commit b017396bf391ba05a448262e290a6609cfe7f275
Author: commit-queue <commit-queue@webkit.org>
Date:   Sun Aug 28 19:24:40 2011 +0000

    Fix build error when compiling with MinGW-w64 by disabling JIT
    on Windows 64-bit
    https://bugs.webkit.org/show_bug.cgi?id=61235
    
    Patch by Jonathan Liu <net147@gmail.com> on 2011-08-28
    Reviewed by Gavin Barraclough.
    
    The fixed mmap executable allocator for JIT on x86_64 requires
    sys/mman.h which is not available on Windows.
    
    * wtf/Platform.h:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93950 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit dda59e50379214c098f365a39c4d64b39ced427e
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Fri Aug 26 17:49:20 2011 -0300

    Revert "[Qt] Fix tst_QWebFrame::setHtmlWithResource() API test" [1/2]
    
    This reverts commit 83cad9be6897798567d0e477ab7f928c93fceed1.
    
    The patch was not needed in qtwebkit-2.2, as the failure was
    specific to trunk. This is the first commit, which added XFAILs
    to the test.

commit 5e03a534a590d88fb7afff68b2728470a650483f
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Fri Aug 26 17:43:54 2011 -0300

    Revert "[Qt] Fix tst_QWebFrame::setHtmlWithResource() API test" [2/2]
    
    This reverts commit dfe73c30b98223a75f91050ae55ccb87afcf2c73.
    
    The patch was not needed in qtwebkit-2.2, as the failure was
    specific to trunk. This is the second commit, which "fixes"
    the test.

commit 16cbdf38f280feb8fcc073b5c461673dffe0feab
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Fri Aug 26 10:19:43 2011 -0300

    Add build flags to reduce the size of Webcore library
    
    Patch by Holger Freyther <zecke@selfish.org>
    Rubberstamped by Andreas Kling.
    
    (qtwebkit-2.2 only by now)
    
    [Qt] libwebcore.a source is compiled without -fvisibility=hidden -fvisibility-inlines-hidden
    https://bugs.webkit.org/show_bug.cgi?id=65470
    
    WTF_USE_EXPORT_MACROS is still not enabled on trunk because there are
    pending issues with WebKit2, but it appears to be safe to enable this
    on QtWebKit, so this change is being added to the qtwebkit-2.2 branch.
    
    The patch also adds CONFIG += hide_symbols and on Unix, +=
    bsymbolic_functions, which should help reduce the library binary size.
    
    Testing this is quite easy, so if there's any problem we'll soon
    know. :-)

commit 85d4df147ac7b239497b05979a51fd6fde7580fd
Author: Ademar de Souza Reis Junior <ademar.reis@openbossa.org>
Date:   Thu Aug 25 20:29:30 2011 +0000

    [Qt] Enable password echo on Symbian builds
    https://bugs.webkit.org/show_bug.cgi?id=66954
    
    Reviewed by Chang Shu.
    
    No tests, as this is just a build change.
    
    * config.h:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93817 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 836fa24be73978fb292e954abb151fb46b1d97e0
Author: Ademar de Souza Reis Junior <ademar.reis@openbossa.org>
Date:   Thu Aug 25 15:29:21 2011 +0000

    Unreviewed QtWebKit.pro fix for when building inside Qt
    
    Patch by Simo Fält <simo.falt@nokia.com>
    
    The QtWebKit version was being overwritten by a global Qt version when
    QtWebKit was built inside Qt. Fixed by moving the version
    definition after the inclusion of qbase.pri.
    
    * QtWebKit.pro:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93787 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 17039576ed6c8d2cf26005cbc70ac20486a2c56f
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Thu Aug 25 11:53:59 2011 -0300

    Add missing libWebKitSystemInterfaceLion.a to QtWebKit-2.2 branch
    
    This file is required when building QtWebKit using the QTKit multimedia
    backend on Lion, as it provides a bridge to some system interfaces. It
    was added on trunk a while ago with several other changes, but all we
    need is the file itself.

commit 35023190d11c50ec0ce9ec038bf224f07f87db5a
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Wed Aug 24 11:28:59 2011 -0300

    Added support for momentarily revealing last typed character in password input.
    Code change was partially based on Apple's iOS code and Samuel Nevala's work.
    https://bugs.webkit.org/show_bug.cgi?id=32509
    
    Patch by Chang Shu <cshu@webkit.org> on 2011-08-23
    Reviewed by Alexey Proskuryakov.
    
    Source/WebCore:
    
    * editing/InsertIntoTextNodeCommand.cpp:
    (WebCore::InsertIntoTextNodeCommand::doApply):
    * rendering/RenderText.cpp:
    (WebCore::SecureTextTimer::SecureTextTimer):
    (WebCore::SecureTextTimer::restartWithNewText):
    (WebCore::SecureTextTimer::invalidate):
    (WebCore::SecureTextTimer::lastTypedCharacterOffset):
    (WebCore::SecureTextTimer::fired):
    (WebCore::RenderText::willBeDestroyed):
    (WebCore::RenderText::setTextInternal):
    (WebCore::RenderText::secureText):
    (WebCore::RenderText::momentarilyRevealLastTypedCharacter):
    * rendering/RenderText.h:
    (WebCore::RenderText::isSecure):
    * testing/Internals.cpp:
    (WebCore::Internals::setPasswordEchoEnabled): Fixed some silly coding in Internals.
    (WebCore::Internals::setPasswordEchoDurationInSeconds):
    (WebCore::Internals::reset):
    
    LayoutTests:
    
    Updated failed expected files.
    
    * editing/input/password-echo-passnode-expected.txt:
    * editing/input/password-echo-passnode2-expected.txt:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93656 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
    	Source/WebCore/testing/Internals.cpp

commit 3da1d42284d6ab38146278a1218ebf97235e341c
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Wed Aug 24 11:26:06 2011 -0300

    Source/JavaScriptCore: Rename "makeSecure" to "fill" and remove the support for displaying last character
    to avoid layering violatation.
    https://bugs.webkit.org/show_bug.cgi?id=59114
    
    Patch by Chang Shu <cshu@webkit.org> on 2011-07-08
    Reviewed by Alexey Proskuryakov.
    
    * JavaScriptCore.exp:
    * JavaScriptCore.order:
    * wtf/text/StringImpl.cpp:
    (WTF::StringImpl::fill):
    * wtf/text/StringImpl.h:
    * wtf/text/WTFString.h:
    (WTF::String::fill):
    
    Source/WebCore: Update calling sites after function renamed.
    https://bugs.webkit.org/show_bug.cgi?id=59114
    
    Patch by Chang Shu <cshu@webkit.org> on 2011-07-08
    Reviewed by Alexey Proskuryakov.
    
    No new tests, just refactoring.
    
    * editing/visible_units.cpp:
    (WebCore::previousBoundary):
    (WebCore::nextBoundary):
    * rendering/RenderText.cpp:
    (WebCore::RenderText::setTextInternal):
    
    Source/WebKit/win: Update calling sites after function renamed.
    https://bugs.webkit.org/show_bug.cgi?id=59114
    
    Patch by Chang Shu <cshu@webkit.org> on 2011-07-08
    Reviewed by Alexey Proskuryakov.
    
    * WebKitGraphics.cpp:
    (WebDrawText):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@90643 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/JavaScriptCore/JavaScriptCore.order

commit 985a8fa875e9f8c46d2cd379d55983e8ab8d839f
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Wed Aug 24 11:23:22 2011 -0300

    Add support of setPasswordEchoEnabled and setPasswordEchoDuration for password echo feature
    https://bugs.webkit.org/show_bug.cgi?id=66052
    
    Patch by Chang Shu <cshu@webkit.org> on 2011-08-18
    Reviewed by Alexey Proskuryakov.
    
    Source/WebCore:
    
    Added runtime settings in WebCore.
    Added support in window.internals for testing.
    
    Tests: editing/input/password-echo-passnode.html
           editing/input/password-echo-passnode2.html
           editing/input/password-echo-passnode3.html
           editing/input/password-echo-textnode.html
    
    * page/Settings.cpp:
    (WebCore::Settings::Settings):
    * page/Settings.h:
    (WebCore::Settings::setPasswordEchoEnabled):
    (WebCore::Settings::passwordEchoEnabled):
    (WebCore::Settings::setPasswordEchoDurationInSeconds):
    (WebCore::Settings::passwordEchoDurationInSeconds):
    * testing/Internals.cpp:
    (WebCore::Internals::Internals):
    (WebCore::Internals::setPasswordEchoEnabled):
    (WebCore::Internals::setPasswordEchoDurationInSeconds):
    (WebCore::Internals::reset):
    * testing/Internals.h:
    * testing/Internals.idl:
    
    Source/WebKit/qt:
    
    Enable password echo under the build flag.
    
    * Api/qwebsettings.cpp:
    (QWebSettingsPrivate::apply):
    
    LayoutTests:
    
    Added tests.
    
    * editing/input/password-echo-passnode-expected.txt: Added.
    * editing/input/password-echo-passnode.html: Added.
    * editing/input/password-echo-passnode2-expected.txt: Added.
    * editing/input/password-echo-passnode2.html: Added.
    * editing/input/password-echo-passnode3-expected.txt: Added.
    * editing/input/password-echo-passnode3.html: Added.
    * editing/input/password-echo-textnode-expected.txt: Added.
    * editing/input/password-echo-textnode.html: Added.
    * editing/input/resources: Added.
    * editing/input/resources/password-echo.js: Added.
    (secureChar):
    (secureText):
    (log):
    (assert):
    (run.else):
    (run):
    (init):
    * platform/wk2/Skipped: No support yet.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93291 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	LayoutTests/platform/wk2/Skipped
    	Source/WebCore/page/Settings.cpp
    	Source/WebCore/page/Settings.h
    	Source/WebCore/testing/Internals.cpp
    	Source/WebCore/testing/Internals.h
    	Source/WebCore/testing/Internals.idl

commit 2777535ba73a764640da9fac79f0f8d4ee5355ab
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Wed Aug 24 11:15:37 2011 -0300

    2011-08-16  Chang Shu  <cshu@webkit.org>
    
            Support reset in WebCore::Internals
            https://bugs.webkit.org/show_bug.cgi?id=66307
    
            Reviewed by Dimitri Glazkov.
    
