Merge 122082 - Heap-use-after-free in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers

Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 122284)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,3 +1,17619 @@
+2012-07-05  MORITA Hajime  <morrita@google.com>
+
+        Heap-use-after-free in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers
+        https://bugs.webkit.org/show_bug.cgi?id=90480
+
+        Reviewed by Kent Tamura.
+
+        If <select> has any insertion point, the attachment phase
+        unpextedly creates a renderer for distributed node and added to
+        the renderer of the <select>, which breaks an assumption and
+        results the crash.
+
+        This change tighten the childShouldCreateRenderer() to forbid
+        child renderers even from distributed nodes.
+
+        There is an exception as always: ValidationMessage can create a
+        ShadowRoot to <select>, which generates usually-forbidden child
+        renderers.  This change introduces HTMLFormControlElement::validationMessageContains()
+        to let these renderers in.
+
+        Test: fast/dom/shadow/insertion-point-list-menu-crash.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::validationMessageContains):
+        (WebCore):
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::childShouldCreateRenderer):
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::contains):
+        (WebCore):
+        * html/ValidationMessage.h:
+        (WebCore):
+        (ValidationMessage):
+
+2012-07-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unnecessary member HTMLTreeBuilder::m_lastScriptElementStartPosition
+        https://bugs.webkit.org/show_bug.cgi?id=90726
+
+        Reviewed by Adam Barth.
+
+        HTMLTreeBuilder::m_lastScriptElementStartPosition is of no use. Currently,
+        m_lastScriptElementStartPosition is used to store the text position in
+        "script" start tag, and then the stored position is passed to m_scriptToProcessStartPosition
+        later in "script" end tag. Because HTMLTreeBuilder handles one script tag at
+        a time, we can store the text position directly to m_scriptToProcessStartPosition
+        in "script" start tag.
+
+        No behavior change, so no new tests.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processScriptStartTag):
+        * html/parser/HTMLTreeBuilder.h:
+        (HTMLTreeBuilder):
+
+2012-07-08  Philip Rogers  <pdr@google.com>
+
+        Refactor RenderSVGShape to not contain fallback code
+        https://bugs.webkit.org/show_bug.cgi?id=90514
+
+        Reviewed by Nikolas Zimmermann.
+
+        The interaction between RenderSVGShape and {RenderSVGEllipse, RenderSVGRect}
+        was too coupled and it was not clear when a path existed or who controlled
+        falling back to path codepaths in RenderSVGShape.
+
+        This patch cleans up RenderSVGShape so that it does not track fallback state
+        and does not have special handling for creating a shape in strokeContains. Because
+        some functions of RenderSVGShape can be called without a path existing, each
+        of these functions has switched to using the path() function which asserts that
+        a path exists.
+
+        There is only one remaining use of hasPath() in RenderSVGShape which I plan
+        to remove in a followup patch.
+
+        This patch also cleans up RenderSVGRect and RenderSVGEllipse. These classes
+        now handle fallback tracking themselves and choose when to use their optimized
+        strokeContains codepaths.
+
+        No new tests as this is just a refactoring.
+
+        * rendering/svg/RenderSVGEllipse.cpp:
+        (WebCore::RenderSVGEllipse::RenderSVGEllipse):
+        (WebCore::RenderSVGEllipse::createShape):
+        (WebCore::RenderSVGEllipse::objectBoundingBox):
+        (WebCore::RenderSVGEllipse::strokeBoundingBox):
+        (WebCore::RenderSVGEllipse::fillShape):
+        (WebCore::RenderSVGEllipse::strokeShape):
+        (WebCore::RenderSVGEllipse::shapeDependentStrokeContains):
+        (WebCore::RenderSVGEllipse::shapeDependentFillContains):
+        * rendering/svg/RenderSVGEllipse.h:
+        (WebCore::RenderSVGEllipse::isEmpty):
+        (RenderSVGEllipse):
+        * rendering/svg/RenderSVGRect.cpp:
+        (WebCore::RenderSVGRect::RenderSVGRect):
+        (WebCore::RenderSVGRect::createShape):
+        (WebCore::RenderSVGRect::objectBoundingBox):
+        (WebCore::RenderSVGRect::strokeBoundingBox):
+        (WebCore::RenderSVGRect::fillShape):
+        (WebCore::RenderSVGRect::strokeShape):
+        (WebCore::RenderSVGRect::shapeDependentStrokeContains):
+        (WebCore::RenderSVGRect::shapeDependentFillContains):
+        * rendering/svg/RenderSVGRect.h:
+        (WebCore::RenderSVGRect::isEmpty):
+        (RenderSVGRect):
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::RenderSVGShape):
+        (WebCore::RenderSVGShape::createShape):
+        (WebCore::RenderSVGShape::isEmpty):
+        (WebCore::RenderSVGShape::objectBoundingBox):
+        (WebCore::RenderSVGShape::shapeDependentStrokeContains):
+        (WebCore::RenderSVGShape::shapeDependentFillContains):
+        (WebCore::RenderSVGShape::strokeContains):
+        (WebCore::RenderSVGShape::layout):
+        (WebCore::RenderSVGShape::hasSmoothStroke):
+        (WebCore):
+        * rendering/svg/RenderSVGShape.h:
+        (RenderSVGShape):
+
+2012-07-08  Kinuko Yasuda  <kinuko@chromium.org>
+
+        XHR.send should support ArrayBufferView
+        https://bugs.webkit.org/show_bug.cgi?id=90536
+
+        XHR.send should support ArrayBufferView according to the latest draft
+        and also eventually deprecate ArrayBuffer.
+        Spec: http://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#dom-xmlhttprequest-send
+
+        Reviewed by Kenneth Russell.
+
+        Test: http/tests/xmlhttprequest/send-array-buffer.html
+              http/tests/xmlhttprequest/send-data-view.html
+
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore):
+        (WebCore::XMLHttpRequest::send):
+        * xml/XMLHttpRequest.h:
+        (XMLHttpRequest):
+        * xml/XMLHttpRequest.idl:
+
+2012-07-08  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: CodeGeneratorInspector.py should not generate statements with no effect
+        https://bugs.webkit.org/show_bug.cgi?id=90697
+
+        Reviewed by Vsevolod Vlasov.
+
+        Fix to remove the statements with no effect. The check for errors is added only when some valid
+        statements exist.
+
+        No new tests as generator related patch.
+
+        * inspector/CodeGeneratorInspector.py:
+        (Generator.process_command):
+
+2012-07-06  Lauro Neto  <lauro.neto@openbossa.org>
+
+        [Qt] Avoid deep copy of QImage in GraphicsContext3D::getImageData()
+        https://bugs.webkit.org/show_bug.cgi?id=90705
+
+        Reviewed by Noam Rosenthal.
+
+        Use QImage.constBits() as argument to packPixels instead of bits() to avoid
+        deep copying it.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2012-07-06  Andy Estes  <aestes@apple.com>
+
+        Fix errors reported by generate-bindings.pl after r121882.
+
+        * DerivedSources.make: Specify the correct path for notifications idl
+        files now that notifications/ lives in WebCore/Modules/.
+
+2012-07-06  Justin Novosad  <junov@chromium.org>
+
+        Drawing to accelerated 2D canvas causes compositor to recompute layer tree
+        https://bugs.webkit.org/show_bug.cgi?id=90630
+
+        Reviewed by Simon Fraser.
+
+        No new tests: covered by existing canvas/compositing layout tests
+
+        Before this change, there was no distinction between canvas changes
+        that require recomputing the compositor tree and canvas changes that
+        only require re-display. The new CanvasPixelsChanged member of enum
+        ContentChangeType requests re-display without re-layout.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::didDraw):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentChanged):
+
+2012-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: get rid of this._lastMarkedRange in TextEditor.
+        https://bugs.webkit.org/show_bug.cgi?id=90691
+
+        Reviewed by Vsevolod Vlasov.
+
+        We don't need it, should use setSelection instead.
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.markAndRevealRange):
+        (WebInspector.TextEditor.prototype._handleSelectionChange):
+        (WebInspector.TextEditor.prototype.setSelection):
+        (WebInspector.TextEditor.prototype._handleFocused):
+
+2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Snippet renaming behavior is not correct.
+        https://bugs.webkit.org/show_bug.cgi?id=90689
+
+        Reviewed by Pavel Feldman.
+
+        Navigator overlay is now not closed when editing is canceled.
+        Esc handler in NavigatorOverlayController is not installed as a shortcut anymore since
+        it should not be called until all underlying DOM elements handled the key down event.
+
+        * inspector/front-end/NavigatorOverlayController.js:
+        (WebInspector.NavigatorOverlayController.prototype.set showNavigatorOverlay):
+        (WebInspector.NavigatorOverlayController.prototype._keyDown):
+        (WebInspector.NavigatorOverlayController.prototype._innerHideNavigatorOverlay):
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype.rename.commitHandler):
+        (WebInspector.NavigatorView.prototype.rename.cancelHandler):
+        (WebInspector.NavigatorView.prototype.rename.afterEditing):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator):
+        (WebInspector.ScriptsNavigator.prototype._itemRenamingRequested):
+        (WebInspector.SnippetsNavigatorView.prototype._handleRenameSnippet):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._itemRenamingRequested.callback):
+        (WebInspector.ScriptsPanel.prototype._itemRenamingRequested):
+
+2012-07-06  Andreas Kling  <kling@webkit.org>
+
+        Separate mutating CSSStyleDeclaration operations.
+        <http://webkit.org/b/89945>
+
+        Reviewed by Antti Koivisto.
+
+        Use separate paths for mutating the StylePropertySet wrapped by a CSSStyleDeclaration.
+        PropertySetCSSStyleDeclaration now has:
+
+            - propertySet() const
+            - ensureMutablePropertySet()
+
+        This is prep work for supporting immutable ElementAttributeData objects, the idea being
+        that calling ensureMutablePropertySet() may cause the element to convert its internal
+        attribute storage (which also holds the inline StylePropertySet.)
+
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::length):
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        (WebCore::PropertySetCSSStyleDeclaration::cssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
+        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::copy):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::InlineCSSStyleDeclaration::didMutate):
+        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):
+        * css/PropertySetCSSStyleDeclaration.h:
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::propertySet):
+        (WebCore::PropertySetCSSStyleDeclaration::ensureMutablePropertySet):
+
+2012-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: text editor scrolls 2px horizontally as one navigates the source code.
+        https://bugs.webkit.org/show_bug.cgi?id=90682
+
+        Reviewed by Vsevolod Vlasov.
+
+        Removing the hack that is glueing the scroller to the left.
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype._updatePanelOffsets):
+        (WebInspector.TextEditorChunkedPanel.prototype._scroll):
+        * inspector/front-end/textEditor.css:
+
+2012-07-06  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: get rid of cancellable records in Timeline, manage frame records explicitly
+        https://bugs.webkit.org/show_bug.cgi?id=90684
+
+        Reviewed by Pavel Feldman.
+
+        - drop handling of "cancelable" records;
+        - keep frame record until other records come (or frame is canceled)
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didBeginFrame):
+        (WebCore::InspectorTimelineAgent::didCancelFrame):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        (WebCore::InspectorTimelineAgent::commitFrameRecord):
+        (WebCore::InspectorTimelineAgent::clearRecordStack):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
+        (TimelineRecordEntry):
+        (InspectorTimelineAgent):
+
+2012-07-06  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Add native memory used by GlyphCache to the snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=90615
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::addPlatformComponentsInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+        * platform/MemoryUsageSupport.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        (WebCore):
+        * platform/MemoryUsageSupport.h:
+        (MemoryUsageSupport):
+        (ComponentInfo):
+        (WebCore::MemoryUsageSupport::ComponentInfo::ComponentInfo):
+        * platform/chromium/MemoryUsageSupportChromium.cpp:
+        (WebCore::glyphCacheVisitor):
+        (WebCore):
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Switch to new-style Qt 5 configure tests
+
+        Use explicit project file action instead of syncqt magic.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WebCore.pri:
+
+2012-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: start searching from the cursor position in the Sources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=90677
+
+        Reviewed by Vsevolod Vlasov.
+
+        Web Inspector: start searching from the cursor position in the Sources panel.
+        Drive-by: select whole match upon search cancel.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.performSearch.finishedCallback):
+        (WebInspector.ScriptsPanel.prototype.performSearch):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.performSearch.doFindSearchMatches):
+        (WebInspector.SourceFrame.prototype.performSearch):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.lastSelection):
+        (WebInspector.TextEditor.prototype._handleFocused):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextRange.prototype.serializeToObject):
+        (WebInspector.TextRange.prototype.compareTo):
+
+2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Snippets should be correctly (re)loaded when inspector is open and on navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=90672
+
+        Reviewed by Pavel Feldman.
+
+        Snippets are now reloaded from the storage on ScriptSnippetMapping reset.
+        Fixed snippets storage.
+
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel):
+        (WebInspector.ScriptSnippetModel.prototype._loadSnippets):
+        (WebInspector.ScriptSnippetModel.prototype._reset):
+        * inspector/front-end/SnippetStorage.js:
+        (WebInspector.Snippet.fromObject):
+
+2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Implement snippets removing.
+        https://bugs.webkit.org/show_bug.cgi?id=90674
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype.rename.afterEditing):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype.removeUISourceCode):
+        (WebInspector.SnippetsNavigatorView.prototype._handleRemoveSnippet):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeRemoved):
+        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
+        * inspector/front-end/TabbedEditorContainer.js:
+
+2012-07-06  'Pavel Feldman'  <pfeldman@chromium.org>
+
+        Not reviewed: fix inspector front-end compilation.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SearchController.js:
+
+2012-07-06  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add memory reporting routine to Document
+        https://bugs.webkit.org/show_bug.cgi?id=90668
+
+        Reviewed by Pavel Feldman.
+
+        Added methods for reporting HashSet, ListHashSet and Vector memory
+        footprint. Made Document report its size along with its internal
+        collections sizes.
+
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        (WebCore):
+        * dom/Document.h:
+        (Document):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (MemoryObjectInfo):
+        (WebCore::MemoryObjectInfo::reportHashMap):
+        (WebCore::MemoryObjectInfo::reportHashSet):
+        (WebCore::MemoryObjectInfo::reportListHashSet):
+        (WebCore::MemoryObjectInfo::reportVector):
+        (WebCore::MemoryObjectInfo::memoryInstrumentation):
+        (WebCore::MemoryInstrumentation::reportHashMap):
+        (WebCore):
+        (WebCore::MemoryInstrumentation::reportHashSet):
+        (WebCore::MemoryInstrumentation::reportListHashSet):
+        (WebCore::MemoryInstrumentation::reportVector):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-07-06  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Fixing defines for NEON intrinsics.
+        https://bugs.webkit.org/show_bug.cgi?id=90666
+
+        Reviewed by Zoltan Herczeg.
+
+        Existing tests cover this issue.
+
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::platformApplyGeneric):
+        * platform/graphics/filters/arm/FEGaussianBlurNEON.h:
+        * platform/graphics/filters/arm/NEONHelpers.h:
+
+2012-07-05  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Workspace should dispatch WorkspaceReset event on navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=90616
+
+        Reviewed by Pavel Feldman.
+
+        Workspace UISourceCodeProviders are now reset on navigation.
+        UISourceCodeRemoved event is not dispatched from UISourceCodeProviders on reset (page navigation) anymore.
+
+        * inspector/front-end/CompilerScriptMapping.js:
+        (WebInspector.CompilerScriptMapping.prototype.reset):
+        * inspector/front-end/DebuggerScriptMapping.js:
+        (WebInspector.DebuggerScriptMapping):
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._loadUISourceCodes):
+        (WebInspector.ScriptsPanel.prototype._reset):
+        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
+        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
+        (WebInspector.ScriptsPanel.prototype.showGoToSourceDialog):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StylesUISourceCodeProvider):
+        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodeProviders):
+        (WebInspector.Workspace):
+        (WebInspector.Workspace.prototype.registerUISourceCodeProvider):
+        (WebInspector.Workspace.prototype._reset):
+
+2012-07-05  Arnaud Renevier  <arno@renevier.net>
+
+        [GTK] Showing the context menu in the Web Inspector can crash the browser
+        https://bugs.webkit.org/show_bug.cgi?id=88800
+
+        Reviewed by Carlos Garcia Campos.
+
+        Remove ContextMenuItem from its parent before appending it again to a
+        new parent
+
+        No new tests, behavior is unchanged.
+
+        * platform/gtk/ContextMenuGtk.cpp:
+        (WebCore::ContextMenu::appendItem):
+
+2012-07-05  Dongwoo Im  <dw.im@samsung.com>
+
+        [EFL] Unreviewed, Fix build break when WEB_AUDIO is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=90653
+
+        Unreviewed build fix.
+
+        A new file, AudioFIFO.cpp, is added for the Web Audio fearure.
+        This file should be included into the CMakeLists.txt file.
+
+        * CMakeLists.txt: Add the newly created file into the CMakeLists.txt
+
+2012-07-05  Mike West  <mkwst@chromium.org>
+
+        Multiple Content Security Policy headers are correctly processed as separate headers.
+        https://bugs.webkit.org/show_bug.cgi?id=90629
+
+        Headers of the same name are normalized into a single, comma-separated
+        string as per RFC2616, section 4.2. We didn't correctly account for this
+        in ContentSecurityPolicy::didReceiveHeader. Now we do by walking through
+        the header string, looking for commas and processing each block in turn.
+
+        This oversight bit Firefox as well, and was patched in February:
+        https://bugzilla.mozilla.org/show_bug.cgi?id=717511
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/contentSecurityPolicy/directive-parsing-multiple-headers.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+
+2012-07-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121921.
+        http://trac.webkit.org/changeset/121921
+        https://bugs.webkit.org/show_bug.cgi?id=90648
+
+        caused hundreds of crashes on Mac (Requested by pizlo on
+        #webkit).
+
+        * editing/SurroundingText.cpp:
+        (WebCore::SurroundingText::SurroundingText):
+        * editing/TextIterator.cpp:
+        (WebCore::CharacterIterator::advance):
+        (WebCore::BackwardsCharacterIterator::advance):
+
+2012-07-05  Anders Carlsson  <andersca@apple.com>
+
+        Type-ahead doesn't work in options inside optgroups
+        https://bugs.webkit.org/show_bug.cgi?id=90647
+        <rdar://problem/5604894>
+
+        Reviewed by Dan Bernstein.
+
+        Set the title of the menu item to a string that doesn't contain any leading or trailing whitespace.
+
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenuMac::populate):
+
+2012-07-05  Hayato Ito  <hayato@chromium.org>
+
+        [Crash] Click an element which will be 'display: none' on focus.
+        https://bugs.webkit.org/show_bug.cgi?id=90516
+
+        Reviewed by Hajime Morita.
+
+        EventHandler::handleMousePressEventSingleClick checks whether
+        innerNode has a renderer in the beginning of the function.  But
+        the renderer may disappear in the middle of the function since its
+        style has just become 'display:none'.  As a result, it touches null renderer
+        in EventHandler.cpp:517:
+            VisiblePosition visiblePos(innerNode->renderer()->positionForPoint(event.localPoint()));
+        In the case of 'display:none', we don't have to continue.  So call
+        updateLayoutIgnorePendingStylesheets() in the beginning so that we
+        can early exit and do not touch null renderer.
+
+        Test: fast/events/display-none-on-focus-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+
+2012-07-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Double release of resources if the load is canceled in a callback of ResourceLoader::didFinishLoading
+        https://bugs.webkit.org/show_bug.cgi?id=90431
+
+        Reviewed by Anders Carlsson.
+
+        In ResourceLoader::didFinishLoadingOnePart(), we invoke didFinishLoad() on the WebKit client. If WebKit
+        causes the current frame to cancel the load synchronously, the resources are already freed when
+        ResourceLoader::didFinishLoadingOnePart() ends.
+        When ResourceLoader::didFinishLoading() subsequently invokes releaseResources(), we are releasing the
+        resources a second time.
+
+        This patch add a second check for cancellation after invoking ResourceLoader::didFinishLoadingOnePart() to
+        avoid such issues.
+
+        The previous check at the beginning of ResourceLoader::didFinishLoading() has been removed because it is
+        redundant with ResourceLoader::didFinishLoadingOnePart().
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didFinishLoading):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+
+2012-07-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Add a utility method for hasOverflowClip() or hasClip()
+        https://bugs.webkit.org/show_bug.cgi?id=90635
+
+        Reviewed by Dean Jackson.
+        
+        Add RenderObject::hasClipOrOverflowClip() as a convenience method
+        since we end up calling hasOverfFlowClip() || hasClip() a lot in the layer code.
+
+        No new tests; refactoring only.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::enclosingNonStackingClippingLayer):
+        (WebCore::RenderLayerCompositor::clipsCompositingDescendants):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::hasClipOrOverflowClip):
+
+2012-07-05  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        Code refactoring: move mimeTypeFromUTITree to a separate file.
+        https://bugs.webkit.org/show_bug.cgi?id=90619
+
+        We should move UTI handling related code to a separate file.
+
+        Reviewed by David Kilzer.
+
+        * WebCore.xcodeproj/project.pbxproj: Add UTIUtilities.h/UTIUtilities.mm to xcode project, and drive-by fix
+            that happened when editing the Xcode project file.
+        * platform/network/mac/UTIUtilities.h: Added.
+        (WebCore):
+        * platform/network/mac/UTIUtilities.mm: Added.  move mimeTypeFromUTITree to UTIUtilities.mm.
+        (WebCore):
+        (WebCore::mimeTypeFromUTITree):
+        * platform/network/mac/WebCoreURLResponse.mm: include UTIUtilities.h to use mimeTypeFromUTITree.
+        (WebCore):
+
+2012-07-05  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Character iterators should not advance if they are at end
+        https://bugs.webkit.org/show_bug.cgi?id=90560
+
+        Reviewed by Ryosuke Niwa.
