graphics/cg/ImageBufferDataCG.h: Adds a timestamp of last tracked flush.
+        * platform/graphics/cg/ImageBufferCG.cpp: Ensures periodic flushes on the drawing context.
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::context): Flushes context if we're beyond flush interval.
+        (WebCore::ImageBuffer::copyNativeImage): Updates last flush timestamp.
+        (WebCore::ImageBuffer::getUnmultipliedImageData): Updates last flush timestamp.
+        (WebCore::ImageBuffer::getPremultipliedImageData): Updates last flush timestamp.
+        (WebCore::ImageBuffer::putUnmultipliedImageData): Updates last flush timestamp.
+        (WebCore::ImageBuffer::putPremultipliedImageData): Updates last flush timestamp.
+
+2011-10-21  Adam Barth  <abarth@webkit.org>
+
+        Introduce Event::hasInterface to make uses of interfaceName more readable
+        https://bugs.webkit.org/show_bug.cgi?id=70652
+
+        Reviewed by Eric Seidel.
+
+        Eric felt that this approach would be more readable because it requires
+        less syntax at each callsite.
+
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/objc/DOMEvents.mm:
+        (kitClass):
+        * bindings/v8/V8WindowErrorHandler.cpp:
+        (WebCore::V8WindowErrorHandler::callListenerFunction):
+        * bindings/v8/V8WorkerContextErrorHandler.cpp:
+        (WebCore::V8WorkerContextErrorHandler::callListenerFunction):
+        * dom/Event.cpp:
+        (WebCore::Event::hasInterface):
+        * dom/Event.h:
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::determineDispatchBehavior):
+        * dom/Node.cpp:
+        (WebCore::Node::defaultEventHandler):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::forwardEvent):
+        (WebCore::TextFieldInputType::shouldSubmitImplicitly):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+
+2011-10-21  Adam Klein  <adamk@chromium.org>
+
+        [MutationObservers] Implement basic subtree observation
+        https://bugs.webkit.org/show_bug.cgi?id=70436
+
+        Reviewed by Ryosuke Niwa.
+
+        Note that this patch only implements "basic" subtree semantics,
+        not the fully robust semantics described in
+        http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/1622.html.
+        Most importantly, this change does not handle the case where mutations
+        occur in a temporarily detached subtree.
+
+        The plan is to implement those semantics in a followup to avoid
+        blocking other parts of the MutationObserver spec that rely on
+        the existence of subtree observation but not its specific
+        implementation.
+
+        Test: fast/mutation/observe-subtree.html
+
+        * dom/Node.cpp:
+        (WebCore::addMatchingObservers): Static helper method for registeredMutationObserversOfType().
+        (WebCore::Node::registeredMutationObserversOfType): Walk up the tree looking for observers.
+        * dom/NodeRareData.h:
+        (WebCore::MutationObserverEntry::hasAllOptions): A stricter, renamed from matches().
+
+2011-10-21  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: objectStore.transaction property should be readonly
+        https://bugs.webkit.org/show_bug.cgi?id=62395
+
+        Reviewed by Tony Chang.
+
+        Implement the IDBObjectStore.transaction property defined by the spec.
+
+        Test: storage/indexeddb/readonly-properties.html
+
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::transaction):
+        * storage/IDBObjectStore.h:
+        * storage/IDBObjectStore.idl:
+
+2011-10-21  Adam Barth  <abarth@webkit.org>
+
+        Event.h has too many virtual isMumbleEvent() functions
+        https://bugs.webkit.org/show_bug.cgi?id=70636
+
+        Reviewed by Dimitri Glazkov.
+
+        We should use the new interfaceName() way of doing run-time type inference.
+
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::JSEvent::clipboardData):
+        * bindings/objc/DOMEvents.mm:
+        (kitClass):
+        * bindings/v8/V8WindowErrorHandler.cpp:
+        (WebCore::V8WindowErrorHandler::callListenerFunction):
+        * bindings/v8/V8WorkerContextErrorHandler.cpp:
+        (WebCore::V8WorkerContextErrorHandler::callListenerFunction):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::V8Event::clipboardDataAccessorGetter):
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::interfaceName):
+        * dom/BeforeTextInsertedEvent.h:
+        * dom/ClipboardEvent.cpp:
+        * dom/ClipboardEvent.h:
+        * dom/CompositionEvent.cpp:
+        * dom/CompositionEvent.h:
+        * dom/ErrorEvent.cpp:
+        * dom/ErrorEvent.h:
+        * dom/Event.cpp:
+        (WebCore::Event::storesResultAsString):
+        (WebCore::Event::storeResult):
+        (WebCore::Event::clipboardData):
+        * dom/Event.h:
+        * dom/Event.idl:
+            - Remove this interface from the CPP bindings because this function
+              no longer exists.  It's unclear to me how strong our API
+              commitments are in the CPP bindings.
