2013-01-13  Dirk Schulze  <dschulze@adobe.com> 

       [CSS Filters] brightness() function doesn't work as specified 
       https://bugs.webkit.org/show_bug.cgi?id=106674 

       Reviewed by Dean Jackson. 

       The brightness filter implementation modified the intercept instead of the slope on 
       the feComponentTransfer function. The passed amount acts as multiplier for each 
       color chanel now. 

       Existing tests cover the changes and were updated. 

       * css/CSSParser.cpp: 
       (WebCore::CSSParser::parseBuiltinFilterArguments): 
       * platform/graphics/ca/mac/PlatformCALayerMac.mm: 
       (PlatformCALayer::setFilters): 
       * rendering/FilterEffectRenderer.cpp: 
       (WebCore::FilterEffectRenderer::build): 

2013-02-14  Christophe Dumez  <ch.dumez@sisa.samsung.com>

       Add addHTTPHeaderField() method to ResourceResponse
       https://bugs.webkit.org/show_bug.cgi?id=109844

       Reviewed by Adam Barth.

       ResourceRequestBase provides both setHTTPHeaderField() and addHTTPHeaderField(). However,
       ResourceResponseBase only provides setHTTPHeaderField(). This is a bit inconsistent. As a
       result, the addHTTPHeaderField() functionality's implementation is duplicated in several
       ports (at least chromium and soup).

       This patch introduces addHTTPHeaderField() to ResourceResponseBase and makes use of it
       in Chromium and Soup backends.

       No new tests, no behavior change.

       * platform/chromium/support/WebURLResponse.cpp:
       (WebKit::WebURLResponse::addHTTPHeaderField): Use ResourceResponseBase::addHTTPHeaderField().
       * platform/network/ResourceResponseBase.cpp:
       (WebCore::ResourceResponseBase::updateHeaderParsedState): Move headers' parsed state update code
       from setHTTPHeaderField() to a new updateHeaderParsedState() method to avoid code duplication.
       (WebCore):
       (WebCore::ResourceResponseBase::setHTTPHeaderField):
       (WebCore::ResourceResponseBase::addHTTPHeaderField):
       * platform/network/ResourceResponseBase.h:
       (ResourceResponseBase):
       * platform/network/soup/ResourceResponseSoup.cpp:
       (WebCore::ResourceResponse::updateFromSoupMessageHeaders): Use ResourceResponseBase::addHTTPHeaderField().


2015-02-06  Maciej Stachowiak  <mjs@apple.com>

        REGRESSION(r179706): Caused memory corruption on some tests (Requested by _ap_ on #webkit).
        https://bugs.webkit.org/show_bug.cgi?id=141324

        Reviewed by Alexey Proskuryakov.

        No new tests. This is caught by existing tests under ASAN, and I don't know how to reproduce
        it without ASAN.

        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Give up
        and just always invalidate the next line. It's too hard to come up
        with the condition that catches all needed cases, doesn't itself
        cause a crash, and isn't overzealous. And we do this for the
        previous line anyway.  Also clean up the code a bit since it
        confusingly reuses a variable, and declares it uninitialized, for
        no good reason.

2012-11-01  Florin Malita  <fmalita@chromium.org>

        Crash when mixing layers, foreignObjects and SVG hidden containers
        https://bugs.webkit.org/show_bug.cgi?id=87297

        Reviewed by NOBODY (OOPS!).

        Foreign objects may introduce content which requires layers, but layer creation is
        suppressed within RenderSVGHiddenContainer subtrees and this yields an inconsistent render
        tree state. This patch prevents foreignObject renderer instantiation under
        RenderSVGHiddenContainers.

        Test: svg/foreignObject/foreign-object-defs-crash.svg

        * svg/SVGForeignObjectElement.cpp:
        (WebCore::SVGForeignObjectElement::rendererIsNeeded):
        (WebCore):
        * svg/SVGForeignObjectElement.h:
        (SVGForeignObjectElement):

2012-11-01  Florin Malita  <fmalita@chromium.org>

        Crash when mixing layers, foreignObjects and SVG hidden containers
        https://bugs.webkit.org/show_bug.cgi?id=87297

        Reviewed by NOBODY (OOPS!).

        Foreign objects may introduce content which requires layers, but layer creation is
        suppressed within RenderSVGHiddenContainer subtrees and this yields an inconsistent render
        tree state. This patch prevents foreignObject renderer instantiation under
        RenderSVGHiddenContainers.

        Test: svg/foreignObject/foreign-object-defs-crash.svg

        * svg/SVGForeignObjectElement.cpp:
        (WebCore::SVGForeignObjectElement::rendererIsNeeded):
        (WebCore):
        * svg/SVGForeignObjectElement.h:
        (SVGForeignObjectElement):

2015-02-05  Maciej Stachowiak  <mjs@apple.com>

        Crash due to failing to dirty a removed text node's line box
        https://bugs.webkit.org/show_bug.cgi?id=136544

        Reviewed by David Hyatt.

        Test: fast/text/remove-text-node-linebox-not-dirty-crash.html

        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild): Make the check for dirtying the next
        line box a bit more inclusive to avoid a case of a line box for a destroyed render object not
        being dirtied. In particular, when the text node's parent has no line boxes but contains BRs.

2014-02-28  Bem Jones-Bey  <bjonesbe@adobe.com>

        Properly clear m_logicallyLastRun to remove use-after-free possibility
        https://bugs.webkit.org/show_bug.cgi?id=129489

        Reviewed by David Hyatt.

        A use-after-free issue was caught in Blink because m_logicallyLastRun
        is not cleared when the item it points to is deleted. Clearing it
        turns the use-after-free into a segfault, and prevents any future
        use-after-frees from happening.

        * platform/text/BidiRunList.h:
        (WebCore::BidiRunList<Run>::deleteRuns):

2014-11-11  David Kilzer  <ddkilzer@apple.com>

        Protect Document in ProcessingInstruction::setXSLStyleSheet()
        <http://webkit.org/b/138621>

        Reviewed by Andreas Kling.

        The patch is inspired by the following Blink revision by
        <tasak@google.com>:
        <https://src.chromium.org/viewvc/blink?view=rev&revision=182309>

        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::setXSLStyleSheet):

2014-11-18  David Hyatt  <hyatt@apple.com>

        REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
        https://bugs.webkit.org/show_bug.cgi?id=137590

        Reviewed by Dean Jackson.

        Added fast/block/selection-block-gaps-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::blockSelectionGaps):
        Check that we really are a RenderBlock before recurring.

2014-11-10  Csaba Osztrogonac  <ossy@webkit.org>

        Crash in WebCore::Node::getFlag
        https://bugs.webkit.org/show_bug.cgi?id=137961

        Reviewed by Antti Koivisto.

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyBlockStyle): Null pointer check added.


2014-08-12  Max Stepin  <maxstepin@gmail.com>

        Add APNG support.
        https://bugs.webkit.org/show_bug.cgi?id=17022

        Reviewed by NOBODY (OOPS!).

        Test: fast/images/animated-png.html

        * platform/image-decoders/ImageDecoder.h:
        (WebCore::ImageFrame::divide255):
        (WebCore::ImageFrame::overRGBA):
        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::frameHeader):
        (WebCore::readChunks):
        (WebCore::PNGImageReader::PNGImageReader):
        (WebCore::PNGImageDecoder::PNGImageDecoder):
        (WebCore::PNGImageDecoder::frameBufferAtIndex):
        (WebCore::PNGImageDecoder::headerAvailable):
        (WebCore::PNGImageDecoder::rowAvailable):
        (WebCore::PNGImageDecoder::pngComplete):
        (WebCore::PNGImageDecoder::readChunks):
        (WebCore::PNGImageDecoder::frameHeader):
        (WebCore::PNGImageDecoder::init):
        (WebCore::PNGImageDecoder::clearFrameBufferCache):
        (WebCore::PNGImageDecoder::initFrameBuffer):
        (WebCore::PNGImageDecoder::frameComplete):
        (WebCore::PNGImageDecoder::processingStart):
        (WebCore::PNGImageDecoder::processingFinish):
        (WebCore::PNGImageDecoder::fallbackNotAnimated):
        * platform/image-decoders/png/PNGImageDecoder.h:
        (WebCore::PNGImageDecoder::frameCount):
        (WebCore::PNGImageDecoder::repetitionCount):
        (WebCore::PNGImageDecoder::isComplete):

2014-10-22  Said Abou-Hallawa  <sabouhallawa@apple.com>

        SVG loaded through html <img> can't request to load any external resources.
        https://bugs.webkit.org/show_bug.cgi?id=137762.

        Reviewed by Daniel Bates.

        SVG images have unique security rules that prevent them from loading any external
        resources. This patch enforces these rules in CachedResourceLoader::canRequest for
        all non-data-uri resources.

        The fix and the tests are ported but modified a little from the chromium fix:
        http://src.chromium.org/viewvc/blink?view=rev&rev=176084

        Test: http/tests/security/svg-image-with-cached-remote-image.html
              http/tests/security/svg-image-with-css-cross-domain.html

        For the SVG image, prevent loading any external sub-resource except for data urls.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::canRequest):

2014-08-28  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] Incorrect selection clearing on a document without regions
        https://bugs.webkit.org/show_bug.cgi?id=134901

        Reviewed by David Hyatt.

        When we select all the content of document with named flows but without regions,
        the start and end points of selection is cached in RenderView. However, since
        the document has named flows, the selection is split between the subtrees. During the split,
        it is possible that the cached end-points of the original selection are not included
        in any of the resulting subtree selection and they are not marked accordingly.
        In order to process the selection clearing correctly, we have to take the original
        selection end-points into account.

        Test: fast/regions/selection/select-all-without-regions.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::isSelectionBorder):

2014-08-27  Daniel Bates  <dabates@apple.com>

        Scrollbar corner can be drawn outside containing frame
        https://bugs.webkit.org/show_bug.cgi?id=133131
        <rdar://problem/16382769>

        Reviewed by Simon Fraser.

        Merged from Blink (patch by Levi Weintraub):
        <https://src.chromium.org/viewvc/blink?revision=170625&view=revision>

        Fixes an issue where the scroll corner may be painted outside the rectangle of
        its associated frame by setting a clip rectangle before painting the scroll bar(s)
        and scroll corner.

        Test: scrollbars/custom-scrollbars-paint-outside-iframe.html

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::paint):

2014-10-17  Jeffrey Pfau  <jpfau@apple.com>

        Ensure attached frame count doesn't exceed the maximum allowed frames
        https://bugs.webkit.org/show_bug.cgi?id=136457

        Reviewed by Alexey Proskuryakov.

        Test: fast/frames/exponential-frames.html

        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::isURLAllowed):

2014-10-14  Youenn Fablet  <youennf@gmail.com>

        [XHR] Abort method execution when m_loader->cancel() in internalAbort() caused reentry
        https://bugs.webkit.org/show_bug.cgi?id=126975

        Reviewed by Alexey Proskuryakov.

        Merging https://chromium.googlesource.com/chromium/blink/+/0d75daf2053631518606ae15daaece701a25b2c4
        Ensuring new test from https://codereview.chromium.org/76133002/ is passing.

        Test: http/tests/xmlhttprequest/reentrant-cancel-abort.html

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open): exit early if internalAbort asks so
        (WebCore::XMLHttpRequest::abort): exit early if internalAbort asks so
        (WebCore::XMLHttpRequest::internalAbort): ask calling function to exit early if a new loader is created during the cancellation of the loader (potential reentrant case through window.onload callback)   
        (WebCore::XMLHttpRequest::didTimeout): exit early if internalAbort asks so
        * xml/XMLHttpRequest.h:

2014-10-30  Babak Shafiei  <bshafiei@apple.com>

        Merge r175347.

    2014-10-29  Alexey Proskuryakov  <ap@apple.com>

            Notify Settings object when its Page object goes away.
            https://bugs.webkit.org/show_bug.cgi?id=138183
            rdar://problem/18786900

            Reviewed by Andreas Kling.

            I could not make a test for this issue.

            * page/Page.cpp:
            (WebCore::Page::~Page):
            * page/Settings.cpp:
            (WebCore::setImageLoadingSettings):
            (WebCore::Settings::Settings):
            (WebCore::Settings::setTextAutosizingEnabled):
            (WebCore::Settings::setTextAutosizingWindowSizeOverride):
            (WebCore::Settings::setTextAutosizingFontScaleFactor):
            (WebCore::Settings::setMediaTypeOverride):
            (WebCore::Settings::setScriptEnabled):
            (WebCore::Settings::setUserStyleSheetLocation):
            (WebCore::Settings::setMinDOMTimerInterval):
            (WebCore::Settings::minDOMTimerInterval):
            (WebCore::Settings::domTimerAlignmentInterval):
            (WebCore::Settings::setUsesPageCache):
            (WebCore::Settings::setScreenFontSubstitutionEnabled):
            (WebCore::Settings::setFontRenderingMode):
            (WebCore::Settings::setDNSPrefetchingEnabled):
            (WebCore::Settings::setStorageBlockingPolicy):
            (WebCore::Settings::setBackgroundShouldExtendBeyondPage):
            (WebCore::Settings::setScrollingPerformanceLoggingEnabled):
            (WebCore::Settings::setHiddenPageDOMTimerThrottlingEnabled):
            (WebCore::Settings::setHiddenPageCSSAnimationSuspensionEnabled):
            (WebCore::Settings::setFontFallbackPrefersPictographs):
            * page/Settings.h:
            (WebCore::Settings::pageDestroyed):

2014-09-22  Alexey Proskuryakov  <ap@apple.com>

        WebSocket crash when a connection is closed from server side
        https://bugs.webkit.org/show_bug.cgi?id=137009
        rdar://problem/18333977
        rdar://problem/12708225

        Reviewed by Brady Eidson.

        I don't think that this can be tested with our test server.

        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::WebSocketChannel): Added logging.
        (WebCore::WebSocketChannel::~WebSocketChannel): Ditto.
        (WebCore::WebSocketChannel::close): Protect self, because startClosingHandshake
        can release the last reference.
        (WebCore::WebSocketChannel::fail): Added an assertion that the channel is always
        closed after this function.
        (WebCore::WebSocketChannel::startClosingHandshake): Protect self, and don't change
        the stack from closed back to closing if after failing to send closing handshake.
        (WebCore::WebSocketChannel::processOutgoingFrameQueue): Protect self.

2013-02-28  Nate Chapin  <japhet@chromium.org>

        Crash in CachedRawResource::responseReceived().
        https://bugs.webkit.org/show_bug.cgi?id=110482

        Reviewed by Adam Barth.

        Test: http/tests/security/XFrameOptions/x-frame-options-deny-multiple-clients.html

        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::responseReceived):

2013-01-29  Simon Fraser  <simon.fraser@apple.com>

        Rubberband scrolling on news.google.com causes text to blink repeatedly
        https://bugs.webkit.org/show_bug.cgi?id=107326

        Reviewed by Beth Dakin.

        When in the middle of layout, RenderBlock::updateScrollInfoAfterLayout()
        could cause us to re-evaluate reasons for compositing, via the call
        to updateLayerCompositingState() in RenderLayer::updateScrollInfoAfterLayout().
        
        At this time, when layout is still happening, it's bad to look at render
        geometry to decide when to do compositing (e.g. for fixed position); we might
        incorrectly conclude that the layer is outside the viewport.
        
        Fix by having RenderLayerCompositing store in a member whether it's safe
        to look at layout information. requiresCompositingForPosition() then consults
        this bit, and, if it needs to make decisions based on layout but layout is not
        complete, it doesn't change the compositing state of the layer.
        
        Not testable, since dumping the layer tree will update layout and mask the bug.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
        (WebCore::RenderLayerCompositor::updateCompositingLayers):
        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
        * rendering/RenderLayerCompositor.h:
        (RenderLayerCompositor):

2013-05-04  Andreas Kling  <akling@apple.com>

        REGRESSION(r142647): Flaky Test: fast/frames/crash-remove-iframe-during-object-beforeload.html
        <http://webkit.org/b/115322>
        <rdar://problem/13810719>

        Reviewed by Anders Carlsson.

        Don't cache the FrameView::renderView() in a local since updating Widgets may blow it away.

        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2012-10-04  Sami Kyostila  <skyostil@chromium.org>

        Fixed position visibility check does not consider descendants
        https://bugs.webkit.org/show_bug.cgi?id=98144

        Reviewed by Simon Fraser.

        The check against creating composition layers for invisible fixed positioned
        elements is too aggressive in that it does not consider descendants of the
        fixed positioned element that may be visible even though the element itself is
        out of view.

        Fix the problem by calculating the true composited bounds of the fixed
        element instead of just using the size of the fixed layer. Because calculating
        the true bounds may be expensive, it is only done if the fixed layer itself is
        invisible.

        Test: compositing/layer-creation/fixed-position-absolute-descendant.html

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
        * rendering/RenderLayerCompositor.h:

2012-06-07  Simon Fraser  <simon.fraser@apple.com>

        Optimize FrameView::scrollXForFixedPosition() / scrollYForFixedPosition()
        https://bugs.webkit.org/show_bug.cgi?id=88475

        Reviewed by Sam Weinig.
        
        FrameView's scrollXForFixedPosition() and scrollYForFixedPosition()
        methods were often called together, but they do duplicate work,
        including calling into platform widget code which might be slow.
        
        Fix by converting scrollOffsetForFixedPosition() from being a wrapper
        that just calls scrollXForFixedPosition() and scrollYForFixedPosition()
        to the method that does all the work, calling just once into platform
        widget code.
        
        Changed callers to use scrollOffsetForFixedPosition() rather than make
        two separate method calls.
        
        Added ScrollView::layoutSize() and visibleSize() methods for
        convenience.
        
        Removed FrameView::scrollXForFixedPosition and FrameView::scrollYForFixedPosition
        to avoid inefficient callers in future.

        No new tests; refactoring only.

        * page/FrameView.cpp:
        (WebCore::fixedPositionScrollOffset):
        (WebCore::FrameView::scrollOffsetForFixedPosition):
        * page/FrameView.h: Removed scrollXForFixedPosition and scrollYForFixedPosition.
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::layoutSize):
        * platform/ScrollView.h:
        (WebCore::ScrollView::visibleSize):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::backgroundClipRect):
        * rendering/RenderLayer.h:
        (WebCore::ClipRect::move):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::computeRectForRepaint):

2014-05-15  Daniel Bates  <dabates@apple.com>

        SVG element may reference arbitrary DOM element before running its insertion logic
        https://bugs.webkit.org/show_bug.cgi?id=132757
        <rdar://problem/15703817>

        Reviewed by Ryosuke Niwa.

        Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
        inserted in the tree.

        Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
        element B it references (if any). If A is inserted before B and B has the same id as a later element in
        the document then A can find B before B is notified that its been inserted into the document (i.e. before
        Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
        cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
        processed their insertion-specific logic.

        Tests: svg/custom/reparent-animate-element.html
               svg/custom/reparent-feimage-element.html
               svg/custom/reparent-mpath-element.html
               svg/custom/reparent-textpath-element.html
               svg/custom/reparent-tref-element.html
               svg/custom/reparent-use-element.html

        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
        * svg/SVGFEImageElement.h:
        * svg/SVGMPathElement.cpp:
        (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
        * svg/SVGMPathElement.h:
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
        * svg/SVGTRefElement.h:
        * svg/SVGTextPathElement.cpp:
        (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
        * svg/SVGTextPathElement.h:
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
        inserted.
        (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
        * svg/SVGUseElement.h:
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
        * svg/animation/SVGSMILElement.h:

2014-05-03  Babak Shafiei  <bshafiei@apple.com>

        Follow-up fix for the merge of r167480.
        
        Rubber stamped by Tim Horton.

        * platform/KURL.cpp:
        (WebCore::KURL::host): Return empty string instead of null string.

2014-04-23  Jon Honeycutt  <jhoneycutt@apple.com>

        Crash applying editing commands from iframe onload event

        <https://bugs.webkit.org/show_bug.cgi?id=132103>
        <rdar://problem/15696351>

        This patch merges the Chromium bug workaround from
        <http://src.chromium.org/viewvc/blink?revision=162080&view=revision>,
        which prevents reentrancy in CompositeEditCommand::apply().

        Reviewed by Darin Adler.

        Test: editing/apply-style-iframe-crash.html

        * editing/CompositeEditCommand.cpp:
        (WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
        (WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
        (WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
        (WebCore::CompositeEditCommand::apply):
        If this is a recursive call, return early.

2014-04-22  Zalan Bujtas  <zalan@apple.com>

        Do not paint border image when the border rect is empty.
        https://bugs.webkit.org/show_bug.cgi?id=131988

        Reviewed by Darin Adler.

        http://trac.webkit.org/changeset/167351 introduced an early return when border
        rect is empty. This patch ensures that border image is not painted either in that case.