+
+        CharacterIterator and BackwardsCharacterIterator try to advance their
+        internal TextIterator without checking if they already are at end.
+        This can cause crashes in TextIterator::advance.
+
+        Test: platform/chromium/editing/surrounding-text/surrounding-text.html
+
+        * editing/SurroundingText.cpp:
+        (WebCore::SurroundingText::SurroundingText):
+        * editing/TextIterator.cpp:
+        (WebCore::CharacterIterator::advance):
+        (WebCore::BackwardsCharacterIterator::advance):
+
+2012-07-05  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add basic framework
+        https://bugs.webkit.org/show_bug.cgi?id=88655
+
+        Follow-up patch tweaking method signatures.
+
+        Reviewed by Simon Fraser.
+
+        No functional change, so no new tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/TextAutosizer.cpp:
+        (WebCore::TextAutosizer::processSubtree):
+        (WebCore::TextAutosizer::processBlock):
+        (WebCore::TextAutosizer::processText):
+        (WebCore):
+        * rendering/TextAutosizer.h:
+        (TextAutosizer):
+
+2012-07-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move cursor to the current search match.
+        https://bugs.webkit.org/show_bug.cgi?id=90621
+
+        Reviewed by Vsevolod Vlasov.
+
+        After closing the search dialog, the cursor should be at the latest search match location.
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.markAndRevealRange):
+        (WebInspector.TextEditor.prototype._handleFocused):
+
+2012-07-05  Behdad Esfahbod  <behdad@behdad.org>
+
+        Subpixel layout broken with spans with CSS position other than static
+        https://bugs.webkit.org/show_bug.cgi?id=90097
+
+        Reviewed by Eric Seidel.
+
+        In InlineBox, don't truncate size to integers when returning.
+
+        In RenderBlock, don't round-up width to next integer.  Round-up to
+        next LayoutUnit instead.
+
+        Test: Added fast/sub-pixel/size-of-span-with-different-positions.html
+        Adjust expected outputs affected by the rounding changes.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::fromFloatCeil):
+        (FractionalLayoutUnit):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::size):
+        * rendering/RenderBlock.cpp:
+        (WebCore::updatePreferredWidth):
+
+2012-07-05  Nate Chapin  <japhet@chromium.org>
+
+        REGRESSION (r115654): Sometimes does not replace content for multipart/x-mixed-replace
+        https://bugs.webkit.org/show_bug.cgi?id=88436
+
+        Reviewed by Brady Eidson.
+
+        Test: http/tests/multipart/multipart-replace-non-html-content.php
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::commitData): We should only send receivedFirstData() once per main resource load,
+            rather than multiple times in a multipart load. 
+        (WebCore::DocumentLoader::setupForReplaceByMIMEType): m_gotFirstByte isn't set to true until data is
+            actually committed, and multipart data is often not committed until the part is finished. Check
+            whether the SharedBuffer is non-null instead.
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject): The JSInternals object my have already been cleared if the window shell
+            was cleared as part of creation of a new Document. Check it before using it.
+
+2012-07-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move search field to the bottom of the page.
+        https://bugs.webkit.org/show_bug.cgi?id=90610
+
+        Reviewed by Vsevolod Vlasov.
+
+        This is the first step in the Search/replace implementation. This change moves search
+        field from the inspector toolbar to the inspector view footer that is visible upon Cmd/Ctrl+F.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/InspectorView.js:
+        (WebInspector.InspectorView):
+        (WebInspector.InspectorView.prototype._pushToHistory):
+        (WebInspector.InspectorView.prototype.panelsElement):
+        (WebInspector.InspectorView.prototype.setFooterElement):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.show):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._reset):
+        * inspector/front-end/SearchController.js:
+        (WebInspector.SearchController):
+        (WebInspector.SearchController.prototype.updateSearchLabel):
+        (WebInspector.SearchController.prototype.cancelSearch):
+        (WebInspector.SearchController.prototype._updateSearchNavigationButtonState):
+        (WebInspector.SearchController.prototype.focusSearchField):
+        (WebInspector.SearchController.prototype._onKeyDown):
+        (WebInspector.SearchController.prototype._onNextButtonSearch):
+        (WebInspector.SearchController.prototype._onPrevButtonSearch):
+        (WebInspector.SearchController.prototype._performSearch):
+        * inspector/front-end/inspector.css:
+        (#search):
+        (.toolbar-search-container):
+        (.toolbar-search-navigation):
+        (.toolbar-search-navigation:hover):
+        (.toolbar-search-navigation.toolbar-search-navigation-prev):
+        (.toolbar-search-navigation.toolbar-search-navigation-next):
+        (.toolbar-search-navigation-hidden):
+        (.status-bar):
+        (.search-drawer-header input[type="search"].search-config-search):
+        (.inspector-footer):
+        (.inspector-footer > div):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.get _setCompactMode):
+        (WebInspector.postDocumentKeyDown):
+
+2012-07-05  Sergey Rogulenko  <rogulenko@google.com>
+
+        Web Inspector: added low-level instrumentation support for TimelineAgent
+        https://bugs.webkit.org/show_bug.cgi?id=90264
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::timelineAgentForOrphanEvents):
+        (WebCore::InspectorInstrumentation::setTimelineAgentForOrphanEvents):
+        (WebCore::InspectorInstrumentation::threadSpecificTimelineAgentForOrphanEvents):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+
+2012-07-05  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add test framework and simple test.
+        https://bugs.webkit.org/show_bug.cgi?id=90561
+
+        Exposes methods allowing Layout Tests to enable Text Autosizing and
+        get the same results as if they were running on a mobile device.
+
+        Reviewed by Adam Barth.
+
+        Test: fast/text-autosizing/simple-paragraph.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore):
+        (WebCore::Settings::setTextAutosizingWindowSizeOverride):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::textAutosizingWindowSizeOverride):
+        * rendering/TextAutosizer.cpp:
+        (WebCore::TextAutosizer::boostSubtree):
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::InternalSettings):
+        (WebCore::InternalSettings::restoreTo):
+        (WebCore::InternalSettings::setTextAutosizingEnabled):
+        (WebCore):
+        (WebCore::InternalSettings::setTextAutosizingWindowSizeOverride):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-07-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: timeline events in the vicinity of event dividers some times are tricky to expand
+        https://bugs.webkit.org/show_bug.cgi?id=90572
+
+        Reviewed by Pavel Feldman.
+
+        - do not use resources-event-divider-padding;
+        - make dividers larger and use border-color to visualize them;
+        - move resources-<color>-divider to timelinePanel.css, as they're not used outside of timeline;
+
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.createEventDivider):
+        * inspector/front-end/inspectorCommon.css:
+        * inspector/front-end/timelinePanel.css:
+        (.timeline .resources-event-divider):
+        (.resources-red-divider):
+        (.resources-blue-divider):
+        (.resources-orange-divider):
+        (.resources-divider.last):
+        (.timeline .resources-event-divider.timeline-frame-divider):
+
+2012-07-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: incorrect height of main timeline pane after switching to memory mode
+        https://bugs.webkit.org/show_bug.cgi?id=90387
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._splitterDragging):
+        (WebInspector.TimelinePanel.prototype.set _setSplitterPosition):
+        (WebInspector.TimelinePanel.prototype._overviewModeChanged):
+
+2012-07-05  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: Add support for keyboard increment / decrement on numbers in attributes in Elements Panel
+        https://bugs.webkit.org/show_bug.cgi?id=89586
+
+        Reviewed by Pavel Feldman
+
+        Refactoring the key events while editing style property values. Migrated the code to UIUtils.js and referred
+        from StylesSidebarPane.js, ElementsTreeOutline.js and MetricsSidebarPane.js.
+
+        No new tests as code refactoring and UI feature added to ElementsTreeOutline.js
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditingAttribute.handleKeyDownEvents):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAttribute):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown.finishHandler):
+        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown.customNumberHandler):
+        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._handleNameOrValueUpDown.finishHandler):
+        (WebInspector.StylesSidebarPane.prototype._handleNameOrValueUpDown):
+        * inspector/front-end/UIUtils.js:
+        (WebInspector._modifiedHexValue):
+        (WebInspector._modifiedFloatNumber):
+        (WebInspector.handleElementValueModifications):
+
+2012-07-05  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        NEON intrinsics should be used with gaussian blur filter
+        https://bugs.webkit.org/show_bug.cgi?id=90166
+
+        Reviewed by Zoltan Herczeg.
+
+        Rewrite inline assembly to NEON intrinsics for better portabilty 
+        and readibility. Remove unnecessary FEGaussianBlurNEON.cpp and add
+        NEONHelpers.h to the project which will contains the shared
+        NEON code of the filters.
+
+        Existing tests cover this issue.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::platformApplyGeneric):
+        (WebCore::FEGaussianBlur::platformApplyWorker):
+        * platform/graphics/filters/FEGaussianBlur.h:
+        (FEGaussianBlur):
+        * platform/graphics/filters/arm/FEGaussianBlurNEON.cpp: Removed.
+        * platform/graphics/filters/arm/FEGaussianBlurNEON.h:
+        (WebCore::boxBlurNEON):
+        * platform/graphics/filters/arm/NEONHelpers.h: Added.
+        (WebCore):
+        (WebCore::loadRGBA8AsFloat):
+        (WebCore::storeFloatAsRGBA8):
+
+2012-07-05  Sam D  <dsam2912@gmail.com>
+
+        Web Inspector: Having a "Scroll into view" for nodes through web inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=89554
+
+        Added options for scrolling-into-view the  element node through web
+        inspector.
+
+        Reviewed by Pavel Feldman.
+
+        No new tests. UI change.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (.):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.callFunction):
+
+2012-07-05  Zan Dobersek  <zandobersek@gmail.com>
+
+        Add Gamepad logging channel
+        https://bugs.webkit.org/show_bug.cgi?id=90570
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add a new logging channel for logging significant
+        events that are related to Gamepad API implementation.
+
+        No new tests - no new testable functionality.
+
+        * platform/Logging.cpp:
+        (WebCore):
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
+        (WebCore):
+        * platform/gtk/GamepadsGtk.cpp: Log when a device is
+        registered or unregistered.
+        (WebCore::GamepadsGtk::registerDevice):
+        (WebCore::GamepadsGtk::unregisterDevice):
+
+2012-07-05  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] support JS execution in the context of an isolated world
+        https://bugs.webkit.org/show_bug.cgi?id=85709
+
+        Reviewed by Gavin Barraclough.
+
+        No new test case for this bug. 
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::collectIsolatedContexts):
+        (WebCore):
+
+2012-07-04  Huang Dongsung  <luxtella@company100.net>
+
+        Add virtual keyword to ~BitmapImage and ~StillImage because ~Image is virtual.
+        https://bugs.webkit.org/show_bug.cgi?id=90447
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/graphics/BitmapImage.h:
+        (BitmapImage):
+        * platform/graphics/qt/StillImageQt.h:
+        (StillImage):
+
+2012-07-04  Mike West  <mkwst@chromium.org>
+
+        Implement the script-nonce Content Security Policy directive.
+        https://bugs.webkit.org/show_bug.cgi?id=89577
+
+        Reviewed by Adam Barth.
+
+        This patch implements the (experimental) script-nonce Content Security
+        Policy directive from the 1.1 spec, which allows for selective
+        execution of script by specifying a "nonce" attribute for the
+        script tag. Script is only loaded and executed if it both matches the
+        nonce and matches the script-src whitelist (if present).
+
+        The implementation is gated on the ENABLE_CSP_NEXT flag, which is
+        currently disabled for all ports other than Chromium.
+
+        Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-nonce--experimental
+
+        Tests: http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed.html
+               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-badnonce.html
+               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html
+               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-emptynonce.html
+               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-scriptsrc-blocked.html
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::requestScript):
+        (WebCore::ScriptElement::executeScript):
+            Passing the nonce attribute through to check against CSP.
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.idl:
+            Adding the `nonce` attribute to the script tag.
+        * page/ContentSecurityPolicy.cpp:
+        (CSPDirectiveList):
+        (WebCore::CSPDirectiveList::logInvalidNonce):
+        (WebCore):
+        (WebCore::CSPDirectiveList::checkNonceAndReportViolation):
+        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
+        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
+            If a nonce is set, deny JavaScript URLs and inline event handlers.
+        (WebCore::CSPDirectiveList::allowScriptNonce):
+        (WebCore::CSPDirectiveList::parseScriptNonce):
+        (WebCore::CSPDirectiveList::addDirective):
+        (WebCore::isAllowedByAllWithNonce):
+        (WebCore::ContentSecurityPolicy::allowScriptNonce):
+        * page/ContentSecurityPolicy.h:
+        (WebCore):
+
+2012-07-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Notifications should be in Modules/notifications
+        https://bugs.webkit.org/show_bug.cgi?id=82121
+
+        Reviewed by Adam Barth.
+
+        The notifications directory is now self-contained. This patch moves it to the Modules directory.
+
+        No new tests, covered by existing tests.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/notifications/DOMWindowNotifications.cpp: Renamed from Source/WebCore/notifications/DOMWindowNotifications.cpp.
+        (WebCore):
+        (WebCore::DOMWindowNotifications::DOMWindowNotifications):
+        (WebCore::DOMWindowNotifications::~DOMWindowNotifications):
+        (WebCore::DOMWindowNotifications::from):
+        (WebCore::DOMWindowNotifications::webkitNotifications):
+        (WebCore::DOMWindowNotifications::disconnectFrameForPageCache):
+        (WebCore::DOMWindowNotifications::reconnectFrameFromPageCache):
+        (WebCore::DOMWindowNotifications::willDestroyGlobalObjectInCachedFrame):
+        (WebCore::DOMWindowNotifications::willDestroyGlobalObjectInFrame):
+        (WebCore::DOMWindowNotifications::willDetachGlobalObjectFromFrame):
+        * Modules/notifications/DOMWindowNotifications.h: Renamed from Source/WebCore/notifications/DOMWindowNotifications.h.
+        (WebCore):
+        (DOMWindowNotifications):
+        * Modules/notifications/DOMWindowNotifications.idl: Renamed from Source/WebCore/notifications/DOMWindowNotifications.idl.
+        * Modules/notifications/Notification.cpp: Renamed from Source/WebCore/notifications/Notification.cpp.
+        (WebCore):
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::~Notification):
+        (WebCore::Notification::create):
+        (WebCore::getAndAddEventListener):
+        (WebCore::Notification::interfaceName):
+        (WebCore::Notification::show):
+        (WebCore::Notification::close):
+        (WebCore::Notification::eventTargetData):
+        (WebCore::Notification::ensureEventTargetData):
+        (WebCore::Notification::contextDestroyed):
+        (WebCore::Notification::finalize):
+        (WebCore::Notification::dispatchShowEvent):
+        (WebCore::Notification::dispatchClickEvent):
+        (WebCore::Notification::dispatchCloseEvent):
+        (WebCore::Notification::dispatchErrorEvent):
+        (WebCore::Notification::taskTimerFired):
+        (WebCore::Notification::permissionLevel):
+        (WebCore::Notification::permissionString):
+        (WebCore::Notification::requestPermission):
+        * Modules/notifications/Notification.h: Renamed from Source/WebCore/notifications/Notification.h.
+        (WebCore):
+        (Notification):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::isHTML):
+        (WebCore::Notification::setHTML):
+        (WebCore::Notification::url):
+        (WebCore::Notification::setURL):
+        (WebCore::Notification::iconURL):
+        (WebCore::Notification::title):
+        (WebCore::Notification::body):
+        (WebCore::Notification::dir):
+        (WebCore::Notification::setDir):
+        (WebCore::Notification::replaceId):
+        (WebCore::Notification::setReplaceId):
+        (WebCore::Notification::tag):
+        (WebCore::Notification::setTag):
+        (WebCore::Notification::direction):
+        (WebCore::Notification::scriptExecutionContext):
+        (WebCore::Notification::detachPresenter):
+        (WebCore::Notification::setBody):
+        (WebCore::Notification::refEventTarget):
+        (WebCore::Notification::derefEventTarget):
+        * Modules/notifications/Notification.idl: Renamed from Source/WebCore/notifications/Notification.idl.
+        * Modules/notifications/NotificationCenter.cpp: Renamed from Source/WebCore/notifications/NotificationCenter.cpp.
+        (WebCore):
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        (WebCore::NotificationCenter::stop):
+        (WebCore::NotificationCenter::requestTimedOut):
+        (WebCore::NotificationCenter::NotificationRequestCallback::createAndStartTimer):
+        (WebCore::NotificationCenter::NotificationRequestCallback::NotificationRequestCallback):
+        (WebCore::NotificationCenter::NotificationRequestCallback::startTimer):
+        (WebCore::NotificationCenter::NotificationRequestCallback::timerFired):
+        * Modules/notifications/NotificationCenter.h: Renamed from Source/WebCore/notifications/NotificationCenter.h.
+        (WebCore):
+        (NotificationCenter):
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::client):
+        (NotificationRequestCallback):
+        * Modules/notifications/NotificationCenter.idl: Renamed from Source/WebCore/notifications/NotificationCenter.idl.
+        * Modules/notifications/NotificationClient.h: Renamed from Source/WebCore/notifications/NotificationClient.h.
+        (WebCore):
+        (NotificationClient):
+        (WebCore::NotificationClient::clearNotifications):
+        (WebCore::NotificationClient::~NotificationClient):
+        * Modules/notifications/NotificationController.cpp: Renamed from Source/WebCore/notifications/NotificationController.cpp.
+        (WebCore):
+        (WebCore::NotificationController::NotificationController):
+        (WebCore::NotificationController::~NotificationController):
+        (WebCore::NotificationController::create):
+        (WebCore::NotificationController::clientFrom):
+        (WebCore::NotificationController::supplementName):
+        (WebCore::provideNotification):
+        * Modules/notifications/NotificationController.h: Renamed from Source/WebCore/notifications/NotificationController.h.
+        (WebCore):
+        (NotificationController):
+        (WebCore::NotificationController::from):
+        (WebCore::NotificationController::client):
+        * Modules/notifications/NotificationPermissionCallback.h: Renamed from Source/WebCore/notifications/NotificationPermissionCallback.h.
+        (WebCore):
+        (NotificationPermissionCallback):
+        (WebCore::NotificationPermissionCallback::~NotificationPermissionCallback):
+        * Modules/notifications/NotificationPermissionCallback.idl: Renamed from Source/WebCore/notifications/NotificationPermissionCallback.idl.
+        * Modules/notifications/WorkerContextNotifications.cpp: Renamed from Source/WebCore/notifications/WorkerContextNotifications.cpp.
+        (WebCore):
+        (WebCore::WorkerContextNotifications::WorkerContextNotifications):
+        (WebCore::WorkerContextNotifications::~WorkerContextNotifications):
+        (WebCore::WorkerContextNotifications::from):
+        (WebCore::WorkerContextNotifications::webkitNotifications):
+        * Modules/notifications/WorkerContextNotifications.h: Renamed from Source/WebCore/notifications/WorkerContextNotifications.h.
+        (WebCore):
+        (WorkerContextNotifications):
+        * Modules/notifications/WorkerContextNotifications.idl: Renamed from Source/WebCore/notifications/WorkerContextNotifications.idl.
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-07-04  Hayato Ito  <hayato@chromium.org>
+
+        Remove inline keywords from functions which can not be inlined in ComposedShadowTreeWalker
+        https://bugs.webkit.org/show_bug.cgi?id=90432
+
+        Reviewed by Hajime Morita.
+
+        No new tests - no functional changes.
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseParent):
+        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):
+
+2012-07-04  Luke Macpherson  <macpherson@chromium.org>
+
+        Inspector crashes when trying to inspect a page with CSS variables
+        https://bugs.webkit.org/show_bug.cgi?id=89818
+
+        Reviewed by Antti Koivisto.
+
+        Patch works by fixing treating handling of CSSPropertyID == CSSPropertyVariable as a special case,
+        and looking up the author-defined property name from the CSSValue.
+
+        Added test inspector/styles/variables/css-variables.html that inspects an element using CSS variables.
+        Test is skipped when variables are compiled out.
+
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::cssName):
+        (WebCore):
+        (WebCore::CSSProperty::cssText):
+        * css/CSSProperty.h:
+        (CSSProperty):
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::asText):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::populateAllProperties):
+
+2012-07-04  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
+        https://bugs.webkit.org/show_bug.cgi?id=40118
+
+        Reviewed by Yong Li.
+
+        Implemented stub for createScriptCallStack to call into
+        Interpreter and extract the current stack frames, iterate
+        through the frames and create the return result required.
+
+        No new tests, manually tested thrown exception and inspector
+        tracebacks.
+
+        * bindings/js/ScriptCallStackFactory.cpp:
+        (WebCore::createScriptCallStack):
+
+2012-07-04  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Respect memory needed for RenderSurfaces when reserving contents textures
+        https://bugs.webkit.org/show_bug.cgi?id=89901
+
+        Reviewed by Adrienne Walker.
+
+        Treat the memory allocation given to a tab as an allocation for its
+        contents and surfaces. Then only use up contents memory such that
+        the surface textures will still fit within the limit. Report histograms
+        for the amount of contents and surface texture memory used by each
+        frame generated by the main thread.
+
+        In the context of ubercomp, each nested compositor will use less memory
+        for contents ensuring that the root compositor has space for surfaces
+        caused by that nested compositor.
+
+        Since surface memory can no longer be taken by contents, we remove the
+        preferred memory limit from the texture manager.