            New tests will be added when function reset is implemented.
    
            Added framework code in WebCoreTestSupport. The real implementation of
            Internals::reset() depends on the need from the settings that require a reset.
    
            * testing/Internals.cpp:
            (WebCore::Internals::reset):
            * testing/Internals.h:
            * testing/js/WebCoreTestSupport.cpp:
            (WebCoreTestSupport::resetInternalsObject):
            * testing/js/WebCoreTestSupport.h:
            * testing/v8/WebCoreTestSupport.cpp:
            (WebCoreTestSupport::resetInternalsObject):
            * testing/v8/WebCoreTestSupport.h:
    
    2011-08-16  Chang Shu  <cshu@webkit.org>
    
            Support reset in WebCore::Internals
            https://bugs.webkit.org/show_bug.cgi?id=66307
    
            Reviewed by Dimitri Glazkov.
    
            Added framework code in WebKit.
    
            * public/WebTestingSupport.h:
            * src/WebTestingSupport.cpp:
            (WebKit::WebTestingSupport::resetInternalsObject):
    
    2011-08-16  Chang Shu  <cshu@webkit.org>
    
            Support reset in WebCore::Internals
            https://bugs.webkit.org/show_bug.cgi?id=66307
    
            Reviewed by Dimitri Glazkov.
    
            Added framework code in WebKit.
    
            * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
            (DumpRenderTreeSupportQt::resetInternalsObject):
            * WebCoreSupport/DumpRenderTreeSupportQt.h:
    
    2011-08-16  Chang Shu  <cshu@webkit.org>
    
            Support reset in WebCore::Internals
            https://bugs.webkit.org/show_bug.cgi?id=66307
    
            Reviewed by Dimitri Glazkov.
    
            Added call to resetInternalsObject in DRT.
    
            * DumpRenderTree/chromium/TestShell.cpp:
            (TestShell::resetTestController):
            * DumpRenderTree/mac/DumpRenderTree.mm:
            (resetWebViewToConsistentStateBeforeTesting):
            * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
            (WebCore::WebPage::resetSettings):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93235 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/WebCore/testing/Internals.cpp
    	Source/WebCore/testing/Internals.h
    	Source/WebKit/chromium/public/WebTestingSupport.h
    	Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
    	Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp

commit f3847b9e81180f185bac7338520edb9732b687fa
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Wed Aug 24 11:59:28 2011 -0300

    2011-06-09  Robert Hogan  <robert@webkit.org>
    
            Reviewed by Andreas Kling.
    
            Teach Qt about window.internals
            https://bugs.webkit.org/show_bug.cgi?id=61074
    
            Unskip fast/harness/internals-object.html
    
            * platform/qt/Skipped:
    2011-06-09  Robert Hogan  <robert@webkit.org>
    
            Reviewed by Andreas Kling.
    
            Teach Qt about window.internals
            https://bugs.webkit.org/show_bug.cgi?id=61074
    
            A weakness of the Qt DRT setup is that things like JSContextRef are abstracted
            away from the QtWebKit API so we need DumpRenderTreeSupportQt to access WebCore internals.
            Since the window.internals object requires JSContextRef we need to implement it in DumpRenderTreeSupportQt
            where we can access it. DumpRenderTreeSupportQt cannot be compiled outside Qt's WebCore and as it
            is our only possible route into the WebCoreTestSupport class neither can the new window.internals plumbing.
            Likewise we can't put the accessor in WebCoreTestSupport because it would then need to know about QWebFrame
            and others. The only alternative seems like a compile time guard which we would have to teach the bots about.
    
            * CodeGenerators.pri:
            * WebCore.pri:
            * WebCore.pro:
    2011-06-09  Robert Hogan  <robert@webkit.org>
    
            Reviewed by Andreas Kling.
    
            Teach Qt about window.internals
            https://bugs.webkit.org/show_bug.cgi?id=61074
    
            * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
            (DumpRenderTreeSupportQt::injectInternalsObject):
            * WebCoreSupport/DumpRenderTreeSupportQt.h:
    2011-06-09  Robert Hogan  <robert@webkit.org>
    
            Reviewed by Andreas Kling.
    
            Teach Qt about window.internals
            https://bugs.webkit.org/show_bug.cgi?id=61074
    
            * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
            (WebCore::DumpRenderTree::initJSObjects):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88446 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	LayoutTests/platform/qt/Skipped
    	Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h

commit b0ff91f953d5f3781d24c842c5616d29be04fca6
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Wed Aug 24 11:01:28 2011 -0300

    2011-06-02  Dimitri Glazkov  <dglazkov@chromium.org>
    
            Reviewed by Darin Adler.
    
            Add build logistics and plumbing for window.internals object.
            https://bugs.webkit.org/show_bug.cgi?id=60313
    
            * fast/dom/Window/script-tests/window-property-descriptors.js: Added internals object to list of properties to skip.
            * fast/dom/Window/window-properties.html: Ditto.
            * fast/dom/script-tests/prototype-inheritance-2.js: Ditto.
            * fast/dom/script-tests/prototype-inheritance.js: Ditto.
            * fast/harness/internals-object-expected.txt: Added.
            * fast/harness/internals-object.html: Added.
            * platform/gtk/Skipped: Skipped the newly added test until platform supports window.internals.
            * platform/mac-wk2/Skipped: Ditto.
            * platform/qt/Skipped: Ditto.
            * platform/win/Skipped: Ditto.
    2011-06-02  Dimitri Glazkov  <dglazkov@chromium.org>
    
            Reviewed by Darin Adler.
    
            Add build logistics and plumbing for window.internals object.
            https://bugs.webkit.org/show_bug.cgi?id=60313
    
            Test: fast/harness/internals-object.html
    
            * Configurations/WebCoreTestSupport.xcconfig: Added.
            * DerivedSources.make: Added support for generating from Internals.idl.
            * WebCore.gyp/WebCore.gyp: Added new webcore_test_support library.
            * WebCore.gypi: Ditto.
            * WebCore.xcodeproj/project.pbxproj: Added WebCoreTestSupport library.
            * testing/Internals.cpp: Added.
            * testing/Internals.h: Added.
            * testing/Internals.idl: Added.
            * testing/js/WebCoreTestSupport.cpp: Added.
            * testing/js/WebCoreTestSupport.h: Added.
            * testing/v8/WebCoreTestSupport.cpp: Added.
            * testing/v8/WebCoreTestSupport.h: Added.
    2011-06-02  Dimitri Glazkov  <dglazkov@chromium.org>
    
            Reviewed by Darin Adler.
    
            Add build logistics and plumbing for window.internals object.
            https://bugs.webkit.org/show_bug.cgi?id=60313
    
            * WebKit.gyp: Added linking new webkit_test_support library.
            * public/WebTestingSupport.h: Added.
            * src/WebTestingSupport.cpp: Added.
    2011-06-02  Dimitri Glazkov  <dglazkov@chromium.org>
    
            Reviewed by Darin Adler.
    
            Add build logistics and plumbing for window.internals object.
            https://bugs.webkit.org/show_bug.cgi?id=60313
    
            * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj: Added linking new WebCoreTestSupport library.
            * DumpRenderTree/chromium/TestShell.cpp:
            (TestShell::bindJSObjectsToWindow): Added injection code.
            * DumpRenderTree/mac/FrameLoadDelegate.mm:
            (-[FrameLoadDelegate didClearWindowObjectInStandardWorldForFrame:]): Ditto.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@87948 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	LayoutTests/platform/gtk/Skipped
    	LayoutTests/platform/mac-wk2/Skipped
    	LayoutTests/platform/qt/Skipped
    	LayoutTests/platform/win/Skipped

commit fcfb7c14310eac4cec42da5cd9ce873e911894ce
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Tue Aug 23 18:19:17 2011 -0300

    Add a missing trailing whitespace to a test expectation
    
    svg/dom/stylesheet-candidate-node-crash-main.html is a crash test and it
    fails because of a missing trailing whitespace. For some reason it doesn't
    fail on trunk (maybe because of new run-webkit-tests or something in our
    DRT?).

commit 2a511cf13bb1bccd312b39fbdafe69a19e54826f
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Tue Aug 23 18:24:20 2011 -0300

    Skip failing test introduced in r92966
    
    SHA1: 0e9f086adb423a785038bc12e7a646620a890f7a
    
    editing/selection/select-start-remove-root-crash.html fails (timeout) in
    our 2.2 branch. It's a crash test and the original test-case doesn't
    crash the QtTestBrowser. I guess there's something missing in our DRT.
    Pending investigation.

commit 5a9b4b9c9f8e18a5d90b6c11656b99272104c876
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Tue Aug 23 17:17:39 2011 -0300

    Crash in FocusController::advanceFocusInDocumentOrder
    https://bugs.webkit.org/show_bug.cgi?id=66678
    
    Source/WebCore:
    
    RefPtr the focusable node to prevent getting deleted by mutation
    event.
    
    Author: Abhishek Arya <inferno@chromium.org>
    Reviewed by Dave Hyatt.
    
    Test: fast/frames/focus-controller-crash-change-event.html
    
    * page/FocusController.cpp:
    (WebCore::FocusController::advanceFocusInDocumentOrder):
    
    LayoutTests:
    
    Reviewed by Dave Hyatt.
    
    * fast/frames/focus-controller-crash-change-event-expected.txt: Added.
    * fast/frames/focus-controller-crash-change-event.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93514 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/WebCore/page/FocusController.cpp

commit b0f1d639e8bd2da6bab80d6238a7d56a947420ff
Author: Ryosuke Niwa <rniwa@webkit.org>
Date:   Thu Aug 18 20:41:51 2011 +0000

    SimplifiedBackwardsTextIterator returns incorrect offset with first-letter rule
    https://bugs.webkit.org/show_bug.cgi?id=66086
    
    Reviewed by Darin Adler.
    
