2013-02-14  Christophe Dumez  <ch.dumez@sisa.samsung.com>

       Add addHTTPHeaderField() method to ResourceResponse
       https://bugs.webkit.org/show_bug.cgi?id=109844

       Reviewed by Adam Barth.

       ResourceRequestBase provides both setHTTPHeaderField() and addHTTPHeaderField(). However,
       ResourceResponseBase only provides setHTTPHeaderField(). This is a bit inconsistent. As a
       result, the addHTTPHeaderField() functionality's implementation is duplicated in several
       ports (at least chromium and soup).

       This patch introduces addHTTPHeaderField() to ResourceResponseBase and makes use of it
       in Chromium and Soup backends.

       No new tests, no behavior change.

       * platform/chromium/support/WebURLResponse.cpp:
       (WebKit::WebURLResponse::addHTTPHeaderField): Use ResourceResponseBase::addHTTPHeaderField().
       * platform/network/ResourceResponseBase.cpp:
       (WebCore::ResourceResponseBase::updateHeaderParsedState): Move headers' parsed state update code
       from setHTTPHeaderField() to a new updateHeaderParsedState() method to avoid code duplication.
       (WebCore):
       (WebCore::ResourceResponseBase::setHTTPHeaderField):
       (WebCore::ResourceResponseBase::addHTTPHeaderField):
       * platform/network/ResourceResponseBase.h:
       (ResourceResponseBase):
       * platform/network/soup/ResourceResponseSoup.cpp:
       (WebCore::ResourceResponse::updateFromSoupMessageHeaders): Use ResourceResponseBase::addHTTPHeaderField().


2014-08-18  Renata Hodovan  <rhodovan.u-szeged@partner.samsung.com>

        Fix keyTimes list length of from/to/by animations.
        https://bugs.webkit.org/show_bug.cgi?id=136037

        Reviewed by Darin Adler.

        For from/to/by animations, the length of keyTimes and keyPoints
        attribute if are specified must be equal and must have at least
        2 values.

        This is backport of my fix in Blink: https://codereview.chromium.org/453243003/

        Test: svg/animations/invalid-keytime-number-crash.html

        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::startedActiveInterval):

2013-02-28  Nate Chapin  <japhet@chromium.org>

        Crash in CachedRawResource::responseReceived().
        https://bugs.webkit.org/show_bug.cgi?id=110482

        Reviewed by Adam Barth.

        Test: http/tests/security/XFrameOptions/x-frame-options-deny-multiple-clients.html

        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::responseReceived):

2012-09-21  Chris Rogers  <crogers@google.com>

        Add Web Audio support for deprecated/legacy APIs
        https://bugs.webkit.org/show_bug.cgi?id=97050

        Reviewed by Eric Carlson.

        The Web Audio API specification has undergone much review and some small API changes
        have been made (mostly naming-related changes).  This patch adds an ENABLE_LEGACY_WEB_AUDIO
        build option to allow ports to support the old names.

        Tests changed:
        audiobuffersource-playbackrate.html
        audiobuffersource.html
        note-grain-on-testing.js
        oscillator-testing.js

        * Configurations/FeatureDefines.xcconfig:
        * GNUmakefile.features.am:
        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::startGrain):
        (WebCore):
        (WebCore::AudioBufferSourceNode::noteGrainOn):
        * Modules/webaudio/AudioBufferSourceNode.h:
        (AudioBufferSourceNode):
        * Modules/webaudio/AudioBufferSourceNode.idl:
        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::start):
        (WebCore::AudioScheduledSourceNode::stop):
        (WebCore):
        (WebCore::AudioScheduledSourceNode::noteOn):
        (WebCore::AudioScheduledSourceNode::noteOff):
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/Oscillator.idl:
        * page/FeatureObserver.h:

2014-05-08  Jer Noble  <jer.noble@apple.com>

        [MSE][Mac] Move AVStreamDataParser off-main-thread.
        https://bugs.webkit.org/show_bug.cgi?id=132698

        Reviewed by Eric Carlson.

        -[AVStreamDataParser appendStreamData:] can casue the main thread to hang when a
        large amount of media data is appended at once. Move the actual parsing of data
        to a background (synchronous) dispatch queue, and split SourceBuffer::appendBufferTimerFired
        into two functions, the latter of which will be called after the background queue
        completes.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::appendBufferTimerFired): Split into sourceBufferPrivateAppendComplete.
        (WebCore::SourceBuffer::sourceBufferPrivateAppendComplete): Split from appendBufferTimerFired.
        * Modules/mediasource/SourceBuffer.h:
        * platform/graphics/SourceBufferPrivate.h:
        * platform/graphics/SourceBufferPrivateClient.h:
        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]): Re-dispatch to the
                web thread.
        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]): Ditto.
        (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]): Ditto.
        (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]): Ditto.
        (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]): Ditto.
        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]): Ditto.
        (WebCore::globalDataParserQueue): Added.
        (WebCore::SourceBufferPrivateAVFObjC::append): Dispatch to the globalDataParserQueue.
        (WebCore::SourceBufferPrivateAVFObjC::appendCompleted): Added.
        * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
        (WebCore::MockSourceBufferPrivate::append): Adopt sourceBufferPrivateAppendComplete.
        * platform/mock/mediasource/MockSourceBufferPrivate.h:

        Update SourceBufferPrivateGStreamer to match the new append return value:
        * platform/graphics/gstreamer/SourceBufferPrivateGStreamer.cpp:
        (WebCore::SourceBufferPrivateGStreamer::append):
        * platform/graphics/gstreamer/SourceBufferPrivateGStreamer.h:

2014-04-30  Jer Noble  <jer.noble@apple.com>

        [MSE] Seeking between two buffered ranges enquues incorrect buffers.
        https://bugs.webkit.org/show_bug.cgi?id=132416

        Reviewed by Eric Carlson.

        std::equal_range(begin, end, value) will return an empty range if equal values cannot
        be found. But the range is not necessarily [end, end).  It may be some other value n,
        such that the empty range is [n, n). Check to see if the returned range is empty in
        findSampleContainingPresentationTime() and its reverse version, and if so, explicitly
        return presentationEnd() or reversePresentationEnd() respectively.

        Drive-by fix: make the comparator functions take const& arguments to minimize object
        creation.

        * Modules/mediasource/SampleMap.cpp:
        (WebCore::SampleIsLessThanMediaTimeComparator::operator()):
        (WebCore::SampleIsGreaterThanMediaTimeComparator::operator()):
        (WebCore::SampleMap::findSampleContainingPresentationTime):
        (WebCore::SampleMap::reverseFindSampleContainingPresentationTime):

2014-04-16  Jer Noble  <jer.noble@apple.com>

        [MSE] Multiple initialization segments with same codecs in tracks fail validation.
        https://bugs.webkit.org/show_bug.cgi?id=131768

        Additional initialization segments added to the same SourceBuffer with the same
        codec values will fail validation. Update the validation check to add the correct
        codec information for the initial segment, and check against the correct codecs during
        the validation step.

        Additionally, after validation, if successful update the Audio, Video, and TextTracks
        for the SourceBuffer with the updated initialization segment information.

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-multiple-initialization-segments.html

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::appendBufferTimerFired): m_source may have been cleared
            as a result of the append, so check it before using.
        (WebCore::SourceBuffer::sourceBufferPrivateDidEndStream): Call streamEndedWithError
            instead of endOfStream as the latter is safe to call within an update.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment): Ditto.
            Update the track lists if validation succeeds.
        (WebCore::SourceBuffer::validateInitializationSegment): Switch the audio and video
            codec checks.

        Add the ability for Audio, Video, and InbandTextTracks to replace their private tracks:
        * html/track/AudioTrack.cpp:
        (WebCore::AudioTrack::AudioTrack): Call updateKindFromPrivate().
        (WebCore::AudioTrack::setPrivate):
        (WebCore::AudioTrack::updateKindFromPrivate): Split out from constructor.
        * html/track/AudioTrack.h:
        * html/track/InbandTextTrack.cpp:
        (WebCore::InbandTextTrack::InbandTextTrack): Call updateKindFromPrivate().
        (WebCore::InbandTextTrack::setPrivate):
        (WebCore::InbandTextTrack::setMode): Split up into setModeInternal().
        (WebCore::InbandTextTrack::setModeInternal): Broke out from setMode().
        (WebCore::InbandTextTrack::updateKindFromPrivate): Split out from constructor.
        * html/track/InbandTextTrack.h:
        * html/track/TextTrack.h:
        (WebCore::TextTrack::isInband): Added, returns false.
        * html/track/VideoTrack.cpp:
        (WebCore::VideoTrack::VideoTrack): Call updateKindFromPrivate().
        (WebCore::VideoTrack::setPrivate):
        (WebCore::VideoTrack::updateKindFromPrivate):  Split out from constructor.
        * html/track/VideoTrack.h:

2014-04-16  Jer Noble  <jer.noble@apple.com>

        [MSE] Seeks into buffered ranges will never complete.
        https://bugs.webkit.org/show_bug.cgi?id=131717

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-seek-complete.html

        Run the SourceBuffer Monitoring step after initiating a seek.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateSeekToTime):

2014-04-03  Jer Noble  <jer.noble@apple.com>

        [EME] Crash when passing a NULL initData to MediaKeys.createSession()
        https://bugs.webkit.org/show_bug.cgi?id=131156

        Reviewed by Eric Carlson.

        Update the checks at the start of createSession() to match the current spec, notably
        bailing early if the initData parameter is NULL or empty.

        * Modules/encryptedmedia/MediaKeys.cpp:
        (WebCore::MediaKeys::createSession):

2014-03-28  Jer Noble  <jer.noble@apple.com>

        [MSE] Implement support for SourceBuffer.remove()
        https://bugs.webkit.org/show_bug.cgi?id=121562

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-remove.html

        Add support for SourceBuffer.remove().

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::SourceBuffer): Initialize new member variables.
        (WebCore::SourceBuffer::setTimestampOffset): Update comments to match spec.
        (WebCore::SourceBuffer::remove): Added; start removeTimer.
        (WebCore::SourceBuffer::abortIfUpdating): Cancel removeTimer.
        (WebCore::SourceBuffer::removedFromMediaSource): Call abortIfUpdating().
        (WebCore::SourceBuffer::stop): Cancel removeTimer.
        (WebCore::SourceBuffer::removeCodedFrames): Added.
        (WebCore::SourceBuffer::removeTimerFired): Added.
        * Modules/mediasource/SourceBuffer.h:
        * Modules/mediasource/SourceBuffer.idl:

2014-03-17  Jer Noble  <jer.noble@apple.com>

        [EME] Add NULL protections in SourceBuffer and MediaSource.
        https://bugs.webkit.org/show_bug.cgi?id=130266

        Reviewed by Eric Carlson.

        Add NULL checks in places which may be called after a SourceBuffer has been removed:

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::monitorSourceBuffers): Protect against a SourceBuffer being removed
            (and thus activeSourceBuffers being empty) when monitoring source buffer state.
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::appendBufferTimerFired): Protect against SourceBuffer being removed.
        (WebCore::SourceBuffer::videoTracks): Ditto.
        (WebCore::SourceBuffer::audioTracks): Ditto.
        (WebCore::SourceBuffer::textTracks): Ditto.
        (WebCore::SourceBuffer::setActive): Ditto.
        (WebCore::SourceBuffer::sourceBufferPrivateDidEndStream): Ditto.
        (WebCore::SourceBuffer::hasCurrentTime): Ditto.
        (WebCore::SourceBuffer::canPlayThrough): Ditto.
        (WebCore::SourceBuffer::hasFutureTime): Ditto, and check for an empty buffered ranges.

2014-03-14  Jer Noble  <jer.noble@apple.com>

        [EME] Extend the lifetime of MediaKeySession.
        https://bugs.webkit.org/show_bug.cgi?id=129841

        Reviewed by Eric Carlson.

        Test: media/encrypted-media/encrypted-media-session-lifetime.html

        In anticipation of guidance to be added to the EME Spec <https://www.w3.org/Bugs/Public/show_bug.cgi?id=24771>,
        extend the lifetime of MediaKeySession by making the session an ActiveDOMObject, and returning true to
        hasPendingActivity when the session is both not closed and is associated with a live MediaKeys object.

        Additionally, keep the object from being destroyed while events are pending.

        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::MediaKeySession):
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/encryptedmedia/MediaKeySession.idl:

2014-03-05  Jer Noble  <jer.noble@apple.com>

        [MSE] Crash in SourceBuffer::sourceBufferPrivateDidReceiveSample() - received samples after SourceBuffer was removed.
        https://bugs.webkit.org/show_bug.cgi?id=129761

        Reviewed by Eric Carlson.

        Guard against the possibility that SourceBufferPrivates will continue to generate samples even after
        a parse error. Bail out early from sourceBufferPrivateDidReceiveInitializationSegment and
        sourceBufferPrivateDidReceiveSample if the SourceBuffer has been removed.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment):
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2014-02-28  Jer Noble  <jer.noble@apple.com>

        [MSE] YouTube videos fail to play
        https://bugs.webkit.org/show_bug.cgi?id=129525

        Reviewed by Darin Adler.

        Test: media/media-source/media-source-fudge-factor.html

        Add a very simple playability metric to SourceBuffer. Track the number of seconds buffered
        and use that metric to determine whether the MediaSource has buffered enough data to play
        through.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::currentTime): Added simple accessor.
        (WebCore::MediaSource::monitorSourceBuffers): Replace the functor-based iterators with lambdas.
        (WebCore::MediaSource::addSourceBuffer): Drive-by fix; only add new source buffers to the
            activeSourceBuffers list if those buffers are actually active.
        * Modules/mediasource/MediaSource.h:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::SourceBuffer): Initialize new ivars.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Measure the number of seconds buffered.
        (WebCore::SourceBuffer::monitorBufferingRate): Use a simple Exponential moving average to
            track the buffering rate.
        (WebCore::SourceBuffer::hasCurrentTime): Return true if the current time is within 1/24 s
            of a buffered range.
        (WebCore::SourceBuffer::hasFutureTime): Moved from MediaSource.
        (WebCore::SourceBuffer::canPlayThrough): Return true if the buffering rate is > 1s per
            second, or if the rate is sufficient to keep up over the remaining time.
        * Modules/mediasource/SourceBuffer.h:

2014-02-21  Eric Carlson  <eric.carlson@apple.com>

        Fix TimeRanges layering violations
        https://bugs.webkit.org/show_bug.cgi?id=128717

        Reviewed by Jer Noble.

        No new tests, no functionality changed.

        * CMakeLists.txt:
        * GNUmakefile.list.am: Add PlatformTimeRanges.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::buffered): TimeRanges -> PlatformTimeRanges.
        * Modules/mediasource/MediaSource.h:

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): TimeRanges* -> TimeRanges&.

        * WebCore.exp.in: Update for signature changes.

        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj: Add PlatformTimeRanges.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::percentLoaded): Create TimeRanges from PlatformTimeRanges.
        (WebCore::HTMLMediaElement::buffered): Ditto.
        (WebCore::HTMLMediaElement::seekable): Ditto.

        * html/MediaController.cpp:
        (MediaController::buffered): TimeRanges* -> TimeRanges&.
        (MediaController::seekable): Ditto.
        (MediaController::played): Ditto.

        Move all of the logic into PlatformTimeRanges. Change API to take TimeRanges& instead of TimeRanges*.
        * html/TimeRanges.cpp:
        (WebCore::TimeRanges::create): Move to .cpp from .h.
        (WebCore::TimeRanges::TimeRanges): Initialize the PlatformTimeRanges member variable.
        (WebCore::TimeRanges::start): Passthrough to PlatformTimeRanges.
        (WebCore::TimeRanges::end): Ditto.
        (WebCore::TimeRanges::invert): Ditto.
        (WebCore::TimeRanges::copy): Ditto.
        (WebCore::TimeRanges::intersectWith): Ditto.
        (WebCore::TimeRanges::unionWith): Ditto.
        (WebCore::TimeRanges::length): Ditto.
        (WebCore::TimeRanges::add): Ditto.
        (WebCore::TimeRanges::contain): Ditto.
        (WebCore::TimeRanges::find): Ditto.
        (WebCore::TimeRanges::nearest): Ditto.
        (WebCore::TimeRanges::totalDuration): Ditto.
        * html/TimeRanges.h:

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::buffered): TimeRanges -> PlatformTimeRanges.
        (WebCore::MediaPlayer::buffered): Ditto.
        (WebCore::MediaPlayer::seekable): Ditto.
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:

        * platform/graphics/MediaSourcePrivateClient.h:

        * platform/graphics/PlatformTimeRanges.cpp: Added.
        * platform/graphics/PlatformTimeRanges.h: Added.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::buffered): TimeRanges -> PlatformTimeRanges.
        (WebCore::MediaPlayerPrivateAVFoundation::loadedTimeRangesChanged): Drive-by fix to log
            FunctionType notifications. ASSERT when passed an unknown notification.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::MediaPlayerPrivateAVFoundationCF::platformBufferedTimeRanges):  TimeRanges -> PlatformTimeRanges.
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::currentTime): Ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformBufferedTimeRanges): Ditto.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekable): Ditto.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::buffered): Ditto.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::buffered): Ditto.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:

        * platform/graphics/ios/MediaPlayerPrivateIOS.h:
        * platform/graphics/ios/MediaPlayerPrivateIOS.mm:
        (WebCore::MediaPlayerPrivateIOS::buffered): Ditto.

        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::buffered): Ditto.

        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::buffered): Ditto.
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:

        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:

        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
        (WebCore::MockMediaPlayerMediaSource::buffered): Ditto.
        (WebCore::MockMediaPlayerMediaSource::advanceCurrentTime): Ditto.
        * platform/mock/mediasource/MockMediaPlayerMediaSource.h:

2014-03-02  Dirkjan Ochtman  <d.ochtman@activevideo.com>

        Support ENABLE_ENCRYPTED_MEDIA in cmake builds
        https://bugs.webkit.org/show_bug.cgi?id=129575

        Reviewed by Philippe Normand.

        No new tests, only fixes the build.

        * CMakeLists.txt:
        Add support for ENABLE_ENCRYPTED_MEDIA.
        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::close):
        Assign nullptr instead of 0 to OwnPtr to appease gcc-4.7.

2014-02-25  Jer Noble  <jer.noble@apple.com>

        [EME][Mac] Fix a few issues in CDMSessionMediaSourceAVFObjC.
        https://bugs.webkit.org/show_bug.cgi?id=129310

        Reviewed by Eric Carlson.

        Only send a 'keyerror' event if an actual error code was returned, not just
        when no key was added:
        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::addKeyTimerFired):

        The 'length' parameter to a typed ArrayBufferView is the number of entries
        in the array, not the byte length:
        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
        (WebCore::CDMSessionMediaSourceAVFObjC::generateKeyRequest):

        The return value of streamingContentKeyRequestDataForApp:contentIdentifier:trackId:options:error
        is autoreleased; do not wrap it in an adoptNS:
        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
        (WebCore::CDMSessionMediaSourceAVFObjC::update):

2014-02-21  Jer Noble  <jer.noble@apple.com>

        Make a generic CDMPrivateMediaPlayer and move its CDMSession into platform/.
        https://bugs.webkit.org/show_bug.cgi?id=129164

        Reviewed by Eric Carlson.

        Move the session created by CDMPrivateAVFoundation into platform, and rename
        CDMPrivateAVFoundation to CDMPrivateMediaPlayer. Future media engines who want
        to support a keysystem from within the media engine can create their own
        CDMSession as part of the MediaPlayerPrivate interface.

        * Modules/encryptedmedia/CDM.cpp:
        (WebCore::installedCDMFactories):
        (WebCore::CDM::createSession):
        * Modules/encryptedmedia/CDM.h:
        * Modules/encryptedmedia/CDMPrivate.h:
        * Modules/encryptedmedia/MediaKeySession.cpp:
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/encryptedmedia/CDMPrivateAVFoundation.mm: Removed.
        * Modules/encryptedmedia/CDMPrivateMediaPlayer.cpp: Renamed from Source/WebCore/Modules/encryptedmedia/CDMPrivateAVFoundation.cpp.
        (WebCore::CDMPrivateMediaPlayer::supportsKeySystem):
        (WebCore::CDMPrivateMediaPlayer::supportsKeySystemAndMimeType):
        (WebCore::CDMPrivateMediaPlayer::supportsMIMEType):
        (WebCore::CDMPrivateMediaPlayer::createSession):
        * Modules/encryptedmedia/CDMPrivateMediaPlayer.h: Renamed from Source/WebCore/Modules/encryptedmedia/CDMPrivateAVFoundation.h.
        (WebCore::CDMPrivateMediaPlayer::create):
        (WebCore::CDMPrivateMediaPlayer::~CDMPrivateMediaPlayer):
        (WebCore::CDMPrivateMediaPlayer::cdm):
        (WebCore::CDMPrivateMediaPlayer::CDMPrivateMediaPlayer):
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/CDMSession.h: Extracted from CDMPrivateAVFoundation.h.
        (WebCore::CDMSessionClient::~CDMSessionClient):
        (WebCore::CDMSession::CDMSession):
        (WebCore::CDMSession::~CDMSession):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::createSession):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::createSession):
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h: Renamed from Source/WebCore/Modules/encryptedmedia/CDMPrivateAVFoundation.h.
        (WebCore::CDMSessionAVFoundationObjC::~CDMSessionAVFoundationObjC):
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm: Renamed from Source/WebCore/Modules/encryptedmedia/CDMPrivateAVFoundation.mm.
        (WebCore::CDMSessionAVFoundationObjC::CDMSessionAVFoundationObjC):
        (WebCore::CDMSessionAVFoundationObjC::generateKeyRequest):
        (WebCore::CDMSessionAVFoundationObjC::releaseKeys):
        (WebCore::CDMSessionAVFoundationObjC::update):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createSession):
        * testing/MockCDM.cpp:
        (WebCore::MockCDMSession::setClient):
        (WebCore::MockCDM::createSession):
        * testing/MockCDM.h:

2014-02-21  Jer Noble  <jer.noble@apple.com>

        Add a supportsKeySystem media engine factory parameter.
        https://bugs.webkit.org/show_bug.cgi?id=129161

        Reviewed by Eric Carlson.

        Add a new parameter to the MediaPlayerFactory to allow registered media
        engines to be queried for keySystem support:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayerFactory::MediaPlayerFactory):
        (WebCore::MediaPlayer::supportsKeySystem):
        * platform/graphics/MediaPlayer.h:

        Support this new field in MediaPlayerPrivateAVFoundationObjC:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::registerMediaEngine):
        (WebCore::keySystemIsSupported):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsKeySystem):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::shouldWaitForLoadingOfResource):

        Add an empty field for SupportsKeySystem to the remaining media engines:
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::MediaPlayerPrivateAVFoundationCF::registerMediaEngine):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::registerMediaEngine):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::registerMediaEngine):
        * platform/graphics/ios/MediaPlayerPrivateIOS.mm:
        (WebCore::MediaPlayerPrivateIOS::registerMediaEngine):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::registerMediaEngine):
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::registerMediaEngine):
        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
        (WebCore::MockMediaPlayerMediaSource::registerMediaEngine):

2014-02-10  Jer Noble  <jer.noble@apple.com>

        [EME][Mac] Move the implementation of CDMPrivateAVFoundation back into MediaPlayerPrivateAVFoundationObjC.
        https://bugs.webkit.org/show_bug.cgi?id=128559

        Reviewed by Dean Jackson.

        To prepare for multiple simultaneous CDMs with muliple MediaPlayer types, move the implementation for
        CDMPrivateAVFoundation back into its media engine.

        * Modules/encryptedmedia/CDMPrivateAVFoundation.mm:
        (WebCore::MediaKeyExceptionToErrorCode): Added.
        (WebCore::CDMSessionAVFoundation::generateKeyRequest): Moved to MediaPlayerPrivateAVFoundationObjC.
        (WebCore::CDMSessionAVFoundation::releaseKeys): Ditto.
        (WebCore::CDMSessionAVFoundation::update): Ditto.
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::generateKeyRequest): Added, pass through to MediaPlayerPrivate.
        (WebCore::MediaPlayer::releaseKeys): Ditto.
        (WebCore::MediaPlayer::update): Ditto.
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::generateKeyRequest): Added.
        (WebCore::MediaPlayerPrivateInterface::releaseKeys): Ditto.
        (WebCore::MediaPlayerPrivateInterface::update): Ditto.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::generateKeyRequest): Moved from CDMSessionAVFoundation.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::releaseKeys): Ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::update): Ditto.

2014-02-10  Jer Noble  <jer.noble@apple.com>

        [MSE] Fix layering violations in MediaSource
        https://bugs.webkit.org/show_bug.cgi?id=128546

        Reviewed by Eric Carlson.

        Code in Modules should be considered part of html/ and should have the
        same layering properties. Get rid of HTMLMediaSource (which was intended
        to allow Modules/mediasource to be considered part of platform/) and add
        a new client interface allowing communication from platform/ -> 
        Modules/mediasource.

        Replace HTMLMediaSource -> MediaSourcePrivateClient:
        * html/HTMLMediaSource.cpp: Removed.
        * html/HTMLMediaSource.h: Removed.
        * platform/graphics/MediaSourcePrivateClient.h: Added.
        (WebCore::MediaSourcePrivateClient::~MediaSourcePrivateClient):

        Move registry support from HTMLMediaSource -> MediaSource.
        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::setRegistry): Moved from HTMLMediaSource.cpp.
        * Modules/mediasource/MediaSource.h:
        (WebCore::MediaSource::lookup): Ditto.

        Update references to HTMLMediaSource -> MediaSource:
        * Modules/mediasource/MediaSourceRegistry.cpp:
        (WebCore::MediaSourceRegistry::MediaSourceRegistry): 
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource):
        * html/HTMLMediaElement.h:

        Update references to HTMLMediaSource -> MediaSourcePrivateClient:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::load):
        (WebCore::MediaPlayer::load): Ditto.
        (WebCore::MediaPlayer::loadWithNextMediaEngine):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::load):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::load):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::load):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        * platform/graphics/gstreamer/MediaSourceGStreamer.cpp:
        (WebCore::MediaSourceGStreamer::open):
        * platform/graphics/gstreamer/MediaSourceGStreamer.h:
        * platform/graphics/ios/MediaPlayerPrivateIOS.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::load):
        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
        (WebCore::MockMediaPlayerMediaSource::load):
        * platform/mock/mediasource/MockMediaPlayerMediaSource.h:

2013-12-17  Jer Noble  <jer.noble@apple.com>

        [MSE] Periodically monitor source buffers.
        https://bugs.webkit.org/show_bug.cgi?id=125898

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-monitor-source-buffers.html

        The MSE spec requires that the SourceBuffer Monitoring step is run
        periodically during playback. No specific update interval is specified
        so we will re-use the existing HTMLMediaElement playback progress
        timer to signal the media source monitoring.

        * html/HTMLMediaElement.cpp:
        (HTMLMediaElement::playbackProgressTimerFired):

2013-12-17  Jer Noble  <jer.noble@apple.com>

        [MSE] Update duration after appending samples, per spec.
        https://bugs.webkit.org/show_bug.cgi?id=125703

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-duration-after-append.html

        After appending a sample, update the MediaSource duration if the sample's
        presentation end time is greater than the existing duration.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
        (WebCore::MediaSourcePrivateAVFObjC::setDuration): Notify the MediaPlayer.

2013-12-05  Jer Noble  <jer.noble@apple.com>

        [MSE] Bring end-of-stream algorithm section up to current spec.
        https://bugs.webkit.org/show_bug.cgi?id=125270

        Reviewed by Darin Adler.

        Test: media/media-source/media-source-end-of-stream.html

        Separate the "endOfStream()" method from the "end of stream algorithm".

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::SourceBufferIsUpdating): Added predicate function.
        (WebCore::MediaSource::endOfStream): Call streamEndedWithError().
        (WebCore::MediaSource::streamEndedWithError): Added.
        * Modules/mediasource/MediaSource.h:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::appendBufferTimerFired): Call streamEndedWithError().
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Ditto.
        * Modules/mediasource/SourceBuffer.h:
        * html/HTMLMediaElement.cpp:
        (HTMLMediaElement::mediaLoadingFailedFatally): Renamed from mediaEngineError.
        (HTMLMediaElement::mediaLoadingFailed): Call renamed method.
        * html/HTMLMediaElement.h:
        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
        (WebCore::MediaSourcePrivateAVFObjC::markEndOfStream): Set load state to Loaded.
        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
        (WebCore::MockMediaPlayerMediaSource::setNetworkState): Simple setter.
        * platform/mock/mediasource/MockMediaPlayerMediaSource.h:
        * platform/mock/mediasource/MockMediaSourcePrivate.cpp:
        (WebCore::MockMediaSourcePrivate::MockMediaSourcePrivate): Set the intitial duration to NaN.
        (WebCore::MockMediaSourcePrivate::markEndOfStream): Set load state to Loaded.

2013-12-04  Jer Noble  <jer.noble@apple.com>

        [MSE] Refactor MediaSourceBase back into MediaSource
        https://bugs.webkit.org/show_bug.cgi?id=125245

        Reviewed by Eric Carlson.

        Now that the legacy WebKitMediaSource has been removed, there is no reason to have
        a separate MediaSource and MediaSourceBase. Re-integrate the two.

        Copy all the methods from MediaSource into MediaSourceBase, and rename the class MediaSource:
        * Modules/mediasource/MediaSource.cpp: Copied from MediaSourceBase.cpp.
        (WebCore::MediaSource::create): Copied from MediaSource.cpp.
        (WebCore::MediaSource::addSourceBuffer): Ditto.
        (WebCore::MediaSource::removeSourceBuffer): Ditto.
        (WebCore::MediaSource::isTypeSupported): Ditto.
        (WebCore::MediaSource::eventTargetInterface): Ditto.
        (WebCore::MediaSource::sourceBufferDidChangeAcitveState): Ditto.
        * Modules/mediasource/MediaSource.h: Copied from MediaSourceBase.h.
        (WebCore::MediaSource::sourceBuffers): Copied from MediaSource.h.
        (WebCore::MediaSource::activeSourceBuffers): Copied from MediaSource.h.
        * Modules/mediasource/MediaSourceBase.cpp: Removed.
        * Modules/mediasource/MediaSourceBase.h: Removed.

        Change all references to MediaSourceBase into MediaSource:
        * Modules/mediasource/DOMURLMediaSource.cpp:
        (WebCore::DOMURLMediaSource::createObjectURL):
        * Modules/mediasource/DOMURLMediaSource.h:
        * Modules/mediasource/MediaSourceRegistry.cpp:
        (WebCore::MediaSourceRegistry::registerURL):
        (WebCore::MediaSourceRegistry::unregisterURL):
        * Modules/mediasource/MediaSourceRegistry.h:

        Remove MediaSourceBase.cpp/h from the project file:
        * WebCore.xcodeproj/project.pbxproj:
        * GNUmakefile.list.am:

2013-11-15  Jer Noble  <jer.noble@apple.com>

        [MSE] Support fastSeek() in MediaSource.
        https://bugs.webkit.org/show_bug.cgi?id=124422

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-fastseek.html

        * Modules/mediasource/MediaSource.cpp:
        * Modules/mediasource/MediaSource.h:

        Add support for "seek to the next fastest time" in MediaSource by
        returning the time of the nearest Sync sample.

        Move the data structure logic out of SourceBuffer and into it's own
        class:
        * Modules/mediasource/SampleMap.cpp: Added.
        (WebCore::SampleIsLessThanMediaTimeComparator::operator()):
        (WebCore::SampleIsGreaterThanMediaTimeComparator::operator()):
        (WebCore::SampleIsRandomAccess::operator()):
        (WebCore::SamplePresentationTimeIsWithinRangeComparator::operator()):
        (WebCore::SampleMap::addSample):
        (WebCore::SampleMap::removeSample):
        (WebCore::SampleMap::findSampleContainingPresentationTime):
        (WebCore::SampleMap::findSampleAfterPresentationTime):
        (WebCore::SampleMap::findSampleWithDecodeTime):
        (WebCore::SampleMap::reverseFindSampleContainingPresentationTime):
        (WebCore::SampleMap::reverseFindSampleBeforePresentationTime):
        (WebCore::SampleMap::reverseFindSampleWithDecodeTime):
        (WebCore::SampleMap::findSyncSamplePriorToPresentationTime):
        (WebCore::SampleMap::findSyncSamplePriorToDecodeIterator):
        (WebCore::SampleMap::findSyncSampleAfterPresentationTime):
        (WebCore::SampleMap::findSyncSampleAfterDecodeIterator):
        (WebCore::SampleMap::findSamplesBetweenPresentationTimes):
        (WebCore::SampleMap::findDependentSamples):
        * Modules/mediasource/SampleMap.h: Added.
        (WebCore::SampleMap::presentationBegin):
        (WebCore::SampleMap::presentationEnd):
        (WebCore::SampleMap::decodeBegin):
        (WebCore::SampleMap::decodeEnd):
        (WebCore::SampleMap::reversePresentationBegin):
        (WebCore::SampleMap::reversePresentationEnd):
        (WebCore::SampleMap::reverseDecodeBegin):
        (WebCore::SampleMap::reverseDecodeEnd):

        Add logic to find and return the time of the next & previous sync
        sample, within the threshold provided:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::TrackBuffer::TrackBuffer):
        (WebCore::SourceBuffer::sourceBufferPrivateSeekToTime):
        (WebCore::SourceBuffer::sourceBufferPrivateFastSeekTimeForMediaTime):
        (WebCore::SourceBuffer::appendBufferTimerFired):
        (WebCore::SourceBuffer::setActive):
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):
        (WebCore::SourceBuffer::sourceBufferPrivateDidBecomeReadyForMoreSamples):
        (WebCore::SourceBuffer::provideMediaData):
        * Modules/mediasource/SourceBuffer.h:
        * platform/graphics/SourceBufferPrivate.h:
        (WebCore::SourceBufferPrivate::setActive):
        * platform/graphics/SourceBufferPrivateClient.h:
        (WebCore::SourceBufferPrivateClient::sourceBufferPrivateFastSeekTimeForMediaTime):
        (WebCore::SourceBufferPrivateClient::sourceBufferPrivateSeekToTime):

        Add new files to the project:
        * WebCore.xcodeproj/project.pbxproj:

        Drive-by fixes in HTMLMediaElement:
        * html/HTMLMediaSource.h:
        * html/HTMLMediaElement.cpp:
        (HTMLMediaElement::finishSeek): Cause the MediaSource to check the ready state of all its buffers.
        (HTMLMediaElement::selectNextSourceChild): Pass in whether the source element has a MediaSource URL.

        Implement the seekWithTolerance behavior in MockMediaPlayerMediaSource:
        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
        (WebCore::MockMediaPlayerMediaSource::maxTimeSeekableDouble):
        (WebCore::MockMediaPlayerMediaSource::currentTimeDouble):
        (WebCore::MockMediaPlayerMediaSource::seekWithTolerance):
        (WebCore::MockMediaPlayerMediaSource::advanceCurrentTime):
        * platform/mock/mediasource/MockMediaPlayerMediaSource.h:
        * platform/mock/mediasource/MockMediaSourcePrivate.cpp:
        (WebCore::MockMediaSourcePrivate::seekToTime):
        * platform/mock/mediasource/MockMediaSourcePrivate.h:
        * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
        (WebCore::MockMediaSample::flags):
        (WebCore::MockSourceBufferPrivate::setActive):
        (WebCore::MockSourceBufferPrivate::fastSeekTimeForMediaTime):
        (WebCore::MockSourceBufferPrivate::seekToTime):
        * platform/mock/mediasource/MockSourceBufferPrivate.h:

2013-10-30  Jer Noble  <jer.noble@apple.com>

        [MSE] Bring SourceBuffer.append up to the most recent spec.
        https://bugs.webkit.org/show_bug.cgi?id=123377

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-append-failed.html

        Bring the MediaSource append() implementation up to the current spec.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::appendBufferInternal):
        (WebCore::SourceBuffer::appendBufferTimerFired):
        * platform/graphics/SourceBufferPrivate.h:
        * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
        (WebCore::MockSourceBufferPrivate::append):
        (WebCore::MockSourceBufferPrivate::evictCodedFrames):
        (WebCore::MockSourceBufferPrivate::isFull):
        * platform/mock/mediasource/MockSourceBufferPrivate.h:

2013-10-30  Jer Noble  <jer.noble@apple.com>

        [MSE] Add mock MediaSource classes for testing.
        https://bugs.webkit.org/show_bug.cgi?id=123322

        Reviewed by Eric Carlson.

        Tests: media/media-source/media-source-addsourcebuffer.html
               media/media-source/media-source-append-buffer.html
               media/media-source/media-source-canplaythrough.html
               media/media-source/media-source-closed.html
               media/media-source/media-source-play.html
               media/media-source/media-source-track-enabled.html
               media/media-source/media-source-tracks.html


        Add mock implementation of platform MediaSource classes, allowing ports to test the
        MediaSource API without having a platform implementation.