        Modified padding-margin-negative-border.html to cover border-image case.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintBorder):

2014-04-19  Alexey Proskuryakov  <ap@apple.com>

        Crashes in HTMLFormElement::submit.
        https://bugs.webkit.org/show_bug.cgi?id=131910
        <rdar://problem/15661790>

        Based on a patch by Kent Tamura.

        Reviewed by Anders Carlsson.

        Tests: fast/forms/form-submission-crash-2.html
               fast/forms/form-submission-crash.html

        Code that executes arbitrary JS needs to protect objects that it uses afterwards.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::prepareForSubmission):
        (WebCore::HTMLFormElement::submit):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::submitForm):

2014-04-16  Martin Hodovan  <mhodovan@inf.u-szeged.hu>

        ASSERTION FAILED: x2 >= x1 in WebCore::RenderObject::drawLineForBoxSide
        https://bugs.webkit.org/show_bug.cgi?id=127835

        In some cases when a negative margin and a positive padding are applied
        together to the right and/or left side of the box, the logical width of
        the borders can be set to a negative value, making the assertion fire.
        The fix checks if the width or height of the box is negative, and if so,
        it will not display the borders and shadows of the box.

        Reviewed by Darin Adler.

        Test: fast/css/padding-margin-negative-border.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintBorder):

2014-04-11  Jon Honeycutt  <jhoneycutt@apple.com>

        Assertion failure changing select element size during focus event
        dispatch
        <https://bugs.webkit.org/show_bug.cgi?id=131566>
        <rdar://problem/16400735>

        Reviewed by Andy Estes.

        Test: fast/forms/select-change-size-during-focus.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
        Adopt the fix from Chromium r171216; check that the renderer is still
        of the expected type, and return early if it is not.

2014-04-07  Jon Honeycutt  <jhoneycutt@apple.com>

        Assertion failure, !node || node->isElementNode(), in
        WebCore::RenderBlock::clone()
        <https://bugs.webkit.org/show_bug.cgi?id=110489>
        <rdar://problem/13666425>

        Reviewed by Antti Koivisto.

        We're ending up in RenderBlock::splitBlocks() with |this| ==
        |fromBlock|.  We then try to climb the ancestor block chain from
        this->parent() to |fromBlock|, but this->parent() is already above
        |fromBlock|, so we end up climbing up to the RenderView and trying to
        clone it, causing the assertion failure.

        Adopt Chromium's mitigation for this from
        <https://codereview.chromium.org/13852041>. This is not intended as a
        fix for the underlying issue.

        Also, fix another issue that occurs with this fuzzed test case that's
        not handled by the Chromium fix.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::splitBlocks):
        Ensure while we're in the loop that |curr| is a descendant of
        |fromBlock|. From the Chromium patch:

            We need to check in every iteration of the loop because
            moveChildrenTo could have moved |curr|. This is a mitigation and
            not really a fix against a class of tree craziness.

        Finally, before moving children from |fromBlock| to |toBlock|, ensure
        that the children are children of |fromBlock|. If we never entered the
        loop, they will be siblings of |fromBlock|, not children.

2014-04-02  David Kilzer  <ddkilzer@apple.com>

        Use outermost containing isolate when constructing bidi runs
        <http://webkit.org/b/131107>
        <rdar://problem/15690021>

        Reviewed by Darin Adler.

        Merged from Blink (patch by jww@chromium.org):
        https://src.chromium.org/viewvc/blink?revision=157268&view=revision
        http://crbug.com/279277

            Update containingIsolate to go back all the way to top
            isolate from current root, rather than stopping at the first
            isolate it finds. This works because the current root is
            always updated with each isolate run.

        Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
               fast/text/international/unicode-bidi-isolate-nested-with-removes.html

        * rendering/InlineIterator.h:
        (WebCore::highestContainingIsolateWithinRoot):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRunsForSegment):

2014-03-22  Martin Hodovan  <mhodovan@inf.u-szeged.hu>

        ASSERTION FAILED: std::isfinite(num) in WebCore::CSSPrimitiveValue::CSSPrimitiveValue
        https://bugs.webkit.org/show_bug.cgi?id=127361

        Huge numbers represented by the 'INF' value can not be used
        in CSS rules, so they make the assert fail. We have to make
        sure that the parsed property value is finite, otherwise
        the property will be dropped.

        Test: fast/css/infinite-floating-value.html

        * css/CSSValuePool.cpp:
        (WebCore::CSSValuePool::createValue):

2014-03-21  Oliver Hunt  <oliver@apple.com>

        Fix a crash when assigning an object to document.location
        https://bugs.webkit.org/show_bug.cgi?id=130213

        Reviewed by Geoffrey Garen.

        Convert location to string before we make use the document.
        This prevents us from attempting to navigate a frame that
        has already been removed.

        Test: fast/dom/navigation-with-sideeffects-crash.html

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::location):
        (WebCore::JSDocument::setLocation):

2014-03-10  Zsolt Borbely  <borbezs@inf.u-szeged.hu>

        ASSERTION FAILED: span >= 1
        https://bugs.webkit.org/show_bug.cgi?id=129148

        Reviewed by Andreas Kling.

        Set the value of span to 1 if the given number is too big or zero.

        Test: fast/table/incorrect-colgroup-span-values.html

        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):

2014-02-28  Martin Hodovan  <mhodovan@inf.u-szeged.hu>

        ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer
        https://bugs.webkit.org/show_bug.cgi?id=119626

        SVGRenderSupport::mapLocalToContainer() was trying to apply transforms
        in the incorrect order. Specifically, it would attempt to apply its
        localToParentTransform before its localToBorderBoxTransform. This
        was causing an ASSERT to fail when the computed transforms didn't
        match up to those computed by RenderGeometryMap.

        Backported from Blink: https://codereview.chromium.org/143363004

        Reviewed by Simon Fraser.

        Test: svg/transforms/svg-geometry-crash.html

        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::mapLocalToContainer):

2014-02-15  Renata Hodovan  <rhodovan.u-szeged@partner.samsung.com>

        ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
        https://bugs.webkit.org/show_bug.cgi?id=128810

        Reviewed by Ryosuke Niwa.

        Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
        doesn't contain |start|.

        Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
        ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
        patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
        |outerNode| only if |outerNode| contains |start| position.

        Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&view=revision by yosin@chromium.org.

        Test: editing/execCommand/indent-with-uneditable-crash.html

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):

2014-02-14  Renata Hodovan  <rhodovan.u-szeged@partner.samsung.com>

        ASSERTION FAILED: comparePositions(newEnd, newStart) >= 0 in WebCore::ApplyStyleCommand::updateStartEnd
        https://bugs.webkit.org/show_bug.cgi?id=121791

        Reviewed by Darin Adler.

        If WebCore::ApplyStyleCommand::applyBlockStyle() creates a TextIterator for a range
        that has an element with ReplacedElement rendering object, then a ',' is emitted in the
        constructor of TextIterator. Due to this comma the end of the run range can be at the
        wrong position, what makes the assertion fire. This situation can be handled the same
        way in TextIterator::rangeFromLocationAndLength() as we do in case of the emitted '\n's.

        Test: editing/execCommand/remove-formatting-from-iframe-in-button.html

        * editing/TextIterator.cpp:
        (WebCore::TextIterator::rangeFromLocationAndLength):

2014-02-11  Youenn Fablet  <youennf@gmail.com>

        XMLHttpRequest should not send DNT header
        https://bugs.webkit.org/show_bug.cgi?id=128533

        Reviewed by Alexey Proskuryakov.

        Added DNT (Do Not Track) header to the list of forbidden headers.
        Updated http/tests/xmlhttprequest/set-dangerous-headers.html to test that header.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData):

2014-02-04  Jeffrey Pfau  <jpfau@apple.com>

        Make adoption agency use the task queue
        https://bugs.webkit.org/show_bug.cgi?id=109445

        Reviewed by Ryosuke Niwa.

        Tests: fast/parser/adoption-agency-crash-01.html
               fast/parser/adoption-agency-crash-02.html
               fast/parser/adoption-agency-crash-03.html

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::insert):
        (WebCore::executeInsertTask):
        (WebCore::executeReparentTask):
        (WebCore::executeInsertAlreadyParsedChildTask):
        (WebCore::executeTakeAllChildrenTask):
        (WebCore::executeTask):
        (WebCore::HTMLConstructionSite::attachLater):
        (WebCore::HTMLConstructionSite::executeQueuedTasks):
        (WebCore::HTMLConstructionSite::insertTextNode):
        (WebCore::HTMLConstructionSite::reparent):
        (WebCore::HTMLConstructionSite::insertAlreadyParsedChild):
        (WebCore::HTMLConstructionSite::takeAllChildren):
        (WebCore::HTMLConstructionSite::fosterParent):
        * html/parser/HTMLConstructionSite.h:
        (WebCore::HTMLConstructionSiteTask::HTMLConstructionSiteTask):
        (WebCore::HTMLConstructionSiteTask::oldParent):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

2014-01-28  Myles C. Maxfield  <mmaxfield@apple.com>

        Fixing several incorrect assumptions with handling isolated inlines.
        https://bugs.webkit.org/show_bug.cgi?id=127608

        Reviewed by Dave Hyatt.

        First, when an isolated inline spans multiple lines, we aren't guaranteed
        to exit BidiResolver with a nested inline count of zero. Removing the
        assert that says otherwise.
        
        Previously in constructBidiRunsForSegment, we called bidiFirst in
        an attempt to properly setup the isolatedResolver for any dom/style
        that applied, but this only worked on the first line the isolated
        inline appeared in. Adding a function that approaches this properly
        by recursing through the parents of the starting object for the line
        and post-fixing direction attributes to the resolver.
        
        Finally, addressing an issue where the line following a removed isolated
        inline (with a continuation) failed to be marked dirty.

        Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/72698f203b1c50900e535b80945563b92b7eef23

        Tests: fast/text/nested-bidi-assert.html
               fast/text/nested-bidi-with-continuation-crash.html

        * platform/text/BidiResolver.h:
        (WebCore::Run>::~BidiResolver):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::setupResolverToResumeInIsolate):
        (WebCore::constructBidiRunsForSegment):
        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

2014-01-21  László Langó  <llango.u-szeged@partner.samsung.com>

        Assertion failure in Range::nodeWillBeRemoved
        https://bugs.webkit.org/show_bug.cgi?id=121694

        Reviewed by Ryosuke Niwa.

        Based on Blink a change: https://chromium.googlesource.com/chromium/blink/+/407c1d7b2c45974aa614b3f847ffe9e8fce205fa

        This patch fix an assertion failure. Range::nodeWillBeRemoved() might
        be called with removed node in ContainerNode, when DOMNodeRemovedFromDocument
        event handler calls removeChild(), for node being removed.

        Test: fast/dom/Range/remove-twice-crash.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::willRemoveChild):
        * dom/ContainerNode.h:

2014-01-21  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>

        ASSERT(time.isFinite()) in SVGSMILElement::createInstanceTimesFromSyncbase
        <https://webkit.org/b/108184>

        Reviewed by Philip Rogers.

        In the case a SMILElement timing had a syncbase dependency on an indefinite value
        the assert were raised. The assert has been removed and a check has been added
        instead that prevents the addition of indefinite times to the time list.

        Test: svg/animations/smil-syncbase-self-dependency.svg

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::createInstanceTimesFromSyncbase):
          ASSERT removed.

2013-11-21  Ryosuke Niwa  <rniwa@webkit.org>

        Fix Range.insertNode when the inserted node is in the same container as the Range
        https://bugs.webkit.org/show_bug.cgi?id=123957

        Reviewed by Antti Koivisto.

        Inspired by https://chromium.googlesource.com/chromium/blink/+/fb6ca1f488703e8d4f20ce6449cc8ea210be6edb

        When a node from the same container is inserted, we can't simply adjust m_end with the offset.
        Compute m_start and m_end from the inserted nodes instead.

        Also, don't adjust m_start and m_end to nodes outside of the document if the inserted nodes had been
        removed by mutation events.

        Test: fast/dom/Range/range-insertNode-same-container.html

        * dom/Range.cpp:
        (WebCore::Range::insertNode):

2013-11-06  Ryosuke Niwa  <rniwa@webkit.org>

        Fix out-of-date offset in selection range code in range.surroundContents
        https://bugs.webkit.org/show_bug.cgi?id=123871

        Reviewed by Andreas Kling.
        
        Merge https://chromium.googlesource.com/chromium/blink/+/c89b413ff0fc4aafa0c71d180b0b1e131bb37707

        The code in Range::insertNode assumeed that the start offset of the selection range within its container
        doesn't change across a call to insertBefore on the container but this is wrong. This patch recomputes
        the start offset when it is used after the insertBefore call.

        Test: editing/selection/range-surroundContents-with-preceding-node.html

        * dom/Range.cpp:
        (WebCore::Range::insertNode):

2013-11-06  Ryosuke Niwa  <rniwa@webkit.org>

        Assertion failure end < m_runCount in WebCore::BidiRunList<WebCore::BidiRun>::reverseRuns
        https://bugs.webkit.org/show_bug.cgi?id=123863

        Reviewed by Andreas Kling.

        Merge https://chromium.googlesource.com/chromium/blink/+/cbaa92c763a37d89eeabd01658e522219299290c

        Test: fast/text/bidi-reverse-runs-crash.html

        * platform/text/BidiResolver.h:
        (WebCore::BidiResolver<Iterator, Run>::createBidiRunsForLine): Don't reverse the runs if there's
        nothing to be reversed.

2013-11-05  Renata Hodovan  <reni@webkit.org>

        ASSERTION FAILED: isHTMLTitleElement(m_titleElement.get()) in WebCore::Document::setTitle
        https://bugs.webkit.org/show_bug.cgi?id=122092

        Reviewed by Darin Adler.

        Remove a bogus assert in Document::setTitle().
        m_titleElement can be either of HTMLTitleElement or SVGTitleElement. The assertion was wrong.
        
        Backported from Blink:
        https://src.chromium.org/viewvc/blink?revision=158620&view=revision

        Test: svg/custom/title-assertion.html

        * dom/Document.cpp:
        (WebCore::Document::setTitle):
        * svg/SVGTitleElement.cpp:
        (WebCore::SVGTitleElement::insertedInto):

2013-10-21  Santosh Mahto  <santosh.ma@samsung.com>

        ASSERTION FAILED: !style->propertyIsImportant(propertyID) in WebCore::setTextDecorationProperty
        https://bugs.webkit.org/show_bug.cgi?id=122097

        Reviewed by Ryosuke Niwa.

        Added Test cases to verify that crash does not happen in scenario when
        remove format command is executed on selection containing the iframe
        element and when textdecoration style is defined as !important and
        need to pushDown to iframe.

        * editing/execCommand/remove-format-textdecoration-in-iframe-expected.txt: Added.
        * editing/execCommand/remove-format-textdecoration-in-iframe.html: Added.

2013-09-11  Myles C. Maxfield  <mmaxfield@apple.com>

        Fix nested unicode-bidi: isolate
        https://bugs.webkit.org/show_bug.cgi?id=120504

        Reviewed by Darin Adler.

        When we have a nested isolate renderer if the outer isolate has a text
        and this text is not the first child, the isolated chain is not
        rendered correctly. This happens because constructBidiRunsForSegment
        uses always the first inner isolated renderer as isolated inline
        container. This patch fixes the behavior described changing
        containingIsolate to find the right isolated container.

        Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/840a57050eade39dd04dde0c6603e129b783151c

        Tests: fast/text/international/unicode-bidi-isolate-nested-first-child-text.html
               fast/text/international/unicode-bidi-isolate-nested-simple.html

        * rendering/InlineIterator.h:
        (WebCore::containingIsolate):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRunsForSegment):

2013-08-22  Renata Hodovan  <reni@webkit.org>

        ASSERTION FAILED: extractedStyle in WebCore::ApplyStyleCommand::removeInlineStyleFromElement
        https://bugs.webkit.org/show_bug.cgi?id=119672

        Reviewed by Darin Adler.

        The last extractedStyle parameter of removeInlineStyleFromElement() is not mandatory and it's set
        to default 0. This way we have to check its existence before the usage.

        Test: editing/execCommand/extracted_style_assert.html

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):

2013-08-14  Rob Buis  <rwlbuis@webkit.org>

        Assertion failure in RenderObject::drawLineForBoxSide
        https://bugs.webkit.org/show_bug.cgi?id=108187

        Reviewed by David Hyatt.

        Don't draw the outline if the rectangle to draw is empty.

        Test: fast/css/outline-negative.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutlineForLine):

2013-08-14  Rob Buis  <rwlbuis@webkit.org>

        ASSERTION FAILED: resultAnimationElement->m_animatedType in WebCore::SVGAnimateElement::calculateAnimatedValue
        https://bugs.webkit.org/show_bug.cgi?id=119748

        Reviewed by Dirk Schulze.

        Avoid animation when attributeType="CSS" is used on an animateTransform.

        Tests: svg/animations/animateTransform-translate-attributetype-auto.html
               svg/animations/animateTransform-translate-invalid-attributetype.html

        * svg/SVGAnimateTransformElement.cpp:
        (WebCore::SVGAnimateTransformElement::hasValidAttributeType):

2013-08-12  Zan Dobersek  <zdobersek@igalia.com>

        ASSERTION FAILED: type() == Percent in WebCore::Length::percent
        https://bugs.webkit.org/show_bug.cgi?id=116715

        Reviewed by Darin Adler.

        Allow the Calculated type in the Length::percent method that returns the Length's
        float value. This reflects the changes in r110148 that adjusted the Length::isPercent
        method to return true for Length objects of either Percent or Calculated type.

        Test: fast/css/calculated-length-as-percent-crash.html

        * platform/Length.h:
        (WebCore::Length::percent): Assert that Length::isPercent is true when Length::percent
        is called, ensuring the Length's type is either Percent or Calculated.

2013-08-12  Ryosuke Niwa  <rniwa@webkit.org>

        Fix NULL de-refernce in HTMLAnchorElement::sendPings when settings doesn't exist
        https://bugs.webkit.org/show_bug.cgi?id=119716

        Reviewed by Darin Adler.

        Merge https://chromium.googlesource.com/chromium/blink/+/d5783da353ab783e9994b8fbecd91880be5192a1

        No new tests since the test in the Blink change doesn't reproduce crash on WebKit.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::sendPings):

2013-08-09  Rob Buis  <rwlbuis@webkit.org>

        ASSERTION FAILED: stroke->opacity != other->stroke->opacity in WebCore::SVGRenderStyle::diff
        https://bugs.webkit.org/show_bug.cgi?id=119623

        Reviewed by Dirk Schulze.

        Include all the stroke attributes in the style diff comparison, the visited links ones were missing.

        Test: svg/animations/animate-stroke-crasher.html

        * rendering/style/SVGRenderStyle.cpp:
        (WebCore::SVGRenderStyle::diff):

2013-08-09  Rob Buis  <rwlbuis@webkit.org>

        ASSERT_NOT_REACHED() touched in WebCore::SVGAnimatedStringAnimator::addAnimatedTypes
        https://bugs.webkit.org/show_bug.cgi?id=113224

        Reviewed by Darin Adler.

        Do not perform from-by animations for non-additive attributes.

        Test: svg/animations/non-additive-type-from-by-animation.html

        * svg/SVGAnimateElement.cpp:
        (WebCore::SVGAnimateElement::calculateFromAndByValues):
        (WebCore::SVGAnimateElement::animatedPropertyTypeSupportsAddition):
        (WebCore::SVGAnimateElement::isAdditive):
        * svg/SVGAnimateElement.h:

2013-08-09  Renata Hodovan  <reni@webkit.org>

        Missing NULL check in ApplyStyleCommand::applyInlineStyleToNodeRange()
        https://bugs.webkit.org/show_bug.cgi?id=119570

        Reviewed by Ryosuke Niwa.

        The m_mutableStyleSet of EditingStyle can be NULL in ApplyStyleCommand::applyInlineStyleToNodeRange but
        this scenario was not checked earlier.

        Test: editing/execCommand/null-style-crash.html

        * css/StylePropertySet.cpp:
        (WebCore::MutableStylePropertySet::mergeAndOverrideOnConflict):
        * css/StylePropertySet.h:
        * css/ViewportStyleResolver.cpp:
        (WebCore::ViewportStyleResolver::addViewportRule):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
        * editing/EditingStyle.cpp:
        (WebCore::styleFromMatchedRulesForElement):
        (WebCore::EditingStyle::mergeStyleFromRules):
        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):

2013-07-18  Santosh Mahto  <santosh.ma@samsung.com>

        ASSERTION FAILED: !listItems().size() || m_activeSelectionAnchorIndex >= 0 in WebCore::HTMLSelectElement::updateListBoxSelection
        https://bugs.webkit.org/show_bug.cgi?id=118591

        Reviewed by Kent Tamura.

