Merge 120640 - [chromium] REGRESSION(r120346) ContentLayerPainter should clear rect to be painted

Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 120770)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,5 +1,662 @@
+2012-06-18  James Robinson  <jamesr@chromium.org>
+
+        [chromium] REGRESSION(r120346) ContentLayerPainter should clear rect to be painted
+        https://bugs.webkit.org/show_bug.cgi?id=89376
+
+        Reviewed by Adrienne Walker.
+
+        In r120346, a refactor moved a clearRect()/clip() call from ContentLayerPainter - which all
+        ContentLayerChromiums use - out to OpaqueRectTrackingContentLayerDelegate - which all GraphicsLayerChromium
+        backed layers use, but which callers using WebContentLayer directly do not use. This meant that the canvas
+        wasn't cleared/clipped as WebContentLayerClient.h claimed it would be. This moves the clear and the clip
+        into CanvasLayerTextureUpdater which all paths use, including layers that don't use the ContentLayerPainter.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerPainter::paint):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+
+2012-06-18  Igor Oliveira  <igor.o@sisa.samsung.com>
+
+        Unreviewed, rolling out r120119.
+        http://trac.webkit.org/changeset/120119
+
+        Multiple regressions on ClusterFuzz
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimations):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::cancelAnimations):
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::pauseAnimation):
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+        (WebCore::KeyframeAnimation::pauseAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetterStyle):
+        (WebCore::RenderBlock::createFirstLetterRenderer):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        (RenderObject):
+
+2012-06-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r118414): some pages on concursolutions.com doesn't show up
+        https://bugs.webkit.org/show_bug.cgi?id=89399
+
+        Reviewed by Adam Barth.
+
+        The bug was caused by insertAdjacentHTML's not passing context element to createFragmentForInnerOuterHTML.
+
+        Test: fast/html/adjacent-html-context-element.html
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::insertAdjacentHTML):
+
+2012-06-18  Zhenyao Mo  <zmo@google.com>
+
+        Fix framebuffer-object-attachment.html failures
+        https://bugs.webkit.org/show_bug.cgi?id=89387
+
+        Reviewed by Kenneth Russell.
+
+        * html/canvas/WebGLFramebuffer.cpp: fix detachment behavior with depth/stencil/depth_stencil conflicts
+        (WebCore::WebGLFramebuffer::setAttachmentForBoundFramebuffer):
+        (WebCore::WebGLFramebuffer::removeAttachmentFromBoundFramebuffer):
+        * html/canvas/WebGLFramebuffer.h:
+        (WebGLFramebuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer): move logic to WebGLFramebuffer
+        (WebCore::WebGLRenderingContext::framebufferTexture2D): Ditto.
+        (WebCore::WebGLRenderingContext::getParameter): Correct the wrong assumption that it's always checking the drawingbuffer's DEPTH_BITS/STENCIL_BITS
+        * html/canvas/WebGLRenderingContext.h:
+        (WebGLRenderingContext):
+
+2012-06-18  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure that skipping frames during an accelerated animation doesn't cause starvation
+        https://bugs.webkit.org/show_bug.cgi?id=87766
+
+        Reviewed by James Robinson.
+
+        Unit tests:
+            CCLayerTreeHostTestCheckerboardDoesNotStarveDraws.runMultiThread
+            CCSchedulerStateMachineTest.TestFailedDrawsWillEventuallyForceADrawAfterTheNextCommit
+
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::CCSchedulerStateMachine):
+        (WebCore::CCSchedulerStateMachine::updateState):
+        (WebCore::CCSchedulerStateMachine::didDrawIfPossibleCompleted):
+        (WebCore::CCSchedulerStateMachine::setMaximumNumberOfFailedDrawsBeforeDrawIsForced):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        (CCSchedulerStateMachine):
+
+2012-06-18  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Unbreak smooth scrolling.
+        https://bugs.webkit.org/show_bug.cgi?id=89327
+
+        Reviewed by Dimitri Glazkov.
+
+        Broken by Sam in r115589 / r115591.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::scrollAnimationEnabledForSystem):
+
 2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>
 
+        Unreviewed, rolling out r120541, r120547, and r120548.