        The MockMediaSource will support a byteformat defined in MockBox.h: a simple box-style media
        format with an initialization segment containing a number of tracks, followed by a list of
        samples.

        Add a means to insert a new media engine factory at runtime, so the internals object can add
        a MockMediaSourceMediaPlayer:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayerFactorySupport::callRegisterMediaEngine):
        * platform/graphics/MediaPlayer.h:
        * testing/Internals.cpp:
        (WebCore::Internals::initializeMockMediaSource):
        * testing/Internals.h:
        * testing/Internals.idl:

        For non-media-source supporting media engines, fail immediately when asked to load a media
        source, so that the MockMediaSourceMediaPlayer will be instantiated as a fall-back:
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::load):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsType):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::load):
        (WebCore::MediaPlayerPrivateQTKit::supportsType):

        Add new files to the project:
        * WebCore.xcodeproj/project.pbxproj:
        * Source/WebCore/WebCore.exp.in:

        Update the MediaSource implementation:
        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::monitorSourceBuffers): Add a link to the spec.
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::buffered): Ditto.
        (WebCore::SourceBuffer::setTimestampOffset): Ditto.
        (WebCore::SourceBuffer::validateInitializationSegment): Ditto.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment): Ditto. Also,
            bring the implementation up to date with part of the spec.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Remove "Predicate" from
            SampleIsRandomAccessPredicate.

        Add utility classes to parse and represent the bytestream supported by the MockMediaSource:
        * platform/mock/mediasource/MockBox.cpp: Added.
        (WebCore::MockBox::MockBox):
        (WebCore::MockBox::peekType):
        (WebCore::MockBox::peekLength):
        (WebCore::MockTrackBox::MockTrackBox):
        (WebCore::MockTrackBox::type):
        (WebCore::MockInitializationBox::MockInitializationBox):
        (WebCore::MockInitializationBox::type):
        (WebCore::MockSampleBox::MockSampleBox):
        (WebCore::MockSampleBox::type):
        * platform/mock/mediasource/MockBox.h: Added.
        (WebCore::MockBox::length):
        (WebCore::MockBox::type):
        (WebCore::MockTrackBox::trackID):
        (WebCore::MockTrackBox::codec):
        (WebCore::MockTrackBox::kind):
        (WebCore::MockInitializationBox::duration):
        (WebCore::MockInitializationBox::tracks):
        (WebCore::MockSampleBox::presentationTimestamp):
        (WebCore::MockSampleBox::decodeTimestamp):
        (WebCore::MockSampleBox::duration):
        (WebCore::MockSampleBox::trackID):
        (WebCore::MockSampleBox::flags):
        (WebCore::MockSampleBox::isSync):

        Add a MediaPlayerPrivate implementation which uses MockMediaSource:
        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp: Added.
        (WebCore::MockMediaPlayerMediaSource::registerMediaEngine):
        (WebCore::MockMediaPlayerMediaSource::create):
        (WebCore::mimeTypeCache):
        (WebCore::MockMediaPlayerMediaSource::getSupportedTypes):
        (WebCore::MockMediaPlayerMediaSource::supportsType):
        (WebCore::MockMediaPlayerMediaSource::MockMediaPlayerMediaSource):
        (WebCore::MockMediaPlayerMediaSource::~MockMediaPlayerMediaSource):
        (WebCore::MockMediaPlayerMediaSource::load):
        (WebCore::MockMediaPlayerMediaSource::cancelLoad):
        (WebCore::MockMediaPlayerMediaSource::play):
        (WebCore::MockMediaPlayerMediaSource::pause):
        (WebCore::MockMediaPlayerMediaSource::naturalSize):
        (WebCore::MockMediaPlayerMediaSource::hasVideo):
        (WebCore::MockMediaPlayerMediaSource::hasAudio):
        (WebCore::MockMediaPlayerMediaSource::setVisible):
        (WebCore::MockMediaPlayerMediaSource::seeking):
        (WebCore::MockMediaPlayerMediaSource::paused):
        (WebCore::MockMediaPlayerMediaSource::networkState):
        (WebCore::MockMediaPlayerMediaSource::readyState):
        (WebCore::MockMediaPlayerMediaSource::buffered):
        (WebCore::MockMediaPlayerMediaSource::didLoadingProgress):
        (WebCore::MockMediaPlayerMediaSource::setSize):
        (WebCore::MockMediaPlayerMediaSource::paint):
        (WebCore::MockMediaPlayerMediaSource::currentTimeDouble):
        (WebCore::MockMediaPlayerMediaSource::durationDouble):
        (WebCore::MockMediaPlayerMediaSource::seekDouble):
        (WebCore::MockMediaPlayerMediaSource::advanceCurrentTime):
        (WebCore::MockMediaPlayerMediaSource::updateDuration):
        (WebCore::MockMediaPlayerMediaSource::setReadyState):
        * platform/mock/mediasource/MockMediaPlayerMediaSource.h: Added.

        Add a mock implementation of MediaSourcePrivate, which uses MockSourceBuffer:
        * platform/mock/mediasource/MockMediaSourcePrivate.cpp: Added.
        (WebCore::MockMediaSourcePrivate::create):
        (WebCore::MockMediaSourcePrivate::MockMediaSourcePrivate):
        (WebCore::MockMediaSourcePrivate::~MockMediaSourcePrivate):
        (WebCore::MockMediaSourcePrivate::addSourceBuffer):
        (WebCore::MockMediaSourcePrivate::removeSourceBuffer):
        (WebCore::MockMediaSourcePrivate::duration):
        (WebCore::MockMediaSourcePrivate::setDuration):
        (WebCore::MockMediaSourcePrivate::markEndOfStream):
        (WebCore::MockMediaSourcePrivate::unmarkEndOfStream):
        (WebCore::MockMediaSourcePrivate::readyState):
        (WebCore::MockMediaSourcePrivate::setReadyState):
        (WebCore::MockMediaSourcePrivate::sourceBufferPrivateDidChangeActiveState):
        (WebCore::MockSourceBufferPrivateHasAudio):
        (WebCore::MockMediaSourcePrivate::hasAudio):
        (WebCore::MockSourceBufferPrivateHasVideo):
        (WebCore::MockMediaSourcePrivate::hasVideo):
        * platform/mock/mediasource/MockMediaSourcePrivate.h: Added.
        (WebCore::MockMediaSourcePrivate::activeSourceBuffers):
        (WebCore::MockMediaSourcePrivate::player):

        Add a mock implementation of SourceBufferPrivate, which uses MockBoxes to parse the
        bytestream provided by SourceBuffer:
        * platform/mock/mediasource/MockSourceBufferPrivate.cpp: Added.
        (WebCore::MockMediaSample::create):
        (WebCore::MockMediaSample::~MockMediaSample):
        (WebCore::MockMediaSample::MockMediaSample):
        (WebCore::MockMediaSample::platformSample):
        (WebCore::MockMediaDescription::create):
        (WebCore::MockMediaDescription::~MockMediaDescription):
        (WebCore::MockMediaDescription::MockMediaDescription):
        (WebCore::MockSourceBufferPrivate::create):
        (WebCore::MockSourceBufferPrivate::MockSourceBufferPrivate):
        (WebCore::MockSourceBufferPrivate::~MockSourceBufferPrivate):
        (WebCore::MockSourceBufferPrivate::setClient):
        (WebCore::MockSourceBufferPrivate::append):
        (WebCore::MockSourceBufferPrivate::didReceiveInitializationSegment):
        (WebCore::MockSourceBufferPrivate::didReceiveSample):
        (WebCore::MockSourceBufferPrivate::abort):
        (WebCore::MockSourceBufferPrivate::removedFromMediaSource):
        (WebCore::MockSourceBufferPrivate::readyState):
        (WebCore::MockSourceBufferPrivate::setReadyState):
        (WebCore::MockSourceBufferPrivate::hasVideo):
        (WebCore::MockSourceBufferPrivate::hasAudio):
        * platform/mock/mediasource/MockSourceBufferPrivate.h: Added.

        Create mock implementations of AudioTrackPrivate, VideoTrackPrivate, and TextTrackPrivate
        which wrap the MockTrackBox class:
        * platform/mock/mediasource/MockTracks.cpp: Added.
        * platform/mock/mediasource/MockTracks.h: Added.
        (WebCore::MockAudioTrackPrivate::create):
        (WebCore::MockAudioTrackPrivate::~MockAudioTrackPrivate):
        (WebCore::MockAudioTrackPrivate::id):
        (WebCore::MockAudioTrackPrivate::MockAudioTrackPrivate):
        (WebCore::MockTextTrackPrivate::create):
        (WebCore::MockTextTrackPrivate::~MockTextTrackPrivate):
        (WebCore::MockTextTrackPrivate::id):
        (WebCore::MockTextTrackPrivate::MockTextTrackPrivate):
        (WebCore::MockVideoTrackPrivate::create):
        (WebCore::MockVideoTrackPrivate::~MockVideoTrackPrivate):
        (WebCore::MockVideoTrackPrivate::id):
        (WebCore::MockVideoTrackPrivate::MockVideoTrackPrivate):

2013-10-25  Jer Noble  <jer.noble@apple.com>

        [MSE] Add MediaSource extensions to AudioTrack, VideoTrack, and TextTrack.
        https://bugs.webkit.org/show_bug.cgi?id=123374

        Reviewed by Eric Carlson.

        No tests added; tests will be added when Mock implementations are added in a future patch.

        Add new partial interfaces for added methods on AudioTrack, TextTrack, and VideoTrack:
        * Modules/mediasource/AudioTrackMediaSource.idl: Add read-only sourceBuffer attribute.
        * Modules/mediasource/TextTrackMediaSource.idl: Ditto.
        * Modules/mediasource/VideoTrackMediaSource.idl: Ditto.
        * Modules/mediasource/AudioTrackMediaSource.h:
        (WebCore::AudioTrackMediaSource::sourceBuffer): Added static wrapper around non-static sourceBuffer().
        * Modules/mediasource/TextTrackMediaSource.h:
        (WebCore::TextTrackMediaSource::sourceBuffer): Ditto.
        * Modules/mediasource/VideoTrackMediaSource.h:
        (WebCore::VideoTrackMediaSource::sourceBuffer): Ditto.

        Add support for writable kind & language attributes through a custom setter:
        * bindings/js/JSAudioTrackCustom.cpp:
        (WebCore::JSAudioTrack::setKind):
        (WebCore::JSAudioTrack::setLanguage):
        * bindings/js/JSTextTrackCustom.cpp:
        (WebCore::JSTextTrack::setKind):
        (WebCore::JSTextTrack::setLanguage):
        * bindings/js/JSVideoTrackCustom.cpp:
        (WebCore::JSVideoTrack::setKind):
        (WebCore::JSVideoTrack::setLanguage):
        * html/track/AudioTrack.idl:
        * html/track/TextTrack.idl:
        * html/track/VideoTrack.idl:

        Add setter methods to the implementation classes:
        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::TextTrack):
        (WebCore::TextTrack::setKind):
        (WebCore::TextTrack::setLanguage):
        * html/track/TextTrack.h:
        * html/track/TrackBase.cpp:
        (WebCore::TrackBase::TrackBase):
        (WebCore::TrackBase::setKind):
        (WebCore::TrackBase::setKindInternal):
        * html/track/TrackBase.h:
        (WebCore::TrackBase::setLanguage):
        (WebCore::TrackBase::sourceBuffer):
        (WebCore::TrackBase::setSourceBuffer):
        * html/track/VideoTrack.cpp:
        (WebCore::VideoTrack::VideoTrack):
        (WebCore::VideoTrack::setKind):
        (WebCore::VideoTrack::setLanguage):
        * html/track/VideoTrack.h:

        Implement the unimplemented portions of MediaSource and SourceBuffer:
        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::removeSourceBuffer):
        * Modules/mediasource/MediaSourceBase.cpp:
        (WebCore::MediaSourceBase::MediaSourceBase):
        (WebCore::MediaSourceBase::setPrivateAndOpen):
        (WebCore::MediaSourceBase::setReadyState):
        (WebCore::MediaSourceBase::attachToElement):
        * Modules/mediasource/MediaSourceBase.h:
        (WebCore::MediaSourceBase::mediaElement):
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::videoTracks):
        (WebCore::SourceBuffer::audioTracks):
        (WebCore::SourceBuffer::textTracks):
        (WebCore::SourceBuffer::sourceBufferPrivateDidAddAudioTrack):
        (WebCore::SourceBuffer::sourceBufferPrivateDidAddVideoTrack):
        (WebCore::SourceBuffer::sourceBufferPrivateDidAddTextTrack):
        (WebCore::SourceBuffer::sourceBufferPrivateDidChangeActiveState):
        * Modules/mediasource/SourceBuffer.h:
        * Modules/mediasource/SourceBuffer.idl:

        Add new files to the project:
        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:

        And a smorgasbord of other utility changes:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource): Pass this when attaching.
        (WebCore::HTMLMediaElement::mediaPlayerDidAddTextTrack): Ditto.
        * html/HTMLMediaSource.h:
        * html/track/TextTrackList.cpp:
        (TextTrackList::item): Make const.
        * html/track/TextTrackList.h:
        (WebCore::TextTrackList::lastItem): Added.
        * platform/graphics/InbandTextTrackPrivate.h:
        (WebCore::InbandTextTrackPrivate::create): Added.
        (WebCore::MockSourceBufferPrivate::trackDidChangeEnabled):

2013-10-25  Jer Noble  <jer.noble@apple.com>

        [MSE] Add a SourceBufferPrivateClient interface for platform -> html communication.
        https://bugs.webkit.org/show_bug.cgi?id=123373

        Reviewed by Eric Carlson.

        To enable communication between SourceBuffer and SourceBufferPrivate without introducing
        layering violations, add a new interface class SourceBufferPrivateInterface from which
        SourceBuffer will inherit.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::SourceBuffer): Set the private's client.
        (WebCore::SourceBuffer::~SourceBuffer): Clear the private's client.
        (WebCore::SourceBuffer::sourceBufferPrivateDidEndStream): Added stub.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment): Hinno.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Ditto.
        (WebCore::SourceBuffer::sourceBufferPrivateHasAudio): Ditto.
        (WebCore::SourceBuffer::sourceBufferPrivateHasVideo): Ditto.
        * Modules/mediasource/SourceBuffer.h:
        * WebCore.xcodeproj/project.pbxproj: Add new files to project.
        * platform/graphics/SourceBufferPrivate.h:
        * platform/graphics/SourceBufferPrivateClient.h: Added.
        (WebCore::SourceBufferPrivateClient::~SourceBufferPrivateClient): Empty destructor.

2013-10-30  Jer Noble  <jer.noble@apple.com>

        [MSE] Add MediaSource compatable loading functions to MediaPlayer
        https://bugs.webkit.org/show_bug.cgi?id=123353

        Reviewed by Eric Carlson.

        Add methods to MediaPlayer to allow it to select the correct MediaPlayerFactory
        when attempting to load a MediaSource URL.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::addSourceBuffer):
        (WebCore::MediaSource::isTypeSupported):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource):
        (WebCore::HTMLMediaElement::canPlayType):
        (WebCore::HTMLMediaElement::selectNextSourceChild):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::load):
        (WebCore::MediaPlayer::supportsType):
        * platform/graphics/MediaPlayer.h:
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):

        Remove the isSupportedMediaSourceMIMEType() method:
        * platform/MIMETypeRegistry.h:
        * platform/efl/MIMETypeRegistryEfl.cpp:
        * platform/mac/MIMETypeRegistryMac.mm:


2013-10-29  Jer Noble  <jer.noble@apple.com>

        [MSE] Remove legacy Media Source APIs (WebKitMediaSource, WebKitSourceBuffer, WebKitSourceBufferList)
        https://bugs.webkit.org/show_bug.cgi?id=123463

        Reviewed by Eric Carlson.

        No new tests; updated test results.

        Remove all reference to WebKitMediaSource, WebKitSourceBuffer, and WebKitSourceBufferList.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * GNUmakefile.list.am:
        * Modules/mediasource/DOMURLMediaSource.idl:
        * Modules/mediasource/WebKitMediaSource.cpp: Removed.
        * Modules/mediasource/WebKitMediaSource.h: Removed.
        * Modules/mediasource/WebKitMediaSource.idl: Removed.
        * Modules/mediasource/WebKitSourceBuffer.cpp: Removed.
        * Modules/mediasource/WebKitSourceBuffer.h: Removed.
        * Modules/mediasource/WebKitSourceBuffer.idl: Removed.
        * Modules/mediasource/WebKitSourceBufferList.cpp: Removed.
        * Modules/mediasource/WebKitSourceBufferList.h: Removed.
        * Modules/mediasource/WebKitSourceBufferList.idl: Removed.
        * WebCore.xcodeproj/project.pbxproj:
        * dom/EventTargetFactory.in:

2013-10-25  Jer Noble  <jer.noble@apple.com>

        [MSE] Fix runtime errors caused by mediasource IDL attributes.
        https://bugs.webkit.org/show_bug.cgi?id=123352

        Reviewed by Eric Carlson.

        Due to http://webkit.org/b/123178, MediaSource classes must add a GenerateIsReachable
        (and also a JSGenerateToJSObject) attribute to avoid runtime asserts and crashes.

        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/mediasource/WebKitMediaSource.idl:
        * Modules/mediasource/WebKitSourceBufferList.idl:

2013-10-22  Jer Noble  <jer.noble@apple.com>

        [Media] Refactor supportsType() factory method to take a parameters object.
        https://bugs.webkit.org/show_bug.cgi?id=122489

        Reviewed by Eric Carlson.

        In order to support adding new conditional properties with which to decide
        what MediaPlayerPrivate subclass to create, replace the two versions of the
        supportsType() factory method with a single one taking a parameters object.

        At the same time, add a 'isMediaSource' parameter to that object, allowing
        MediaPlayerPrivate subclasses which support the same type and codecs but
        which do not both support MediaSource to be distinguised.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::bestMediaEngineForSupportParameters): Renamed from
            bestMediaEngineForTypeAndCodecs.
        (WebCore::MediaPlayer::nextBestMediaEngine): Added convenience function.
        (WebCore::MediaPlayer::loadWithNextMediaEngine): Call nextBestMediaEngine()
        (WebCore::MediaPlayer::supportsType): Pass parameter object.
        (WebCore::MediaPlayer::networkStateChanged): Call nextBestMediaEngine().
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::MediaPlayerPrivateAVFoundationCF::supportsType): Handle parameter object.
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::registerMediaEngine): Remove extraneous
            extendedSupportsType method.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsType): Handle parameter object.
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
        (WebCore::MediaPlayerPrivate::supportsType): Ditto.
        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::registerMediaEngine): Remove extraneous
            extendedSupportsType method.
        (WebCore::MediaPlayerPrivateQTKit::supportsType): Handle parameter object.
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::supportsType): Ditto.
        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:

2013-09-18  Jer Noble  <jer.noble@apple.com>

        [MSE] Throw exception when setting timestampOffset while 'updating' state is set.
        https://bugs.webkit.org/show_bug.cgi?id=121561

        Reviewed by Eric Carlson.

        Tests: Updated http/tests/media/media-source/mediasource-append-buffer.html.

        Merge https://chromium.googlesource.com/chromium/blink/+/25285998be3d0edcd951d12d445a7375e50e512c
        by Changbin Shao.

        The Media Source Extensions spec requires that an exception be thrown if the 'updating' attribute
        equals true while setting the timestampOffset of a SourceBuffer. 

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::setTimestampOffset):

2013-09-18  Jer Noble  <jer.noble@apple.com>

        Merge blink MediaSource changes since fork.
        https://bugs.webkit.org/show_bug.cgi?id=118752

        Rubber-stamped by Eric Carlson.

        Tests: http/tests/media/media-source/mediasource-addsourcebuffer.html
               http/tests/media/media-source/mediasource-append-buffer.html
               http/tests/media/media-source/mediasource-buffered.html
               http/tests/media/media-source/mediasource-closed.html
               http/tests/media/media-source/mediasource-config-change-mp4-a-bitrate.html
               http/tests/media/media-source/mediasource-config-change-mp4-av-audio-bitrate.html
               http/tests/media/media-source/mediasource-config-change-mp4-av-framesize.html
               http/tests/media/media-source/mediasource-config-change-mp4-av-video-bitrate.html
               http/tests/media/media-source/mediasource-config-change-mp4-v-bitrate.html
               http/tests/media/media-source/mediasource-config-change-mp4-v-framerate.html
               http/tests/media/media-source/mediasource-config-change-mp4-v-framesize.html
               http/tests/media/media-source/mediasource-config-change-webm-a-bitrate.html
               http/tests/media/media-source/mediasource-config-change-webm-av-audio-bitrate.html
               http/tests/media/media-source/mediasource-config-change-webm-av-framesize.html
               http/tests/media/media-source/mediasource-config-change-webm-av-video-bitrate.html
               http/tests/media/media-source/mediasource-config-change-webm-v-bitrate.html
               http/tests/media/media-source/mediasource-config-change-webm-v-framerate.html
               http/tests/media/media-source/mediasource-config-change-webm-v-framesize.html
               http/tests/media/media-source/mediasource-is-type-supported.html
               http/tests/media/media-source/mediasource-multiple-attach.html
               http/tests/media/media-source/mediasource-play.html
               http/tests/media/media-source/mediasource-sourcebufferlist.html

        Add files to project. Fix compile errors exposed by enabling.

        * WebCore.xcodeproj/project.pbxproj:
        * Modules/mediasource/MediaSourceRegistry.cpp:
        (WebCore::MediaSourceRegistry::lookupMediaSource):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
        (WebCore::MediaPlayerPrivateAVFoundation::load):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        (WebCore::MediaPlayerPrivateQTKit::load):
        * platform/mac/MIMETypeRegistryMac.mm:
        (WebCore::MIMETypeRegistry::isSupportedMediaSourceMIMEType):
        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:

        Merge
        https://chromium.googlesource.com/chromium/blink/+/c38e2955db98a300a535b692869fea0e41501497
        https://chromium.googlesource.com/chromium/blink/+/8568015e9bee1de7fccee28163f9e4a4b51f9baf
        https://chromium.googlesource.com/chromium/blink/+/14417e8fa6294f4e7dbc1e0fac549398522b2f97
        https://chromium.googlesource.com/chromium/blink/+/f43a5496f233102f8861a067a9cf8053c010d401
        https://chromium.googlesource.com/chromium/blink/+/57771439806f7c6e6a272efb1ea72900f5f6a015
        https://chromium.googlesource.com/chromium/blink/+/8c77a790a9d225194db0a8832399d0f9e1fa54ec
        https://chromium.googlesource.com/chromium/blink/+/d33ae3fa7a8592e946503ed17f862a27c6d9dde1
        https://chromium.googlesource.com/chromium/blink/+/1caaa9c51f06e1b9341d58c994f77fd59fcd236d
        https://chromium.googlesource.com/chromium/blink/+/e95720393b0ebe67f19de39bb77cdf2926165512
        https://chromium.googlesource.com/chromium/blink/+/bad2c1b4b70faec731b2ad3cc8a4ccf28de6cc38
        https://chromium.googlesource.com/chromium/blink/+/a7873430c3d5c9373336c6f3993db3cb4228e9cd
        https://chromium.googlesource.com/chromium/blink/+/508966d5e32360b3cec058f9fbae0014542fbc52
        https://chromium.googlesource.com/chromium/blink/+/371dfe72f61ce6f73e6c242324da73c415d38be3

2013-08-08  Jer Noble  <jer.noble@apple.com>

        [EME] MediaKey APIs should be prefixed.
        https://bugs.webkit.org/show_bug.cgi?id=119606

        Reviewed by Anders Carlsson.

        No new tests; updated exsisting tests with new names.

        Prefix all new classes with "WebKit" and new methods on existing unprefixed
        classes with "webkit"

        * Modules/encryptedmedia/MediaKeyMessageEvent.idl: MediaKeyMessageEvent -> WebKitMediaKeyMessageEvent
        * Modules/encryptedmedia/MediaKeySession.idl: MediaKeySession -> WebKitMediaKeySession
        * Modules/encryptedmedia/MediaKeys.idl: MediaKeys -> WebKitMediaKeys
        * html/HTMLMediaElement.idl: keys -> webkitKeys, setMediaKeys -> webkitSetMediaKeys
        * html/MediaKeyError.idl: MediaKeyError -> WebKitMediaKeyError

2013-08-08  Jer Noble  <jer.noble@apple.com>

        [EME] setMediaKeys function as defined in the EME specification does not work
        https://bugs.webkit.org/show_bug.cgi?id=119597

        Reviewed by Anders Carlsson.

        No new tests; updated media/encrypted-media/encrypted-media-v2-syntax.html

        Rename the mediaKeys attribute 'keys' and make readonly, and add an explicit
        setMediaKeys() method in HTMLMediaElement's IDL.

        * html/HTMLMediaElement.h:
        (WebCore::HTMLMediaElement::keys):
        * html/HTMLMediaElement.idl:

2013-08-08  Jer Noble  <jer.noble@apple.com>

        [EME] Implement MediaKeys.isTypeSupported()
        https://bugs.webkit.org/show_bug.cgi?id=119586

        Reviewed by Eric Carlson.

        Test: media/encrypted-media/encrypted-media-is-type-supported.html

        The EME spec has removed the extra keySystem parameter from
        HTMLMediaElement.canPlayType() in favor of a new isTypeSupported()
        method on MediaKeys.

        To implement this method, the CDMFactory needs to know whether the
        registered CDM supports the specified mime type.  CDMs must register
        this new factory method, which requires changes to CDMPrivateAVFoundation
        and MockCDM.

        Add the new MediaKeys.isTypeSupported() method:
        * Modules/encryptedmedia/MediaKeys.cpp:
        (WebCore::MediaKeys::isTypeSupported):
        * Modules/encryptedmedia/MediaKeys.h:
        * Modules/encryptedmedia/MediaKeys.idl:

        Add the new factory CDMSupportsKeySystemAndMimeType method:
        * Modules/encryptedmedia/CDM.cpp:
        (WebCore::CDMFactory::CDMFactory): Now takes a third parameter.
        (WebCore::installedCDMFactories): When adding the AVFoundation CDM, pass its new method.
        (WebCore::CDM::registerCDMFactory): Now takes a third parameter.
        (WebCore::CDM::keySystemSupportsMimeType): Added.
        * Modules/encryptedmedia/CDM.h:
        * WebCore.exp.in:

        Register this new method with the factory for all concrete CDMs:
        * Modules/encryptedmedia/CDMPrivateAVFoundation.h:
        * Modules/encryptedmedia/CDMPrivateAVFoundation.mm:
        (WebCore::CDMPrivateAVFoundation::supportsKeySystem):
        (WebCore::CDMPrivateAVFoundation::supportsKeySystemAndMimeType):
        * testing/Internals.cpp:
        (WebCore::Internals::initializeMockCDM):
        * testing/MockCDM.cpp:
        (WebCore::MockCDM::supportsKeySystem):
        (WebCore::MockCDM::supportsKeySystemAndMimeType):
        * testing/MockCDM.h:

2013-04-19  Brendan Long  <b.long@cablelabs.com>

        Add interfaces and stubs for audio and video tracks
        https://bugs.webkit.org/show_bug.cgi?id=113965

        Reviewed by Jer Noble.

        No new tests because there's no implementations, so there's nothing
        interesting to test.

        * CMakeLists.txt: Add AudioTrack, VideoTrack, AudioTrackList and VideoTrackList.
        * DerivedSources.cpp: Same.
        * DerivedSources.make: Same.
        * DerivedSources.pri: Same.
        * GNUmakefile.list.am: Same.
        * Target.pri: Same.
        * UseJSC.cmake: Same.
        * WebCore.vcproj/WebCore.vcproj: Same.
        * WebCore.xcodeproj/project.pbxproj: Same.
        * bindings/gobject/GNUmakefile.am: Same.
        * bindings/js/JSAudioTrackCustom.cpp: Added, based on JSTestTrackCustom
        * bindings/js/JSAudioTrackListCustom.cpp: Same.
        * bindings/js/JSBindingsAllInOne.cpp: Add AudioTrack, VideoTrack, AudioTrackList and VideoTrackList.
        * bindings/js/JSVideoTrackCustom.cpp: Added, based on JSTestTrackCustom
        * bindings/js/JSVideoTrackListCustom.cpp: Same.
        * dom/EventTarget.h: Make AudioTrackList and VideoTrackList event targets.
        * dom/EventTargetFactory.in: Same.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Add m_audioTracks and m_videoTracks
        (WebCore::HTMLMediaElement::~HTMLMediaElement): Clear clients for audio and video tracks
        (WebCore::HTMLMediaElement::audioTrackEnabledChanged): Added.
        (WebCore::HTMLMediaElement::videoTrackSelectedChanged): Added.
        (WebCore::HTMLMediaElement::mediaPlayerDidAddAudioTrack): Added, based on mediaPlayerDidAddTextTrack
        (WebCore::HTMLMediaElement::mediaPlayerDidAddVideoTrack): Same.
        (WebCore::HTMLMediaElement::mediaPlayerDidRemoveAudioTrack): Added, based on mediaPlayerDidRemoveTextTrack
        (WebCore::HTMLMediaElement::mediaPlayerDidRemoveVideoTrack): Same.
        (WebCore::HTMLMediaElement::addAudioTrack): Added, based on addTextTrack
        (WebCore::HTMLMediaElement::addVideoTrack): Same.
        (WebCore::HTMLMediaElement::removeAudioTrack): Added, based on removeTextTrack
        (WebCore::HTMLMediaElement::removeVideoTrack): Added, based on removeTextTrack
        (WebCore::HTMLMediaElement::removeAllInbandTracks): Remove audio and video tracks too
        (WebCore::HTMLMediaElement::audioTracks): Added, based on textTracks
        (WebCore::HTMLMediaElement::videoTracks): Added, based on textTracks
        (WebCore::HTMLMediaElement::reportMemoryUsage): Add audio and video tracks
        * html/HTMLMediaElement.h: Add audioTracks and videoTracks and related functions
        * html/HTMLMediaElement.idl: Add audioTracks and videoTracks
        * html/track/AudioTrack.cpp: Added, based on TextTrack and InbandTextTrack.
        * html/track/AudioTrack.h: Same.
        * html/track/AudioTrack.idl: Added.
        * html/track/AudioTrackList.cpp: Added, based on TextTrackList
        * html/track/AudioTrackList.h: Same.
        * html/track/AudioTrackList.idl: Added.
        * html/track/TextTrackList.h: Add missing OVERRIDE on interfaceName()
        * html/track/VideoTrack.cpp: Added, based on TextTrack and InbandTextTrack.
        * html/track/VideoTrack.h: Same.
        * html/track/VideoTrack.idl: Added.
        * html/track/VideoTrackList.cpp: Added, based on TextTrackList
        * html/track/VideoTrackList.h: Same.
        * html/track/VideoTrackList.idl: Added.
        * platform/graphics/AudioTrackPrivate.h: Added, based on InbandTextTrackPrivate.h
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::addAudioTrack): Added, based on addTextTrack
        (WebCore::MediaPlayer::removeAudioTrack): Added, based on removeTextTrack
        (WebCore::MediaPlayer::addVideoTrack): Added, based on addTextTrack
        (WebCore::MediaPlayer::removeVideoTrack): Added, based on removeTextTrack
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerDidAddAudioTrack): Added, based on mediaPlayerDidAddTextTrack
        (WebCore::MediaPlayerClient::mediaPlayerDidAddVideoTrack): Same
        (WebCore::MediaPlayerClient::mediaPlayerDidRemoveAudioTrack): Added, based on mediaPlayerDidRemoveTextTrack
        (WebCore::MediaPlayerClient::mediaPlayerDidRemoveVideoTrack): Same
        * platform/graphics/VideoTrackPrivate.h: Added, based on InbandTextTrackPrivate.h

2013-04-19  Erik Arvidsson  <arv@chromium.org>

        Rename TextTrackList owner to element for consistency
        https://bugs.webkit.org/show_bug.cgi?id=79822

        Reviewed by Eric Carlson.

        No new tests. Covered by existing tests.

        * bindings/js/JSTextTrackListCustom.cpp:
        (WebCore::JSTextTrackListOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTextTrackList::visitChildren):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement):
        * html/track/TextTrackList.cpp:
        (TextTrackList::append):
        (TextTrackList::remove):
        * html/track/TextTrackList.h:
        (WebCore::TextTrackList::create):
        * html/track/TrackListBase.cpp:
        (TrackListBase::TrackListBase):
        (TrackListBase::remove):
        * html/track/TrackListBase.h:
        (WebCore::TrackListBase::clearElement):
        (WebCore::TrackListBase::element):
        (TrackListBase):

2013-04-12  Brendan Long  <b.long@cablelabs.com>

        Refactor TextTrack and TextTrackList to make it easier to add audio and video tracks
        https://bugs.webkit.org/show_bug.cgi?id=114330

        Reviewed by Jer Noble.

        No new tests because this doesn't add new functionality.

        * CMakeLists.txt: Only compile text track files if ENABLE(VIDEO_TRACK), and add TrackListBase
        * Target.pri: Add TrackListBase
        * WebCore.vcproj/WebCore.vcproj: Correct InbandTextTrackPrivate.h's location and add TrackListBase
        * WebCore.xcodeproj/project.pbxproj: Add TrackListBase
        * html/HTMLMediaElement.cpp: Renamed "track" functions to "textTrack"
        (WebCore::HTMLMediaElement::mediaPlayerDidAddTextTrack): Renamed.
        (WebCore::HTMLMediaElement::mediaPlayerDidRemoveTextTrack): Renamed.
        (WebCore::HTMLMediaElement::addTextTrack): Renamed.
        (WebCore::HTMLMediaElement::removeTextTrack): Renamed.
        (WebCore::HTMLMediaElement::removeAllInbandTracks): Use renamed functions.
        (WebCore::HTMLMediaElement::didAddTextTrack): Renamed.
        (WebCore::HTMLMediaElement::didRemoveTextTrack): Renamed.
        * html/HTMLMediaElement.h:
        Renamed "track" functions to "textTrack" and only forward-declare TextTrackList if ENABLE(VIDEO_TRACK)
        * html/HTMLTrackElement.cpp: Renamed "track" functions to "textTrack"
        (WebCore::HTMLTrackElement::insertedInto):
        (WebCore::HTMLTrackElement::removedFrom):
        * html/track/TextTrack.cpp:
        Move media element, label, language and kind into TrackBase and move EventTarget functions into TextTrack.
        (WebCore::TextTrack::TextTrack): Added.
        (WebCore::TextTrack::interfaceName): Added.
        (WebCore::TextTrack::scriptExecutionContext): Added.
        (WebCore::TextTrack::eventTargetData): Added.
        (WebCore::TextTrack::ensureEventTargetData): Added.
        (WebCore::TextTrack::isValidKind): Added to support TrackBase::setKind()
        (WebCore::TextTrack::setKind): Override to support textTrackKindChanged()
        (WebCore::TextTrack::isRendered): Use kind(), label() and language() instead of m_kind, etc.
        (WebCore::TextTrack::platformTextTrack): Ditto.
        (WebCore::TextTrack::isMainProgramContent): Ditto.
        * html/track/TextTrack.h:
        Same as TextTrack.cpp, plus added defaultKindKeyword() so TrackBase::setKind() will work and added
        toTextTrack().
        * html/track/TextTrackList.cpp:
        Move functionality into TrackListBase, add toTextTrack() casts, use
        TrackBase where necesssary and use owner() instead of m_owner.

        Moved EventTarget functions into TrackListBase.
        (TextTrackList::TextTrackList):
        (TextTrackList::getTrackIndexRelativeToRenderedTracks):
        (TextTrackList::item):
        (TextTrackList::invalidateTrackIndexesAfterTrack):
        (TextTrackList::append):
        (TextTrackList::remove):
        (TextTrackList::contains):
        * html/track/TextTrackList.h:
        Move EventTarget, RefCounted and m_inbandTracks into TrackListBase.
        Override length(), contains() and remove().
        * html/track/TrackBase.cpp: Remove EventTarget functions.
        (WebCore::TrackBase::TrackBase):
        Remove EventTarget, add label and language
        (WebCore::TrackBase::setKind): Added
        * html/track/TrackBase.h:
        Don't extend EventTarget (AudioTrack and VideoTrack aren't). Handle
        kind, label, language and media element.
        (WebCore::TrackBase::setMediaElement): Added.
        (WebCore::TrackBase::mediaElement): Added.
        (WebCore::TrackBase::kind): Added.
        (WebCore::TrackBase::label): Added.
        (WebCore::TrackBase::setLabel): Added.
        (WebCore::TrackBase::language): Added.
        (WebCore::TrackBase::setLanguage): Added.
        * html/track/TrackListBase.cpp:
        Added. Handles functionality common to TextTrackList, AudioTrackList and
        VideoTrackList.
        (TrackListBase::TrackListBase): Added.
        (TrackListBase::~TrackListBase): Added.
        (TrackListBase::length): Added.
        (TrackListBase::remove): Added.
        (TrackListBase::contains): Added.
        (TrackListBase::scheduleAddTrackEvent): Added.
        (TrackListBase::scheduleRemoveTrackEvent): Added.
        (TrackListBase::scheduleChangeEvent): Added.
        (TrackListBase::asyncEventTimerFired): Added.
        * html/track/TrackListBase.h:
        Copied from Source/WebCore/html/track/TextTrackList.h. Handles
        functionality common to TextTrackList, AudioTrackList and VideoTrackList.
        (WebCore::TrackListBase::scriptExecutionContext): Added.
        (WebCore::TrackListBase::clearOwner): Added.
        (WebCore::TrackListBase::owner): Added.
        (WebCore::TrackListBase::isFiringEventListeners): Added.
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::addTextTrack): Renamed (was addTrack)
        (WebCore::MediaPlayer::removeTextTrack): Renamed (was removeTrack)
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerDidAddTextTrack): Renamed (was mediaPlayerDidAddTrack)
        (WebCore::MediaPlayerClient::mediaPlayerDidRemoveTextTrack): Renamed (was mediaPlayerDidRemoveTrack)

2013-03-09  Eric Carlson  <eric.carlson@apple.com>

        Enable platform code to implement text track menu
        https://bugs.webkit.org/show_bug.cgi?id=111924

        Reviewed by Dean Jackson.