    Source/WebCore:
    
    The bug was caused by SimplifiedBackwardsTextIterator's not taking care of first-letter at all.
    Fixing the bug by detecting RenderTextFragment in handleTextNode.
    
    Also added m_shouldHandleFirstLetter to SimplifiedBackwardsTextIterator to keep track of whether or not
    the next call to handleTextNode needs to process the first-letter part of the text fragment.
    
    Test: editing/text-iterator/backward-textiterator-first-letter-crash.html
    
    * editing/TextIterator.cpp:
    (WebCore::firstRenderTextInFirstLetter): Extracted from handleTextNodeFirstLetter.
    (WebCore::TextIterator::handleTextNodeFirstLetter): Calls firstRenderTextInFirstLetter.
    (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
    (WebCore::SimplifiedBackwardsTextIterator::handleTextNode):
    (WebCore::SimplifiedBackwardsTextIterator::handleFirstLetter): Added.
    * editing/TextIterator.h:
    
    LayoutTests:
    
    Added a test to ensure WebKit does not hit assertions in SimplifiedBackwardsTextIterator.
    Also fixed a bug in first-letter-word-boundary.html and updated expected offsets for move backward by word
    from 0 to 1 because there is unrendered space before "hello".
    
    * editing/text-iterator/backward-textiterator-first-letter-crash-expected.txt: Added.
    * editing/text-iterator/backward-textiterator-first-letter-crash.html: Added.
    * editing/text-iterator/first-letter-word-boundary-expected.txt:
    * editing/text-iterator/first-letter-word-boundary.html:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93347 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit f011bd5f216ba62629ddd6e3f5cec97f44814f58
Author: Tor Arne Vestbø <vestbo@webkit.org>
Date:   Tue Aug 23 13:26:26 2011 +0000

    [Qt] Fix build on Lion
    
    https://bugs.webkit.org/show_bug.cgi?id=66770
    
    Reviewed by Andreas Kling.
    
    We were mistakenly picking up mac/WebCoreSystemInterface.h instead of
    the Qt one, and building on Lion revealed this when a typedef for
    IOSurfaceRef was wrapped in PLATFORM(MAC).
    
    For now we fix this by including WebCoreSystemInterface using
    brackets, so that we'll pick up the right file based on the
    include paths. This also means exposing a few missing enums
    in our own version of the file, so those were added.
    
    Lasty, we need to link against the right system interface library
    on Lion.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93600 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 607eaba91272f6e7b996920dc8410d0ac00fa73b
Author: Cris Neckar <cdn@chromium.org>
Date:   Mon Aug 8 20:39:23 2011 +0000

    Remove counter nodes from the tree and fix-up children when they are removed from the counter map.
    https://bugs.webkit.org/show_bug.cgi?id=65346
    
    Reviewed by Adam Barth.
    
    Covered by existing CSS counter tests.
    
    * rendering/CounterNode.cpp:
    (WebCore::CounterNode::~CounterNode):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92630 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 668d03b83596f616cd9b4ba94908428ba1c6f330
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Thu Aug 18 16:36:27 2011 -0300

    Move towards supporting user controlled prototypes on CanvasPixelArray
    https://bugs.webkit.org/show_bug.cgi?id=66429
    
    Author: Oliver Hunt <oliver@apple.com>
    Reviewed by Gavin Barraclough.
    
    Start using a per-global object structure for canvas pixel array.
    
    * bindings/js/JSImageDataCustom.cpp:
    (WebCore::toJS):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93264 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/WebCore/bindings/js/JSImageDataCustom.cpp

commit 964b7e9738b9770e0a6bffd4aa4b9514169f5a21
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Thu Aug 18 15:45:59 2011 -0300

    Source/WebCore: Crash in Document::recalcStyleSelector
    https://bugs.webkit.org/show_bug.cgi?id=66335
    
    Author: Abhishek Arya <inferno@chromium.org>
    Reviewed by Simon Fraser.
    
    When node is getting destroyed and its removedFromDocument
    is not called due to entire document structure torn down(using
    removeAllChildren), make sure to clear out the stylesheet
    candidate node from document's structures in its destructor.
    
    Test: svg/dom/stylesheet-candidate-node-crash-main.html
    
    * dom/ProcessingInstruction.cpp:
    (WebCore::ProcessingInstruction::~ProcessingInstruction):
    * html/HTMLLinkElement.cpp:
    (WebCore::HTMLLinkElement::~HTMLLinkElement):
    * html/HTMLStyleElement.cpp:
    (WebCore::HTMLStyleElement::~HTMLStyleElement):
    * svg/SVGStyleElement.cpp:
    (WebCore::SVGStyleElement::~SVGStyleElement):
    
    LayoutTests: Tests that we do not crash when iterating through stylesheet
    candidate list hashset.
    https://bugs.webkit.org/show_bug.cgi?id=66335
    
    Reviewed by Simon Fraser.
    
    * svg/dom/resources/stylesheet-candidate-node-crash.svg: Added.
    * svg/dom/stylesheet-candidate-node-crash-main-expected.txt: Added.
    * svg/dom/stylesheet-candidate-node-crash-main.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93227 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/WebCore/html/HTMLLinkElement.cpp

commit 4277f8277b1daf3ec33c996f5a760ccd1113af4b
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Thu Aug 18 11:23:19 2011 -0300

    [Mac] Add a missing include path to generated headers
    
    Author: Alexis Menard <alexis.menard@openbossa.org>
    
    When building QtWebKit from inside Qt, we need to use
    auto-generated headers. On Mac there was an include path
    missing after the multimedia backend change
    (Bug 63472, r91752).
    
    This is not being added to trunk because it doesn't make
    sense to add this include path when using build-webkit.

commit d054da8fd1752501582c12cb24cf9a7489e0f9e6
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Tue Aug 16 17:10:03 2011 -0300

    Crash accessing static property on sealed object
    https://bugs.webkit.org/show_bug.cgi?id=66242
    
    Author: Gavin Barraclough <barraclough@apple.com>
    Reviewed by Sam Weinig.
    
    Source/JavaScriptCore:
    
    * runtime/JSObject.h:
    (JSC::JSObject::putDirectInternal):
        - should only check isExtensible if checkReadOnly.
    
    LayoutTests:
    
    * fast/js/preventExtensions-expected.txt:
    * fast/js/script-tests/preventExtensions.js:
        - added test case.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93048 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	LayoutTests/fast/js/preventExtensions-expected.txt
    	LayoutTests/fast/js/script-tests/preventExtensions.js

commit 0e9f086adb423a785038bc12e7a646620a890f7a
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Mon Aug 15 18:02:07 2011 -0300

    Crash in WebCore::editingIgnoresContent
    https://bugs.webkit.org/show_bug.cgi?id=66125
    
    Author: Abhishek Arya <inferno@chromium.org>
    Reviewed by Ryosuke Niwa.
    
    Source/WebCore:
    
    RefPtr a few nodes in case they get blown away in
    dispatchEvent calls.
    
    Test: editing/selection/select-start-remove-root-crash.html
    
    * editing/FrameSelection.cpp:
    (WebCore::FrameSelection::selectAll):
    * editing/ReplaceSelectionCommand.cpp:
    (WebCore::ReplacementFragment::ReplacementFragment):
    
    LayoutTests:
    
    Tests that we do not crash when we blow away the root
    during the firing of selectstart event in selection.
    
    * editing/selection/select-start-remove-root-crash-expected.txt: Added.
    * editing/selection/select-start-remove-root-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92966 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/WebCore/editing/FrameSelection.cpp

commit fbfc2f9a18a55802204a8e95dd22bb5c1fe49f1a
Author: Abhishek Arya <inferno@chromium.org>
Date:   Sun Aug 14 23:08:11 2011 +0000

    Source/WebCore: Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody
    https://bugs.webkit.org/show_bug.cgi?id=66187
    
    Reviewed by Adam Barth.
    
    RefPtr a few ContainerNodes to prevent premature deletion.
    
    Test: fast/html/process-end-tag-for-inbody-crash.html
    
    * html/parser/HTMLTreeBuilder.cpp:
    (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
    (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
    (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
    
    LayoutTests: Crash in HTMLTreeBuilder::processAnyOtherEndTagForInBody.
    https://bugs.webkit.org/show_bug.cgi?id=66187
    
    Reviewed by Adam Barth.
    
    * fast/html/process-end-tag-for-inbody-crash-expected.txt: Added.
    * fast/html/process-end-tag-for-inbody-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@93032 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit a755bead1f11d4d721d7dee518c566345e6ea484
Author: Abhishek Arya <inferno@chromium.org>
Date:   Wed Aug 10 21:48:18 2011 +0000

    Source/WebCore: Check that we do not need layout before trying to dirty
    m_originatingLine for our floats.
    https://bugs.webkit.org/show_bug.cgi?id=65938
    
    Reviewed by Dave Hyatt.
    
    Test: fast/block/float/float-originating-line-deleted-crash.html
    
    * rendering/RenderBlock.cpp:
    (WebCore::RenderBlock::removeFloatingObject):
    (WebCore::RenderBlock::clearFloats):
    
    LayoutTests: Tests that we do not crash when trying to access a removed
    m_originatingLine for a float.
    https://bugs.webkit.org/show_bug.cgi?id=65938
    
    Reviewed by Dave Hyatt.
    
    * fast/block/float/float-originating-line-deleted-crash-expected.txt: Added.
    * fast/block/float/float-originating-line-deleted-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92798 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 8ed79cb10ca72b5d240beae674a7932963cbd007
Author: Alexis Menard <alexis.menard@openbossa.org>
Date:   Thu Aug 11 12:45:44 2011 +0000

    Unreviewed build fix for Qt.
    
    Make sure we build when Qt is namespaced.
    