+
+        Tests: TiledLayerChromiumTest.dontAllocateContentsWhenTargetSurfaceCantBeAllocated
+               CCPrioritizedTextureTest.renderSurfacesReduceMemoryAvailableOutsideRootSurface
+               CCPrioritizedTextureTest.renderSurfacesReduceMemoryAvailableForRequestLate
+               CCPrioritizedTextureTest.whenRenderSurfaceNotAvailableTexturesAlsoNotAvailable
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawBackgroundFilters):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::prioritizeTextures):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
+        (WebCore::CCOverdrawMetrics::CCOverdrawMetrics):
+        (WebCore::CCOverdrawMetrics::didUseContentsTextureMemoryBytes):
+        (WebCore):
+        (WebCore::CCOverdrawMetrics::didUseRenderSurfaceTextureMemoryBytes):
+        (WebCore::CCOverdrawMetrics::recordMetricsInternal):
+        * platform/graphics/chromium/cc/CCOverdrawMetrics.h:
+        (CCOverdrawMetrics):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
+        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
+        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
+        (WebCore::CCPrioritizedTextureManager::requestLate):
+        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
+        (WebCore::CCPrioritizedTextureManager::reduceMemory):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
+        (WebCore::CCPrioritizedTextureManager::create):
+        (WebCore::CCPrioritizedTextureManager::memoryForRenderSurfacesBytes):
+        (CCPrioritizedTextureManager):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.cpp:
+        (WebCore::CCPriorityCalculator::uiPriority):
+        (WebCore::CCPriorityCalculator::visiblePriority):
+        (WebCore):
+        (WebCore::CCPriorityCalculator::renderSurfacePriority):
+        (WebCore::CCPriorityCalculator::priorityFromDistance):
+        (WebCore::CCPriorityCalculator::priorityFromVisibility):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
+        (CCPriorityCalculator):
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add basic framework
+        https://bugs.webkit.org/show_bug.cgi?id=88655
+
+        This adds a highly simplified foundation that subsequent Text Autosizing patches
+        can build upon. I've refactored this code (since the earlier combined diff
+        uploaded to http://webkit.org/b/84186) to touch as few files as possible.
+
+        Reviewed by Adam Barth.
+
+        No new tests. I plan to add a test framework as my next Text Autosizing patch.
+
+        * WebCore.gypi:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore):
+        (Document):
+        (WebCore::Document::textAutosizer):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/TextAutosizer.cpp: Added.
+        (WebCore):
+        (WebCore::TextAutosizer::TextAutosizer):
+        (WebCore::TextAutosizer::~TextAutosizer):
+        (WebCore::TextAutosizer::create):
+        (WebCore::TextAutosizer::boostSubtree):
+        (WebCore::TextAutosizer::boostBlock):
+        (WebCore::TextAutosizer::boostText):
+        (WebCore::TextAutosizer::treatAsInline):
+        (WebCore::TextAutosizer::traverseNext):
+        (WebCore::TextAutosizer::cloneRenderStyleWithState):
+        * rendering/TextAutosizer.h: Added.
+        (WebCore):
+        (TextAutosizer):
+
+2012-07-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed, rolling out r121767.
+        http://trac.webkit.org/changeset/121767
+        https://bugs.webkit.org/show_bug.cgi?id=89584
+
+        Crashes inspected page while recording timeline due to
+        conflict with BeginFrame in record stack
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::willProcessTask):
+        (WebCore::InspectorTimelineAgent::didProcessTask):
+        (WebCore::InspectorTimelineAgent::innerAddRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._onRecordAdded):
+        * inspector/front-end/TimelineFrameController.js:
+        (WebInspector.TimelineFrameController.prototype._addRecord):
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord):
+        (WebInspector.TimelineCategoryStrips.prototype.update):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.categories):
+        (WebInspector.TimelinePresentationModel.recordStyle):
+        (WebInspector.TimelinePresentationModel.categoryForRecord):
+        (WebInspector.TimelinePresentationModel.forAllRecords):
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+
+2012-07-04  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clear RenderSurfaces still when no idle paint will be done
+        https://bugs.webkit.org/show_bug.cgi?id=90553
+
+        Reviewed by Adrienne Walker.
+
+        Currently if idle painting is disabled, updateLayers() will early-out.
+        But this prevents it from doing cleanup and clearing all RenderSurface
+        pointers, leaving the layer tree in an unexpected state.
+
+        Tests: CCLayerTreeHostTestCompositeAndReadbackCleanup
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::updateLayers):
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing and adds compile guards around the runtime setting.
+
+        Reviewed by Adam Barth.
+
+        No functionality yet, so no new tests.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * Target.pri:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setTextAutosizingEnabled):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::textAutosizingEnabled):
+
+2012-07-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Emulate pseudo styles (hover etc.) of non-selected elements
+        https://bugs.webkit.org/show_bug.cgi?id=86630
+
+        Reviewed by Pavel Feldman.
+
+        - A map of pseudo-states for all bound DOM nodes is maintained in the backend and queried whenever StyleResolver
+        calculates the effective element style.
+        - In the frontend, markers are introduced to distinguish elements that have forced pseudo styles set for them.
+        Additionally, dimmed markers are added for collapsed nodes, whose descendants have forced pseudo styles.
+        More ElementDecorator subtypes will be added for other types of markers.
+
+        Test: inspector/styles/force-pseudo-state.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::InspectorCSSAgent):
+        (WebCore::InspectorCSSAgent::clearFrontend):
+        (WebCore::InspectorCSSAgent::reset):
+        (WebCore::InspectorCSSAgent::forcePseudoState):
+        (WebCore::InspectorCSSAgent::recalcStyleForPseudoStateIfNeeded):
+        (WebCore::InspectorCSSAgent::elementForId):
+        (WebCore::InspectorCSSAgent::didRemoveDocument):
+        (WebCore::InspectorCSSAgent::didRemoveDOMNode):
+        (WebCore::InspectorCSSAgent::resetPseudoStates):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.get this):
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype._setPseudoClassForNodeId):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+        (WebInspector.ElementsTreeOutline.prototype._createNodeDecorators):
+        (WebInspector.ElementsTreeOutline.prototype.updateOpenCloseTags):
+        (WebInspector.ElementsTreeOutline.ElementDecorator):
+        (WebInspector.ElementsTreeOutline.ElementDecorator.prototype.decorate):
+        (WebInspector.ElementsTreeOutline.ElementDecorator.prototype.decorateAncestor):
+        (WebInspector.ElementsTreeOutline.PseudoStateDecorator):
+        (WebInspector.ElementsTreeOutline.PseudoStateDecorator.prototype.decorate):
+        (WebInspector.ElementsTreeOutline.PseudoStateDecorator.prototype.decorateAncestor):
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._populateForcedPseudoStateItems):
+        (WebInspector.ElementsTreeElement.prototype.updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._createDecoratorElement):
+        (WebInspector.ElementsTreeElement.prototype._updateDecorations):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylesSidebarPane.prototype.get forcedPseudoClasses):
+        (WebInspector.StylesSidebarPane.prototype._updateForcedPseudoStateInputs):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._refreshUpdate):
+        (WebInspector.StylesSidebarPane.prototype._rebuildUpdate):
+        (WebInspector.StylesSidebarPane.prototype._toggleElementStatePane):
+        (WebInspector.StylesSidebarPane.prototype._createElementStatePane.clickListener):
+        * inspector/front-end/elementsPanel.css:
+        (#elements-content .elements-gutter-decoration):
+        (#elements-content .elements-gutter-decoration.elements-has-decorated-children):
+
+2012-07-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: fix search on the network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=90557
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._highlightNthMatchedRequest):
+
+2012-07-04  Kwang Yul Seo  <skyul@company100.net>
+
+        Stop tracking line number in tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=90544
+
+        Reviewed by Adam Barth.
+
+        Because SegmentedString knows how to track the current line and column,
+        a tokenizer does not need to keep track of the current line by itself.
+        No behavior change, so no new tests.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        (WebCore::HTMLDocumentParser::lineNumber):
+        (WebCore::HTMLDocumentParser::textPosition):
+        * html/parser/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::reset):
+        (WebCore::HTMLTokenizer::flushBufferedEndTag):
+        (WebCore):
+        (WebCore::HTMLTokenizer::nextToken):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processScriptStartTag):
+        * html/track/WebVTTTokenizer.cpp:
+        (WebCore::WebVTTTokenizer::reset):
+        (WebCore::WebVTTTokenizer::nextToken):
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase):
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
+        (SegmentedString):
+        * xml/parser/MarkupTokenizerBase.h:
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek):
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):
+        (WebCore::MarkupTokenizerBase::emitAndResumeIn):
+        (WebCore::MarkupTokenizerBase::emitEndOfFile):
+        (WebCore::MarkupTokenizerBase::reset):
+        (MarkupTokenizerBase):
+        * xml/parser/MarkupTokenizerInlineMethods.h:
+        (WebCore):
+        * xml/parser/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::nextToken):
+
+2012-07-04  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [CMAKE] Add GENERATE_BINDINGS macro to share the codes which use generate-bindings.pl.
+        https://bugs.webkit.org/show_bug.cgi?id=90258
+
+        Reviewed by Rob Buis.
+
+        Use GENERATE_BINDINGS instead of using generate-bindings.pl directly.
+
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * PlatformBlackBerry.cmake:
+
+2012-07-04  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: UISourceCode should take care of adding revision after committing working copy.
+        https://bugs.webkit.org/show_bug.cgi?id=90549
+
+        Reviewed by Pavel Feldman.
+
+        Revision is now added in UISourceCode.commitWorkingCopy synchronously even if saving to JS VM or CSS model failed.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._handleOpenURL):
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
+        (WebInspector.ExtensionServer.prototype._onSetResourceContent):
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSource.prototype._callOrSetTimeout):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodeForURL):
+
+2012-07-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move settings button back to the right.
+        https://bugs.webkit.org/show_bug.cgi?id=90552
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/inspector.css:
+        (button.status-bar-item:active, button.status-bar-item.emulate-active):
+        (button.settings-status-bar-item):
+
+2012-07-04  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Get rid of ResourceDomainModelBinding and DebuggerResourceBinding, make Resource.setContent private.
+        https://bugs.webkit.org/show_bug.cgi?id=90531
+
+        Reviewed by Pavel Feldman.
+
+        Resource.setContent made private. It is delegating now to UISourceCodes which take care of domain specific actions.
+        DebuggerResourceBinding was be removed and DebuggerResourceBinding.setScriptSource was moved to JavaScriptSource.
+        ResourceDomainModelBinding was removed as well.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModelResourceBinding):
+        * inspector/front-end/DebuggerResourceBinding.js: Removed.
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
+        (WebInspector.JavaScriptSource.prototype._setScriptSource.didEditScriptSource):
+        (WebInspector.JavaScriptSource.prototype._setScriptSource):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._setContent):
+        (WebInspector.Resource.prototype.revertToOriginal):
+        (WebInspector.Resource.prototype.revertAndClearHistory):
+        (WebInspector.ResourceRevision.prototype.revertToThis):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSource.prototype.isEditable):
+        * inspector/front-end/UISourceCode.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/Workspace.js:
+        (WebInspector.Workspace):
+        * inspector/front-end/inspector.html:
+
+2012-07-04  'Pavel Feldman'  <pfeldman@chromium.org>
+
+        Not reviewed: follow up to r121843, reduce inspector dock timeout to 200ms.
+
+        * inspector/front-end/StatusBarButton.js:
+        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseDown):
+
+2012-07-04  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Correctly reject accelerated animations with certain rotations.
+        https://bugs.webkit.org/show_bug.cgi?id=89768
+
+        Reviewed by James Robinson.
+
+        UnitTests:
+          GraphicsLayerChromiumTest.createTransformAnimationWithBigRotation
+          GraphicsLayerChromiumTest.createTransformAnimationWithRotationInvolvingNegativeAngles
+          GraphicsLayerChromiumTest.createTransformAnimationWithSmallRotationInvolvingLargeAngles
+
+        * platform/graphics/chromium/AnimationTranslationUtil.cpp:
+        (WebCore::appendKeyframe):
+        (WebCore::isRotationType):
+        (WebCore):
+        (WebCore::causesRotationOfAtLeast180Degrees):
+        (WebCore::CCKeyframedTransformAnimationCurve):
+        (WebCore::createActiveAnimation):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::addAnimation):
+
+2012-07-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: "Dock to right" shouldn't be in the settings dialog
+        https://bugs.webkit.org/show_bug.cgi?id=76917
+
+        Reviewed by Vsevolod Vlasov.
+
+        Introduced 'long click-enabled' options for status bar buttons. Made dock/undock one of them.
+
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/StatusBarButton.js:
+        (WebInspector.StatusBarButton.prototype._clicked):
+        (WebInspector.StatusBarButton.prototype.set visible):
+        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseDown):
+        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseUp):
+        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled):
+        (WebInspector.StatusBarButton.prototype._showOptions.mouseOver):
+        (WebInspector.StatusBarButton.prototype._showOptions.mouseOut):
+        (WebInspector.StatusBarButton.prototype._showOptions.mouseUp):
+        (WebInspector.StatusBarButton.prototype._showOptions):
+        * inspector/front-end/UIUtils.js:
+        (WebInspector.elementDragStart):
+        (WebInspector.elementDragEnd):
+        (WebInspector.GlassPane):
+        (WebInspector.GlassPane.prototype.dispose):
+        * inspector/front-end/inspector.css:
+        (.long-click-glyph):
+        (.long-click-glyph.shadow):
+        (button.status-bar-item:active:not(.emulate-inactive), button.status-bar-item.emulate-active):
+        (.alternate-status-bar-buttons-bar):
+        (.alternate-status-bar-buttons-bar .status-bar-item):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createGlobalStatusBarItems):
+        (WebInspector._createDockOptions.onClick.set else):
+        (WebInspector._createDockOptions.onClick):
+
+2012-07-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121813.
+        http://trac.webkit.org/changeset/121813
+        https://bugs.webkit.org/show_bug.cgi?id=90522
+
+        Causes browser_tests failure:
+        ErrorPageTest.DNSError_GoBack2{Forward2,AndForward} on
+        Chromium {Linux,Mac,Win} (Requested by yosin on #webkit).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::commitData):
+        (WebCore::DocumentLoader::setupForReplaceByMIMEType):
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject):
+
+2012-07-04  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        [EFL] Change format of return value of navigator.language
+        https://bugs.webkit.org/show_bug.cgi?id=89639
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove encoding type from return value of navigator.language.
+        For example, from en-US.UTF-8 to en-US.
+
+        Use exist test case (fast/js/navigator-language.html).
+
+        * platform/efl/LanguageEfl.cpp:
+        (WebCore::platformLanguage):
+
+2012-07-03  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Don't show accel labels in context menu items
+        https://bugs.webkit.org/show_bug.cgi?id=90437
+
+        Reviewed by Martin Robinson.
+
+        When a context menu item is created with a GtkMenuItem that has
+        been created from a GtkAction, if the action has an accelerator,
+        it's shown in the menu item label, like menu items in a menu
+        bar. In that case we should reset the accel closure of the menu
+        item label, like GtkUIManager does for popup menus, to make sure
+        the accelerator is not shown. This isn't needed for all other
+        ContextMenuIem constructors, because the GtkAction is created
+        without accelerator by webkit in those cases.
+
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Move BatteryClientEfl from WebKit to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90063
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move BatteryClientEfl class from WebKit to WebCore
+        so that it can be reused in WebKit2.
+
+        No new tests, no behavior change.
+
+        * PlatformEfl.cmake:
+        * platform/efl/BatteryClientEfl.cpp: Renamed from Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.cpp.
+        (WebCore):
+        (WebCore::BatteryClientEfl::BatteryClientEfl):
+        (WebCore::BatteryClientEfl::setController):
+        (WebCore::BatteryClientEfl::startUpdating):
+        (WebCore::BatteryClientEfl::stopUpdating):
+        (WebCore::BatteryClientEfl::batteryControllerDestroyed):
+        (WebCore::BatteryClientEfl::setBatteryStatus):
+        (WebCore::BatteryClientEfl::timerFired):
+        (WebCore::BatteryClientEfl::getBatteryStatus):
+        (WebCore::BatteryClientEfl::setBatteryClient):
+        * platform/efl/BatteryClientEfl.h: Renamed from Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.h.
+        (WebCore):
+        (BatteryClientEfl):
+        (WebCore::BatteryClientEfl::~BatteryClientEfl):
+        (WebCore::BatteryClientEfl::batteryStatus):
+
+2012-07-03  Huang Dongsung  <luxtella@company100.net>
+
+        Add a comment in order to clarify why
+        BitmapImage::frameHasAlphaAtIndex returns true as default.
+        https://bugs.webkit.org/show_bug.cgi?id=90445
+
+        Reviewed by Eric Seidel.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::frameHasAlphaAtIndex):
+        (WebCore):
+
+2012-07-03  Alex Sakhartchouk  <alexst@chromium.org>
+
+        [chromium] Avoid calling getUniformLocation??() in the compositor startup
+        https://bugs.webkit.org/show_bug.cgi?id=90217
+
+        Reviewed by Adrienne Walker.
+
+        This change allows chrome compositor to bind uniform locations instead of querying 
+        them from the graphics context by using GL_CHROMIUM_bind_uniform_location.
+
+        The extention itself is tested in chromium and the change in webkit simply adds
+        plumbing to allow its usage. Existing pixel tests would be able to verify proper behaviour.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::tileCheckerboardProgram):
+        (WebCore::LayerRendererChromium::solidColorProgram):
+        (WebCore::LayerRendererChromium::headsUpDisplayProgram):
+        (WebCore::LayerRendererChromium::renderPassProgram):
+        (WebCore::LayerRendererChromium::renderPassProgramAA):
+        (WebCore::LayerRendererChromium::renderPassMaskProgram):
+        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
+        (WebCore::LayerRendererChromium::tileProgram):
+        (WebCore::LayerRendererChromium::tileProgramOpaque):
+        (WebCore::LayerRendererChromium::tileProgramAA):
+        (WebCore::LayerRendererChromium::tileProgramSwizzle):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleOpaque):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleAA):
+        (WebCore::LayerRendererChromium::textureProgram):
+        (WebCore::LayerRendererChromium::textureProgramFlip):
+        (WebCore::LayerRendererChromium::textureIOSurfaceProgram):
+        (WebCore::LayerRendererChromium::videoYUVProgram):
+        (WebCore::LayerRendererChromium::videoStreamTextureProgram):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/ProgramBinding.cpp:
+        (WebCore::ProgramBindingBase::ProgramBindingBase):
+        (WebCore::ProgramBindingBase::~ProgramBindingBase):
+        (WebCore::ProgramBindingBase::init):
+        (WebCore::ProgramBindingBase::link):
+        (WebCore):
+        (WebCore::ProgramBindingBase::cleanup):
+        (WebCore::ProgramBindingBase::createShaderProgram):
+        (WebCore::ProgramBindingBase::cleanupShaders):
+        * platform/graphics/chromium/ProgramBinding.h:
+        (ProgramBindingBase):
+        (WebCore::ProgramBinding::initialize):
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::VertexShaderPosTex::init):
+        (WebCore::VertexShaderPosTexYUVStretch::init):
+        (WebCore::VertexShaderPos::init):
+        (WebCore::VertexShaderPosTexTransform::init):
+        (WebCore::VertexShaderQuad::init):
+        (WebCore::VertexShaderTile::init):
+        (WebCore::VertexShaderVideoTransform::init):
+        (WebCore::FragmentTexAlphaBinding::init):
+        (WebCore::FragmentTexOpaqueBinding::init):
+        (WebCore::FragmentShaderOESImageExternal::init):
+        (WebCore::FragmentShaderRGBATexAlphaAA::init):
+        (WebCore::FragmentTexClampAlphaAABinding::init):
+        (WebCore::FragmentShaderRGBATexAlphaMask::init):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::init):
+        (WebCore::FragmentShaderYUVVideo::init):
+        (WebCore::FragmentShaderColor::init):
+        (WebCore::FragmentShaderCheckerboard::init):
+        * platform/graphics/chromium/ShaderChromium.h:
+        (VertexShaderPosTex):
+        (VertexShaderPosTexYUVStretch):
+        (VertexShaderPos):
+        (WebCore::VertexShaderPosTexIdentity::init):
+        (VertexShaderPosTexTransform):
+        (VertexShaderQuad):
+        (VertexShaderTile):
+        (VertexShaderVideoTransform):
+        (FragmentTexAlphaBinding):
+        (FragmentTexOpaqueBinding):
+        (FragmentShaderOESImageExternal):
+        (FragmentShaderRGBATexAlphaAA):
+        (FragmentTexClampAlphaAABinding):
+        (FragmentShaderRGBATexAlphaMask):
+        (FragmentShaderRGBATexAlphaMaskAA):
+        (FragmentShaderYUVVideo):
+        (FragmentShaderColor):
+        (FragmentShaderCheckerboard):
+        * platform/graphics/chromium/TextureCopier.cpp:
+        (WebCore::AcceleratedTextureCopier::AcceleratedTextureCopier):
+        (WebCore::AcceleratedTextureCopier::copyTexture):
+        * platform/graphics/chromium/TextureCopier.h:
+        (WebCore::AcceleratedTextureCopier::create):
+        (AcceleratedTextureCopier):
+
+2012-07-03  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Remove enableFasterDOMStoreAccess which is never used
+        https://bugs.webkit.org/show_bug.cgi?id=90489
+
+        Reviewed by Adam Barth.
+
+        No new tests. Dead code removal.
+
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+
+2012-07-03  Joshua Bell  <jsbell@chromium.org>
+
+        Binding: IDL type DOMString[] shouldn't match null
+        https://bugs.webkit.org/show_bug.cgi?id=84217
+
+        Reviewed by Kentaro Hara.
+
+        Similar to r121714, IDL overloads with T[] (which is only minimally supported)
+        were being treated as Nullable by default during overloaded method dispatching,
+        which deviates from the WebIDL specification. Extend the previous change to
+        look for Nullable (specified by "?" type suffix in the IDL) for array types.