        No new tests, the new code isn't enabled in any ports yet.

        * WebCore.xcodeproj/project.pbxproj: Add PlatformTextTrack.h and PlatformTextTrackMenu.h.

        * html/HTMLAudioElement.cpp:
        (WebCore::HTMLAudioElement::createForJSConstructor): scheduleLoad -> scheduleDelayedAction.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Deal with scheduleLoad to scheduleDelayedAction rename.
        (WebCore::HTMLMediaElement::parseAttribute): Ditto.
        (WebCore::HTMLMediaElement::finishParsingChildren): Ditto.
        (WebCore::HTMLMediaElement::insertedInto): Ditto.
        (WebCore::HTMLMediaElement::scheduleDelayedAction): Ditto.
        (WebCore::HTMLMediaElement::scheduleNextSourceChild): Ditto.
        (WebCore::HTMLMediaElement::loadTimerFired): Ditto.
        (WebCore::HTMLMediaElement::textTrackModeChanged): Notify platform menu of track change.
        (WebCore::HTMLMediaElement::playInternal): Deal with scheduleLoad to scheduleDelayedAction rename.
        (WebCore::HTMLMediaElement::pauseInternal): Ditto.
        (WebCore::HTMLMediaElement::mediaPlayerDidAddTrack): Ditto. Call addTrack() instead of appending 
            the track directly.
        (WebCore::HTMLMediaElement::setSelectedTextTrack): Deal with platform menu changing the
            selected track.
        (WebCore::HTMLMediaElement::platformTextTracks): Return an array of PlatformTracks representing
            the current text tracks.
        (WebCore::HTMLMediaElement::notifyMediaPlayerOfTextTrackChanges): Notify the platform menu
            that the list of text tracks has changed.
        (WebCore::HTMLMediaElement::platformTextTrackMenu): Return the platform track menu, if any.
        (WebCore::HTMLMediaElement::closeCaptionTracksChanged): 
        (WebCore::HTMLMediaElement::addTrack): Call addTrack() instead of appending the track directly.
        (WebCore::HTMLMediaElement::removeTrack): Call closeCaptionTracksChanged.
        (WebCore::HTMLMediaElement::addTextTrack): Call addTrack() instead of appending the track directly.
        (WebCore::HTMLMediaElement::didAddTrack): Ditto.
        (WebCore::HTMLMediaElement::didRemoveTrack): Deal with scheduleLoad to scheduleDelayedAction rename.
        (WebCore::HTMLMediaElement::sourceWasAdded): Ditto.
        (WebCore::HTMLMediaElement::clearMediaPlayer): Forget the platform track menu.
        (WebCore::HTMLMediaElement::resume): Deal with scheduleLoad to scheduleDelayedAction rename.
        * html/HTMLMediaElement.h:

        * html/track/InbandTextTrack.h: scheduleLoad -> scheduleDelayedAction.

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::platformTextTrack): Create a PlatformTextTrack.
        * html/track/TextTrack.h:

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::implementsTextTrackControls): New, player private passthrough.
        (WebCore::MediaPlayer::textTrackMenu): Ditto.
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:

        * platform/graphics/PlatformTextTrack.h: Added.

        * platform/graphics/PlatformTextTrackMenu.h: Added.

2012-12-16  Eric Carlson  <eric.carlson@apple.com>

        Remove in-band text tracks when media element's src changes
        https://bugs.webkit.org/show_bug.cgi?id=105081

        Reviewed by Sam Weinig.

        No new tests, media/track/track-in-band.html was updated to test this change.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerDidRemoveTrack): Move some code into removeTrack.
        (WebCore::HTMLMediaElement::removeTrack): New, remove a track and all of its cues.
        (WebCore::HTMLMediaElement::removeAllInbandTracks): New, remove all in-band tracks.
        (WebCore::HTMLMediaElement::clearMediaPlayer): Call removeAllInbandTracks.
        * html/HTMLMediaElement.h:

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Call clearTextTracks.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::clearTextTracks): Remove all tracks from client.

2012-12-10  Eric Carlson  <eric.carlson@apple.com>

        Add support for in-band text tracks to Mac port
        https://bugs.webkit.org/show_bug.cgi?id=103663

        Reviewed by Sam Weinig.

        Test: media/track/track-in-band.html

        * GNUmakefile.list.am: Move InbandTextTrackPrivate.h to platform/graphics. Add InbandTextTrackPrivateClient.h.
        * Target.pri: Ditto.
        * WebCore.gypi: Ditto.

        * WebCore.xcodeproj/project.pbxproj: Add new files.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setReadyState): No need to call processInbandTextTracks, in-band tracks
            are now registered by the media engine as they are discovered.
        (WebCore::HTMLMediaElement::mediaPlayerDidAddTrack): New, called by the media player when a new
            in-band track is found.
        (WebCore::HTMLMediaElement::mediaPlayerDidRemoveTrack): New, called by the media player when an
            in-band track goes away.
        * html/HTMLMediaElement.h:

        * html/track/InbandTextTrack.cpp:
        (WebCore::InbandTextTrack::InbandTextTrack): Use m_private instead of tracksPrivate because
            it is zeroed during assignment.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::addTextTrack): New MediaPlayerClient method to allow MediaPlayerPrivate subclasses
            to add a new in-band track.
        (WebCore::MediaPlayer::removeTextTrack): New MediaPlayerClient method to allow MediaPlayerPrivate subclasses
            to remove a new in-band track.
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:

        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Added.
        (WebCore::InbandTextTrackPrivateAVF::InbandTextTrackPrivateAVF):
        (WebCore::InbandTextTrackPrivateAVF::~InbandTextTrackPrivateAVF):
        (WebCore::InbandTextTrackPrivateAVF::processCueAttributes): Convert an attribute string into WebVTT 
            cue setting and content strings.
        (WebCore::InbandTextTrackPrivateAVF::processCue): Process a new cue.
        (WebCore::InbandTextTrackPrivateAVF::disconnect): Clear member variables.
        (WebCore::InbandTextTrackPrivateAVF::resetCueValues): Reset cue values to defaults.
        (WebCore::InbandTextTrackPrivateAVF::setMode): Set track mode and call player's trackModeChanged.
        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.h: Added.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp: Initialize 
            m_inbandTrackConfigurationPending.
        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
        (WebCore::MediaPlayerPrivateAVFoundation::seekCompleted): Flush the currently accumulating
            cue so it doesn't get the wrong duration.
        (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification): Handle InbandTracksNeedConfiguration.
        (WebCore::MediaPlayerPrivateAVFoundation::flushCurrentCue): New, pass the current cue up to the client.
        (WebCore::MediaPlayerPrivateAVFoundation::configureInbandTracks): Configure in-band tracks.
        (WebCore::MediaPlayerPrivateAVFoundation::trackModeChanged): Schedule a call to configureInbandTracks.
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:

        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.h: Added.
        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.mm: Added.
        (WebCore::InbandTextTrackPrivateAVFObjC::InbandTextTrackPrivateAVFObjC):
        (WebCore::InbandTextTrackPrivateAVFObjC::disconnect):
        (WebCore::InbandTextTrackPrivateAVFObjC::kind): Return track kind.
        (WebCore::InbandTextTrackPrivateAVFObjC::label): Return track label.
        (WebCore::InbandTextTrackPrivateAVFObjC::language): Return track language.
        (WebCore::InbandTextTrackPrivateAVFObjC::isDefault): 
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        (MediaPlayerPrivateAVFoundationObjC):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::playerItem):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC): Initialize m_currentTrack.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Clear m_legibleOutput.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Create and initialize m_legibleOutput.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::processTextTracks): Called when the player item's
            "tracks" changes, add and remove in-band text tracks as necessary.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::processCue): Pass an attributed string to the current 
            track to be processed.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setCurrentTrack): Tell AVFoundation to select an in-band track.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::currentTrack): Return the current track.
        (-[WebCoreAVFMovieObserver legibleOutput:didOutputAttributedStrings:nativeSampleBuffers:forItemTime:]): Legible
            output delegate.

2012-11-21  Eric Carlson  <eric.carlson@apple.com>

        In-band text tracks infrastructure
        https://bugs.webkit.org/show_bug.cgi?id=102830

        Reviewed by Philippe Normand.

        Add the infrastructure necessary to allow a port-specific media engine to expose in-band text
        tracks.

        No new tests, this patch only adds plumbing. Existing tests verify that these changes don't
        break existing functionality.

        * CMakeLists.txt: Add new project files.
        * GNUmakefile.list.am: Ditto.
        * Target.pri: Ditto.
        * WebCore.gypi: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setReadyState): Call processInbandTextTracks when readyState reaches
            HAVE_METADATA
        (WebCore::HTMLMediaElement::processInbandTextTracks): Fetch the in-band text tracks from the 
            media player and processes them.
        * html/HTMLMediaElement.h:

        * html/track/InbandTextTrack.cpp: Added.
        * html/track/InbandTextTrack.h: Added.
        * html/track/InbandTextTrackPrivate.h: Added.

        * html/track/TextTrack.h:
        (TextTrack):
        (WebCore::TextTrack::clearClient): Remove virtual, it is unnecessary
        (WebCore::TextTrack::mode): Make virtual so derived classes can override.
        (WebCore::TextTrack::setMode): Ditto.

        * html/track/TextTrackList.cpp:
        (TextTrackList::length): Update to deal with in-band tracks.
        (TextTrackList::getTrackIndex): Ditto.
        (TextTrackList::getTrackIndexRelativeToRenderedTracks): Ditto.
        (TextTrackList::item): Ditto.
        (TextTrackList::invalidateTrackIndexesAfterTrack): New, invalidate the cached track indexes of
            all tracks after another.
        (TextTrackList::append): Update to deal with in-band tracks.
        (TextTrackList::remove): Update to deal with in-band tracks.
        (TextTrackList::scheduleAddTrackEvent): Remove typo.
        * html/track/TextTrackList.h:

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::getTextTracks): New, pass through to the media engine.
        (WebCore::MediaPlayer::setTextTrackClient):
        * platform/graphics/MediaPlayer.h:

        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::setPreload): Cleanup.
        (WebCore::MediaPlayerPrivateInterface::sourceEndOfStream): Ditto.
        (WebCore::MediaPlayerPrivateInterface::getTextTracks): New client method.
        (WebCore::MediaPlayerPrivateInterface::setTextTrackClient): Ditto.

2012-10-24  Eric Carlson  <eric.carlson@apple.com>

        Allow ports to override text track rendering style
        https://bugs.webkit.org/show_bug.cgi?id=97800
        <rdar://problem/12044964>

        Reviewed by Maciej Stachowiak.

        * WebCore.exp.in: Export new WebkitSystemInterface functions.
        * WebCore.xcodeproj/project.pbxproj: Add CaptionUserPreferences.h, CaptionUserPreferencesMac.mm,
            and CaptionUserPreferencesMac.h.

        * css/mediaControls.css: Rearrange the caption CSS so it is possible to style the cue window,
            background, and text independently.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_disableCaptions with theme->userPrefersCaptions().
        (WebCore::HTMLMediaElement::attach): Register for caption preferences change callbacks.
        (WebCore::HTMLMediaElement::detach): Unregister for caption preferences change callbacks.
        (WebCore::HTMLMediaElement::userPrefersCaptions): Return theme->userPrefersCaptions().
        (WebCore::HTMLMediaElement::userIsInterestedInThisTrackKind): Consider userPrefersCaptions().
        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): Move the code that marks all tracks as
            un-configured to markCaptionAndSubtitleTracksAsUnconfigured so it can be reused.
        (WebCore::HTMLMediaElement::captionPreferencesChanged): New, force a reevaluation of all text tracks.
        (WebCore::HTMLMediaElement::markCaptionAndSubtitleTracksAsUnconfigured): New, code moved from 
            setClosedCaptionsVisible
        * html/HTMLMediaElement.h: Inherit from CaptionPreferencesChangedListener.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTextTrackContainerElement::updateSizes): Get rid of unnecessary member
            variable. Get caption font scale from theme instead of hard coding.
        * html/shadow/MediaControlElements.h:

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::TextTrack): Change attributes from String to AtomicString.
        (WebCore::TextTrack::isValidKindKeyword): Ditto.
        (WebCore::TextTrack::setKind): Ditto.
        (WebCore::TextTrack::setMode): Ditto.
        (WebCore::TextTrack::mode): Ditto.
        * html/track/TextTrack.h:
        (WebCore::TextTrack::create): Ditto.
        (WebCore::TextTrack::kind): Ditto.
        (WebCore::TextTrack::label): Ditto.
        (WebCore::TextTrack::setLabel): Ditto.
        (WebCore::TextTrack::language): Ditto.
        (WebCore::TextTrack::setLanguage): Ditto.

        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCueBox::TextTrackCueBox): Set the shadow pseudo id.
        (WebCore::TextTrackCueBox::textTrackCueBoxShadowPseudoId): New, class method to return the 
            shadow pseudo id so it can be used elsewhere.
        (WebCore::TextTrackCueBox::shadowPseudoId): Call textTrackCueBoxShadowPseudoId.
        (WebCore::TextTrackCue::pastNodesShadowPseudoId): New, class method to return the 
            shadow pseudo id so it can be used elsewhere.
        (WebCore::TextTrackCue::futureNodesShadowPseudoId): Ditto.
        (WebCore::TextTrackCue::updateDisplayTree):
        * html/track/TextTrackCue.h:

        * page/CaptionUserPreferences.h: Added.
        * page/CaptionUserPreferencesMac.h: Added.
        * page/CaptionUserPreferencesMac.mm: Added.
        (WebCore::userCaptionPreferencesChangedNotificationCallback):
        (WebCore::CaptionUserPreferencesMac::CaptionUserPreferencesMac):
        (WebCore::CaptionUserPreferencesMac::~CaptionUserPreferencesMac):
        (WebCore::CaptionUserPreferencesMac::userHasCaptionPreferences): New, passthrough to WKSI function.
        (WebCore::CaptionUserPreferencesMac::userPrefersCaptions): Ditto.
        (WebCore::CaptionUserPreferencesMac::captionsWindowColor): Return Color with user's caption window color preference.
        (WebCore::CaptionUserPreferencesMac::captionsBackgroundColor): Return Color with user's caption 
            background color preference.
        (WebCore::CaptionUserPreferencesMac::captionsTextColor): Return Color with user's caption text color preference.
        (WebCore::CaptionUserPreferencesMac::captionsEdgeColorForTextColor): Return Color for text edge effect.
        (WebCore::CaptionUserPreferencesMac::cssPropertyWithTextEdgeColor): Return String with CSS to set a text-shadow
            or webkit-text-stroke property.
        (WebCore::CaptionUserPreferencesMac::cssColorProperty): Return a String with css to set a property 
            with a color value.
        (WebCore::CaptionUserPreferencesMac::captionsTextEdgeStyle): Return a String with css to style caption 
            text with the user's preferred text edge stye.
        (WebCore::CaptionUserPreferencesMac::captionsDefaultFont): Return a String with css to style caption
            text with the user's preferred font.
        (WebCore::CaptionUserPreferencesMac::captionsStyleSheetOverride): Return a String with css to style captions
            with the user's preferred style.
        (WebCore::CaptionUserPreferencesMac::captionFontSizeScale): Return the user's preferred caption font scale.
        (WebCore::CaptionUserPreferencesMac::captionPreferencesChanged): Notify listeners of caption preference change.
        (WebCore::CaptionUserPreferencesMac::registerForCaptionPreferencesChangedCallbacks): Add a caption preferences 
            changes listener.
        (WebCore::CaptionUserPreferencesMac::unregisterForCaptionPreferencesChangedCallbacks): Remove a caption preferences
            changes listener.
        (WebCore::CaptionUserPreferencesMac::updateCaptionStyleSheetOveride): New, if theme has a captions style sheet override,
            inject it into the current page group, otherwise remove injected sheet.

        * page/PageGroup.cpp:
        (WebCore::PageGroup::captionPreferences):
        (WebCore::PageGroup::registerForCaptionPreferencesChangedCallbacks): New, passthrough to platform specific function
            of the same name.
        (WebCore::PageGroup::unregisterForCaptionPreferencesChangedCallbacks): Ditto.
        (WebCore::PageGroup::userPrefersCaptions): Ditto.
        (WebCore::PageGroup::userHasCaptionPreferences): Ditto.
        (WebCore::PageGroup::captionFontSizeScale): Ditto.
        * page/PageGroup.h:

        * platform/mac/WebCoreSystemInterface.h: Updated.
        * platform/mac/WebCoreSystemInterface.mm: Ditto.

2012-08-27  Anna Cavender  <annacc@chromium.org>

        TextTrack modes are strings
        https://bugs.webkit.org/show_bug.cgi?id=85050

        Reviewed by Eric Carlson.

        The spec recently changed away from enumeration to string for the type
        of TextTrack mode.
        http://dev.w3.org/html5/spec/media-elements.html#texttrackmode

        No new tests. Updates to existing tests.

        * html/HTMLMediaElement.cpp:

        Use the new string mode rather than the old enum.  Also, TextTrack::setMode()
        no longer requires an ExceptionCode:
        (WebCore::HTMLMediaElement::loadInternal):
        (WebCore::HTMLMediaElement::textTrackModeChanged):
        (WebCore::HTMLMediaElement::textTrackKindChanged):
        (WebCore::HTMLMediaElement::addTextTrack):
        (WebCore::HTMLMediaElement::showingTrackWithSameKind):
        (WebCore::HTMLMediaElement::configureTextTrackGroup):
        (WebCore::HTMLMediaElement::configureNewTextTracks):
        (WebCore::HTMLMediaElement::configureTextTrackDisplay):

        * html/track/TextTrack.cpp:

        Update these methods to use ConstructFromLiteral for efficiency:
        (WebCore::TextTrack::subtitlesKeyword):
        (WebCore::TextTrack::captionsKeyword):
        (WebCore::TextTrack::descriptionsKeyword):
        (WebCore::TextTrack::chaptersKeyword):
        (WebCore::TextTrack::metadataKeyword):

        New methods to use for the mode string (replacing the enum):
        (WebCore::TextTrack::disabledKeyword):
        (WebCore::TextTrack::hiddenKeyword):
        (WebCore::TextTrack::showingKeyword):

        (WebCore::TextTrack::TextTrack): Initialize mode to disabled.
        (WebCore::TextTrack::setMode): Remove ExceptionCode and no longer throw an
        INVALID_ACCESS_ERR.
        (WebCore::TextTrack::mode): Return a keyword string instead of an enum.

        Use the new string mode rather than the old enum:
        (WebCore::TextTrack::cues):
        (WebCore::TextTrack::activeCues):
        (WebCore::TextTrack::isRendered):

        * html/track/TextTrack.h: Remove old enum, add new string keyword methods,
        and update mode() and setMode() accordingly.

        * html/track/TextTrack.idl: Remove old enum and make mode attribute be a string.

        Use the new string mode rather than the old enum:
        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCue::dispatchEvent):
        (WebCore::TextTrackCue::isActive):

2013-02-13  Jer Noble  <jer.noble@apple.com>

        Add a CDMClient class which allows the CDM to query for the currently attached MediaPlayer.
        https://bugs.webkit.org/show_bug.cgi?id=109702

        Reviewed by Eric Carlson.

        Some CDM implementations will need to work closely with an associated
        MediaPlayer in order to generate key requests and provide keys. Add a
        client protocol to be implemented by the MediaKeys object which can
        provide access to the associated MediaPlayer if present.

        * Modules/encryptedmedia/CDM.cpp:
        (WebCore::CDM::CDM): Initialize the m_client ivar.
        (WebCore::CDM::mediaPlayer): Pass to the client, if present.
        * Modules/encryptedmedia/CDM.h:
        (WebCore::CDM::client): Simple getter.
        (WebCore::CDM::setClient): Simple setter.
        * Modules/encryptedmedia/MediaKeys.cpp:
        (WebCore::MediaKeys::MediaKeys): Initialize the m_mediaElement ivar
            and call setClient() on the passed in CDM.
        (WebCore::MediaKeys::setMediaElement): Simple setter.
        (WebCore::MediaKeys::cdmMediaPlayer): Retrieve the MediaPlayer from
            the m_mediaElement if present.
        * Modules/encryptedmedia/MediaKeys.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement): Call setMediaKeys(0)
            to clear the mediaElement in any associated MediaKeys.
        (WebCore::HTMLMediaElement::setMediaKeys): Clear the mediaElement on
            any associated MediaKeys, and set the mediaElement on the newly
            associated MediaKeys.

2013-02-14  Jer Noble  <jer.noble@apple.com>

        EME: replace MediaKeySession.addKey() -> update()
        https://bugs.webkit.org/show_bug.cgi?id=109461

        Reviewed by Eric Carlson.

        No new tests; updated media/encrypted-media/encrypted-media-v2-syntax.html test.

        In the latest draft of the Encrypted Media Spec, the addKeys() method has been replaced
        with update().

        * Modules/encryptedmedia/CDM.h:
        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::update):
        (WebCore::MediaKeySession::addKeyTimerFired):
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/encryptedmedia/MediaKeySession.idl:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::webkitAddKey):
        * testing/MockCDM.cpp:
        (WebCore::MockCDMSession::update):

2013-02-13  Jer Noble  <jer.noble@apple.com>

        EME: MediaPlayer::keyNeede() should return a bool indicating whether an event listener was triggered.
        https://bugs.webkit.org/show_bug.cgi?id=109701

        Reviewed by Eric Carlson.

        Clients of MediaPlayer may need to do cleanup if calling keyNeeded()
        results in no event listener being triggered. Return a bool (like the
        v1 equivalent keyNeeded method) to indicate this.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerKeyNeeded):
        * html/HTMLMediaElement.h:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::keyNeeded):
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerKeyNeeded):

2013-02-08  Jer Noble  <jer.noble@apple.com>

        Bring WebKit up to speed with latest Encrypted Media spec.
        https://bugs.webkit.org/show_bug.cgi?id=97037

        Reviewed by Eric Carlson.

        The most recent version of the Encrypted Media Extensions spec breaks functionality out of the
        HTMLMediaElement and into new MediaKeys and MediaKeySession classes. Since the CDM functionality
        has been pulled out of the media element, we create a proxy CDM class and factory system for
        creating specific CDM key system implementations. The spec also breaks out MediaKeyEvent
        into distinct event classes, MediaKeyNeededEvent and MediaKeyMessageEvent, for needkey and
        keymessage events, respectively.

        Tests: media/encrypted-media/encrypted-media-v2-events.html
               media/encrypted-media/encrypted-media-v2-syntax.html

        CDM is a proxy class (a la MediaPlayer) for a specific CDMPrivateInterface implementation. A CDM
        implementation is registered with the CDMFactory and will be created if that implementation supports
        the key system passed into the MediaKeys constructor. CDMSession is a pure-virtual interface exposed
        by concrete CDMPrivate subclasses.  Its lifetime is owned by MediaKeySession.
        * Modules/encryptedmedia/CDM.cpp: Added.
        (WebCore::installedCDMFactories): Initialize all the known CDM subtypes. Ports will add CDM implementations here.
        (WebCore::CDM::registerCDMFactory): Registers a new CDMFactory using the passed in function pointers.
        (WebCore::CDMFactoryForKeySystem): Return the first CDM factory which supports the requested key system.
        (WebCore::CDM::supportsKeySystem): Walk the installed CDMs and ask if the given key system is supported.
        (WebCore::CDM::supportsKeySystemMIMETypeAndCodec): Ditto, with an additional MIME type and codec string.
        (WebCore::CDM::create): Simple constructor wrapper.
        (WebCore::CDM::CDM): Simple constructor; calls bestCDMForKeySystem() to create it's private implementation.
        (WebCore::CDM::~CDM): Simple destructor.
        (WebCore::CDM::createSession): Creates a new CDMSession.
        * Modules/encryptedmedia/CDM.h: Added.
        (WebCore::CDM::keySystem): Simple accessor for m_keySystem.
        (WebCore::CDMSession::CDMSession): Simple constructor.
        (WebCore::CDMSession::~CDMSession): Simple destructor.
        * Modules/encryptedmedia/CDMPrivate.h: Added.
        (WebCore::CDMPrivateInterface::CDMPrivateInterface): Simple constructor.
        (WebCore::CDMPrivateInterface::~CDMPrivateInterface): Simple destructor.

        The new classes, MediaKeyMessageEvent and MediaKeyNeededEvent, take distinct subsets of the initializers of
        the original MediaKeyMessageEvent.
        * Modules/encryptedmedia/MediaKeyMessageEvent.cpp: Copied from Source/WebCore/html/MediaKeyEvent.cpp.
        (WebCore::MediaKeyMessageEventInit::MediaKeyMessageEventInit): Initializer now only takes message and destinationURL
            parameters.
        (WebCore::MediaKeyMessageEvent::MediaKeyMessageEvent): Simple constructor.
        (WebCore::MediaKeyMessageEvent::~MediaKeyMessageEvent): Simple destructor.
        (WebCore::MediaKeyMessageEvent::interfaceName): Standard interfaceName.
        * Modules/encryptedmedia/MediaKeyMessageEvent.h: Copied from Source/WebCore/html/MediaKeyEvent.h.
        (WebCore::MediaKeyMessageEvent::create): Simple construction wrapper.
        (WebCore::MediaKeyMessageEvent::message): Simple accessor for m_message.
        (WebCore::MediaKeyMessageEvent::destinationURL): Simple accessor for m_destinationURL.
        * Modules/encryptedmedia/MediaKeyMessageEvent.idl: Copied from Source/WebCore/html/MediaKeyEvent.idl.
        * Modules/encryptedmedia/MediaKeyNeededEvent.cpp: Copied from Source/WebCore/html/MediaKeyEvent.h.
        (WebCore::MediaKeyNeededEventInit::MediaKeyNeededEventInit): Initializer now only takes initData parameter.
        (WebCore::MediaKeyNeededEvent::MediaKeyNeededEvent): Simple constructor.
        (WebCore::MediaKeyNeededEvent::~MediaKeyNeededEvent): Simple destructor.
        (WebCore::MediaKeyNeededEvent::interfaceName): Standard interfaceName.
        * Modules/encryptedmedia/MediaKeyNeededEvent.h: Copied from Source/WebCore/html/MediaKeyEvent.h.
        (WebCore::MediaKeyNeededEvent::create): Simple construction wrapper.
        (WebCore::MediaKeyNeededEvent::initData): Simple accessor for m_initData.
        * Modules/encryptedmedia/MediaKeyNeededEvent.idl: Copied from Source/WebCore/html/MediaKeyEvent.idl.

        MediaKeySession is a new class that maps keys and key requests to a given session ID:
        * Modules/encryptedmedia/MediaKeySession.cpp: Added.
        (WebCore::MediaKeySession::create): Simple construction wrapper.
        (WebCore::MediaKeySession::MediaKeySession): Simple constructor.
        (WebCore::MediaKeySession::~MediaKeySession): Simple destructor; calls close().
        (WebCore::MediaKeySession::setError): Simple setter for m_error;
        (WebCore::MediaKeySession::close): Tell the CDM to clear any saved session keys.
        (WebCore::MediaKeySession::generateKeyRequest): Start a one-shot timer, handled in keyRequestTimerFired.
        (WebCore::MediaKeySession::keyRequestTimerFired): Follow the steps in the spec; ask the CDM to generate a key request.
        (WebCore::MediaKeySession::addKey): Start a one-shot timer, handled in addKeyTimerFired.
        (WebCore::MediaKeySession::addKeyTimerFired): Follow the steps in the spec; provide the key data to the CDM.
        * Modules/encryptedmedia/MediaKeySession.h: Added.
        (WebCore::MediaKeySession::keySystem): Simple accessor for m_keySystem.
        (WebCore::MediaKeySession::sessionId): Simple accessor for m_sessionId.
        (WebCore::MediaKeySession::error): Simple accessor for m_error;
        * Modules/encryptedmedia/MediaKeySession.idl:

        MediaKeySession inherits from EventTarget, and must override the pure virtual functions in that class:
        * Modules/encryptedmedia/MediaKeySession.cpp: Added.
        (WebCore::MediaKeySession::interfaceName):
        * Modules/encryptedmedia/MediaKeySession.h: Added.
        (WebCore::MediaKeySession::refEventTarget):
        (WebCore::MediaKeySession::derefEventTarget):
        (WebCore::MediaKeySession::eventTargetData):
        (WebCore::MediaKeySession::ensureEventTargetData):
        (WebCore::MediaKeySession::scriptExecutionContext):

        MediaKeys is a new class that encapsulates a CDM and a number of key sessions:
        * Modules/encryptedmedia/MediaKeys.cpp: Added.
        (WebCore::MediaKeys::create): Throw an exception if the key system parameter is unsupported; create a CDM object
            and a new MediaKeys session.
        (WebCore::MediaKeys::MediaKeys): Simple constructor.
        (WebCore::MediaKeys::~MediaKeys): Simple destructor.
        (WebCore::MediaKeys::createSession): Follow the spec and create a new key session.
        * Modules/encryptedmedia/MediaKeys.h: Added.
        * Modules/encryptedmedia/MediaKeys.idl: Copied from Source/WebCore/html/MediaError.idl.

        Provide a new interface to HTMLMediaElement for MediaPlayer which does not require a sessionId or a key system:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerKeyNeeded):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::keyNeeded):

        MediaKeyError now has a systemCode parameter and member variable.
        * html/MediaKeyError.h:
        (WebCore::MediaKeyError::create): Take a systemCode parameter with a default (0) value.
        (WebCore::MediaKeyError::MediaKeyError): Ditto.
        (WebCore::MediaKeyError::systemCode): Simple accessor for m_systemCode.
        * html/MediaKeyError.idl:

        Add new methods to HTMLMediaElement to support MediaKeys. Support different initializer
        for the MediaKeyNeededEvent.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setMediaKeys): Simple setter for m_mediaKeys.
        (WebCore::HTMLMediaElement::mediaPlayerKeyNeeded): This version takes fewer parameters
            than the deprecated version.
        * html/HTMLMediaElement.h:
        (WebCore::HTMLMediaElement::mediaKeys): Simple accessor for m_mediaKeys.
        * html/HTMLMediaElement.idl: Add the mediaKeys attribute.

        Add an ENABLE(ENCRYPTED_MEDIA_V2) check to the existing ENABLE(ENCRYPTED_MEDIA) one:
        * html/MediaError.h:
        * html/MediaError.idl:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::bestMediaEngineForTypeAndCodecs):
        (WebCore::MediaPlayer::supportsType):
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayer::keyNeeded): This version takes fewer parameters than the
            deprecated version.

        Support the new version of canPlayType which takes an extra parameter:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::registerMediaEngine):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::extendedSupportsType):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::registerMediaEngine):
        (WebCore::MediaPlayerPrivateQTKit::extendedSupportsType):

        Add a mock CDM for use within DRT and WKTR to test the MediaKeys and MediaKeySession
        APIs and events:
        * testing/Internals.cpp:
        (WebCore::Internals::initializeMockCDM): Add the MockCDM class to the CDM factories.
        * testing/Internals.h:
        * testing/Internals.idl: Add the initializeMockCDM() method.
        * testing/MockCDM.cpp: Added.
        (WebCore::MockCDM::supportsKeySystem): Only supports the 'com.webcore.mock' key system.
        (WebCore::MockCDM::supportsMIMEType): Only supports the 'video/mock' mime type.
        (WebCore::initDataPrefix): Static method which returns a Uint8Array containing 'mock'.
        (WebCore::keyPrefix): Static method which returns a Uint8Array containing 'key'.
        (WebCore::keyRequest): Static method which returns a Uint8Array containing 'request'.
        (WebCore::generateSessionId): Return a monotonically increasing number.
        (WebCore::MockCDMSession::MockCDMSession): Simple constructor.
        (WebCore::MockCDMSession::generateKeyRequest): Ignores the parameters and returns a keyRequest() array.
        (WebCore::MockCDMSession::releaseKeys): No-op.
        (WebCore::MockCDMSession::addKey): Checks that the key starts with the keyPrefix() array.
        * testing/MockCDM.h: Added.
        (WebCore::MockCDM::create):
        (WebCore::MockCDM::~MockCDM): Simple destructor.
        (WebCore::MockCDM::MockCDM): Simple constructor.

        Add the new classes to the built system:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.make:
        * WebCore.exp.in:
        * WebCore.xcodeproj/project.pbxproj:

        Miscelaneous changes:
        * dom/EventNames.in: Add the two new event types, MediaKeyMessageEvent and MediaKeyNeededEvent.
        * dom/EventTargetFactory.in: Add the new EventTarget, MediaKeySession.
        * page/DOMWindow.idl: Add constructors for the new classes to the window object.

2012-12-14  Jessie Berlin  <jberlin@apple.com>

        Mac build fix after r137724.

        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerKeyAdded):
        Comment out the names of the unused parameters so they don't trigger unused parameter
        warnings.
        (WebCore::MediaPlayerClient::mediaPlayerKeyError):
        Ditto.
        (WebCore::MediaPlayerClient::mediaPlayerKeyMessage):
        Ditto.
        (WebCore::MediaPlayerClient::mediaPlayerKeyNeeded):
        Ditto.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::generateKeyRequest):
        Pass an empty URL for the new defaultURL parameter in the keyMessage call.

2012-12-12  Aaron Colwell  <acolwell@chromium.org>

        Remove MediaSource 'ended' to 'open' transition when seeking.
        https://bugs.webkit.org/show_bug.cgi?id=104583

        Reviewed by Eric Carlson.

        Remove the 'ended' to 'open' transition on a seek.

        No new tests. The following tests were updated to reflect the new behavior.
          http/tests/media/media-source/video-media-source-seek.html
          http/tests/media/media-source/video-media-source-state-changes.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::seek):

2012-10-23  Aaron Colwell  <acolwell@chromium.org>

        Clear m_mediaSource reference when the MediaSource is closed
        https://bugs.webkit.org/show_bug.cgi?id=100047

        Reviewed by Eric Carlson.

        The m_mediaSource object shouldn't be accessed after the object
        transitions to closed so this change simply clears the reference
        when that transition happens.

        No new tests because the change isn't visible to JavaScript.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource): Removed a closed transition that is actually dead code.
        (WebCore::HTMLMediaElement::setSourceState): Clear the m_mediaSource reference on closed transition.

2012-08-22  Victor Carbune  <victor@rosedu.org>

        DOM manipulation crashes the browser

        Creating a DOM track element by script and changing the mode crashes
        results in a browser crash.
        https://bugs.webkit.org/show_bug.cgi?id=94628

        Reviewed by Eric Carlson.

        Simple fix that creates the text track cue list in case of mode change.

        Test: media/track/track-element-dom-change-crash.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::textTrackModeChanged):

2013-03-21  Praveen R Jadhav  <praveen.j@samsung.com>

        Remove AudioGain.idl from compilation.
        https://bugs.webkit.org/show_bug.cgi?id=112650

        Reviewed by Chris Rogers.

        Spec: https://dvcs.w3.org/hg/audio/raw-file/tip/webaudio/specification.html#GainNode
              https://dvcs.w3.org/hg/audio/raw-file/tip/webaudio/specification.html#AudioBufferSourceNode

        AudioParam serves the same purpose as AudioGain. Infact, AudioGain inherits
        AudioParam class and doesn't have its own member functions/parameters. Also,
        AudioGain is not part of WebAudio W3C specifications.