    * platform/graphics/gstreamer/PlatformVideoWindowPrivate.h:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92841 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 66b76cdb8ef823f27a8229c5cae2d35e7f2d3c59
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Mon Aug 8 12:15:10 2011 -0300

    Skip tests that fail because of qtwebkit-2.2 DRT limitations
    
    Introduced by r92142 (bug 61809):
      Source/WebCore: Never override the policy URL on form submissions
      https://bugs.webkit.org/show_bug.cgi?id=61809
    
    On qtwebkit-2.2 our DRT doesn't support third-party-cookies
    configuration (layoutTestController.setAlwaysAcceptCookies()
    and therefore these tests fail.

commit 0c20586abec46074c8641f80736e473201344e5a
Author: commit-queue <commit-queue@webkit.org>
Date:   Sat Aug 6 19:52:39 2011 +0000

    Patch by Aron Rosenberg <arosenberg@logitech.com> on 2011-08-06
    Reviewed by Benjamin Poulain.
    
    [Qt] Fix build with Intel compiler on Windows
    https://bugs.webkit.org/show_bug.cgi?id=65088
    
    .:
    
    Disable Intel Compiler warning 873 - function "" has no corresponding operator
    delete (to be called if an exception is thrown during initialization of an
    allocated object).
    
    * Source/WebKit.pri:
    
    Source/JavaScriptCore:
    
    Intel compiler needs .lib suffixes instead of .a
    Intel compiler doesn't support nullptr
    Intel compiler supports unsized arrays
    
    * JavaScriptCore.pri:
    * jsc.cpp:
    * wtf/ByteArray.h:
    * wtf/NullPtr.h:
    
    Source/WebCore:
    
    Intel compiler needs .lib suffixes instead of .a
    
    * WebCore.pri:
    
    Source/WebKit2:
    
    Intel compiler needs .lib suffixes instead of .a
    
    * WebKit2.pri:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92555 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 6c2f6bbcd6f5d9c63b936851c2b58f06f477f99a
Author: Kent Tamura <tkent@chromium.org>
Date:   Thu Aug 4 04:38:01 2011 +0000

    Fix incorrect checks for HTMLMediaElement
    https://bugs.webkit.org/show_bug.cgi?id=65590
    
    Reviewed by Dimitri Glazkov.
    
    <video> and <audio> can be an HTMLElement instance instead of
    HTMLMediaElement if MediaPlayer::isAvailable() returns false or
    the media feature is disabled at runtime.
    
    Source/WebCore:
    
    * html/HTMLSourceElement.cpp:
    (WebCore::HTMLSourceElement::insertedIntoTree):
    (WebCore::HTMLSourceElement::willRemove):
    * html/HTMLTrackElement.cpp:
    (WebCore::HTMLTrackElement::insertedIntoTree):
    (WebCore::HTMLTrackElement::willRemove):
    * html/shadow/MediaControlElements.cpp:
    (WebCore::toParentMediaElement):
    * page/FrameView.cpp:
    (WebCore::FrameView::updateWidget):
    * platform/efl/RenderThemeEfl.cpp:
    (WebCore::RenderThemeEfl::paintMediaMuteButton):
    * platform/gtk/RenderThemeGtk.cpp:
    (WebCore::getMediaElementFromRenderObject):
    * rendering/RenderThemeMac.mm:
    (WebCore::RenderThemeMac::paintMediaSliderTrack):
    * rendering/RenderThemeWinCE.cpp:
    (WebCore::mediaElementParent):
    
    Source/WebKit/mac:
    
    * WebView/WebFullScreenController.mm:
    (-[WebFullScreenController _isAnyMoviePlaying]):
    
    Source/WebKit/win:
    
    * WebView.cpp:
    (WebView::enterFullscreenForNode):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92347 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 244cf0d8aa7f831c0774c491f2c40fc6172426da
Author: Abhishek Arya <inferno@chromium.org>
Date:   Mon Aug 1 18:03:03 2011 +0000

    Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
    https://bugs.webkit.org/show_bug.cgi?id=65137
    
    Source/WebCore:
    
    Fix the looping condition to prevent trailingSpaceMidpoint from becoming negative.
    
    Reviewed by Dave Hyatt.
    
    Test: fast/block/update-midpoints-for-trailing-boxes-crash.html
    
    * rendering/RenderBlockLineLayout.cpp:
    (WebCore::TrailingObjects::updateMidpointsForTrailingBoxes):
    
    LayoutTests:
    
    ASSERTION FAILED: trailingSpaceMidpoint >= 0
    
    Reviewed by Dave Hyatt.
    
    * fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt: Added.
    * fast/block/update-midpoints-for-trailing-boxes-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92132 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit c1022df9dc8bced1b5d9a40afc9ed5257e9bbc0e
Author: Jochen Eisinger <jochen@chromium.org>
Date:   Mon Aug 1 21:18:49 2011 +0000

    Source/WebCore: Never override the policy URL on form submissions.
    https://bugs.webkit.org/show_bug.cgi?id=61809
    
    Reviewed by Adam Barth.
    
    Tests: http/tests/security/cookies/third-party-cookie-blocking-main-frame.html
           http/tests/security/cookies/third-party-cookie-blocking-user-action.html
           http/tests/security/cookies/third-party-cookie-blocking.html
    
    * loader/FrameLoader.cpp:
    (WebCore::FrameLoader::loadURL):
    (WebCore::FrameLoader::addExtraFieldsToSubresourceRequest):
    (WebCore::FrameLoader::addExtraFieldsToMainResourceRequest):
    (WebCore::FrameLoader::addExtraFieldsToRequest):
    (WebCore::FrameLoader::loadPostRequest):
    (WebCore::FrameLoader::loadDifferentDocumentItem):
    * loader/FrameLoader.h:
    
    LayoutTests: Require explicit user action to override the policy URL on form submissions.
    https://bugs.webkit.org/show_bug.cgi?id=61809
    
    Reviewed by Adam Barth.
    
    * http/tests/loading/redirect-methods-expected.txt:
    * http/tests/security/cookies/resources/set-a-cookie.php: Added.
    * http/tests/security/cookies/third-party-cookie-blocking-expected.txt: Added.
    * http/tests/security/cookies/third-party-cookie-blocking-main-frame-expected.txt: Added.
    * http/tests/security/cookies/third-party-cookie-blocking-main-frame.html: Added.
    * http/tests/security/cookies/third-party-cookie-blocking-user-action-expected.txt: Added.
    * http/tests/security/cookies/third-party-cookie-blocking-user-action.html: Added.
    * http/tests/security/cookies/third-party-cookie-blocking.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92142 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 18d52e6744ddb011aa537602367d465069d2e8b7
Author: commit-queue <commit-queue@webkit.org>
Date:   Fri Aug 5 14:17:23 2011 +0000

    Patch by Dawit Alemayehu <adawit@kde.org> on 2011-08-05
    Reviewed by Andreas Kling.
    
    Reverted commit r87797, http://trac.webkit.org/changeset/87797, because it
    causes the regression reported under bug# 63582.
    
    [Qt] REGRESSION(r87797): Broke KDEWebKit's custom QNAM.
    https://bugs.webkit.org/show_bug.cgi?id=63582
    
    * WebCoreSupport/FrameLoaderClientQt.cpp:
    (WebCore::FrameLoaderClientQt::setFrame):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@92479 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit b54ce191891e524ec4d99d666cb9291b3a4a92bb
Author: Gavin Barraclough <barraclough@apple.com>
Date:   Mon May 16 07:21:01 2011 +0000

    Source/JavaScriptCore: https://bugs.webkit.org/show_bug.cgi?id=60860
    Simplify backtracking in YARR JIT
    
    Reviewed by Geoff Garen & Michael Saboff.
    
    YARR JIT currently performs a single pass of code generation over the pattern,
    with special handling to allow the code generation for some backtracking code
    out of line. We can simplify things by moving to a common mechanism whereby all
    forwards matching code is generated in one pass, and all backtracking code is
    generated in another. Backtracking code can be generated in reverse order, to
    optimized the common fall-through case.
    
    To make it easier to walk over the pattern, we can first convert to a more
    byte-code like format before JIT generating. In time we should unify this with
    the YARR interpreter to more closely unify the two.
    
    * yarr/YarrJIT.cpp:
    (JSC::Yarr::YarrGenerator::jumpIfNoAvailableInput):
    (JSC::Yarr::YarrGenerator::YarrOp::YarrOp):
    (JSC::Yarr::YarrGenerator::BacktrackingState::BacktrackingState):
    (JSC::Yarr::YarrGenerator::BacktrackingState::append):
    (JSC::Yarr::YarrGenerator::BacktrackingState::fallthrough):
    (JSC::Yarr::YarrGenerator::BacktrackingState::link):
    (JSC::Yarr::YarrGenerator::BacktrackingState::linkTo):
    (JSC::Yarr::YarrGenerator::BacktrackingState::takeBacktracksToJumpList):
    (JSC::Yarr::YarrGenerator::BacktrackingState::isEmpty):
    (JSC::Yarr::YarrGenerator::BacktrackingState::linkDataLabels):
    (JSC::Yarr::YarrGenerator::BacktrackingState::ReturnAddressRecord::ReturnAddressRecord):
    (JSC::Yarr::YarrGenerator::generateAssertionBOL):
    (JSC::Yarr::YarrGenerator::backtrackAssertionBOL):
    (JSC::Yarr::YarrGenerator::generateAssertionEOL):
    (JSC::Yarr::YarrGenerator::backtrackAssertionEOL):
    (JSC::Yarr::YarrGenerator::matchAssertionWordchar):
    (JSC::Yarr::YarrGenerator::generateAssertionWordBoundary):
    (JSC::Yarr::YarrGenerator::backtrackAssertionWordBoundary):
    (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
    (JSC::Yarr::YarrGenerator::backtrackPatternCharacterOnce):
    (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
    (JSC::Yarr::YarrGenerator::backtrackPatternCharacterFixed):
    (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
    (JSC::Yarr::YarrGenerator::backtrackPatternCharacterGreedy):
    (JSC::Yarr::YarrGenerator::generatePatternCharacterNonGreedy):
    (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
    (JSC::Yarr::YarrGenerator::generateCharacterClassOnce):
    (JSC::Yarr::YarrGenerator::backtrackCharacterClassOnce):
    (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
    (JSC::Yarr::YarrGenerator::backtrackCharacterClassFixed):
    (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
    (JSC::Yarr::YarrGenerator::backtrackCharacterClassGreedy):
    (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
    (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
    (JSC::Yarr::YarrGenerator::generateTerm):
    (JSC::Yarr::YarrGenerator::backtrackTerm):
    (JSC::Yarr::YarrGenerator::generate):
    (JSC::Yarr::YarrGenerator::backtrack):
    (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
    (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
    (JSC::Yarr::YarrGenerator::opCompileAlternative):
    (JSC::Yarr::YarrGenerator::opCompileBody):
    (JSC::Yarr::YarrGenerator::YarrGenerator):
    (JSC::Yarr::YarrGenerator::compile):
    
    LayoutTests: https://bugs.webkit.org/show_bug.cgi?id=60860
    Add layout tests for some regular expressions that used to crash the compiler.
    