        Test: fast/forms/select/selectall-command-crash.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::selectAll):
        We should return this function if activeSelectionAnchorIndex is not valid index

2013-07-16  Eric Carlson  <eric.carlson@apple.com>

        HTMLMediaElement should not add cues for disabled text tracks
        https://bugs.webkit.org/show_bug.cgi?id=118682

        Reviewed by Ryosuke Niwa.

        Merge https://src.chromium.org/viewvc/blink?view=rev&revision=153810

        Tests: media/track/track-disabled-addcue.html
               media/track/track-disabled.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::textTrackAddCues): Do nothing if the track is disabled.
        (WebCore::HTMLMediaElement::textTrackAddCue): Ditto.

2013-07-15  Yuta Kitamura  <yutak@chromium.org>

        Fix a crash in Range::processContents().

        NULL ptr in WebCore::Range::processAncestorsAndTheirSiblings
        https://bugs.webkit.org/show_bug.cgi?id=77614

        Reviewed by Ryosuke Niwa.

        This change is ported from Blink revision 153483:
        https://src.chromium.org/viewvc/blink?revision=153483&view=revision

        This crash can be initiated by calling Range.detach() while deleteContents()
        is processing the same range. Range::processContents() should save the state
        of the range since mutation events can change the state of the range.

        Test: fast/dom/Range/detach-range-during-deletecontents.html

        * dom/Range.cpp:
        (WebCore::Range::processContents):
        * dom/RangeBoundaryPoint.h:
        (WebCore::RangeBoundaryPoint::RangeBoundaryPoint):

2013-06-21  James Craig  <james@cookiecrook.com>

        AX: audio/video playback control timers (elapsed and remaining) should be exposed as ApplicationTimerRole
        https://bugs.webkit.org/show_bug.cgi?id=117883

        Reviewed by Chris Fleizach.

        Some of the media controls were returning the wrong role. Updated existing test coverage.

        * accessibility/AccessibilityMediaControls.h:
        (WebCore::AccessibilityMediaTimeDisplay::roleValue):

2013-06-16  Kent Tamura  <tkent@chromium.org>

        Fix two assertion failures in Range::insertNode
        https://bugs.webkit.org/show_bug.cgi?id=116511

        Reviewed by Ryosuke Niwa.

        > ASSERTION FAILED: childBefore == (offset ? container->childNode(offset - 1) : 0)
        > third_party/WebKit/Source/WebCore/dom/RangeBoundaryPoint.h(115) : void WebCore::RangeBoundaryPoint::set(PassRefPtr<WebCore::Node>, int, WebCore::Node *)

        > ASSERTION FAILED: child->parentNode()
        > ../../third_party/WebKit/Source/core/dom/RangeBoundaryPoint.h(133) : void WebCore::RangeBoundaryPoint::setToBeforeChild(WebCore::Node *)
        >  1   0x87594b2 WebCore::RangeBoundaryPoint::setToBeforeChild(WebCore::Node*)
        >  2   0x87534a9 WebCore::Range::insertNode(WTF::PassRefPtr<WebCore::Node>, int&)

        Range::insertNode calls Node::insertBefore, in which an event handler
        can update the DOM structure so that RangeBoundaryPoint don't like. We
        postpone event dispatching by EventQueueScope.

        Also, remove old comments about Acid3. The behavior is standardized.
        (Step 9 of http://dom.spec.whatwg.org/#dom-range-insertnode)

        This patch imports http://src.chromium.org/viewvc/blink?view=revision&revision=150470 .

        Test: fast/dom/Range/range-insertNode-assertion.html

        * dom/Range.cpp:
        (WebCore::Range::insertNode):
         - Add EventQueueScope
         - Remove obsolete comments

2013-06-07  Zalan Bujtas  <zalan@apple.com>

        Frame flattening: crash when child iframe is removed during beforeload.
        https://bugs.webkit.org/show_bug.cgi?id=116220

        Reviewed by Antti Koivisto.

        FrameView can get destroyed in updateWidget(). Normally, it is protected by layout()
        but with frame flattening on, it can also be called asynchronously through the
        post layout timer.

        Test: fast/frames/flattening/crash-remove-iframe-during-object-beforeload.html

        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2013-05-20  Ryosuke Niwa  <rniwa@webkit.org>

        Null pointer deference in WebCore::AppendNodeCommand::create
        https://bugs.webkit.org/show_bug.cgi?id=116479

        Reviewed by Andreas Kling.
        
        Merge https://chromium.googlesource.com/chromium/blink/+/5cb43002a44f67a60ecf5a7ed76de2d0bcf89eb2

        DeleteSelection::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss() make style and link elements
        to be the direct children of the editable root. However, these style and link elements are not necessary editable
        and WebKit crashes when they are not.

        Test: editing/deleting/delete-uneditable-style.html

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):

2013-04-26  Zalan Bujtas  <zalan@apple.com>

        use-after-free removing a frame from its parent in a beforeload event of an OBJECT element
        https://bugs.webkit.org/show_bug.cgi?id=113964

        Object elements have the tendecny to modify or even fully remove 
        the containing Document inside beforeload callback. While Document is removed, 
        RenderArena gets destroyed. Retained RenderWidgets fails to function with NULL arena.
        
        Protect RendereArena from getting wiped out, when Document is removed 
        during FrameView::updateWidget(). 

        Reviewed by Antti Koivisto.

        Test: fast/frames/crash-remove-iframe-during-object-beforeload.html

        * dom/Document.cpp:
        (WebCore::Document::attach):
        * dom/Document.h:
        (Document):
        * page/FrameView.cpp:
        (WebCore::FrameView::updateWidgets):
        * rendering/RenderArena.h:
        (RenderArena):
        (WebCore::RenderArena::create):

2013-04-23  Andreas Kling  <akling@apple.com>

        Clear StyleResolver state before returning from styleForElement().
        <http://webkit.org/b/115035>

        Reviewed by Antti Koivisto.

        From Blink r148687 by <inferno@chromium.org>.

        A cached element pointer in the resolver state was causing confusion because
        in some cases a subsequent call to styleForElement() would use a pointer to
        a different object that is at the same memory address as the previous one.

        Test: fast/css/reload-non-styled-element-crash.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForElement):

2013-04-08  Douglas Stockwell  <dstockwell@chromium.org>

        Crash in WebCore::ElementRuleCollector::collectMatchingRulesForList
        https://bugs.webkit.org/show_bug.cgi?id=113458

        Reviewed by Darin Adler.

        A stylesheet which has been invalidated (type changed from "" or
        "text/css") was not correctly removed from the list of active
        style sheets when its children are changed.

        This change releases StyleElement::m_sheet in advance of calling
        DocumentStyleSheetCollection::updateActiveStyleSheets.

        (StyleElement::clearSheet calls CSSStyleSheet::clearOwnerNode calls
        CSSStyleSheet::didMutate calls Document::styleResolverChanged calls
        DocumentStyleSheetCollection::updateActiveStyleSheets)

        Test: fast/css/style-element-invalidation-crash.html

        * dom/StyleElement.cpp:
        (WebCore::StyleElement::clearSheet): Release m_sheet before we
          trigger an update of the active style sheets.

2013-04-02  David Vest  <davve@opera.com>

        Hang when calling setCurrentTime on SVG with cyclic animation dependency chain
        https://bugs.webkit.org/show_bug.cgi?id=113485

        Reviewed by Stephen Chenney.

        If no exact match can be found, approximateBinarySearch may return
        either adjacent value to the key. Selecting the lesser value when
        there is a greater one may cause interval creation to fail in a
        way that causes infinite loops during seeking. Detect and amend
        this condition by selecting the greater value when possible.

        Test: svg/animations/animation-dependency-hang.html

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::findInstanceTime):

2013-04-01  Chris Evans  <cevans@google.com>

        Crash in Node::enclosingBlockFlowElement()
        https://bugs.webkit.org/show_bug.cgi?id=113712

        Reviewed by Abhishek Arya.

        Fix a bad Node assumption if we walk up to the document root.

        Test: editing/execCommand/format-block-at-root.html

        * dom/Node.cpp:
        (WebCore::Node::isBlockFlowElement): Check we found an Element Node and rename from isBlockFlow().
        (WebCore::Node::enclosingBlockFlowElement): Use the new toElement().
        * editing/FormatBlockCommand.cpp:
        (WebCore::FormatBlockCommand::formatRange): Check for NULL.
        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::doApplyForSingleParagraph):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::enclosingInline): Impact from method rename.

2013-03-26  Arpita Bahuguna  <a.bah@samsung.com>

        Unable to insert a paragraph in between some text whose previous sibling is a non-editable block.
        https://bugs.webkit.org/show_bug.cgi?id=113007

        Reviewed by Ryosuke Niwa.

        Unable to insert a line break in between a text that follows a
        non-editable block but is itself contained within an editable
        block.

        While comparing the positions from the start block till the
        insertion position, we should ignore the nodes that do not
        generate a visiblePosition for the position before the node.
        This ultimately results in an assert within comparePositions().

        For this case, the firstChild of the start block is a text
        node with no renderer which would thus not generate a candidate
        position for itself.
        There is also no candidate previous to it, and since
        the position after it lies within a different editable element (root),
        no candidate after it as well.
        Such a point will thus return a null visiblePosition.

        Test: editing/inserting/insert-paragraph-between-text.html

        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):
        Added a check to verify the generated visiblePosition (for the
        position before the node) prior to carrying out a comparison with
        the insertion point.

2013-03-20  Kent Tamura  <tkent@chromium.org>

        Crash in Document::setFocusedNode if the frame of new focused node is detached in 'change' event handler
        https://bugs.webkit.org/show_bug.cgi?id=112653

        Reviewed by Dimitri Glazkov.

        Test: fast/frames/detach-frame-during-focus.html

        * page/FocusController.cpp:
        (WebCore::FocusController::setFocusedNode):
        A oldDocument->setFocusedNode call might dispatch a 'change' event for
        an old focused node, and an event handler code might detach the
        newFocusedFrame. So we should check it. Without the check, the following
        newDocument->setFocusedNode call would crash because of null
        Frame::page().

2013-03-19  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] Crash reflowing content in variable width regions
        https://bugs.webkit.org/show_bug.cgi?id=112515

        Reviewed by David Hyatt.

        When removing floats during relayout of a line in a paginated context,
        we have to make sure that the floats collection actually has elements before
        accessing the last float from the collection.
        This situation arises when a block had floats in a previous layout and after
        they were removed, m_floatingObjects is not destroyed, only emptied.

        Test: fast/regions/crash-reflow-inline-content-in-variable-width-regions.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeFloatingObjectsBelow):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutRunsAndFloats):
        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):

2013-03-18  Dominic Cooney  <dominicc@chromium.org>

        A placeholder renderer should not be taken to imply the existence of a text renderer in single line text controls
        https://bugs.webkit.org/show_bug.cgi?id=112410

        Reviewed by Tony Chang.

        The assumption that if a text control had a placeholder renderer
        then it also had a text renderer is not valid. If
        ::-webkit-textfield-decoration-controller is set to display: none;
        a single line text control's decoration container renderer and
        hence text renderer are not created. This change handles this
        corner case where a text control has a placeholder renderer but
        not a text renderer.

        Tests: fast/forms/search/search-hide-decoration-container-crash.html (Updated)

        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::fixPlaceholderRenderer):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::layout):

2013-03-08  Dominic Cooney  <dominicc@chromium.org>

        RenderTextControlSingleLine should not assume that its text element has a renderer
        https://bugs.webkit.org/show_bug.cgi?id=111826

        Reviewed by Ojan Vafai.

        Tests: fast/forms/search/search-autoscroll-hidden-decoration-container-crash.html
               fast/forms/search/search-hide-decoration-container-crash.html
               fast/forms/search/search-scroll-hidden-decoration-container-crash.html

        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::controlClipRect):
        (WebCore::RenderTextControlSingleLine::autoscroll):
        (WebCore::RenderTextControlSingleLine::scroll):

2013-02-27  Andrei Bucur  <abucur@adobe.com>

        REGRESSION(r124739): fast/lists/list-marker-remove-crash.html hits an assertion in MoveParagraphs
        https://bugs.webkit.org/show_bug.cgi?id=93247

        Reviewed by Darin Adler.

        The listifyParagraph function inside InsertListCommand triggered a layout for the new list and updated
        only the "start" Position. The insertion and layout may have changed the "end" Position as well. The patch
        makes sure "end" is also recomputed.

        Test: No new test, the patch fixes a regression.

        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::listifyParagraph):

2013-02-26  Adam Klein  <adamk@chromium.org>

        Parsing of HTML tags in MathML Text Insertion Points leads to bogus parser behavior
        https://bugs.webkit.org/show_bug.cgi?id=110808

        Reviewed by Adam Barth.

        When looking for various table tags in the HTMLElementStack, compare
        QualifiedNames rather than just local names, where necessary.

        Note that not all uses have been "fixed"; I've only changed for which
        I could write a test with differing behavior. A followup patch to
        rationalize the use of QualifiedName vs local names would be ideal.

        Tests: html5lib/generated/run-math-data.html
               html5lib/generated/run-math-write.html

        * html/parser/HTMLElementStack.cpp:
        (WebCore::inScopeCommon): Added a version of inScopeCommon that
        handles QualifiedNames instead of just localNames.
        (WebCore::HTMLElementStack::inTableScope): When given a QualifiedName,
        call the new version of inScopeCommon().
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTag):
        (WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
        (WebCore::HTMLTreeBuilder::processTrEndTagForInRow):

2013-02-19  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Assertion in RenderFlowThread::removeRenderBoxRegionInfo
        https://bugs.webkit.org/show_bug.cgi?id=109914

        Reviewed by David Hyatt.

        This patch moves a part of the invalidation operations inside the RenderFlowThread::invalidateRegions call. The maps
        are cleared anyway at layout time but doing this earlier makes sure the flow thread is in a more consistent state
        (the RenderFlowThread object has both the region chain invalidated and the regions information cleared).

        RenderFlowThread::removeRenderBoxRegionInfo will check if the region chain is invalidated. If true, it means the
        flow thread has a layout scheduled and the regions information is not yet reliable. In this case we just return from the
        function and wait for the layout to cleanup the box information.

        Test: fast/regions/remove-box-info-assert.html

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::removeRegionFromThread):
        (WebCore::RenderFlowThread::invalidateRegions):
        (WebCore):
        (WebCore::RenderFlowThread::layout):
        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo):
        * rendering/RenderFlowThread.h:
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::removeRegionFromThread):

2013-02-14  Emil A Eklund  <eae@chromium.org>

        Clamp span value in RenderTableCell::parse[Col|Row]SpanFromDOM
        https://bugs.webkit.org/show_bug.cgi?id=109878

        Reviewed by Abhishek Arya.

        Test: fast/table/colspan-huge-number.html
        
        Clamp colspan and rowspan values to their respective maximum
        supported values.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::parseColSpanFromDOM):
        (WebCore::RenderTableCell::parseRowSpanFromDOM):

2013-02-06  Ojan Vafai  <ojan@chromium.org>

        display:none file upload button crashes
        https://bugs.webkit.org/show_bug.cgi?id=109102

        Reviewed by Levi Weintraub.

        Test: fast/forms/file/display-none-upload-button.html

        * rendering/RenderFileUploadControl.cpp:
        (WebCore::nodeWidth):
        (WebCore::RenderFileUploadControl::paintObject):
        Having an upload button doesn't mean we have a rendered upload button.
        Null check the renderer before trying to access it.

2013-01-14  Tien-Ren Chen  <trchen@chromium.org>

        Positioned children of an overflow:visible container should ignore scroll offset when updating layer position
        https://bugs.webkit.org/show_bug.cgi?id=106814

        Reviewed by Simon Fraser.

        This patch fixes a bug in RenderLayer::updateLayerPosition that
        scrollLeft / scrollTop of a block should only be effective when the
        block has overflow clipping. The bug results in rendering artifacts
        and triggers a RenderGeometryMap assertion falure.

        Fixes http://crbug.com/167985

        Test: fast/overflow/overflow-visible-should-ignore-scroll.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateLayerPosition):

2013-01-14  Andrei Bucur  <abucur@adobe.com>

        Crash caused by incomplete cleanup of regions information for anonymous block
        https://bugs.webkit.org/show_bug.cgi?id=106191

        Reviewed by Abhishek Arya.

        When an anonymous block is no longer required it is removed from the render tree and deleted. For example, this can happen when an anonymous block children change
        from inlines to blocks. The patch updates the removeLeftoverAnonymousBlock function to delete the flow thread information attached to the obsolete anonymous block.
        The removeFromRenderFlowThread() function is recursive and it needs to be called after the anonymous block children were reparented and the child list cleared.
        I've also placed the children reset operation before clearing the parent because the latter also deletes the inRenderFlowThread flag from the object and it makes
        flow thread ownership detection impossible.

        Tests: fast/regions/remove-leftover-anon-block-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeLeftoverAnonymousBlock):

2013-01-10  Alexis Menard  <alexis@webkit.org>

        ASSERT_NOT_REACHED in StylePropertySet::fontValue when accessing font style property through JS after setting style font size.
        https://bugs.webkit.org/show_bug.cgi?id=88866

        Reviewed by Alexander Pavlov.

        StylePropertySet::fontValue always assumed that it was called using
        style.font after a subsequent call which set the shorthand font. The
        ASSERT_NOT_REACHED assumed that all longhands of the font shorthand not
        set by the shorthand itself were set to initial. While it's true when
        we set the font shorthand (i.e all longhands are set to implicit initial)
        it is not true when you set the longhands individually. For example setting
        font-size will not set other font properties to initial. It is the behavior of all
        other shorthands in WebKit. When reconstructing the shorthand other
        properties tests whether the value of each longhands is initial or not
        (if not then we omit the value, as we should always construct the
        shortest shorthand possible) or if the value is set or not (if set then
        we include it in the shorthand if not then we omit it). The comment
        removed was also talking about invalid font property potentially built
        by fontValue(). So far appendFontLonghandValueIfExplicit will always
        construct a valid value as it takes care of adding ' ' or '/' when
        needed, so the return value is parsable and correct.

        Test: fast/css/font-shorthand-from-longhands.html

        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::appendFontLonghandValueIfExplicit):
        (WebCore::StylePropertySet::fontValue):
        * css/StylePropertySet.h:

2013-01-09  Shinya Kawanaka  <shinyak@chromium.org>

        Assert triggered in SelectorChecker::checkOneSelector when scrollbar (e.g. :horizontal) selector is specified.
        https://bugs.webkit.org/show_bug.cgi?id=106414

        Reviewed by Dimitri Glazkov.

        In SelectorChecker::checkOneSelector, scrollbar related pseudoType (e.g. :horizontal) is not handled anywhere.
        This caused ASSERT triggered. We have to check them.

        Test: fast/css/scrollbar-crash.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector):

2013-01-08  Andreas Kling  <akling@apple.com>

        Heap-use-after-free in bool WebCore::SelectorChecker::checkOneSelector.
        <http://webkit.org/b/105834>

        Reviewed by Antti Koivisto.

        Suppress the DOMSubtreeModified event when synchronizing the "style" attribute and we've
        instantiated an Attr node wrapper for the said attribute.

        Also added an assertion that Document's StyleResolver isn't cleared during style recalc,
        which will help us catch this kind of bug in the future.

        Test: fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html

        * dom/Document.cpp:
        (WebCore::Document::styleResolverThrowawayTimerFired):
        * dom/Element.cpp:
        (WebCore::Element::setAttributeInternal):

2012-12-13  Filip Pizlo  <fpizlo@apple.com>

        Named lookups on HTML documents produce inconsistent results in JavaScriptCore bindings
        https://bugs.webkit.org/show_bug.cgi?id=104623

        Reviewed by Geoffrey Garen.

        All DOM objects that have named getters or directly override getOwnPropertySlot are now marked as
        HasImpureGetOwnPropertySlot.

        Tests: fast/js/prototype-chain-caching-with-impure-get-own-property-slot-traps
               fast/js/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):

2012-12-10  Yi Shen  <max.hong.shen@gmail.com>

        Keyboard caret movement in textarea with RTL Override Character can make tab unresponsive
        https://bugs.webkit.org/show_bug.cgi?id=103067

        Reviewed by Ryosuke Niwa.

        For textarea with RTL override character, the line break could be the previous leaf InlineTextBox of
        the InlineTextBox for the RTL override text. When overshots the left/right, make sure the 
        leftVisuallyDistinctCandidate and rightVisuallyDistinctCandidate return the visually distinct 
        left/right position by ignoring the line break.

        Test: editing/selection/move-by-character-crash-test-textarea.html

        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):

2012-12-03  Hajime Morrita  <morrita@google.com>

        Corrupted DOM tree during appendChild/insertBefore
        https://bugs.webkit.org/show_bug.cgi?id=103601

        Reviewed by Abhishek Arya.