        Test: webaudio/gain-basic.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
        * Modules/webaudio/AudioBufferSourceNode.h:
        (AudioBufferSourceNode):
        (WebCore::AudioBufferSourceNode::gain):
        * Modules/webaudio/AudioBufferSourceNode.idl:
        * Modules/webaudio/AudioGain.h: Removed.
        * Modules/webaudio/AudioGain.idl: Removed.
        * Modules/webaudio/GainNode.cpp:
        (WebCore::GainNode::GainNode):
        * Modules/webaudio/GainNode.h:
        (WebCore):
        (WebCore::GainNode::create):
        (GainNode):
        (WebCore::GainNode::gain):
        * Modules/webaudio/GainNode.idl:
        * Modules/webaudio/PannerNode.cpp:
        (WebCore::PannerNode::PannerNode):
        * Modules/webaudio/PannerNode.h:
        (WebCore::PannerNode::distanceGain):
        (WebCore::PannerNode::coneGain):
        * Target.pri:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:

2013-03-20  Xingnan Wang  <xingnan.wang@intel.com>

        ASSERTION FAILED: !m_renderingAutomaticPullNodes.size()
        https://bugs.webkit.org/show_bug.cgi?id=112777

        Reviewed by Chris Rogers.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::~AudioContext):

2013-03-18  Wei James  <james.wei@intel.com>

        AudioBasicProcessorNode need to check for deferred updating of output channels
        https://bugs.webkit.org/show_bug.cgi?id=112544

        There can in rare cases be a slight delay before the output
        bus is updated to the new number of channels because of tryLocks() in the
        context's updating system but the processor already updated to the new
        number of channels, so need to check the channel number before processing.

        Reviewed by Chris Rogers.

        * Modules/webaudio/AudioBasicProcessorNode.cpp:
        (WebCore::AudioBasicProcessorNode::process):
        * Modules/webaudio/WaveShaperProcessor.cpp:
        (WebCore::WaveShaperProcessor::process):
        * platform/audio/AudioDSPKernelProcessor.cpp:
        (WebCore::AudioDSPKernelProcessor::AudioDSPKernelProcessor):
        * platform/audio/AudioDSPKernelProcessor.h:
        (WebCore::AudioDSPKernelProcessor::numberOfChannels):
        (AudioDSPKernelProcessor):
        * platform/audio/AudioProcessor.h:
        (WebCore::AudioProcessor::AudioProcessor):
        (AudioProcessor):

2012-12-04  Michael Pruett  <michael@68k.org>

        [JSC] Generate visitChildren() for uncustomized EventTarget interfaces
        https://bugs.webkit.org/show_bug.cgi?id=103908

        Reviewed by Geoffrey Garen.

        CodeGeneratorJS.pm should automatically generate visitChildren()
        for EventTarget interfaces without custom mark functions even if
        those interfaces have no functions or cached attributes.

        This change is needed for IDBOpenDBRequest and IDBVersionChangeRequest.

        No new tests. Covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):

2013-03-18  Kentaro Hara  <haraken@chromium.org>

        Unreviewed, rolling out r146033.
        http://trac.webkit.org/changeset/146033
        https://bugs.webkit.org/show_bug.cgi?id=112521

        web audio tests are broken

        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::AudioNode):
        * Modules/webaudio/AudioNode.h:
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/ScriptProcessorNode.idl:

2013-03-17  Russell McClellan  <russell.mcclellan@gmail.com>

        ScriptProcessorNode is garbage collected while still active if unreachable
        https://bugs.webkit.org/show_bug.cgi?id=112521

        Reviewed by Kentaro Hara.

        Fix for issue where ScriptProcessorNodes (and AudioNode js wrappers generally)
        would be garbage collected before their time.  Made AudioNode an ActiveDOMElement
        marked pending if there are any open audio connections.

        Test: webaudio/javascriptaudionode.html

        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::AudioNode): 
        (WebCore::AudioNode::hasPendingActivity): it's pending (and thus not GCed)
        if it has open audio connections.
        * Modules/webaudio/AudioNode.h: AudioNode is now an ActiveDOMElement
        * Modules/webaudio/AudioScheduledSourceNode.h: added a using declaration
        to avoid function name hiding.
        * Modules/webaudio/ScriptProcessorNode.idl: AudioNode is an ActiveDOMElement

2013-03-15  Andreas Kling  <akling@apple.com>

        [JSC] Remove custom WebAudio mark functions that we can generate instead.
        <http://webkit.org/b/110976>

        Reviewed by Eric Carlson.

        Remove custom JSC mark functions for AudioContext and ScriptProcessorNode since they
        are trivial to generate.

        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/ScriptProcessorNode.idl:
        * GNUmakefile.list.am:
        * UseJSC.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSAudioContextCustom.cpp:
        * bindings/js/JSScriptProcessorNodeCustom.cpp: Removed.

2013-02-27  Chris Rogers  <crogers@google.com>

        Implement channel up-mixing and down-mixing rules
        https://bugs.webkit.org/show_bug.cgi?id=110812

        Reviewed by Kenneth Russell.

        Please see Web Audio specification for details of the AudioNode mixing rules attributes:
        https://dvcs.w3.org/hg/audio/raw-file/tip/webaudio/specification.html#UpMix

        Test: webaudio/audionode-channel-rules.html

        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::AudioNode):
        (WebCore::AudioNode::channelCount):
        (WebCore):
        (WebCore::AudioNode::setChannelCount):
        (WebCore::AudioNode::channelCountMode):
        (WebCore::AudioNode::setChannelCountMode):
        (WebCore::AudioNode::channelInterpretation):
        (WebCore::AudioNode::setChannelInterpretation):
        (WebCore::AudioNode::updateChannelsForInputs):
        * Modules/webaudio/AudioNode.h:
        (AudioNode):
        (WebCore::AudioNode::internalChannelCountMode):
        (WebCore::AudioNode::internalChannelInterpretation):
        * Modules/webaudio/AudioNode.idl:
        * Modules/webaudio/AudioNodeInput.cpp:
        (WebCore::AudioNodeInput::numberOfChannels):
        (WebCore::AudioNodeInput::bus):
        (WebCore::AudioNodeInput::internalSummingBus):
        (WebCore::AudioNodeInput::sumAllConnections):
        (WebCore::AudioNodeInput::pull):
        * Modules/webaudio/AudioNodeInput.h:
        (AudioNodeInput):
        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::ConvolverNode):
        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
        * Modules/webaudio/PannerNode.cpp:
        (WebCore::PannerNode::PannerNode):
        * platform/audio/AudioBus.cpp:
        (WebCore::AudioBus::speakersCopyFrom):
        (WebCore::AudioBus::speakersSumFrom):
        (WebCore::AudioBus::speakersSumFrom5_1_ToMono):
        (WebCore):
        * platform/audio/AudioBus.h:
        (AudioBus):

2013-02-22  Chris Rogers  <crogers@google.com>

        AudioDestination::create() needs extra device identification information for live/local input streams
        https://bugs.webkit.org/show_bug.cgi?id=109494

        Reviewed by James Robinson.

        AudioDestination::create() supports live/local audio input.  But, since there may be multiple
        audio input devices available, an identifier for the requested input device needs to be
        passed in.  The embedder may then use this information so that the proper audio hardware is
        accessed.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createMediaStreamSource):
        * Modules/webaudio/AudioDestinationNode.h:
        (AudioDestinationNode):
        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::initialize):
        (WebCore::DefaultAudioDestinationNode::createDestination):
        (WebCore::DefaultAudioDestinationNode::enableInput):
        * Modules/webaudio/DefaultAudioDestinationNode.h:
        (DefaultAudioDestinationNode):
        * Modules/webaudio/OfflineAudioDestinationNode.h:
        * platform/audio/AudioDestination.h:
        (AudioDestination):
        * platform/audio/chromium/AudioDestinationChromium.cpp:
        (WebCore::AudioDestination::create):
        (WebCore::AudioDestinationChromium::AudioDestinationChromium):
        * platform/audio/chromium/AudioDestinationChromium.h:
        (AudioDestinationChromium):
        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
        (WebCore::AudioDestination::create):
        * platform/audio/mac/AudioDestinationMac.cpp:
        (WebCore::AudioDestination::create):
        * platform/chromium/support/WebMediaStreamSource.cpp:
        (WebKit::WebMediaStreamSource::deviceId):
        (WebKit):
        (WebKit::WebMediaStreamSource::setDeviceId):
        * platform/mediastream/MediaStreamSource.h:
        (WebCore::MediaStreamSource::deviceId):
        (WebCore::MediaStreamSource::setDeviceId):
        (MediaStreamSource):

2013-02-15  Chris Rogers  <crogers@google.com>

        Enhance AudioBus copyFrom() and sumFrom() to be able to handle discrete and speakers up and down-mixing
        https://bugs.webkit.org/show_bug.cgi?id=109983

        Reviewed by Kenneth Russell.

        The Web Audio spec has a more detailed explanation for how channels are to be up and down-mixed:
        https://dvcs.w3.org/hg/audio/raw-file/tip/webaudio/specification.html#UpMix

        This patch adds the initial support for handling ChannelInterpretation, although no
        new JS API is yet implemented.

        No new tests since no new APIs have yet been exposed.

        * platform/audio/AudioBus.cpp:
        (WebCore::AudioBus::copyFrom):
        (WebCore):
        (WebCore::AudioBus::sumFrom):
        (WebCore::AudioBus::speakersCopyFrom):
        (WebCore::AudioBus::speakersSumFrom):
        (WebCore::AudioBus::discreteCopyFrom):
        (WebCore::AudioBus::discreteSumFrom):
        * platform/audio/AudioBus.h:
        (AudioBus):

2012-10-16  Chris Rogers  <crogers@google.com>

        Rename some AudioNodes
        https://bugs.webkit.org/show_bug.cgi?id=99358

        Reviewed by Daniel Bates.

        Here's a list of the node names, showing the changing ones:
            AudioBufferSourceNode
            MediaElementAudioSourceNode
            MediaStreamAudioSourceNode
            JavaScriptAudioNode ------------> ScriptProcessorNode
            RealtimeAnalyserNode ------------> AnalyserNode
            AudioGainNode ------------> GainNode
            DelayNode
            BiquadFilterNode
            AudioPannerNode ------------> PannerNode
            ConvolverNode
            AudioChannelSplitter ------------> ChannelSplitterNode
            AudioChannelMerger ------------> ChannelMergerNode
            DynamicsCompressorNode
            Oscillator ------------> OscillatorNode

        * CMakeLists.txt:
        * DerivedSources.make:
        * DerivedSources.pri:
        * GNUmakefile.list.am:
        * Modules/webaudio/AnalyserNode.cpp: Renamed from Source/WebCore/Modules/webaudio/RealtimeAnalyserNode.cpp.
        * Modules/webaudio/AnalyserNode.idl: Renamed from Source/WebCore/Modules/webaudio/RealtimeAnalyserNode.idl.
        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::setPannerNode):
        * Modules/webaudio/AudioBufferSourceNode.h:
        (AudioBufferSourceNode):
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createJavaScriptNode):
        (WebCore::AudioContext::createPanner):
        (WebCore::AudioContext::createAnalyser):
        (WebCore::AudioContext::createGainNode):
        (WebCore::AudioContext::createChannelSplitter):
        (WebCore::AudioContext::createChannelMerger):
        (WebCore::AudioContext::createOscillator):
        * Modules/webaudio/AudioContext.h:
        (WebCore):
        (AudioContext):
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/ChannelMergerNode.cpp: Renamed from Source/WebCore/Modules/webaudio/AudioChannelMerger.cpp.
        * Modules/webaudio/ChannelMergerNode.h: Renamed from Source/WebCore/Modules/webaudio/AudioChannelMerger.h.
        (WebCore):
        (ChannelMergerNode):
        * Modules/webaudio/ChannelMergerNode.idl: Renamed from Source/WebCore/Modules/webaudio/AudioChannelMerger.idl.
        * Modules/webaudio/ChannelSplitterNode.cpp: Renamed from Source/WebCore/Modules/webaudio/AudioChannelSplitter.cpp.
        * Modules/webaudio/ChannelSplitterNode.h: Renamed from Source/WebCore/Modules/webaudio/AudioChannelSplitter.h.
        (WebCore):
        (ChannelSplitterNode):
        * Modules/webaudio/ChannelSplitterNode.idl: Renamed from Source/WebCore/Modules/webaudio/AudioChannelSplitter.idl.
        * Modules/webaudio/DOMWindowWebAudio.idl:
        * Modules/webaudio/GainNode.cpp: Renamed from Source/WebCore/Modules/webaudio/AudioGainNode.cpp.
        * Modules/webaudio/GainNode.h: Renamed from Source/WebCore/Modules/webaudio/AudioGainNode.h.
        * Modules/webaudio/GainNode.idl: Renamed from Source/WebCore/Modules/webaudio/AudioGainNode.idl.
        * Modules/webaudio/OscillatorNode.cpp: Renamed from Source/WebCore/Modules/webaudio/Oscillator.cpp.
        * Modules/webaudio/OscillatorNode.h: Renamed from Source/WebCore/Modules/webaudio/Oscillator.h.
        * Modules/webaudio/OscillatorNode.idl: Renamed from Source/WebCore/Modules/webaudio/Oscillator.idl.
        * Modules/webaudio/PannerNode.cpp: Renamed from Source/WebCore/Modules/webaudio/AudioPannerNode.cpp.
        * Modules/webaudio/PannerNode.h: Renamed from Source/WebCore/Modules/webaudio/AudioPannerNode.h.
        (WebCore):
        * Modules/webaudio/PannerNode.idl: Renamed from Source/WebCore/Modules/webaudio/AudioPannerNode.idl.
        * Modules/webaudio/ScriptProcessorNode.cpp: Renamed from Source/WebCore/Modules/webaudio/JavaScriptAudioNode.cpp.
        * Modules/webaudio/ScriptProcessorNode.h: Renamed from Source/WebCore/Modules/webaudio/JavaScriptAudioNode.h.
        (WebCore):
        * Modules/webaudio/ScriptProcessorNode.idl: Renamed from Source/WebCore/Modules/webaudio/JavaScriptAudioNode.idl.
        * Modules/webaudio/WaveTable.cpp:
        (WebCore::WaveTable::createSine):
        (WebCore::WaveTable::createSquare):
        (WebCore::WaveTable::createSawtooth):
        (WebCore::WaveTable::createTriangle):
        (WebCore::WaveTable::generateBasicWaveform):
        * Target.pri:
        * UseJSC.cmake:
        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSScriptProcessorNodeCustom.cpp: Renamed from Source/WebCore/bindings/js/JSJavaScriptAudioNodeCustom.cpp.
        (WebCore):
        (WebCore::JSScriptProcessorNode::visitChildren):
        * dom/EventTarget.h:
        (WebCore):
        * dom/EventTargetFactory.in:

2012-10-13  Chris Rogers  <crogers@google.com>

        WebAudioBus needs support for resizing bus to a smaller size
        https://bugs.webkit.org/show_bug.cgi?id=99215

        Reviewed by Dimitri Glazkov.

        Upgrade AudioBus and WebAudioBus to support resizing to a smaller size, once it has been created.
        This is useful, for example, when decoding VBR formats and the actual length can't be exactly determined
        until the entire file is decoded.

        * platform/audio/AudioBus.cpp:
        (WebCore::AudioBus::resizeSmaller):
        (WebCore):
        * platform/audio/AudioBus.h:
        (AudioBus):
        * platform/audio/AudioChannel.cpp:
        (WebCore::AudioChannel::resizeSmaller):
        (WebCore):
        * platform/audio/AudioChannel.h:
        (AudioChannel):
        * platform/chromium/support/WebAudioBus.cpp:
        (WebKit::WebAudioBus::resizeSmaller):
        (WebKit):

2012-07-31  Chris Rogers  <crogers@google.com>

        Allow AudioDestination to support local/live audio input
        https://bugs.webkit.org/show_bug.cgi?id=90318

        Reviewed by Kenneth Russell.

        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        * GNUmakefile.list.am:
        Add AudioIOCallback.h to make files.

        * Modules/webaudio/AudioDestinationNode.h:
        * Modules/webaudio/AudioDestinationNode.cpp:
        (WebCore::AudioDestinationNode::render):
        Change provideInput() method to render() to support optional audio input.

        (AudioDestinationNode):
        (WebCore::AudioDestinationNode::localAudioInputProvider):
        Expose public access to an AudioSourceProvider for local/live audio input.

        (LocalAudioInputProvider):
        (WebCore::AudioDestinationNode::LocalAudioInputProvider::LocalAudioInputProvider):
        (WebCore::AudioDestinationNode::LocalAudioInputProvider::set):
        (WebCore::AudioDestinationNode::LocalAudioInputProvider::provideInput):
        Add simple AudioSourceProvider implementation which dishes out a single AudioBus each
        render quantum for optional local/live audio input.

        * Modules/webaudio/OfflineAudioDestinationNode.h:
        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
        (WebCore::OfflineAudioDestinationNode::startRendering):
        (WebCore::OfflineAudioDestinationNode::offlineRenderEntry):
        (WebCore::OfflineAudioDestinationNode::offlineRender):
        Simple name change using "offline" prefix to avoid confusion with AudioDestinationNode::render() method (implementing AudioIOCallback)

        * platform/audio/AudioDestination.h:
        Switch create() method to take an AudioIOCallback instead of AudioSourceProvider.

        * platform/audio/AudioIOCallback.h:
        (WebCore::AudioIOCallback::~AudioIOCallback):
        Add new AudioIOCallback interface for audio input/output.

        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
        (WebCore::AudioDestination::create):
        (WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
        * platform/audio/gstreamer/AudioDestinationGStreamer.h:
        (AudioDestinationGStreamer):
        (WebCore::AudioDestinationGStreamer::callback):
        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
        (_WebKitWebAudioSourcePrivate):
        (webKitWebAudioSrcSetProperty):
        (webKitWebAudioSrcLoop):
        Small tweaks to AudioDestinationGStreamer implementation to account for switch to AudioIOCallback.

        * platform/audio/mac/AudioDestinationMac.cpp:
        (WebCore::AudioDestination::create):
        (WebCore::AudioDestinationMac::AudioDestinationMac):
        (WebCore::AudioDestinationMac::render):
        * platform/audio/mac/AudioDestinationMac.h:
        (AudioDestinationMac):
        Small tweaks to AudioDestinationMac implementation to account for switch to AudioIOCallback.

2012-07-31  Li Yin  <li.yin@intel.com>

        AudioPannerNode should raise exception when distanceModel is set incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=90952

        Reviewed by Chris Rogers.

        Spec: http://www.w3.org/TR/webaudio/#AudioPannerNode-section
        The distance model can be only set to LINEAR_DISTANCE, INVERSE_DISTANCE or EXPONENTIAL_DISTANCE.
        If the incorrect value is set, it will raise the exception.
        Use the unsigned short to replace unsigned long in AudioPannerNode.idl.

        Test: webaudio/audiopannernode-basic.html

        * Modules/webaudio/AudioPannerNode.cpp:
        (WebCore::AudioPannerNode::setDistanceModel): raise exception
        (WebCore):
        * Modules/webaudio/AudioPannerNode.h:
        (AudioPannerNode):
        * Modules/webaudio/AudioPannerNode.idl: using unsigned short to replace unsigned long

2012-06-01  Raymond Toy  <rtoy@google.com>

        Remove RefInfo class
        https://bugs.webkit.org/show_bug.cgi?id=87904

        Reviewed by Chris Rogers.

        No new tests; covered by existing tests.

        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::~AudioBufferSourceNode): Clear
        panner node.
        (WebCore::AudioBufferSourceNode::totalPitchRate):
        (WebCore::AudioBufferSourceNode::setPannerNode): Use
        RefTypeConnection counting for panner node.
        (WebCore):
        (WebCore::AudioBufferSourceNode::clearPannerNode): New function to
         clear panner node in AudioBufferSourceNode.
        (WebCore::AudioBufferSourceNode::finish): Clear panner node when done.
        * Modules/webaudio/AudioBufferSourceNode.h:
        (AudioBufferSourceNode): Add virtual finish(), m_pannerNode is not
        a RefPtr anymore.
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::addDeferredFinishDeref): Remove unneeded RefTyp.
        (WebCore::AudioContext::handleDeferredFinishDerefs): Remove
        unneeded RefType.
        * Modules/webaudio/AudioContext.h:
        (AudioContext): Update addDeferredFinishDeref signature.
        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::deref): Update call to addDeferredFinishDeref. 
        * Modules/webaudio/AudioScheduledSourceNode.h:
        (AudioScheduledSourceNode): Make finish() virtual.

2012-05-15  Chris Rogers  <crogers@google.com>

        Add AudioSummingJunction class to handle fan-in (abstracted from AudioNodeInput)
        https://bugs.webkit.org/show_bug.cgi?id=86396

        Reviewed by Kenneth Russell.

        No new tests.  Existing layout tests already extensively test summing.

        * CMakeLists.txt:
        * GNUmakefile.list.am:
        Add AudioSummingJunction files to makefiles.

        * Modules/webaudio/AudioContext.cpp:
        * Modules/webaudio/AudioContext.h:
        (WebCore::AudioContext::handlePreRenderTasks):
        (WebCore::AudioContext::handlePostRenderTasks):
        (WebCore::AudioContext::deleteMarkedNodes):
        (WebCore::AudioContext::markSummingJunctionDirty):
        (WebCore::AudioContext::removeMarkedSummingJunction):
        (WebCore::AudioContext::handleDirtyAudioSummingJunctions):
        Simple munge from AudioNodeInput -> AudioSummingJunction

        * Modules/webaudio/AudioNodeInput.cpp:
        * Modules/webaudio/AudioNodeInput.h:
        (WebCore::AudioNodeInput::AudioNodeInput):
        (WebCore::AudioNodeInput::didUpdate):
        Remove logic from AudioNodeInput which now is being moved to AudioSummingJunction.

        * Modules/webaudio/AudioSummingJunction.cpp: Added.
        * Modules/webaudio/AudioSummingJunction.h: Added.
        (WebCore::AudioSummingJunction::AudioSummingJunction):
        (WebCore::AudioSummingJunction::~AudioSummingJunction):
        (WebCore::AudioSummingJunction::changedOutputs):
        (WebCore::AudioSummingJunction::updateRenderingState):
        (WebCore::AudioSummingJunction::context):
        (WebCore::AudioSummingJunction::numberOfRenderingConnections):
        (WebCore::AudioSummingJunction::renderingOutput):
        (WebCore::AudioSummingJunction::isConnected):
        (WebCore::AudioSummingJunction::numberOfConnections):
        Add AudioSummingJunction which is an abstraction to manage/track the connections from AudioNodeOutputs
        representing the fan-in points for unity gain summing junctions.

        * WebCore.gypi:
        * WebCore.xcodeproj/project.pbxproj:
        Add AudioSummingJunction files to makefiles.

2012-05-09  Raymond Liu  <raymond.liu@intel.com>

        Add multi-channels support for CopyWithGainFrom in AudioBus
        https://bugs.webkit.org/show_bug.cgi?id=80675

        Reviewed by Chris Rogers.

        * platform/audio/AudioBus.cpp:
        (WebCore):
        (WebCore::AudioBus::AudioBus):
        (WebCore::AudioBus::copyWithGainFrom):
        * platform/audio/AudioBus.h:
        (AudioBus):

2012-05-08  Chris Rogers  <crogers@google.com>

        AudioParam should directly be given context in create() method
        https://bugs.webkit.org/show_bug.cgi?id=85905

        Reviewed by James Robinson.

        No new tests.  This is a low-level re-factoring and is covered by existing tests.

        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
        * Modules/webaudio/AudioGain.h:
        (WebCore::AudioGain::create):
        (WebCore::AudioGain::AudioGain):
        * Modules/webaudio/AudioGainNode.cpp:
        (WebCore::AudioGainNode::AudioGainNode):
        * Modules/webaudio/AudioPannerNode.cpp:
        (WebCore::AudioPannerNode::AudioPannerNode):
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::create):
        (AudioParam):
        (WebCore::AudioParam::AudioParam):
        * Modules/webaudio/BiquadFilterNode.cpp:
        (WebCore::BiquadFilterNode::BiquadFilterNode):
        * Modules/webaudio/BiquadProcessor.cpp:
        (WebCore::BiquadProcessor::BiquadProcessor):
        * Modules/webaudio/BiquadProcessor.h:
        * Modules/webaudio/DelayNode.cpp:
        (WebCore::DelayNode::DelayNode):
        * Modules/webaudio/DelayProcessor.cpp:
        (WebCore::DelayProcessor::DelayProcessor):
        * Modules/webaudio/DelayProcessor.h:
        (DelayProcessor):
        * Modules/webaudio/DynamicsCompressorNode.cpp:
        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
        * Modules/webaudio/Oscillator.cpp:
        (WebCore::Oscillator::Oscillator):

2014-08-12  Renata Hodovan  <rhodovan.u-szeged@partner.samsung.com>

        Make sure that begin time cannot be greater than SMILTime::indefiniteValue unintentionally.
        https://bugs.webkit.org/show_bug.cgi?id=135838

        Reviewed by Darin Adler.

        When WebCore::SVGSMILElement::resolveInterval creates a SMILTime begin
        node for a SMILInterval, then it only checks if the value of begin is
        indefinite or unresolved but misses the case if it is between these two
        reference values.

        This is a backport of my fix in Blink: https://codereview.chromium.org/406263002/.

        Test: svg/animations/animateMotion-crash-with-large-begin-time.html

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::parseOffsetValue):
        (WebCore::SVGSMILElement::parseClockValue):

2014-07-22  Alex Christensen  <achristensen@webkit.org>

        Fix window-inactive css selectors when using querySelector.
        https://bugs.webkit.org/show_bug.cgi?id=135149

        Reviewed by Tim Horton.

        Test: fast/selectors/querySelector-window-inactive.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        Removed default and implemented case PseudoClassWindowInactive.

2013-05-04  Andreas Kling  <akling@apple.com>

        REGRESSION(r142647): Flaky Test: fast/frames/crash-remove-iframe-during-object-beforeload.html
        <http://webkit.org/b/115322>
        <rdar://problem/13810719>

        Reviewed by Anders Carlsson.

        Don't cache the FrameView::renderView() in a local since updating Widgets may blow it away.

        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2013-08-27  Arunprasad Rajkumar  <arurajku@cisco.com>

        Replace currentTime() with monotonicallyIncreasingTime() in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=119958

        Reviewed by Alexey Proskuryakov.

        WTF::currentTime() is prone to NTP and manual adjustments, so use
        WTF::monotonicallyIncreasingTime() to measure elapsed time.

        It is a continuation of r154201.

        * history/CachedPage.cpp:
        (WebCore::CachedPage::CachedPage):
        (WebCore::CachedPage::hasExpired):
        * html/parser/HTMLParserScheduler.h:
        (WebCore::HTMLParserScheduler::checkForYieldBeforeToken):
        * loader/CrossOriginPreflightResultCache.cpp:
        (WebCore::CrossOriginPreflightResultCacheItem::parse):
        (WebCore::CrossOriginPreflightResultCacheItem::allowsRequest):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::setState):
        * loader/ProgressTracker.cpp:
        (WebCore::ProgressTracker::incrementProgress):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::restoreParsedStyleSheet):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::didDraw):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::pruneLiveResourcesToSize):
        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::iconDatabaseSyncThread):
        (WebCore::IconDatabase::syncThreadMainLoop):
        (WebCore::IconDatabase::readFromDatabase):
        (WebCore::IconDatabase::writeToDatabase):
        (WebCore::IconDatabase::cleanupSyncThread):
        * page/animation/AnimationBase.cpp:
        (WebCore::AnimationBase::freezeAtTime):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::beginAnimationUpdateTime):
        * platform/graphics/GraphicsLayerAnimation.cpp:
        (WebCore::GraphicsLayerAnimation::computeTotalRunningTime):
        (WebCore::GraphicsLayerAnimation::resume):
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::AVFWrapper::createImageForTimeInRect):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRect):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::suspendAnimations):
        * platform/graphics/ca/PlatformCALayer.h:
        (WebCore::PlatformCALayer::currentTimeToMediaTime):
        * platform/graphics/ca/mac/LayerPool.mm:
        (WebCore::LayerPool::addLayer):
        (WebCore::LayerPool::decayedCapacity):
        (WebCore::LayerPool::pruneTimerFired):
        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
        (mediaTimeToCurrentTime):
        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted):
        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (PlatformCALayer::printTree):
        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::addAnimation):
        * platform/graphics/texmap/TextureMapperFPSCounter.cpp:
        (WebCore::TextureMapperFPSCounter::TextureMapperFPSCounter):
        (WebCore::TextureMapperFPSCounter::updateFPSAndDisplay):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::addAnimation):
        * platform/network/DNSResolveQueue.cpp:
        (WebCore::DNSResolveQueue::isUsingProxy):
        * plugins/win/PluginMessageThrottlerWin.cpp:
        (WebCore::PluginMessageThrottlerWin::appendMessage):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::didPaintBacking):
        (WebCore::RenderLayerCompositor::updateCompositingLayers):
        * rendering/RenderProgress.cpp:
        (WebCore::RenderProgress::animationProgress):
        (WebCore::RenderProgress::updateAnimationState):
        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::elapsed):
        (WebCore::SMILTimeContainer::begin):
        (WebCore::SMILTimeContainer::pause):
        (WebCore::SMILTimeContainer::resume):
        (WebCore::SMILTimeContainer::setElapsed):

2013-08-16  Arunprasad Rajkumar  <arurajku@cisco.com>

        <https://webkit.org/b/119785> Replace currentTime() with monotonicallyIncreasingTime() in WebCore

        Reviewed by Alexey Proskuryakov.

        WTF::currentTime() is prone to DST changes and NTP adjustments, so use
        WTF::monotonicallyIncreasingTime() to measure elapsed time.
        
        * Modules/filesystem/FileWriter.cpp:
        (WebCore::FileWriter::didWrite):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::elapsedTime):
        (WebCore::Document::resetLastHandledUserGestureTimestamp):
        * dom/Element.cpp:
        (WebCore::Element::setActive):
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::didReceiveData):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::startProgressEventTimer):
        (WebCore::HTMLMediaElement::progressEventTimerFired):
        (WebCore::HTMLMediaElement::refreshCachedTime):
        (WebCore::HTMLMediaElement::invalidateCachedTime):
        (WebCore::HTMLMediaElement::currentTime):
        (WebCore::HTMLMediaElement::startPlaybackProgressTimer):
        (WebCore::HTMLMediaElement::scheduleTimeupdateEvent):
        * html/HTMLMediaElement.h:
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::documentHadRecentUserGesture):
        * html/MediaController.cpp:
        (MediaController::scheduleTimeupdateEvent):
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::pumpPendingSpeculations):
        * html/parser/HTMLParserScheduler.h:
        (WebCore::HTMLParserScheduler::checkForYieldBeforeToken):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::SelectorProfile::SelectorProfile):
        (WebCore::SelectorProfile::totalMatchingTimeMs):
        (WebCore::SelectorProfile::startSelector):
        (WebCore::SelectorProfile::commitSelector):
        (WebCore::SelectorProfile::commitSelectorTime):
        * inspector/InspectorProfilerAgent.cpp:
        (WebCore::InspectorProfilerAgent::willProcessTask):
        (WebCore::InspectorProfilerAgent::didProcessTask):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::timestamp):
        * inspector/TimelineTraceEventProcessor.cpp:
        (WebCore::TimelineTraceEventProcessor::processEventOnAnyThread):
        * page/FrameView.cpp:
        (WebCore::FrameView::adjustedDeferredRepaintDelay):
        (WebCore::FrameView::paintContents):
        * platform/ClockGeneric.cpp:
        (ClockGeneric::now):
        * platform/ScrollAnimatorNone.cpp:
        (WebCore::ScrollAnimatorNone::scroll):
        (WebCore::ScrollAnimatorNone::animationTimerFired):
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::ImageBuffer):
        (WebCore::ImageBuffer::flushContextIfNecessary):
        (WebCore::ImageBuffer::flushContext):
        (WebCore::ImageBuffer::copyNativeImage):

2014-05-15  Daniel Bates  <dabates@apple.com>

        SVG element may reference arbitrary DOM element before running its insertion logic
        https://bugs.webkit.org/show_bug.cgi?id=132757
        <rdar://problem/15703817>

        Reviewed by Ryosuke Niwa.

        Fixes an issue where an SVG element may reference an arbitrary DOM element e before e finished being
        inserted in the tree.

        Currently when an SVG element A is inserted into a document we use document.getElementById() to find the
        element B it references (if any). If A is inserted before B and B has the same id as a later element in
        the document then A can find B before B is notified that its been inserted into the document (i.e. before
        Element::insertedFrom() is called on B). Instead, A should call document.getElementById() only after
        cessation of the insertion operation that inserted it to ensure that all inserted nodes (including B)
        processed their insertion-specific logic.

        Tests: svg/custom/reparent-animate-element.html
               svg/custom/reparent-feimage-element.html
               svg/custom/reparent-mpath-element.html
               svg/custom/reparent-textpath-element.html
               svg/custom/reparent-tref-element.html
               svg/custom/reparent-use-element.html

        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGFEImageElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGFEImageElement::didNotifySubtreeInsertions): Added; turns around and calls SVGFEImageElement::buildPendingResources().
        * svg/SVGFEImageElement.h:
        * svg/SVGMPathElement.cpp:
        (WebCore::SVGMPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGMPathElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGMPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGMPathElement::buildPendingResources().
        * svg/SVGMPathElement.h:
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGTRefElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGTRefElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTRefElement::buildPendingResources().
        * svg/SVGTRefElement.h:
        * svg/SVGTextPathElement.cpp:
        (WebCore::SVGTextPathElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGTextPathElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGTextPathElement::didNotifySubtreeInsertions): Added; turns around and calls SVGTextPathElement::buildPendingResources().
        * svg/SVGTextPathElement.h:
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGUseElement::buildPendingResources()) after its subtree is
        inserted.
        (WebCore::SVGUseElement::didNotifySubtreeInsertions): Added; turns around and calls SVGUseElement::buildPendingResources().
        * svg/SVGUseElement.h:
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::insertedInto): Return InsertionShouldCallDidNotifySubtreeInsertions so that
        we are called back to resolve our target element (i.e. call SVGSMILElement::buildPendingResources())
        after the subtree we're in is inserted.
        (WebCore::SVGSMILElement::didNotifySubtreeInsertions): Added; turns around and calls SVGSMILElement::buildPendingResources().
        * svg/animation/SVGSMILElement.h:

2014-05-03  Babak Shafiei  <bshafiei@apple.com>

        Follow-up fix for the merge of r167480.
        
        Rubber stamped by Tim Horton.

        * platform/KURL.cpp:
        (WebCore::KURL::host): Return empty string instead of null string.

2014-04-23  Jon Honeycutt  <jhoneycutt@apple.com>

        Crash applying editing commands from iframe onload event

        <https://bugs.webkit.org/show_bug.cgi?id=132103>
        <rdar://problem/15696351>

        This patch merges the Chromium bug workaround from
        <http://src.chromium.org/viewvc/blink?revision=162080&view=revision>,
        which prevents reentrancy in CompositeEditCommand::apply().

        Reviewed by Darin Adler.

        Test: editing/apply-style-iframe-crash.html

        * editing/CompositeEditCommand.cpp:
        (WebCore::HTMLNames::ReentrancyGuard::isRecursiveCall):
        (WebCore::HTMLNames::ReentrancyGuard::Scope::Scope):
        (WebCore::HTMLNames::ReentrancyGuard::Scope::~Scope):
        (WebCore::CompositeEditCommand::apply):
        If this is a recursive call, return early.

2014-04-22  Zalan Bujtas  <zalan@apple.com>

        Do not paint border image when the border rect is empty.
        https://bugs.webkit.org/show_bug.cgi?id=131988

        Reviewed by Darin Adler.

        http://trac.webkit.org/changeset/167351 introduced an early return when border
        rect is empty. This patch ensures that border image is not painted either in that case.

        Modified padding-margin-negative-border.html to cover border-image case.

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintBorder):

2014-04-19  Alexey Proskuryakov  <ap@apple.com>

        Crashes in HTMLFormElement::submit.
        https://bugs.webkit.org/show_bug.cgi?id=131910
        <rdar://problem/15661790>

        Based on a patch by Kent Tamura.

        Reviewed by Anders Carlsson.

        Tests: fast/forms/form-submission-crash-2.html
               fast/forms/form-submission-crash.html

        Code that executes arbitrary JS needs to protect objects that it uses afterwards.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::prepareForSubmission):
        (WebCore::HTMLFormElement::submit):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::submitForm):

2014-04-16  Martin Hodovan  <mhodovan@inf.u-szeged.hu>

        ASSERTION FAILED: x2 >= x1 in WebCore::RenderObject::drawLineForBoxSide
        https://bugs.webkit.org/show_bug.cgi?id=127835

        In some cases when a negative margin and a positive padding are applied
        together to the right and/or left side of the box, the logical width of
        the borders can be set to a negative value, making the assertion fire.
        The fix checks if the width or height of the box is negative, and if so,
        it will not display the borders and shadows of the box.

        Reviewed by Darin Adler.