    Reviewed by Geoff Garen & Michael Saboff.
    
    * fast/regex/parentheses-expected.txt:
    * fast/regex/script-tests/parentheses.js:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@86536 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 883ca7eae6dedfd2caddbaf8b95a51795aa13268
Author: Alexis Menard <alexis.menard@openbossa.org>
Date:   Wed Jul 27 14:20:07 2011 +0000

    [Qt] Unreviewed build fix for mac.
    
    QtKit is now our default media player, the define is WTF_USE_QTKIT and it's not part
    of the options passed to build-webkit, therefore DerivedSources should now generate the
    includes when it's mac.
    
    * DerivedSources.pro:
    * WebCore.pro:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91843 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit c955d9023e78c90187a3e11c5ca637a446e95ee9
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Tue Aug 2 15:08:51 2011 -0300

    Patch by Julien Chaffraix <jchaffraix@webkit.org> on 2011-07-07
    Reviewed by David Hyatt.
    
    Partial layout when a flex-box has visibility: collapse
    https://bugs.webkit.org/show_bug.cgi?id=63776
    
    Source/WebCore:
    
    Tests: fast/flexbox/crash-button-input-autofocus.html
           fast/flexbox/crash-button-keygen.html
           fast/flexbox/crash-button-relayout.html
    
    The issue is that FlexBoxIterator would skip any child if it has visibility: collapsed.
    However if one of the child is anonymous, it may wrap some other child that would be skipped.
    Now FlexBoxIterator is called during the layout phase and thus some nodes would not relayouted
    as expected.
    
    * rendering/RenderDeprecatedFlexibleBox.cpp:
    (WebCore::FlexBoxIterator::next): When iterating, don't skip anonymous content as there may
    be real content hiding below.
    
    LayoutTests:
    
    Those tests checks some variation of the same underlying issue.
    
    * fast/flexbox/crash-button-input-autofocus-expected.txt: Added.
    * fast/flexbox/crash-button-input-autofocus.html: Added.
    * fast/flexbox/crash-button-keygen-expected.txt: Added.
    * fast/flexbox/crash-button-keygen.html: Added.
    * fast/flexbox/crash-button-relayout-expected.txt: Added.
    * fast/flexbox/crash-button-relayout.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@90568 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp

commit 2f842a47d379271e800cf54584d6aca0a5d106c9
Author: Julien Chaffraix <jchaffraix@webkit.org>
Date:   Thu Jun 30 21:51:17 2011 +0000

    2011-06-30  Julien Chaffraix  <jchaffraix@webkit.org>
    
            Reviewed by Nikolas Zimmermann.
    
            Update SVG position values on SVG DOM updates
            https://bugs.webkit.org/show_bug.cgi?id=62439
    
            * svg/custom/crash-textPath-attributes-expected.txt: Added.
            * svg/custom/crash-textPath-attributes.html: Added.
            * svg/custom/resources/crash-textPath-attributes-iframe.svg: Added.
    2011-06-30  Julien Chaffraix  <jchaffraix@webkit.org>
    
            Reviewed by Nikolas Zimmermann.
    
            Update SVG position values on SVG DOM updates
            https://bugs.webkit.org/show_bug.cgi?id=62439
    
            Test: svg/custom/crash-textPath-attributes.html
    
            * rendering/svg/RenderSVGInline.cpp:
            (WebCore::RenderSVGInline::destroy): Notify our containing RenderSVGText that it needs
            to update its positioning information.
    
            * rendering/svg/SVGInlineFlowBox.cpp:
            (WebCore::SVGInlineFlowBox::calculateBoundaries): Check the type of the InlineBox
            like the rest of the code (fixes an ASSERT_NOT_REACHED in InlineBox::calculateBoudaries).
    
            * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
            (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree): Clear
            our cached layout attributes every time we invalidate them. This avoids keeping stale
            attribute that have a backpointer to a RenderObject.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@90166 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 899ebf52af7b8e39652fb88f54ab7b9fbbaf68f1
Author: John Knottenbelt <jknotten@chromium.org>
Date:   Wed Jul 13 14:11:14 2011 +0000

    Reference Geolocation object from GeoNotifier and Geolocation::setIsAllowed.
    https://bugs.webkit.org/show_bug.cgi?id=64363
    
    Reviewed by Tony Gentilcore.
    
    Source/WebCore:
    
    Test: fast/dom/Geolocation/remove-remote-context-in-error-callback-crash.html
    
    * page/Geolocation.cpp:
    (WebCore::Geolocation::setIsAllowed):
    * page/Geolocation.h:
    
    LayoutTests:
    
    * fast/dom/Geolocation/remove-remote-context-in-error-callback-crash.html: Added.
    * fast/dom/Geolocation/resources/remove-remote-context-in-error-callback-crash-inner.html: Added.
    * fast/dom/Geolocation/script-tests/remove-remote-context-in-error-callback-crash.js: Added.
    * fast/dom/Geolocation/remove-remote-context-in-error-callback-crash-expected.txt: Added.
    (gc):
    (onIframeReady):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@90914 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 9ee58b72d6be7ef21706bac02451193fd7df6f2a
Author: Adam Barth <abarth@webkit.org>
Date:   Mon Jun 27 03:43:39 2011 +0000

    2011-06-26  Adam Barth  <abarth@webkit.org>
    
            Reviewed by Kent Tamura.
    
            m_formElementsWithFormAttribute doesn't ref the objects it holds
            https://bugs.webkit.org/show_bug.cgi?id=62956
    
            * fast/forms/form-associated-element-crash3-expected.txt: Added.
            * fast/forms/form-associated-element-crash3.html: Added.
    2011-06-26  Adam Barth  <abarth@webkit.org>
    
            Reviewed by Kent Tamura.
    
            m_formElementsWithFormAttribute doesn't ref the objects it holds
            https://bugs.webkit.org/show_bug.cgi?id=62956
    
            Test: fast/forms/form-associated-element-crash3.html
    
            * dom/Document.h:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@89780 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit b5578491e02b4b57346d0b3e6e7e3fbd51a95dec
Author: David Levin <levin@chromium.org>
Date:   Fri May 27 02:16:21 2011 +0000

    2011-05-26  David Levin  <levin@chromium.org>
    
            Reviewed by Dmitry Titov.
    
            WebKit's font notification has problems when the WebKit main thread != UI thread.
            https://bugs.webkit.org/show_bug.cgi?id=61391
    
            This doesn't happen in DumpRenderTree, so it needs a unit test which is taking me
            some time to write correctly. In the meantime, this issues happens to be causing
            some crashes in Chrome so here's the fix alone for the time being.
    
            * platform/graphics/mac/FontCacheMac.mm:
            (WebCore::invalidateFontCache): Ensure that FontCache::invalidate is only called on WebKit's main thread.
            (WebCore::fontCacheRegisteredFontsChangedNotificationCallback): Call common function for font cache invalidation.
             Note that the call to fontCache() is fine since the singleton is initialized well before calling this function. Theoretically,
             there could be a problem due to a lack of a memory barrier but that is highly unlikely and this is debug only code.
            (WebCore::fontCacheATSNotificationCallback): Ditto.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@87462 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 02c9701b50dfdc15ada78399f05abdd01392d4ed
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Tue Aug 2 14:46:43 2011 -0300

    Reviewed by Alexey Proskuryakov.
    
    fast/dom/HTMLLinkElement/link-and-subresource-test.html is flaky on chromium debug bots
    https://bugs.webkit.org/show_bug.cgi?id=60097
    
    The culprit was that CachedResource:stopLoading() was using *this
    after a call to checkNotify(), which isn't kosher.  This patch
    uses a CachedResourceHandle to keep the CachedResource alive.
    
    Source/WebCore:
    
    The test is a very close copy of the eponymous
    link-and-subresource-test.html, only substituting invalid
    resources for the valid ones in that test.  The reproduction is
    timing related, and happens much more consistantly with an invalid
    resource for whatever reason.
    Test: fast/dom/HTMLLinkElement/link-and-subresource-test-nonexistent.html
    
    * loader/cache/CachedResource.cpp:
    (WebCore::CachedResource::stopLoading):
    
    LayoutTests:
    
    The test is a very close copy of the eponymous
    link-and-subresource-test.html, only substituting invalid
    resources for the valid ones in that test.  The reproduction is
    timing related, and happens much more consistantly with an invalid
    resource for whatever reason.
    
    * fast/dom/HTMLLinkElement/link-and-subresource-test-nonexistent-expected.txt: Added.
    * fast/dom/HTMLLinkElement/link-and-subresource-test-nonexistent.html: Added.
    * platform/gtk/Skipped:
    * platform/mac/Skipped:
    * platform/qt/Skipped:
    * platform/win/Skipped:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@90595 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	LayoutTests/platform/qt/Skipped

commit b5e100fc1c38285ed10027020f43889dda72ea0d
Author: Ilya Tikhonovsky <loislo@chromium.org>
Date:   Thu Jun 9 12:42:40 2011 +0000

    2011-06-08  Mikołaj Małecki  <m.malecki@samsung.com>
    
            Reviewed by Pavel Feldman.
    