        There are some missing protection in appendChild() and insertBefore().
        This change added these.

        Dromaeo dom-modify shows no speed regression (5445run/s before vs 5351run/s after)

        Tests: fast/events/mutation-during-append-child.html
               fast/events/mutation-during-insert-before.html

        * dom/ContainerNode.cpp:
        (WebCore::checkAcceptChildGuaranteedNodeTypes):
        (WebCore):
        (WebCore::ContainerNode::insertBefore):
        (WebCore::ContainerNode::appendChild):

2012-11-29  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Fix content node renderers ordering inside the named flow thread
        https://bugs.webkit.org/show_bug.cgi?id=103501

        Reviewed by David Hyatt.

        This patch fixes two issues with how content nodes renderers are added to a named flow thread.
        The first issue was about determining the insertion position of a renderer inside the children list of a named flow thread. Before this patch, the
        insertion point was based on both the DOM ordering of the elements and insertion order of previous renderers.
        The patch fixes this and makes the renderer position just a function of the DOM ordering of elements.
        The second issue appeared when next/previousRenderer methods were skipping nodes because they had the flow-into property as a side effect
        of copying the style of the parent element (e.g. Text nodes). The patch ensures the skipped nodes are also elements.

        Tests: fast/regions/named-flow-content-order-1.html
               fast/regions/named-flow-content-order-2.html
               fast/regions/named-flow-content-order-3.html

        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::nextRenderer): Skip only elements.
        (WebCore::NodeRenderingContext::previousRenderer): Skip only elements.
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::addFlowChild): Insert the renderer in the list based on the DOM position of the owner element.
        * rendering/RenderNamedFlowThread.h:
        (RenderNamedFlowThread):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::renderNamedFlowThreadWrapper): Rename to eliminate the confusion with enclosingRenderFlowThread.
        (WebCore::RenderObject::insertedIntoTree):
        (WebCore::RenderObject::willBeRemovedFromTree):
        * rendering/RenderObject.h:
        (RenderObject):

2012-11-25  Takashi Sakamoto  <tasak@google.com>

        WebCore::RenderBlock::determineStartPosition crash
        https://bugs.webkit.org/show_bug.cgi?id=98993

        Reviewed by Brent Fulgham.

        If we move some node and the node has some text,
        InlineFlowBox::removeChild() is invoked. The method invokes
        RootInlineBox::childRemoved(). childRemoved() checks whether the
        removed inlinebox has the renderer of its parent's line break object.
        If so, use setLineBreakInfo to make the parent's line break info to
        be 0. However in RenderBlock::determineStartPosition(), the code
        assume that all line break info is solved, i.e.
        prevRootBox->lineBreakObj()->isText(). Since lineBreakObj() returns 0
        because of removeChild(), determineStartPosition crash occurs.

        Test: fast/inline/inline-box-append-child-crash.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::determineStartPosition):
        Checks whether lineBreakObj() is 0 or not before using lineBreakObj().

2012-11-14  Takashi Sakamoto  <tasak@google.com>

        Crash when replacing parts of text inputs with content: url(...)
        https://bugs.webkit.org/show_bug.cgi?id=101133

        Reviewed by Kent Tamura.

        Disable directly setting content of elements in an input element's
        shadow dom tree, because the setting breaks input element's behavior.

        Tests: fast/forms/number/number-content-url-crash.html
               fast/forms/search/search-content-url-crash.html

        * css/html.css:
        (input::-webkit-textfield-decoration-container):
        Use important to disable overriding an input element's content
        property.
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::attach):
        Added ASSERTION. No content should be applied to
        input::-webkit-textfield-decoration-container.

2012-11-13  Christophe Dumez  <christophe.dumez@intel.com>

        Make HTMLLegendElement.form behave according to specification
        https://bugs.webkit.org/show_bug.cgi?id=101044

        Reviewed by Kent Tamura.

        According to the HTML5 specification (http://dev.w3.org/html5/spec/single-page.html#dom-legend-form),
        The form IDL attribute's behavior depends on whether the legend element is in a fieldset element or
        not. If the legend has a fieldset element as its parent, then the form IDL attribute must return the
        same value as the form IDL attribute on that fieldset element. Otherwise, it must return null.

        This patch makes WebKit behaves according to specification (and Firefox). Previously, legend.form was
        not returning null if the element was not inside a fieldset. Also, legend.form did not necessarily
        return the same value as the parent fieldset's form attribute.

        Test: fast/forms/legend/legend-form.html

        * html/HTMLLegendElement.cpp:
        (WebCore):
        (WebCore::HTMLLegendElement::virtualForm):
        * html/HTMLLegendElement.h:
        (HTMLLegendElement):

2012-11-04  Florin Malita  <fmalita@chromium.org>

        Color-profile property triggers assert
        https://bugs.webkit.org/show_bug.cgi?id=101080

        Reviewed by Dirk Schulze.

        CSSPropertyColorProfile is not handled in StyleResolver::applySVGProperty(), triggering the
        unimplemented property assert. Adding a stub entry to avoid that.

        Test: svg/css/color-profile-crash.html

        * css/SVGCSSStyleSelector.cpp:
        (WebCore::StyleResolver::applySVGProperty):

2012-09-14  Simon Fraser  <simon.fraser@apple.com>

        REGRESSION: transition doesn’t always override transition-property
        https://bugs.webkit.org/show_bug.cgi?id=96658

        Reviewed by Dean Jackson.

        Setting the animation property on an Animation in CSSToStyleMap::mapAnimationProperty()
        is special because we have to call setAnimationMode(Animation::AnimateAll) as well
        as setting the property to CSSPropertyInvalid if it's for the initial state
        of the transition-property property.
        
        In order to fix this via StyleBuilder PropertyHandlers, we have to know,
        in ApplyPropertyAnimation::applyInitialValue(), which property is getting applied.
        This requires passing the CSSPropertyID down through all of the "apply" methods.
        
        Do some unrelated cleanup in CSSParser::parseTransitionShorthand(); the existing code
        was not safe with respect to adding new properties to the shorthand.

        Test: transitions/longhand-vs-shorthand-initial.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseTransitionShorthand):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyExpanding::applyInheritValue):
        (WebCore::ApplyPropertyExpanding::applyInitialValue):
        (WebCore::ApplyPropertyExpanding::applyValue):
        (WebCore::ApplyPropertyDefaultBase::applyInheritValue):
        (WebCore::ApplyPropertyDefaultBase::applyInitialValue):
        (WebCore::ApplyPropertyDefaultBase::applyValue):
        (WebCore::ApplyPropertyDefault::applyValue):
        (WebCore::ApplyPropertyNumber::applyValue):
        (WebCore::ApplyPropertyStyleImage::applyValue):
        (WebCore::ApplyPropertyAuto::applyInheritValue):
        (WebCore::ApplyPropertyAuto::applyInitialValue):
        (WebCore::ApplyPropertyAuto::applyValue):
        (WebCore::ApplyPropertyClip::applyInheritValue):
        (WebCore::ApplyPropertyClip::applyInitialValue):
        (WebCore::ApplyPropertyClip::applyValue):
        (WebCore::ApplyPropertyColor::applyInheritValue):
        (WebCore::ApplyPropertyColor::applyInitialValue):
        (WebCore::ApplyPropertyColor::applyValue):
        (WebCore::ApplyPropertyDirection::applyValue):
        (WebCore::ApplyPropertyLength::applyValue):
        (WebCore::ApplyPropertyString::applyValue):
        (WebCore::ApplyPropertyBorderRadius::applyValue):
        (WebCore::ApplyPropertyFillLayer::applyInheritValue):
        (WebCore::ApplyPropertyFillLayer::applyInitialValue):
        (WebCore::ApplyPropertyFillLayer::applyValue):
        (WebCore::ApplyPropertyComputeLength::applyValue):
        (WebCore::ApplyPropertyFont::applyInheritValue):
        (WebCore::ApplyPropertyFont::applyInitialValue):
        (WebCore::ApplyPropertyFont::applyValue):
        (WebCore::ApplyPropertyFontSize::applyInheritValue):
        (WebCore::ApplyPropertyFontSize::applyInitialValue):
        (WebCore::ApplyPropertyFontSize::applyValue):
        (WebCore::ApplyPropertyFontWeight::applyValue):
        (WebCore::ApplyPropertyFontVariantLigatures::applyInheritValue):
        (WebCore::ApplyPropertyFontVariantLigatures::applyInitialValue):
        (WebCore::ApplyPropertyFontVariantLigatures::applyValue):
        (WebCore::ApplyPropertyBorderImage::applyValue):
        (WebCore::ApplyPropertyBorderImageModifier::applyInheritValue):
        (WebCore::ApplyPropertyBorderImageModifier::applyInitialValue):
        (WebCore::ApplyPropertyBorderImageModifier::applyValue):
        (WebCore::ApplyPropertyBorderImageSource::applyValue):
        (WebCore::ApplyPropertyCounter::emptyFunction):
        (WebCore::ApplyPropertyCounter::applyInheritValue):
        (WebCore::ApplyPropertyCounter::applyValue):
        (WebCore::ApplyPropertyCursor::applyInheritValue):
        (WebCore::ApplyPropertyCursor::applyInitialValue):
        (WebCore::ApplyPropertyCursor::applyValue):
        (WebCore::ApplyPropertyTextAlign::applyValue):
        (WebCore::ApplyPropertyTextDecoration::applyValue):
        (WebCore::ApplyPropertyLineHeight::applyValue):
        (WebCore::ApplyPropertyPageSize::applyInheritValue):
        (WebCore::ApplyPropertyPageSize::applyInitialValue):
        (WebCore::ApplyPropertyPageSize::applyValue):
        (WebCore::ApplyPropertyTextEmphasisStyle::applyInheritValue):
        (WebCore::ApplyPropertyTextEmphasisStyle::applyInitialValue):
        (WebCore::ApplyPropertyTextEmphasisStyle::applyValue):
        (WebCore::ApplyPropertyAnimation::applyInheritValue):
        (WebCore::ApplyPropertyAnimation::applyInitialValue): If the property is
        CSSPropertyWebkitTransitionProperty, call setAnimationMode(Animation::AnimateAll).
        (WebCore::ApplyPropertyAnimation::applyValue):
        (WebCore::ApplyPropertyOutlineStyle::applyInheritValue):
        (WebCore::ApplyPropertyOutlineStyle::applyInitialValue):
        (WebCore::ApplyPropertyOutlineStyle::applyValue):
        (WebCore::ApplyPropertyResize::applyValue):
        (WebCore::ApplyPropertyVerticalAlign::applyValue):
        (WebCore::ApplyPropertyAspectRatio::applyInheritValue):
        (WebCore::ApplyPropertyAspectRatio::applyInitialValue):
        (WebCore::ApplyPropertyAspectRatio::applyValue):
        (WebCore::ApplyPropertyZoom::applyInheritValue):
        (WebCore::ApplyPropertyZoom::applyInitialValue):
        (WebCore::ApplyPropertyZoom::applyValue):
        (WebCore::ApplyPropertyDisplay::applyInheritValue):
        (WebCore::ApplyPropertyDisplay::applyInitialValue):
        (WebCore::ApplyPropertyDisplay::applyValue):
        (WebCore::ApplyPropertyClipPath::applyValue):
        (WebCore::ApplyPropertyWrapShape::applyValue):
        (WebCore::ApplyPropertyImageResolution::applyInheritValue):
        (WebCore::ApplyPropertyImageResolution::applyInitialValue):
        (WebCore::ApplyPropertyImageResolution::applyValue):
        * css/StyleBuilder.h:
        (PropertyHandler):
        (WebCore::PropertyHandler::applyInheritValue):
        (WebCore::PropertyHandler::applyInitialValue):
        (WebCore::PropertyHandler::applyValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList): Pass in the property ID.

2012-09-04  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Destroying a render named flow thread without unregistering left-over content nodes triggered an assertion.
        https://bugs.webkit.org/show_bug.cgi?id=95645

        Reviewed by Abhishek Arya.

        This patch cleans up the render named flow thread before destruction by unregistering left-over content nodes.

        Tests: fast/regions/moved-content-node-crash.html

        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::~RenderNamedFlowThread):

2012-08-31  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] It should be possible to specify ::BEFORE/AFTER as regions
        https://bugs.webkit.org/show_bug.cgi?id=90079

        Reviewed by David Hyatt.

        The calls for RenderRegion::node() have been replaced with RenderRegion::generatingNode() to allow pseudo-elements to have RenderRegion renderers.
        The compare function that establishes the region order was adapted to take into account pseudo-regions.
        A renderer for the pseudo-element is now generated if it's a region even though there's no content property specified.

        Test: fast/regions/content-flowed-into-pseudo-regions.html

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::compareRenderRegions):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::ensureBeforeAfterContainer):
        (WebCore):
        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::nodeAtPoint):
        (WebCore::RenderRegion::checkRegionStyle):
        (WebCore::RenderRegion::computeStyleInRegion):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::writeRenderNamedFlowThreads):

2012-08-30  Shinya Kawanaka  <shinyak@chromium.org>

        AuthorShadowDOM support for textarea element.
        https://bugs.webkit.org/show_bug.cgi?id=91485

        Reviewed by Dimitri Glazkov.

        We add AuthorShadowDOM support for textarea element.

        Unlike other replaced elements (e.g. meter, progress, img), we do not need to add
        extra RenderBlock when we add AuthorShadowDOM. However, since inner element will not have
        renderer when AuthorShadowDOM does not have any shadow insertion point, we have to check
        the existence of the renderer of inner element.

        Tests: fast/dom/shadow/shadowdom-for-textarea-with-attribute.html
               fast/dom/shadow/shadowdom-for-textarea-with-placeholder.html
               fast/dom/shadow/shadowdom-for-textarea-with-style.html
               fast/dom/shadow/shadowdom-for-textarea.html

        * dom/ShadowRoot.cpp:
        (WebCore::allowsAuthorShadowRoot): Needs allow textarea to have AuthorShadowRoot.
        * rendering/RenderTextControl.cpp: When AuthorShadowDOM does not have any insertion point,
        innerTextElement() will not have any renderer. We have to tweak these renderers not to be crashed.
        (WebCore::RenderTextControl::textBlockWidth):
        (WebCore::RenderTextControl::updateFromElement):
        (WebCore::RenderTextControl::computeLogicalHeight):
        (WebCore::RenderTextControl::hitInnerTextElement):
        (WebCore::RenderTextControl::computePreferredLogicalWidths):

2012-08-29  Philip Rogers  <pdr@google.com>

        Use SVGImage instead of cached image when drawing without a render tree.
        https://bugs.webkit.org/show_bug.cgi?id=95002

        Reviewed by Nikolas Zimmermann.

        Previously if we tried to use canvas.context2d.drawImage() with an SVG image
        that was not in the render tree, we would crash. This patch changes this behavior
        so that we use SVGImage::draw() to draw images that are not in the render tree.

        Test: svg/as-image/svg-canvas-draw-image-detached.html

        * svg/graphics/SVGImageCache.cpp:
        (WebCore::SVGImageCache::requestedSizeAndScales):
        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):

2012-08-28  Kenichi Ishibashi  <bashi@chromium.org>

        style->fontMetrics() should be available when setting line-height
        https://bugs.webkit.org/show_bug.cgi?id=93327

        Reviewed by Darin Adler.

        Setting line-height assumes the fontMetrics are available for the affected font, but
        the fontMetrics won't be available immediately after setting other properties like
        font-size. Call styleResolver->updateFont() before setting line-height to update fontMetrics.

        Added a test case to fast/canvas/crash-set-font.html.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::setFont):
        Call styleResolver->updateFont() before styleResolver->applyPropertyToCurrentStyle(CSSPropertyLineHeight,...)

2012-08-28  Sukolsak Sakshuwong  <sukolsak@gmail.com>

        Crash in EditingStyle::mergeStyle
        https://bugs.webkit.org/show_bug.cgi?id=94740

        Reviewed by Ryosuke Niwa.

        This bug happened when we selected "1<progress><a style>2</a></progress>"
        and executed a create link command because

        1. The selection ended at <progress>, not the text node inside it, because
           <progress> is an atomic node.
        2. We called removeInlineStyle() to remove conflicting styles.
           Since the selection started at the text node "1" and ended at <progress>,
           we did not get to remove <a>.
        3. We called fixRangeAndApplyInlineStyle(), which in turn called
           applyInlineStyleToNodeRange(). This method split the node range
           into smaller runs. In this case, the run was the whole
           "1<progress><a style>2</a></progress>".
        4. We called removeStyleFromRunBeforeApplyingStyle(). This method tried
           to remove <a> by calling removeInlineStyleFromElement() on <a> with
           extractedStyle = 0. But the method expected that extractedStyle was not null.
           So, it crashed.

        This bug doesn't happen with non-atomic nodes because if <a> is inside a non-atomic
        node, <a> will be covered by the selection. Therefore, it will be removed in
        step #2 and we will never call removeInlineStyleFromElement() on <a>
        again. Thus, the assertion that extractedStyle is not null is reasonable.
        Hence, this patch fixes this bug by skipping over atomic nodes when we apply style.

        Test: editing/style/apply-style-atomic.html

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle):
        (WebCore::ApplyStyleCommand::removeInlineStyle):

2012-08-17  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        ASSERTION FAILED: allocatedMaxLogicalWidth <= cellMaxLogicalWidth : int WebCore::AutoTableLayout::calcEffectiveLogicalWidth()
        https://bugs.webkit.org/show_bug.cgi?id=92471

        Reviewed by Julien Chaffraix.

        The assert occurs due to the float based computations causing a floating
        point rounding error between allocatedMaxLogicalWidth and cellMaxLogicalWidth.

        Test: fast/table/assert-autotablelayout-maxlogicalwidth.html

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
        Converting float based calculations for computing max logical width to int based;
        similar to the calculations for min logical width.

2012-08-09  Luke Macpherson   <macpherson@chromium.org>

        Fix null pointer deref in RenderFileUploadControl::computePreferredLogicalWidth().
        https://bugs.webkit.org/show_bug.cgi?id=93579

        Reviewed by Kent Tamura.

        Checks the upload control has a non-null button renderer before dereferencing.

        Test: fast/forms/file/file-crash-by-display-none-button.html

        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths):

2012-08-08  Matt Arsenault  <arsenm2@gmail.com>

        Crash when inspecting an element with border-image
        https://bugs.webkit.org/show_bug.cgi?id=93380

        Reviewed by Tim Horton.

        The second value in the CSSPair should be the same as the first if
        we are in a shorthand and the next value is not a
        border-image-repeat keyword.

        Test: fast/css/parse-border-image-repeat-null-crash.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseBorderImageRepeat):

2012-08-08  Douglas Stockwell  <dstockwell@chromium.org>

        'highlight' should not be parsed for a composite operation
        https://bugs.webkit.org/show_bug.cgi?id=92615

        Reviewed by Ryosuke Niwa.

        r88144 removed support for highlight as a composite operation but did
        not update the parser.

        Test: fast/backgrounds/composite-highlight-is-invalid.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFillProperty):

2012-07-23  Douglas Stockwell  <dstockwell@chromium.org>

        Null-pointer crash when a derived color like -webkit-activelink is set in a gradient stop
        https://bugs.webkit.org/show_bug.cgi?id=89148

        Reviewed by Simon Fraser.

        CSSGradientValue attempted to resolve colors during paint, this crashed
        when a derived color like -webkit-activelink was encountered because the
        corresponding element was no longer available in the StyleResolver.
        Instead, by adding a field to CSSGradientColorStop we can resolve and
        then cache the resolved colors at the correct time. To avoid sharing
        cached derived colors between elements we clone the gradient values when
        needed.

        Test: fast/css/crash-on-gradient-with-derived-color.html

        * css/CSSGradientValue.cpp:
        (WebCore::CSSGradientValue::gradientWithStylesResolved): Added. Resolve and cache
        resolved colors, clone if colors are derived from the element.
        (WebCore):
        (WebCore::CSSGradientValue::addStops):
        (WebCore::CSSGradientValue::isCacheable): Defer to new logic in
        StyleResolver.
        * css/CSSGradientValue.h:
        (CSSGradientColorStop): Added cache of resolved color.
        (CSSGradientValue):
        (CSSLinearGradientValue):
        (CSSRadialGradientValue):
        * css/CSSImageGeneratorValue.h:
        (WebCore):
        * css/CSSValue.h:
        (WebCore::CSSValue::isGradientValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (StyleResolver):
        * rendering/style/StyleGeneratedImage.cpp:
        (WebCore::StyleGeneratedImage::image): Revert change from r96449. This
        is no longer necessary as the gradient colors are now resolved at a
        time when the style is set on StyleResolver.

2012-07-12  Adam Barth  <abarth@webkit.org>

        Regression (r122359) Layout Test html5lib/runner.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=91047

        Reviewed by Tony Chang.