        Test: fast/css/padding-margin-negative-border.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintBorder):

2014-04-11  Jon Honeycutt  <jhoneycutt@apple.com>

        Assertion failure changing select element size during focus event
        dispatch
        <https://bugs.webkit.org/show_bug.cgi?id=131566>
        <rdar://problem/16400735>

        Reviewed by Andy Estes.

        Test: fast/forms/select-change-size-during-focus.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
        Adopt the fix from Chromium r171216; check that the renderer is still
        of the expected type, and return early if it is not.

2014-04-07  Jon Honeycutt  <jhoneycutt@apple.com>

        Assertion failure, !node || node->isElementNode(), in
        WebCore::RenderBlock::clone()
        <https://bugs.webkit.org/show_bug.cgi?id=110489>
        <rdar://problem/13666425>

        Reviewed by Antti Koivisto.

        We're ending up in RenderBlock::splitBlocks() with |this| ==
        |fromBlock|.  We then try to climb the ancestor block chain from
        this->parent() to |fromBlock|, but this->parent() is already above
        |fromBlock|, so we end up climbing up to the RenderView and trying to
        clone it, causing the assertion failure.

        Adopt Chromium's mitigation for this from
        <https://codereview.chromium.org/13852041>. This is not intended as a
        fix for the underlying issue.

        Also, fix another issue that occurs with this fuzzed test case that's
        not handled by the Chromium fix.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::splitBlocks):
        Ensure while we're in the loop that |curr| is a descendant of
        |fromBlock|. From the Chromium patch:

            We need to check in every iteration of the loop because
            moveChildrenTo could have moved |curr|. This is a mitigation and
            not really a fix against a class of tree craziness.

        Finally, before moving children from |fromBlock| to |toBlock|, ensure
        that the children are children of |fromBlock|. If we never entered the
        loop, they will be siblings of |fromBlock|, not children.

2014-04-02  David Kilzer  <ddkilzer@apple.com>

        Use outermost containing isolate when constructing bidi runs
        <http://webkit.org/b/131107>
        <rdar://problem/15690021>

        Reviewed by Darin Adler.

        Merged from Blink (patch by jww@chromium.org):
        https://src.chromium.org/viewvc/blink?revision=157268&view=revision
        http://crbug.com/279277

            Update containingIsolate to go back all the way to top
            isolate from current root, rather than stopping at the first
            isolate it finds. This works because the current root is
            always updated with each isolate run.

        Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
               fast/text/international/unicode-bidi-isolate-nested-with-removes.html

        * rendering/InlineIterator.h:
        (WebCore::highestContainingIsolateWithinRoot):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRunsForSegment):

2014-03-22  Martin Hodovan  <mhodovan@inf.u-szeged.hu>

        ASSERTION FAILED: std::isfinite(num) in WebCore::CSSPrimitiveValue::CSSPrimitiveValue
        https://bugs.webkit.org/show_bug.cgi?id=127361

        Huge numbers represented by the 'INF' value can not be used
        in CSS rules, so they make the assert fail. We have to make
        sure that the parsed property value is finite, otherwise
        the property will be dropped.

        Test: fast/css/infinite-floating-value.html

        * css/CSSValuePool.cpp:
        (WebCore::CSSValuePool::createValue):

2014-03-21  Oliver Hunt  <oliver@apple.com>

        Fix a crash when assigning an object to document.location
        https://bugs.webkit.org/show_bug.cgi?id=130213

        Reviewed by Geoffrey Garen.

        Convert location to string before we make use the document.
        This prevents us from attempting to navigate a frame that
        has already been removed.

        Test: fast/dom/navigation-with-sideeffects-crash.html

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::location):
        (WebCore::JSDocument::setLocation):

2014-03-10  Zsolt Borbely  <borbezs@inf.u-szeged.hu>

        ASSERTION FAILED: span >= 1
        https://bugs.webkit.org/show_bug.cgi?id=129148

        Reviewed by Andreas Kling.

        Set the value of span to 1 if the given number is too big or zero.

        Test: fast/table/incorrect-colgroup-span-values.html

        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):

2014-02-28  Martin Hodovan  <mhodovan@inf.u-szeged.hu>

        ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer
        https://bugs.webkit.org/show_bug.cgi?id=119626

        SVGRenderSupport::mapLocalToContainer() was trying to apply transforms
        in the incorrect order. Specifically, it would attempt to apply its
        localToParentTransform before its localToBorderBoxTransform. This
        was causing an ASSERT to fail when the computed transforms didn't
        match up to those computed by RenderGeometryMap.

        Backported from Blink: https://codereview.chromium.org/143363004

        Reviewed by Simon Fraser.

        Test: svg/transforms/svg-geometry-crash.html

        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::mapLocalToContainer):

2014-02-15  Renata Hodovan  <rhodovan.u-szeged@partner.samsung.com>

        ASSERT_WITH_SECURITY_IMPLICATION in WebCore::toElement
        https://bugs.webkit.org/show_bug.cgi?id=128810

        Reviewed by Ryosuke Niwa.

        Make CompositeEditCommand::cloneParagraphUnderNewElement() to work when |outerNode|
        doesn't contain |start|.

        Before this patch, CompositeEditCommand::cloneParagraphUnderNewElement() tried to copy
        ancestry nodes from |start| to Document node when |start| position isn't in |outerNode|. This
        patch changes CompositeEditCommand::cloneParagraphUnderNewElement() to copy |start| to
        |outerNode| only if |outerNode| contains |start| position.

        Merged from Blink https://src.chromium.org/viewvc/blink?revision=161762&view=revision by yosin@chromium.org.

        Test: editing/execCommand/indent-with-uneditable-crash.html

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):

2014-02-14  Renata Hodovan  <rhodovan.u-szeged@partner.samsung.com>

        ASSERTION FAILED: comparePositions(newEnd, newStart) >= 0 in WebCore::ApplyStyleCommand::updateStartEnd
        https://bugs.webkit.org/show_bug.cgi?id=121791

        Reviewed by Darin Adler.

        If WebCore::ApplyStyleCommand::applyBlockStyle() creates a TextIterator for a range
        that has an element with ReplacedElement rendering object, then a ',' is emitted in the
        constructor of TextIterator. Due to this comma the end of the run range can be at the
        wrong position, what makes the assertion fire. This situation can be handled the same
        way in TextIterator::rangeFromLocationAndLength() as we do in case of the emitted '\n's.

        Test: editing/execCommand/remove-formatting-from-iframe-in-button.html

        * editing/TextIterator.cpp:
        (WebCore::TextIterator::rangeFromLocationAndLength):

2014-02-11  Youenn Fablet  <youennf@gmail.com>

        XMLHttpRequest should not send DNT header
        https://bugs.webkit.org/show_bug.cgi?id=128533

        Reviewed by Alexey Proskuryakov.

        Added DNT (Do Not Track) header to the list of forbidden headers.
        Updated http/tests/xmlhttprequest/set-dangerous-headers.html to test that header.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData):

2014-02-04  Jeffrey Pfau  <jpfau@apple.com>

        Make adoption agency use the task queue
        https://bugs.webkit.org/show_bug.cgi?id=109445

        Reviewed by Ryosuke Niwa.

        Tests: fast/parser/adoption-agency-crash-01.html
               fast/parser/adoption-agency-crash-02.html
               fast/parser/adoption-agency-crash-03.html

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::insert):
        (WebCore::executeInsertTask):
        (WebCore::executeReparentTask):
        (WebCore::executeInsertAlreadyParsedChildTask):
        (WebCore::executeTakeAllChildrenTask):
        (WebCore::executeTask):
        (WebCore::HTMLConstructionSite::attachLater):
        (WebCore::HTMLConstructionSite::executeQueuedTasks):
        (WebCore::HTMLConstructionSite::insertTextNode):
        (WebCore::HTMLConstructionSite::reparent):
        (WebCore::HTMLConstructionSite::insertAlreadyParsedChild):
        (WebCore::HTMLConstructionSite::takeAllChildren):
        (WebCore::HTMLConstructionSite::fosterParent):
        * html/parser/HTMLConstructionSite.h:
        (WebCore::HTMLConstructionSiteTask::HTMLConstructionSiteTask):
        (WebCore::HTMLConstructionSiteTask::oldParent):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

2014-01-28  Myles C. Maxfield  <mmaxfield@apple.com>

        Fixing several incorrect assumptions with handling isolated inlines.
        https://bugs.webkit.org/show_bug.cgi?id=127608

        Reviewed by Dave Hyatt.

        First, when an isolated inline spans multiple lines, we aren't guaranteed
        to exit BidiResolver with a nested inline count of zero. Removing the
        assert that says otherwise.
        
        Previously in constructBidiRunsForSegment, we called bidiFirst in
        an attempt to properly setup the isolatedResolver for any dom/style
        that applied, but this only worked on the first line the isolated
        inline appeared in. Adding a function that approaches this properly
        by recursing through the parents of the starting object for the line
        and post-fixing direction attributes to the resolver.
        
        Finally, addressing an issue where the line following a removed isolated
        inline (with a continuation) failed to be marked dirty.

        Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/72698f203b1c50900e535b80945563b92b7eef23

        Tests: fast/text/nested-bidi-assert.html
               fast/text/nested-bidi-with-continuation-crash.html

        * platform/text/BidiResolver.h:
        (WebCore::Run>::~BidiResolver):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::setupResolverToResumeInIsolate):
        (WebCore::constructBidiRunsForSegment):
        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

2014-01-21  L񎽎szl񎽎 Lang񎽎  <llango.u-szeged@partner.samsung.com>

        Assertion failure in Range::nodeWillBeRemoved
        https://bugs.webkit.org/show_bug.cgi?id=121694

        Reviewed by Ryosuke Niwa.

        Based on Blink a change: https://chromium.googlesource.com/chromium/blink/+/407c1d7b2c45974aa614b3f847ffe9e8fce205fa

        This patch fix an assertion failure. Range::nodeWillBeRemoved() might
        be called with removed node in ContainerNode, when DOMNodeRemovedFromDocument
        event handler calls removeChild(), for node being removed.

        Test: fast/dom/Range/remove-twice-crash.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::willRemoveChild):
        * dom/ContainerNode.h:

2014-01-21  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>

        ASSERT(time.isFinite()) in SVGSMILElement::createInstanceTimesFromSyncbase
        <https://webkit.org/b/108184>

        Reviewed by Philip Rogers.

        In the case a SMILElement timing had a syncbase dependency on an indefinite value
        the assert were raised. The assert has been removed and a check has been added
        instead that prevents the addition of indefinite times to the time list.

        Test: svg/animations/smil-syncbase-self-dependency.svg

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::createInstanceTimesFromSyncbase):
          ASSERT removed.

2013-11-21  Ryosuke Niwa  <rniwa@webkit.org>

        Fix Range.insertNode when the inserted node is in the same container as the Range
        https://bugs.webkit.org/show_bug.cgi?id=123957

        Reviewed by Antti Koivisto.

        Inspired by https://chromium.googlesource.com/chromium/blink/+/fb6ca1f488703e8d4f20ce6449cc8ea210be6edb

        When a node from the same container is inserted, we can't simply adjust m_end with the offset.
        Compute m_start and m_end from the inserted nodes instead.

        Also, don't adjust m_start and m_end to nodes outside of the document if the inserted nodes had been
        removed by mutation events.

        Test: fast/dom/Range/range-insertNode-same-container.html

        * dom/Range.cpp:
        (WebCore::Range::insertNode):

2013-11-06  Ryosuke Niwa  <rniwa@webkit.org>

        Fix out-of-date offset in selection range code in range.surroundContents
        https://bugs.webkit.org/show_bug.cgi?id=123871

        Reviewed by Andreas Kling.
        
        Merge https://chromium.googlesource.com/chromium/blink/+/c89b413ff0fc4aafa0c71d180b0b1e131bb37707

        The code in Range::insertNode assumeed that the start offset of the selection range within its container
        doesn't change across a call to insertBefore on the container but this is wrong. This patch recomputes
        the start offset when it is used after the insertBefore call.

        Test: editing/selection/range-surroundContents-with-preceding-node.html

        * dom/Range.cpp:
        (WebCore::Range::insertNode):

2013-11-06  Ryosuke Niwa  <rniwa@webkit.org>

        Assertion failure end < m_runCount in WebCore::BidiRunList<WebCore::BidiRun>::reverseRuns
        https://bugs.webkit.org/show_bug.cgi?id=123863

        Reviewed by Andreas Kling.

        Merge https://chromium.googlesource.com/chromium/blink/+/cbaa92c763a37d89eeabd01658e522219299290c

        Test: fast/text/bidi-reverse-runs-crash.html

        * platform/text/BidiResolver.h:
        (WebCore::BidiResolver<Iterator, Run>::createBidiRunsForLine): Don't reverse the runs if there's
        nothing to be reversed.

2013-11-05  Renata Hodovan  <reni@webkit.org>

        ASSERTION FAILED: isHTMLTitleElement(m_titleElement.get()) in WebCore::Document::setTitle
        https://bugs.webkit.org/show_bug.cgi?id=122092

        Reviewed by Darin Adler.

        Remove a bogus assert in Document::setTitle().
        m_titleElement can be either of HTMLTitleElement or SVGTitleElement. The assertion was wrong.
        
        Backported from Blink:
        https://src.chromium.org/viewvc/blink?revision=158620&view=revision

        Test: svg/custom/title-assertion.html

        * dom/Document.cpp:
        (WebCore::Document::setTitle):
        * svg/SVGTitleElement.cpp:
        (WebCore::SVGTitleElement::insertedInto):

2013-10-21  Santosh Mahto  <santosh.ma@samsung.com>

        ASSERTION FAILED: !style->propertyIsImportant(propertyID) in WebCore::setTextDecorationProperty
        https://bugs.webkit.org/show_bug.cgi?id=122097

        Reviewed by Ryosuke Niwa.

        Added Test cases to verify that crash does not happen in scenario when
        remove format command is executed on selection containing the iframe
        element and when textdecoration style is defined as !important and
        need to pushDown to iframe.

        * editing/execCommand/remove-format-textdecoration-in-iframe-expected.txt: Added.
        * editing/execCommand/remove-format-textdecoration-in-iframe.html: Added.

2013-09-11  Myles C. Maxfield  <mmaxfield@apple.com>

        Fix nested unicode-bidi: isolate
        https://bugs.webkit.org/show_bug.cgi?id=120504

        Reviewed by Darin Adler.

        When we have a nested isolate renderer if the outer isolate has a text
        and this text is not the first child, the isolated chain is not
        rendered correctly. This happens because constructBidiRunsForSegment
        uses always the first inner isolated renderer as isolated inline
        container. This patch fixes the behavior described changing
        containingIsolate to find the right isolated container.

        Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/840a57050eade39dd04dde0c6603e129b783151c

        Tests: fast/text/international/unicode-bidi-isolate-nested-first-child-text.html
               fast/text/international/unicode-bidi-isolate-nested-simple.html

        * rendering/InlineIterator.h:
        (WebCore::containingIsolate):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::constructBidiRunsForSegment):

2013-08-22  Renata Hodovan  <reni@webkit.org>

        ASSERTION FAILED: extractedStyle in WebCore::ApplyStyleCommand::removeInlineStyleFromElement
        https://bugs.webkit.org/show_bug.cgi?id=119672

        Reviewed by Darin Adler.

        The last extractedStyle parameter of removeInlineStyleFromElement() is not mandatory and it's set
        to default 0. This way we have to check its existence before the usage.

        Test: editing/execCommand/extracted_style_assert.html

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):

2013-08-14  Rob Buis  <rwlbuis@webkit.org>

        Assertion failure in RenderObject::drawLineForBoxSide
        https://bugs.webkit.org/show_bug.cgi?id=108187

        Reviewed by David Hyatt.

        Don't draw the outline if the rectangle to draw is empty.

        Test: fast/css/outline-negative.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutlineForLine):

2013-08-14  Rob Buis  <rwlbuis@webkit.org>

        ASSERTION FAILED: resultAnimationElement->m_animatedType in WebCore::SVGAnimateElement::calculateAnimatedValue
        https://bugs.webkit.org/show_bug.cgi?id=119748

        Reviewed by Dirk Schulze.

        Avoid animation when attributeType="CSS" is used on an animateTransform.

        Tests: svg/animations/animateTransform-translate-attributetype-auto.html
               svg/animations/animateTransform-translate-invalid-attributetype.html

        * svg/SVGAnimateTransformElement.cpp:
        (WebCore::SVGAnimateTransformElement::hasValidAttributeType):

2013-08-12  Zan Dobersek  <zdobersek@igalia.com>

        ASSERTION FAILED: type() == Percent in WebCore::Length::percent
        https://bugs.webkit.org/show_bug.cgi?id=116715

        Reviewed by Darin Adler.

        Allow the Calculated type in the Length::percent method that returns the Length's
        float value. This reflects the changes in r110148 that adjusted the Length::isPercent
        method to return true for Length objects of either Percent or Calculated type.

        Test: fast/css/calculated-length-as-percent-crash.html

        * platform/Length.h:
        (WebCore::Length::percent): Assert that Length::isPercent is true when Length::percent
        is called, ensuring the Length's type is either Percent or Calculated.

2013-08-12  Ryosuke Niwa  <rniwa@webkit.org>

        Fix NULL de-refernce in HTMLAnchorElement::sendPings when settings doesn't exist
        https://bugs.webkit.org/show_bug.cgi?id=119716

        Reviewed by Darin Adler.

        Merge https://chromium.googlesource.com/chromium/blink/+/d5783da353ab783e9994b8fbecd91880be5192a1

        No new tests since the test in the Blink change doesn't reproduce crash on WebKit.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::sendPings):

2013-08-09  Rob Buis  <rwlbuis@webkit.org>

        ASSERTION FAILED: stroke->opacity != other->stroke->opacity in WebCore::SVGRenderStyle::diff
        https://bugs.webkit.org/show_bug.cgi?id=119623

        Reviewed by Dirk Schulze.

        Include all the stroke attributes in the style diff comparison, the visited links ones were missing.

        Test: svg/animations/animate-stroke-crasher.html

        * rendering/style/SVGRenderStyle.cpp:
        (WebCore::SVGRenderStyle::diff):

2013-08-09  Rob Buis  <rwlbuis@webkit.org>

        ASSERT_NOT_REACHED() touched in WebCore::SVGAnimatedStringAnimator::addAnimatedTypes
        https://bugs.webkit.org/show_bug.cgi?id=113224

        Reviewed by Darin Adler.

        Do not perform from-by animations for non-additive attributes.

        Test: svg/animations/non-additive-type-from-by-animation.html

        * svg/SVGAnimateElement.cpp:
        (WebCore::SVGAnimateElement::calculateFromAndByValues):
        (WebCore::SVGAnimateElement::animatedPropertyTypeSupportsAddition):
        (WebCore::SVGAnimateElement::isAdditive):
        * svg/SVGAnimateElement.h:

2013-08-09  Renata Hodovan  <reni@webkit.org>

        Missing NULL check in ApplyStyleCommand::applyInlineStyleToNodeRange()
        https://bugs.webkit.org/show_bug.cgi?id=119570

        Reviewed by Ryosuke Niwa.

        The m_mutableStyleSet of EditingStyle can be NULL in ApplyStyleCommand::applyInlineStyleToNodeRange but
        this scenario was not checked earlier.

        Test: editing/execCommand/null-style-crash.html

        * css/StylePropertySet.cpp:
        (WebCore::MutableStylePropertySet::mergeAndOverrideOnConflict):
        * css/StylePropertySet.h:
        * css/ViewportStyleResolver.cpp:
        (WebCore::ViewportStyleResolver::addViewportRule):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
        * editing/EditingStyle.cpp:
        (WebCore::styleFromMatchedRulesForElement):
        (WebCore::EditingStyle::mergeStyleFromRules):
        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):

2013-07-18  Santosh Mahto  <santosh.ma@samsung.com>

        ASSERTION FAILED: !listItems().size() || m_activeSelectionAnchorIndex >= 0 in WebCore::HTMLSelectElement::updateListBoxSelection
        https://bugs.webkit.org/show_bug.cgi?id=118591

        Reviewed by Kent Tamura.

        Test: fast/forms/select/selectall-command-crash.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::selectAll):
        We should return this function if activeSelectionAnchorIndex is not valid index

2013-07-16  Eric Carlson  <eric.carlson@apple.com>

        HTMLMediaElement should not add cues for disabled text tracks
        https://bugs.webkit.org/show_bug.cgi?id=118682

        Reviewed by Ryosuke Niwa.

        Merge https://src.chromium.org/viewvc/blink?view=rev&revision=153810

        Tests: media/track/track-disabled-addcue.html
               media/track/track-disabled.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::textTrackAddCues): Do nothing if the track is disabled.
        (WebCore::HTMLMediaElement::textTrackAddCue): Ditto.

2013-07-15  Yuta Kitamura  <yutak@chromium.org>

        Fix a crash in Range::processContents().

        NULL ptr in WebCore::Range::processAncestorsAndTheirSiblings
        https://bugs.webkit.org/show_bug.cgi?id=77614

        Reviewed by Ryosuke Niwa.

        This change is ported from Blink revision 153483:
        https://src.chromium.org/viewvc/blink?revision=153483&view=revision

        This crash can be initiated by calling Range.detach() while deleteContents()
        is processing the same range. Range::processContents() should save the state
        of the range since mutation events can change the state of the range.

        Test: fast/dom/Range/detach-range-during-deletecontents.html

        * dom/Range.cpp:
        (WebCore::Range::processContents):
        * dom/RangeBoundaryPoint.h:
        (WebCore::RangeBoundaryPoint::RangeBoundaryPoint):

2013-06-21  James Craig  <james@cookiecrook.com>

        AX: audio/video playback control timers (elapsed and remaining) should be exposed as ApplicationTimerRole
        https://bugs.webkit.org/show_bug.cgi?id=117883

        Reviewed by Chris Fleizach.

        Some of the media controls were returning the wrong role. Updated existing test coverage.

        * accessibility/AccessibilityMediaControls.h:
        (WebCore::AccessibilityMediaTimeDisplay::roleValue):

2013-06-16  Kent Tamura  <tkent@chromium.org>

        Fix two assertion failures in Range::insertNode
        https://bugs.webkit.org/show_bug.cgi?id=116511

        Reviewed by Ryosuke Niwa.

        > ASSERTION FAILED: childBefore == (offset ? container->childNode(offset - 1) : 0)
        > third_party/WebKit/Source/WebCore/dom/RangeBoundaryPoint.h(115) : void WebCore::RangeBoundaryPoint::set(PassRefPtr<WebCore::Node>, int, WebCore::Node *)

        > ASSERTION FAILED: child->parentNode()
        > ../../third_party/WebKit/Source/core/dom/RangeBoundaryPoint.h(133) : void WebCore::RangeBoundaryPoint::setToBeforeChild(WebCore::Node *)
        >  1   0x87594b2 WebCore::RangeBoundaryPoint::setToBeforeChild(WebCore::Node*)
        >  2   0x87534a9 WebCore::Range::insertNode(WTF::PassRefPtr<WebCore::Node>, int&)

        Range::insertNode calls Node::insertBefore, in which an event handler
        can update the DOM structure so that RangeBoundaryPoint don't like. We
        postpone event dispatching by EventQueueScope.

        Also, remove old comments about Acid3. The behavior is standardized.
        (Step 9 of http://dom.spec.whatwg.org/#dom-range-insertnode)

        This patch imports http://src.chromium.org/viewvc/blink?view=revision&revision=150470 .

        Test: fast/dom/Range/range-insertNode-assertion.html

        * dom/Range.cpp:
        (WebCore::Range::insertNode):
         - Add EventQueueScope
         - Remove obsolete comments

2013-06-07  Zalan Bujtas  <zalan@apple.com>

        Frame flattening: crash when child iframe is removed during beforeload.
        https://bugs.webkit.org/show_bug.cgi?id=116220

        Reviewed by Antti Koivisto.

        FrameView can get destroyed in updateWidget(). Normally, it is protected by layout()
        but with frame flattening on, it can also be called asynchronously through the
        post layout timer.

        Test: fast/frames/flattening/crash-remove-iframe-during-object-beforeload.html

        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):

2013-05-20  Ryosuke Niwa  <rniwa@webkit.org>

        Null pointer deference in WebCore::AppendNodeCommand::create
        https://bugs.webkit.org/show_bug.cgi?id=116479

        Reviewed by Andreas Kling.
        
        Merge https://chromium.googlesource.com/chromium/blink/+/5cb43002a44f67a60ecf5a7ed76de2d0bcf89eb2

        DeleteSelection::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss() make style and link elements
        to be the direct children of the editable root. However, these style and link elements are not necessary editable
        and WebKit crashes when they are not.

        Test: editing/deleting/delete-uneditable-style.html

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):

2013-04-26  Zalan Bujtas  <zalan@apple.com>

        use-after-free removing a frame from its parent in a beforeload event of an OBJECT element
        https://bugs.webkit.org/show_bug.cgi?id=113964

        Object elements have the tendecny to modify or even fully remove 
        the containing Document inside beforeload callback. While Document is removed, 
        RenderArena gets destroyed. Retained RenderWidgets fails to function with NULL arena.
        
        Protect RendereArena from getting wiped out, when Document is removed 
        during FrameView::updateWidget(). 

        Reviewed by Antti Koivisto.

        Test: fast/frames/crash-remove-iframe-during-object-beforeload.html

        * dom/Document.cpp:
        (WebCore::Document::attach):
        * dom/Document.h:
        (Document):
        * page/FrameView.cpp:
        (WebCore::FrameView::updateWidgets):
        * rendering/RenderArena.h:
        (RenderArena):
        (WebCore::RenderArena::create):

2013-04-23  Andreas Kling  <akling@apple.com>

        Clear StyleResolver state before returning from styleForElement().
        <http://webkit.org/b/115035>

        Reviewed by Antti Koivisto.

        From Blink r148687 by <inferno@chromium.org>.

        A cached element pointer in the resolver state was causing confusion because
        in some cases a subsequent call to styleForElement() would use a pointer to
        a different object that is at the same memory address as the previous one.

        Test: fast/css/reload-non-styled-element-crash.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForElement):

2013-04-08  Douglas Stockwell  <dstockwell@chromium.org>

        Crash in WebCore::ElementRuleCollector::collectMatchingRulesForList
        https://bugs.webkit.org/show_bug.cgi?id=113458

        Reviewed by Darin Adler.

        A stylesheet which has been invalidated (type changed from "" or
        "text/css") was not correctly removed from the list of active
        style sheets when its children are changed.

        This change releases StyleElement::m_sheet in advance of calling
        DocumentStyleSheetCollection::updateActiveStyleSheets.

        (StyleElement::clearSheet calls CSSStyleSheet::clearOwnerNode calls
        CSSStyleSheet::didMutate calls Document::styleResolverChanged calls
        DocumentStyleSheetCollection::updateActiveStyleSheets)

        Test: fast/css/style-element-invalidation-crash.html

        * dom/StyleElement.cpp:
        (WebCore::StyleElement::clearSheet): Release m_sheet before we
          trigger an update of the active style sheets.

2013-04-02  David Vest  <davve@opera.com>

        Hang when calling setCurrentTime on SVG with cyclic animation dependency chain
        https://bugs.webkit.org/show_bug.cgi?id=113485

        Reviewed by Stephen Chenney.

        If no exact match can be found, approximateBinarySearch may return
        either adjacent value to the key. Selecting the lesser value when
        there is a greater one may cause interval creation to fail in a
        way that causes infinite loops during seeking. Detect and amend
        this condition by selecting the greater value when possible.

        Test: svg/animations/animation-dependency-hang.html

        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::findInstanceTime):

2013-04-01  Chris Evans  <cevans@google.com>

        Crash in Node::enclosingBlockFlowElement()
        https://bugs.webkit.org/show_bug.cgi?id=113712

        Reviewed by Abhishek Arya.

        Fix a bad Node assumption if we walk up to the document root.

        Test: editing/execCommand/format-block-at-root.html

        * dom/Node.cpp:
        (WebCore::Node::isBlockFlowElement): Check we found an Element Node and rename from isBlockFlow().
        (WebCore::Node::enclosingBlockFlowElement): Use the new toElement().
        * editing/FormatBlockCommand.cpp:
        (WebCore::FormatBlockCommand::formatRange): Check for NULL.
        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::doApplyForSingleParagraph):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::enclosingInline): Impact from method rename.

2013-03-26  Arpita Bahuguna  <a.bah@samsung.com>

        Unable to insert a paragraph in between some text whose previous sibling is a non-editable block.
        https://bugs.webkit.org/show_bug.cgi?id=113007

        Reviewed by Ryosuke Niwa.

        Unable to insert a line break in between a text that follows a
        non-editable block but is itself contained within an editable
        block.

        While comparing the positions from the start block till the
        insertion position, we should ignore the nodes that do not
        generate a visiblePosition for the position before the node.
        This ultimately results in an assert within comparePositions().

        For this case, the firstChild of the start block is a text
        node with no renderer which would thus not generate a candidate
        position for itself.
        There is also no candidate previous to it, and since
        the position after it lies within a different editable element (root),
        no candidate after it as well.
        Such a point will thus return a null visiblePosition.

        Test: editing/inserting/insert-paragraph-between-text.html

        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):
        Added a check to verify the generated visiblePosition (for the
        position before the node) prior to carrying out a comparison with
        the insertion point.

2013-03-20  Kent Tamura  <tkent@chromium.org>

        Crash in Document::setFocusedNode if the frame of new focused node is detached in 'change' event handler
        https://bugs.webkit.org/show_bug.cgi?id=112653

        Reviewed by Dimitri Glazkov.

        Test: fast/frames/detach-frame-during-focus.html

        * page/FocusController.cpp:
        (WebCore::FocusController::setFocusedNode):
        A oldDocument->setFocusedNode call might dispatch a 'change' event for
        an old focused node, and an event handler code might detach the
        newFocusedFrame. So we should check it. Without the check, the following
        newDocument->setFocusedNode call would crash because of null
        Frame::page().

2013-03-19  Mihnea Ovidenie  <mihnea@adobe.com>

        [CSSRegions] Crash reflowing content in variable width regions
        https://bugs.webkit.org/show_bug.cgi?id=112515

        Reviewed by David Hyatt.

        When removing floats during relayout of a line in a paginated context,
        we have to make sure that the floats collection actually has elements before
        accessing the last float from the collection.
        This situation arises when a block had floats in a previous layout and after
        they were removed, m_floatingObjects is not destroyed, only emptied.

        Test: fast/regions/crash-reflow-inline-content-in-variable-width-regions.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeFloatingObjectsBelow):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::layoutRunsAndFloats):
        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):

2013-03-18  Dominic Cooney  <dominicc@chromium.org>

        A placeholder renderer should not be taken to imply the existence of a text renderer in single line text controls
        https://bugs.webkit.org/show_bug.cgi?id=112410

        Reviewed by Tony Chang.

        The assumption that if a text control had a placeholder renderer
        then it also had a text renderer is not valid. If
        ::-webkit-textfield-decoration-controller is set to display: none;
        a single line text control's decoration container renderer and
        hence text renderer are not created. This change handles this
        corner case where a text control has a placeholder renderer but
        not a text renderer.

        Tests: fast/forms/search/search-hide-decoration-container-crash.html (Updated)

        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::fixPlaceholderRenderer):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::layout):

2013-03-08  Dominic Cooney  <dominicc@chromium.org>

        RenderTextControlSingleLine should not assume that its text element has a renderer
        https://bugs.webkit.org/show_bug.cgi?id=111826

        Reviewed by Ojan Vafai.

        Tests: fast/forms/search/search-autoscroll-hidden-decoration-container-crash.html
               fast/forms/search/search-hide-decoration-container-crash.html
               fast/forms/search/search-scroll-hidden-decoration-container-crash.html

        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::controlClipRect):
        (WebCore::RenderTextControlSingleLine::autoscroll):
        (WebCore::RenderTextControlSingleLine::scroll):

2013-02-27  Andrei Bucur  <abucur@adobe.com>

        REGRESSION(r124739): fast/lists/list-marker-remove-crash.html hits an assertion in MoveParagraphs
        https://bugs.webkit.org/show_bug.cgi?id=93247

        Reviewed by Darin Adler.

        The listifyParagraph function inside InsertListCommand triggered a layout for the new list and updated
        only the "start" Position. The insertion and layout may have changed the "end" Position as well. The patch
        makes sure "end" is also recomputed.

        Test: No new test, the patch fixes a regression.

        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::listifyParagraph):

2013-02-26  Adam Klein  <adamk@chromium.org>

        Parsing of HTML tags in MathML Text Insertion Points leads to bogus parser behavior
        https://bugs.webkit.org/show_bug.cgi?id=110808

        Reviewed by Adam Barth.

        When looking for various table tags in the HTMLElementStack, compare
        QualifiedNames rather than just local names, where necessary.

        Note that not all uses have been "fixed"; I've only changed for which
        I could write a test with differing behavior. A followup patch to
        rationalize the use of QualifiedName vs local names would be ideal.

        Tests: html5lib/generated/run-math-data.html
               html5lib/generated/run-math-write.html

        * html/parser/HTMLElementStack.cpp:
        (WebCore::inScopeCommon): Added a version of inScopeCommon that
        handles QualifiedNames instead of just localNames.
        (WebCore::HTMLElementStack::inTableScope): When given a QualifiedName,
        call the new version of inScopeCommon().
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTag):
        (WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
        (WebCore::HTMLTreeBuilder::processTrEndTagForInRow):

2013-02-19  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Assertion in RenderFlowThread::removeRenderBoxRegionInfo
        https://bugs.webkit.org/show_bug.cgi?id=109914

        Reviewed by David Hyatt.

        This patch moves a part of the invalidation operations inside the RenderFlowThread::invalidateRegions call. The maps
        are cleared anyway at layout time but doing this earlier makes sure the flow thread is in a more consistent state
        (the RenderFlowThread object has both the region chain invalidated and the regions information cleared).

        RenderFlowThread::removeRenderBoxRegionInfo will check if the region chain is invalidated. If true, it means the
        flow thread has a layout scheduled and the regions information is not yet reliable. In this case we just return from the
        function and wait for the layout to cleanup the box information.

        Test: fast/regions/remove-box-info-assert.html

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::removeRegionFromThread):
        (WebCore::RenderFlowThread::invalidateRegions):
        (WebCore):
        (WebCore::RenderFlowThread::layout):
        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo):
        * rendering/RenderFlowThread.h:
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::removeRegionFromThread):

2013-02-14  Emil A Eklund  <eae@chromium.org>

        Clamp span value in RenderTableCell::parse[Col|Row]SpanFromDOM
        https://bugs.webkit.org/show_bug.cgi?id=109878

        Reviewed by Abhishek Arya.

        Test: fast/table/colspan-huge-number.html
        
        Clamp colspan and rowspan values to their respective maximum
        supported values.

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::parseColSpanFromDOM):
        (WebCore::RenderTableCell::parseRowSpanFromDOM):

2013-02-06  Ojan Vafai  <ojan@chromium.org>

        display:none file upload button crashes
        https://bugs.webkit.org/show_bug.cgi?id=109102

        Reviewed by Levi Weintraub.

        Test: fast/forms/file/display-none-upload-button.html

        * rendering/RenderFileUploadControl.cpp:
        (WebCore::nodeWidth):
        (WebCore::RenderFileUploadControl::paintObject):
        Having an upload button doesn't mean we have a rendered upload button.
        Null check the renderer before trying to access it.

2013-01-14  Tien-Ren Chen  <trchen@chromium.org>

        Positioned children of an overflow:visible container should ignore scroll offset when updating layer position
        https://bugs.webkit.org/show_bug.cgi?id=106814

        Reviewed by Simon Fraser.

        This patch fixes a bug in RenderLayer::updateLayerPosition that
        scrollLeft / scrollTop of a block should only be effective when the
        block has overflow clipping. The bug results in rendering artifacts
        and triggers a RenderGeometryMap assertion falure.

        Fixes http://crbug.com/167985

        Test: fast/overflow/overflow-visible-should-ignore-scroll.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateLayerPosition):

2013-01-14  Andrei Bucur  <abucur@adobe.com>

        Crash caused by incomplete cleanup of regions information for anonymous block
        https://bugs.webkit.org/show_bug.cgi?id=106191

        Reviewed by Abhishek Arya.

        When an anonymous block is no longer required it is removed from the render tree and deleted. For example, this can happen when an anonymous block children change
        from inlines to blocks. The patch updates the removeLeftoverAnonymousBlock function to delete the flow thread information attached to the obsolete anonymous block.
        The removeFromRenderFlowThread() function is recursive and it needs to be called after the anonymous block children were reparented and the child list cleared.
        I've also placed the children reset operation before clearing the parent because the latter also deletes the inRenderFlowThread flag from the object and it makes
        flow thread ownership detection impossible.