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::determineDispatchBehavior):
+        * dom/MessageEvent.cpp:
+        * dom/MessageEvent.h:
+        * dom/MutationEvent.cpp:
+        * dom/MutationEvent.h:
+        * dom/Node.cpp:
+        (WebCore::Node::defaultEventHandler):
+        * dom/OverflowEvent.cpp:
+        * dom/OverflowEvent.h:
+        * dom/PageTransitionEvent.h:
+        * dom/ProgressEvent.h:
+        * dom/TextEvent.cpp:
+        * dom/TextEvent.h:
+        * dom/WheelEvent.cpp:
+        * dom/WheelEvent.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::forwardEvent):
+        (WebCore::TextFieldInputType::shouldSubmitImplicitly):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+        * svg/SVGZoomEvent.cpp:
+        * svg/SVGZoomEvent.h:
+
+2011-10-21  Raymond Toy  <rtoy@google.com>
+
+        Flush denormals in Biquad, ZeroPole, and DynamicsCompressor.
+
+        We only flush when saving the state variables instead of in the
+        loops so that we don't impact performance too much when there are
+        no denormals.  This will at least not propagate the denormals any
+        further within the class.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=70626
+
+        Reviewed by Kenneth Russell.
+
+        * platform/audio/Biquad.cpp:
+        (WebCore::Biquad::process):
+        Flush denormals when storing the filter state back in to class
+        filter state.  
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::process):
+        Ditto.
+        * platform/audio/ZeroPole.cpp:
+        (WebCore::ZeroPole::process):
+        Ditto.
+
+2011-10-21  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Advanced search results should be cleared on navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=70627
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.AdvancedSearchController):
+        (WebInspector.AdvancedSearchController.prototype._frameNavigated):
+
+2011-10-21  Rafael Weinstein  <rafaelw@chromium.org>
+
+        [MutationObservers] Implement WebKitMutationObserver.observe for childList changes
+        https://bugs.webkit.org/show_bug.cgi?id=68955
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch adds a ChildListMutationScope object which manages the coalescing of
+        multiple child removals and additions within DOM operations into single childList
+        mutation records.
+
+        Note that this patch doesn't cover all the cases which can be coalesced (it only
+        covers ContainerNode.*, and Node.innerHTML/innerText). A separate bug,
+        https://bugs.webkit.org/show_bug.cgi?id=70385, has been opened to track the
+        remaining cases.
+
+        Test: fast/mutation/observe-childList.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ChildListMutationScope.cpp: Added.
+        (WebCore::ChildListAccumulation::ChildListAccumulation::ChildListAccumulation):
+        (WebCore::ChildListAccumulation::ChildListAccumulation::~ChildListAccumulation):
+        (WebCore::ChildListAccumulation::ChildListAccumulation::childAdded):
+        (WebCore::ChildListAccumulation::ChildListAccumulation::willRemoveChild):
+        (WebCore::ChildListAccumulation::ChildListAccumulation::dispatch):
+        (WebCore::ChildListAccumulation::ChildListAccumulation::clear):
+        (WebCore::ChildListAccumulation::ChildListAccumulation::isEmpty):
+        (WebCore::ChildListAccumulation::ChildListAccumulator::ChildListAccumulator):
+        (WebCore::ChildListAccumulation::ChildListAccumulator::~ChildListAccumulator):
+        (WebCore::ChildListAccumulation::ChildListAccumulator::initialize):
+        (WebCore::ChildListAccumulation::ChildListAccumulator::instance):
+        (WebCore::ChildListAccumulation::ChildListAccumulator::childAdded):
+        (WebCore::ChildListAccumulation::ChildListAccumulator::willRemoveChild):
+        (WebCore::ChildListAccumulation::ChildListAccumulator::incrementScopingLevel):
+        (WebCore::ChildListAccumulation::ChildListAccumulator::decrementScopingLevel):
+        (WebCore::ChildListMutationScope::ChildListMutationScope):
+        (WebCore::ChildListMutationScope::~ChildListMutationScope):
+        (WebCore::ChildListMutationScope::childAdded):
+        (WebCore::ChildListMutationScope::willRemoveChild):
+        * dom/ChildListMutationScope.h: Added.
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::willRemoveChildren):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Element.cpp:
+        (WebCore::enqueueAttributesMutationRecord):
+        * dom/Node.cpp:
+        (WebCore::Node::setTextContent):
+        (WebCore::Node::registeredMutationObserversOfType):
+        * dom/WebKitMutationObserver.cpp:
+        (WebCore::WebKitMutationObserver::disconnect):
+        * html/HTMLElement.cpp:
+        (WebCore::replaceChildrenWithFragment):
+        (WebCore::replaceChildrenWithText):
+
+2011-10-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r98079.
+        http://trac.webkit.org/changeset/98079
+        https://bugs.webkit.org/show_bug.cgi?id=70624
+
+        The extensions tests enabled are failing on the Chromium Win
+        Dbg bot (Requested by jchaffraix on #webkit).
+
+        * inspector/front-end/ExtensionAPI.js:
+        (buildExtensionAPIInjectedScript):
+
+2011-10-21  Dan Bernstein  <mitz@apple.com>
+
+        Column rules positioned incorrectly in vertical-rl block with horizontal border or padding
+        https://bugs.webkit.org/show_bug.cgi?id=70622
+
+        Reviewed by Beth Dakin.
+
+        Tests: fast/multicol/vertical-lr/rules-with-border-before.html
+               fast/multicol/vertical-rl/rules-with-border-before.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnRules): Changed to use the physical left border and padding for the
+        left edge of the horizontal column rule.
+
 2011-10-21  Simon Fraser  <simon.fraser@apple.com>
 
         Fix Windows build.