+
+        Also, after inspection of the spec, use a strict "is this an Array?" test in
+        the JS generator rather than an "inherits from Array.prototype?" test, to
+        match the WebIDL spec.
+
+        IDL files with affected overloads are modified to include the "?" suffix
+        so that no behavior changes are introduced by this patch - the JS and V8
+        generator results before/after the change show no diffs apart from the stricter
+        isJSArray() test.
+
+        Test: bindings/scripts/test/TestObj.idl (a non-Nullable T[] overload)
+
+        * Modules/indexeddb/IDBDatabase.idl: Tag T[] overloads with ? suffix.
+        * Modules/indexeddb/IDBObjectStore.idl: Ditto.
+        * Modules/vibration/NavigatorVibration.idl: Ditto.
+        * bindings/scripts/CodeGeneratorJS.pm: Check isNullable for T[].
+        (GenerateParametersCheckExpression):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateParametersCheckExpression):
+        * bindings/scripts/test/JS/JSTestObj.cpp: Rebaselined.
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
+        * bindings/scripts/test/TestObj.idl: Tag existing T[] with ?, add non-? T[].
+        * bindings/scripts/test/V8/V8TestObj.cpp: Rebaselined.
+        (WebCore::TestObjV8Internal::overloadedMethod9Callback):
+        (TestObjV8Internal):
+        (WebCore::TestObjV8Internal::overloadedMethodCallback):
+
+2012-07-03  Nate Chapin  <japhet@chromium.org>
+
+        REGRESSION (r115654): Sometimes does not replace content for multipart/x-mixed-replace
+        https://bugs.webkit.org/show_bug.cgi?id=88436
+
+        Reviewed by Brady Eidson.
+
+        Test: http/tests/multipart/multipart-replace-non-html-content.php
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::commitData): We should only send receivedFirstData() once per main resource load,
+            rather than multiple times in a multipart load. 
+        (WebCore::DocumentLoader::setupForReplaceByMIMEType): m_gotFirstByte isn't set to true until data is
+            actually committed, and multipart data is often not committed until the part is finished. Check
+            whether the SharedBuffer is non-null instead.
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject): The JSInternals object my have already been cleared if the window shell
+            was cleared as part of creation of a new Document. Check it before using it.
+
+2012-07-03  Raymond Toy  <rtoy@google.com>
+
+        Add AudioFIFO class and simplify AudioPullFIFO
+        https://bugs.webkit.org/show_bug.cgi?id=90398
+
+        Reviewed by Chris Rogers.
+
+        No new tests. This code will be used in audio back-end implementation.
+
+        Add AudioFIFO class to implement main parts of FIFO.  Simplify
+        implementation of AudioPushFIFO by using AudioFIFO.
+        
+        * WebCore.gypi: Add new files.
+
+        New AudioFIFO class
+        * platform/audio/AudioFIFO.cpp: Copied from Source/WebCore/platform/audio/AudioPullFIFO.cpp.
+        (WebCore):
+        (WebCore::AudioFIFO::AudioFIFO):
+        (WebCore::AudioFIFO::consume):
+        (WebCore::AudioFIFO::push):
+        (WebCore::AudioFIFO::findWrapLengths):
+        * platform/audio/AudioFIFO.h: Copied from Source/WebCore/platform/audio/AudioPullFIFO.h.
+        (WebCore):
+        (AudioFIFO):
+        (WebCore::AudioFIFO::framesInFifo):
+        (WebCore::AudioFIFO::updateIndex):
+
+        Use AudioFIFO
+        * platform/audio/AudioPullFIFO.cpp:
+        (WebCore::AudioPullFIFO::AudioPullFIFO):
+        (WebCore::AudioPullFIFO::consume):
+        (WebCore::AudioPullFIFO::fillBuffer):
+        * platform/audio/AudioPullFIFO.h:
+        (AudioPullFIFO):
+
+2012-07-03  Nate Chapin  <japhet@chromium.org>
+
+        Protect this DocumentThreadableLoader in cancel() to handle reentrancy properly.
+        https://bugs.webkit.org/show_bug.cgi?id=90483
+
+        Reviewed by Abhishek Arya.
+
+        No new tests, covered by http/tests/xmlhttprequest/reentrant-cancel.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::cancel):
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * WebCore.gyp/.gitignore:
+
+2012-07-03  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk][Gamepads] 'warning: comparison is always true due to limited range of data type [-Wtype-limits]' in GamepadsGtk.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=90477
+
+        Reviewed by Martin Robinson.
+
+        Vector::find() returns value of type size_t, springing errors when
+        assigning the value to a variable of type unsigned. Use size_t type
+        for that variable instead.
+
+        No new tests - no changed functionality.
+
+        * platform/gtk/GamepadsGtk.cpp:
+        (WebCore::GamepadsGtk::unregisterDevice):
+
+2012-07-03  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Fix LayoutUnit usage in RenderImage::imageDimensionsChanged
+        https://bugs.webkit.org/show_bug.cgi?id=90173
+
+        Reviewed by Eric Seidel.
+
+        The appropriate type should be used for storing width() and height() into local temporary variables.
+
+        No new tests, no change in behavior.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageDimensionsChanged):
+
+2012-07-03  Sergio Villar Senin  <svillar@igalia.com>
+
+        [TextureMapper] Typo in edge-distance anti-aliasing code
+        https://bugs.webkit.org/show_bug.cgi?id=90475
+
+        Reviewed by Martin Robinson.
+
+        No new tests. This just fixes a typo.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawQuad):
+
+2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Extensions API] Resource manipulations should be based on UISourceCode thus extending Sources Panel.
+        https://bugs.webkit.org/show_bug.cgi?id=89868
+
+        Reviewed by Pavel Feldman.
+
+        Extensions API is now based on both ScriptsPanel acting as a UISourceCodeProvider and ResourceTreeModel.
+        Extensions API resource could be for any content provider now.
+        Extensions API resource.setContent implementation is now based on UISourceCode editing methods.
+        Drive-by StyleSource insremental editing timeout fix.
+
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._handleOpenURL):
+        (WebInspector.ExtensionServer.prototype._makeResource):
+        (WebInspector.ExtensionServer.prototype._onGetPageResources):
+        (WebInspector.ExtensionServer.prototype._getResourceContent):
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
+        (WebInspector.ExtensionServer.prototype._onSetResourceContent):
+        (WebInspector.ExtensionServer.prototype._notifyResourceAdded):
+        (WebInspector.ExtensionServer.prototype._notifyResourceContentCommitted):
+        * inspector/front-end/JavaScriptSource.js:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.uiSourceCodes):
+        (WebInspector.ScriptsPanel.prototype.uiSourceCodeForURL):
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._reset):
+        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSource.prototype.workingCopyCommitted):
+        (WebInspector.StyleSource.prototype.workingCopyChanged):
+        (WebInspector.StyleSource.prototype._callOrSetTimeout):
+        (WebInspector.StyleSource.prototype._commitIncrementalEdit):
+        (WebInspector.StyleSource.prototype._clearIncrementalUpdateTimer):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype.requestContent):
+        (WebInspector.UISourceCode.prototype.workingCopy):
+        (WebInspector.UISourceCode.prototype.setWorkingCopy):
+        (WebInspector.UISourceCode.prototype.isDirty):
+
+2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Anonymous scripts (evals) should not be added to Workspace.
+        https://bugs.webkit.org/show_bug.cgi?id=90467
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype.rawLocationToUILocation):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+
+2012-07-03  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: floats-wrap-top-below-inline-* fail
+        https://bugs.webkit.org/show_bug.cgi?id=88171
+
+        Reviewed by Eric Seidel.
+
+        When shifting a line or element left or right to avoid a float use the height
+        of the line or element to determine whether the float is inside the element or
+        if it overlaps the bottom of the element. 
+
+        Do this by passing the height of the element to the interval tree used to detect
+        the overlap with it's containing block's floats. The height is zero by default so
+        callers to logical[Left|Right]OffsetForLine will need to pass the height if they
+        want to use it to detect floats to avoid.
+
+        Tests: css2.1/20110323/floats-wrap-top-below-bfc-001l.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-001r.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-002l.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-002r.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-003l.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-003r.htm
+               css2.1/20110323/floats-wrap-top-below-inline-001l.htm
+               css2.1/20110323/floats-wrap-top-below-inline-001r.htm
+               css2.1/20110323/floats-wrap-top-below-inline-002l.htm
+               css2.1/20110323/floats-wrap-top-below-inline-002r.htm
+               css2.1/20110323/floats-wrap-top-below-inline-003l.htm
+               css2.1/20110323/floats-wrap-top-below-inline-003r.htm
+               css2.1/20110323/floats-zero-height-wrap-001.htm
+               css2.1/20110323/floats-zero-height-wrap-002.htm
+               fast/block/float/floats-wrap-inside-inline-001.htm
+               fast/block/float/floats-wrap-inside-inline-002.htm
+               fast/block/float/floats-wrap-inside-inline-003.htm
+               fast/block/float/floats-wrap-inside-inline-004.htm
+               fast/block/float/floats-wrap-inside-inline-005.htm
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
+        (WebCore::::collectIfNeeded):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        (WebCore::RenderBlock::getClearDelta):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::availableLogicalWidthForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::startOffsetForLine):
+        (WebCore::RenderBlock::endOffsetForLine):
+        (WebCore::RenderBlock::pixelSnappedLogicalLeftOffsetForLine):
+        (WebCore::RenderBlock::pixelSnappedLogicalRightOffsetForLine):
+        (RenderBlock):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::FloatIntervalSearchAdapter):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::lowValue):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::highValue):
+        (FloatIntervalSearchAdapter):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::logicalBottomForLine):
+        (WebCore):
+        (WebCore::LineWidth::updateAvailableWidth):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockAvailableLineWidthInRegion):
+
+2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Introduce Workspace make it UISourceCode provider for ScriptsPanel.
+        https://bugs.webkit.org/show_bug.cgi?id=90466
+
+        Reviewed by Pavel Feldman.
+
+        Introduced WebInspector.Workspace as a model (UISourceCode provider) behind ScriptsPanel.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/Workspace.js: Added.
+        (WebInspector.CompositeUISourceCodeProvider):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._registerUISourceCodeProvider):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeAdded):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeReplaced):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeRemoved):
+        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodes):
+        (WebInspector.Workspace):
+        (WebInspector.Workspace.prototype.registerUISourceCodeProvider):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DerivedSources.pri:
+        * WebCore.pri:
+
+2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121766.
+        http://trac.webkit.org/changeset/121766
+        https://bugs.webkit.org/show_bug.cgi?id=90465
+
+        It caused flakey build errors on the bots (Requested by Ossy
+        on #webkit).
+
+        * DerivedSources.pri:
+        * WebCore.pri:
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable Custom Scheme Handlers for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90422
+
+        Reviewed by Rob Buis.
+
+        * page/NavigatorRegisterProtocolHandler.cpp:
+        (WebCore::initProtocolHandlerWhitelist): Disable the overrides as
+                                                 they're undesired by BlackBerry
+
+2012-07-03  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Forward message loop instrumentation data to frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=89584
+
+        Reviewed by Yury Semikhatsky.
+
+        Transmit collected message loop tasks to inspector frontend.
+        Now "Program" should be a top-level event on browsers that
+        support message loop instrumentation.
+        Frontend was changed so that user will not see any changes.
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        Added new event type - "Program"
+        (WebCore::InspectorTimelineAgent::willProcessTask):
+        Begin "Program" event.
+        (WebCore::InspectorTimelineAgent::didProcessTask):
+        Finish "Program" event.
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        Do not add counters to "Program" events.
+        (WebCore):
+        (WebCore::InspectorTimelineAgent::innerSetHeapSizeStatistic):
+        Renamed from "setHeapSizeStatistic"
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._onRecordAdded):
+        Unwraps "Program" events.
+        (WebInspector.MemoryStatistics.prototype._innerRecordAdded):
+        Renamed from "_onRecordAdded"
+        * inspector/front-end/TimelineFrameController.js:
+        (WebInspector.TimelineFrameController.prototype._addRecord):
+        Unwraps "Program" events.
+        (WebInspector.TimelineFrameController.prototype._innerAddRecord):
+        Renamed from "_addRecord"
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord):
+        Filter out "Program" category.
+        (WebInspector.TimelineCategoryStrips.prototype.update):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        Filter out "Program" category.
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        Unwraps "Program" events.
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.categories):
+        Added "Program" category.
+        (WebInspector.TimelinePresentationModel.recordStyle):
+        Ditto.
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+        Unwraps "Program" events.
+        (WebInspector.TimelinePresentationModel.prototype._addRecord):
+        Renamed from "addRecord"
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DerivedSources.pri:
+        * WebCore.pri:
+
+2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        inspector/debugger/script-snippet-model.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=90385
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptSnippetModel.js:
+
+2012-07-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        [REGRESSION] Crash when copying a StyleRuleMedia with a NULL m_mediaQueries
+        https://bugs.webkit.org/show_bug.cgi?id=90459
+
+        Reviewed by Andreas Kling.
+
+        Create StyleRuleMedia with a non-NULL MediaQuerySet. The respective NULL checks for it were all over the code,
+        except the copy constructor. Added the check, just in case.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createMediaRule):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleMedia::StyleRuleMedia):
+
+2012-07-03  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: display time intervals measured with console.time() and console.timeEnd() in Timeline
+        https://bugs.webkit.org/show_bug.cgi?id=90442
+
+        Reviewed by Pavel Feldman.
+
+        - added Time and TimeEnd record types produced by console.time() and console.timeEnd()
+        - connect Time to TimeEnd in "glue" mode to better visualize the interval;
+        - always make Time a top-level record;
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::startConsoleTimingImpl):
+        (WebCore::InspectorInstrumentation::stopConsoleTimingImpl):
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        (WebCore::InspectorTimelineAgent::didStartTiming):
+        (WebCore):
+        (WebCore::InspectorTimelineAgent::didStopTiming):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.recordStyle):
+        (WebInspector.TimelinePresentationModel.categoryForRecord):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+        (WebInspector.TimelinePresentationModel.prototype._findParentRecord):
+        (WebInspector.TimelinePresentationModel.Record):
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+
+2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
+
+        [Qt][Win] Fix broken QtWebKit5.lib linking
+        https://bugs.webkit.org/show_bug.cgi?id=88321
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * platform/PlatformExportMacros.h:
+
+2012-07-03  Philip Rogers  <pdr@google.com>
+
+        Fix text positioning with non-bmp characters.
+        https://bugs.webkit.org/show_bug.cgi?id=87681
+
+        Reviewed by Nikolas Zimmermann.
+
+        Previously when constructing metrics for tspans with non-bmp characters,
+        each non-bmp character treated as a skipped character in the same way that
+        spaces are ignored.
+        This made sense because the initial SVGCharacterDataMap for <text> is
+        indexed by character index (not string length) so the high portion of a
+        non-bmp character was treated as a skipped space. Unfortunately, this
+        led to a bug because skipped spaces lead to an offset in the positioning
+        values list but non-bmp characters do not.
+
+        This change switches the code to use a new offset for non-bmp characters,
+        surrogatePairCharacters, which does not affect the positioning values list.
+
+        Tests: svg/text/non-bmp-tspans-expected.svg
+               svg/text/non-bmp-tspans.svg
+
+        * rendering/svg/SVGTextMetricsBuilder.cpp:
+        (WebCore::SVGTextMetricsBuilder::measureTextRenderer):
+
+2012-07-03  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Improve test cases for network information APIs
+        https://bugs.webkit.org/show_bug.cgi?id=90162
+
+        Reviewed by Adam Barth.
+
+        Existing implementation doesn't test port implementation in network info APIs.
+        This patch lets test cases use bandwidth and metered functions implemented by port layer.
+
+        In addition, expected results need to check return type instead of property name.
+
+        No new tests. Covered by existing tests.
+
+        * Modules/networkinfo/NetworkInfoConnection.cpp:
+        (WebCore::NetworkInfoConnection::bandwidth):
+        (WebCore::NetworkInfoConnection::metered):
+
+2012-07-03  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [EFL] [WK2] Don't call eina_iterator_free() if iterator is NULL
+        https://bugs.webkit.org/show_bug.cgi?id=90076
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add a null check to prevent calling eina_iterator_free() when
+        iterator is NULL.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/efl/FileSystemEfl.cpp:
+        (WebCore::listDirectory): Early return when iterator is NULL.
+
+2012-07-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Elements] Text formatting is not retained when editing <script> or <style> contents as text
+        https://bugs.webkit.org/show_bug.cgi?id=90440
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditingTextNode):
+
+2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Save scroll selection and cursor position of SourceFrames in sources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=90294
+
+        Reviewed by Yury Semikhatsky.
+
+        Scroll and selection change handling is now delegated from TextViewer to SourceFrame.
+        SourceFrame now dispatches ScrollChanged and SelectionChanged events.
+        TabbedEditorContainer now saves scroll and selection information together
+        with the url history and restores scroll and selection on resource opening.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.wasShown):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._innerHighlightLineIfNeeded):
+        (WebInspector.SourceFrame.prototype._clearLineHighlight):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._innerRevealLineIfNeeded):
+        (WebInspector.SourceFrame.prototype._clearLineToReveal):
+        (WebInspector.SourceFrame.prototype.scrollToLine):
+        (WebInspector.SourceFrame.prototype._innerScrollToLineIfNeeded):
+        (WebInspector.SourceFrame.prototype._clearLineToScrollTo):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype._innerSetSelectionIfNeeded):
+        (WebInspector.SourceFrame.prototype._wasShownOrLoaded):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.commitEditing):
+        (WebInspector.SourceFrame.prototype.selectionChanged):
+        (WebInspector.SourceFrame.prototype.scrollChanged):
+        (WebInspector.TextViewerDelegateForSourceFrame.prototype.selectionChanged):
+        (WebInspector.TextViewerDelegateForSourceFrame.prototype.scrollChanged):
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer):
+        (WebInspector.TabbedEditorContainer.prototype._addScrollAndSelectionListeners):
+        (WebInspector.TabbedEditorContainer.prototype._removeScrollAndSelectionListeners):
+        (WebInspector.TabbedEditorContainer.prototype._scrollChanged):
+        (WebInspector.TabbedEditorContainer.prototype._selectionChanged):
+        (WebInspector.TabbedEditorContainer.prototype._appendFileTab):
+        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
+        (WebInspector.TabbedEditorContainer.HistoryItem):
+        (WebInspector.TabbedEditorContainer.HistoryItem.fromObject):
+        (WebInspector.TabbedEditorContainer.HistoryItem.prototype.serializeToObject):
+        (WebInspector.TabbedEditorContainer.History):
+        (WebInspector.TabbedEditorContainer.History.fromObject):
+        (WebInspector.TabbedEditorContainer.History.prototype.index):
+        (WebInspector.TabbedEditorContainer.History.prototype.selectionRange):
+        (WebInspector.TabbedEditorContainer.History.prototype.updateSelectionRange):
+        (WebInspector.TabbedEditorContainer.History.prototype.scrollLineNumber):
+        (WebInspector.TabbedEditorContainer.History.prototype.updateScrollLineNumber):
+        (WebInspector.TabbedEditorContainer.History.prototype.update):
+        (WebInspector.TabbedEditorContainer.History.prototype.remove):
+        (WebInspector.TabbedEditorContainer.History.prototype.save):
+        (WebInspector.TabbedEditorContainer.History.prototype.set _serializeToObject):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextRange.fromObject):
+        (WebInspector.TextRange.prototype.clone):
+        (WebInspector.TextRange.prototype.serializeToObject):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._handleScrollChanged):
+        (WebInspector.TextViewer.prototype.scrollToLine):
+        (WebInspector.TextViewer.prototype._handleSelectionChange):
+        (WebInspector.TextViewer.prototype.setSelection):
+        (WebInspector.TextViewer.prototype.wasShown):
+        (WebInspector.TextViewer.prototype._handleFocused):
+        (WebInspector.TextViewer.prototype.willHide):
+        (WebInspector.TextViewerDelegate.prototype.selectionChanged):
+        (WebInspector.TextViewerDelegate.prototype.scrollChanged):
+        (WebInspector.TextEditorChunkedPanel.prototype.scrollToLine):
+
+2012-07-03  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Make DirectoryContentView sortable
+        https://bugs.webkit.org/show_bug.cgi?id=90361
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        * inspector/front-end/DirectoryContentView.js:
+        (WebInspector.DirectoryContentView):
+        (WebInspector.DirectoryContentView.prototype.showEntries):
+        (WebInspector.DirectoryContentView.prototype._sort):
+        (WebInspector.DirectoryContentView.Node.comparator.isDirectoryCompare):
+        (WebInspector.DirectoryContentView.Node.comparator.nameCompare):
+        (WebInspector.DirectoryContentView.Node.comparator.typeCompare):
+        (WebInspector.DirectoryContentView.Node.comparator.sizeCompare):
+        (WebInspector.DirectoryContentView.Node.comparator):
+        (WebInspector.DirectoryContentView.Node.prototype._metadataReceived):
+
+2012-07-03  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: WebInspector.TextViewer should be renamed WebInspector.TextEditor
+        https://bugs.webkit.org/show_bug.cgi?id=89939
+
+        Reviewed by Vsevolod Vlasov.