        Tests: fast/regions/remove-leftover-anon-block-crash.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removeLeftoverAnonymousBlock):

2013-01-10  Alexis Menard  <alexis@webkit.org>

        ASSERT_NOT_REACHED in StylePropertySet::fontValue when accessing font style property through JS after setting style font size.
        https://bugs.webkit.org/show_bug.cgi?id=88866

        Reviewed by Alexander Pavlov.

        StylePropertySet::fontValue always assumed that it was called using
        style.font after a subsequent call which set the shorthand font. The
        ASSERT_NOT_REACHED assumed that all longhands of the font shorthand not
        set by the shorthand itself were set to initial. While it's true when
        we set the font shorthand (i.e all longhands are set to implicit initial)
        it is not true when you set the longhands individually. For example setting
        font-size will not set other font properties to initial. It is the behavior of all
        other shorthands in WebKit. When reconstructing the shorthand other
        properties tests whether the value of each longhands is initial or not
        (if not then we omit the value, as we should always construct the
        shortest shorthand possible) or if the value is set or not (if set then
        we include it in the shorthand if not then we omit it). The comment
        removed was also talking about invalid font property potentially built
        by fontValue(). So far appendFontLonghandValueIfExplicit will always
        construct a valid value as it takes care of adding ' ' or '/' when
        needed, so the return value is parsable and correct.

        Test: fast/css/font-shorthand-from-longhands.html

        * css/StylePropertySet.cpp:
        (WebCore::StylePropertySet::appendFontLonghandValueIfExplicit):
        (WebCore::StylePropertySet::fontValue):
        * css/StylePropertySet.h:

2013-01-09  Shinya Kawanaka  <shinyak@chromium.org>

        Assert triggered in SelectorChecker::checkOneSelector when scrollbar (e.g. :horizontal) selector is specified.
        https://bugs.webkit.org/show_bug.cgi?id=106414

        Reviewed by Dimitri Glazkov.

        In SelectorChecker::checkOneSelector, scrollbar related pseudoType (e.g. :horizontal) is not handled anywhere.
        This caused ASSERT triggered. We have to check them.

        Test: fast/css/scrollbar-crash.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOneSelector):

2013-01-08  Andreas Kling  <akling@apple.com>

        Heap-use-after-free in bool WebCore::SelectorChecker::checkOneSelector.
        <http://webkit.org/b/105834>

        Reviewed by Antti Koivisto.

        Suppress the DOMSubtreeModified event when synchronizing the "style" attribute and we've
        instantiated an Attr node wrapper for the said attribute.

        Also added an assertion that Document's StyleResolver isn't cleared during style recalc,
        which will help us catch this kind of bug in the future.

        Test: fast/dom/mutation-event-listener-with-dirty-inline-style-crash.html

        * dom/Document.cpp:
        (WebCore::Document::styleResolverThrowawayTimerFired):
        * dom/Element.cpp:
        (WebCore::Element::setAttributeInternal):

2012-12-13  Filip Pizlo  <fpizlo@apple.com>

        Named lookups on HTML documents produce inconsistent results in JavaScriptCore bindings
        https://bugs.webkit.org/show_bug.cgi?id=104623

        Reviewed by Geoffrey Garen.

        All DOM objects that have named getters or directly override getOwnPropertySlot are now marked as
        HasImpureGetOwnPropertySlot.

        Tests: fast/js/prototype-chain-caching-with-impure-get-own-property-slot-traps
               fast/js/dfg-prototype-chain-caching-with-impure-get-own-property-slot-traps

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):

2012-12-10  Yi Shen  <max.hong.shen@gmail.com>

        Keyboard caret movement in textarea with RTL Override Character can make tab unresponsive
        https://bugs.webkit.org/show_bug.cgi?id=103067

        Reviewed by Ryosuke Niwa.

        For textarea with RTL override character, the line break could be the previous leaf InlineTextBox of
        the InlineTextBox for the RTL override text. When overshots the left/right, make sure the 
        leftVisuallyDistinctCandidate and rightVisuallyDistinctCandidate return the visually distinct 
        left/right position by ignoring the line break.

        Test: editing/selection/move-by-character-crash-test-textarea.html

        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):

2012-12-03  Hajime Morrita  <morrita@google.com>

        Corrupted DOM tree during appendChild/insertBefore
        https://bugs.webkit.org/show_bug.cgi?id=103601

        Reviewed by Abhishek Arya.

        There are some missing protection in appendChild() and insertBefore().
        This change added these.

        Dromaeo dom-modify shows no speed regression (5445run/s before vs 5351run/s after)

        Tests: fast/events/mutation-during-append-child.html
               fast/events/mutation-during-insert-before.html

        * dom/ContainerNode.cpp:
        (WebCore::checkAcceptChildGuaranteedNodeTypes):
        (WebCore):
        (WebCore::ContainerNode::insertBefore):
        (WebCore::ContainerNode::appendChild):

2012-11-29  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Fix content node renderers ordering inside the named flow thread
        https://bugs.webkit.org/show_bug.cgi?id=103501

        Reviewed by David Hyatt.

        This patch fixes two issues with how content nodes renderers are added to a named flow thread.
        The first issue was about determining the insertion position of a renderer inside the children list of a named flow thread. Before this patch, the
        insertion point was based on both the DOM ordering of the elements and insertion order of previous renderers.
        The patch fixes this and makes the renderer position just a function of the DOM ordering of elements.
        The second issue appeared when next/previousRenderer methods were skipping nodes because they had the flow-into property as a side effect
        of copying the style of the parent element (e.g. Text nodes). The patch ensures the skipped nodes are also elements.

        Tests: fast/regions/named-flow-content-order-1.html
               fast/regions/named-flow-content-order-2.html
               fast/regions/named-flow-content-order-3.html

        * dom/NodeRenderingContext.cpp:
        (WebCore::NodeRenderingContext::nextRenderer): Skip only elements.
        (WebCore::NodeRenderingContext::previousRenderer): Skip only elements.
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::addFlowChild): Insert the renderer in the list based on the DOM position of the owner element.
        * rendering/RenderNamedFlowThread.h:
        (RenderNamedFlowThread):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::renderNamedFlowThreadWrapper): Rename to eliminate the confusion with enclosingRenderFlowThread.
        (WebCore::RenderObject::insertedIntoTree):
        (WebCore::RenderObject::willBeRemovedFromTree):
        * rendering/RenderObject.h:
        (RenderObject):

2012-11-25  Takashi Sakamoto  <tasak@google.com>

        WebCore::RenderBlock::determineStartPosition crash
        https://bugs.webkit.org/show_bug.cgi?id=98993

        Reviewed by Brent Fulgham.

        If we move some node and the node has some text,
        InlineFlowBox::removeChild() is invoked. The method invokes
        RootInlineBox::childRemoved(). childRemoved() checks whether the
        removed inlinebox has the renderer of its parent's line break object.
        If so, use setLineBreakInfo to make the parent's line break info to
        be 0. However in RenderBlock::determineStartPosition(), the code
        assume that all line break info is solved, i.e.
        prevRootBox->lineBreakObj()->isText(). Since lineBreakObj() returns 0
        because of removeChild(), determineStartPosition crash occurs.

        Test: fast/inline/inline-box-append-child-crash.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlock::determineStartPosition):
        Checks whether lineBreakObj() is 0 or not before using lineBreakObj().

2012-11-14  Takashi Sakamoto  <tasak@google.com>

        Crash when replacing parts of text inputs with content: url(...)
        https://bugs.webkit.org/show_bug.cgi?id=101133

        Reviewed by Kent Tamura.

        Disable directly setting content of elements in an input element's
        shadow dom tree, because the setting breaks input element's behavior.

        Tests: fast/forms/number/number-content-url-crash.html
               fast/forms/search/search-content-url-crash.html

        * css/html.css:
        (input::-webkit-textfield-decoration-container):
        Use important to disable overriding an input element's content
        property.
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::attach):
        Added ASSERTION. No content should be applied to
        input::-webkit-textfield-decoration-container.

2012-11-13  Christophe Dumez  <christophe.dumez@intel.com>

        Make HTMLLegendElement.form behave according to specification
        https://bugs.webkit.org/show_bug.cgi?id=101044

        Reviewed by Kent Tamura.

        According to the HTML5 specification (http://dev.w3.org/html5/spec/single-page.html#dom-legend-form),
        The form IDL attribute's behavior depends on whether the legend element is in a fieldset element or
        not. If the legend has a fieldset element as its parent, then the form IDL attribute must return the
        same value as the form IDL attribute on that fieldset element. Otherwise, it must return null.

        This patch makes WebKit behaves according to specification (and Firefox). Previously, legend.form was
        not returning null if the element was not inside a fieldset. Also, legend.form did not necessarily
        return the same value as the parent fieldset's form attribute.

        Test: fast/forms/legend/legend-form.html

        * html/HTMLLegendElement.cpp:
        (WebCore):
        (WebCore::HTMLLegendElement::virtualForm):
        * html/HTMLLegendElement.h:
        (HTMLLegendElement):

2012-11-04  Florin Malita  <fmalita@chromium.org>

        Color-profile property triggers assert
        https://bugs.webkit.org/show_bug.cgi?id=101080

        Reviewed by Dirk Schulze.

        CSSPropertyColorProfile is not handled in StyleResolver::applySVGProperty(), triggering the
        unimplemented property assert. Adding a stub entry to avoid that.

        Test: svg/css/color-profile-crash.html

        * css/SVGCSSStyleSelector.cpp:
        (WebCore::StyleResolver::applySVGProperty):

2012-09-14  Simon Fraser  <simon.fraser@apple.com>

        REGRESSION: transition doesn掲 always override transition-property
        https://bugs.webkit.org/show_bug.cgi?id=96658

        Reviewed by Dean Jackson.

        Setting the animation property on an Animation in CSSToStyleMap::mapAnimationProperty()
        is special because we have to call setAnimationMode(Animation::AnimateAll) as well
        as setting the property to CSSPropertyInvalid if it's for the initial state
        of the transition-property property.
        
        In order to fix this via StyleBuilder PropertyHandlers, we have to know,
        in ApplyPropertyAnimation::applyInitialValue(), which property is getting applied.
        This requires passing the CSSPropertyID down through all of the "apply" methods.
        
        Do some unrelated cleanup in CSSParser::parseTransitionShorthand(); the existing code
        was not safe with respect to adding new properties to the shorthand.

        Test: transitions/longhand-vs-shorthand-initial.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseTransitionShorthand):
        * css/StyleBuilder.cpp:
        (WebCore::ApplyPropertyExpanding::applyInheritValue):
        (WebCore::ApplyPropertyExpanding::applyInitialValue):
        (WebCore::ApplyPropertyExpanding::applyValue):
        (WebCore::ApplyPropertyDefaultBase::applyInheritValue):
        (WebCore::ApplyPropertyDefaultBase::applyInitialValue):
        (WebCore::ApplyPropertyDefaultBase::applyValue):
        (WebCore::ApplyPropertyDefault::applyValue):
        (WebCore::ApplyPropertyNumber::applyValue):
        (WebCore::ApplyPropertyStyleImage::applyValue):
        (WebCore::ApplyPropertyAuto::applyInheritValue):
        (WebCore::ApplyPropertyAuto::applyInitialValue):
        (WebCore::ApplyPropertyAuto::applyValue):
        (WebCore::ApplyPropertyClip::applyInheritValue):
        (WebCore::ApplyPropertyClip::applyInitialValue):
        (WebCore::ApplyPropertyClip::applyValue):
        (WebCore::ApplyPropertyColor::applyInheritValue):
        (WebCore::ApplyPropertyColor::applyInitialValue):
        (WebCore::ApplyPropertyColor::applyValue):
        (WebCore::ApplyPropertyDirection::applyValue):
        (WebCore::ApplyPropertyLength::applyValue):
        (WebCore::ApplyPropertyString::applyValue):
        (WebCore::ApplyPropertyBorderRadius::applyValue):
        (WebCore::ApplyPropertyFillLayer::applyInheritValue):
        (WebCore::ApplyPropertyFillLayer::applyInitialValue):
        (WebCore::ApplyPropertyFillLayer::applyValue):
        (WebCore::ApplyPropertyComputeLength::applyValue):
        (WebCore::ApplyPropertyFont::applyInheritValue):
        (WebCore::ApplyPropertyFont::applyInitialValue):
        (WebCore::ApplyPropertyFont::applyValue):
        (WebCore::ApplyPropertyFontSize::applyInheritValue):
        (WebCore::ApplyPropertyFontSize::applyInitialValue):
        (WebCore::ApplyPropertyFontSize::applyValue):
        (WebCore::ApplyPropertyFontWeight::applyValue):
        (WebCore::ApplyPropertyFontVariantLigatures::applyInheritValue):
        (WebCore::ApplyPropertyFontVariantLigatures::applyInitialValue):
        (WebCore::ApplyPropertyFontVariantLigatures::applyValue):
        (WebCore::ApplyPropertyBorderImage::applyValue):
        (WebCore::ApplyPropertyBorderImageModifier::applyInheritValue):
        (WebCore::ApplyPropertyBorderImageModifier::applyInitialValue):
        (WebCore::ApplyPropertyBorderImageModifier::applyValue):
        (WebCore::ApplyPropertyBorderImageSource::applyValue):
        (WebCore::ApplyPropertyCounter::emptyFunction):
        (WebCore::ApplyPropertyCounter::applyInheritValue):
        (WebCore::ApplyPropertyCounter::applyValue):
        (WebCore::ApplyPropertyCursor::applyInheritValue):
        (WebCore::ApplyPropertyCursor::applyInitialValue):
        (WebCore::ApplyPropertyCursor::applyValue):
        (WebCore::ApplyPropertyTextAlign::applyValue):
        (WebCore::ApplyPropertyTextDecoration::applyValue):
        (WebCore::ApplyPropertyLineHeight::applyValue):
        (WebCore::ApplyPropertyPageSize::applyInheritValue):
        (WebCore::ApplyPropertyPageSize::applyInitialValue):
        (WebCore::ApplyPropertyPageSize::applyValue):
        (WebCore::ApplyPropertyTextEmphasisStyle::applyInheritValue):
        (WebCore::ApplyPropertyTextEmphasisStyle::applyInitialValue):
        (WebCore::ApplyPropertyTextEmphasisStyle::applyValue):
        (WebCore::ApplyPropertyAnimation::applyInheritValue):
        (WebCore::ApplyPropertyAnimation::applyInitialValue): If the property is
        CSSPropertyWebkitTransitionProperty, call setAnimationMode(Animation::AnimateAll).
        (WebCore::ApplyPropertyAnimation::applyValue):
        (WebCore::ApplyPropertyOutlineStyle::applyInheritValue):
        (WebCore::ApplyPropertyOutlineStyle::applyInitialValue):
        (WebCore::ApplyPropertyOutlineStyle::applyValue):
        (WebCore::ApplyPropertyResize::applyValue):
        (WebCore::ApplyPropertyVerticalAlign::applyValue):
        (WebCore::ApplyPropertyAspectRatio::applyInheritValue):
        (WebCore::ApplyPropertyAspectRatio::applyInitialValue):
        (WebCore::ApplyPropertyAspectRatio::applyValue):
        (WebCore::ApplyPropertyZoom::applyInheritValue):
        (WebCore::ApplyPropertyZoom::applyInitialValue):
        (WebCore::ApplyPropertyZoom::applyValue):
        (WebCore::ApplyPropertyDisplay::applyInheritValue):
        (WebCore::ApplyPropertyDisplay::applyInitialValue):
        (WebCore::ApplyPropertyDisplay::applyValue):
        (WebCore::ApplyPropertyClipPath::applyValue):
        (WebCore::ApplyPropertyWrapShape::applyValue):
        (WebCore::ApplyPropertyImageResolution::applyInheritValue):
        (WebCore::ApplyPropertyImageResolution::applyInitialValue):
        (WebCore::ApplyPropertyImageResolution::applyValue):
        * css/StyleBuilder.h:
        (PropertyHandler):
        (WebCore::PropertyHandler::applyInheritValue):
        (WebCore::PropertyHandler::applyInitialValue):
        (WebCore::PropertyHandler::applyValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList): Pass in the property ID.

2012-09-04  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] Destroying a render named flow thread without unregistering left-over content nodes triggered an assertion.
        https://bugs.webkit.org/show_bug.cgi?id=95645

        Reviewed by Abhishek Arya.

        This patch cleans up the render named flow thread before destruction by unregistering left-over content nodes.

        Tests: fast/regions/moved-content-node-crash.html

        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::~RenderNamedFlowThread):

2012-08-31  Andrei Bucur  <abucur@adobe.com>

        [CSS Regions] It should be possible to specify ::BEFORE/AFTER as regions
        https://bugs.webkit.org/show_bug.cgi?id=90079

        Reviewed by David Hyatt.

        The calls for RenderRegion::node() have been replaced with RenderRegion::generatingNode() to allow pseudo-elements to have RenderRegion renderers.
        The compare function that establishes the region order was adapted to take into account pseudo-regions.
        A renderer for the pseudo-element is now generated if it's a region even though there's no content property specified.

        Test: fast/regions/content-flowed-into-pseudo-regions.html

        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::compareRenderRegions):
        * rendering/RenderObjectChildList.cpp:
        (WebCore::ensureBeforeAfterContainer):
        (WebCore):
        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::nodeAtPoint):
        (WebCore::RenderRegion::checkRegionStyle):
        (WebCore::RenderRegion::computeStyleInRegion):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::writeRenderNamedFlowThreads):

2012-08-30  Shinya Kawanaka  <shinyak@chromium.org>

        AuthorShadowDOM support for textarea element.
        https://bugs.webkit.org/show_bug.cgi?id=91485

        Reviewed by Dimitri Glazkov.

        We add AuthorShadowDOM support for textarea element.

        Unlike other replaced elements (e.g. meter, progress, img), we do not need to add
        extra RenderBlock when we add AuthorShadowDOM. However, since inner element will not have
        renderer when AuthorShadowDOM does not have any shadow insertion point, we have to check
        the existence of the renderer of inner element.

        Tests: fast/dom/shadow/shadowdom-for-textarea-with-attribute.html
               fast/dom/shadow/shadowdom-for-textarea-with-placeholder.html
               fast/dom/shadow/shadowdom-for-textarea-with-style.html
               fast/dom/shadow/shadowdom-for-textarea.html

        * dom/ShadowRoot.cpp:
        (WebCore::allowsAuthorShadowRoot): Needs allow textarea to have AuthorShadowRoot.
        * rendering/RenderTextControl.cpp: When AuthorShadowDOM does not have any insertion point,
        innerTextElement() will not have any renderer. We have to tweak these renderers not to be crashed.
        (WebCore::RenderTextControl::textBlockWidth):
        (WebCore::RenderTextControl::updateFromElement):
        (WebCore::RenderTextControl::computeLogicalHeight):
        (WebCore::RenderTextControl::hitInnerTextElement):
        (WebCore::RenderTextControl::computePreferredLogicalWidths):

2012-08-29  Philip Rogers  <pdr@google.com>

        Use SVGImage instead of cached image when drawing without a render tree.
        https://bugs.webkit.org/show_bug.cgi?id=95002

        Reviewed by Nikolas Zimmermann.

        Previously if we tried to use canvas.context2d.drawImage() with an SVG image
        that was not in the render tree, we would crash. This patch changes this behavior
        so that we use SVGImage::draw() to draw images that are not in the render tree.

        Test: svg/as-image/svg-canvas-draw-image-detached.html

        * svg/graphics/SVGImageCache.cpp:
        (WebCore::SVGImageCache::requestedSizeAndScales):
        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):

2012-08-28  Kenichi Ishibashi  <bashi@chromium.org>

        style->fontMetrics() should be available when setting line-height
        https://bugs.webkit.org/show_bug.cgi?id=93327

        Reviewed by Darin Adler.

        Setting line-height assumes the fontMetrics are available for the affected font, but
        the fontMetrics won't be available immediately after setting other properties like
        font-size. Call styleResolver->updateFont() before setting line-height to update fontMetrics.

        Added a test case to fast/canvas/crash-set-font.html.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::setFont):
        Call styleResolver->updateFont() before styleResolver->applyPropertyToCurrentStyle(CSSPropertyLineHeight,...)

2012-08-28  Sukolsak Sakshuwong  <sukolsak@gmail.com>

        Crash in EditingStyle::mergeStyle
        https://bugs.webkit.org/show_bug.cgi?id=94740

        Reviewed by Ryosuke Niwa.

        This bug happened when we selected "1<progress><a style>2</a></progress>"
        and executed a create link command because

        1. The selection ended at <progress>, not the text node inside it, because
           <progress> is an atomic node.
        2. We called removeInlineStyle() to remove conflicting styles.
           Since the selection started at the text node "1" and ended at <progress>,
           we did not get to remove <a>.
        3. We called fixRangeAndApplyInlineStyle(), which in turn called
           applyInlineStyleToNodeRange(). This method split the node range
           into smaller runs. In this case, the run was the whole
           "1<progress><a style>2</a></progress>".
        4. We called removeStyleFromRunBeforeApplyingStyle(). This method tried
           to remove <a> by calling removeInlineStyleFromElement() on <a> with
           extractedStyle = 0. But the method expected that extractedStyle was not null.
           So, it crashed.

        This bug doesn't happen with non-atomic nodes because if <a> is inside a non-atomic
        node, <a> will be covered by the selection. Therefore, it will be removed in
        step #2 and we will never call removeInlineStyleFromElement() on <a>
        again. Thus, the assertion that extractedStyle is not null is reasonable.
        Hence, this patch fixes this bug by skipping over atomic nodes when we apply style.

        Test: editing/style/apply-style-atomic.html

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle):
        (WebCore::ApplyStyleCommand::removeInlineStyle):

2012-08-17  Arpita Bahuguna  <arpitabahuguna@gmail.com>

        ASSERTION FAILED: allocatedMaxLogicalWidth <= cellMaxLogicalWidth : int WebCore::AutoTableLayout::calcEffectiveLogicalWidth()
        https://bugs.webkit.org/show_bug.cgi?id=92471

        Reviewed by Julien Chaffraix.

        The assert occurs due to the float based computations causing a floating
        point rounding error between allocatedMaxLogicalWidth and cellMaxLogicalWidth.

        Test: fast/table/assert-autotablelayout-maxlogicalwidth.html

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
        Converting float based calculations for computing max logical width to int based;
        similar to the calculations for min logical width.

2012-08-09  Luke Macpherson   <macpherson@chromium.org>

        Fix null pointer deref in RenderFileUploadControl::computePreferredLogicalWidth().
        https://bugs.webkit.org/show_bug.cgi?id=93579

        Reviewed by Kent Tamura.

        Checks the upload control has a non-null button renderer before dereferencing.

        Test: fast/forms/file/file-crash-by-display-none-button.html

        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths):

2012-08-08  Matt Arsenault  <arsenm2@gmail.com>

        Crash when inspecting an element with border-image
        https://bugs.webkit.org/show_bug.cgi?id=93380

        Reviewed by Tim Horton.

        The second value in the CSSPair should be the same as the first if
        we are in a shorthand and the next value is not a
        border-image-repeat keyword.

        Test: fast/css/parse-border-image-repeat-null-crash.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseBorderImageRepeat):

2012-08-08  Douglas Stockwell  <dstockwell@chromium.org>

        'highlight' should not be parsed for a composite operation
        https://bugs.webkit.org/show_bug.cgi?id=92615

        Reviewed by Ryosuke Niwa.

        r88144 removed support for highlight as a composite operation but did
        not update the parser.

        Test: fast/backgrounds/composite-highlight-is-invalid.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFillProperty):

2012-07-23  Douglas Stockwell  <dstockwell@chromium.org>

        Null-pointer crash when a derived color like -webkit-activelink is set in a gradient stop
        https://bugs.webkit.org/show_bug.cgi?id=89148

        Reviewed by Simon Fraser.

        CSSGradientValue attempted to resolve colors during paint, this crashed
        when a derived color like -webkit-activelink was encountered because the
        corresponding element was no longer available in the StyleResolver.
        Instead, by adding a field to CSSGradientColorStop we can resolve and
        then cache the resolved colors at the correct time. To avoid sharing
        cached derived colors between elements we clone the gradient values when
        needed.

        Test: fast/css/crash-on-gradient-with-derived-color.html

        * css/CSSGradientValue.cpp:
        (WebCore::CSSGradientValue::gradientWithStylesResolved): Added. Resolve and cache
        resolved colors, clone if colors are derived from the element.
        (WebCore):
        (WebCore::CSSGradientValue::addStops):
        (WebCore::CSSGradientValue::isCacheable): Defer to new logic in
        StyleResolver.
        * css/CSSGradientValue.h:
        (CSSGradientColorStop): Added cache of resolved color.
        (CSSGradientValue):
        (CSSLinearGradientValue):
        (CSSRadialGradientValue):
        * css/CSSImageGeneratorValue.h:
        (WebCore):
        * css/CSSValue.h:
        (WebCore::CSSValue::isGradientValue):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::collectMatchingRulesForList):
        * css/StyleResolver.h:
        (StyleResolver):
        * rendering/style/StyleGeneratedImage.cpp:
        (WebCore::StyleGeneratedImage::image): Revert change from r96449. This
        is no longer necessary as the gradient colors are now resolved at a
        time when the style is set on StyleResolver.

2012-07-12  Adam Barth  <abarth@webkit.org>

        Regression (r122359) Layout Test html5lib/runner.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=91047

        Reviewed by Tony Chang.

        This ASSERT is bogus because doctypes can be removed from the DOM and
        then re-added.

        Test: fast/viewport/viewport-legacy-xhtmlmp-remove-and-add.html

        * dom/Document.cpp:
        (WebCore::Document::setDocType):

2012-06-27  Alexandru Chiculita  <achicu@adobe.com> 

       Blur filter causes issues when scrolling 
       https://bugs.webkit.org/show_bug.cgi?id=89475 

       Reviewed by Simon Fraser. 

       This patch disables the fast scrolling when there is a fixed postioned element that 
       has a filter applied on its parent layer. Otherwise the scroll blitting will just 
       copy the outsets of the blur effect. 

       Test: css3/filters/blur-filter-page-scroll.html 

       * page/FrameView.cpp: 
       (WebCore::FrameView::scrollContentsFastPath): 

2012-06-25  Adam Barth  <abarth@webkit.org> 

       ASSERT(m_wheelEventHandlerCount > 0) can fire 
       https://bugs.webkit.org/show_bug.cgi?id=89856 

       Reviewed by Eric Seidel. 

       When a node with a wheel or a touch event is moved from one document to 
       another, the didAddMumble/didRemoveMumble calls do not balance because 
       they're called on different documents. This patch twiddles the counts 
       appropriately in that case. 

       Test: fast/events/move-element-with-wheel-and-touch-event-listeners.html 

       * dom/EventNames.h: 
       (WebCore::EventNames::isTouchEventType): 
       (EventNames): 
       (WebCore::EventNames::touchEventNames): 
       * dom/Node.cpp: 
       (WebCore::Node::didMoveToNewDocument): 

2012-06-22  Florin Malita  <fmalita@chromium.org> 

       REGRESSION (Safari 5.1.5 - ToT): Crash in RenderSVGRoot::computeReplacedLogicalWidth 
       https://bugs.webkit.org/show_bug.cgi?id=85797 

       Reviewed by Darin Adler. 

       Test: svg/custom/svg-width-intrinsic-crash.html 

       RenderSVGRoot::computeReplacedLogicalWidth assumes that if 
       SVGSVGElement::widthAttributeEstablishesViewport returns false, the 
       SVG must be embedded via <object>. This is not always the case, though: 
       widthAttributeEstablishesViewport can also return false for inline 
       SVG if it doesn't have a replaced logical width. 

       Updated computeReplacedLogical{Width,Height} to handle the 
       !widthAttributeEstablishesViewport && !isEmbeddedThroughFrameContainingSVGDocument 
       case gracefully. 

       * rendering/svg/RenderSVGRoot.cpp: 
       (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): 
       (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): 

2012-06-12  Kent Tamura  <tkent@chromium.org> 

       Checking a radio button doesn't uncheck other buttons in the same group in some cases. 
       https://bugs.webkit.org/show_bug.cgi?id=88835 

       Reviewed by Ryosuke Niwa. 

       This change fixes a bug that checking a radio button in a radio button 
       group in a form detached from a document tree doesn't uncheck another 
       checked radio button in the radio button group. 

       A radio button participates in a radio button group in the following 
       conditions: 
       - If it is owned by a form element regardless of the form is in a 
       document tree or not, or 

       - If it is not owned by any form elements and it is in a document tree. 
       A radio button group for the radio button is owned by the document. 

       For HTMLInputElement::removedFrom(): 
       The old code always unregistered the radio button if it was removed from 
       the document tree. It was incorrect because we don't need to unregister 
       it if it has an owner form and the owner form is not changed by 
       removedFrom(). 
       If the owner form is cleared by removedFrom(), willChangeForm() 
       unregisters the radio button. So what we should do in removedFrom() is 
       to unregister the radio button only if the radio button group is owned 
       by the document. 

       For HTMLInputElement::insertedInto(): 
       The old code always registered the radio button if it is inserted into 
       the document tree. It was incorrect because we don't need to register it 
       if it has an owner form and the owner form is not changed by 
       insertedInto(). 
       If the owner form is changed by insertedInto(), didChangeForm() 
        registers the radio button. So We should register the radio button only 
       if its radio button group will be owned by the document. 

       Test: Add test cases to fast/forms/radio/radio-group.html 

       * html/HTMLInputElement.cpp: 
       (WebCore::HTMLInputElement::insertedInto): 
       Register this to CheckedRadioButtons only if new group owner is Document. 
       (WebCore::HTMLInputElement::removedFrom): 
       Unregister this from CheckedRadioButtons only if old group owner was Document. 

2012-05-25  Keishi Hattori  <keishi@webkit.org> 

       Bad checkValidity result on recently "enabled" form fields 
       https://bugs.webkit.org/show_bug.cgi?id=85704 

       Reviewed by Kent Tamura. 

       Test: fast/forms/disabled-attr-checkvalidity.html 

       We were tripping on the assertion m_isValid == validity()->valid() 
       inside HTMLFormControlElement::isValidFormControlElement. 
       m_isValid was becoming stale because setNeedsValidityCheck wasn't called 
       after m_willValidate changed. 

       * html/HTMLFormControlElement.cpp: 
       (WebCore::HTMLFormControlElement::willValidate): We used const_cast 
       because it was too difficult to remove const. We are checking if the 
       value from willValidate has changed to avoid an infinite loop. 
       (WebCore::HTMLFormControlElement::setNeedsWillValidateCheck): 

2012-05-10  Julien Chaffraix  <jchaffraix@webkit.org> 

       Crash in computedCSSPadding* functions due to RenderImage::imageDimensionsChanged called during attachment 
       https://bugs.webkit.org/show_bug.cgi?id=85912 

       Reviewed by Eric Seidel. 

       Tests: fast/images/link-body-content-imageDimensionChanged-crash.html 
              fast/images/script-counter-imageDimensionChanged-crash.html 

       The bug comes from CSS generated images that could end up calling imageDimensionsChanged during attachment. As the 
       rest of the code (e.g. computedCSSPadding*) would assumes that we are already inserted in the tree, we would crash. 

       The solution is to bail out in this case as newly inserted RenderObject will trigger layout later on and properly 
       handle what we would be doing as part of imageDimensionChanged (the only exception being updating our intrinsic 
       size which should be done as part of imageDimensionsChanged). 

       * rendering/RenderImage.cpp: 
       (WebCore::RenderImage::imageDimensionsChanged): 

012-12-07  David Dorwin  <ddorwin@chromium.org>

        EME v0.1: Report defaultURL in KeyMessage.
        https://bugs.webkit.org/show_bug.cgi?id=104284

        Reviewed by NOBODY (OOPS!).

        Passes defaultURL down from the media engine to HTMLMediaElement.
        Only Valid URLs will be passed.

        No test because Clear Key does not provide a defaultURL (in v0.1).

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerKeyMessage):
        * html/HTMLMediaElement.h:
        (HTMLMediaElement):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::keyMessage):
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerKeyAdded):
        (WebCore::MediaPlayerClient::mediaPlayerKeyError):
        (WebCore::MediaPlayerClient::mediaPlayerKeyMessage):
        (WebCore::MediaPlayerClient::mediaPlayerKeyNeeded):
        (MediaPlayer):

2012-07-04  Kinuko Yasuda  <kinuko@chromium.org>

        XHR.send should support ArrayBufferView
        https://bugs.webkit.org/show_bug.cgi?id=90536

        XHR.send should support ArrayBufferView according to the latest draft
        and also eventually deprecate ArrayBuffer.
        Spec: http://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#dom-xmlhttprequest-send

        Reviewed by NOBODY (OOPS!).

        Test: http/tests/xmlhttprequest/send-array-buffer.html
              http/tests/xmlhttprequest/send-data-view.html

        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::JSXMLHttpRequest::send):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::V8XMLHttpRequest::sendCallback):
        * xml/XMLHttpRequest.cpp:
        (WebCore):
        (WebCore::XMLHttpRequest::send):
        * xml/XMLHttpRequest.h:
        (XMLHttpRequest):
        * xml/XMLHttpRequest.idl:

2012-12-13  Lucas Forschler  <lforschler@apple.com>

    Rollout r145656

2013-04-16  Ryosuke Niwa  <rniwa@webkit.org>

        Merge r125955.

    2012-08-17  Alice Cheng  <alice_cheng@apple.com>

            Preserve styling elements in DeleteSelectionCommand
            <rdar://problem/12040676>
            https://bugs.webkit.org/show_bug.cgi?id=93643

            Reviewed by Ryosuke Niwa.

            Styling elements (<link> and <style>) can appear inside editable content. To 
            prevent accidental deletion, we move styling elements to rootEditableElement in
            DeleteSelectionCommand undoably.

            Test: editing/execCommand/delete-selection-has-style.html

            * editing/DeleteSelectionCommand.cpp:
            (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss): Added to preserve styling elements during the command
            (WebCore::DeleteSelectionCommand::handleGeneralDelete):  Modified to preserve styling elements during the command
            * editing/DeleteSelectionCommand.h:
            (DeleteSelectionCommand):

2013-04-16  Lucas Forschler  <lforschler@apple.com>

        Merge r130313

    2012-10-03  Adam Barth  <abarth@webkit.org>

            Crash when calling document.open during unload
            https://bugs.webkit.org/show_bug.cgi?id=98287

            Reviewed by Nate Chapin.

            Calling document.open results in us nulling out m_documentLoader. This
            code doesn't properly handle that case and crashes.

            Test: fast/parser/document-open-in-unload.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::commitProvisionalLoad):

2013-04-16  Lucas Forschler  <lforschler@apple.com>

        Merge r147938

    2013-04-08  Alexey Proskuryakov  <ap@apple.com>

            <rdar://problem/12834449> Crashes in WebSocketChannel::processFrame when processing a ping
            https://bugs.webkit.org/show_bug.cgi?id=114178

            Reviewed by Brady Eidson.

            No test, I could never reproduce even manually.

            Calling enqueueRawFrame() could change incoming buffer, so a subsequent skipBuffer()
            would operate on wrong assumptions. This happened because enqueueRawFrame() actually
            tried to process the queue, and send failure sometimed clears m_buffer.

            Fixing this by decoupling enqueuing from sending, and making sure that skipBuffer()
            in ping frame processing case is performed at a safe time.

            * Modules/websockets/WebSocketChannel.cpp:
            (WebCore::WebSocketChannel::send):
            (WebCore::WebSocketChannel::startClosingHandshake):
            (WebCore::WebSocketChannel::processFrame):
            (WebCore::WebSocketChannel::enqueueTextFrame):
            (WebCore::WebSocketChannel::enqueueRawFrame):
            (WebCore::WebSocketChannel::enqueueBlobFrame):

2013-04-16  Andy Estes  <aestes@apple.com>

        Merged r142631.

    2013-02-12  Dominic Mazzoni  <dmazzoni@google.com>

        ASSERTION FAILED: i < size(), UNKNOWN in WebCore::AccessibilityMenuListPopup::didUpdateActiveOption
        https://bugs.webkit.org/show_bug.cgi?id=109452

        Reviewed by Chris Fleizach.

        Send the accessibility childrenChanged notification in
        HTMLSelectElement::setRecalcListItems instead of in childrenChanged
        so that all possible codepaths are caught.

        Test: accessibility/insert-selected-option-into-select-causes-crash.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::childrenChanged):
        (WebCore::HTMLSelectElement::setRecalcListItems):

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r139444.

    2013-01-11  Stephen Chenney  <schenney@chromium.org>
        Objects can be re-added to the AXObjectCache during removal
        https://bugs.webkit.org/show_bug.cgi?id=104171

        The problem occurs when a label's corresponding element is a sibling
        that precedes it in the render tree, and the corresponding element is
        removed. The corresponding element's AX render object is removed, but
        then recreated when accessibilityIsIgnored() invokes correspondingControl()
        on the label. The corresponding renderer then has an AX render object
        that survives beyond the deleted renderer, leading to invalid memory
        accesses.