            Web Inspector: Crash by buffer overrun crash when serializing inspector object tree.
            https://bugs.webkit.org/show_bug.cgi?id=52791
    
            No new tests. The problem can be reproduced by trying to create InspectorValue
            from 1.0e-100 and call ->toJSONString() on this.
    
            * JavaScriptCore.exp:
            * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
            export 2 functions DecimalNumber::bufferLengthForStringExponential and
            DecimalNumber::toStringExponential.
    
    2011-06-08  Mikołaj Małecki  <m.malecki@samsung.com>
    
            Reviewed by Pavel Feldman.
    
            Web Inspector: Crash by buffer overrun crash when serializing inspector object tree.
            https://bugs.webkit.org/show_bug.cgi?id=52791
    
            No new tests. The problem can be reproduced by trying to create InspectorValue
            from 1.0e-100 and call ->toJSONString() on this.
    
            * JavaScriptCore.exp:
            * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
            export 2 functions DecimalNumber::bufferLengthForStringExponential and
            DecimalNumber::toStringExponential.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@88444 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit d230e745d1046a23cd5efa084a8c7ba7f113473b
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Fri Jul 29 12:24:00 2011 -0300

    [Qt][ARM]REGRESSION(r91752): It made audio related tests fail
    https://bugs.webkit.org/show_bug.cgi?id=65369
    
    * platform/qt-arm/Skipped: Skip failing tests.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91991 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	LayoutTests/platform/qt-arm/Skipped

commit 165e4172eb4edc64d8b74628da030791ae06cf24
Author: Alexis Menard <alexis.menard@openbossa.org>
Date:   Tue Jul 26 21:49:03 2011 +0000

    Unreviewed build fix for Qt/Linux.
    
    On platforms with no glib and gstreamer we should not build javascriptcore
    with the Glib support. This is related to http://trac.webkit.org/changeset/91752.
    
    * wtf/wtf.pri:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91787 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 522bdac4a6113cb8ec5b36e3d7c231715cf91614
Author: Alexis Menard <alexis.menard@openbossa.org>
Date:   Tue Jul 26 19:14:38 2011 +0000

    [Qt] Disable video support on linux if the dependencies are not found.
    
    If we can't find the necessary dependencies to build the GStreamer media player
    we disable the video support. This is related to http://trac.webkit.org/changeset/91752.
    
    Reviewed by Holger Freyther.
    
    No new tests, it's a build fix.
    
    * features.pri:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91771 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 7a53b15515fbd4365220128d107bff070e5a9fee
Author: Andras Becsi <abecsi@webkit.org>
Date:   Tue Jul 26 13:34:26 2011 +0000

    Patch by Alexis Menard <alexis.menard@openbossa.org> on 2011-07-26
    Reviewed by Andreas Kling.
    
    [Qt] Change default backend to use GStreamer on Linux and QuickTime on Mac.
    https://bugs.webkit.org/show_bug.cgi?id=63472
    
    Source/JavaScriptCore:
    
    Enable the bits needed for GStreamer only when QtMultimedia is not used.
    
    * wtf/wtf.pri:
    
    Source/WebCore:
    
    Enable the GStreamer backend and the QuickTime backend as default media players
    for the Qt port on Mac and Linux. QtMultimedia is now a fallback option that you
    can enable by passing DEFINES+=USE_QT_MULTIMEDIA=1 to enforce its usage.
    
    No new tests. The media layout tests are disabled on the Qt port but hopefully with this
    switch we can enable them again.
    
    * WebCore.pri:
    * WebCore.pro:
    * features.pri:
    
    Source/WebKit/qt:
    
    Use the flag WTF_USE_QTKIT=1 rather than USE_QTKIT=1 because that flag doesn't
    exist anymore, it's the default. Ditto for GStreamer.
    
    * QtWebKit.pro:
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91752 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit a086be90453a4152b6fa205b0759dd933053e866
Author: Alexis Menard <alexis.menard@openbossa.org>
Date:   Thu Jun 23 21:42:52 2011 +0000

    2011-06-23  Alexis Menard  <alexis.menard@openbossa.org>
    
            Reviewed by Eric Carlson.
    
            [Qt] Implement fullscreen support on Mac with the QuickTime backend.
            https://bugs.webkit.org/show_bug.cgi?id=61728
    
            Implement fullscreen support for Qt when using the QuickTime backend.
            We mostly use what is already done for the Mac port.
    
            * DerivedSources.pro: We use the mac files and they have <WebCore/x> type
            of includes. We need to generate those headers.
            * WebCore.pro:
            * platform/mac/WebVideoFullscreenController.h:
            * platform/mac/WebVideoFullscreenController.mm:
            * platform/mac/WebVideoFullscreenHUDWindowController.h:
            * platform/mac/WebVideoFullscreenHUDWindowController.mm:
            * platform/qt/WebCoreSystemInterface.h:
            * platform/qt/WebCoreSystemInterface.mm:
    2011-06-23  Alexis Menard  <alexis.menard@openbossa.org>
    
            Reviewed by Eric Carlson.
    
            [Qt] Implement fullscreen support on Mac with the QuickTime backend.
            https://bugs.webkit.org/show_bug.cgi?id=61728
    
            Implement fullscreen support for Qt when using the QuickTime backend.
            We mostly use what is already done for the Mac port.
    
            * QtWebKit.pro:
            * WebCoreSupport/ChromeClientQt.cpp:
            (WebCore::ChromeClientQt::ChromeClientQt):
            (WebCore::ChromeClientQt::~ChromeClientQt):
            * WebCoreSupport/ChromeClientQt.h:
            * WebCoreSupport/FullScreenVideoQt.cpp:
            (WebCore::FullScreenVideoQt::FullScreenVideoQt):
            (WebCore::FullScreenVideoQt::~FullScreenVideoQt):
            (WebCore::FullScreenVideoQt::enterFullScreenForNode):
            (WebCore::FullScreenVideoQt::exitFullScreenForNode):
            (WebCore::FullScreenVideoQt::requiresFullScreenForVideoPlayback):
            (WebCore::FullScreenVideoQt::isValid):
            * WebCoreSupport/FullScreenVideoQt.h:
            * WebCoreSupport/QTKitFullScreenVideoHandler.h: Added.
            * WebCoreSupport/QTKitFullScreenVideoHandler.mm: Added.
            (QTKitFullScreenVideoHandler::QTKitFullScreenVideoHandler):
            (QTKitFullScreenVideoHandler::~QTKitFullScreenVideoHandler):
            (QTKitFullScreenVideoHandler::enterFullScreen):
            (QTKitFullScreenVideoHandler::exitFullScreen):
            * WebCoreSupport/WebSystemInterface.mm:
            (InitWebCoreSystemInterface):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@89617 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 52145a65c843cc5cbd7f91f026fa6889f78be970
Author: Alexey Proskuryakov <ap@webkit.org>
Date:   Tue Jun 21 22:35:00 2011 +0000

            Fix Mac build in some configurations.
    
            * platform/mac/WebCoreSystemInterface.h: Added an enum matching WKSI one, since we cannot use
            WKSI in WebCore.
    
            * platform/mac/WebVideoFullscreenHUDWindowController.mm: Removed an include of WebKitSystemInterface.h.
            It's not meant to be used from WebCore, and if included, a wrong copy may be used.
            (createControlWithMediaUIControlType): Added a FIXME about problems with Leopard build.
            (-[WebVideoFullscreenHUDWindowController windowDidLoad]): Ditto. Switched enum values to
            WCSI style (lower level "wk").
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@89387 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit e6c68fed69dfb23257ceea191ba043772cad04ad
Author: Jer Noble <jer.noble@apple.com>
Date:   Mon Jun 20 22:21:48 2011 +0000

    Unreviewed build fix; Fix Leopard WebCore build.
    
    * platform/mac/WebVideoFullscreenHUDWindowController.mm: On Leopard, NSWindowDelegate
        is a category, not a protocol.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@89296 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 8253536aa42becd816d0848b27822f22c9fa3538
Author: Jer Noble <jer.noble@apple.com>
Date:   Mon Jun 20 21:56:15 2011 +0000

    Unreviewed build fix; Fix 32-bit build.
    
    Code recently moved from WebKit -> WebCore does not pass WebCore's more strict compiler warnings.  Use
    CGFloat, and float constants wherever possible, and use narrowPrecisionToFloat() where not.
    
    * WebCore.xcodeproj/project.pbxproj: Add '-Wno-undef' flag for WebVideoFullScreenController.mm
    * platform/mac/WebVideoFullscreenController.mm:
    (constrainFrameToRatioOfFrame): Use CGFloat instead of Double.
    (-[WebVideoFullscreenWindow animateFromRect:toRect:withSubAnimation:controllerAction:]): Use float constant.
    * platform/mac/WebVideoFullscreenHUDWindowController.mm:
    (-[WebVideoFullscreenHUDWindowController updateVolume]): Use float for volume.
    (-[WebVideoFullscreenHUDWindowController maxVolume]): Ditto.
    (-[WebVideoFullscreenHUDWindowController volumeChanged:]): Ditto.
    (-[WebVideoFullscreenHUDWindowController decrementVolume]): Ditto.
    (-[WebVideoFullscreenHUDWindowController incrementVolume]): Ditto.
    (-[WebVideoFullscreenHUDWindowController volume]): Ditto.
    (-[WebVideoFullscreenHUDWindowController setVolume:]): Ditto.
    (timeToString): Narrow precision to float when converting to seconds.
    * platform/mac/WebWindowAnimation.mm:
    (scaledRect): Use CGFloat.
    (-[WebWindowScaleAnimation init]): Use float constant.
    (-[WebWindowScaleAnimation currentValue]): Ditto.
    (-[WebWindowScaleAnimation additionalDurationNeededToReachFinalFrame]): Ditto.
    (-[WebWindowFadeAnimation currentAlpha]): Ditto.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@89292 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit b1e0431888d9ce56eafc26bab838a681b5c50e32
Author: Jer Noble <jer.noble@apple.com>
Date:   Mon Jun 20 19:29:39 2011 +0000

    2011-06-01  Jer Noble  <jer.noble@apple.com>
    
            Reviewed by Eric Carlson.
    