+        http://trac.webkit.org/changeset/120541
+        http://trac.webkit.org/changeset/120547
+        http://trac.webkit.org/changeset/120548
+        https://bugs.webkit.org/show_bug.cgi?id=89383
+
+        This approach doesn't work for WebKit2 (Requested by abarth on
+        #webkit).
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::InternalSettings):
+        (WebCore::InternalSettings::restoreTo):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+
+2012-06-18  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] NetworkJob::startNewJobWithRequest() should check the frame pointer
+        https://bugs.webkit.org/show_bug.cgi?id=89369
+
+        Reviewed by Antonio Gomes.
+
+        NetworkJob::startNewJobWithRequest() should stop proceeding if the frame is null,
+        which means it is a PingLoader job and should just finish now.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::startNewJobWithRequest):
+
+2012-06-18  Dan Bernstein  <mitz@apple.com>
+
+        Ideographic comma and full-stops are mishandled in linebreak
+        https://bugs.webkit.org/show_bug.cgi?id=87041
+
+        Reviewed by Alexey Proskuryakov.
+
+        Test: fast/text/line-breaks-after-ideographic-comma-or-full-stop-2.html
+
+        Specifically, line breaks were always allowed after an ideographic comma or full stop, even
+        before a closing bracket.
+
+        * rendering/break_lines.cpp:
+        (WebCore::shouldBreakAfter): Removed code that unconditionally allowed line breaks after
+        ideographic commas and full stops, which was added for <http://webkit.org/b/17411> to work
+        around an issue in Unicode 5.0. Current line break iterator implementations are based on
+        newer versions of Unicode, which do not have that issue, so we can use them instead of the
+        hardcoded approximate rule.
+
+2012-06-18  Martin Robinson  <mrobinson@igalia.com>
+
+        [TextureMapper] Rename shader variables to match the naming scheme of the newer filter shaders
+        https://bugs.webkit.org/show_bug.cgi?id=89324
+
+        Reviewed by Noam Rosenthal.
+
+        Rename shader variables to align them with those in the new filter shaders.
+
+        No new tests. This is just a simple refactor.
+
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        Rename shader variables so that uniforms are prefixed by "u_", attributes by "a_",
+        and texture samplers by "s_".
+
+2012-06-18  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Implement native memory bar diagram
+        https://bugs.webkit.org/show_bug.cgi?id=89106
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemoryBarChart):
+        (WebInspector.NativeMemoryBarChart.prototype._updateStats):
+        (WebInspector.NativeMemoryBarChart.prototype.willHide):
+        (WebInspector.NativeMemoryBarChart.prototype.wasShown):
+        (WebInspector.NativeMemoryBarChart.prototype._updateView):
+        * inspector/front-end/ProfileLauncherView.js:
+        (WebInspector.ProfileLauncherView):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.memory-bar-chart-name):
+        (.memory-bar-chart-bar):
+        (.memory-bar-chart-size):
+        (.memory-bar-chart-total):
+
+2012-06-18  Mike West  <mkwst@chromium.org>
+
+        Crash in CSPSource::parseSource
+        https://bugs.webkit.org/show_bug.cgi?id=89353
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPSourceList::parseSource):
+            Checking that we're not past the end of the string before deref.
+
+2012-06-18  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: table-height-algorithm-012 fails
+        https://bugs.webkit.org/show_bug.cgi?id=85652
+
+        Reviewed by Julien Chaffraix.
+
+        Test: css2.1/20110323/table-height-algorithm-012.htm
+              fast/css/vertical-align-baseline-rowspan-001.htm
+              fast/css/vertical-align-baseline-rowspan-002.htm
+              fast/css/vertical-align-baseline-rowspan-003.htm
+              fast/css/vertical-align-baseline-rowspan-004.htm
+              fast/css/vertical-align-baseline-rowspan-005.htm
+              fast/css/vertical-align-baseline-rowspan-006.htm
+              fast/css/vertical-align-baseline-rowspan-007.htm
+              fast/css/vertical-align-baseline-rowspan-008.htm
+              fast/css/vertical-align-baseline-rowspan-009.htm
+
+        A spanning cell with Vertical-align set to 'baseline' should align the cell's content baseline 
+        (which is the bottom of the first line of text or in-flow content) with the baseline of the first of the rows it spans.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight): Only calculate the baseline for the first row in a rowspan. This
+          ensures that any height added to the rowspan from the baseline is only added to the first row in the span rather than
+          to each of them.