        This ASSERT is bogus because doctypes can be removed from the DOM and
        then re-added.

        Test: fast/viewport/viewport-legacy-xhtmlmp-remove-and-add.html

        * dom/Document.cpp:
        (WebCore::Document::setDocType):

2012-06-27  Alexandru Chiculita  <achicu@adobe.com> 

       Blur filter causes issues when scrolling 
       https://bugs.webkit.org/show_bug.cgi?id=89475 

       Reviewed by Simon Fraser. 

       This patch disables the fast scrolling when there is a fixed postioned element that 
       has a filter applied on its parent layer. Otherwise the scroll blitting will just 
       copy the outsets of the blur effect. 

       Test: css3/filters/blur-filter-page-scroll.html 

       * page/FrameView.cpp: 
       (WebCore::FrameView::scrollContentsFastPath): 

2012-06-25  Adam Barth  <abarth@webkit.org> 

       ASSERT(m_wheelEventHandlerCount > 0) can fire 
       https://bugs.webkit.org/show_bug.cgi?id=89856 

       Reviewed by Eric Seidel. 

       When a node with a wheel or a touch event is moved from one document to 
       another, the didAddMumble/didRemoveMumble calls do not balance because 
       they're called on different documents. This patch twiddles the counts 
       appropriately in that case. 

       Test: fast/events/move-element-with-wheel-and-touch-event-listeners.html 

       * dom/EventNames.h: 
       (WebCore::EventNames::isTouchEventType): 
       (EventNames): 
       (WebCore::EventNames::touchEventNames): 
       * dom/Node.cpp: 
       (WebCore::Node::didMoveToNewDocument): 

2012-06-22  Florin Malita  <fmalita@chromium.org> 

       REGRESSION (Safari 5.1.5 - ToT): Crash in RenderSVGRoot::computeReplacedLogicalWidth 
       https://bugs.webkit.org/show_bug.cgi?id=85797 

       Reviewed by Darin Adler. 

       Test: svg/custom/svg-width-intrinsic-crash.html 

       RenderSVGRoot::computeReplacedLogicalWidth assumes that if 
       SVGSVGElement::widthAttributeEstablishesViewport returns false, the 
       SVG must be embedded via <object>. This is not always the case, though: 
       widthAttributeEstablishesViewport can also return false for inline 
       SVG if it doesn't have a replaced logical width. 

       Updated computeReplacedLogical{Width,Height} to handle the 
       !widthAttributeEstablishesViewport && !isEmbeddedThroughFrameContainingSVGDocument 
       case gracefully. 

       * rendering/svg/RenderSVGRoot.cpp: 
       (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): 
       (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): 

2012-06-12  Kent Tamura  <tkent@chromium.org> 

       Checking a radio button doesn't uncheck other buttons in the same group in some cases. 
       https://bugs.webkit.org/show_bug.cgi?id=88835 

       Reviewed by Ryosuke Niwa. 

       This change fixes a bug that checking a radio button in a radio button 
       group in a form detached from a document tree doesn't uncheck another 
       checked radio button in the radio button group. 

       A radio button participates in a radio button group in the following 
       conditions: 
       - If it is owned by a form element regardless of the form is in a 
       document tree or not, or 

       - If it is not owned by any form elements and it is in a document tree. 
       A radio button group for the radio button is owned by the document. 

       For HTMLInputElement::removedFrom(): 
       The old code always unregistered the radio button if it was removed from 
       the document tree. It was incorrect because we don't need to unregister 
       it if it has an owner form and the owner form is not changed by 
       removedFrom(). 
       If the owner form is cleared by removedFrom(), willChangeForm() 
       unregisters the radio button. So what we should do in removedFrom() is 
       to unregister the radio button only if the radio button group is owned 
       by the document. 

       For HTMLInputElement::insertedInto(): 
       The old code always registered the radio button if it is inserted into 
       the document tree. It was incorrect because we don't need to register it 
       if it has an owner form and the owner form is not changed by 
       insertedInto(). 
       If the owner form is changed by insertedInto(), didChangeForm() 
        registers the radio button. So We should register the radio button only 
       if its radio button group will be owned by the document. 

       Test: Add test cases to fast/forms/radio/radio-group.html 

       * html/HTMLInputElement.cpp: 
       (WebCore::HTMLInputElement::insertedInto): 
       Register this to CheckedRadioButtons only if new group owner is Document. 
       (WebCore::HTMLInputElement::removedFrom): 
       Unregister this from CheckedRadioButtons only if old group owner was Document. 

2012-05-25  Keishi Hattori  <keishi@webkit.org> 

       Bad checkValidity result on recently "enabled" form fields 
       https://bugs.webkit.org/show_bug.cgi?id=85704 

       Reviewed by Kent Tamura. 

       Test: fast/forms/disabled-attr-checkvalidity.html 

       We were tripping on the assertion m_isValid == validity()->valid() 
       inside HTMLFormControlElement::isValidFormControlElement. 
       m_isValid was becoming stale because setNeedsValidityCheck wasn't called 
       after m_willValidate changed. 

       * html/HTMLFormControlElement.cpp: 
       (WebCore::HTMLFormControlElement::willValidate): We used const_cast 
       because it was too difficult to remove const. We are checking if the 
       value from willValidate has changed to avoid an infinite loop. 
       (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck): 

2012-05-10  Julien Chaffraix  <jchaffraix@webkit.org> 

       Crash in computedCSSPadding* functions due to RenderImage::imageDimensionsChanged called during attachment 
       https://bugs.webkit.org/show_bug.cgi?id=85912 

       Reviewed by Eric Seidel. 

       Tests: fast/images/link-body-content-imageDimensionChanged-crash.html 
              fast/images/script-counter-imageDimensionChanged-crash.html 

       The bug comes from CSS generated images that could end up calling imageDimensionsChanged during attachment. As the 
       rest of the code (e.g. computedCSSPadding*) would assumes that we are already inserted in the tree, we would crash. 

       The solution is to bail out in this case as newly inserted RenderObject will trigger layout later on and properly 
       handle what we would be doing as part of imageDimensionChanged (the only exception being updating our intrinsic 
       size which should be done as part of imageDimensionsChanged). 

       * rendering/RenderImage.cpp: 
       (WebCore::RenderImage::imageDimensionsChanged): 

2012-12-13  Lucas Forschler  <lforschler@apple.com>

    Rollout r145656

2013-04-16  Ryosuke Niwa  <rniwa@webkit.org>

        Merge r125955.

    2012-08-17  Alice Cheng  <alice_cheng@apple.com>

            Preserve styling elements in DeleteSelectionCommand
            <rdar://problem/12040676>
            https://bugs.webkit.org/show_bug.cgi?id=93643

            Reviewed by Ryosuke Niwa.

            Styling elements (<link> and <style>) can appear inside editable content. To 
            prevent accidental deletion, we move styling elements to rootEditableElement in
            DeleteSelectionCommand undoably.

            Test: editing/execCommand/delete-selection-has-style.html

            * editing/DeleteSelectionCommand.cpp:
            (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss): Added to preserve styling elements during the command
            (WebCore::DeleteSelectionCommand::handleGeneralDelete):  Modified to preserve styling elements during the command
            * editing/DeleteSelectionCommand.h:
            (DeleteSelectionCommand):

2013-04-16  Lucas Forschler  <lforschler@apple.com>

        Merge r130313

    2012-10-03  Adam Barth  <abarth@webkit.org>

            Crash when calling document.open during unload
            https://bugs.webkit.org/show_bug.cgi?id=98287

            Reviewed by Nate Chapin.

            Calling document.open results in us nulling out m_documentLoader. This
            code doesn't properly handle that case and crashes.

            Test: fast/parser/document-open-in-unload.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::commitProvisionalLoad):

2013-04-16  Lucas Forschler  <lforschler@apple.com>

        Merge r147938

    2013-04-08  Alexey Proskuryakov  <ap@apple.com>

            <rdar://problem/12834449> Crashes in WebSocketChannel::processFrame when processing a ping
            https://bugs.webkit.org/show_bug.cgi?id=114178

            Reviewed by Brady Eidson.

            No test, I could never reproduce even manually.

            Calling enqueueRawFrame() could change incoming buffer, so a subsequent skipBuffer()
            would operate on wrong assumptions. This happened because enqueueRawFrame() actually
            tried to process the queue, and send failure sometimed clears m_buffer.

            Fixing this by decoupling enqueuing from sending, and making sure that skipBuffer()
            in ping frame processing case is performed at a safe time.

            * Modules/websockets/WebSocketChannel.cpp:
            (WebCore::WebSocketChannel::send):
            (WebCore::WebSocketChannel::startClosingHandshake):
            (WebCore::WebSocketChannel::processFrame):
            (WebCore::WebSocketChannel::enqueueTextFrame):
            (WebCore::WebSocketChannel::enqueueRawFrame):
            (WebCore::WebSocketChannel::enqueueBlobFrame):

2013-04-16  Andy Estes  <aestes@apple.com>

        Merged r142631.

    2013-02-12  Dominic Mazzoni  <dmazzoni@google.com>

        ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
        https://bugs.webkit.org/show_bug.cgi?id=109452

        Reviewed by Chris Fleizach.

        Send the accessibility childrenChanged notification in
        HTMLSelectElement::setRecalcListItems instead of in childrenChanged
        so that all possible codepaths are caught.

        Test: accessibility/insert-selected-option-into-select-causes-crash.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::childrenChanged):
        (WebCore::HTMLSelectElement::setRecalcListItems):

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r139444.

    2013-01-11  Stephen Chenney  <schenney@chromium.org>
        Objects can be re-added to the AXObjectCache during removal
        https://bugs.webkit.org/show_bug.cgi?id=104171

        The problem occurs when a label's corresponding element is a sibling
        that precedes it in the render tree, and the corresponding element is
        removed. The corresponding element's AX render object is removed, but
        then recreated when accessibilityIsIgnored() invokes correspondingControl()
        on the label. The corresponding renderer then has an AX render object
        that survives beyond the deleted renderer, leading to invalid memory
        accesses.

        The solution is to rearrange the calls to delete the renderer's AX
        render object only when we are sure it will no longer be required.

        Reviewed by Simon Fraser.

        Test: accessibility/corresponding-control-deleted-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::willBeDestroyed): Move the call to remove the
        renderer from the AXCache to after the renderer is removed from the
        render tree. This means that the AXObject still exists during renderer
        removal, as we require.

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r131670.

    2012-10-17  Tom Sepez  <tsepez@chromium.org>

        Crash in ContainerNode::removeAllChildren()
        https://bugs.webkit.org/show_bug.cgi?id=98443

        Reviewed by Eric Carlson.

        This patch makes the errorEventSender added in WebKit Revision 112190 interact
        with the updatedHasPendingLoadEvent() mechanism in the same manner as the other
        existing event senders.

        Test: http/tests/security/video-poster-cross-origin-crash2.html

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::setImage):
        (WebCore::ImageLoader::updateFromElement):
        (WebCore::ImageLoader::notifyFinished):
        (WebCore::ImageLoader::updatedHasPendingEvent):
        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
        (WebCore::ImageLoader::dispatchPendingLoadEvent):
        * loader/ImageLoader.h:
        (ImageLoader):

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r142063.

    2013-02-06  Tom Sepez  <tsepez@chromium.org>

        document.referrer leakage with XSS Auditor page block
        https://bugs.webkit.org/show_bug.cgi?id=109089

        Reviewed by Adam Barth.

        Pass "about:blank" as referrer instead of "" so that the actual page
        is not leaked when empty referrers are replaced later on in the
        request.
        
        * html/parser/XSSAuditorDelegate.cpp:
        (WebCore::XSSAuditorDelegate::didBlockScript):

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r139111.

    2013-01-08  Tom Sepez  <tsepez@chromium.org>

        Copy-paste preserves <embed> tags containing active content.
        https://bugs.webkit.org/show_bug.cgi?id=77625

        Reviewed by Ryosuke Niwa.

        Test: editing/pasteboard/paste-noplugin.html

        * dom/FragmentScriptingPermission.h:
        (WebCore::scriptingContentIsAllowed):
        (WebCore::pluginContentIsAllowed):
        Add new permission to restrict plugin pasting.  Add inline functions to check
        the implications of each permission rather than having a list of raw comparisions
        sprinkled throughout the code. 
        
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkup):
        Revert back to unsafe plugin pasting regardless of caller's intentions when
        the settings allow it.

        * dom/Element.cpp:
        (WebCore::Element::parserSetAttributes):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertScriptElement):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::endElementNs):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::parseEndElement):
        Use new inline functions to check implications of permissions rather than raw
        comparisions.
        
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
        (WebCore::HTMLTreeBuilder::processEndTag):
        Check if plugin pasting is allowed before inserting applet/embed/oject elements.

        * page/Settings.in:
        Declaration of new unsafePluginPastingEnabled setting.

        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::documentFragment):
        * platform/blackberry/PasteboardBlackBerry.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/chromium/DragDataChromium.cpp:
        (WebCore::DragData::asFragment):
        * platform/chromium/PasteboardChromium.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/gtk/PasteboardGtk.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/qt/DragDataQt.cpp:
        (WebCore::DragData::asFragment):
        * platform/qt/PasteboardQt.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/win/ClipboardUtilitiesWin.cpp:
        (WebCore::fragmentFromCFHTML):
        (WebCore::fragmentFromHTML):
        * platform/wx/PasteboardWx.cpp:
        (WebCore::Pasteboard::documentFragment):
        Pass DisallowScriptingAndPluginContent enum value.
        
2013-04-15  Roger Fong  <roger_fong@apple.com>

        Build fix for r148472.

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::setBlendedFontSize):
        * rendering/style/RenderStyle.h:

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merged r138821.

    01/04/13 John Mellor  <johnme@chromium.org>

            Clamp font sizes to valid range in RenderStyle::setFontSize
            https://bugs.webkit.org/show_bug.cgi?id=106014

            Reviewed by Emil A Eklund.

            There is a test-case attached to http://crbug.com/167443, but I can't
            think of a good way of automatically testing this. Functionality
            shouldn't change on normal pages.

            * rendering/style/RenderStyleConstants.h:
                Add constant for maximum allowed font size.
            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::getComputedSizeFromSpecifiedSize):
                Use constant from RenderStyleConstants.h instead of hardcoding.
            * rendering/style/RenderStyle.cpp:
            (WebCore::RenderStyle::setFontSize):
                Clamp non-finite and out of range font sizes.

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r138990.

    2013-01-07  Tom Sepez  <tsepez@chromium.org>

        Document::initSecurityContext() gives parent security context to iframes with invalid URLs.
        https://bugs.webkit.org/show_bug.cgi?id=104960

        Reviewed by Adam Barth.

        Change covers the case of an invalid non-empty URL.  We know nothing
        about that kind of URL and choose not to inherit origins.
        
        * dom/Document.cpp:
        (WebCore::shouldInheritSecurityOriginFromOwner):

2013-04-15  Tim Horton  <timothy_horton@apple.com>

    Merge r138460.

    2012-12-25  Alexander Pavlov  <apavlov@chromium.org>

            Web Inspector: Crash when modifying a rule that has been removed through JavaScript
            https://bugs.webkit.org/show_bug.cgi?id=105718

            Reviewed by Yury Semikhatsky.

            CSSStyleRules should be stored by RefPtr's to avoid using stale pointers to deleted instances.

            Test: inspector/styles/removed-rule-crash.html

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::ruleForId):
            (WebCore::InspectorStyleSheet::revalidateStyle):
            (WebCore::InspectorStyleSheet::buildArrayForRuleList):
            (WebCore::InspectorStyleSheet::collectFlatRules):
            * inspector/InspectorStyleSheet.h:
            (InspectorStyleSheet):

2013-04-15  Tim Horton  <timothy_horton@apple.com>

        Merge r143454.

    2013-02-20  Florin Malita  <fmalita@chromium.org>

            Clear SVGPathSeg role on removal.
            https://bugs.webkit.org/show_bug.cgi?id=110058

            Reviewed by Dirk Schulze.

            SVGPathSegListPropertyTearOff::initialize() and SVGPathSegListPropertyTearOff::replaceItem()
            need to clear the context and role for segments being expunged from the list, similarly to
            removeItem(). Otherwise, processIncomingListItemValue() can get confused and attempt to
            remove stale segments.

            Test: svg/dom/SVGPathSegList-crash.html

            * svg/properties/SVGPathSegListPropertyTearOff.cpp:
            (WebCore::SVGPathSegListPropertyTearOff::clearContextAndRoles):
            (WebCore::SVGPathSegListPropertyTearOff::clear):
            (WebCore::SVGPathSegListPropertyTearOff::replaceItem):
            (WebCore):
            * svg/properties/SVGPathSegListPropertyTearOff.h:
            (WebCore::SVGPathSegListPropertyTearOff::initialize):
            (SVGPathSegListPropertyTearOff):

2013-04-15  Tim Horton  <timothy_horton@apple.com>

        Merge r142759.

    2013-02-13  Florin Malita  <fmalita@chromium.org>

            [SVG] OOB access in SVGListProperty::replaceItemValues()
            https://bugs.webkit.org/show_bug.cgi?id=109293

            Replacing a list property item with itself should be a no-op. This patch updates the related
            APIs and logic to detect the self-replace case and prevent removal of the item from the list.

            To avoid scanning the list multiple times, removeItemFromList() is updated to operate on
            indices and a findItem() method is added to resolve an item to an index.

            Reviewed by Dirk Schulze.

            No new tests: updated existing tests cover the change.

            * svg/properties/SVGAnimatedListPropertyTearOff.h:
            (WebCore::SVGAnimatedListPropertyTearOff::findItem):
            (SVGAnimatedListPropertyTearOff):
            (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
            * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
            (WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
            (SVGAnimatedPathSegListPropertyTearOff):
            (WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
            Add a findItem() delegating method, and update removeItemFromList() to use the new
            index-based API.

            * svg/properties/SVGListProperty.h:
            (WebCore::SVGListProperty::insertItemBeforeValues):
            (WebCore::SVGListProperty::insertItemBeforeValuesAndWrappers):
            (WebCore::SVGListProperty::replaceItemValues):
            (WebCore::SVGListProperty::replaceItemValuesAndWrappers):
            (SVGListProperty):
            Updated to handle the no-op case for insertItemBefore() & replaceItem().

            * svg/properties/SVGListPropertyTearOff.h:
            (WebCore::SVGListPropertyTearOff::findItem):
            (WebCore::SVGListPropertyTearOff::removeItemFromList):
            Index-based API updates.

            (WebCore::SVGListPropertyTearOff::processIncomingListItemValue):
            (WebCore::SVGListPropertyTearOff::processIncomingListItemWrapper):
            * svg/properties/SVGPathSegListPropertyTearOff.cpp:
            (WebCore::SVGPathSegListPropertyTearOff::processIncomingListItemValue):
            Detect the self-replace case and return without removing the item from the list.

            * svg/properties/SVGPathSegListPropertyTearOff.h:
            (WebCore::SVGPathSegListPropertyTearOff::findItem):
            (WebCore::SVGPathSegListPropertyTearOff::removeItemFromList):
            (SVGPathSegListPropertyTearOff):
            (WebCore::SVGPathSegListPropertyTearOff::processIncomingListItemWrapper):
            * svg/properties/SVGStaticListPropertyTearOff.h:
            (WebCore::SVGStaticListPropertyTearOff::processIncomingListItemValue):
            (WebCore::SVGStaticListPropertyTearOff::processIncomingListItemWrapper):
            Index-based API updates.

2013-04-15  Timothy Hatcher  <timothy@apple.com>

        Merge r140127.

    2013-01-18  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: make sure InspectorInstrumentationCookie is invalidated if inspected page was destroyed
        https://bugs.webkit.org/show_bug.cgi?id=107232

        Reviewed by Pavel Feldman.

        Made InstrumentingAgents reference counted to make sure it is not deleted while there is
        InspectorInstrumentationCookie with reference to it.

        Introduced InstrumentingAgents::reset that is called from inspector controller destructor
        to double check that references to all deleted agents are cleared.