+
+        Fixed LayoutTests and PerformanceTests accordingly.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame):
+        (WebInspector.JavaScriptSourceFrame.prototype._onHidePopover):
+        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
+        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointDecoration):
+        (WebInspector.JavaScriptSourceFrame.prototype._editBreakpointCondition.finishEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
+        (WebInspector.JavaScriptSourceFrame.prototype.clearExecutionLine):
+        (WebInspector.JavaScriptSourceFrame.prototype.onTextEditorContentLoaded):
+        (WebInspector.JavaScriptSourceFrame.prototype.toggleBreakpointOnCurrentLine):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.wasShown):
+        (WebInspector.SourceFrame.prototype.willHide):
+        (WebInspector.SourceFrame.prototype.defaultFocusedElement):
+        (WebInspector.SourceFrame.prototype.get textEditor):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._clearLineHighlight):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.onTextEditorContentLoaded):
+        (WebInspector.SourceFrame.prototype._setTextEditorDecorations):
+        (WebInspector.SourceFrame.prototype.searchCanceled):
+        (WebInspector.SourceFrame.prototype.jumpToSearchResult):
+        (WebInspector.SourceFrame.prototype.addMessageToSource):
+        (WebInspector.SourceFrame.prototype.removeMessageFromSource):
+        (WebInspector.SourceFrame.prototype.inheritScrollPositions):
+        (WebInspector.TextEditorDelegateForSourceFrame):
+        * inspector/front-end/TextViewer.js: Removed.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textViewer.css: Removed.
+
+2012-07-03  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        IndexedDB: should make the LevelDB persistant to the directory indicated in PageGroupSettings::indexedDBDataBasePath
+        https://bugs.webkit.org/show_bug.cgi?id=88338
+
+        Reviewed by David Levin.
+
+        If the indexedDB runs in main thread it can access the GroupSettings via the document;
+        otherwise, we need to pass the page GroupSettings to the worker thread so that accessible
+        to the indexedDB running in WorkerContext. 
+
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        * workers/DedicatedWorkerThread.h:
+        (DedicatedWorkerThread):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::groupSettings):
+        (WebCore):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/SharedWorkerThread.h:
+        (SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WorkerThreadStartupData):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::groupSettings):
+        (WebCore):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-07-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] fast/viewport/viewport-91.html still fails after r121555 and r121661
+        https://bugs.webkit.org/show_bug.cgi?id=90376
+
+        Reviewed by Csaba Osztrogonác.
+
+        No new tests, this is only a build alignment.
+
+        Export ViewportArguments::deprecatedTargetDPI since it is used in WebKit2.
+        * WebCore.exp.in:
+
+2012-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [TextureMapper] The TextureMapper should support edge-distance anti-antialiasing
+        https://bugs.webkit.org/show_bug.cgi?id=90308
+
+        Reviewed by Noam Rosenthal.
+
+        Add an edge-distance anti-aliasing implementation for the TextureMapper. Currently
+        this implementation is not active for tiled layers. This implementation is based
+        on the one in the Chromium compositor originally written by David Raveman.
+
+        When a layer is transformed in a way that leaves its edge dimensions across pixel
+        boundaries, edge distance anti-aliasing will do a cheaper form of anti-aliasing
+        than full-scene anti-aliasing to make the transition from the layer pixel
+        to the background pixel smoother.
+
+        No new tests. This will be covered by pixel tests for Qt and GTK+ accelerated
+        compositing and 3D transforms, when those test harnesses are capable of
+        producing pixel output (in progress).
+
+        * platform/graphics/texmap/TextureMapper.h: Add an enum which is used to tell
+        the texture mapper what edges of a texture are exposed. This will be used for
+        properly dealing with tiled layers in the future.
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp: Properly pass information
+        about exposed layer edges to the TextureMapper while painting.
+        * platform/graphics/texmap/TextureMapperBackingStore.h:
+        (TextureMapperTile): Modified arguments include exposed edges.
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawQuad): Renamed from drawRect, this method can now
+        draw quads that have non unit-rect texture coordinates. This is necessary because
+        the edge distance approach draws such quad.
+        (WebCore::TextureMapperGL::drawBorder): Call drawQuad now instead of drawRect.
+        (WebCore::TextureMapperGL::drawTexture): Pass the exposedEdges argument down.
+        (WebCore::TextureMapperGL::drawTextureRectangleARB): Call drawQuad now instead of
+        drawRect.
+        (WebCore::viewportMatrix): Added this helper which can calculate the viewport
+        transform based on the current OpenGL viewport settings.
+        (WebCore::scaleLineEquationCoeffecientsToOptimizeDistanceCalculation): Added this
+        helper which optimizes the fragment shader by precalculating some constant parts
+        of the distance calculation.
+        (WebCore::getStandardEquationCoeffecientsForLine): Given two end points of line segment
+        get the coeffecients of the line in the standard form of the line equation.
+        (WebCore::quadToEdgeArray): Converts a FloatQuad to an array of four sets of pre-scaled
+        line coefficients so that they can be passed to OpenGL.
+        (WebCore::scaledVectorDifference): Helper which helps expand a quad of arbitrary
+        orientation.
+        (WebCore::inflateQuad): Inflate a quad of arbitrary orientation. The transform may
+        flip it so we have to look at neighboring points to expand the quad.
+        (WebCore::TextureMapperGL::drawTextureWithAntialiasing): Activate the anti-aliasing
+        program and set up all uniforms.
+        (WebCore::TextureMapperGL::drawTexturedQuadWithProgram): Abstract out common operations
+        from drawTexture to be used with drawTextureWithAntialiasing.
+        * platform/graphics/texmap/TextureMapperGL.h:
+        (WebCore::TextureMapperGL::DrawQuad::DrawQuad): Add this small type which stores information
+        necessary to draw a quad -- it's original destination rect and the final size mapped to
+        texture coordinates.
+        (TextureMapperGL):
+        * platform/graphics/texmap/TextureMapperImageBuffer.cpp: Add the new exposedEdges argument.
+        * platform/graphics/texmap/TextureMapperImageBuffer.h: Ditto.
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Add the new fragment shader for
+        doing edge-distance AA and a program which uses that shader.
+        * platform/graphics/texmap/TextureMapperShaderManager.h: Ditto.
+
+2012-07-02  Dan Bernstein  <mitz@apple.com>
+
+        Column height and count calculation ignores most overflow
+        https://bugs.webkit.org/show_bug.cgi?id=90392
+
+        Reviewed by Dean Jackson.
+
+        Test: fast/multicol/overflow-content.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::relayoutForPagination): Changed to compute the overflow from children
+        and use the layout overflow height rather the content height.
+
+2012-07-02  Chris Guan  <chris.guan@torchmobile.com.cn>
+
+        [BlackBerry] Refactor : move the implementation of getMIMETypeForExtension and getPreferredExtensionForMIMEType into BlackBerry platform
+        https://bugs.webkit.org/show_bug.cgi?id=90360
+
+        Reviewed by Antonio Gomes.
+
+        We should have one implementation for getMIMETypeForExtension
+        and getPreferredExtensionForMIMEType for both webkit and platform,
+        so I move this implementation to BlackBerry platform.
+        
+        No new test cases , because no behavior changed.
+
+        * platform/blackberry/MIMETypeRegistryBlackBerry.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+
+2012-07-02  Emil A Eklund  <eae@chromium.org>
+
+        Position replaced elements on pixel bounds
+        https://bugs.webkit.org/show_bug.cgi?id=90354
+
+        Reviewed by Eric Seidel.
+
+        To avoid sizing and repaint issues we should layout replaced elements on
+        pixel bounds. We already ensure that replaced elements are sized in full
+        pixels and that they are painted on pixel bounds. By also ensuring that
+        they are placed on pixel bounds we avoid pixel having the size be
+        expanded by pixel snapping and repainting/invalidation rect issues when
+        scrolling.
+
+        Test: fast/repaint/repaint-during-scroll-with-zoom.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+
+2012-07-02  Nico Weber  <thakis@chromium.org>
+
+        Fix new -Wunused-private-field violations
+        https://bugs.webkit.org/show_bug.cgi?id=90417
+
+        Reviewed by Ryosuke Niwa.
+
+        No intended behavior change.
+
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
+        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
+        (CCPrioritizedTextureManager):
+
+2012-07-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Build fix for Chromimum
+
+        r121710 removed WebCore/platform/qt/GraphicsLayerQt.{cpp,h}.
+        However, that patch didn't remove them from WebCore.gypi.
+
+        * WebCore.gypi: Removed GraphicsLayerQt.{cpp,h}
+
+2012-07-02  Joshua Bell  <jsbell@chromium.org>
+
+        IDL overloads should not treat wrapper types as nullable by default
+        https://bugs.webkit.org/show_bug.cgi?id=90218
+
+        Reviewed by Kentaro Hara.
+
+        Wrapper types were being treated as Nullable by default during overloaded
+        method dispatching, which deviates from the WebIDL specification. This change
+        introduces the "?" type suffix into the parser, and treats wrapper types
+        only nullable if specified. (The behavior of array types and other non-wrapper
+        types are not changed, and only overloaded methods are checked.)
+
+        IDL files with affected overloads are modified to include the "?" suffix
+        so that no behavior changes are introduced by this patch - the JS and V8
+        generator results before/after the change show no diffs.
+
+        Test: bindings/scripts/test/TestObj.idl (a non-nullable overload)
+
+        * Modules/indexeddb/IDBDatabase.idl: Added "?" where necessary.
+        * Modules/indexeddb/IDBIndex.idl: Added "?" where necessary.
+        * Modules/indexeddb/IDBObjectStore.idl: Added "?" where necessary.
+        * Modules/webaudio/AudioContext.idl: Added "?" where necessary.
+        * Modules/webaudio/AudioNode.idl: Added "?" where necessary.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateParametersCheckExpression): Add isNullable check.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheckExpression): Add isNullable check.
+        * bindings/scripts/IDLParser.pm: Parse/set isNullable.
+        (parseParameters):
+        * bindings/scripts/IDLStructure.pm: Add basic type suffix parsing.
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
+        * bindings/scripts/test/TestObj.idl: Mark previous overload params with ?, add new one without.
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::overloadedMethod8Callback):
+        (TestObjV8Internal):
+        (WebCore::TestObjV8Internal::overloadedMethodCallback):
+        * dom/DataTransferItemList.idl: Added "?" where necessary.
+        * fileapi/WebKitBlobBuilder.idl: Added "?" where necessary.
+        * html/DOMURL.idl: Added "?" where necessary.
+        * html/canvas/CanvasRenderingContext2D.idl: Added "?" where necessary.
+        * html/canvas/WebGLRenderingContext.idl: Added "?" where necessary.
+
+2012-07-02  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Get rid of GraphicsLayerQt
+        https://bugs.webkit.org/show_bug.cgi?id=78598
+
+        Reviewed by Luiz Agostini.
+
+        Remove GraphicsLayerQt.h/cpp, as well as references to the non-TextureMapper code paths
+        in GraphicsContext3DQt and MediaPlayerPrivateQt.
+
+        No new tests, removing unused code paths.
+
+        * Target.pri:
+        * platform/graphics/PlatformLayer.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (GraphicsContext3DPrivate):
+        (WebCore):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore):
+        * platform/graphics/qt/GraphicsLayerQt.cpp: Removed.
+        * platform/graphics/qt/GraphicsLayerQt.h: Removed.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        (MediaPlayerPrivateQt):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::platformStart):
+
+2012-07-02  Behdad Esfahbod  <behdad@behdad.org>
+
+        LayoutUnit::epsilon() is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=90083
+
+        Reviewed by Eric Seidel.
+
+        Do division in floats, not integers.
+
+        No new tests. No code using the affected function.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::epsilon):
+
+2012-07-02  Tim Horton  <timothy_horton@apple.com>
+
+        Compositing layer sync should cause deferred repaints to be fired immediately
+        https://bugs.webkit.org/show_bug.cgi?id=90401
+        <rdar://problem/11792028>
+
+        Reviewed by Simon Fraser and Antti Koivisto.
+
+        If we sync compositing layers and allow the repaint to be deferred, there is time for a
+        visible flash to occur. Instead, stop the deferred repaint timer and repaint immediately.
+
+        No new tests, configuration and timing dependent.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateForThisFrame):
+        (WebCore::FrameView::checkStopDelayingDeferredRepaints):
+        (WebCore::FrameView::stopDelayingDeferredRepaints): Split off from checkStopDelayingDeferredRepaints.
+        * page/FrameView.h:
+        (FrameView): Add stopDelayingDeferredRepaints.
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        Initializating of the logging channels was taking time on startup. When logging is disabled
+        (and the LOG macro does nothing), we should aslo disable logging channels and initialization.
+
+        This patch #ifdef the Logging initialization with the macro LOG_DISABLED.
+
+        * WebCore.exp.in:
+        * make-export-file-generator: Explicitely adds Assertions.h so that LOG_DISABLED is defined.
+        * platform/Logging.cpp:
+        * platform/Logging.h:
+        * platform/blackberry/LoggingBlackBerry.cpp:
+        * platform/efl/LoggingEfl.cpp:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/mac/LoggingMac.mm:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+        * platform/qt/LoggingQt.cpp:
+        * platform/win/LoggingWin.cpp:
+        * platform/wx/LoggingWx.cpp:
+
+2012-07-02  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11787030> In vertical writing modes, child following float-clearing block has incorrect logical top
+        https://bugs.webkit.org/show_bug.cgi?id=90359
+
+        Reviewed by Anders Carlsson.
+
+        Test: fast/writing-mode/logical-height-after-clear.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloatsIfNeeded): Changed to use logicalTop() and logicalHeight()
+        instead of y() and height().
+
+2012-07-02  Arko Saha  <arko@motorola.com>
+
+        Microdata: Fix build failure after r121580.
+        https://bugs.webkit.org/show_bug.cgi?id=90378
+
+        Reviewed by Ryosuke Niwa.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::properties):
+        * html/HTMLElement.h:
+
+2012-07-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Update MediaStreamTrackList to match the specification
+        https://bugs.webkit.org/show_bug.cgi?id=90171
+
+        Reviewed by Adam Barth.
+
+        The latest update to the specification added add and remove methods with corresponding callbacks.
+        The callbacks can be triggered both from JS and from the platform layer.
+
+        Test: fast/mediastream/MediaStreamTrackList.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/MediaStream.cpp:
+        (WebCore::MediaStream::MediaStream):
+        (WebCore::MediaStream::~MediaStream):
+        (WebCore::MediaStream::streamEnded):
+        (WebCore::MediaStream::addTrack):
+        (WebCore):
+        (WebCore::MediaStream::removeTrack):
+        * Modules/mediastream/MediaStream.h:
+        (MediaStream):
+        * Modules/mediastream/MediaStreamTrackEvent.cpp: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp.
+        (WebCore):
+        (WebCore::MediaStreamTrackEvent::create):
+        (WebCore::MediaStreamTrackEvent::MediaStreamTrackEvent):
+        (WebCore::MediaStreamTrackEvent::~MediaStreamTrackEvent):
+        (WebCore::MediaStreamTrackEvent::track):
+        (WebCore::MediaStreamTrackEvent::interfaceName):
+        * Modules/mediastream/MediaStreamTrackEvent.h: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.h.
+        (WebCore):
+        (MediaStreamTrackEvent):
+        * Modules/mediastream/MediaStreamTrackEvent.idl: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl.
+        * Modules/mediastream/MediaStreamTrackList.cpp:
+        (WebCore::MediaStreamTrackList::create):
+        (WebCore::MediaStreamTrackList::MediaStreamTrackList):
+        (WebCore::MediaStreamTrackList::detachOwner):
+        (WebCore):
+        (WebCore::MediaStreamTrackList::add):
+        (WebCore::MediaStreamTrackList::remove):
+        (WebCore::MediaStreamTrackList::stop):
+        (WebCore::MediaStreamTrackList::interfaceName):
+        (WebCore::MediaStreamTrackList::scriptExecutionContext):
+        (WebCore::MediaStreamTrackList::eventTargetData):
+        (WebCore::MediaStreamTrackList::ensureEventTargetData):
+        * Modules/mediastream/MediaStreamTrackList.h:
+        (MediaStreamTrackList):
+        * Modules/mediastream/MediaStreamTrackList.idl:
+        * WebCore.gypi:
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventNames.in:
+        * dom/EventTargetFactory.in:
+        * platform/mediastream/MediaStreamCenter.cpp:
+        (WebCore::MediaStreamCenter::addMediaStreamTrack):
+        (WebCore):
+        (WebCore::MediaStreamCenter::removeMediaStreamTrack):
+        * platform/mediastream/MediaStreamCenter.h:
+        (MediaStreamCenter):
+        * platform/mediastream/MediaStreamDescriptor.h:
+        (MediaStreamDescriptorOwner):
+        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
+        (WebCore::MediaStreamCenterChromium::didAddMediaStreamTrack):
+        (WebCore):
+        (WebCore::MediaStreamCenterChromium::didRemoveMediaStreamTrack):
+        (WebCore::MediaStreamCenterChromium::addMediaStreamTrack):
+        (WebCore::MediaStreamCenterChromium::removeMediaStreamTrack):
+        * platform/mediastream/chromium/MediaStreamCenterChromium.h:
+        (WebKit):
+        (MediaStreamCenterChromium):
+        * platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp:
+        (WebCore::MediaStreamCenterGStreamer::didAddMediaStreamTrack):
+        (WebCore):
+        (WebCore::MediaStreamCenterGStreamer::didRemoveMediaStreamTrack):
+        * platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h:
+        (MediaStreamCenterGStreamer):
+
+2012-07-02  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: incorrect height of main timeline pane after switching to memory mode
+        https://bugs.webkit.org/show_bug.cgi?id=90387
+
+        Reviewed by Pavel Feldman.
+
+        - update cached container height when setting vertical splitter position.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.set _setSplitterPosition):
+
+2012-07-02  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [MICRODATA] Build failure in html/HTMLPropertiesCollection.h
+        https://bugs.webkit.org/show_bug.cgi?id=90379
+
+        Reviewed by Ryosuke Niwa.
+
+        Switch HTMLCollection::append() visibility from private
+        to protected so that HTMLPropertiesCollection subclass
+        can call it. This fixes build when MICRODATA flag is
+        turned on.
+
+        No new tests, build fix.
+
+        * html/HTMLCollection.h:
+        (HTMLCollectionCacheBase):
+
+2012-07-02  Kwang Yul Seo  <skyul@company100.net>
+
+        A start "body" tag in the "in body" insertion mode is a parse error
+        https://bugs.webkit.org/show_bug.cgi?id=90373
+
+        Reviewed by Eric Seidel.
+
+        According to HTML5 specification (http://www.w3.org/TR/html5/tree-construction.html#parsing-main-inbody),
+        a start "body" tag in the "in body" insertion mode is a parse error. So parseError(token) is required here.
+        No behavior change because parseError(token) is just a marker.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+
+2012-07-02  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [EFL] Unreviewed build fix with ENABLE_NETSCAPE_PLUGIN_API after r121467.
+
+        * plugins/efl/PluginPackageEfl.cpp:
+        (WebCore::PluginPackage::load): Move the declaration of `err'
+        before the first `goto' statement.
+
+2012-07-02  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: replace recursion with a stack in DOM nodes snapshot traversal.
+        https://bugs.webkit.org/show_bug.cgi?id=89889
+
+        Number of DOM nodes native snapshots can handle was limited
+        by the process stack size because of recursion used to traverse the nodes.
+        The patch changes the recursion to a stack based algorithm.
+
+        Reviewed by Yury Semikhatsky.
+
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (InstrumentedPointerBase):
+        (WebCore::MemoryInstrumentation::InstrumentedPointerBase::~InstrumentedPointerBase):
+        (InstrumentedPointer):
+        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
+        (WebCore::MemoryInstrumentation::reportInstrumentedPointer):
+        (WebCore):
+        (WebCore::::process):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-07-02  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add requestFileContent command and fileContentReceived event
+        https://bugs.webkit.org/show_bug.cgi?id=89642
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: http/tests/inspector/filesystem/read-file.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorFileSystemAgent::requestFileContent):
+        * inspector/InspectorFileSystemAgent.h:
+        (InspectorFileSystemAgent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype.requestMetadata):
+        (WebInspector.FileSystemModel.prototype.requestFileContent):
+        (WebInspector.FileSystemModel.File.prototype.get resourceType):
+        (WebInspector.FileSystemModel.File.prototype.requestFileContent):
+        (WebInspector.FileSystemRequestManager):
+        (WebInspector.FileSystemRequestManager.prototype._metadataReceived):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileContent.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileContent):
+        (WebInspector.FileSystemRequestManager.prototype._fileContentReceived):
+        (WebInspector.FileSystemDispatcher.prototype.metadataReceived):
+        (WebInspector.FileSystemDispatcher.prototype.fileContentReceived):
+
+2012-07-02  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add refresh button to FileSystemView status bar
+        https://bugs.webkit.org/show_bug.cgi?id=90244
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/FileSystemView.js:
+        (WebInspector.FileSystemView):
+        (WebInspector.FileSystemView.prototype.get statusBarItems):
+        (WebInspector.FileSystemView.prototype.showView):
+        (WebInspector.FileSystemView.prototype._refresh):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype._directoryContentReceived):
+
+2012-06-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Implement snippets evaluation.
+        https://bugs.webkit.org/show_bug.cgi?id=88707
+
+        Reviewed by Pavel Feldman.
+
+        Implemented snippet evaluation and adjusted breakpoints behavior when editing snippet.
+        Snippets are evaluated using separate compile and run.
+        Breakpoints are updated after compilation (once scriptId is available they can be set in debugger).