+        (WebCore::RenderTableSection::layoutRows): Rather than get the baseline for each row in a rowspan (with the result that
+          only the baseline for the last row actually sticks), calculate it for the first row in the rowspan only. This function is
+          inefficient when handling rowspans so this doesn't fix the fact that redundant calculations are performed on each subsequent
+          row in the span - that should be done separately.
+
+2012-06-18  Hayato Ito  <hayato@chromium.org>
+
+        Event dispatcher should use InsertionPoint::hasDistribution instead of InsertinPoint::isActive in re-targeting.
+        https://bugs.webkit.org/show_bug.cgi?id=89180
+
+        Reviewed by Dimitri Glazkov.
+
+        If an event is fired on a fallback element within a insertion
+        point which does not select any nodes, the result of event's
+        re-targeting will be wrong since it uses
+        InsertionPoint::isActive() to judge an existence of a lower boundary.
+        That must use InsertionPoint::hasDistribution().
+
+        Test: fast/dom/shadow/shadow-dom-event-dispatching.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::ensureEventAncestors):
+
+2012-06-18  Tony Payne  <tpayne@chromium.org>
+
+       [chromium] Add iccjpeg and qcms to chromium port
+       https://bugs.webkit.org/show_bug.cgi?id=81974
+
+       Reviewed by Adam Barth.
+
+       Covered by existing layout tests which will be rebaselined.
+
+       * WebCore.gyp/WebCore.gyp: Add qcms to the build.
+       * platform/image-decoders/ImageDecoder.h:
+       (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Return an sRGB profile.
+       On OSX, return the default RGB profile. Add FIXME to use the user's
+       monitor profile and verify that profile for other platforms.
+
+       * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+       (turboSwizzled): For libjpeg-turbo, JCS_EXT_BGRA and JCS_EXT_RGBA are the
+       two known output color spaces for which the decoder uses a data swizzle.
+       (colorSpaceHasAlpha): JPEG's have no alpha in the output color space. For
+       libjpeg-turbo, alpha may be present in the swizzled output color space.
+
+       (WebCore::JPEGImageReader::JPEGImageReader):
+       (WebCore::JPEGImageReader::close):
+       (WebCore::JPEGImageReader::decode): For QCMSLIB, create the color transform
+       to use during decoding, and ensure we switch to inputing RGBA data to qcms
+       even if the desired output data is BGRA: outputScanlines() sends BGRA data
+       to the frame buffer following color correction if needed.
+       (JPEGImageReader):
+       (WebCore::JPEGImageReader::colorTransform): qcms color transform getter.
+       (WebCore::JPEGImageReader::createColorTransform): Create color transform.
+       Release the existing transform (if any) and assign to the color transform
+       created from the color profile data.
+       (WebCore::JPEGImageDecoder::outputScanlines): Minor style fix. Apply color
+       transform to each decoded image row.
+
+       * platform/image-decoders/png/PNGImageDecoder.cpp:
+       (WebCore::PNGImageReader::PNGImageReader):
+       (WebCore::PNGImageReader::close):
+       (WebCore::PNGImageReader::currentBufferSize): Move this adjacent to other
+       setters and getters.
+       (WebCore::PNGImageReader::decodingSizeOnly): Ditto.
+       (WebCore::PNGImageReader::setHasAlpha): Ditto.
+       (WebCore::PNGImageReader::hasAlpha): Ditto.
+       (WebCore::PNGImageReader::interlaceBuffer): Ditto.
+       (WebCore::PNGImageReader::createRowBuffer): Creates a temporary row buffer,
+       used when a color transform is applied to the decoded image pixels.
+       (WebCore::PNGImageReader::rowBuffer): Return the temporary row buffer.
+       (WebCore::PNGImageReader::colorTransform): qcms color transform getter.
+       (WebCore::PNGImageReader::createColorTransform): Create color transform.
+       Release the existing transform (if any) and assign to the color transform
+       created from the color profile data.
+       (WebCore::PNGImageDecoder::headerAvailable): For QCMSLIB, create the color
+       transform to use for decoding. Clear m_colorProfile (not used anymore).