            Move Full Screen Controllers into WebCore.
    
            Remove dependency on QTKit from wekitExitFullscreen()
            https://bugs.webkit.org/show_bug.cgi?id=61843
    
            No new tests; the existing media full screen tests are sufficient.
    
            * WebCore.exp.in: Add new exports.
            * WebCore.xcodeproj/project.pbxproj: Add references to moved files.
            * platform/mac/WebCoreSystemInterface.h: Add new WCSI interfaces to WKSI functions.
            * platform/mac/WebCoreSystemInterface.mm:
            * platform/mac/WebVideoFullscreenController.h: Renamed from Source/WebKit/mac/WebView/WebVideoFullscreenController.h.
            * platform/mac/WebVideoFullscreenController.mm: Renamed from Source/WebKit/mac/WebView/WebVideoFullscreenController.mm.
    
            The following functions have had UNUSED_PARAM added:
            (-[WebVideoFullscreenController applicationDidResignActive:]):
            (-[WebVideoFullscreenController applicationDidChangeScreenParameters:]):
            (-[WebVideoFullscreenWindow mouseMoved:]):
    
    Source/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h.
            * platform/mac/WebVideoFullscreenHUDWindowController.mm: Renamed from Source/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm.
    
            The following functions have had UNUSED_PARAM added:
            (-[WebVideoFullscreenHUDWindow cancelOperation:]):
            (-[WebVideoFullscreenHUDWindowController timelinePositionChanged:]):
            (-[WebVideoFullscreenHUDWindowController setVolumeToZero:]):
            (-[WebVideoFullscreenHUDWindowController setVolumeToMaximum:]):
            (-[WebVideoFullscreenHUDWindowController togglePlaying:]):
            (-[WebVideoFullscreenHUDWindowController mouseEntered:]):
            (-[WebVideoFullscreenHUDWindowController mouseExited:]):
            (-[WebVideoFullscreenHUDWindowController rewind:]):
            (-[WebVideoFullscreenHUDWindowController fastForward:]):
            (-[WebVideoFullscreenHUDWindowController windowDidExpose:]):
            (-[WebVideoFullscreenHUDWindowController windowDidClose:]):
    
            The following functions have had WKSI calls converted to WCSI ones:
            (createControlWithMediaUIControlType):
            (createTimeTextField):
    
            * platform/mac/WebWindowAnimation.h: Renamed from Source/WebKit/mac/WebView/WebWindowAnimation.h.
            * platform/mac/WebWindowAnimation.mm: Renamed from Source/WebKit/mac/WebView/WebWindowAnimation.m.
            (WebWindowAnimationDurationFromDuration):
    
            The following functions have had WKSI calls converted to WCSI ones:
            (-[WebWindowScaleAnimation setCurrentProgress:]):
            (-[WebWindowFadeAnimation initWithDuration:window:initialAlpha:finalAlpha:]):
    2011-06-01  Jer Noble  <jer.noble@apple.com>
    
            Reviewed by Eric Carlson.
    
            Move Full Screen Controllers into WebCore.
    
            Remove dependency on QTKit from wekitExitFullscreen()
            https://bugs.webkit.org/show_bug.cgi?id=61843
    
            WebVideoFullscreenController, WebVideoFullscreenHUDController, and WebWindowAnimation
            have been moved into WebCore.
    
            * WebKit.xcodeproj/project.pbxproj:
    2011-06-01  Jer Noble  <jer.noble@apple.com>
    
            Reviewed by Eric Carlson.
    
            Move Full Screen Controllers into WebCore.
    
            Remove dependency on QTKit from wekitExitFullscreen()
            https://bugs.webkit.org/show_bug.cgi?id=61843
    
            WebVideoFullscreenController, WebVideoFullscreenHUDController, and WebWindowAnimation
            have been moved into WebCore.
    
            * WebCoreSupport/WebSystemInterface.mm:
            (InitWebCoreSystemInterface): Add support for four WKSI functions in WCSI.
            * WebView/WebFullScreenController.mm: Remove unused #include.
            * WebView/WebView.mm: Change the include location of
                WebVideoFullscreenController.h
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@89271 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 382deba135d86c35f978d12539740a8c9a7b1986
Author: Caio Marcelo de Oliveira Filho <cmarcelo@webkit.org>
Date:   Wed Jul 27 17:40:57 2011 +0000

    [Qt] QtWebkit never finishes loading sites when they are loaded after an initial QUrl fails to load.
    https://bugs.webkit.org/show_bug.cgi?id=61328
    
    Reviewed by Andreas Kling.
    
    Change the hooks in FrameLoaderClient we use for emitting signals. Instead of
    emitting signals in the progress notification functions, we use the
    dispatchDid{Start,Finish,Fail}* functions. The main reason behind this change is
    that loading code is prepared to handle load() when inside those functions.
    
    The crash was being caused by setUrl() (and load()) being called when
    loadFinished(false) was emitted. The problem here is that when
    postProgressFinishedNotification the FrameLoader wasn't ready for taking a load()
    call again, because it was still the ProvisionalLoadState but with the
    provisionalDocumentLoader already removed.
    
    To emulate the same behavior that QtWebKit had when using
    postProgressFinishedNotification, we now keep track of the frame originating the
    load, and emit the signals when this frame's client is called.
    
    The patch keeps the existing semantics for QWebPage signals, but we now emit the
    QWebFrame signals everytime, not only when they are the originating frame for
    loading.
    
    * Api/qwebframe.cpp:
    (clearCoreFrame): Document our assumption that activeDocumentLoader will exist.
    
    * WebCoreSupport/FrameLoaderClientQt.h: Remove m_loadError, add a boolean to keep
    track whether the frame is originating the load. Remove the signals from
    FrameLoaderClientQt since we will emit QWebFrame and QWebPage signals directly.
    
    * WebCoreSupport/FrameLoaderClientQt.cpp:
    (WebCore::FrameLoaderClientQt::FrameLoaderClientQt): Initialize m_isOriginatingLoad.
    
    (WebCore::FrameLoaderClientQt::setFrame): Do not connect QWebFrame and QWebPage
    signals to our signals for load/finished, signal emission will be done manually.
    
    (WebCore::FrameLoaderClientQt::dispatchDidStartProvisionalLoad): Emit
    loadStarted() signal and make the first notification of estimation change, that
    Qt API tests expect to exist and notify 10%.
    
    (WebCore::FrameLoaderClientQt::dispatchDidFinishLoad): Remove reference to
    m_loadError and emit loadFinished() signal.
    
    (WebCore::FrameLoaderClientQt::postProgressStartedNotification): Remove signal
    emission and mark the originating load as true, since only the originating frame
    gets this call in its client.
    
    (WebCore::FrameLoaderClientQt::postProgressFinishedNotification): Remove signal
    emission.
    
    (WebCore::FrameLoaderClientQt::callErrorPageExtension): Return whether the call
    was successful or not. This wasn't necessary before because a successful call for
    error page would lead to a load(), that cleared the m_loadError.
    (WebCore::FrameLoaderClientQt::dispatchDidFailProvisionalLoad): Remove reference
    to m_loadError and emit finished signal indicating error if ErrorPage extension
    doesn't handle it.
    (WebCore::FrameLoaderClientQt::dispatchDidFailLoad): Ditto.
    
    (WebCore::FrameLoaderClientQt::emitLoadStarted): Emit the loadStarted() signal
    for the QWebFrame, and if the originating load also do for the QWebPage.
    
    (WebCore::FrameLoaderClientQt::emitLoadFinished): Same as before but for
    loadFinished(). Take care to reset the originating load flag before the signals
    are emitted, since they might want to set it back again.
    
    * tests/qwebframe/tst_qwebframe.cpp:
    (URLSetter::URLSetter): Object that sets the url using either load() or setUrl()
    when a certain signal is emitted in the frame.
    
    (URLSetter::execute):
    (tst_QWebFrame::loadInSignalHandlers_data):
    (tst_QWebFrame::loadInSignalHandlers): New test inspired by the bug test case. This test
    crashes without this patch applied.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91855 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 8a95d2b5e2117fee85b4ccce4eae589f6a4eaee9
Author: Caio Marcelo de Oliveira Filho <cmarcelo@webkit.org>
Date:   Mon Jul 25 15:51:16 2011 +0000

    [Qt] Add more tests to cover the behavior of loadFinished() signal
    https://bugs.webkit.org/show_bug.cgi?id=63490
    
    Reviewed by Benjamin Poulain.
    
    * tests/qwebframe/tst_qwebframe.cpp:
    (FakeReply::FakeReply):
    (FakeNetworkManager::createRequest): Add a fake reply that gives 404 error code.
    
    (tst_QWebFrame::loadFinishedAfterNotFoundError): Verify that we get loadFinished(false)
    after a 404 error without contents.
    
    * tests/qwebpage/tst_qwebpage.cpp:
    (tst_QWebPage::errorPageExtensionLoadFinished): Verify if the argument of loadFinished()
    is true when we use error page extension to produce our own error pages.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91669 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 8c104c0f5f21a71269716ea9d84ba20ca78b81ab
Author: Ryosuke Niwa <rniwa@webkit.org>
Date:   Thu Jul 28 05:24:41 2011 +0000

    Calling window.find immediately after mutating the document crashes WebKit.
    https://bugs.webkit.org/show_bug.cgi?id=65296
    
    Reviewed by Darin Adler.
    
    Source/WebCore:
    
    Don't forget to layout first.
    