+        If separate compile and run is not supported by port or debugger is paused we fall back to evaluation in console.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.runScript.runCallback):
+        (WebInspector.ConsoleView.prototype.runScript):
+        (WebInspector.ConsoleView.prototype._printResult):
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource.prototype.supportsEnabledBreakpointsWhileEditing):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
+        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointsBeforeEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype._restoreBreakpointsAfterEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
+        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype.deleteScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._setScriptSnippetContent):
+        (WebInspector.ScriptSnippetModel.prototype.evaluateScriptSnippet.compileCallback):
+        (WebInspector.ScriptSnippetModel.prototype.evaluateScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._rawLocationToUILocation):
+        (WebInspector.ScriptSnippetModel.prototype._removeBreakpoints):
+        (WebInspector.ScriptSnippetModel.prototype._restoreBreakpoints):
+        (WebInspector.ScriptSnippetModel.prototype._evaluationSourceURL):
+        (WebInspector.SnippetJavaScriptSource.prototype.isDivergedFromVM):
+        (WebInspector.SnippetJavaScriptSource.prototype.workingCopyCommitted):
+        (WebInspector.SnippetJavaScriptSource.prototype.workingCopyChanged):
+        (WebInspector.SnippetJavaScriptSource.prototype.evaluate):
+        (WebInspector.SnippetJavaScriptSource.prototype.supportsEnabledBreakpointsWhileEditing):
+        (WebInspector.SnippetJavaScriptSource.prototype.breakpointStorageId):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.SnippetsNavigatorView.prototype._handleEvaluateSnippet):
+
+2012-06-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: StyleSource should set content using CSSStyleModelResourceBinding directly.
+        https://bugs.webkit.org/show_bug.cgi?id=89891
+
+        Reviewed by Pavel Feldman.
+
+        StyleSource now calls CSS resource binding directly.
+        CSS resource binding now adds resource revision only after setStyleSheetText call returns from backend.
+        Resource.revertAndClearHistory is now clearing history asynchronously
+        since Resource.setContent adds revision that should be removed as well.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getViaInspectorResourceForRule):
+        (WebInspector.CSSStyleModel.prototype.resourceBinding):
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent.innerCallback):
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent):
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setContent):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.revertAndClearHistory):
+        (WebInspector.Resource.prototype.revertAndClearHistory.clearHistory):
+        * inspector/front-end/RevisionHistoryView.js:
+        (WebInspector.RevisionHistoryView.prototype._createResourceItem):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSource.prototype.workingCopyCommitted):
+        (WebInspector.StyleSource.prototype.workingCopyChanged):
+
+2012-07-02  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add DirectoryContentView for FileSystemView
+        https://bugs.webkit.org/show_bug.cgi?id=89961
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/DirectoryContentView.js: Added.
+        * inspector/front-end/FileSystemView.js:
+        (WebInspector.FileSystemView):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype.onattach):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype.onselect):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype._directoryContentReceived):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-07-02  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Fix compilation error in GamepadsEfl.cpp in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=90369
+
+        Unreviewed, EFL build fix.
+
+        * platform/efl/GamepadsEfl.cpp:
+        (WebCore::GamepadsEfl::registerDevice):
+        (WebCore::GamepadsEfl::unregisterDevice):
+
+2012-07-02  Nikita Vasilyev  <me@elv1s.ru>
+
+        Web Inspector: Design WebSockets panel
+        https://bugs.webkit.org/show_bug.cgi?id=89461
+
+        Use DataGrid to display the data.
+        Put "Data" column first. Make it wider.
+        Remove "Mask" column since it appears to be always true for outgoing frames,
+        and false for incoming.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/NetworkItemView.js:
+        (WebInspector.NetworkItemView): Don't show Preview, Response, Cookies
+        and Timing tabs for succefuly established WebSocket connection.
+
+        * inspector/front-end/ResourceWebSocketFrameView.js:
+        (WebInspector.ResourceWebSocketFrameView):
+        * inspector/front-end/networkPanel.css:
+        (.resource-websocket):
+        (.resource-websocket, .resource-websocket .data-grid):
+        (.resource-websocket .data-grid .data):
+        (.resource-websocket td):
+        (.resource-websocket .data-column div):
+        (.resource-websocket-row-outcoming):
+        (.resource-websocket-row-outcoming:not(.selected) td):
+        (.resource-websocket-row-outcoming:not(.selected) td, .resource-websocket-row-outcoming:not(.selected) + tr td):
+        (.resource-websocket-row-opcode):
+        (.resource-websocket-row-opcode td):
+        (.resource-websocket-row-opcode td, .resource-websocket-row-opcode + tr td):
+        (.resource-websocket-row-error):
+
+2012-07-02  Vineet Chaudhary  <rgf748@motorola.com>
+
+        [V8Binding] Merging v8NumberArray()/v8NumberArrayToVector() to v8Array()/toNativeArray() respectively.
+        https://bugs.webkit.org/show_bug.cgi?id=90338
+
+        Reviewed by Kentaro Hara.
+
+        We can remove v8NumberArray() and v8NumberArrayToVector() implementaion
+        merging them to current v8Array() and toNativeArray() traits.
+
+        Tests: TestObj.idl
+        Shouldn't cause any behavioural changes.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Removed float[]/double[] specific binding code.
+        (IsRefPtrType):
+        (GetNativeType):
+        (JSValueToNative):
+        (NativeToJSValue):
+        * bindings/scripts/test/V8/V8TestObj.cpp: Rebased binding test.
+        (WebCore::TestObjV8Internal::floatArrayAttrGetter):
+        (WebCore::TestObjV8Internal::floatArrayAttrSetter):
+        (WebCore::TestObjV8Internal::doubleArrayAttrGetter):
+        (WebCore::TestObjV8Internal::doubleArrayAttrSetter):
+        * bindings/v8/V8Binding.h: Added templates for float and double.
+        (WebCore::v8Array):
+        (WebCore::toNativeArray):
+
+2012-07-02  Konrad Piascik  <kpiascik@rim.com>
+
+        [EFL] [GTK] [QT] fast/viewport/viewport-91.html is failing after r121555
+        https://bugs.webkit.org/show_bug.cgi?id=90286
+
+        Reviewed by Daniel Bates.
+
+        Since the deprecatedTargetDPI was an int and the deviceDPI was also an int the result
+        was truncated.  Changed deprecatedTargetDPI to a float value. Viewport test 91 now passes.
+
+        * dom/ViewportArguments.h:
+        (ViewportArguments):
+
+2012-06-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add v8 bindings memory info to the native memory graph
+        https://bugs.webkit.org/show_bug.cgi?id=90149
+
+        Reviewed by Pavel Feldman.
+
+        Size of V8 binding maps is now reported on the memory chart.
+
+        * bindings/js/ScriptProfiler.h:
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::reportMemoryUsage):
+        (WebCore):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore):
+        (DOMDataStore):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore::ChunkedTable::reportMemoryUsage):
+        (ChunkedTable):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        (WebCore):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
+        (WebCore):
+        (WebCore::StringCache::reportMemoryUsage):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        (StringCache):
+        (V8BindingPerIsolateData):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+        (AbstractWeakReferenceMap):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (WebCore):
+        (WebCore::MemoryInstrumentation::reportHashMap): added a method for reporting
+        size of a HashMap.
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::domTreeInfo):
+
+2012-07-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Add Gamepad support
+        https://bugs.webkit.org/show_bug.cgi?id=90170
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for the Gamepad feature on the EFL port.
+
+        The implementation of this class relies on the Linux
+        kernel joystick API.
+
+        Gamepad devices are recognized through the GamepadsEfl
+        class, of which implementation is based on Eeze
+        library. This way devices are properly registered on
+        connection as objects of the GamepadDeviceEfl class
+        which inherits GamepadDeviceLinux. GamepadDeviceEfl
+        reads the joystick data through an Ecore_Fd_Handler
+        and updates the device state accordingly. The
+        GamepadsEfl object is then polled for gamepads data
+        through the sampleGamepads method.
+
+        No new tests - already tested by gamepad/*
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake:
+        * platform/efl/GamepadsEfl.cpp: Added.
+        (WebCore):
+        (GamepadDeviceEfl):
+        (WebCore::GamepadDeviceEfl::create):
+        (WebCore::GamepadDeviceEfl::GamepadDeviceEfl):
+        (WebCore::GamepadDeviceEfl::~GamepadDeviceEfl):
+        (WebCore::GamepadDeviceEfl::readCallback):
+        (GamepadsEfl):
+        (WebCore::GamepadsEfl::onGamePadChange):
+        (WebCore::GamepadsEfl::GamepadsEfl):
+        (WebCore::GamepadsEfl::~GamepadsEfl):
+        (WebCore::GamepadsEfl::registerDevice):
+        (WebCore::GamepadsEfl::unregisterDevice):
+        (WebCore::GamepadsEfl::updateGamepadList):
+        (WebCore::sampleGamepads):
+
+2012-07-01  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed, rolling out r121635.
+        http://trac.webkit.org/changeset/121635
+        https://bugs.webkit.org/show_bug.cgi?id=90286
+
+        Breaks compile on clang error: in-class initializer for static
+        data member of type 'const float' is a GNU extension
+        [-Werror,-Wgnu]
+
+        * dom/ViewportArguments.h:
+        (ViewportArguments):
+
+2012-07-01  Timothy Hatcher  <timothy@apple.com>
+
+        Make the "Inspect Element" context menu item appear in nightly builds again.
+
+        rdar://problem/11702613
+        https://webkit.org/b/89323
+
+        Reviewed by Dan Bernstein.
+
+        * platform/ContextMenuItem.h:
+        Fix the order of the ContextMenuAction enum to be binary compatible with
+        older versions of WebKit.
+
+2012-07-01  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11785743> [mac] Non-BMP characters in vertical text appear as missing glyphs
+        https://bugs.webkit.org/show_bug.cgi?id=90349
+
+        Reviewed by Dean Jackson.
+
+        Test: platform/mac/fast/text/vertical-surrogate-pair.html
+
+        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
+        (WebCore::GlyphPage::fill): When calling wkGetVerticalGlyphsForCharacters or
+        CTFontGetGlyphsForCharacters with a buffer consisting of surrogate pair, account for those
+        functions’ behavior of placing glyphs at indices corresponding to the first character of
+        each pair.
+
+2012-07-01  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Arabic shaping is incorrect if ZWNJ exist
+        https://bugs.webkit.org/show_bug.cgi?id=89843
+
+        Reviewed by Dan Bernstein.
+
+        mac port treats ZWJ (zero-width-joiner) and ZWNJ (zero-width-non-joiner) as a part of combining
+        character sequence. This could cause a problem when the font doesn't have glyph mapping of ZWJ and ZWNJ.
+        Suppose the text to be rendered is "U+0645(MEEM) U+06CC(FARSI YEH) U+200C(ZWNJ)". In this case, U+0645
+        and U+06CC are rendered in isolated form if the font doesn't have a glyph for ZWNJ. They should be joined.
+
+        This patch changes handling of ZWJ and ZWNJ. Treats ZWJ and ZWNJ as base characters so that a complex text
+        run isn't separate at the point of ZWJ and ZWNJ even the font doesn't contain glyphs for them.
+        If ComplexTextController finds ZWJ, it doesn't split the current complex text run.
+
+        Test: platform/mac/fast/text/arabic-zwj-and-zwnj.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::advanceByCombiningCharacterSequence): Don't treat ZWJ and ZWNJ as a part of combining character sequence.
+        (WebCore::ComplexTextController::collectComplexTextRuns): Set fontData to nextFontData if the baseCharacter is ZWJ.
+
+2012-07-01  Konrad Piascik  <kpiascik@rim.com>
+
+        [EFL] [GTK] [QT] fast/viewport/viewport-91.html is failing after r121555
+        https://bugs.webkit.org/show_bug.cgi?id=90286
+
+        Reviewed by Daniel Bates.
+
+        Since the deprecatedTargetDPI was an int and the deviceDPI was also an int the result
+        was truncated.  Changed deprecatedTargetDPI to a float value. Viewport test 91 now passes.
+
+        * dom/ViewportArguments.h:
+        (ViewportArguments):
+
+2012-06-30  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] CanvasLayerTextureUpdater needs to convert opaque rects back to content space.
+        https://bugs.webkit.org/show_bug.cgi?id=90092
+
+        The CanvasLayerTextureUpdater currently receives its opaque rects in
+        layer space, but is expected to return them in content space and does
+        not convert them. This patch adds this conversion. To avoid numerical
+        errors, this patch also switches to using float rects to store opaque
+        rects where appropriate.
+
+        Reviewed by Adrienne Walker.
+
+        Unit test: ContentLayerTest.ContentLayerPainterWithDeviceScale
+
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        (WebCore::CanvasLayerTextureUpdater::paintContents):
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerPainter::ContentLayerPainter):
+        (WebCore::ContentLayerPainter::create):
+        (WebCore::ContentLayerPainter::paint):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (WebCore):
+        (ContentLayerDelegate):
+        (ContentLayerPainter):
+        * platform/graphics/chromium/LayerPainterChromium.h:
+        (WebCore):
+        (LayerPainterChromium):
+        * platform/graphics/chromium/LinkHighlight.cpp:
+        (WebCore::LinkHighlight::paintContents):
+        * platform/graphics/chromium/LinkHighlight.h:
+        (LinkHighlight):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
+        (OpaqueRectTrackingContentLayerDelegate):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+
+2012-06-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Unreviewed. Remove unused declaration.
+        HTMLDocumentParser::begin() has no method definition.
+
+        * html/parser/HTMLDocumentParser.h:
+
+2012-06-29  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Unreviewed, rolling out r121569.
+        http://trac.webkit.org/changeset/121569
+        https://bugs.webkit.org/show_bug.cgi?id=90082
+
+        It broke a couple of tests in Qt Linux Release
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+
+2012-06-29  Simon Fraser  <simon.fraser@apple.com>
+
+        updateDescendantDependentFlags() is inside #if USE(ACCELERATED_COMPOSITING)
+        https://bugs.webkit.org/show_bug.cgi?id=90245
+
+        Reviewed by Dan Bernstein.
+
+        updateDescendantDependentFlags() and updateTransform() should be
+        outside the USE(ACCELERATED_COMPOSITING) #ifdef. They do work
+        that is needed even if accelerated compositing is disabled.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+
+2012-06-29  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] HTMLCollection wrappers are not retained
+        https://bugs.webkit.org/show_bug.cgi?id=90208
+
+        Reviewed by Adam Barth.
+
+        Generate visitDOMWrapper for HTMLCollection and HTMLAllCollection so that we add an implicit reference from the owner
+        to the collection.
+
+        Tests: fast/dom/htmlallcollection-reachable.html
+               fast/dom/htmlcollection-reachable.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation): Instead of hard coding to use base() for HTMLAllCollection and HTMLCollection we now
+        annotate the IDL file to use GenerateIsReachable=ImplBaseRoot.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateVisitDOMWrapper): Generate visitDOMWrapper if GenerateIsReachable is ImplBaseRoot.
+        * bindings/scripts/IDLAttributes.txt: Added ImplBaseRoot.
+        * html/HTMLAllCollection.idl: Added annotations.
+        * html/HTMLCollection.idl: Ditto.
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        All child elements of a flex container should be turned into a flex item
+        https://bugs.webkit.org/show_bug.cgi?id=90323
+
+        Reviewed by Ojan Vafai.
+
+        We used to only convert some elements to blocks, but now we convert everything except text nodes.
+        This was recently changed here:
+        http://wiki.csswg.org/topics/css3-flexbox-flexbox-replaced-children
+
+        Tests: css3/flexbox/anonymous-block.html : Add new test case.
+               css3/flexbox/flexitem.html: Update results.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Keep direction on IDBCursor to avoid calls to back end
+        https://bugs.webkit.org/show_bug.cgi?id=90114
+
+        Reviewed by Tony Chang.
+
+        Let IDBCursor handle direction() accessor locally, without a call to
+        the IDBCursorBackendImpl which (in some ports) may reside in a different
+        process. Not a heavily called function, but further reduces the surface
+        area exposed by the XXXInterface classes.
+
+        No new tests - no functional changes.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::create): Accept direction, known at creation time.
+        (WebCore::IDBCursor::IDBCursor): Stash in member.
+        (WebCore::IDBCursor::direction): Use local copy
+        (WebCore::IDBCursor::stringToDirection): Return enum value, not int.
+        * Modules/indexeddb/IDBCursor.h:
+        (IDBCursor):
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp: Remove accessor.
+        * Modules/indexeddb/IDBCursorBackendImpl.h:
+        (IDBCursorBackendImpl):
+        * Modules/indexeddb/IDBCursorBackendInterface.h: Remove accessor.
+        * Modules/indexeddb/IDBCursorWithValue.cpp:
+        (WebCore::IDBCursorWithValue::create):
+        (WebCore::IDBCursorWithValue::IDBCursorWithValue):
+        * Modules/indexeddb/IDBCursorWithValue.h:
+        (IDBCursorWithValue):
+        * Modules/indexeddb/IDBIndex.cpp: Prep IDBRequest with cursor direction too.
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::openKeyCursor):
+        * Modules/indexeddb/IDBObjectStore.cpp: Ditto.
+        (WebCore::IDBObjectStore::openCursor):
+        * Modules/indexeddb/IDBRequest.cpp: Stash direction for pending cursor too.
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::setCursorDetails):
+        (WebCore::IDBRequest::onSuccess): Apply stashed direction to new cursor.
+        * Modules/indexeddb/IDBRequest.h:
+        (IDBRequest):
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        Allow align-self: stretch to cause the item size to shrink below its intrinsic size
+        https://bugs.webkit.org/show_bug.cgi?id=90304
+
+        Reviewed by Ojan Vafai.
+
+        The spec used to say that stretch could only make items grow, but now
+        it allows items to shrink.
+        http://dev.w3.org/csswg/css3-flexbox/#align-items-stretch
+
+        Tests: css3/flexbox/flex-align-stretch.html Updated expectations.
+               css3/flexbox/child-overflow.html Updated expectations.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild):
+
+2012-06-29  James Weatherall  <wez@chromium.org>
+
+        NPObjectWrapper may not address all window script object lifetime issues
+        https://bugs.webkit.org/show_bug.cgi?id=85679
+
+        The ScriptController implementations force-deallocate the window script object to ensure that DOM objects are not leaked if an NPAPI plugin fails to release a reference to it before being destroyed. The NPObjectWrapper was added to ensure that NPAPI scripting could not touch the real window script object after it had been deallocated, by providing the plugin with a small wrapper which will leak if the plugin fails to dereference it.
+
+        This patch removes NPObjectWrapper and instead drops the window script NPObject's reference to the underlying V8Object in ScriptController::clearScriptObjects(). If a plugin fails to dereference the object then the NPV8Object wrapper will be leaked but the DOM objects it references will not.
+
+        Reviewed by Nate Chapin.
+
+        Test: plugins/npruntime/leak-window-scriptable-object.html
+
+        * WebCore.gypi:
+        * bindings/v8/NPObjectWrapper.cpp: Removed.
+        * bindings/v8/NPObjectWrapper.h: Removed.
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::disposeUnderlyingV8Object):
+        (WebCore):
+        (WebCore::freeV8NPObject):
+        (_NPN_Invoke):
+        (_NPN_InvokeDefault):
+        (_NPN_EvaluateHelper):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bindings/v8/NPV8Object.h:
+        (WebCore):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::clearScriptObjects):
+        (WebCore::ScriptController::windowScriptNPObject):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+
+2012-06-29  Adam Barth  <abarth@webkit.org>
+
+        Update complex fonts on Android to use fonts from a newer SDK
+        https://bugs.webkit.org/show_bug.cgi?id=90296
+
+        Reviewed by Nate Chapin.
+
+        These fonts are available in the Jelly Bean SDK.
+
+        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
+        (WebCore::ComplexTextController::ComplexTextController):
+        (WebCore::ComplexTextController::getComplexFontPlatformData):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        HTMLCollection's caches should be owned by either ElementRareData or Document
+        https://bugs.webkit.org/show_bug.cgi?id=90322
+
+        Reviewed by Anders Carlsson.
+
+        Removed all instances of OwnPtr<HTMLCollection> except ones on ElementRareData and Document.
+        ElementRareData::ensureCachedHTMLCollection then polymorphically creates HTMLCollection or
+        its subclass as deemed necessary.
+
+        This refactoring allows us to move HTMLCollection to use the same invalidation model as
+        DynamicNodeList (invalidated during DOM mutations) in a follow up.
+
+        * dom/Document.cpp:
+        (WebCore::Document::all):
+        * dom/Document.h:
+        (Document):
+        * dom/Element.cpp:
+        (WebCore::ElementRareData::ensureCachedHTMLCollection):
+        (WebCore):
+        (WebCore::Element::cachedHTMLCollection):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementRareData.h:
+        (WebCore):
+        (ElementRareData):
+        (WebCore::ElementRareData::cachedHTMLCollection):
+        * dom/Node.cpp:
+        (WebCore):
+        * dom/Node.h:
+        (Node):
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::setItemType):
+        (NodeRareData):
+        * html/CollectionType.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::shouldIncludeChildren):
+        (WebCore::HTMLCollection::isAcceptableElement):
+        * html/HTMLElement.cpp:
+        (WebCore):
+        (WebCore::HTMLElement::properties):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::elements):
+        * html/HTMLFieldSetElement.h:
+        (HTMLFieldSetElement):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::HTMLFormCollection):
+        (WebCore::HTMLFormCollection::create):
+        * html/HTMLFormCollection.h:
+        (HTMLFormCollection):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::elements):
+        * html/HTMLFormElement.h:
+        * html/HTMLOptionsCollection.cpp:
+        (WebCore::HTMLOptionsCollection::HTMLOptionsCollection):
+        (WebCore::HTMLOptionsCollection::create):
+        * html/HTMLOptionsCollection.h:
+        (HTMLOptionsCollection):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedOptions):
+        (WebCore::HTMLSelectElement::options):
+        (WebCore::HTMLSelectElement::invalidateSelectedItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::rows):
+        * html/HTMLTableElement.h:
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection):
+        (WebCore::HTMLTableRowsCollection::create):
+        * html/HTMLTableRowsCollection.h:
+        (HTMLTableRowsCollection):
+
+2012-06-29  Ojan Vafai  <ojan@chromium.org>
+
+        Add FIXMEs for vertical writing mode and override sizes.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::overrideLogicalContentWidth):
+        (WebCore::RenderBox::overrideLogicalContentHeight):
+
+2012-06-29  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use CCThread::Task in compositor's RateLimiter instead of Timer
+        https://bugs.webkit.org/show_bug.cgi?id=90300
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/RateLimiter.cpp:
+        (RateLimiter::Task):
+        (WebCore::RateLimiter::Task::create):
+        (WebCore::RateLimiter::Task::~Task):
+        (WebCore::RateLimiter::Task::Task):
+        (WebCore):
+        (WebCore::RateLimiter::RateLimiter):
+        (WebCore::RateLimiter::start):
+        (WebCore::RateLimiter::stop):
+        (WebCore::RateLimiter::rateLimitContext):
+        * platform/graphics/chromium/RateLimiter.h:
+        (WebCore):
+        (RateLimiter):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):
+
+2012-06-29  Tony Payne  <tpayne@chromium.org>
+
+        Remove type from screenColorProfile API
+        https://bugs.webkit.org/show_bug.cgi?id=90299
+
+        Reviewed by Adam Barth.