+       (WebCore::PNGImageDecoder::rowAvailable): Create temporary row buffer if
+       a color transform is needed for decoding. Apply color transform to each
+       decoded image row.
+
+       * platform/image-decoders/skia/ImageDecoderSkia.cpp:
+       (WebCore::ImageFrame::setColorProfile): Old method of colorProfiles is no
+       longer used. Add a FIXME to remove the old implementation.
+       (WebCore::ImageFrame::setStatus): Remove old color correction code.
+
+2012-06-18  Dan Bernstein  <mitz@apple.com>
+
+        Column progression direction cannot be set independently of writing direction
+        https://bugs.webkit.org/show_bug.cgi?id=89315
+
+        Added a column-progression property, which can have the values 'normal' and 'reverse'. When
+        set to 'reverse', the first column is positioned at the end side of the block, and
+        subsequent columns go from the in the start direction (in the inline column axis case; in
+        the block column axis case, the first column coincides with the block and subsequent columns
+        go before the block).
+
+        Reviewed by Darin Adler.
+
+        Test: fast/multicol/progression-reverse.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Added handling of the new
+        property.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Added validity check for the new property. The valid
+        values are the identifiers 'normal' and 'reverse'.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added this mapping from ColumnProgression
+        enum values to the identifiers 'normal and 'reverse'.
+        (WebCore::CSSPrimitiveValue::operator ColumnProgression): Added this mapping from the
+        identifiers 'normal' and 'reverse' to ColumnProgression enum values.
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty): Added the new property to the set of
+        non-inherited properties.
+        * css/CSSPropertyNames.in: Added -webkit-column-progression.
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder): Added a handler for the new property.
+        * rendering/ColumnInfo.h:
+        (WebCore::ColumnInfo::ColumnInfo): Added an initializer for the m_progressionIsReversed
+        member variable.
+        (WebCore::ColumnInfo::progressionIsReversed): Added this accessor.
+        (WebCore::ColumnInfo::setProgressionIsReversed): Ditto.
+        (ColumnInfo): Added a m_progressionIsReversed member variable.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnRules): Changed to advance in the reverse direction if
+        needed.
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth): Added call to
+        ColumnInfo::setProgressionIsReversed(), based on the new property.
+        (WebCore::RenderBlock::columnRectAt): Changed to take the progression direction into
+        account.
+        * rendering/style/RenderStyle.h: Added accessors and initial value for column progression.
+        * rendering/style/RenderStyleConstants.h: Added ColumnProgression enum.
+        * rendering/style/StyleMultiColData.cpp:
+        (WebCore::StyleMultiColData::StyleMultiColData): Added initializer for the m_progression
+        member variable.
+        (WebCore::StyleMultiColData::operator==): Added equality check for m_progression.
+        * rendering/style/StyleMultiColData.h:
+        (StyleMultiColData): Added m_progression member variable.
+
+2012-06-18  Martin Robinson  <mrobinson@igalia.com>
+
+        [TextureMapper] Replace the source transform with a flip uniform
+        https://bugs.webkit.org/show_bug.cgi?id=89317
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests. This should not change any observable behavior.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp: Instead of building and passing
+        the m4src matrix to the shader, just pass a single uniform that says whether or
+        not the texture should be flipped.
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Change the shader programs
+        to deal with a flip variable rather than a source matrix.
+        (WebCore::TextureMapperShaderProgram::TextureMapperShaderProgram): Instead of getting the location
+        of the source matrix, get the location of the flip uniform.
+        (WebCore::TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple): Ditto.
+        (WebCore::TextureMapperShaderProgramRectSimple::TextureMapperShaderProgramRectSimple): Ditto.
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMask): Ditto.
+        (WebCore::TextureMapperShaderProgramRectOpacityAndMask::TextureMapperShaderProgramRectOpacityAndMask): Ditto.
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (WebCore::TextureMapperShaderProgram::flipLocation): Added this getter.
+        (TextureMapperShaderProgram): Rename the source matrix location member to reflect above changes.
+
+2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120598.
+        http://trac.webkit.org/changeset/120598
+        https://bugs.webkit.org/show_bug.cgi?id=89359
+
+        Patch causes crashes on EFL and GTK release builds (Requested
+        by zdobersek on #webkit).