        InspectorInstrumentationCookie turned from std::pair into a custom class so that
        we can avoid inclusion of InstrumentingAgents.h into InspectorInstrumentation.h

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::~InspectorController):
        * inspector/InspectorController.h:
        (InspectorController):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentationCookie::InspectorInstrumentationCookie):
        (WebCore::InspectorInstrumentationCookie::operator=):
        (WebCore::InspectorInstrumentationCookie::~InspectorInstrumentationCookie):
        (WebCore::InspectorInstrumentation::didHandleEventImpl):
        (WebCore::InspectorInstrumentation::didFireTimerImpl):
        (WebCore::InspectorInstrumentation::didLayoutImpl):
        (WebCore::InspectorInstrumentation::didPaintImpl):
        (WebCore::InspectorInstrumentation::didRecalculateStyleImpl):
        (WebCore::InspectorInstrumentation::didMatchRuleImpl):
        (WebCore::InspectorInstrumentation::didProcessRuleImpl):
        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
        (WebCore::InspectorInstrumentation::retrieveTimelineAgent):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentationCookie):
        (WebCore::InspectorInstrumentation::didCallFunction):
        (WebCore::InspectorInstrumentation::didDispatchXHRReadyStateChangeEvent):
        (WebCore::InspectorInstrumentation::didDispatchEvent):
        (WebCore::InspectorInstrumentation::didHandleEvent):
        (WebCore::InspectorInstrumentation::didDispatchEventOnWindow):
        (WebCore::InspectorInstrumentation::didEvaluateScript):
        (WebCore::InspectorInstrumentation::didFireTimer):
        (WebCore::InspectorInstrumentation::didLayout):
        (WebCore::InspectorInstrumentation::didDispatchXHRLoadEvent):
        (WebCore::InspectorInstrumentation::didPaint):
        (WebCore::InspectorInstrumentation::didRecalculateStyle):
        (WebCore::InspectorInstrumentation::didMatchRule):
        (WebCore::InspectorInstrumentation::didProcessRule):
        (WebCore::InspectorInstrumentation::didReceiveResourceData):
        (WebCore::InspectorInstrumentation::didWriteHTML):
        (WebCore::InspectorInstrumentation::didFireAnimationFrame):
        * inspector/InstrumentingAgents.cpp:
        (WebCore::InstrumentingAgents::InstrumentingAgents):
        (WebCore):
        (WebCore::InstrumentingAgents::reset):
        * inspector/InstrumentingAgents.h:
        (WebCore::InstrumentingAgents::create):
        (InstrumentingAgents):
        * inspector/WorkerInspectorController.cpp:
        (WebCore::WorkerInspectorController::WorkerInspectorController):
        (WebCore::WorkerInspectorController::~WorkerInspectorController):
        * inspector/WorkerInspectorController.h:
        (WorkerInspectorController):

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merge 133840, 134191, 134197.

    2012-11-12  Ryosuke Niwa  <rniwa@webkit.org>

            Build fix after r134191. Turns out that FrameView::performPostLayoutTasks calls FrameSelection::updateAppearance
            in the middle of a layout. So we can't have assertions in recomputeCaretRect and updateAppearance.

            Furthermore, we can't update layout in updateAppearance. So do that in its call sites.
        
            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::setSelection):
            (WebCore::FrameSelection::recomputeCaretRect):
            (WebCore::FrameSelection::updateAppearance):
            (WebCore::FrameSelection::setCaretVisibility):

    2012-11-09  Ryosuke Niwa  <rniwa@webkit.org>

            Multiple Layout Tests (e.g. fast/repaint/japanese-rl-selection-clear.html) is failing after r133840.
            https://bugs.webkit.org/show_bug.cgi?id=101547

            Reviewed by Simon Fraser.

            I overlooked the fact when the selection is null, we still have to invalidate the caret rect that
            previously existed. Revert the optimization added in r133840 to skip caret invalidation when new
            selection is null, and add a special method to be called by FrameLoader prior to destruction instead.
            This will let us avoid doing an extra layout upon destruction and not regress repaint tests.

            Covered by existing tests.

            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::setSelection): Added DoNotUpdateAppearance option.
            (WebCore::FrameSelection::prepareForDestruction): Added.
            (WebCore::FrameSelection::updateAppearance): Reverted the flawed optimization added in r133840.
            Also, don't update style before updating selection unless text caret is disabled since we always
            update the layout (including style) when text caret is enabled.
            * editing/FrameSelection.h:
            (FrameSelection):
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::clear): Call prepareForDestruction instead of clear to avoid a layout.

    2012-11-07  Ryosuke Niwa  <rniwa@webkit.org>

            Crash in WebCore::RenderLayer::normalFlowList
            https://bugs.webkit.org/show_bug.cgi?id=101528

            Reviewed by Simon Fraser.

            Make sure the layout is up to date before re-computing the caret rect.
            Avoid doing the layout when the selection is cleared since we don't can
            since we can always stop the blink timer in that case.

            Unfortunately, we haven't found any reproduction of this crash yet.

            * editing/FrameSelection.cpp:
            (WebCore::isNonOrphanedCaret):
            (WebCore):
            (WebCore::FrameSelection::localCaretRect):
            (WebCore::FrameSelection::updateAppearance):
 
2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merged r138213.

    2013-01-09  Abhishek Arya  <inferno@chromium.org>

            Mitigate out-of-bounds access in InlineIterator
            https://bugs.webkit.org/show_bug.cgi?id=104812

            Reviewed by Levi Weintraub.

            Share code between InlineIterator::current and InlineIterator::previousInSameNode,
            thereby checking for access outside text renderer's length.

            * rendering/InlineIterator.h:
            (InlineIterator):
            (WebCore::InlineIterator::characterAt):
            (WebCore):
            (WebCore::InlineIterator::current):
            (WebCore::InlineIterator::previousInSameNode):

2012-12-13  Lucas Forschler  <lforschler@apple.com>

    Rollout r
145643

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merge r142816.

    2013-02-13  Abhishek Arya  <inferno@chromium.org>

            ASSERTION FAILED: !object || object->isBox(), Bad cast in RenderBox::computeLogicalHeight
            https://bugs.webkit.org/show_bug.cgi?id=107748

            Reviewed by Levi Weintraub.

            Make sure that body renderer is not an inline-block display
            when determining that it stretches to viewport or when paginated
            content needs base height.

            Test: fast/block/body-inline-block-crash.html

            * rendering/RenderBox.cpp:
            (WebCore::RenderBox::computeLogicalHeight):
            * rendering/RenderBox.h:
            (WebCore::RenderBox::stretchesToViewport):

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merge r142922.

    2013-02-14  Abhishek Arya  <inferno@chromium.org>

            Bad cast in RenderBlock::splitBlocks.
            https://bugs.webkit.org/show_bug.cgi?id=108691

            Reviewed by Levi Weintraub.

            Test: fast/multicol/remove-child-split-flow-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore):
            (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): rename gIsInColumnFlowSplit to gColumnFlowSplitEnabled
            and use it to decide when to do the column flow split or not.
            (WebCore::RenderBlock::removeChild): Do not allow column flow split inside removeChild
            since we might be merging anonymous blocks.

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merge r138988.

    2013-01-07  Abhishek Arya  <inferno@chromium.org>

            Heap-buffer-overflow in WebCore::RenderBlock::clone.
            https://bugs.webkit.org/show_bug.cgi?id=101984

            Reviewed by Julien Chaffraix.

            Add a global in RenderBlock to prevent recursion inside splitFlow.
            While inside splitFlow (multi-column handling), we move many children
            using fullRemoveInsert=true, causing RenderBlock::addChild to be called
            and recursing in splitFlow. This messes the tree splitting happening in
            RenderBlock::splitBlocks and can cause bad casts.

            Test: fast/multicol/recursive-split-flow-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):

2013-04-13  Lucas Forschler  <lforschler@apple.com>

        Merge r136845

    2012-12-06  Stephen Chenney  <schenney@chromium.org>

            SVG <use> element inside an svg-as-image fails
            https://bugs.webkit.org/show_bug.cgi?id=104007

            Reviewed by Eric Seidel.

            Upon redraw, SVGImage calls layout on the document it is drawing into
            the image if the image, provided it believes the redraw does not need
            to be delayed. Unfortunately, when an SVG <use> element is modified
            (by animation, say) and regenerates its shadow tree, the destructors
            invoke redraw, causing the SVGImage to call layout on something that
            is in the process of being deleted. That's bad.

            This change causes SVGImage to always delay the redraw. It is the most robust
            way to protect against this problem, as there may be any number of
            ways to cause this issue (a node being deleted in an svg-as-image
            target) and this protects against them all.

            The test case crashes in Asan Chromium.

            Test: svg/as-image/animated-use-as-image-crash.html

            * svg/graphics/SVGImageCache.cpp:
            (WebCore::SVGImageCache::imageContentChanged): Always redraw on the timer.

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 140893

    2013-01-30  Kentaro Hara  <haraken@chromium.org>

            Remove InjectedScript::wrapSerializedObject()
            https://bugs.webkit.org/show_bug.cgi?id=107906

            Reviewed by Abhishek Arya.

            InjectedScript::wrapSerializedObject() is unused.
            (This is one of steps to remove raw pointers of SerializedScriptValue*,
            which can be a security concern.)

            * inspector/InjectedScript.cpp:
            * inspector/InjectedScript.h:
            (InjectedScript):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 141315

    2013-01-30  Kentaro Hara  <haraken@chromium.org>

            isSameAsCurrentState() should take SerializedScriptValue* instead of PassRefPtr
            https://bugs.webkit.org/show_bug.cgi?id=107904

            Reviewed by Darin Adler.

            Applied Darin's comment: https://bugs.webkit.org/show_bug.cgi?id=107904#c5

            No tests. No change in behavior.

            * bindings/js/JSPopStateEventCustom.cpp:
            (WebCore::JSPopStateEvent::state):
            * bindings/v8/custom/V8PopStateEventCustom.cpp:
            (WebCore::V8PopStateEvent::stateAccessorGetter):
            * page/History.cpp:
            (WebCore::History::isSameAsCurrentState):
            * page/History.h:
            (History):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 140886

    2013-01-25  Kentaro Hara  <haraken@chromium.org>

            Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() in PopStateEvent
            https://bugs.webkit.org/show_bug.cgi?id=107904

            Reviewed by Abhishek Arya.

            If you use a raw SerializedScriptValue* for serialize()/deserialize(),
            it can potentially cause a use-after-free. This is because serialize()/
            deserialize() can destruct a RefPtr of the SerializedScriptValue*,
            depending on data that is serialized/deserialized. So we should keep a
            RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
            (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

            No tests. This is just a just-in-case fix.

            * dom/PopStateEvent.h:
            (WebCore::PopStateEvent::serializedState):
            * page/History.cpp:
            (WebCore::History::isSameAsCurrentState):
            * page/History.h:
            (History):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge r140892

    2013-01-25  Kentaro Hara  <haraken@chromium.org>

            Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() in code generators
            https://bugs.webkit.org/show_bug.cgi?id=107902

            Reviewed by Abhishek Arya.

            If you use a raw SerializedScriptValue* for serialize()/deserialize(),
            it can potentially cause a use-after-free. This is because serialize()/
            deserialize() can destruct a RefPtr of the SerializedScriptValue*,
            depending on data that is serialized/deserialized. So we should keep a
            RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
            (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

            No tests. This is just a just-in-case fix.

            * Modules/intents/Intent.h:
            (WebCore::Intent::data):
            * Modules/intents/IntentRequest.cpp:
            (WebCore::IntentRequest::postResult):
            (WebCore::IntentRequest::postFailure):
            * Modules/intents/IntentRequest.h:
            (IntentRequest):
            * Modules/intents/IntentResultCallback.h:
            (IntentResultCallback):
            * bindings/scripts/CodeGeneratorJS.pm:
            (GetNativeTypeForCallbacks):
            * bindings/scripts/CodeGeneratorV8.pm:
            (GenerateNormalAttrGetter):
            (GetNativeTypeForCallbacks):
            * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
            (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
            (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):
            * dom/MessagePortChannel.h:
            (WebCore::MessagePortChannel::EventData::message):


2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge r140891

    2013-01-25  Kentaro Hara  <haraken@chromium.org>

            Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() for MessageEvent
            https://bugs.webkit.org/show_bug.cgi?id=107900

            Reviewed by Abhishek Arya.

            If you use a raw SerializedScriptValue* for serialize()/deserialize(),
            it can potentially cause a use-after-free. This is because serialize()/
            deserialize() can destruct a RefPtr of the SerializedScriptValue*,
            depending on data that is serialized/deserialized. So we should keep a
            RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
            (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

            No tests. This is just a just-in-case fix. I couldn't find any bug
            even in an ASAN build.

            * bindings/js/JSMessageEventCustom.cpp:
            (WebCore::JSMessageEvent::data):
            * bindings/v8/custom/V8MessageEventCustom.cpp:
            (WebCore::V8MessageEvent::dataAccessorGetter):
            * dom/MessageEvent.h:
            (WebCore::MessageEvent::dataAsSerializedScriptValue):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge r140748.

    2013-01-24  Kentaro Hara  <haraken@chromium.org>

            Regression(r107058): Use-after-free in SerializedScriptValue::deserialize
            https://bugs.webkit.org/show_bug.cgi?id=107792

            Reviewed by Abhishek Arya.

            Imagine the following call path:

            (1) history.state is accessed.
            (2) V8History::stateAccessorGetter() calls History::state(), which calls
            HistoryItem::stateObject().
            (3) HistoryItem holds m_stateObject as RefPtr<SerializedScriptValue>,
            but HistoryItem::stateObject() returns SerializedScriptValue*.
            (4) V8History::stateAccessorGetter calls SerializedScriptValue::deserialize()
            for the SerializedScriptValue* obtained in (3).
            (5) SerializedScriptValue::deserialize() can call history.replaceState()
            in its deserialization process (See the test case in the Chromium bug).
            (6) history.replaceState() replaces HistoryItem::m_stateObject.
            This replacement destructs the original HistoryItem::m_stateObject.
            (7) The current deserialization process can crash due to the premature destruction.

            To avoid the problem, we have to pass PassRefPtr<SerializedScriptValue> around
            instead of SerializedScriptValue*.

            Test: fast/history/replacestate-nocrash.html

            * bindings/v8/custom/V8HistoryCustom.cpp:
            (WebCore::V8History::stateAccessorGetter):
            * history/HistoryItem.h:
            (WebCore):
            (WebCore::HistoryItem::stateObject):
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::loadInSameDocument):
            * loader/FrameLoader.h:
            * page/History.cpp:
            (WebCore::History::state):
            (WebCore::History::stateInternal):
            * page/History.h:
            (History):

2013-04-12  Lucas Forschler  <lforschler@apple.com>

        Merge r129814

    2012-09-27  Levi Weintraub  <leviw@chromium.org>

            REGRESSION(r129186): Pressing enter at the end of a line deletes the line
            https://bugs.webkit.org/show_bug.cgi?id=97763

            Reviewed by Ryosuke Niwa.

            r129186 exposed incorrect behavior in RenderText whereby RenderText's lines were
            dirtied but the renderer wasn't marked for layout. Rich text editing in GMail exposed
            this behavior. RenderText::setTextWithOffset is called with a text string identical
            to the current text. It still dirties lines, then calls setText, which has a check
            for the case when the strings are the same and returns early and doesn't mark us as
            needing layout.

            This change adds the same early bailing logic in setText to setTextWithOffset, but
            forces setText to work its magic whenever we dirty lines there (and avoid double-
            checking that the strings are equal).

            * rendering/RenderText.cpp:
            (WebCore::RenderText::setTextWithOffset):

2013-04-12  Roger Fong  <roger_fong@apple.com>

        Merge r143565.

    2013-02-20  Wei James  <james.wei@intel.com>
    
            ChannelMergerNode may need check for deferred updating of output channels
            https://bugs.webkit.org/show_bug.cgi?id=108863
    
            There can in rare cases be a slight delay before the output bus is updated
            to the new number of channels because of tryLocks() in the context's
            updating system. So need to check the channel number before processing.
    
            Reviewed by Chris Rogers.
    
            * Modules/webaudio/ChannelMergerNode.cpp:
            (WebCore::ChannelMergerNode::ChannelMergerNode):
            (WebCore::ChannelMergerNode::process):
            (WebCore::ChannelMergerNode::checkNumberOfChannelsForInput):
            * Modules/webaudio/ChannelMergerNode.h:
            (ChannelMergerNode):

2013-04-12  Tim Horton  <timothy_horton@apple.com> 

        Merge r132856

    2012-10-25  Stephen Chenney  <schenney@chromium.org>

            feImage should not be allowed to self reference
            https://bugs.webkit.org/show_bug.cgi?id=94652

            Reviewed by Eric Seidel.

            Add cycle detection for SVG filter application, and also fix a problem
            with graphics context restore when filters are applied. This also
            converts the flags in FilterData to a state tracking system, as the
            number of flags was getting messy and only one flag is valid at any given time.

            Test: svg/filters/feImage-self-and-other-referencing.html

            * rendering/svg/RenderSVGResourceFilter.cpp: Convert to new FilterData
            state management and enable cycle detection.
            (WebCore):
            (WebCore::RenderSVGResourceFilter::removeClientFromCache): Change isBuilt and markedForRemoval flags to state enums.
            (WebCore::RenderSVGResourceFilter::applyResource): Change flags to state enums and detect cycles.
            (WebCore::RenderSVGResourceFilter::postApplyResource): Change flags to state and add handling
            for the various states.
            (WebCore::RenderSVGResourceFilter::primitiveAttributeChanged): Change isBuilt flag to state enums.
            * rendering/svg/RenderSVGResourceFilter.h:
            (WebCore::FilterData::FilterData):
            (FilterData): Convert to a state tracking system.
            * rendering/svg/RenderSVGRoot.cpp:
            (WebCore::RenderSVGRoot::paintReplaced): Add a block around the
            SVGRenderingContext so that it applies the filter and reverts the
            context before the calling method restores the context.

2013-04-12  Tim Horton  <timothy_horton@apple.com> 

        Merge r131488

    2012-10-16  Stephen Chenney  <schenney@chromium.org> 
            An feImage that tries to render itself should be stopped
            https://bugs.webkit.org/show_bug.cgi?id=94652

            Reviewed by Eric Seidel.

            An SVG feImage filter element will accept, as the src to render, an
            SVG document that makes use of the feImage itself. This causes the
            feImage to try to draw itself while already in the process of drawing
            itself. Various problems arise from this. The invariant we wish to
            maintain is that no element in the src tree of an feImage element
            refers to that feImage.

            This patch adds a flag to all FilterData objects that tracks whether or
            not the filter is currently applying itself, and avoids applying the
            filter recursively.

            While it may seem better to catch this problem when the src is set, or
            when the filter is built, that turns out to be challenging and
            inefficient. Say we choose to test when the src atttribute is set. To
            do so would require looking through all of the DOM nodes that will be
            rendered for the src, finding all resources used, and checking if any
            of them make use fo the feImage element that we are setting the source
            for. The infrastructure is not in place to do that, and it would
            involve walking a potentially very large portion of the DOM in order
            to detect a very rare situation. Note that it is not enough just to
            walk the DOM directly under the src; we also need to recursively follow any
            resource links to see if they use the feImage (e.g. patterns or
            masks or use or ...).

            If we instead try to use the renderer node to find self referencing,
            we need to recursively walk a potentially very large render tree,
            tracing all resources in search of the feImage. This would need to be
            done every time the filter is built, which is again a significant
            overhead for a situation that is very unlikely to occur. And we do not
            have methods that make it easy to find feImage filter effect nodes; they are
            hidden behind filter resource nodes.

            Hence the runtime check to catch the problem. The check must be in
            FilterData and RenderSVGResourceFilter code because we must prevent
            the destruction of the feImage when we encounter it recursively.

            This patch also renames FilterData::builded to FilterData::isBuilt.

            Test: svg/filters/feImage-self-referencing.html

            * rendering/svg/RenderSVGResourceFilter.cpp:
            (WebCore::ApplyingFilterEffectGuard): Guard to ensure that, in the future, we always
            clear the isApplying flag even if the postApplyResource method returns early.
            (WebCore::RenderSVGResourceFilter::applyResource): Do not apply a resource that is already applying and
            rename builded to isBuilt.
            (WebCore::RenderSVGResourceFilter::postApplyResource): Mark a resource as applying and clear after
            it is done. Abort if a resource is already applying when the method begins. Rename builded to isBuilt.
            (WebCore::RenderSVGResourceFilter::primitiveAttributeChanged): Rename builded to isBuilt.
            * rendering/svg/RenderSVGResourceFilter.h:
            (WebCore::FilterData::FilterData):
            (FilterData): Add isApplying and rename builded to isBuilt.

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 130717.

    2012-10-08  Yoshifumi Inoue  <yosin@chromium.org>

            HTMLSelectElement::typeAheadFind depends on implementation dependent behavior
            https://bugs.webkit.org/show_bug.cgi?id=98710

            Reviewed by Kent Tamura.

            This patch gets rid of C/C++ implementation dependent behavior from
            HTMLSelectElement::typeAheadFind() which does modulo operation with
            a negative operand.

            HTMLSelectElement::typeAheadFind() contains expression with modulo
            operator and dividend can be -1 when the "select" element without
            "option" element but "optgroup" element.

            Test: fast/forms/select/select-typeahead-crash.html

            * html/HTMLSelectElement.cpp:
            (WebCore::HTMLSelectElement::typeAheadFind): Changed to do modulo
            operation with both operands are non-negative.

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 136619.