        The solution is to rearrange the calls to delete the renderer's AX
        render object only when we are sure it will no longer be required.

        Reviewed by Simon Fraser.

        Test: accessibility/corresponding-control-deleted-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::willBeDestroyed): Move the call to remove the
        renderer from the AXCache to after the renderer is removed from the
        render tree. This means that the AXObject still exists during renderer
        removal, as we require.

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r131670.

    2012-10-17  Tom Sepez  <tsepez@chromium.org>

        Crash in ContainerNode::removeAllChildren()
        https://bugs.webkit.org/show_bug.cgi?id=98443

        Reviewed by Eric Carlson.

        This patch makes the errorEventSender added in WebKit Revision 112190 interact
        with the updatedHasPendingLoadEvent() mechanism in the same manner as the other
        existing event senders.

        Test: http/tests/security/video-poster-cross-origin-crash2.html

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::setImage):
        (WebCore::ImageLoader::updateFromElement):
        (WebCore::ImageLoader::notifyFinished):
        (WebCore::ImageLoader::updatedHasPendingEvent):
        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
        (WebCore::ImageLoader::dispatchPendingLoadEvent):
        * loader/ImageLoader.h:
        (ImageLoader):

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r142063.

    2013-02-06  Tom Sepez  <tsepez@chromium.org>

        document.referrer leakage with XSS Auditor page block
        https://bugs.webkit.org/show_bug.cgi?id=109089

        Reviewed by Adam Barth.

        Pass "about:blank" as referrer instead of "" so that the actual page
        is not leaked when empty referrers are replaced later on in the
        request.
        
        * html/parser/XSSAuditorDelegate.cpp:
        (WebCore::XSSAuditorDelegate::didBlockScript):

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r139111.

    2013-01-08  Tom Sepez  <tsepez@chromium.org>

        Copy-paste preserves <embed> tags containing active content.
        https://bugs.webkit.org/show_bug.cgi?id=77625

        Reviewed by Ryosuke Niwa.

        Test: editing/pasteboard/paste-noplugin.html

        * dom/FragmentScriptingPermission.h:
        (WebCore::scriptingContentIsAllowed):
        (WebCore::pluginContentIsAllowed):
        Add new permission to restrict plugin pasting.  Add inline functions to check
        the implications of each permission rather than having a list of raw comparisions
        sprinkled throughout the code. 
        
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkup):
        Revert back to unsafe plugin pasting regardless of caller's intentions when
        the settings allow it.

        * dom/Element.cpp:
        (WebCore::Element::parserSetAttributes):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertScriptElement):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::endElementNs):
        * xml/parser/XMLDocumentParserQt.cpp:
        (WebCore::XMLDocumentParser::parseEndElement):
        Use new inline functions to check implications of permissions rather than raw
        comparisions.
        
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
        (WebCore::HTMLTreeBuilder::processEndTag):
        Check if plugin pasting is allowed before inserting applet/embed/oject elements.

        * page/Settings.in:
        Declaration of new unsafePluginPastingEnabled setting.

        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::documentFragment):
        * platform/blackberry/PasteboardBlackBerry.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/chromium/DragDataChromium.cpp:
        (WebCore::DragData::asFragment):
        * platform/chromium/PasteboardChromium.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/gtk/PasteboardGtk.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/qt/DragDataQt.cpp:
        (WebCore::DragData::asFragment):
        * platform/qt/PasteboardQt.cpp:
        (WebCore::Pasteboard::documentFragment):
        * platform/win/ClipboardUtilitiesWin.cpp:
        (WebCore::fragmentFromCFHTML):
        (WebCore::fragmentFromHTML):
        * platform/wx/PasteboardWx.cpp:
        (WebCore::Pasteboard::documentFragment):
        Pass DisallowScriptingAndPluginContent enum value.
        
2013-04-15  Roger Fong  <roger_fong@apple.com>

        Build fix for r148472.

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::setBlendedFontSize):
        * rendering/style/RenderStyle.h:

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merged r138821.

    01/04/13 John Mellor  <johnme@chromium.org>

            Clamp font sizes to valid range in RenderStyle::setFontSize
            https://bugs.webkit.org/show_bug.cgi?id=106014

            Reviewed by Emil A Eklund.

            There is a test-case attached to http://crbug.com/167443, but I can't
            think of a good way of automatically testing this. Functionality
            shouldn't change on normal pages.

            * rendering/style/RenderStyleConstants.h:
                Add constant for maximum allowed font size.
            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::getComputedSizeFromSpecifiedSize):
                Use constant from RenderStyleConstants.h instead of hardcoding.
            * rendering/style/RenderStyle.cpp:
            (WebCore::RenderStyle::setFontSize):
                Clamp non-finite and out of range font sizes.

2013-04-15  Andy Estes  <aestes@apple.com>

        Merged r138990.

    2013-01-07  Tom Sepez  <tsepez@chromium.org>

        Document::initSecurityContext() gives parent security context to iframes with invalid URLs.
        https://bugs.webkit.org/show_bug.cgi?id=104960

        Reviewed by Adam Barth.

        Change covers the case of an invalid non-empty URL.  We know nothing
        about that kind of URL and choose not to inherit origins.
        
        * dom/Document.cpp:
        (WebCore::shouldInheritSecurityOriginFromOwner):

2013-04-15  Tim Horton  <timothy_horton@apple.com>

    Merge r138460.

    2012-12-25  Alexander Pavlov  <apavlov@chromium.org>

            Web Inspector: Crash when modifying a rule that has been removed through JavaScript
            https://bugs.webkit.org/show_bug.cgi?id=105718

            Reviewed by Yury Semikhatsky.

            CSSStyleRules should be stored by RefPtr's to avoid using stale pointers to deleted instances.

            Test: inspector/styles/removed-rule-crash.html

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::ruleForId):
            (WebCore::InspectorStyleSheet::revalidateStyle):
            (WebCore::InspectorStyleSheet::buildArrayForRuleList):
            (WebCore::InspectorStyleSheet::collectFlatRules):
            * inspector/InspectorStyleSheet.h:
            (InspectorStyleSheet):

2013-04-15  Tim Horton  <timothy_horton@apple.com>

        Merge r143454.

    2013-02-20  Florin Malita  <fmalita@chromium.org>

            Clear SVGPathSeg role on removal.
            https://bugs.webkit.org/show_bug.cgi?id=110058

            Reviewed by Dirk Schulze.

            SVGPathSegListPropertyTearOff::initialize() and SVGPathSegListPropertyTearOff::replaceItem()
            need to clear the context and role for segments being expunged from the list, similarly to
            removeItem(). Otherwise, processIncomingListItemValue() can get confused and attempt to
            remove stale segments.

            Test: svg/dom/SVGPathSegList-crash.html

            * svg/properties/SVGPathSegListPropertyTearOff.cpp:
            (WebCore::SVGPathSegListPropertyTearOff::clearContextAndRoles):
            (WebCore::SVGPathSegListPropertyTearOff::clear):
            (WebCore::SVGPathSegListPropertyTearOff::replaceItem):
            (WebCore):
            * svg/properties/SVGPathSegListPropertyTearOff.h:
            (WebCore::SVGPathSegListPropertyTearOff::initialize):
            (SVGPathSegListPropertyTearOff):

2013-04-15  Tim Horton  <timothy_horton@apple.com>

        Merge r142759.

    2013-02-13  Florin Malita  <fmalita@chromium.org>

            [SVG] OOB access in SVGListProperty::replaceItemValues()
            https://bugs.webkit.org/show_bug.cgi?id=109293

            Replacing a list property item with itself should be a no-op. This patch updates the related
            APIs and logic to detect the self-replace case and prevent removal of the item from the list.

            To avoid scanning the list multiple times, removeItemFromList() is updated to operate on
            indices and a findItem() method is added to resolve an item to an index.

            Reviewed by Dirk Schulze.

            No new tests: updated existing tests cover the change.

            * svg/properties/SVGAnimatedListPropertyTearOff.h:
            (WebCore::SVGAnimatedListPropertyTearOff::findItem):
            (SVGAnimatedListPropertyTearOff):
            (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
            * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
            (WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
            (SVGAnimatedPathSegListPropertyTearOff):
            (WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
            Add a findItem() delegating method, and update removeItemFromList() to use the new
            index-based API.

            * svg/properties/SVGListProperty.h:
            (WebCore::SVGListProperty::insertItemBeforeValues):
            (WebCore::SVGListProperty::insertItemBeforeValuesAndWrappers):
            (WebCore::SVGListProperty::replaceItemValues):
            (WebCore::SVGListProperty::replaceItemValuesAndWrappers):
            (SVGListProperty):
            Updated to handle the no-op case for insertItemBefore() & replaceItem().

            * svg/properties/SVGListPropertyTearOff.h:
            (WebCore::SVGListPropertyTearOff::findItem):
            (WebCore::SVGListPropertyTearOff::removeItemFromList):
            Index-based API updates.

            (WebCore::SVGListPropertyTearOff::processIncomingListItemValue):
            (WebCore::SVGListPropertyTearOff::processIncomingListItemWrapper):
            * svg/properties/SVGPathSegListPropertyTearOff.cpp:
            (WebCore::SVGPathSegListPropertyTearOff::processIncomingListItemValue):
            Detect the self-replace case and return without removing the item from the list.

            * svg/properties/SVGPathSegListPropertyTearOff.h:
            (WebCore::SVGPathSegListPropertyTearOff::findItem):
            (WebCore::SVGPathSegListPropertyTearOff::removeItemFromList):
            (SVGPathSegListPropertyTearOff):
            (WebCore::SVGPathSegListPropertyTearOff::processIncomingListItemWrapper):
            * svg/properties/SVGStaticListPropertyTearOff.h:
            (WebCore::SVGStaticListPropertyTearOff::processIncomingListItemValue):
            (WebCore::SVGStaticListPropertyTearOff::processIncomingListItemWrapper):
            Index-based API updates.

2013-04-15  Timothy Hatcher  <timothy@apple.com>

        Merge r140127.

    2013-01-18  Yury Semikhatsky  <yurys@chromium.org>

        Web Inspector: make sure InspectorInstrumentationCookie is invalidated if inspected page was destroyed
        https://bugs.webkit.org/show_bug.cgi?id=107232

        Reviewed by Pavel Feldman.

        Made InstrumentingAgents reference counted to make sure it is not deleted while there is
        InspectorInstrumentationCookie with reference to it.

        Introduced InstrumentingAgents::reset that is called from inspector controller destructor
        to double check that references to all deleted agents are cleared.

        InspectorInstrumentationCookie turned from std::pair into a custom class so that
        we can avoid inclusion of InstrumentingAgents.h into InspectorInstrumentation.h

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::~InspectorController):
        * inspector/InspectorController.h:
        (InspectorController):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore):
        (WebCore::InspectorInstrumentationCookie::InspectorInstrumentationCookie):
        (WebCore::InspectorInstrumentationCookie::operator=):
        (WebCore::InspectorInstrumentationCookie::~InspectorInstrumentationCookie):
        (WebCore::InspectorInstrumentation::didHandleEventImpl):
        (WebCore::InspectorInstrumentation::didFireTimerImpl):
        (WebCore::InspectorInstrumentation::didLayoutImpl):
        (WebCore::InspectorInstrumentation::didPaintImpl):
        (WebCore::InspectorInstrumentation::didRecalculateStyleImpl):
        (WebCore::InspectorInstrumentation::didMatchRuleImpl):
        (WebCore::InspectorInstrumentation::didProcessRuleImpl):
        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
        (WebCore::InspectorInstrumentation::retrieveTimelineAgent):
        * inspector/InspectorInstrumentation.h:
        (InspectorInstrumentationCookie):
        (WebCore::InspectorInstrumentation::didCallFunction):
        (WebCore::InspectorInstrumentation::didDispatchXHRReadyStateChangeEvent):
        (WebCore::InspectorInstrumentation::didDispatchEvent):
        (WebCore::InspectorInstrumentation::didHandleEvent):
        (WebCore::InspectorInstrumentation::didDispatchEventOnWindow):
        (WebCore::InspectorInstrumentation::didEvaluateScript):
        (WebCore::InspectorInstrumentation::didFireTimer):
        (WebCore::InspectorInstrumentation::didLayout):
        (WebCore::InspectorInstrumentation::didDispatchXHRLoadEvent):
        (WebCore::InspectorInstrumentation::didPaint):
        (WebCore::InspectorInstrumentation::didRecalculateStyle):
        (WebCore::InspectorInstrumentation::didMatchRule):
        (WebCore::InspectorInstrumentation::didProcessRule):
        (WebCore::InspectorInstrumentation::didReceiveResourceData):
        (WebCore::InspectorInstrumentation::didWriteHTML):
        (WebCore::InspectorInstrumentation::didFireAnimationFrame):
        * inspector/InstrumentingAgents.cpp:
        (WebCore::InstrumentingAgents::InstrumentingAgents):
        (WebCore):
        (WebCore::InstrumentingAgents::reset):
        * inspector/InstrumentingAgents.h:
        (WebCore::InstrumentingAgents::create):
        (InstrumentingAgents):
        * inspector/WorkerInspectorController.cpp:
        (WebCore::WorkerInspectorController::WorkerInspectorController):
        (WebCore::WorkerInspectorController::~WorkerInspectorController):
        * inspector/WorkerInspectorController.h:
        (WorkerInspectorController):

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merge 133840, 134191, 134197.

    2012-11-12  Ryosuke Niwa  <rniwa@webkit.org>

            Build fix after r134191. Turns out that FrameView::performPostLayoutTasks calls FrameSelection::updateAppearance
            in the middle of a layout. So we can't have assertions in recomputeCaretRect and updateAppearance.

            Furthermore, we can't update layout in updateAppearance. So do that in its call sites.
        
            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::setSelection):
            (WebCore::FrameSelection::recomputeCaretRect):
            (WebCore::FrameSelection::updateAppearance):
            (WebCore::FrameSelection::setCaretVisibility):

    2012-11-09  Ryosuke Niwa  <rniwa@webkit.org>

            Multiple Layout Tests (e.g. fast/repaint/japanese-rl-selection-clear.html) is failing after r133840.
            https://bugs.webkit.org/show_bug.cgi?id=101547

            Reviewed by Simon Fraser.

            I overlooked the fact when the selection is null, we still have to invalidate the caret rect that
            previously existed. Revert the optimization added in r133840 to skip caret invalidation when new
            selection is null, and add a special method to be called by FrameLoader prior to destruction instead.
            This will let us avoid doing an extra layout upon destruction and not regress repaint tests.

            Covered by existing tests.

            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::setSelection): Added DoNotUpdateAppearance option.
            (WebCore::FrameSelection::prepareForDestruction): Added.
            (WebCore::FrameSelection::updateAppearance): Reverted the flawed optimization added in r133840.
            Also, don't update style before updating selection unless text caret is disabled since we always
            update the layout (including style) when text caret is enabled.
            * editing/FrameSelection.h:
            (FrameSelection):
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::clear): Call prepareForDestruction instead of clear to avoid a layout.

    2012-11-07  Ryosuke Niwa  <rniwa@webkit.org>

            Crash in WebCore::RenderLayer::normalFlowList
            https://bugs.webkit.org/show_bug.cgi?id=101528

            Reviewed by Simon Fraser.

            Make sure the layout is up to date before re-computing the caret rect.
            Avoid doing the layout when the selection is cleared since we don't can
            since we can always stop the blink timer in that case.

            Unfortunately, we haven't found any reproduction of this crash yet.

            * editing/FrameSelection.cpp:
            (WebCore::isNonOrphanedCaret):
            (WebCore):
            (WebCore::FrameSelection::localCaretRect):
            (WebCore::FrameSelection::updateAppearance):
 
2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merged r138213.

    2013-01-09  Abhishek Arya  <inferno@chromium.org>

            Mitigate out-of-bounds access in InlineIterator
            https://bugs.webkit.org/show_bug.cgi?id=104812

            Reviewed by Levi Weintraub.

            Share code between InlineIterator::current and InlineIterator::previousInSameNode,
            thereby checking for access outside text renderer's length.

            * rendering/InlineIterator.h:
            (InlineIterator):
            (WebCore::InlineIterator::characterAt):
            (WebCore):
            (WebCore::InlineIterator::current):
            (WebCore::InlineIterator::previousInSameNode):

2012-12-13  Lucas Forschler  <lforschler@apple.com>

    Rollout r
145643

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merge r142816.

    2013-02-13  Abhishek Arya  <inferno@chromium.org>

            ASSERTION FAILED: !object || object->isBox(), Bad cast in RenderBox::computeLogicalHeight
            https://bugs.webkit.org/show_bug.cgi?id=107748

            Reviewed by Levi Weintraub.

            Make sure that body renderer is not an inline-block display
            when determining that it stretches to viewport or when paginated
            content needs base height.

            Test: fast/block/body-inline-block-crash.html

            * rendering/RenderBox.cpp:
            (WebCore::RenderBox::computeLogicalHeight):
            * rendering/RenderBox.h:
            (WebCore::RenderBox::stretchesToViewport):

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merge r142922.

    2013-02-14  Abhishek Arya  <inferno@chromium.org>

            Bad cast in RenderBlock::splitBlocks.
            https://bugs.webkit.org/show_bug.cgi?id=108691

            Reviewed by Levi Weintraub.

            Test: fast/multicol/remove-child-split-flow-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore):
            (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): rename gIsInColumnFlowSplit to gColumnFlowSplitEnabled
            and use it to decide when to do the column flow split or not.
            (WebCore::RenderBlock::removeChild): Do not allow column flow split inside removeChild
            since we might be merging anonymous blocks.

2013-04-15  Roger Fong  <roger_fong@apple.com>

        Merge r138988.

    2013-01-07  Abhishek Arya  <inferno@chromium.org>

            Heap-buffer-overflow in WebCore::RenderBlock::clone.
            https://bugs.webkit.org/show_bug.cgi?id=101984

            Reviewed by Julien Chaffraix.

            Add a global in RenderBlock to prevent recursion inside splitFlow.
            While inside splitFlow (multi-column handling), we move many children
            using fullRemoveInsert=true, causing RenderBlock::addChild to be called
            and recursing in splitFlow. This messes the tree splitting happening in
            RenderBlock::splitBlocks and can cause bad casts.

            Test: fast/multicol/recursive-split-flow-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):

2013-04-13  Lucas Forschler  <lforschler@apple.com>

        Merge r136845

    2012-12-06  Stephen Chenney  <schenney@chromium.org>

            SVG <use> element inside an svg-as-image fails
            https://bugs.webkit.org/show_bug.cgi?id=104007

            Reviewed by Eric Seidel.

            Upon redraw, SVGImage calls layout on the document it is drawing into
            the image if the image, provided it believes the redraw does not need
            to be delayed. Unfortunately, when an SVG <use> element is modified
            (by animation, say) and regenerates its shadow tree, the destructors
            invoke redraw, causing the SVGImage to call layout on something that
            is in the process of being deleted. That's bad.

            This change causes SVGImage to always delay the redraw. It is the most robust
            way to protect against this problem, as there may be any number of
            ways to cause this issue (a node being deleted in an svg-as-image
            target) and this protects against them all.

            The test case crashes in Asan Chromium.

            Test: svg/as-image/animated-use-as-image-crash.html

            * svg/graphics/SVGImageCache.cpp:
            (WebCore::SVGImageCache::imageContentChanged): Always redraw on the timer.

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 140893

    2013-01-30  Kentaro Hara  <haraken@chromium.org>

            Remove InjectedScript::wrapSerializedObject()
            https://bugs.webkit.org/show_bug.cgi?id=107906

            Reviewed by Abhishek Arya.

            InjectedScript::wrapSerializedObject() is unused.
            (This is one of steps to remove raw pointers of SerializedScriptValue*,
            which can be a security concern.)

            * inspector/InjectedScript.cpp:
            * inspector/InjectedScript.h:
            (InjectedScript):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 141315

    2013-01-30  Kentaro Hara  <haraken@chromium.org>

            isSameAsCurrentState() should take SerializedScriptValue* instead of PassRefPtr
            https://bugs.webkit.org/show_bug.cgi?id=107904

            Reviewed by Darin Adler.

            Applied Darin's comment: https://bugs.webkit.org/show_bug.cgi?id=107904#c5

            No tests. No change in behavior.

            * bindings/js/JSPopStateEventCustom.cpp:
            (WebCore::JSPopStateEvent::state):
            * bindings/v8/custom/V8PopStateEventCustom.cpp:
            (WebCore::V8PopStateEvent::stateAccessorGetter):
            * page/History.cpp:
            (WebCore::History::isSameAsCurrentState):
            * page/History.h:
            (History):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 140886

    2013-01-25  Kentaro Hara  <haraken@chromium.org>

            Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() in PopStateEvent
            https://bugs.webkit.org/show_bug.cgi?id=107904

            Reviewed by Abhishek Arya.

            If you use a raw SerializedScriptValue* for serialize()/deserialize(),
            it can potentially cause a use-after-free. This is because serialize()/
            deserialize() can destruct a RefPtr of the SerializedScriptValue*,
            depending on data that is serialized/deserialized. So we should keep a
            RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
            (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

            No tests. This is just a just-in-case fix.

            * dom/PopStateEvent.h:
            (WebCore::PopStateEvent::serializedState):
            * page/History.cpp:
            (WebCore::History::isSameAsCurrentState):
            * page/History.h:
            (History):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge r140892

    2013-01-25  Kentaro Hara  <haraken@chromium.org>

            Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() in code generators
            https://bugs.webkit.org/show_bug.cgi?id=107902

            Reviewed by Abhishek Arya.

            If you use a raw SerializedScriptValue* for serialize()/deserialize(),
            it can potentially cause a use-after-free. This is because serialize()/
            deserialize() can destruct a RefPtr of the SerializedScriptValue*,
            depending on data that is serialized/deserialized. So we should keep a
            RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
            (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

            No tests. This is just a just-in-case fix.

            * Modules/intents/Intent.h:
            (WebCore::Intent::data):
            * Modules/intents/IntentRequest.cpp:
            (WebCore::IntentRequest::postResult):
            (WebCore::IntentRequest::postFailure):
            * Modules/intents/IntentRequest.h:
            (IntentRequest):
            * Modules/intents/IntentResultCallback.h:
            (IntentResultCallback):
            * bindings/scripts/CodeGeneratorJS.pm:
            (GetNativeTypeForCallbacks):
            * bindings/scripts/CodeGeneratorV8.pm:
            (GenerateNormalAttrGetter):
            (GetNativeTypeForCallbacks):
            * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
            (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
            (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):
            * dom/MessagePortChannel.h:
            (WebCore::MessagePortChannel::EventData::message):


2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge r140891

    2013-01-25  Kentaro Hara  <haraken@chromium.org>

            Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() for MessageEvent
            https://bugs.webkit.org/show_bug.cgi?id=107900

            Reviewed by Abhishek Arya.

            If you use a raw SerializedScriptValue* for serialize()/deserialize(),
            it can potentially cause a use-after-free. This is because serialize()/
            deserialize() can destruct a RefPtr of the SerializedScriptValue*,
            depending on data that is serialized/deserialized. So we should keep a
            RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
            (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

            No tests. This is just a just-in-case fix. I couldn't find any bug
            even in an ASAN build.

            * bindings/js/JSMessageEventCustom.cpp:
            (WebCore::JSMessageEvent::data):
            * bindings/v8/custom/V8MessageEventCustom.cpp:
            (WebCore::V8MessageEvent::dataAccessorGetter):
            * dom/MessageEvent.h:
            (WebCore::MessageEvent::dataAsSerializedScriptValue):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge r140748.

    2013-01-24  Kentaro Hara  <haraken@chromium.org>

            Regression(r107058): Use-after-free in SerializedScriptValue::deserialize
            https://bugs.webkit.org/show_bug.cgi?id=107792

            Reviewed by Abhishek Arya.

            Imagine the following call path:

            (1) history.state is accessed.
            (2) V8History::stateAccessorGetter() calls History::state(), which calls
            HistoryItem::stateObject().
            (3) HistoryItem holds m_stateObject as RefPtr<SerializedScriptValue>,
            but HistoryItem::stateObject() returns SerializedScriptValue*.
            (4) V8History::stateAccessorGetter calls SerializedScriptValue::deserialize()
            for the SerializedScriptValue* obtained in (3).
            (5) SerializedScriptValue::deserialize() can call history.replaceState()
            in its deserialization process (See the test case in the Chromium bug).
            (6) history.replaceState() replaces HistoryItem::m_stateObject.
            This replacement destructs the original HistoryItem::m_stateObject.
            (7) The current deserialization process can crash due to the premature destruction.

            To avoid the problem, we have to pass PassRefPtr<SerializedScriptValue> around
            instead of SerializedScriptValue*.

            Test: fast/history/replacestate-nocrash.html

            * bindings/v8/custom/V8HistoryCustom.cpp:
            (WebCore::V8History::stateAccessorGetter):
            * history/HistoryItem.h:
            (WebCore):
            (WebCore::HistoryItem::stateObject):
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::loadInSameDocument):
            * loader/FrameLoader.h:
            * page/History.cpp:
            (WebCore::History::state):
            (WebCore::History::stateInternal):
            * page/History.h:
            (History):

2013-04-12  Lucas Forschler  <lforschler@apple.com>

        Merge r129814

    2012-09-27  Levi Weintraub  <leviw@chromium.org>

            REGRESSION(r129186): Pressing enter at the end of a line deletes the line
            https://bugs.webkit.org/show_bug.cgi?id=97763

            Reviewed by Ryosuke Niwa.

            r129186 exposed incorrect behavior in RenderText whereby RenderText's lines were
            dirtied but the renderer wasn't marked for layout. Rich text editing in GMail exposed
            this behavior. RenderText::setTextWithOffset is called with a text string identical
            to the current text. It still dirties lines, then calls setText, which has a check
            for the case when the strings are the same and returns early and doesn't mark us as
            needing layout.

            This change adds the same early bailing logic in setText to setTextWithOffset, but
            forces setText to work its magic whenever we dirty lines there (and avoid double-
            checking that the strings are equal).

            * rendering/RenderText.cpp:
            (WebCore::RenderText::setTextWithOffset):

2013-04-12  Roger Fong  <roger_fong@apple.com>

        Merge r143565.

    2013-02-20  Wei James  <james.wei@intel.com>
    
            ChannelMergerNode may need check for deferred updating of output channels
            https://bugs.webkit.org/show_bug.cgi?id=108863
    
            There can in rare cases be a slight delay before the output bus is updated
            to the new number of channels because of tryLocks() in the context's
            updating system. So need to check the channel number before processing.
    
            Reviewed by Chris Rogers.
    
            * Modules/webaudio/ChannelMergerNode.cpp:
            (WebCore::ChannelMergerNode::ChannelMergerNode):
            (WebCore::ChannelMergerNode::process):
            (WebCore::ChannelMergerNode::checkNumberOfChannelsForInput):
            * Modules/webaudio/ChannelMergerNode.h:
            (ChannelMergerNode):

2013-04-12  Tim Horton  <timothy_horton@apple.com> 

        Merge r132856

    2012-10-25  Stephen Chenney  <schenney@chromium.org>

            feImage should not be allowed to self reference
            https://bugs.webkit.org/show_bug.cgi?id=94652

            Reviewed by Eric Seidel.

            Add cycle detection for SVG filter application, and also fix a problem
            with graphics context restore when filters are applied. This also
            converts the flags in FilterData to a state tracking system, as the
            number of flags was getting messy and only one flag is valid at any given time.

            Test: svg/filters/feImage-self-and-other-referencing.html

            * rendering/svg/RenderSVGResourceFilter.cpp: Convert to new FilterData
            state management and enable cycle detection.
            (WebCore):
            (WebCore::RenderSVGResourceFilter::removeClientFromCache): Change isBuilt and markedForRemoval flags to state enums.
            (WebCore::RenderSVGResourceFilter::applyResource): Change flags to state enums and detect cycles.
            (WebCore::RenderSVGResourceFilter::postApplyResource): Change flags to state and add handling
            for the various states.
            (WebCore::RenderSVGResourceFilter::primitiveAttributeChanged): Change isBuilt flag to state enums.
            * rendering/svg/RenderSVGResourceFilter.h:
            (WebCore::FilterData::FilterData):
            (FilterData): Convert to a state tracking system.
            * rendering/svg/RenderSVGRoot.cpp:
            (WebCore::RenderSVGRoot::paintReplaced): Add a block around the
            SVGRenderingContext so that it applies the filter and reverts the
            context before the calling method restores the context.

2013-04-12  Tim Horton  <timothy_horton@apple.com> 

        Merge r131488

    2012-10-16  Stephen Chenney  <schenney@chromium.org> 
            An feImage that tries to render itself should be stopped
            https://bugs.webkit.org/show_bug.cgi?id=94652

            Reviewed by Eric Seidel.

            An SVG feImage filter element will accept, as the src to render, an
            SVG document that makes use of the feImage itself. This causes the
            feImage to try to draw itself while already in the process of drawing
            itself. Various problems arise from this. The invariant we wish to
            maintain is that no element in the src tree of an feImage element
            refers to that feImage.

            This patch adds a flag to all FilterData objects that tracks whether or
            not the filter is currently applying itself, and avoids applying the
            filter recursively.

            While it may seem better to catch this problem when the src is set, or
            when the filter is built, that turns out to be challenging and
            inefficient. Say we choose to test when the src atttribute is set. To
            do so would require looking through all of the DOM nodes that will be
            rendered for the src, finding all resources used, and checking if any
            of them make use fo the feImage element that we are setting the source
            for. The infrastructure is not in place to do that, and it would
            involve walking a potentially very large portion of the DOM in order
            to detect a very rare situation. Note that it is not enough just to
            walk the DOM directly under the src; we also need to recursively follow any
            resource links to see if they use the feImage (e.g. patterns or
            masks or use or ...).

            If we instead try to use the renderer node to find self referencing,
            we need to recursively walk a potentially very large render tree,
            tracing all resources in search of the feImage. This would need to be
            done every time the filter is built, which is again a significant
            overhead for a situation that is very unlikely to occur. And we do not
            have methods that make it easy to find feImage filter effect nodes; they are
            hidden behind filter resource nodes.

            Hence the runtime check to catch the problem. The check must be in
            FilterData and RenderSVGResourceFilter code because we must prevent
            the destruction of the feImage when we encounter it recursively.

            This patch also renames FilterData::builded to FilterData::isBuilt.

            Test: svg/filters/feImage-self-referencing.html

            * rendering/svg/RenderSVGResourceFilter.cpp:
            (WebCore::ApplyingFilterEffectGuard): Guard to ensure that, in the future, we always
            clear the isApplying flag even if the postApplyResource method returns early.
            (WebCore::RenderSVGResourceFilter::applyResource): Do not apply a resource that is already applying and
            rename builded to isBuilt.
            (WebCore::RenderSVGResourceFilter::postApplyResource): Mark a resource as applying and clear after
            it is done. Abort if a resource is already applying when the method begins. Rename builded to isBuilt.
            (WebCore::RenderSVGResourceFilter::primitiveAttributeChanged): Rename builded to isBuilt.
            * rendering/svg/RenderSVGResourceFilter.h:
            (WebCore::FilterData::FilterData):
            (FilterData): Add isApplying and rename builded to isBuilt.

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 130717.

    2012-10-08  Yoshifumi Inoue  <yosin@chromium.org>

            HTMLSelectElement::typeAheadFind depends on implementation dependent behavior
            https://bugs.webkit.org/show_bug.cgi?id=98710

            Reviewed by Kent Tamura.

            This patch gets rid of C/C++ implementation dependent behavior from
            HTMLSelectElement::typeAheadFind() which does modulo operation with
            a negative operand.

            HTMLSelectElement::typeAheadFind() contains expression with modulo
            operator and dividend can be -1 when the "select" element without
            "option" element but "optgroup" element.

            Test: fast/forms/select/select-typeahead-crash.html

            * html/HTMLSelectElement.cpp:
            (WebCore::HTMLSelectElement::typeAheadFind): Changed to do modulo
            operation with both operands are non-negative.

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 136619.

    2012-12-04  Abhishek Arya  <inferno@chromium.org>

            Crash in WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode
            https://bugs.webkit.org/show_bug.cgi?id=103515

            Reviewed by Ryosuke Niwa.

            |current| is weak node pointer that iterates in the hierarchy chain
            between |highestAncestor| and |targetNode|. Script executed as part
            of iframe onload event can blow away the nodes and we no longer have
            |targetNode| in our descendants chain. So, we RefPtr |current| and bail
            out when |targetNode| stops being a part of descendant chain.

            Test blocked on https://bugs.webkit.org/show_bug.cgi?id=104044.

            * editing/ApplyStyleCommand.cpp:
            (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode):

2013-04-12  Ryosuke Niwa  <rniwa@webkit.org>

        Merge 117463.

    2012-05-17  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>

            [Qt] REGRESSION(101967): It made editing/style/iframe-onload-crash-mac.html timeout
            https://bugs.webkit.org/show_bug.cgi?id=73802

            Reviewed by Ryosuke Niwa.

            Timeout was caused by an infinite in the outer loop of
            pushDownInlineStyleAroundNode(). The outer loop variable 'current' should point at the
            node containing 'targetNode'. The inner loop traverse the children of 'current'
            and discover the children that contains 'targetNode'.

            However, before the inner loop, we call removeInlineStyleFromElement() that can
            potentially remove the 'current' node from the tree, moving its children to
            'current' former parent. For that reason 'child' and 'lastChild' are collected
            before this call.

            The tricky part is that changing the 'current' children parent, we might trigger
            further side-effects, that can remove either 'child' or 'lastChild' from the tree
            too. The infinite loop was due to 'child' being off the document, so it's
            nextSibling() is 0, and we go another run of outer loop without changing
            'current' because the 'targetNode' wasn't in the first child that inner loop
            couldn't reach.

            When testing Qt on Mac, there was also a crash in RenderTextControl when the font
            family was empty, this patch fixes it as well.

            * editing/ApplyStyleCommand.cpp:
            (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode): Use NodeVector
            instead of relying on first/last child being valid after
            removeInlineStyleFromElement() is called. Skip the child if it has no parent,
            this is an indication that it was removed from the tree.

            * rendering/RenderTextControl.cpp:
            (WebCore::RenderTextControl::hasValidAvgCharWidth): Empty AtomicStrings aren't
            supported by HashSet, so we have to early return in this case.

2013-04-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138654

    2013-01-02  Douglas Stockwell  <dstockwell@chromium.org>

            Crash in WebCore::InlineBox::deleteLine
            https://bugs.webkit.org/show_bug.cgi?id=93448

            Reviewed by Eric Seidel.

            When we ran off the end of the line while looking for line breaks in an
            inline with white-space:nowrap nested in a block with white-space:pre
            it was possible for the line break to be set at or before the current
            position -- this could result in duplications in the render tree or
            infinite looping.

            This patch changes the "fixup" logic that runs after we have finished
            iterating through elements and text and have potentially found a break
            point. In the case of a block setting white-space:pre we would back up
            a character in some cases. Not doing so could leave whitespace that
            should have been collapsed at the end of an inline.

            For example in '<span style="white-space:nowrap">x_</span>_y' if a
            break was inserted before 'y' the space after 'x' would still be
            rendered (rather than be collapsed with the break).

            To avoid this problem we will not take the opportunity to break until
            we have finished collapsing whitespace.

            Tests: fast/text/whitespace/inline-whitespace-wrapping-1.html
                   fast/text/whitespace/inline-whitespace-wrapping-2.html
                   fast/text/whitespace/inline-whitespace-wrapping-3.html
                   fast/text/whitespace/inline-whitespace-wrapping-4.html
                   fast/text/whitespace/nowrap-white-space-collapse.html
                   fast/text/whitespace/pre-block-normal-inline-crash-1.html
                   fast/text/whitespace/pre-block-normal-inline-crash-2.html

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::RenderBlock::LineBreaker::nextLineBreak): Collapse
            whitespace before breaking. Avoid setting the break before the current
            position.

2013-04-11  Lucas Forschler  <lforschler@apple.com>

        Merge r136554

    2012-12-04  Julien Chaffraix  <jchaffraix@webkit.org>

            Heap-use-after-free in WebCore::RenderLayer::paintList [MathML]
            https://bugs.webkit.org/show_bug.cgi?id=100764

            Reviewed by Eric Seidel.

            Test: mathml/mfenced-root-layer.html

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::stackingContext):
            Fixed this function to ensure that it always returns a stacking context, the bug
            was that the document element's layer wasn't guaranteed to be a stacking context.

2013-04-10  Lucas Forschler  <lforschler@apple.com>

        Merge r136250

    2012-11-30  Florin Malita  <fmalita@chromium.org>

            SVG pattern data deleted while in use
            https://bugs.webkit.org/show_bug.cgi?id=103415

            Reviewed by Dirk Schulze.

            Various calls in RenderSVGResourcePattern::applyResource() can trigger invalidations,
            which may end up deleting our current pattern data (via removeAllClientsFromCache).
            To avoid this, we should add the pattern data to the cache only after it is fully built.
            For clarity, the patch also refactors the pattern setup code into a separate method.