+
+        * platform/graphics/Pattern.h:
+        (Pattern):
+        * platform/graphics/cairo/PlatformContextCairo.cpp:
+        (WebCore::PlatformContextCairo::prepareForFilling):
+        * platform/graphics/cairo/PlatformContextCairo.h:
+
+2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120592.
+        http://trac.webkit.org/changeset/120592
+        https://bugs.webkit.org/show_bug.cgi?id=89357
+
+        Broke v8 bindings on windows. (Requested by atwilson__ on
+        #webkit).
+
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        * bindings/js/ScriptDebugServer.cpp:
+        * bindings/js/ScriptDebugServer.h:
+        (ScriptDebugServer):
+        * bindings/v8/DebuggerScript.js:
+        (.):
+        * bindings/v8/JavaScriptCallFrame.cpp:
+        * bindings/v8/JavaScriptCallFrame.h:
+        (JavaScriptCallFrame):
+        * bindings/v8/ScriptDebugServer.cpp:
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        * bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp:
+        * inspector/InjectedScript.cpp:
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InjectedScriptSource.js:
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setScriptSource):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        * inspector/JavaScriptCallFrame.idl:
+
+2012-06-18  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        RenderTableSection wastes vector capacity
+        https://bugs.webkit.org/show_bug.cgi?id=86561
+
+        Reviewed by Antti Koivisto.
+
+        Memory optimization, covered by existing tests.
+
+        The issue is that addChild calls Vector::grow() which can over-allocate our row grid (especially
+        for small tables as we allocate at least 16 entries). As we don't know if addChild is called
+        in a loop (e.g. during parsing), we postpone the shrinkToFit call at layout time.
+
+        (WebCore::RenderTableSection::layout):
+        Added a shrinkToFit call with some explanation as to why it's good trade-off to do it now.
+
+2012-06-18  Takashi Sakamoto  <tasak@google.com>
+
+        webkit fails IETC border-radius-clip-002
+        https://bugs.webkit.org/show_bug.cgi?id=83205
+
+        Added addRoundedRectClip instead of just clip when clipToBorderRadius
+        is true and bgLayer->clip() == ContentFillBox.
+
+        Reviewed by Simon Fraser.
+
+        This change is covered by the existing test: ietestcenter/css3/bordersbackgrounds/border-radius-clip-002.
+        However expected images should be updated. I updated chromium-linux
+        and chromium-mac's expected images and removed chromium-win,
+        chromium-mac-leopard and chromium-mac-snowleopard's expected images.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        As the code for "clipping to content boxes as necessary" doesn't
+        consider border-radius or not, added the code for checking
+        clipToBorderRadius or not, and if so, modified to use
+        getBackgroundRoundedRect for obtaining rounded rect and to use
+        addRoundedRectClip by using the obtained rounded rect.
+
+2012-06-18  Iain Merrick  <husky@google.com>
+
+        Allow updateFixedElementsAfterScrolling() to run during layout.       
+        https://bugs.webkit.org/show_bug.cgi?id=84965
+
+        This is needed because HistoryController restores the previous scroll
+        position during layout (because we don't want an ugly flash of wrongly-
+        scrolled content).
+
+        Reviewed by Simon Fraser.
+
+        Test: compositing/fixed-position-scroll-offset-history-restore.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateFixedElementsAfterScrolling):
+
+2012-06-18  Alexander Pavlov  <apavlov@chromium.org>
+
+        CSSOM wrappers are not built for rules in the per-document and page group user stylesheets
+        https://bugs.webkit.org/show_bug.cgi?id=89221
+
+        Reviewed by Antti Koivisto.
+
+        The issue manifested itself by not displaying injected page group stylesheet data in the Styles pane.
+
+        Test: inspector/styles/inject-stylesheet.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-18  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [cairo] Fix LayoutTests/fast/canvas/patternfill-repeat.html
+        https://bugs.webkit.org/show_bug.cgi?id=53085
+
+        Reviewed by Martin Robinson.
+
+        Clipping previously unlimited vertical and horizontal pattern repeats with
+        a clip rectangle similar to the Qt Graphics Context.
+
+        No new tests, this patch fixes
+        canvas/philip/tests/2d.pattern.paint.repeat* tests.
+
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::getPatternSpaceTransform): Adding constant getter method to be able to map to pattern space externally, needed by PlatformContextCairo::clipForPatternFilling.