    2012-12-04  Abhishek Arya  <inferno@chromium.org>

            Crash in WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode
            https://bugs.webkit.org/show_bug.cgi?id=103515

            Reviewed by Ryosuke Niwa.

            |current| is weak node pointer that iterates in the hierarchy chain
            between |highestAncestor| and |targetNode|. Script executed as part
            of iframe onload event can blow away the nodes and we no longer have
            |targetNode| in our descendants chain. So, we RefPtr |current| and bail
            out when |targetNode| stops being a part of descendant chain.

            Test blocked on https://bugs.webkit.org/show_bug.cgi?id=104044.

            * editing/ApplyStyleCommand.cpp:
            (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 117463.

    2012-05-17  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

            [Qt] REGRESSION(101967): It made editing/style/iframe-onload-crash-mac.html timeout
            https://bugs.webkit.org/show_bug.cgi?id=73802

            Reviewed by Ryosuke Niwa.

            Timeout was caused by an infinite in the outer loop of
            pushDownInlineStyleAroundNode(). The outer loop variable 'current' should point at the
            node containing 'targetNode'. The inner loop traverse the children of 'current'
            and discover the children that contains 'targetNode'.

            However, before the inner loop, we call removeInlineStyleFromElement() that can
            potentially remove the 'current' node from the tree, moving its children to
            'current' former parent. For that reason 'child' and 'lastChild' are collected
            before this call.

            The tricky part is that changing the 'current' children parent, we might trigger
            further side-effects, that can remove either 'child' or 'lastChild' from the tree
            too. The infinite loop was due to 'child' being off the document, so it's
            nextSibling() is 0, and we go another run of outer loop without changing
            'current' because the 'targetNode' wasn't in the first child that inner loop
            couldn't reach.

            When testing Qt on Mac, there was also a crash in RenderTextControl when the font
            family was empty, this patch fixes it as well.

            * editing/ApplyStyleCommand.cpp:
            (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode): Use NodeVector
            instead of relying on first/last child being valid after
            removeInlineStyleFromElement() is called. Skip the child if it has no parent,
            this is an indication that it was removed from the tree.

            * rendering/RenderTextControl.cpp:
            (WebCore::RenderTextControl::hasValidAvgCharWidth): Empty AtomicStrings aren't
            supported by HashSet, so we have to early return in this case.

2013-04-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138654

    2013-01-02  Douglas Stockwell  <dstockwell@chromium.org>

            Crash in WebCore::InlineBox::deleteLine
            https://bugs.webkit.org/show_bug.cgi?id=93448

            Reviewed by Eric Seidel.

            When we ran off the end of the line while looking for line breaks in an
            inline with white-space:nowrap nested in a block with white-space:pre
            it was possible for the line break to be set at or before the current
            position -- this could result in duplications in the render tree or
            infinite looping.

            This patch changes the "fixup" logic that runs after we have finished
            iterating through elements and text and have potentially found a break
            point. In the case of a block setting white-space:pre we would back up
            a character in some cases. Not doing so could leave whitespace that
            should have been collapsed at the end of an inline.

            For example in '<span style="white-space:nowrap">x_</span>_y' if a
            break was inserted before 'y' the space after 'x' would still be
            rendered (rather than be collapsed with the break).

            To avoid this problem we will not take the opportunity to break until
            we have finished collapsing whitespace.

            Tests: fast/text/whitespace/inline-whitespace-wrapping-1.html
                   fast/text/whitespace/inline-whitespace-wrapping-2.html
                   fast/text/whitespace/inline-whitespace-wrapping-3.html
                   fast/text/whitespace/inline-whitespace-wrapping-4.html
                   fast/text/whitespace/nowrap-white-space-collapse.html
                   fast/text/whitespace/pre-block-normal-inline-crash-1.html
                   fast/text/whitespace/pre-block-normal-inline-crash-2.html

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::RenderBlock::LineBreaker::nextLineBreak): Collapse
            whitespace before breaking. Avoid setting the break before the current
            position.

2013-04-11  Lucas Forschler  <lforschler@apple.com>

        Merge r136554

    2012-12-04  Julien Chaffraix  <jchaffraix@webkit.org>

            Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]
            https://bugs.webkit.org/show_bug.cgi?id=100764

            Reviewed by Eric Seidel.

            Test: mathml/mfenced-root-layer.html

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::stackingContext):
            Fixed this function to ensure that it always returns a stacking context, the bug
            was that the document element's layer wasn't guaranteed to be a stacking context.

2013-04-10  Lucas Forschler  <lforschler@apple.com>

        Merge r136250

    2012-11-30  Florin Malita  <fmalita@chromium.org>

            SVG pattern data deleted while in use
            https://bugs.webkit.org/show_bug.cgi?id=103415

            Reviewed by Dirk Schulze.

            Various calls in RenderSVGResourcePattern::applyResource() can trigger invalidations,
            which may end up deleting our current pattern data (via removeAllClientsFromCache).
            To avoid this, we should add the pattern data to the cache only after it is fully built.
            For clarity, the patch also refactors the pattern setup code into a separate method.

            Test: svg/custom/large-image-pattern-crash.html

            * rendering/svg/RenderSVGResourcePattern.cpp:
            (WebCore::RenderSVGResourcePattern::buildPattern):
            (WebCore::RenderSVGResourcePattern::applyResource):
            * rendering/svg/RenderSVGResourcePattern.h:
            (RenderSVGResourcePattern):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r136062

    2012-11-28  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::EventHandler::handleMousePressEvent
            https://bugs.webkit.org/show_bug.cgi?id=101098

            Reviewed by Adam Barth.

            |subframe| can be blown away inside passMousePressEventToSubframe
            call. Use RefPtr to protect it in handleMousePressEvent function.
            We use similar approach in handleMouseMoveEvent function.

            No new tests. Test is extremely time dependent and needs to trigger
            interaction gesture. Reproduced on ClusterFuzz.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::handleMousePressEvent):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r132970

    2012-10-30  Chris Evans  <cevans@google.com>

            Improve performance of MaskPtr.
            https://bugs.webkit.org/show_bug.cgi?id=100790

            Reviewed by Eric Seidel.

            Calculate the mask once, and store it as a fast-access member variable.
            Also avoid unneccessary integer width expansion in index calculation.
            Parser/tiny-innerHTML.html has a high stddev.
            Best result I've seen pre-patch is 5.70 runs/s.
            Best result I've seen post-patch is 5.72 runs/s, but this is not statistically significant.
            MaskPtr is still showing as ~2% in the profile, so we're not sure we trust the profile symbolization at this time.
            MaskPtr is now reduced to a single inline instruction (was: 4) so this seems like a strict improvement worth landing.

            * rendering/RenderArena.cpp:
            (MaskPtr): Use a passed-in mask for the mask operation.
            (WebCore::RenderArena::RenderArena): Calculate the mask and store it.
            (WebCore::RenderArena::allocate):
            (WebCore::RenderArena::free): Use stored mask and avoid unneccessary casts.
            * rendering/RenderArena.h:
            (RenderArena): Store the freelist mask as a member variable.

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r132724

    2012-10-26  Philip Rogers  <pdr@google.com>

            Prevent NaN offset values in ElementTimeControl.
            https://bugs.webkit.org/show_bug.cgi?id=100322

            Reviewed by Abhishek Arya.

            NaN values can cause ElementTimeControl to go back in time!
            If a value of NaN is passed to ElementTimeControl::beginElementAt(offset),
            subsequent sorting will cause an assert in SVGSMILElement::findInstanceTime
            because NaN values are not properly sorted. NaN SMILTime values
            should not be allowed at all, so this patch adds a check for them in
            ElementTimeControl's setters.

            This patch also adds preventative asserts to catch if SMILTime is ever
            initialized with NaN, or if addEndTime/addBeginTime are ever called
            with NaN values.

            Test: svg/custom/elementTimeControl-nan-crash.html

            * svg/SVGAnimationElement.cpp:
            (WebCore::SVGAnimationElement::beginElementAt):
            (WebCore::SVGAnimationElement::endElementAt):
            * svg/animation/SMILTime.h:
            (WebCore::SMILTime::SMILTime):
            * svg/animation/SVGSMILElement.cpp:
            (WebCore::SVGSMILElement::addBeginTime):
            (WebCore::SVGSMILElement::addEndTime):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r132511

    2012-10-25  Tom Sepez  <tsepez@chromium.org>

            XSSAuditor must replace form action with about:blank when reflected action detected.
            https://bugs.webkit.org/show_bug.cgi?id=100280

            Reviewed by Daniel Bates.

            Changes empty string form-action replacement to about:blank.
            Existing form-action.html test modified to check this case.

            * html/parser/XSSAuditor.cpp:
            (WebCore::XSSAuditor::filterFormToken):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r132287

    2012-10-23  Nate Chapin  <japhet@chromium.org>

            Crash in WebCore::SubresourceLoader::willSendRequest.
            https://bugs.webkit.org/show_bug.cgi?id=100147

            Reviewed by Abhishek Arya.

            No new tests. There is a test case that should cover this, but it doesn't
            work correctly on many platforms due to its use of testRunner.addURLToRedirect().
            See http/tests/loading/cross-origin-XHR-willLoadRequest.html.
            Tested manually on http://www.nick.co.uk/shows/spongebob

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::willSendRequest):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r131709

    2012-10-18  MORITA Hajime  <morrita@google.com>

            Assertion failure at TreeScopeAdopter::moveNodeToNewDocument()
            https://bugs.webkit.org/show_bug.cgi?id=99510

            Reviewed by Kent Tamura.

            Shadow DOM notification call didn't have checks for mutation detection.
            This change adds such checks.

            Test: fast/forms/textarea/textarea-autofocus-removal-while-focusing-with-style.html

            * dom/ContainerNodeAlgorithms.cpp:
            (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument):
            (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r130999

    2012-10-10  Stephen Chenney  <schenney@chromium.org>

            SVGTextRunRenderingContext changes font data in the glyph page, but it shouldn't
            https://bugs.webkit.org/show_bug.cgi?id=98755

            Reviewed by Eric Seidel.

            The code in SVGTextRunRenderingContext::glyphDataForCharacter, when it
            encounters an <altglyph> tag, immediately replaces the font data for a
            glyph with font data for the primary font, presumably to meet the SVG
            spec requirement: "If the references to alternate glyphs do not result
            in successful identification of alternate glyphs to use, then the
            character(s) that are inside of the 窶和ltGlyph窶?element are rendered as
            if the 窶和ltGlyph窶?element were a 窶?span窶?element instead."

            If the alt glyph is not then found we are in the case from the spec
            and indeed we should use the primary font. However, we end up replacing the GlyphPage
            entry for the character with primary font data, which we should not do
            because the glyph page might be used in some place that does not have
            the alt glyph tag.

            Furthermore, this causes object lifetime problems for font data, because
            in cases where the font data that is replaced is for the system fallback
            font the GlyphPage will live forever with no knowldege that it contains
            font data pointers into font data other that the system fallback. The
            replaced font data may be deleted while the pointer lives on in the
            system fallback page.

            The fix is simply not to replace the font data in the page.

            Test: svg/text/alt-glpyh-on-fallback-font-crash.html

            * rendering/svg/SVGTextRunRenderingContext.cpp:
            (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter): Keep track of the original font data and put it back
            in the glyph page when the method has finished.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r142657

    2013-02-12  Levi Weintraub  <leviw@chromium.org>

            ASSERTION FAILED: !object || object->isBox(), UNKNOWN in WebCore::RenderListItem::positionListMarker
            https://bugs.webkit.org/show_bug.cgi?id=108699

            Reviewed by Abhishek Arya.

            RenderListItems performs special management of its children to maintain list markers. Splitting a flow
            through a list item results in assumptions made inside RenderListItem failing, so for now, avoid splitting
            flows when inside one.

            Test: fast/multicol/span/list-multi-column-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::containingColumnsBlock):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140558

    2013-01-17  Roger Fong  <roger_fong@apple.com>

            [Win] Remove dependence on Microsoft Embedded OpenType Font Engine (T2EMBED.DLL)  from FontCustomPlatformData.cpp.
            https://bugs.webkit.org/show_bug.cgi?id=107153

            Reviewed by Dan Bernstein.

            * platform/graphics/win/FontCustomPlatformData.cpp:
            (WebCore):
            (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
            (WebCore::FontCustomPlatformData::fontPlatformData):
            (WebCore::createFontCustomPlatformData):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r142539

    2013-02-11  Emil A Eklund  <eae@chromium.org>

            Change RenderFrameSet::paint to use m-rows/m_cols directly.
            https://bugs.webkit.org/show_bug.cgi?id=108503

            Reviewed by Eric Seidel.

            Test: fast/frames/invalid-frameset.html

            * rendering/RenderFrameSet.cpp:
            (WebCore::RenderFrameSet::paint):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r142365

    2013-02-09  Philip Rogers  <pdr@google.com>

            Sanitize m_keyTimes for paced value animations
            https://bugs.webkit.org/show_bug.cgi?id=108828

            Reviewed by Dirk Schulze.

            SVG animations with calcMode=paced calculate new m_keyTimes in
            SVGAnimationElement::calculateKeyTimesForCalcModePaced() because paced animations do not
            specify keyTimes. If an error occurs while calculating m_keyTimes, and there exists
            user-specified values, a crash could occur because the user-specified values were not
            sanitized.

            This change clears user-specified keyTimes before calculating new ones.

            Test: svg/animations/animate-keytimes-crash.html

            * svg/SVGAnimationElement.cpp:
            (WebCore::SVGAnimationElement::calculateKeyTimesForCalcModePaced):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r142358

    2013-02-09  Kent Tamura  <tkent@chromium.org>

            Fix crash by img[ismap] with content property
            https://bugs.webkit.org/show_bug.cgi?id=108702

            Reviewed by Adam Barth.

            Test: fast/dom/HTMLAnchorElement/anchor-ismap-crash.html

            * html/HTMLAnchorElement.cpp:
            (WebCore::appendServerMapMousePosition):
            Check if the renderer of an img element is RenderImage.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r141858

    2013-02-04  Kent Tamura  <tkent@chromium.org>

            Fix crash by <select> type change on focus
            https://bugs.webkit.org/show_bug.cgi?id=108830

            Reviewed by Abhishek Arya.

            Test: fast/forms/select/select-change-type-on-focus.html

            * html/HTMLSelectElement.cpp:
            (WebCore::HTMLSelectElement::menuListDefaultEventHandler):
            focus() calls may change the renderer type.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r141851

    2013-02-04  Wei James  <james.wei@intel.com>

            Heap-buffer-overflow in WebCore::AudioBufferSourceNode::process
            https://bugs.webkit.org/show_bug.cgi?id=108515

            After calling setBuffer() with a buffer having a different number of
            channels, there can in rare cases be a slight delay before the output
            bus is updated to the new number of channels because of use of
            tryLocks() in the context's updating system.
            In this case, if the the buffer has just been changed and we're
            not quite ready yet then just output silence.

            Reviewed by Chris Rogers.

            * Modules/webaudio/AudioBufferSourceNode.cpp:
            (WebCore::AudioBufferSourceNode::process):
            (WebCore::AudioBufferSourceNode::renderFromBuffer):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140879

    2013-01-25  Raymond Toy  <rtoy@google.com>

            Don't subtract too much from nonSilentFramesToProcess
            https://bugs.webkit.org/show_bug.cgi?id=107966

            Reviewed by Kenneth Russell.

            No new tests.

            * Modules/webaudio/AudioScheduledSourceNode.cpp:
            (WebCore::AudioScheduledSourceNode::updateSchedulingInfo):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140520

    2013-01-23  Hajime Morrita  <morrita@google.com>

            Invalidated SVG shadow tree should be always detached.
            https://bugs.webkit.org/show_bug.cgi?id=107634

            Reviewed by Ryosuke Niwa.

            SVGUseElement::clearResourceReferences() uses removeAllChildren() for
            clearing its shadow DOM, but this is wrong.
            removeAllChildren() is designed for removing children of an out-of-document Node.
            For efficiency, it skips a series of cleanup sequences like detach().

            For removing SVG shadow tree which is in Document, removeChildren() should be used.
            It does proper cleanup for the chilren.

            Test: svg/custom/use-invalidate-click-crash.xhtml

            * svg/SVGUseElement.cpp:
            (WebCore::SVGUseElement::clearResourceReferences):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140101

    2013-01-17  Rafael Weinstein  <rafaelw@chromium.org>

            Ensure the parser adopts foster-parented children into the document of their parent.
            https://bugs.webkit.org/show_bug.cgi?id=107023

            Reviewed by Adam Barth.

            Tests: fast/parser/foster-parent-adopted.html
                   fast/parser/foster-parent-adopted2.html

            * html/parser/HTMLConstructionSite.cpp:
            (WebCore::HTMLConstructionSite::insertTextNode):
            (WebCore::HTMLConstructionSite::fosterParent):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140069

    2013-01-17  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::RenderBlock::checkFloatsInCleanLine
            https://bugs.webkit.org/show_bug.cgi?id=90802

            Reviewed by Julien Chaffraix.

            Test: fast/multicol/float-not-removed-crash.html

            * rendering/RenderBoxModelObject.cpp:
            (WebCore::RenderBoxModelObject::moveChildrenTo):
            1. When fullRemoveInsert is True, make sure to clear the
            floating objects from our list (similar to positioned objects).
            Our children are getting moved to another block and we won't
            get notified when they are going away.
            2. Remove the redundant hasPositionedObjects check since it
            is already done inside removePositionedObjects.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r139788

    2013-01-15  Elliott Sprehn  <esprehn@chromium.org>

            Heap-use-after-free in WebCore::RenderObject::willBeRemovedFromTree
            https://bugs.webkit.org/show_bug.cgi?id=106384

            Reviewed by Abhishek Arya.

            Always walk up from beforeChild until the parent() is the owner of the
            child list, otherwise we can end up in situations where
            newChild->parent() == owner but newChild->nextSibling()->parent() != owner
            which is a recipe for security bugs. Previously we only walked up through
            anonymous blocks, but missed anonymous inline blocks like those generated
            by <ruby>.

            Test: fast/css-generated-content/bug-106384.html

            * rendering/RenderObjectChildList.cpp:
            (WebCore::RenderObjectChildList::insertChildNode):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r139551

    2013-01-12  Gavin Peters  <gavinp@chromium.org>

            Regression(r119759): Heap-use-after-free in webkit_glue::WebURLLoaderImpl::Context::OnReceivedResponse
            https://bugs.webkit.org/show_bug.cgi?id=103563

            A subresource could receive a body on a 404 if its call to CachedResource::error() resulted in a nested message loop.
            That caused a crash when data was received, as the Subresource was in the Finished state already. Now when receiving
            data we ignore these bodies, avoiding the crash.

            Reviewed by Nate Chapin.

            No new tests in WebKit, since it required a nested message loop which isn't present in chromium DumpRender tree.
            There's a Chrome side browser test, see https://codereview.chromium.org/11778083/

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::checkForHTTPStatusCodeError):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r139457

    2013-01-11  Florin Malita  <fmalita@chromium.org>

            [SVG] Suppress resource rebuilding for unattached and shadow elements
            https://bugs.webkit.org/show_bug.cgi?id=106664

            Reviewed by Dirk Schulze.

            SVGStyledElement::buildPendingResourcesIfNeeded() can be called while cloning a subtree
            (as nodes are inserted into the clone, while still detached) or when elements are inserted
            into the shadow tree. Both of these cases are problematic for SVGUseElement and can trigger
            indirect recursion in SVGUseElement::buildPendingResource.

            Since shadow and !inDocument() nodes are of no interest to ID dependents (they cannot be
            found by ID in the document), the patch short-circuits buildPendingResource() for these
            cases.

            Test: svg/custom/use-rebuild-resources-crash.svg

            * svg/SVGStyledElement.cpp:
            (WebCore::SVGStyledElement::buildPendingResourcesIfNeeded):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138994

    2013-01-07  Justin Novosad  <junov@google.com>

            Fixing memory read after free in CanvasRenderingContext2D::accessFont
            https://bugs.webkit.org/show_bug.cgi?id=106244

            Reviewed by Abhishek Arya.

            Using a temporary String object to hold ref count on string that is
            passed by reference in CanvasRenderingContext2D::accessFont.

            Test: fast/canvas/canvas-measureText.html

            * html/canvas/CanvasRenderingContext2D.cpp:
            (WebCore::CanvasRenderingContext2D::accessFont):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138926

    2013-01-06  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in DocumentLoader::stopLoading
            https://bugs.webkit.org/show_bug.cgi?id=103656

            Reviewed by Eric Seidel.