    Test: editing/text-iterator/find-after-mutation.html
    
    * editing/TextIterator.cpp:
    (WebCore::findPlainText):
    
    LayoutTests:
    
    Added a test to ensure WebKit doesn't crash when searching for string after mutating the document.
    
    * editing/text-iterator/find-after-mutation-expected.txt: Added.
    * editing/text-iterator/find-after-mutation.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91908 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit eb83f1fc36d6c59b13b2b6f077d6eb7027d35fc6
Author: MORITA Hajime <morrita@google.com>
Date:   Thu Jul 28 03:44:57 2011 +0000

    Source/WebCore: Inconsistent state of TreeScope reference.
    https://bugs.webkit.org/show_bug.cgi?id=65235
    
    The tree scope pointers on shadow tree nodes didn't cleared.
    even when the tree scope (shadow root) is destroyed.
    This change clear these poitners before detaching the shadow root.
    
    Reviewed by Dimitri Glazkov.
    
    Test: fast/dom/shadow/tree-scope-crash.html
    
    * dom/Element.cpp:
    (WebCore::Element::removeShadowRoot):
    
    LayoutTests: Inconsistent state of TreeScope reference.
    https://bugs.webkit.org/show_bug.cgi?id=65235
    
    Reviewed by Dimitri Glazkov.
    
    * fast/dom/shadow/tree-scope-crash-expected.txt: Added.
    * fast/dom/shadow/tree-scope-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 6e2b7712d2ba7077eb03a21d9cd06577514cee12
Author: Dominic Cooney <dominicc@chromium.org>
Date:   Sun May 22 15:56:02 2011 +0000

    2011-05-22  Dominic Cooney  <dominicc@chromium.org>
    
            Reviewed by Dimitri Glazkov.
    
            When removing a shadow root, also remove it from the render tree.
            https://bugs.webkit.org/show_bug.cgi?id=61245
    
            * platform/mac/Skipped: Unskip shadow tests.
    2011-05-22  Dominic Cooney  <dominicc@chromium.org>
    
            Reviewed by Dimitri Glazkov.
    
            When removing a shadow root, also remove it from the render tree.
            https://bugs.webkit.org/show_bug.cgi?id=61245
    
            Test: existing fast/dom/shadow/layout-tests-can-access-shadow.html
    
            * dom/Element.cpp:
            (WebCore::Element::removeShadowRoot): Call detach if attached.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@87029 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 5196373e3402f2503c71fede0ae0a62d493c96dd
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Fri Jul 29 11:40:54 2011 -0300

    Perform the JavaScript navigation check on a complete URL
    https://bugs.webkit.org/show_bug.cgi?id=65038
    
    Patch by Sergey Glazunov <serg.glazunov@gmail.com> on 2011-07-22
    Reviewed by Adam Barth.
    
    Source/WebCore:
    
    Test: http/tests/security/xss-DENIED-document-baseURI-javascript.html
    
    * page/DOMWindow.cpp:
    (WebCore::DOMWindow::setLocation):
    (WebCore::DOMWindow::createWindow):
    (WebCore::DOMWindow::open):
    
    LayoutTests:
    
    * http/tests/security/xss-DENIED-document-baseURI-javascript-expected.txt: Added.
    * http/tests/security/xss-DENIED-document-baseURI-javascript.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91611 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    
    Conflicts:
    
    	Source/WebCore/page/DOMWindow.cpp

commit 2690506060e818facf038f597d52d515c53a7713
Author: commit-queue <commit-queue@webkit.org>
Date:   Fri Jul 22 17:07:15 2011 +0000

    Fix crash in IDBRequest::abort
    https://bugs.webkit.org/show_bug.cgi?id=64740
    
    Patch by David Grogan <dgrogan@chromium.org> on 2011-07-22
    Reviewed by Nate Chapin.
    
    Tested manually with the testcase in the bug.
    
    * storage/IDBRequest.cpp:
    (WebCore::IDBRequest::~IDBRequest):
    (WebCore::IDBRequest::abort):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91571 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 57813edb6f26b5b13e3efbe3fabd84f10f51a157
Author: Daniel Bates <dbates@webkit.org>
Date:   Mon Jul 25 18:55:58 2011 +0000

    REGRESSION (r85964): Improper relayout of some nested positioned elements
    https://bugs.webkit.org/show_bug.cgi?id=64286
    
    Reviewed by David Hyatt.
    
    Source/WebCore:
    
    Fixes an issue when traversing up the containing block hierarchy after skipping
    relatively positioned inlines.
    
    When processing a positioned element we skip any intermediate inlines to get to
    to enclosing block B, but don't use the containing block for B (call this P_B) to
    properly continue traversing up the containing block hierarchy. So, B may be
    considered again instead of looking at P_B. Hence, we don't set the correct dirty
    bits for P_B and may not schedule a relayout with respect to the correct layout node.
    
    Test: fast/block/positioning/relayout-nested-positioned-elements-crash.html
    
    * rendering/RenderObject.h:
    (WebCore::RenderObject::markContainingBlocksForLayout):
    
    LayoutTests:
    
    Add test case to ensure we don't regress relayout of nested positioned elements.
    
    * fast/block/positioning/relayout-nested-positioned-elements-expected-crash.txt: Added.
    * fast/block/positioning/relayout-nested-positioned-elements-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91689 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit a7ba52c323132461dab4af616271bab75c2ffd57
Author: David Hyatt <hyatt@apple.com>
Date:   Tue Jul 26 20:39:25 2011 +0000

    https://bugs.webkit.org/show_bug.cgi?id=60778
    
    Use after free because of line box culling optimization regression.
    
    In the case of a child with no line box being removed (typically
    a <br> in quirks mode), if there is no previous sibling with a line
    box, then we have a potential problem with the culling optimization.
    
    The culled inline may still have other leaf line box children, but
    they may follow the removed <br>. In this case we can't rely on
    them, since we need a line box that comes before the <br>.
    
    The fix is to simply recur up to the parent if we are a culled inline
    and could not find a previous line box.
    
    Reviewed by Dan Bernstein.
    
    Added editing/execCommand/crash-line-break-after-outdent.html
    
    Source/WebCore:
    
    * rendering/RenderLineBoxList.cpp:
    (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
    
    LayoutTests:
    
    * editing/execCommand/crash-line-break-after-outdent-expected.txt: Added.
    * editing/execCommand/crash-line-break-after-outdent.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91781 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit 5b3a2e737ab323b012d9dbca05effdce044e360b
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Tue Jul 26 17:58:28 2011 -0300

    Disable test that is timing out in our 2.2 bots
    
    plugins/mouse-click-plugin-clears-selection.html is timing out on 2.2
    bots (qt-4.7 and qt-4.8), but it passes on trunk and in our test
    environments. No time to investigate it more.

commit 4e1a62f66a363473c488c6bbd8410364db3f79a0
Author: Abhishek Arya <inferno@chromium.org>
Date:   Tue Jul 19 17:39:03 2011 +0000

    Source/WebCore: Crash when removing unrenderered nodes in replacement fragment.
    https://bugs.webkit.org/show_bug.cgi?id=64801
    
    Reviewed by Ryosuke Niwa.
    
    Test: editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html
    
    * editing/ReplaceSelectionCommand.cpp:
    (WebCore::ReplacementFragment::removeUnrenderedNodes):
    
    LayoutTests: Tests that we do not crash when removing unrendering nodes
    in a replacement fragment.
    https://bugs.webkit.org/show_bug.cgi?id=64801
    
    Reviewed by Ryosuke Niwa.
    
    * editing/pasteboard/replacement-fragment-remove-unrendered-node-crash-expected.txt: Added.
    * editing/pasteboard/replacement-fragment-remove-unrendered-node-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91270 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit ff5346793f7e94379696467cc610f7317b504547
Author: Ademar de Souza Reis Jr <ademar.reis@openbossa.org>
Date:   Fri Jul 22 12:23:47 2011 -0300

    Fix build breakage introduced by a previous cherry-pick
    
    isDeprecatedFlexibleBox() is a new name on trunk for isFlexibleBox(). It
    was renamed (refactoring only) in r90773 (bad4cd2).
    
    cherry-pick that broke the build is:
    
        Stale pointer due to floats not removed (flexible box display)
        https://bugs.webkit.org/show_bug.cgi?id=64603

commit 5f10dde2b4a72177adfd3d81eb5d8ea39a04a465
Author: gavinp <gavinp@chromium.org>
Date:   Thu Jul 21 23:53:30 2011 +0000

    Extend the protector of a CSS style sheet.  Because checkLoaded() can recursively delete
    parent style elements, the protector should be extended to include the parent call.
    
    https://bugs.webkit.org/show_bug.cgi?id=64736
    
    Reviewed by Simon Fraser.
    
    Source/WebCore:
    
    Test: fast/css/css-imports-2.html
    
    * css/CSSStyleSheet.cpp:
    (WebCore::CSSStyleSheet::checkLoaded):
    
    LayoutTests:
    
    * fast/css/css-imports-2-expected.txt: Added.
    * fast/css/css-imports-2.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91531 268f45cc-cd09-0410-ab3c-d52691b4dbfc

commit bce3b14f54c084e3e331ec2fbe0fdb30097cd368
Author: Tony Chang <tony@chromium.org>
Date:   Wed Jul 20 19:01:55 2011 +0000

    Stale pointer due to floats not removed (flexible box display)
    https://bugs.webkit.org/show_bug.cgi?id=64603
    
    Reviewed by David Hyatt.
    
    Source/WebCore:
    
    Flexbox items should avoid floats.
    
    Test: fast/flexbox/horizontal-box-float-crash.html
    
    * rendering/RenderBox.cpp:
    (WebCore::RenderBox::avoidsFloats):
    * rendering/RenderBox.h:
    (WebCore::RenderBox::isDeprecatedFlexItem):
    
    LayoutTests:
    
    * fast/flexbox/horizontal-box-float-crash-expected.txt: Added.
    * fast/flexbox/horizontal-box-float-crash.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91386 268f45cc-cd09-0410-ab3c-d52691b4dbfc