+        * platform/graphics/cairo/PlatformContextCairo.cpp:
+        (WebCore::PlatformContextCairo::prepareForFilling):
+        (WebCore::PlatformContextCairo::clipForPatternFilling): Clip pattern repeats if needed.
+        * platform/graphics/cairo/PlatformContextCairo.h:
+
+2012-06-18  Robert Kroeger  <rjkroege@chromium.org>
+
+        Touch events with default actions should be handled.
+        https://bugs.webkit.org/show_bug.cgi?id=89304.
+
+        Reviewed by Kent Tamura.
+
+        Covered by existing tests and tests in blocked bug
+        https://bugs.webkit.org/show_bug.cgi?id=88807
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Return true that the touch event
+        was handled for either preventDefault or defaultHandled.
+
+2012-06-18  Silvia Pfeiffer  <silviapf@chromium.org>
+
+        REGRESSION introduced in bug 88623: new shadowPseudoId elements need to get default styling.
+        https://bugs.webkit.org/show_bug.cgi?id=89280
+
+        Reviewed by Eric Carlson.
+
+        No new tests; existing tests found this bug.
+
+        * css/html.css:
+        (input[type="range"]::-webkit-slider-container, input[type="range"]::-webkit-media-slider-container):
+        Add -webkit-media-slider-container to the default styling.
+        (input[type="range"]::-webkit-slider-thumb, input[type="range"]::-webkit-media-slider-thumb):
+        Add -webkit-media-slider-thumb to the default styling.
+
+2012-06-12  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Support File/DirectoryEntry access for <input type=file> if FileSystem API is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=88293
+
+        Reviewed by Tony Chang.
+
+        Proposal email on whatwg: http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-November/033814.html
+        Proposal draft: http://wiki.whatwg.org/wiki/DragAndDropEntries
+
+        Test: fast/forms/file/input-file-entries.html
+
+        * Modules/filesystem/HTMLInputElementFileSystem.cpp: Added.
+        * Modules/filesystem/HTMLInputElementFileSystem.h: Added.
+        * Modules/filesystem/HTMLInputElementFileSystem.idl: Added.
+        * WebCore.gypi:
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::receiveDroppedFiles): Retrieves dropped file
+        system Id if the given DragData has it.
+        (WebCore::FileInputType::droppedFileSystemId): Added. This returns
+        dropped file system Id retrieved in receiveDroppedFiles, or an empty
+        string if the platform does not support isolated file system for
+        dropped files.
+        * html/FileInputType.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::droppedFileSystemId): Added.
+        * html/HTMLInputElement.h:
+        * html/InputType.cpp:
+        (WebCore::InputType::droppedFileSystemId): Added.
+        * html/InputType.h:
+        * platform/DragData.cpp:
+        * platform/DragData.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::droppedFileSystemId): Added.
+
+2012-06-18  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: Support 'Restart frame' in protocol and backend
+        https://bugs.webkit.org/show_bug.cgi?id=89147
+
+        Reviewed by Yury Semikhatsky.
+
+        Inspector.json got new command in Debugger domain.
+        A call path from InspectorDebuggerAgent to V8 Debug.LiveEdit.RestartFrame API
+        is built.
+        JSC implementation is a stub with fix me (40300). 
+
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::restart):
+        (WebCore):
+        * bindings/js/JavaScriptCallFrame.h:
+        (JavaScriptCallFrame):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore):
+        (WebCore::ScriptDebugServer::updateCallStack):
+        * bindings/js/ScriptDebugServer.h:
+        (ScriptDebugServer):
+        * bindings/v8/DebuggerScript.js:
+        (.):
+        * bindings/v8/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::restart):
+        (WebCore):
+        * bindings/v8/JavaScriptCallFrame.h:
+        (JavaScriptCallFrame):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore):
+        (WebCore::ScriptDebugServer::updateCallStack):
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        * bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp:
+        (WebCore::V8JavaScriptCallFrame::restartCallback):
+        (WebCore):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::restartFrame):
+        (WebCore):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::restartFrame):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        * inspector/JavaScriptCallFrame.idl:
+
+2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
         Unreviewed, rolling out r120485 and r120582.
         http://trac.webkit.org/changeset/120485
         http://trac.webkit.org/changeset/120582