            Test: fast/dom/ready-state-change-crash.html

            * html/parser/HTMLDocumentParser.cpp:
            (WebCore::HTMLDocumentParser::prepareToStopParsing): Bail out
            if the parser is detached due to mutation event.
            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::stopLoading): Move the protectors for
            frame and document loader to the start of the function. Call to
            m_frame->loader()->stopLoading() can change document ready state
            and fire mutation event which might blow the document loader from
            underneath.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138918

    2013-01-06  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::Document::implicitClose
            https://bugs.webkit.org/show_bug.cgi?id=105655

            Reviewed by Eric Seidel.

            Test: fast/dom/window-load-crash.html

            * dom/Document.cpp:
            (WebCore::Document::implicitClose): RefPtr protect |this| document since it
            can be destroyed in the dispatchWindowLoadEvent call.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138863

    2013-01-04  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::XMLDocumentParser::doEnd
            https://bugs.webkit.org/show_bug.cgi?id=100152

            Reviewed by Adam Barth.

            XMLDocumentParser can be blown away inside document()->styleResolverChanged()
            call. Protect it with a local RefPtr in Document::explitClose.    

            No new tests. The site specific dependencies are hard to minimize.

            * dom/Document.cpp:
            (WebCore::Document::explicitClose): RefPtr m_parser into a local, since
            it can be detached and nulled out in DocumentWriter::end().
            * xml/parser/XMLDocumentParser.cpp:
            (WebCore::XMLDocumentParser::end): Bail out when we are detached.
            * xml/parser/XMLDocumentParserLibxml2.cpp:
            (WebCore::XMLDocumentParser::doEnd): Bail out when we are detached.
            * xml/parser/XMLDocumentParserQt.cpp:
            (WebCore::XMLDocumentParser::doEnd): Bail out when we are detached.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138850

    2013-01-04  Abhishek Arya  <inferno@chromium.org>

            Crash in WebCore::RenderBlock::willBeDestroyed
            https://bugs.webkit.org/show_bug.cgi?id=103455

            Reviewed by Eric Seidel.

            It is not required to set beforeChild to :after child since DOM is
            now pseudo element aware. See trac.webkit.org/changeset/137336. We
            were incorrectly placing the inline continuation before the :after
            content.       

            Test: fast/multicol/continuation-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): remove beforeChild
            setting to afterPseudoElementRenderer.
            * rendering/RenderRuby.cpp:
            (WebCore::RenderRubyAsInline::addChild): add missing beforeChild argument.
            setting to afterPseudoElementRenderer.
            (WebCore::RenderRubyAsBlock::addChild): add missing beforeChild argument.
            * rendering/RenderTable.cpp:
            (WebCore::RenderTable::addChild): remove beforeChild
            setting to afterPseudoElementRenderer.
            * rendering/RenderTableRow.cpp:
            (WebCore::RenderTableRow::addChild): remove beforeChild
            setting to afterPseudoElementRenderer.
            * rendering/RenderTableSection.cpp:
            (WebCore::RenderTableSection::addChild): remove beforeChild
            setting to afterPseudoElementRenderer.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138812

    2013-01-04  John Mellor  <johnme@chromium.org>

            Early out from FontCache::releaseFontData if cached font data not found.
            https://bugs.webkit.org/show_bug.cgi?id=106104

            Reviewed by Abhishek Arya.

            No tests, as no change in behavior.

            * platform/graphics/FontCache.cpp:
            (WebCore::FontCache::releaseFontData):

                Early out in release builds if cached font data not found.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138657

    2013-01-02  Abhishek Arya  <inferno@chromium.org>

            Crash in WebCore::Element::cloneElementWithoutChildren.
            https://bugs.webkit.org/show_bug.cgi?id=105949

            Reviewed by Ryosuke Niwa.

            RefPtr |ancestors| vector since its elements can be destroyed from mutation events
            fired in CompositeEditCommand::appendNode. 

            No new tests. The testcase relies on recursive DOM mutations and does not minimize.

            * editing/InsertParagraphSeparatorCommand.cpp:
            (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock):
            (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock):
            (WebCore::InsertParagraphSeparatorCommand::doApply):
            * editing/InsertParagraphSeparatorCommand.h:
            (InsertParagraphSeparatorCommand):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138316

    2012-12-20  Stephen Chenney  <schenney@chromium.org>

            SVG: <altglpyh> for a surrogate pair character in a ligature fails
            https://bugs.webkit.org/show_bug.cgi?id=102969

            Reviewed by Dirk Schulze.

            There are two issues with SVG <altglyph> tags applied to surrogate
            fonts, particularly when mixed with non-standard forms (arabic,
            vertical, etc.).

            First, there is an assertion that is invalid when an alt glyph is
            substituted for the surrogate, because the text chunk that is consumed
            by an alt glyph is the entire run, whereas we assert that a
            surrogate's chunk is length 2 regardless. That assertion has been
            removed.

            Second, when an arabic character or some other characters requiring a
            special form appears before the surrogate pair character inside the alt
            glyph tag, we reject the alt glyph because it is not compatible with the form.
            However, when we process the next character - the surrogate pair - we
            do accept the alt glyph. This breaks all the indexes because we have
            already consumed part of the run that is now considered the alt glyph.
            Chaos ensues. This patch forces us to always accept alt glyph
            characters (assuming we have some glyph to draw). This better matches
            the intent of the spec - if someone specifies an alt glyph they are
            explicitly stating which glyph they want used. We should not argue
            with the content author.

            Tests: svg/text/alt-glyph-for-surrogate-pair-expected.svg
                   svg/text/alt-glyph-for-surrogate-pair.svg

            * rendering/svg/SVGTextLayoutEngine.cpp:
            (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath): Fix some poor code.
            * rendering/svg/SVGTextMetricsBuilder.cpp:
            (WebCore::SVGTextMetricsBuilder::advanceSimpleText): Remove an assert that is not always valid.
            * svg/SVGFontData.cpp:
            (WebCore::SVGFontData::applySVGGlyphSelection): Always return an altGlyph when found. Do not check it compatibility.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r137464

    2012-12-12  Alexander Pavlov  <apavlov@chromium.org>

            Web Inspector: [Crash] Clear cached stylesheet rules in InspectorStyleSheet::deleteRule()
            https://bugs.webkit.org/show_bug.cgi?id=104806

            Reviewed by Vsevolod Vlasov.

            Cached rules (m_flatRules) should get cleared whenever a rule is deleted.

            Test: inspector/styles/undo-add-rule-crash.html

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::deleteRule):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136560

    2012-12-04  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
            https://bugs.webkit.org/show_bug.cgi?id=100621

            Reviewed by Eric Seidel.

            r115639 fixed a memory leak caused by reference cycle between StyleCachedImageSet
            and its owner CSSImageSetValue. The fix caused StyleCachedImageSet to maintain
            a weak pointer to CSSImageSetValue. This patch makes sure that the weak pointer
            is cleared when CSSImageSetValue is going away.

            Test: fast/css/image-set-value-not-removed-crash.html

            * css/CSSImageSetValue.cpp:
            (WebCore::CSSImageSetValue::~CSSImageSetValue):
            * rendering/style/StyleCachedImageSet.h:
            (WebCore::StyleCachedImageSet::clearImageSetValue):
            (StyleCachedImageSet):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136558

    2012-12-04  Abhishek Arya  <inferno@chromium.org>

            Crash in CachedResource::checkNotify due to -webkit-crossfade.
            https://bugs.webkit.org/show_bug.cgi?id=98068

            Reviewed by Nate Chapin.

            Make sure to not re-add the same client again for |m_cachedFromImage|
            and |m_cachedToImage|. This would otherwise cause the CSSCrossfadeValue
            client to not get removed from its cached image resource (when it is
            going away).

            Test: fast/images/crossfade-client-not-removed-crash.html

            * css/CSSCrossfadeValue.cpp:
            (WebCore::CSSCrossfadeValue::loadSubimages):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136541

    2012-12-04  Florin Malita  <fmalita@chromium.org>

            Stale SVGUseElement reference in CachedResource::checkNotify()
            https://bugs.webkit.org/show_bug.cgi?id=104004

            Reviewed by Eric Seidel.

            SVGUseElement tracks one CachedSVGDocument at a time (for external references), but when
            the href attribute is updated it fails to unregister with the current CachedSVGDocument
            and only updates its CachedSVGDocument with the new instance. This leaves an untracked
            reference with the original CachedSVGDocument.

            The patch adds the missing removeClient() call on href change, and encapsulates the
            CachedSVGDocument manipulation in a helper method which handles the necessary cleanup.

            Test: svg/custom/use-href-update-crash.svg

            * svg/SVGUseElement.cpp:
            (WebCore::SVGUseElement::~SVGUseElement):
            (WebCore::SVGUseElement::svgAttributeChanged):
            (WebCore::SVGUseElement::setCachedDocument):
            (WebCore):
            * svg/SVGUseElement.h:
            (SVGUseElement):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136253

    2012-11-30  Abhishek Arya  <inferno@chromium.org>

            Crash due to intruding float not removed after writing mode changed.
            https://bugs.webkit.org/show_bug.cgi?id=100149

            Reviewed by Levi Weintraub.

            When RenderView writing mode changes, make sure to mark all descendants
            with floats for layout.

            Test: fast/block/float/intruding-float-not-removed-writing-mode.xhtml

            * rendering/RenderBox.cpp:
            (WebCore::RenderBox::styleDidChange):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136074

    2012-11-28  Kenichi Ishibashi  <bashi@chromium.org>

            StyleResolver should not set NaN to font size
            https://bugs.webkit.org/show_bug.cgi?id=99506

            Reviewed by Abhishek Arya.

            fixedScaleFactor could be NaN since settings->defaultFixedFontSize()
            and settings->defaultFontSize() are zero in some case. This turns
            out setting NaN to font size. Add a zero checks so that
            fixedScaleFactor won't be NaN.

            Test: fast/css/font-size-nan.html

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::checkForGenericFamilyChange):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136061

    2012-11-28  Tom Sepez  <tsepez@chromium.org>

            XSSAuditor bypass with script src=data: URL ending in <!--
            https://bugs.webkit.org/show_bug.cgi?id=103548

            Reviewed by Adam Barth.

            This fixes an additional case where characters from the page itself are
            included with the snippet to match against the reflected vector, and the
            JS remains legitimate because of a <!--- comment. Truncate the snippet at
            such a comment.

            Test: http/tests/security/xssAuditor/script-tag-with-source-data-url3.html

            * html/parser/XSSAuditor.cpp:
            (WebCore::XSSAuditor::decodedSnippetForAttribute):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136060

    2012-11-28  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
            https://bugs.webkit.org/show_bug.cgi?id=101970

            Reviewed by David Hyatt.

            RenderInline::splitFlow and RenderBlock::splitFlow re-use |pre|
            block in some cases. In those cases, |pre| might hold floating objects
            and those floating descendants might get moved to |post| block. If
            the |pre| block does not get a layout later, then the floating
            descendant will never get removed since it is now part of |post|
            ancestor chain. We don't want failing-to-layout bugs turned into
            security bugs and hence clear floating objects list since we expect
            it to be rebuilt in subsequent layout.

            Test: fast/block/float/float-not-removed-from-pre-block.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::splitFlow): Call removeFloatingObjects on |pre| block.
            (WebCore::RenderBlock::removeFloatingObjects): Clear all floating objects from our list.
            (WebCore):
            * rendering/RenderBlock.h: 
            (RenderBlock):
            * rendering/RenderInline.cpp:
            (WebCore::RenderInline::splitFlow): Call removeFloatingObjects on |pre| block.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135719

    2012-11-26  Florin Malita  <fmalita@chromium.org>

            RenderSVGResourceContainer does not clear cached data on removal
            https://bugs.webkit.org/show_bug.cgi?id=102620

            Reviewed by Dirk Schulze.

            RenderSVGResourceContainer::removeClient needs to also remove the client from specialized
            caches, otherwise we can end up with stale references.

            Test: svg/custom/stale-resource-data-crash.svg

            * rendering/svg/RenderSVGResourceContainer.cpp:
            (WebCore::RenderSVGResourceContainer::removeClient):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135478

    2012-11-21  Cosmin Truta  <ctruta@rim.com>

            Numeric identifiers of events should not be globally sequential
            https://bugs.webkit.org/show_bug.cgi?id=102244

            Reviewed by Alexey Proskuryakov.

            The functions setTimeout, setInterval and navigator.geolocation.watchPosition
            are currently returning values that are unique across all JavaScript execution
            contexts, due to their dependency on global variables.
            Such a guarantee is unnecessarily strong. In this patch, we constrain uniqueness
            to these functions' own script execution context only.

            Tests: fast/dom/Geolocation/watchPosition-unique.html
                   fast/dom/Window/setTimeout-setInterval-unique.html

            * Modules/geolocation/Geolocation.cpp:
            (WebCore): Remove firstAvailableWatchId.
            (WebCore::Geolocation::watchPosition): Get new watchID from script execution context.
            (WebCore::Geolocation::clearWatch): Invalid watchID means less than or equal to 0.
            * Modules/geolocation/Geolocation.h:
            (Geolocation): Renamed the argument of Geolocation::clearWatch to WatchID.
            * dom/ScriptExecutionContext.cpp:
            (WebCore::ScriptExecutionContext::ScriptExecutionContext): Update initialization.
            (WebCore::ScriptExecutionContext::newUniqueID): Add.
            * dom/ScriptExecutionContext.h:
            (ScriptExecutionContext): Add m_sequentialID.
            (WebCore::ScriptExecutionContext::addTimeout): Inline.
            (WebCore::ScriptExecutionContext::removeTimeout): Inline.
            (WebCore::ScriptExecutionContext::findTimeout): Inline.
            * page/DOMTimer.cpp:
            (WebCore): Remove timeoutId.
            (WebCore::DOMTimer::DOMTimer): Get new timeoutId from script execution context.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135303

    2012-11-20  Abhishek Arya  <inferno@chromium.org>

            Crash in FrameLoader::stopLoading.
            https://bugs.webkit.org/show_bug.cgi?id=99504

            Reviewed by Nate Chapin.

            Frame can be blown away in unload event handler. Need
            to protect it with a RefPtr.

            Test: fast/frames/frame-unload-crash2.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::commitProvisionalLoad):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135299

    2012-11-20  Tom Sepez  <tsepez@chromium.org>

            XSSAuditor::decodedSnippetForJavaScript stopping when comma encountered.
            https://bugs.webkit.org/show_bug.cgi?id=102587

            Reviewed by Adam Barth.

            Rather than returning an empty fragment, continue processing the body
            of a script tag when the decoded fragment reduces to nothing.

            Test: http/tests/security/xssAuditor/script-tag-with-actual-comma.html

            * html/parser/XSSAuditor.cpp:
            (WebCore::XSSAuditor::decodedSnippetForJavaScript):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135193

    2012-11-19  Abhishek Arya  <inferno@chromium.org>

            Crash in ApplyStyleCommand::cleanupUnstyledAppleStyleSpans.
            https://bugs.webkit.org/show_bug.cgi?id=100150

            Reviewed by Ryosuke Niwa.

            RefPtr startDummySpanAncestor and endDummySpanAncestor since
            they can go away inside fixRangeAndApplyInlineStyle call.

            Test: editing/style/apply-style-crash.html

            * editing/ApplyStyleCommand.cpp:
            (WebCore::ApplyStyleCommand::applyInlineStyle):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r133717

    2012-11-06  Ken Buchanan  <kenrb@chromium.org>

            Crash due to column span under button element
            https://bugs.webkit.org/show_bug.cgi?id=101402

            Reviewed by Abhishek Arya.

            When there is a column-spanning child of a RenderButton
            splitBlocks() must split the RenderButton as well as its
            only permitted direct child, the anonymous block referenced
            by m_inner. A crash was occurring because splitBlocks()
            calls addChildIgnoringAnonymousColumnBlocks() to add the
            cloned m_inner to the cloned RenderButton, which meant the
            m_inner for the cloned RenderButton was not being set even
            though a child was being added. This violates state
            assumptions in the RenderButton code.

            This patch prevents any descendants of RenderButton from
            spanning columns. Also, it adds a precautionary check in
            RenderButton::removeChild() to mitigate problems if similar
            state problems are found in future.

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::containingColumnsBlock):
            * rendering/RenderButton.cpp:
            (WebCore::RenderButton::removeChild):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r133686

    2012-11-06  Simon Fraser  <simon.fraser@apple.com>

            -webkit-background-clip:text produces artifacts when applied to the body and the browser is resized
            https://bugs.webkit.org/show_bug.cgi?id=89287

            Reviewed by Beth Dakin.

            If the body had -webkit-background-clip: text, we'd fail to paint
            anything behind it, so would see garbage pixels.

            Fix by having RenderView::paintBoxDecorations() check for a background-clip of "text"
            on the renderer that paints the root background.

            Added some new pixel tests for combinations of html and body transform
            and backgrounds; earlier versions of the patch broke some of these tests.

            Tests: fast/backgrounds/background-clip-text-on-body.html
                   fast/backgrounds/transformed-body-background.html
                   fast/backgrounds/transformed-body-html-background.html
                   fast/backgrounds/transformed-html-body-background.html

            * rendering/RenderView.cpp:
            (WebCore::rendererObscuresBackground): Broke up the single condition
            into early 'false' returns when possible. We need to also check whether
            the renderer that actually paints the background (which might be the body)
            will fill it; background-clip: text does not.
            (WebCore::RenderView::paintBoxDecorations): Rather than checking firstChild(),
            actually check the root renderer, so that we can reliably get to the renderer
            that mains the root background.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r133155

    2012-11-01  Stephen Chenney  <schenney@chromium.org>

            SVG as an image may recreate the renderer on zoom
            https://bugs.webkit.org/show_bug.cgi?id=99508

            Reviewed by Abhishek Arya.

            The SVGImage code, when SVG is used in <img> tags, caches the renderer
            at the start of the painting method and re-uses the pointer at the end
            of the method. However, when the page is zoomed the renderer may be
            detached mid-method, thus leaving a stray pointer. The fix is to
            re-fetch the pointer after the zooms.

            Test: svg/as-image/img-zoom-svg-stylesheet.html

            * svg/graphics/SVGImage.cpp:
            (WebCore::SVGImage::drawSVGToImageBuffer): Re-fetch the renderer after
            the zoom operations.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r132983

    2012-10-30  Kent Tamura  <tkent@chromium.org>

            Delaying 'change' and 'input' event dispatching during HTMLInputElement::setValue
            https://bugs.webkit.org/show_bug.cgi?id=100772

            Reviewed by Abhishek Arya.

            'change' and 'input' events are asynchronous and not
            cancelable. We can use ScopedEvent.

            Test: fast/forms/range/range-type-change-onchange.html

            * dom/Node.cpp:
            (WebCore::Node::dispatchChangeEvent): Use dispatchScopedEvent.
            (WebCore::Node::dispatchInputEvent): Ditto.
            * html/HTMLInputElement.cpp:
            (WebCore::HTMLInputElement::setValue):
            Make a scope to delay event dispatching.
            * html/RangeInputType.cpp:
            (WebCore::RangeInputType::handleKeydownEvent): Ditto.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r132462

    2012-10-25  Alexander Pavlov  <apavlov@chromium.org>

            Web Inspector: Improper out-of-order call on a rule that is being removed from the stylesheet.
            https://bugs.webkit.org/show_bug.cgi?id=100357

            Reviewed by Vsevolod Vlasov.

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::deleteRule):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r132398

    2012-10-24  Ami Fischman  <fischman@chromium.org>

            call to setNeedsLayout during RenderVideo::paintReplaced
            https://bugs.webkit.org/show_bug.cgi?id=100265

            Reviewed by Eric Carlson.

            Removed unnecessary call and added new defensive guards to catch erroneous setNeedsLayout() calls
            during paints earlier (so the offending calls are in the emitted stacktrace).

            No new tests - new defensive checks are triggered by existing tests.

            * page/FrameView.cpp:
            (WebCore::FrameView::paintContents): forbid setNeedsLayout() during painting
            * rendering/RenderObject.cpp:
            (WebCore):
            (WebCore::RenderObject::SetLayoutNeededForbiddenScope::SetLayoutNeededForbiddenScope):
            (WebCore::RenderObject::SetLayoutNeededForbiddenScope::~SetLayoutNeededForbiddenScope):
            * rendering/RenderObject.h:
            (RenderObject):
            (SetLayoutNeededForbiddenScope): added helper class for forbidding setNeedsLayout() in a scope.
            * rendering/RenderVideo.cpp:
            (WebCore::RenderVideo::paintReplaced): drop the offending & unnecessary call to updatePlayer().

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r131578

    2012-10-17  Alexander Pavlov  <apavlov@chromium.org>

            Web Inspector: Avoid style updates when retrieving the inline stylesheet text
            https://bugs.webkit.org/show_bug.cgi?id=99576

            Reviewed by Vsevolod Vlasov.

            Avoid using innerText() to retrieve inline stylesheet text, which may result in style and layout updates.

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::inlineStyleSheetText):

== Rolled over to ChangeLog-2013-03-12 ==