+
+        Covered by existing tests.
+
+        * platform/PlatformScreen.h:
+        (WebCore): Removed type from screenColorProfile().
+        * platform/blackberry/PlatformScreenBlackBerry.cpp:
+        (WebCore::screenColorProfile):
+        * platform/chromium/PlatformScreenChromium.cpp:
+        (WebCore::screenColorProfile):
+        * platform/efl/PlatformScreenEfl.cpp:
+        (WebCore::screenColorProfile):
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::screenColorProfile):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Updated call to
+        screenColorProfile() to not pass type param.
+        * platform/mac/PlatformScreenMac.mm:
+        (WebCore::screenColorProfile):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenColorProfile):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::screenColorProfile):
+
+2012-06-29  Emil A Eklund  <eae@chromium.org>
+
+        Allow non-borders to be adjusted to less than 1 when zoomed out
+        https://bugs.webkit.org/show_bug.cgi?id=90104
+
+        Reviewed by Eric Seidel.
+
+        Change CSSPrimitiveValue::computeLengthDouble to allow values to be
+        adjusted to less than 1.0 when zoomed out. This avoids an off by one
+        error for floats with margins when zoomed out that can cause floats to
+        wrap and break pages.
+
+        The logic that prevents the value from being adjusted to less than 1 was
+        added to ensure that borders are still painted even when zoomed out.
+        By moving the logic to ApplyPropertyComputeLength::applyValue, which is
+        used for borders and outlines, that functionality is preserved.
+
+        Test: fast/sub-pixel/float-with-margin-in-container.html
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        * css/StyleBuilder.cpp:
+        (WebCore::ApplyPropertyComputeLength::applyValue):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Let Xcode have its own way after r121513.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-06-29  Mihai Balan  <mibalan@adobe.com>
+
+        [CSS Regions] Adding feature defines for CSS Regions for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=88645
+
+        Reviewed by Tony Chang.
+
+        Re-trying to enable CSS regions on Windows. This time only enabling
+        regions (not exclusions) because of some strange compilation/linking
+        issues.
+
+        * css/CSSPropertyNames.in: Touched file to make sure property names get properly rebuilt.
+
+2012-06-29  Hanna Ma  <Hanma@rim.com>
+
+        Web Inspector: Add data length to resource events on timeline to
+        keep track of the amount of data loaded and the total data length
+        https://bugs.webkit.org/show_bug.cgi?id=89244
+
+        Reviewed by Pavel Feldman.
+
+        Added data length to inspector timeline popup
+        content for resources to keep track of the amount of data loaded.
+        Tests: inspector/timeline/timeline-network-received-data.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willReceiveResourceDataImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willReceiveResourceData):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willReceiveResourceData):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createReceiveResourceData):
+        * inspector/TimelineRecordFactory.h:
+        (TimelineRecordFactory):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.Record):
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveData):
+        * inspector/timeline/timeline-network-received-data.html: Added.
+        * inspector/timeline/timeline-network-received-data-expected.txt: Added.
+        * inspector/timeline/timeline-test.js:
+
+2012-06-29  Shawn Singh  <shawnsingh@chromium.org>
+
+        Unreviewed build fix after 121580.
+
+        WebKit Linux debug bots was complaining about signed vs unsigned integer comparison.
+
+        * html/HTMLCollection.h:
+        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove mapRect and mapQuad from WebTransformationMatrix
+        https://bugs.webkit.org/show_bug.cgi?id=90230
+
+        Reviewed by Adrienne Walker.
+
+        Replaces calls to WebTransformationMatrix::mapRect/mapQuad with clipping-aware calls to CCMathUtils. In most
+        cases, we do not expect clipping to happen. For others (such as area calculations in CCOverdrawMetrics) we can
+        handle a clipped quad easily.
+
+        * platform/chromium/support/WebTransformationMatrix.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        (WebCore::LayerRendererChromium::drawTileQuad):
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::drawableContentRect):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::getDrawRect):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::transformSurfaceOpaqueRegion):
+        (WebCore::addOcclusionBehindLayer):
+        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
+        (WebCore):
+        (WebCore::polygonArea):
+        (WebCore::areaOfMappedQuad):
+        (WebCore::CCOverdrawMetrics::didUpload):
+        (WebCore::CCOverdrawMetrics::didCullForDrawing):
+        (WebCore::CCOverdrawMetrics::didDraw):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::appendQuadsToFillScreen):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawableContentRect):
+        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
+        (WebCore::CCSharedQuadState::isLayerAxisAlignedIntRect):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix after r121575. It rolls out r121547 but didn't roll out the follow up build fix r121553.
+
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        (FontCustomPlatformData):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Share the same cache in HTMLCollection and DynamicNodeLists
+        https://bugs.webkit.org/show_bug.cgi?id=90118
+
+        Reviewed by Anders Carlsson.
+
+        This patch introduces two new base classes DynamicNodeListCacheBase and HTMLCollectionCacheBase to share
+        the cache object between DynamicNodeList and HTMLCollection. HTMLCollectionCacheBase inherits from
+        DynamicNodeListCacheBase and contains extra caches and bit flags for HTMLCollection. DynamicNodeList::Cache
+        and HTMLCollection::Cache had been removed and flattened into these two classes for the easy inheritance.
+
+        In DynamicNodeList, we have a very straight forward one-to-one mapping from old Caches member variables:
+
+        m_caches.lastItem -> cachedItem()
+        m_caches.lastItemOffset -> cachedItemOffset()
+        m_caches.cachedLength -> cachedLength()
+        m_caches.isItemCacheValid -> isItemCacheValid()
+        m_caches.isLengthCacheValid -> isLengthCacheValid()
+        m_caches.type -> removed because it was never used.
+        m_caches.rootedAtDocument -> isRootedAtDocument()
+        m_caches.shouldInvalidateOnAttributeChange -> shouldInvalidateOnAttributeChange()
+
+        In HTMLCollection, there is one semantic change in the way item cache is managed. Previously, we only had
+        m_cache.current which was used as both cachedItem() and isItemCacheValid() (not valid when current is null).
+        There are some asymmetric code changes due to one-to-many relationship. Also, all method names have been updated
+        to use that of DynamicNodeList terminology. Thus we have the following correspondence:
+
+        m_cache.current -> cachedItem() / isItemCacheValid()
+        m_cache.position -> cachedItemOffset()
+        m_cache.length -> cachedLength()
+        m_cache.elementsArrayPosition -> cachedElementsArrayOffset()
+        m_cache.hasLength -> isLengthCacheValid()
+        m_cache.hasNameCache -> hasNameCache() / setHasNameCache()
+        m_cache.idCache -> idCache() / addIdCache()
+        m_cache.nameCache -> idCache() / addNameCache()
+
+        In addition, we had to rename HTMLCollection::clearCache to invalidateCache to avoid the name collision with
+        HTMLCollectionCacheBase::clearCache.
+
+        * dom/ChildNodeList.cpp:
+        (WebCore::ChildNodeList::length):
+        (WebCore::ChildNodeList::item):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicSubtreeNodeList::length):
+        (WebCore::DynamicSubtreeNodeList::itemForwardsFromCurrent):
+        (WebCore::DynamicSubtreeNodeList::itemBackwardsFromCurrent):
+        (WebCore::DynamicSubtreeNodeList::item):
+        * dom/DynamicNodeList.h:
+        (DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument):
+        (WebCore::DynamicNodeListCacheBase::shouldInvalidateOnAttributeChange):
+        (WebCore::DynamicNodeListCacheBase::isItemCacheValid):
+        (WebCore::DynamicNodeListCacheBase::cachedItem):
+        (WebCore::DynamicNodeListCacheBase::cachedItemOffset):
+        (WebCore::DynamicNodeListCacheBase::isLengthCacheValid):
+        (WebCore::DynamicNodeListCacheBase::cachedLength):
+        (WebCore::DynamicNodeListCacheBase::setLengthCache):
+        (WebCore::DynamicNodeListCacheBase::setItemCache):
+        (WebCore::DynamicNodeListCacheBase::clearCache):
+        (WebCore):
+        (WebCore::DynamicNodeList::DynamicNodeList):
+        (WebCore::DynamicNodeList::invalidateCache):
+        (WebCore::DynamicNodeList::rootNode):
+        (DynamicNodeList):
+        * html/HTMLAllCollection.cpp:
+        (WebCore::HTMLAllCollection::namedItemWithIndex):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::HTMLCollection):
+        (WebCore::HTMLCollection::invalidateCacheIfNeeded):
+        (WebCore::HTMLCollection::invalidateCache):
+        (WebCore::HTMLCollection::isAcceptableElement):
+        (WebCore::HTMLCollection::itemAfter):
+        (WebCore::HTMLCollection::length):
+        (WebCore::HTMLCollection::item):
+        (WebCore::HTMLCollection::checkForNameMatch):
+        (WebCore::HTMLCollection::namedItem):
+        (WebCore::HTMLCollection::updateNameCache):
+        (WebCore::HTMLCollection::hasNamedItem):
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollectionCacheBase::append):
+        * html/HTMLCollection.h:
+        (HTMLCollectionCacheBase):
+        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
+        (WebCore::HTMLCollectionCacheBase::type):
+        (WebCore::HTMLCollectionCacheBase::clearCache):
+        (WebCore::HTMLCollectionCacheBase::setItemCache):
+        (WebCore::HTMLCollectionCacheBase::cachedElementsArrayOffset):
+        (WebCore::HTMLCollectionCacheBase::includeChildren):
+        (WebCore::HTMLCollectionCacheBase::cacheTreeVersion):
+        (WebCore::HTMLCollectionCacheBase::idCache):
+        (WebCore::HTMLCollectionCacheBase::nameCache):
+        (WebCore::HTMLCollectionCacheBase::appendIdCache):
+        (WebCore::HTMLCollectionCacheBase::appendNameCache):
+        (WebCore::HTMLCollectionCacheBase::hasNameCache):
+        (WebCore::HTMLCollectionCacheBase::setHasNameCache):
+        (WebCore):
+        (WebCore::HTMLCollection::isEmpty):
+        (WebCore::HTMLCollection::hasExactlyOneItem):
+        (WebCore::HTMLCollection::base):
+        (HTMLCollection):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::item):
+        (WebCore::HTMLFormCollection::updateNameCache):
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::itemAfter):
+        * html/HTMLNameCollection.h:
+        (HTMLNameCollection):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::invalidateSelectedItems):
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::itemAfter):
+        * html/HTMLTableRowsCollection.h:
+        (HTMLTableRowsCollection):
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r121572.
+        http://trac.webkit.org/changeset/121572
+        https://bugs.webkit.org/show_bug.cgi?id=90249
+
+        Breaks Mac build since it depends on r121547, which was rolled
+        out
+
+        * WebCore.exp.in:
+        * page/AlternativeTextClient.h:
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::populate):
+        * platform/graphics/cg/ImageBufferDataCG.h:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawLineForDocumentMarker):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::setClosedCaptionsVisible):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/network/Credential.h:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore):
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+        * platform/text/TextChecking.h:
+        (WebCore):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::containsPaintedContent):
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r121547.
+        http://trac.webkit.org/changeset/121547
+        https://bugs.webkit.org/show_bug.cgi?id=90256
+
+        Breaks Chromium Mac build
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::imageTitle):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setAllowsFontSmoothing):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::boundingRect):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore):
+        (WebCore::canSetCascadeListForCustomFont):
+        (WebCore::FontPlatformData::ctFont):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/mac/ComplexTextController.cpp:
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore):
+        (WebCore::fontCacheATSNotificationCallback):
+        (WebCore::FontCache::platformInit):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/mac/WebLayer.h:
+        * platform/mac/CursorMac.mm:
+        (WebCore::Cursor::ensurePlatformCursor):
+        * platform/mac/DisplaySleepDisabler.cpp:
+        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
+        (WebCore):
+        (WebCore::DisplaySleepDisabler::systemActivityTimerFired):
+        * platform/mac/DisplaySleepDisabler.h:
+        (DisplaySleepDisabler):
+        * platform/mac/HTMLConverter.h:
+        * platform/mac/HTMLConverter.mm:
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenuMac::populate):
+        * platform/mac/ScrollElasticityController.mm:
+
+2012-06-29  Eric Penner  <epenner@google.com>
+
+        [chromium] Adding PrioritizedTexture and replacing ContentsTextureManager
+        https://bugs.webkit.org/show_bug.cgi?id=84308
+
+        Reviewed by Adrienne Walker.
+
+        PrioritizedTextures have a priority such that all texture requests can be
+        prioritized. There are three steps involved:
+            - Call setRequestPriority()
+            - Check if the request succeeded with canAcquireBackingTexture()
+            - Call acquireBackingTexture() when uploading a new texture.
+
+        Internally both the texture requests and the backing textures get sorted.
+        Requests are sorted so they can be prioritized. Backing textures are sorted
+        so that they can be recycled/evicted in the right order (lowest priority first).
+
+        Prioritizing textures doesn't assign backing textures to texture requests but
+        rather just marks which textures can have a backing texture "when needed". This
+        allows us to keep the old textures in use as long as possible.
+
+        The unit tests support all the use cases from the original texture manager
+        but also adds assumptions about priority order throughout all the tests. The
+        function assertInvariants() is added to test the validity of the manager
+        and all textures/allocations within it.
+
+        The TiledLayerChromium tests are updated to request textures first with
+        prioritizeTextures(), and update them with the updater (such that allocate
+        gets called) before pushPropertiesTo is called (when they need to be valid).
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapCanvasLayerTextureUpdater::Texture::Texture):
+        (WebCore::BitmapCanvasLayerTextureUpdater::createTexture):
+        (WebCore::BitmapCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
+        (WebCore):
+        (Texture):
+        (BitmapCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::Texture):
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::createTexture):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        (Texture):
+        (BitmapSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::setTexturePriorities):
+        (WebCore):
+        (WebCore::ContentLayerChromium::update):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (ContentLayerChromium):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::createAcceleratedCanvas):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::Texture):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::createTexture):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
+        (Texture):
+        (FrameBufferSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerTextureUpdater::Texture::Texture):
+        (WebCore::ImageLayerTextureUpdater::createTexture):
+        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
+        (WebCore::ImageLayerChromium::setTexturePriorities):
+        (WebCore):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        (ImageLayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        (WebCore::LayerChromium::setTexturePriorities):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        (WebCore::LayerTextureUpdater::Texture::texture):
+        (WebCore::LayerTextureUpdater::Texture::swapTextureWith):
+        (WebCore::LayerTextureUpdater::Texture::Texture):
+        (Texture):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
+        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
+        (WebCore::ScrollbarLayerChromium::updatePart):
+        (WebCore):
+        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::UpdatableTile::managedTexture):
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        (WebCore::TiledLayerChromium::textureManager):
+        (WebCore::TiledLayerChromium::createTile):
+        (WebCore::TiledLayerChromium::tileNeedsBufferedUpdate):
+        (WebCore::TiledLayerChromium::updateTiles):
+        (WebCore::TiledLayerChromium::setTexturePriorities):
+        (WebCore):
+        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
+        (WebCore::TiledLayerChromium::resetUpdateState):
+        (WebCore::TiledLayerChromium::updateLayerRect):
+        (WebCore::TiledLayerChromium::idleUpdateLayerRect):
+        (WebCore::TiledLayerChromium::needsIdlePaint):
+        (WebCore::TiledLayerChromium::idlePaintRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::deleteContentsTexturesOnImplThread):
+        (WebCore::CCLayerTreeHost::beginCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::commitComplete):
+        (WebCore::CCLayerTreeHost::evictAllContentTextures):
+        (WebCore::CCLayerTreeHost::contentsTextureManager):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::prioritizeTextures):
+        (WebCore::CCLayerTreeHost::deleteTextureAfterCommit):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCPrioritizedTexture.cpp: Added.
+        (WebCore):
+        (WebCore::CCPrioritizedTexture::CCPrioritizedTexture):
+        (WebCore::CCPrioritizedTexture::~CCPrioritizedTexture):
+        (WebCore::CCPrioritizedTexture::setTextureManager):
+        (WebCore::CCPrioritizedTexture::setDimensions):
+        (WebCore::CCPrioritizedTexture::requestLate):
+        (WebCore::CCPrioritizedTexture::acquireBackingTexture):
+        (WebCore::CCPrioritizedTexture::textureId):
+        (WebCore::CCPrioritizedTexture::bindTexture):
+        (WebCore::CCPrioritizedTexture::framebufferTexture2D):
+        (WebCore::CCPrioritizedTexture::setCurrentBacking):
+        * platform/graphics/chromium/cc/CCPrioritizedTexture.h: Added.
+        (WebCore):
+        (CCPrioritizedTexture):
+        (WebCore::CCPrioritizedTexture::create):
+        (WebCore::CCPrioritizedTexture::textureManager):
+        (WebCore::CCPrioritizedTexture::format):
+        (WebCore::CCPrioritizedTexture::size):
+        (WebCore::CCPrioritizedTexture::memorySizeBytes):
+        (WebCore::CCPrioritizedTexture::setRequestPriority):
+        (WebCore::CCPrioritizedTexture::requestPriority):
+        (WebCore::CCPrioritizedTexture::canAcquireBackingTexture):
+        (WebCore::CCPrioritizedTexture::haveBackingTexture):
+        (Backing):
+        (WebCore::CCPrioritizedTexture::Backing::size):
+        (WebCore::CCPrioritizedTexture::Backing::format):
+        (WebCore::CCPrioritizedTexture::Backing::memorySizeBytes):
+        (WebCore::CCPrioritizedTexture::Backing::textureId):
+        (WebCore::CCPrioritizedTexture::Backing::currentTexture):
+        (WebCore::CCPrioritizedTexture::Backing::setCurrentTexture):
+        (WebCore::CCPrioritizedTexture::Backing::Backing):
+        (WebCore::CCPrioritizedTexture::Backing::~Backing):
+        (WebCore::CCPrioritizedTexture::isAbovePriorityCutoff):
+        (WebCore::CCPrioritizedTexture::setAbovePriorityCutoff):
+        (WebCore::CCPrioritizedTexture::setManagerInternal):
+        (WebCore::CCPrioritizedTexture::currentBacking):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp: Added.
+        (WebCore):
+        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
+        (WebCore::CCPrioritizedTextureManager::~CCPrioritizedTextureManager):
+        (WebCore::CCPrioritizedTextureManager::setMemoryAllocationLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
+        (WebCore::CCPrioritizedTextureManager::clearPriorities):
+        (WebCore::CCPrioritizedTextureManager::requestLate):
+        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
+        (WebCore::CCPrioritizedTextureManager::reduceMemory):
+        (WebCore::CCPrioritizedTextureManager::clearAllMemory):
+        (WebCore::CCPrioritizedTextureManager::allBackingTexturesWereDeleted):
+        (WebCore::CCPrioritizedTextureManager::unlink):
+        (WebCore::CCPrioritizedTextureManager::link):
+        (WebCore::CCPrioritizedTextureManager::registerTexture):
+        (WebCore::CCPrioritizedTextureManager::unregisterTexture):
+        (WebCore::CCPrioritizedTextureManager::returnBackingTexture):
+        (WebCore::CCPrioritizedTextureManager::createBacking):
+        (WebCore::CCPrioritizedTextureManager::destroyBacking):
+        (WebCore::CCPrioritizedTextureManager::assertInvariants):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h: Added.
+        (WebCore):
+        (CCPrioritizedTextureManager):
+        (WebCore::CCPrioritizedTextureManager::create):
+        (WebCore::CCPrioritizedTextureManager::createTexture):
+        (WebCore::CCPrioritizedTextureManager::memoryUseBytes):
+        (WebCore::CCPrioritizedTextureManager::memoryAboveCutoffBytes):
+        (WebCore::CCPrioritizedTextureManager::setMaxMemoryLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::maxMemoryLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::setPreferredMemoryLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::preferredMemoryLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::setMaxMemoryPriorityCutoff):
+        (WebCore::CCPrioritizedTextureManager::maxMemoryPriorityCutoff):
+        (WebCore::CCPrioritizedTextureManager::compareTextures):
+        (WebCore::CCPrioritizedTextureManager::compareBackings):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.cpp: Added.
+        (WebCore):
+        (WebCore::CCPriorityCalculator::uiPriority):
+        (WebCore::CCPriorityCalculator::visiblePriority):
+        (WebCore::CCPriorityCalculator::lingeringPriority):
+        (WebCore::CCPriorityCalculator::priorityFromDistance):
+        (WebCore::CCPriorityCalculator::priorityFromVisibility):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.h: Added.