            Test: svg/custom/large-image-pattern-crash.html

            * rendering/svg/RenderSVGResourcePattern.cpp:
            (WebCore::RenderSVGResourcePattern::buildPattern):
            (WebCore::RenderSVGResourcePattern::applyResource):
            * rendering/svg/RenderSVGResourcePattern.h:
            (RenderSVGResourcePattern):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r136062

    2012-11-28  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::EventHandler::handleMousePressEvent
            https://bugs.webkit.org/show_bug.cgi?id=101098

            Reviewed by Adam Barth.

            |subframe| can be blown away inside passMousePressEventToSubframe
            call. Use RefPtr to protect it in handleMousePressEvent function.
            We use similar approach in handleMouseMoveEvent function.

            No new tests. Test is extremely time dependent and needs to trigger
            interaction gesture. Reproduced on ClusterFuzz.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::handleMousePressEvent):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r132970

    2012-10-30  Chris Evans  <cevans@google.com>

            Improve performance of MaskPtr.
            https://bugs.webkit.org/show_bug.cgi?id=100790

            Reviewed by Eric Seidel.

            Calculate the mask once, and store it as a fast-access member variable.
            Also avoid unneccessary integer width expansion in index calculation.
            Parser/tiny-innerHTML.html has a high stddev.
            Best result I've seen pre-patch is 5.70 runs/s.
            Best result I've seen post-patch is 5.72 runs/s, but this is not statistically significant.
            MaskPtr is still showing as ~2% in the profile, so we're not sure we trust the profile symbolization at this time.
            MaskPtr is now reduced to a single inline instruction (was: 4) so this seems like a strict improvement worth landing.

            * rendering/RenderArena.cpp:
            (MaskPtr): Use a passed-in mask for the mask operation.
            (WebCore::RenderArena::RenderArena): Calculate the mask and store it.
            (WebCore::RenderArena::allocate):
            (WebCore::RenderArena::free): Use stored mask and avoid unneccessary casts.
            * rendering/RenderArena.h:
            (RenderArena): Store the freelist mask as a member variable.

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r132724

    2012-10-26  Philip Rogers  <pdr@google.com>

            Prevent NaN offset values in ElementTimeControl.
            https://bugs.webkit.org/show_bug.cgi?id=100322

            Reviewed by Abhishek Arya.

            NaN values can cause ElementTimeControl to go back in time!
            If a value of NaN is passed to ElementTimeControl::beginElementAt(offset),
            subsequent sorting will cause an assert in SVGSMILElement::findInstanceTime
            because NaN values are not properly sorted. NaN SMILTime values
            should not be allowed at all, so this patch adds a check for them in
            ElementTimeControl's setters.

            This patch also adds preventative asserts to catch if SMILTime is ever
            initialized with NaN, or if addEndTime/addBeginTime are ever called
            with NaN values.

            Test: svg/custom/elementTimeControl-nan-crash.html

            * svg/SVGAnimationElement.cpp:
            (WebCore::SVGAnimationElement::beginElementAt):
            (WebCore::SVGAnimationElement::endElementAt):
            * svg/animation/SMILTime.h:
            (WebCore::SMILTime::SMILTime):
            * svg/animation/SVGSMILElement.cpp:
            (WebCore::SVGSMILElement::addBeginTime):
            (WebCore::SVGSMILElement::addEndTime):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r132511

    2012-10-25  Tom Sepez  <tsepez@chromium.org>

            XSSAuditor must replace form action with about:blank when reflected action detected.
            https://bugs.webkit.org/show_bug.cgi?id=100280

            Reviewed by Daniel Bates.

            Changes empty string form-action replacement to about:blank.
            Existing form-action.html test modified to check this case.

            * html/parser/XSSAuditor.cpp:
            (WebCore::XSSAuditor::filterFormToken):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r132287

    2012-10-23  Nate Chapin  <japhet@chromium.org>

            Crash in WebCore::SubresourceLoader::willSendRequest.
            https://bugs.webkit.org/show_bug.cgi?id=100147

            Reviewed by Abhishek Arya.

            No new tests. There is a test case that should cover this, but it doesn't
            work correctly on many platforms due to its use of testRunner.addURLToRedirect().
            See http/tests/loading/cross-origin-XHR-willLoadRequest.html.
            Tested manually on http://www.nick.co.uk/shows/spongebob

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::willSendRequest):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r131709

    2012-10-18  MORITA Hajime  <morrita@google.com>

            Assertion failure at TreeScopeAdopter::moveNodeToNewDocument()
            https://bugs.webkit.org/show_bug.cgi?id=99510

            Reviewed by Kent Tamura.

            Shadow DOM notification call didn't have checks for mutation detection.
            This change adds such checks.

            Test: fast/forms/textarea/textarea-autofocus-removal-while-focusing-with-style.html

            * dom/ContainerNodeAlgorithms.cpp:
            (WebCore::ChildNodeInsertionNotifier::notifyDescendantInsertedIntoDocument):
            (WebCore::ChildNodeRemovalNotifier::notifyDescendantRemovedFromDocument):

2013-03-15  Lucas Forschler  <lforschler@apple.com>

        Merge r130999

    2012-10-10  Stephen Chenney  <schenney@chromium.org>

            SVGTextRunRenderingContext changes font data in the glyph page, but it shouldn't
            https://bugs.webkit.org/show_bug.cgi?id=98755

            Reviewed by Eric Seidel.

            The code in SVGTextRunRenderingContext::glyphDataForCharacter, when it
            encounters an <altglyph> tag, immediately replaces the font data for a
            glyph with font data for the primary font, presumably to meet the SVG
            spec requirement: "If the references to alternate glyphs do not result
            in successful identification of alternate glyphs to use, then the
            character(s) that are inside of the altGlyph element are rendered as
            if the altGlyph element were a tspan element instead."

            If the alt glyph is not then found we are in the case from the spec
            and indeed we should use the primary font. However, we end up replacing the GlyphPage
            entry for the character with primary font data, which we should not do
            because the glyph page might be used in some place that does not have
            the alt glyph tag.

            Furthermore, this causes object lifetime problems for font data, because
            in cases where the font data that is replaced is for the system fallback
            font the GlyphPage will live forever with no knowldege that it contains
            font data pointers into font data other that the system fallback. The
            replaced font data may be deleted while the pointer lives on in the
            system fallback page.

            The fix is simply not to replace the font data in the page.

            Test: svg/text/alt-glpyh-on-fallback-font-crash.html

            * rendering/svg/SVGTextRunRenderingContext.cpp:
            (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter): Keep track of the original font data and put it back
            in the glyph page when the method has finished.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r142657

    2013-02-12  Levi Weintraub  <leviw@chromium.org>

            ASSERTION FAILED: !object || object->isBox(), UNKNOWN in WebCore::RenderListItem::positionListMarker
            https://bugs.webkit.org/show_bug.cgi?id=108699

            Reviewed by Abhishek Arya.

            RenderListItems performs special management of its children to maintain list markers. Splitting a flow
            through a list item results in assumptions made inside RenderListItem failing, so for now, avoid splitting
            flows when inside one.

            Test: fast/multicol/span/list-multi-column-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::containingColumnsBlock):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140558

    2013-01-17  Roger Fong  <roger_fong@apple.com>

            [Win] Remove dependence on Microsoft Embedded OpenType Font Engine (T2EMBED.DLL)  from FontCustomPlatformData.cpp.
            https://bugs.webkit.org/show_bug.cgi?id=107153

            Reviewed by Dan Bernstein.

            * platform/graphics/win/FontCustomPlatformData.cpp:
            (WebCore):
            (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
            (WebCore::FontCustomPlatformData::fontPlatformData):
            (WebCore::createFontCustomPlatformData):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r142539

    2013-02-11  Emil A Eklund  <eae@chromium.org>

            Change RenderFrameSet::paint to use m-rows/m_cols directly.
            https://bugs.webkit.org/show_bug.cgi?id=108503

            Reviewed by Eric Seidel.

            Test: fast/frames/invalid-frameset.html

            * rendering/RenderFrameSet.cpp:
            (WebCore::RenderFrameSet::paint):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r142365

    2013-02-09  Philip Rogers  <pdr@google.com>

            Sanitize m_keyTimes for paced value animations
            https://bugs.webkit.org/show_bug.cgi?id=108828

            Reviewed by Dirk Schulze.

            SVG animations with calcMode=paced calculate new m_keyTimes in
            SVGAnimationElement::calculateKeyTimesForCalcModePaced() because paced animations do not
            specify keyTimes. If an error occurs while calculating m_keyTimes, and there exists
            user-specified values, a crash could occur because the user-specified values were not
            sanitized.

            This change clears user-specified keyTimes before calculating new ones.

            Test: svg/animations/animate-keytimes-crash.html

            * svg/SVGAnimationElement.cpp:
            (WebCore::SVGAnimationElement::calculateKeyTimesForCalcModePaced):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r142358

    2013-02-09  Kent Tamura  <tkent@chromium.org>

            Fix crash by img[ismap] with content property
            https://bugs.webkit.org/show_bug.cgi?id=108702

            Reviewed by Adam Barth.

            Test: fast/dom/HTMLAnchorElement/anchor-ismap-crash.html

            * html/HTMLAnchorElement.cpp:
            (WebCore::appendServerMapMousePosition):
            Check if the renderer of an img element is RenderImage.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r141858

    2013-02-04  Kent Tamura  <tkent@chromium.org>

            Fix crash by <select> type change on focus
            https://bugs.webkit.org/show_bug.cgi?id=108830

            Reviewed by Abhishek Arya.

            Test: fast/forms/select/select-change-type-on-focus.html

            * html/HTMLSelectElement.cpp:
            (WebCore::HTMLSelectElement::menuListDefaultEventHandler):
            focus() calls may change the renderer type.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r141851

    2013-02-04  Wei James  <james.wei@intel.com>

            Heap-buffer-overflow in WebCore::AudioBufferSourceNode::process
            https://bugs.webkit.org/show_bug.cgi?id=108515

            After calling setBuffer() with a buffer having a different number of
            channels, there can in rare cases be a slight delay before the output
            bus is updated to the new number of channels because of use of
            tryLocks() in the context's updating system.
            In this case, if the the buffer has just been changed and we're
            not quite ready yet then just output silence.

            Reviewed by Chris Rogers.

            * Modules/webaudio/AudioBufferSourceNode.cpp:
            (WebCore::AudioBufferSourceNode::process):
            (WebCore::AudioBufferSourceNode::renderFromBuffer):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140879

    2013-01-25  Raymond Toy  <rtoy@google.com>

            Don't subtract too much from nonSilentFramesToProcess
            https://bugs.webkit.org/show_bug.cgi?id=107966

            Reviewed by Kenneth Russell.

            No new tests.

            * Modules/webaudio/AudioScheduledSourceNode.cpp:
            (WebCore::AudioScheduledSourceNode::updateSchedulingInfo):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140520

    2013-01-23  Hajime Morrita  <morrita@google.com>

            Invalidated SVG shadow tree should be always detached.
            https://bugs.webkit.org/show_bug.cgi?id=107634

            Reviewed by Ryosuke Niwa.

            SVGUseElement::clearResourceReferences() uses removeAllChildren() for
            clearing its shadow DOM, but this is wrong.
            removeAllChildren() is designed for removing children of an out-of-document Node.
            For efficiency, it skips a series of cleanup sequences like detach().

            For removing SVG shadow tree which is in Document, removeChildren() should be used.
            It does proper cleanup for the chilren.

            Test: svg/custom/use-invalidate-click-crash.xhtml

            * svg/SVGUseElement.cpp:
            (WebCore::SVGUseElement::clearResourceReferences):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140101

    2013-01-17  Rafael Weinstein  <rafaelw@chromium.org>

            Ensure the parser adopts foster-parented children into the document of their parent.
            https://bugs.webkit.org/show_bug.cgi?id=107023

            Reviewed by Adam Barth.

            Tests: fast/parser/foster-parent-adopted.html
                   fast/parser/foster-parent-adopted2.html

            * html/parser/HTMLConstructionSite.cpp:
            (WebCore::HTMLConstructionSite::insertTextNode):
            (WebCore::HTMLConstructionSite::fosterParent):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r140069

    2013-01-17  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::RenderBlock::checkFloatsInCleanLine
            https://bugs.webkit.org/show_bug.cgi?id=90802

            Reviewed by Julien Chaffraix.

            Test: fast/multicol/float-not-removed-crash.html

            * rendering/RenderBoxModelObject.cpp:
            (WebCore::RenderBoxModelObject::moveChildrenTo):
            1. When fullRemoveInsert is True, make sure to clear the
            floating objects from our list (similar to positioned objects).
            Our children are getting moved to another block and we won't
            get notified when they are going away.
            2. Remove the redundant hasPositionedObjects check since it
            is already done inside removePositionedObjects.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r139788

    2013-01-15  Elliott Sprehn  <esprehn@chromium.org>

            Heap-use-after-free in WebCore::RenderObject::willBeRemovedFromTree
            https://bugs.webkit.org/show_bug.cgi?id=106384

            Reviewed by Abhishek Arya.

            Always walk up from beforeChild until the parent() is the owner of the
            child list, otherwise we can end up in situations where
            newChild->parent() == owner but newChild->nextSibling()->parent() != owner
            which is a recipe for security bugs. Previously we only walked up through
            anonymous blocks, but missed anonymous inline blocks like those generated
            by <ruby>.

            Test: fast/css-generated-content/bug-106384.html

            * rendering/RenderObjectChildList.cpp:
            (WebCore::RenderObjectChildList::insertChildNode):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r139551

    2013-01-12  Gavin Peters  <gavinp@chromium.org>

            Regression(r119759): Heap-use-after-free in webkit_glue::WebURLLoaderImpl::Context::OnReceivedResponse
            https://bugs.webkit.org/show_bug.cgi?id=103563

            A subresource could receive a body on a 404 if its call to CachedResource::error() resulted in a nested message loop.
            That caused a crash when data was received, as the Subresource was in the Finished state already. Now when receiving
            data we ignore these bodies, avoiding the crash.

            Reviewed by Nate Chapin.

            No new tests in WebKit, since it required a nested message loop which isn't present in chromium DumpRender tree.
            There's a Chrome side browser test, see https://codereview.chromium.org/11778083/

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::checkForHTTPStatusCodeError):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r139457

    2013-01-11  Florin Malita  <fmalita@chromium.org>

            [SVG] Suppress resource rebuilding for unattached and shadow elements
            https://bugs.webkit.org/show_bug.cgi?id=106664

            Reviewed by Dirk Schulze.

            SVGStyledElement::buildPendingResourcesIfNeeded() can be called while cloning a subtree
            (as nodes are inserted into the clone, while still detached) or when elements are inserted
            into the shadow tree. Both of these cases are problematic for SVGUseElement and can trigger
            indirect recursion in SVGUseElement::buildPendingResource.

            Since shadow and !inDocument() nodes are of no interest to ID dependents (they cannot be
            found by ID in the document), the patch short-circuits buildPendingResource() for these
            cases.

            Test: svg/custom/use-rebuild-resources-crash.svg

            * svg/SVGStyledElement.cpp:
            (WebCore::SVGStyledElement::buildPendingResourcesIfNeeded):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138994

    2013-01-07  Justin Novosad  <junov@google.com>

            Fixing memory read after free in CanvasRenderingContext2D::accessFont
            https://bugs.webkit.org/show_bug.cgi?id=106244

            Reviewed by Abhishek Arya.

            Using a temporary String object to hold ref count on string that is
            passed by reference in CanvasRenderingContext2D::accessFont.

            Test: fast/canvas/canvas-measureText.html

            * html/canvas/CanvasRenderingContext2D.cpp:
            (WebCore::CanvasRenderingContext2D::accessFont):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138926

    2013-01-06  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in DocumentLoader::stopLoading
            https://bugs.webkit.org/show_bug.cgi?id=103656

            Reviewed by Eric Seidel.

            Test: fast/dom/ready-state-change-crash.html

            * html/parser/HTMLDocumentParser.cpp:
            (WebCore::HTMLDocumentParser::prepareToStopParsing): Bail out
            if the parser is detached due to mutation event.
            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::stopLoading): Move the protectors for
            frame and document loader to the start of the function. Call to
            m_frame->loader()->stopLoading() can change document ready state
            and fire mutation event which might blow the document loader from
            underneath.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138918

    2013-01-06  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::Document::implicitClose
            https://bugs.webkit.org/show_bug.cgi?id=105655

            Reviewed by Eric Seidel.

            Test: fast/dom/window-load-crash.html

            * dom/Document.cpp:
            (WebCore::Document::implicitClose): RefPtr protect |this| document since it
            can be destroyed in the dispatchWindowLoadEvent call.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138863

    2013-01-04  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::XMLDocumentParser::doEnd
            https://bugs.webkit.org/show_bug.cgi?id=100152

            Reviewed by Adam Barth.

            XMLDocumentParser can be blown away inside document()->styleResolverChanged()
            call. Protect it with a local RefPtr in Document::explitClose.    

            No new tests. The site specific dependencies are hard to minimize.

            * dom/Document.cpp:
            (WebCore::Document::explicitClose): RefPtr m_parser into a local, since
            it can be detached and nulled out in DocumentWriter::end().
            * xml/parser/XMLDocumentParser.cpp:
            (WebCore::XMLDocumentParser::end): Bail out when we are detached.
            * xml/parser/XMLDocumentParserLibxml2.cpp:
            (WebCore::XMLDocumentParser::doEnd): Bail out when we are detached.
            * xml/parser/XMLDocumentParserQt.cpp:
            (WebCore::XMLDocumentParser::doEnd): Bail out when we are detached.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138850

    2013-01-04  Abhishek Arya  <inferno@chromium.org>

            Crash in WebCore::RenderBlock::willBeDestroyed
            https://bugs.webkit.org/show_bug.cgi?id=103455

            Reviewed by Eric Seidel.

            It is not required to set beforeChild to :after child since DOM is
            now pseudo element aware. See trac.webkit.org/changeset/137336. We
            were incorrectly placing the inline continuation before the :after
            content.       

            Test: fast/multicol/continuation-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): remove beforeChild
            setting to afterPseudoElementRenderer.
            * rendering/RenderRuby.cpp:
            (WebCore::RenderRubyAsInline::addChild): add missing beforeChild argument.
            setting to afterPseudoElementRenderer.
            (WebCore::RenderRubyAsBlock::addChild): add missing beforeChild argument.
            * rendering/RenderTable.cpp:
            (WebCore::RenderTable::addChild): remove beforeChild
            setting to afterPseudoElementRenderer.
            * rendering/RenderTableRow.cpp:
            (WebCore::RenderTableRow::addChild): remove beforeChild
            setting to afterPseudoElementRenderer.
            * rendering/RenderTableSection.cpp:
            (WebCore::RenderTableSection::addChild): remove beforeChild
            setting to afterPseudoElementRenderer.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138812

    2013-01-04  John Mellor  <johnme@chromium.org>

            Early out from FontCache::releaseFontData if cached font data not found.
            https://bugs.webkit.org/show_bug.cgi?id=106104

            Reviewed by Abhishek Arya.

            No tests, as no change in behavior.

            * platform/graphics/FontCache.cpp:
            (WebCore::FontCache::releaseFontData):

                Early out in release builds if cached font data not found.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138657

    2013-01-02  Abhishek Arya  <inferno@chromium.org>

            Crash in WebCore::Element::cloneElementWithoutChildren.
            https://bugs.webkit.org/show_bug.cgi?id=105949

            Reviewed by Ryosuke Niwa.

            RefPtr |ancestors| vector since its elements can be destroyed from mutation events
            fired in CompositeEditCommand::appendNode. 

            No new tests. The testcase relies on recursive DOM mutations and does not minimize.

            * editing/InsertParagraphSeparatorCommand.cpp:
            (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock):
            (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock):
            (WebCore::InsertParagraphSeparatorCommand::doApply):
            * editing/InsertParagraphSeparatorCommand.h:
            (InsertParagraphSeparatorCommand):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r138316

    2012-12-20  Stephen Chenney  <schenney@chromium.org>

            SVG: <altglpyh> for a surrogate pair character in a ligature fails
            https://bugs.webkit.org/show_bug.cgi?id=102969

            Reviewed by Dirk Schulze.

            There are two issues with SVG <altglyph> tags applied to surrogate
            fonts, particularly when mixed with non-standard forms (arabic,
            vertical, etc.).

            First, there is an assertion that is invalid when an alt glyph is
            substituted for the surrogate, because the text chunk that is consumed
            by an alt glyph is the entire run, whereas we assert that a
            surrogate's chunk is length 2 regardless. That assertion has been
            removed.

            Second, when an arabic character or some other characters requiring a
            special form appears before the surrogate pair character inside the alt
            glyph tag, we reject the alt glyph because it is not compatible with the form.
            However, when we process the next character - the surrogate pair - we
            do accept the alt glyph. This breaks all the indexes because we have
            already consumed part of the run that is now considered the alt glyph.
            Chaos ensues. This patch forces us to always accept alt glyph
            characters (assuming we have some glyph to draw). This better matches
            the intent of the spec - if someone specifies an alt glyph they are
            explicitly stating which glyph they want used. We should not argue
            with the content author.

            Tests: svg/text/alt-glyph-for-surrogate-pair-expected.svg
                   svg/text/alt-glyph-for-surrogate-pair.svg

            * rendering/svg/SVGTextLayoutEngine.cpp:
            (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath): Fix some poor code.
            * rendering/svg/SVGTextMetricsBuilder.cpp:
            (WebCore::SVGTextMetricsBuilder::advanceSimpleText): Remove an assert that is not always valid.
            * svg/SVGFontData.cpp:
            (WebCore::SVGFontData::applySVGGlyphSelection): Always return an altGlyph when found. Do not check it compatibility.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r137464

    2012-12-12  Alexander Pavlov  <apavlov@chromium.org>

            Web Inspector: [Crash] Clear cached stylesheet rules in InspectorStyleSheet::deleteRule()
            https://bugs.webkit.org/show_bug.cgi?id=104806

            Reviewed by Vsevolod Vlasov.

            Cached rules (m_flatRules) should get cleared whenever a rule is deleted.

            Test: inspector/styles/undo-add-rule-crash.html

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::deleteRule):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136560

    2012-12-04  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
            https://bugs.webkit.org/show_bug.cgi?id=100621

            Reviewed by Eric Seidel.

            r115639 fixed a memory leak caused by reference cycle between StyleCachedImageSet
            and its owner CSSImageSetValue. The fix caused StyleCachedImageSet to maintain
            a weak pointer to CSSImageSetValue. This patch makes sure that the weak pointer
            is cleared when CSSImageSetValue is going away.

            Test: fast/css/image-set-value-not-removed-crash.html

            * css/CSSImageSetValue.cpp:
            (WebCore::CSSImageSetValue::~CSSImageSetValue):
            * rendering/style/StyleCachedImageSet.h:
            (WebCore::StyleCachedImageSet::clearImageSetValue):
            (StyleCachedImageSet):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136558

    2012-12-04  Abhishek Arya  <inferno@chromium.org>

            Crash in CachedResource::checkNotify due to -webkit-crossfade.
            https://bugs.webkit.org/show_bug.cgi?id=98068

            Reviewed by Nate Chapin.

            Make sure to not re-add the same client again for |m_cachedFromImage|
            and |m_cachedToImage|. This would otherwise cause the CSSCrossfadeValue
            client to not get removed from its cached image resource (when it is
            going away).

            Test: fast/images/crossfade-client-not-removed-crash.html

            * css/CSSCrossfadeValue.cpp:
            (WebCore::CSSCrossfadeValue::loadSubimages):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136541

    2012-12-04  Florin Malita  <fmalita@chromium.org>

            Stale SVGUseElement reference in CachedResource::checkNotify()
            https://bugs.webkit.org/show_bug.cgi?id=104004

            Reviewed by Eric Seidel.

            SVGUseElement tracks one CachedSVGDocument at a time (for external references), but when
            the href attribute is updated it fails to unregister with the current CachedSVGDocument
            and only updates its CachedSVGDocument with the new instance. This leaves an untracked
            reference with the original CachedSVGDocument.

            The patch adds the missing removeClient() call on href change, and encapsulates the
            CachedSVGDocument manipulation in a helper method which handles the necessary cleanup.

            Test: svg/custom/use-href-update-crash.svg

            * svg/SVGUseElement.cpp:
            (WebCore::SVGUseElement::~SVGUseElement):
            (WebCore::SVGUseElement::svgAttributeChanged):
            (WebCore::SVGUseElement::setCachedDocument):
            (WebCore):
            * svg/SVGUseElement.h:
            (SVGUseElement):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136253

    2012-11-30  Abhishek Arya  <inferno@chromium.org>

            Crash due to intruding float not removed after writing mode changed.
            https://bugs.webkit.org/show_bug.cgi?id=100149

            Reviewed by Levi Weintraub.

            When RenderView writing mode changes, make sure to mark all descendants
            with floats for layout.

            Test: fast/block/float/intruding-float-not-removed-writing-mode.xhtml

            * rendering/RenderBox.cpp:
            (WebCore::RenderBox::styleDidChange):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136074

    2012-11-28  Kenichi Ishibashi  <bashi@chromium.org>

            StyleResolver should not set NaN to font size
            https://bugs.webkit.org/show_bug.cgi?id=99506

            Reviewed by Abhishek Arya.

            fixedScaleFactor could be NaN since settings->defaultFixedFontSize()
            and settings->defaultFontSize() are zero in some case. This turns
            out setting NaN to font size. Add a zero checks so that
            fixedScaleFactor won't be NaN.

            Test: fast/css/font-size-nan.html

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::checkForGenericFamilyChange):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136061

    2012-11-28  Tom Sepez  <tsepez@chromium.org>

            XSSAuditor bypass with script src=data: URL ending in <!--
            https://bugs.webkit.org/show_bug.cgi?id=103548

            Reviewed by Adam Barth.

            This fixes an additional case where characters from the page itself are
            included with the snippet to match against the reflected vector, and the
            JS remains legitimate because of a <!--- comment. Truncate the snippet at
            such a comment.

            Test: http/tests/security/xssAuditor/script-tag-with-source-data-url3.html

            * html/parser/XSSAuditor.cpp:
            (WebCore::XSSAuditor::decodedSnippetForAttribute):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r136060

    2012-11-28  Abhishek Arya  <inferno@chromium.org>

            Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
            https://bugs.webkit.org/show_bug.cgi?id=101970

            Reviewed by David Hyatt.

            RenderInline::splitFlow and RenderBlock::splitFlow re-use |pre|
            block in some cases. In those cases, |pre| might hold floating objects
            and those floating descendants might get moved to |post| block. If
            the |pre| block does not get a layout later, then the floating
            descendant will never get removed since it is now part of |post|
            ancestor chain. We don't want failing-to-layout bugs turned into
            security bugs and hence clear floating objects list since we expect
            it to be rebuilt in subsequent layout.

            Test: fast/block/float/float-not-removed-from-pre-block.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::splitFlow): Call removeFloatingObjects on |pre| block.
            (WebCore::RenderBlock::removeFloatingObjects): Clear all floating objects from our list.
            (WebCore):
            * rendering/RenderBlock.h: 
            (RenderBlock):
            * rendering/RenderInline.cpp:
            (WebCore::RenderInline::splitFlow): Call removeFloatingObjects on |pre| block.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135719

    2012-11-26  Florin Malita  <fmalita@chromium.org>

            RenderSVGResourceContainer does not clear cached data on removal
            https://bugs.webkit.org/show_bug.cgi?id=102620

            Reviewed by Dirk Schulze.

            RenderSVGResourceContainer::removeClient needs to also remove the client from specialized
            caches, otherwise we can end up with stale references.

            Test: svg/custom/stale-resource-data-crash.svg

            * rendering/svg/RenderSVGResourceContainer.cpp:
            (WebCore::RenderSVGResourceContainer::removeClient):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135478

    2012-11-21  Cosmin Truta  <ctruta@rim.com>

            Numeric identifiers of events should not be globally sequential
            https://bugs.webkit.org/show_bug.cgi?id=102244

            Reviewed by Alexey Proskuryakov.

            The functions setTimeout, setInterval and navigator.geolocation.watchPosition
            are currently returning values that are unique across all JavaScript execution
            contexts, due to their dependency on global variables.
            Such a guarantee is unnecessarily strong. In this patch, we constrain uniqueness
            to these functions' own script execution context only.

            Tests: fast/dom/Geolocation/watchPosition-unique.html
                   fast/dom/Window/setTimeout-setInterval-unique.html

            * Modules/geolocation/Geolocation.cpp:
            (WebCore): Remove firstAvailableWatchId.
            (WebCore::Geolocation::watchPosition): Get new watchID from script execution context.
            (WebCore::Geolocation::clearWatch): Invalid watchID means less than or equal to 0.
            * Modules/geolocation/Geolocation.h:
            (Geolocation): Renamed the argument of Geolocation::clearWatch to WatchID.
            * dom/ScriptExecutionContext.cpp:
            (WebCore::ScriptExecutionContext::ScriptExecutionContext): Update initialization.
            (WebCore::ScriptExecutionContext::newUniqueID): Add.
            * dom/ScriptExecutionContext.h:
            (ScriptExecutionContext): Add m_sequentialID.
            (WebCore::ScriptExecutionContext::addTimeout): Inline.
            (WebCore::ScriptExecutionContext::removeTimeout): Inline.
            (WebCore::ScriptExecutionContext::findTimeout): Inline.
            * page/DOMTimer.cpp:
            (WebCore): Remove timeoutId.
            (WebCore::DOMTimer::DOMTimer): Get new timeoutId from script execution context.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135303

    2012-11-20  Abhishek Arya  <inferno@chromium.org>

            Crash in FrameLoader::stopLoading.
            https://bugs.webkit.org/show_bug.cgi?id=99504

            Reviewed by Nate Chapin.

            Frame can be blown away in unload event handler. Need
            to protect it with a RefPtr.

            Test: fast/frames/frame-unload-crash2.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::commitProvisionalLoad):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135299

    2012-11-20  Tom Sepez  <tsepez@chromium.org>

            XSSAuditor::decodedSnippetForJavaScript stopping when comma encountered.
            https://bugs.webkit.org/show_bug.cgi?id=102587

            Reviewed by Adam Barth.

            Rather than returning an empty fragment, continue processing the body
            of a script tag when the decoded fragment reduces to nothing.

            Test: http/tests/security/xssAuditor/script-tag-with-actual-comma.html

            * html/parser/XSSAuditor.cpp:
            (WebCore::XSSAuditor::decodedSnippetForJavaScript):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r135193

    2012-11-19  Abhishek Arya  <inferno@chromium.org>

            Crash in ApplyStyleCommand::cleanupUnstyledAppleStyleSpans.
            https://bugs.webkit.org/show_bug.cgi?id=100150

            Reviewed by Ryosuke Niwa.

            RefPtr startDummySpanAncestor and endDummySpanAncestor since
            they can go away inside fixRangeAndApplyInlineStyle call.

            Test: editing/style/apply-style-crash.html

            * editing/ApplyStyleCommand.cpp:
            (WebCore::ApplyStyleCommand::applyInlineStyle):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r133717

    2012-11-06  Ken Buchanan  <kenrb@chromium.org>

            Crash due to column span under button element
            https://bugs.webkit.org/show_bug.cgi?id=101402

            Reviewed by Abhishek Arya.

            When there is a column-spanning child of a RenderButton
            splitBlocks() must split the RenderButton as well as its
            only permitted direct child, the anonymous block referenced
            by m_inner. A crash was occurring because splitBlocks()
            calls addChildIgnoringAnonymousColumnBlocks() to add the
            cloned m_inner to the cloned RenderButton, which meant the
            m_inner for the cloned RenderButton was not being set even
            though a child was being added. This violates state
            assumptions in the RenderButton code.

            This patch prevents any descendants of RenderButton from
            spanning columns. Also, it adds a precautionary check in
            RenderButton::removeChild() to mitigate problems if similar
            state problems are found in future.

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::containingColumnsBlock):
            * rendering/RenderButton.cpp:
            (WebCore::RenderButton::removeChild):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r133686

    2012-11-06  Simon Fraser  <simon.fraser@apple.com>

            -webkit-background-clip:text produces artifacts when applied to the body and the browser is resized
            https://bugs.webkit.org/show_bug.cgi?id=89287

            Reviewed by Beth Dakin.

            If the body had -webkit-background-clip: text, we'd fail to paint
            anything behind it, so would see garbage pixels.

            Fix by having RenderView::paintBoxDecorations() check for a background-clip of "text"
            on the renderer that paints the root background.

            Added some new pixel tests for combinations of html and body transform
            and backgrounds; earlier versions of the patch broke some of these tests.

            Tests: fast/backgrounds/background-clip-text-on-body.html
                   fast/backgrounds/transformed-body-background.html
                   fast/backgrounds/transformed-body-html-background.html
                   fast/backgrounds/transformed-html-body-background.html

            * rendering/RenderView.cpp:
            (WebCore::rendererObscuresBackground): Broke up the single condition
            into early 'false' returns when possible. We need to also check whether
            the renderer that actually paints the background (which might be the body)
            will fill it; background-clip: text does not.
            (WebCore::RenderView::paintBoxDecorations): Rather than checking firstChild(),
            actually check the root renderer, so that we can reliably get to the renderer
            that mains the root background.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r133155

    2012-11-01  Stephen Chenney  <schenney@chromium.org>

            SVG as an image may recreate the renderer on zoom
            https://bugs.webkit.org/show_bug.cgi?id=99508

            Reviewed by Abhishek Arya.

            The SVGImage code, when SVG is used in <img> tags, caches the renderer
            at the start of the painting method and re-uses the pointer at the end
            of the method. However, when the page is zoomed the renderer may be
            detached mid-method, thus leaving a stray pointer. The fix is to
            re-fetch the pointer after the zooms.

            Test: svg/as-image/img-zoom-svg-stylesheet.html

            * svg/graphics/SVGImage.cpp:
            (WebCore::SVGImage::drawSVGToImageBuffer): Re-fetch the renderer after
            the zoom operations.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r132983

    2012-10-30  Kent Tamura  <tkent@chromium.org>

            Delaying 'change' and 'input' event dispatching during HTMLInputElement::setValue
            https://bugs.webkit.org/show_bug.cgi?id=100772

            Reviewed by Abhishek Arya.

            'change' and 'input' events are asynchronous and not
            cancelable. We can use ScopedEvent.

            Test: fast/forms/range/range-type-change-onchange.html

            * dom/Node.cpp:
            (WebCore::Node::dispatchChangeEvent): Use dispatchScopedEvent.
            (WebCore::Node::dispatchInputEvent): Ditto.
            * html/HTMLInputElement.cpp:
            (WebCore::HTMLInputElement::setValue):
            Make a scope to delay event dispatching.
            * html/RangeInputType.cpp:
            (WebCore::RangeInputType::handleKeydownEvent): Ditto.

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r132462

    2012-10-25  Alexander Pavlov  <apavlov@chromium.org>

            Web Inspector: Improper out-of-order call on a rule that is being removed from the stylesheet.
            https://bugs.webkit.org/show_bug.cgi?id=100357

            Reviewed by Vsevolod Vlasov.

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::deleteRule):

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r132398

    2012-10-24  Ami Fischman  <fischman@chromium.org>

            call to setNeedsLayout during RenderVideo::paintReplaced
            https://bugs.webkit.org/show_bug.cgi?id=100265

            Reviewed by Eric Carlson.

            Removed unnecessary call and added new defensive guards to catch erroneous setNeedsLayout() calls
            during paints earlier (so the offending calls are in the emitted stacktrace).

            No new tests - new defensive checks are triggered by existing tests.

            * page/FrameView.cpp:
            (WebCore::FrameView::paintContents): forbid setNeedsLayout() during painting
            * rendering/RenderObject.cpp:
            (WebCore):
            (WebCore::RenderObject::SetLayoutNeededForbiddenScope::SetLayoutNeededForbiddenScope):
            (WebCore::RenderObject::SetLayoutNeededForbiddenScope::~SetLayoutNeededForbiddenScope):
            * rendering/RenderObject.h:
            (RenderObject):
            (SetLayoutNeededForbiddenScope): added helper class for forbidding setNeedsLayout() in a scope.
            * rendering/RenderVideo.cpp:
            (WebCore::RenderVideo::paintReplaced): drop the offending & unnecessary call to updatePlayer().

2013-03-12  Lucas Forschler  <lforschler@apple.com>

        Merge r131578

    2012-10-17  Alexander Pavlov  <apavlov@chromium.org>

            Web Inspector: Avoid style updates when retrieving the inline stylesheet text
            https://bugs.webkit.org/show_bug.cgi?id=99576

            Reviewed by Vsevolod Vlasov.

            Avoid using innerText() to retrieve inline stylesheet text, which may result in style and layout updates.

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::inlineStyleSheetText):

== Rolled over to ChangeLog-2013-03-12 ==