+        (WebCore):
+        (CCPriorityCalculator):
+        (WebCore::CCPriorityCalculator::highestPriority):
+        (WebCore::CCPriorityCalculator::lowestPriority):
+        (WebCore::CCPriorityCalculator::priorityIsLower):
+        (WebCore::CCPriorityCalculator::priorityIsHigher):
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove BUILDING_ON_LEOPARD now that no ports build on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90249
+
+        Reviewed by Ryosuke Niwa.
+
+        I don't think I quite got it all yet, but this is another step towards
+        removing Leopard support in WebCore.
+
+        * WebCore.exp.in:
+        * page/AlternativeTextClient.h:
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::populate):
+        * platform/graphics/cg/ImageBufferDataCG.h:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawLineForDocumentMarker):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::setClosedCaptionsVisible):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/network/Credential.h:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore):
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+        * platform/text/TextChecking.h:
+        (WebCore):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::containsPaintedContent):
+
+2012-06-29  Andreas Kling  <kling@webkit.org>
+
+        Unreviewed, rolling out r121562.
+        http://trac.webkit.org/changeset/121562
+        https://bugs.webkit.org/show_bug.cgi?id=89945
+
+        Broke a couple of editing/pasteboard tests.
+
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::length):
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        (WebCore::PropertySetCSSStyleDeclaration::cssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
+        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::copy):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::InlineCSSStyleDeclaration::didMutate):
+        (WebCore::InlineCSSStyleDeclaration::parentStyleSheet):
+        * css/PropertySetCSSStyleDeclaration.h:
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentElement):
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
+        (WebCore::StylePropertySet::clearParentElement):
+        (WebCore):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::destroyInlineStyle):
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::~StyledElement):
+        (WebCore):
+        (WebCore::StyledElement::styleAttributeChanged):
+        * dom/StyledElement.h:
+        (StyledElement):
+        (WebCore::StyledElement::destroyInlineStyle):
+
+2012-06-29  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        [Qt] Add missing support for tiled shadow blur on fillRect
+        https://bugs.webkit.org/show_bug.cgi?id=90082
+
+        Reviewed by Noam Rosenthal.
+
+        This overloaded fillRect implementation also supports this optimization in
+        certain situations.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+
+2012-06-29  Brady Eidson  <beidson@apple.com>
+
+        Build fix - These should not be executable!
+
+        Rubberstamped by Jessie Berlin.
+
+        * loader/cache/CachedSVGDocument.cpp: Removed property svn:executable.
+        * loader/cache/CachedSVGDocument.h: Removed property svn:executable.
+
+2012-06-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Update FIXME comment in XMLDocumentParser::wellFormed
+        https://bugs.webkit.org/show_bug.cgi?id=90223
+
+        Reviewed by Adam Barth.
+
+        XMLDocumentParser::wellFormed is still used by the XMLHttpRequest to check if the responseXML was well formed.
+        So it can't be removed.
+
+        * xml/parser/XMLDocumentParser.h:
+        (XMLDocumentParser):
+
+2012-06-29  Andreas Kling  <kling@webkit.org>
+
+        Separate mutating CSSStyleDeclaration operations.
+        <http://webkit.org/b/89945>
+
+        Reviewed by Antti Koivisto.
+
+        Use separate paths for mutating the StylePropertySet wrapped by a CSSStyleDeclaration.
+        PropertySetCSSStyleDeclaration now has:
+
+            - propertySet() const
+            - ensureMutablePropertySet()
+
+        This is prep work for supporting immutable ElementAttributeData objects, the idea being
+        that calling ensureMutablePropertySet() may cause the element to convert its internal
+        attribute storage (which also holds the inline StylePropertySet.)
+
+        To that end, also removed the weird logic that allowed you to kill the inline style object
+        by removing the 'style' attribute. We now simply clear out all the properties in that case
+        which saves us a bunch of hassle (no need for a ~StyledElement anymore.)
+        Note that InlineCSSStyleDeclaration now refs the element rather than the inline style.
+
+        There should be no web-facing behavior change from any of this.
+
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::length):
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        (WebCore::PropertySetCSSStyleDeclaration::cssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
+        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::copy):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::ref):
+        (WebCore::InlineCSSStyleDeclaration::deref):
+        (WebCore::InlineCSSStyleDeclaration::didMutate):
+        (WebCore::InlineCSSStyleDeclaration::parentStyleSheet):
+        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):
+        * css/PropertySetCSSStyleDeclaration.h:
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::propertySet):
+        (WebCore::PropertySetCSSStyleDeclaration::ensureMutablePropertySet):
+        (InlineCSSStyleDeclaration):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        * dom/ElementAttributeData.cpp:
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::styleAttributeChanged):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::~StyledElement):
+        (StyledElement):
+
+2012-06-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Don't call SegmentedString::toString() twice in XMLDocumentParser::append(const SegmentedString&)
+        https://bugs.webkit.org/show_bug.cgi?id=90254
+
+        Reviewed by Adam Barth.
+
+        We can reuse the local variable parseString instead of calling s.toString() again.
+        No behavior change, so no new tests.
+
+        * xml/parser/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::append):
+
+2012-06-29  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Crash when flowing a fixed positioned element into a region.
+        https://bugs.webkit.org/show_bug.cgi?id=88133
+
+        Reviewed by Julien Chaffraix and Abhishek Arya.
+
+        When a fixed positioned element is collected into a named flow, we have to make sure
+        that such element has the RenderFlowThread as containing block instead of RenderView,
+        so that the fixed positioned element is laid out properly.
+        Making the RenderFlowThread the top most containing block for named flow elements required the
+        modification of RenderLayer::convertToLayerCoords so that the fixed positioned elements inside the
+        named flow take the same code path as the absolute positioned elements inside the named flow.
+        I also added a method, checkBlockPositionedObjectsNeedLayout, in order to verify that a block
+        that is ending its layout, setNeedsLayout(false), has all the positioned children laid out.
+        This way, we will hit an assertion if an out-of-flow positioned child inside a RenderFlowThread
+        is not laid out after the RenderFlowThread is laid out.
+
+        Tests: fast/regions/absolute-pos-elem-in-named-flow.html
+               fast/regions/absolute-pos-elem-in-region.html
+               fast/regions/fixed-pos-elem-in-named-flow.html
+               fast/regions/fixed-pos-elem-in-named-flow2.html
+               fast/regions/fixed-pos-elem-in-region.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::checkPositionedObjectsNeedLayout):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertToLayerCoords):
+        * rendering/RenderObject.cpp:
+        (WebCore):
+        (WebCore::RenderObject::checkBlockPositionedObjectsNeedLayout):
+        (WebCore::RenderObject::containingBlock):
+        (WebCore::RenderObject::container):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        (WebCore::RenderObject::setNeedsLayout):
+
+2012-06-29  Konrad Piascik  <kpiascik@rim.com>
+
+        Don't hardcode target dpi of 160 (it should be 96 on desktop)
+        https://bugs.webkit.org/show_bug.cgi?id=88114
+
+        Reviewed by Adam Barth.
+
+        No behavioural change, current tests in fast/viewport cover all
+        functionality.
+
+        * WebCore.exp.in: Updated symbol for computeViewportAttributes.
+        * dom/ViewportArguments.cpp: Use new parameter for devicePixelRatio
+                                     and don't calculate it anymore.
+        (WebCore::computeViewportAttributes):
+        * dom/ViewportArguments.h: Change the deviceDPI parameter to
+                                   devicePixelRatio and put the onus
+                                   on the embedder to supply the
+                                   correct value.  Add temporary constant.
+        (WebCore):
+
+2012-06-29  Vineet Chaudhary  <rgf748@motorola.com>
+
+        JS binding code generator doesn't handle "attribute unsigned long[]" well.
+        https://bugs.webkit.org/show_bug.cgi?id=84540
+
+        Reviewed by Kentaro Hara.
+
+        In JS/V8 Bindings using traits instead of specialised functions.
+        Also added support for "unsigned long" in JSDOMBinding and V8Binding.
+
+        No new tests, as no behavioural changes.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::Traits::arrayJSValue):
+        (WebCore::jsArray):
+        * bindings/v8/V8Binding.h:
+        (WebCore::Traits::arrayV8Value):
+        (WebCore::v8Array):
+
+2012-06-29  Andreas Kling  <kling@webkit.org>
+
+        Unreviewed mac build fix after r121547.
+        Remove the now-unused FontCustomPlatformData::m_atsContainer.
+
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        (FontCustomPlatformData):
+
+2012-06-29  Kent Tamura  <tkent@chromium.org>
+
+        <textarea> unnecessarily saves the value in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=90259
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/forms/textarea/textarea-state-restore.html
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::saveFormControlState):
+        We apply EOL normalization to value(), but don't apply it to
+        defaultValue(). Also value() can return a null string, which never
+        equals to any strings. To check m_isDirty is what we need..
+
+2012-06-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Provide source data for all known rule types in CSSParser, except "keyframe" and "region"
+        https://bugs.webkit.org/show_bug.cgi?id=88420
+
+        Reviewed by Antti Koivisto.
+
+        This change transitions the CSS source code model from a flat list of style rules to a tree of all types of CSS rules
+        (some of them lack actual source code data), which is crucial to model-based CSS stylesheet source editing
+        (add/remove CSS rule) and navigation.
+        As a side effect, the CSS parsing performance on PerformanceTests/Parser/css-parser-yui.html is improved roughly by 2%:
+        - originally: median= 282.051282051 runs/s, stdev= 1.51236798322 runs/s, min= 278.481012658 runs/s, max= 283.870967742 runs/s
+        - with patch applied: median= 287.206266319 runs/s, stdev= 1.31518320219 runs/s, min= 282.051282051 runs/s, max= 288.713910761 runs/s
+
+        No new tests, as there is no client-visible behavior change. Existing Inspector tests will be modified
+        to test the new data provided, along with the necessary Inspector plumbing.
+
+        * css/CSSGrammar.y:
+        * css/CSSMediaRule.cpp:
+        (WebCore::CSSMediaRule::reattach): Check for mediaQueries() validity before reattaching.
+        * css/CSSParser.cpp: Unless explicitly specified below, the method changes are related to the extension of the
+        source-based CSS model provided by the parser.
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::setupParser):
+        (WebCore::CSSParser::parseDeclaration): Accept a CSSRuleSourceData for filling, since it now contains
+        the related style source range.
+        (WebCore::CSSParser::createImportRule):
+        (WebCore::CSSParser::createMediaRule): Create CSSMediaRule even if media and rules are empty,
+        which is consistent with Mozilla.
+        (WebCore::CSSParser::processAndAddNewRuleToSourceTreeIfNeeded):
+        (WebCore):
+        (WebCore::CSSParser::addNewRuleToSourceTree):
+        (WebCore::CSSParser::createKeyframesRule):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::createRegionRule):
+        (WebCore::CSSParser::fixUnparsedPropertyRanges):
+        (WebCore::CSSParser::markRuleHeaderStart):
+        (WebCore::CSSParser::markRuleHeaderEnd):
+        (WebCore::CSSParser::markRuleBodyStart):
+        (WebCore::CSSParser::markRuleBodyEnd):
+        (WebCore::CSSParser::markPropertyStart):
+        (WebCore::CSSParser::markPropertyEnd):
+        * css/CSSParser.h:
+        (CSSParser):
+        * css/CSSPropertySourceData.h: Extend the model to handle more types of rules and their containments.
+        (WebCore):
+        (WebCore::CSSRuleSourceData::create):
+        (WebCore::CSSRuleSourceData::createUnknown):
+        (CSSRuleSourceData):
+        (WebCore::CSSRuleSourceData::CSSRuleSourceData):
+        * inspector/InspectorStyleSheet.cpp: Follow the CSSParser API changes but retain the flat stored CSS rules structure.
+        (ParsedStyleSheet):
+        (flattenSourceData): Flatten the rule tree to retain the existing rule-handling code intact.
+        (ParsedStyleSheet::setSourceData):
+        (ParsedStyleSheet::ruleSourceDataAt):
+        (WebCore::InspectorStyle::buildObjectForStyle):
+        (WebCore::InspectorStyle::setPropertyText):
+        (WebCore::InspectorStyle::styleText):
+        (WebCore::InspectorStyleSheet::setRuleSelector):
+        (WebCore::InspectorStyleSheet::deleteRule):
+        (WebCore::InspectorStyleSheet::buildObjectForRule):
+        (WebCore::InspectorStyleSheet::buildObjectForStyle):
+        (WebCore::InspectorStyleSheet::ensureSourceData):
+        (WebCore::InspectorStyleSheet::styleSheetTextWithChangedStyle):
+        (WebCore::InspectorStyleSheetForInlineStyle::ensureParsedDataReady):
+        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
+        * inspector/InspectorStyleSheet.h:
+
+2012-06-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Annotate TextViewer.js
+        https://bugs.webkit.org/show_bug.cgi?id=90266
+
+        Reviewed by Yury Semikhatsky.
+
+        Annotated TextViewer.js and fixed found errors.
+        Drive-by: Fixed NativeMemorySnapshotView.js compilation.
+        Drive-by: Fixed protocol-externs.js compilation.
+        Drive-by: Removed unused platform parameter from TextViewer constructor.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::runScript):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemoryBarChart.prototype._updateView):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._updateHighlightsForRange):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove still more BUILDING_ON_LEOPARD branches now that no port supports leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90256
+
+        Reviewed by Ryosuke Niwa.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::imageTitle):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setAllowsFontSmoothing):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::boundingRect):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::ctFont):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/mac/ComplexTextController.cpp:
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::fontCacheRegisteredFontsChangedNotificationCallback):
+        (WebCore::FontCache::platformInit):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/mac/WebLayer.h:
+        * platform/mac/CursorMac.mm:
+        (WebCore::Cursor::ensurePlatformCursor):
+        * platform/mac/DisplaySleepDisabler.cpp:
+        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
+        (WebCore::DisplaySleepDisabler::~DisplaySleepDisabler):
+        * platform/mac/DisplaySleepDisabler.h:
+        (DisplaySleepDisabler):
+        * platform/mac/HTMLConverter.h:
+        * platform/mac/HTMLConverter.mm:
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenuMac::populate):
+        * platform/mac/ScrollElasticityController.mm:
+
+2012-06-29  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed attempt at a build fix for 64-bit debug build,
+        touch InsertionPoint.cpp to try to get it rebuilt.
+
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore):
+
+2012-06-29  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Don't add Qt module dependencies in features.prf
+
+        The required dependencies are already added in WebCore.pri.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WebCore.pri:
+
+2012-06-29  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add FileSystemView
+        https://bugs.webkit.org/show_bug.cgi?id=73301
+
+        This patch introduce a split view as FileSystemView. Including directory tree as sidebar tree.
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: http/tests/inspector/filesystem/directory-tree.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.Entry.compare):
+        * inspector/front-end/FileSystemView.js: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showFileSystem):
+        (WebInspector.FileSystemTreeElement.prototype.get itemURL):
+        (WebInspector.FileSystemTreeElement.prototype.onattach):
+        (WebInspector.FileSystemTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.FileSystemTreeElement.prototype._refreshFileSystem):
+        (WebInspector.FileSystemTreeElement.prototype.onselect):
+        (WebInspector.FileSystemTreeElement.prototype.clear):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-06-29  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace v8::Integer::New() with v8Integer() in custom bindings
+        https://bugs.webkit.org/show_bug.cgi?id=90242
+
+        Reviewed by Yury Semikhatsky.
+
+        v8Integer() is a fast wrapper of v8::Integer::New().
+        This patch replaces v8::Integer::New() with v8Integer() in custom bindings,
+        and pass isolates.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::V8CSSStyleDeclaration::namedPropertyEnumerator):
+        (WebCore::V8CSSStyleDeclaration::namedPropertyQuery):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::V8Clipboard::typesAccessorGetter):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::V8DOMStringMap::namedPropertyQuery):
+        (WebCore::V8DOMStringMap::namedPropertyEnumerator):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        (WebCore::V8DataView::getInt8Callback):
+        (WebCore::V8DataView::getUint8Callback):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::V8HTMLInputElement::selectionStartAccessorGetter):
+        (WebCore::V8HTMLInputElement::selectionEndAccessorGetter):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::V8HTMLOptionsCollection::lengthAccessorGetter):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::functionDetailsCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::portsAccessorGetter):
+        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
+        (WebCore::V8MutationCallback::handleEvent):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::namedPropertyGetter):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::V8SQLTransaction::executeSqlCallback):
+        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
+        (WebCore::V8SQLTransactionSync::executeSqlCallback):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Storage::namedPropertyEnumerator):
+        (WebCore::V8Storage::indexedPropertyGetter):
+        (WebCore::V8Storage::namedPropertyQuery):
+        (WebCore::V8Storage::indexedPropertySetter):
+        (WebCore::V8Storage::indexedPropertyDeleter):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
+        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
+        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2012-06-29  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r121520.
+        http://trac.webkit.org/changeset/121520
+        https://bugs.webkit.org/show_bug.cgi?id=90246
+
+        the performance optimization needs more investigation
+
+        * dom/DatasetDOMStringMap.cpp:
+        (WebCore::convertPropertyNameToAttributeName):
+        * dom/Element.cpp:
+        (WebCore::Element::getAttributeNS):
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::removeAttributeNS):
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        (WebCore::Element::hasAttribute):
+        (WebCore::Element::hasAttributeNS):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::getAttributeNode):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+
+2012-06-29  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace v8::Integer::New() with v8Integer() in bindings/v8/*.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=90238
+
+        Reviewed by Yury Semikhatsky.
+
+        v8Integer() is a fast wrapper of v8::Integer::New().
+        We can replace v8::Integer::New() with v8Integer()
+        in bindings/v8/*.{h,cpp}. In addition, we pass isolate
+        to v8Integer() where possible.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/Dictionary.cpp:
+        (WebCore::Dictionary::get):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_Enumerate): Changed v8::None to 0, for consistency with other code.
+        * bindings/v8/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::addListener):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::compileScript):
+        * bindings/v8/SerializedScriptValue.cpp:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8Array):
+        (WebCore::v8ValueToWebCoreDOMStringList):
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8Array):
+        (WebCore::v8NumberArrayToVector):
+        * bindings/v8/V8Collection.h:
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8NPObject.cpp:
+        (WebCore::npObjectQueryProperty):
+        (WebCore::npObjectPropertyEnumerator):
+        * bindings/v8/V8NPUtils.cpp:
+        (WebCore::convertNPVariantToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureConstants):
+        (WebCore::V8Proxy::compileScript):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/V8WindowErrorHandler.cpp:
+        (WebCore::V8WindowErrorHandler::callListenerFunction):
+        * bindings/v8/V8WorkerContextErrorHandler.cpp:
+        (WebCore::V8WorkerContextErrorHandler::callListenerFunction):
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::addListener):
+
+2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Resource content is not loaded if Resource.requestContent method is called before network request is finished.
+        https://bugs.webkit.org/show_bug.cgi?id=90153
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: http/tests/inspector/resource-tree/resource-request-content-while-loading.html
+
+        * inspector/front-end/NetworkRequest.js:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.requestContent):
+        (WebInspector.Resource.prototype._requestFinished):
+
+2012-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121529.
+        http://trac.webkit.org/changeset/121529
+        https://bugs.webkit.org/show_bug.cgi?id=90260
+
+        Failed to compile on Chromium WebKitMacBuilder (Requested by
+        keishi on #webkit).
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::platformAddPathForRoundedRect):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::setFont):
+        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::showGlyphsWithAdvances):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore):
+        * platform/mac/CursorMac.mm:
+        (WebCore::Cursor::ensurePlatformCursor):
+        * platform/mac/MemoryPressureHandlerMac.mm:
+        (WebCore):
+        * platform/mac/PlatformEventFactoryMac.mm:
+        (WebCore::momentumPhaseForEvent):
+        (WebCore::phaseForEvent):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/text/cf/HyphenationCF.cpp:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldShowPlaceholderWhenFocused):
+
+2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Add toggle breakpoint shortcut.
+        https://bugs.webkit.org/show_bug.cgi?id=90188
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
+        (WebInspector.JavaScriptSourceFrame.prototype._toggleBreakpoint):
+        (WebInspector.JavaScriptSourceFrame.prototype.toggleBreakpointOnCurrentLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._toggleBreakpoint):
+        (WebInspector.ScriptsPanel.prototype._showOutlineDialog):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.selection):
+
+2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Cursor should follow execution line when debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=90184
+
+        Reviewed by Yury Semikhatsky.
+
+        Added TextViewer.setSelection public method to set cursor selection in the editor.
+        Added TextRange.createFromLocation method to create TextRanges with the same start and end points.
+        Drive-by: removed unused _setCaretLocation() method in TextViewer.js
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
+        (WebInspector.ScriptsPanel.prototype._editorSelected):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype.setContent):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextRange.createFromLocation):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.setSelection):
+        (WebInspector.TextEditorMainPanel.prototype.highlightLine):
+
+2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: IDBObjectStore.autoIncrement flag not exposed
+        https://bugs.webkit.org/show_bug.cgi?id=89701
+
+        Reviewed by Yury Semikhatsky.
+
+        Plumbed objectStore.autoIncrement to inspector front-end and added it to tooltip.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/Inspector.json:
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.prototype._loadDatabase.callback):
+        (WebInspector.IndexedDBModel.prototype._loadDatabase):
+        (WebInspector.IndexedDBModel.ObjectStore):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.IDBObjectStoreTreeElement.prototype._updateTooltip):
+
+2012-06-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Use floating keyframe rule list when parsing @-webkit-keyframes and allow abrupt rule termination
+        https://bugs.webkit.org/show_bug.cgi?id=90073
+
+        Reviewed by Antti Koivisto.
+
+        - The grammar is changed to allow abruptly terminated stylesheet in the @-webkit-keyframes (use closing_brace, not '}').
+        - A floating StyleKeyframe vector is introduced to separate the creation and filling of StyleRuleKeyframes, as other rules do.
+
+        Test: fast/css/css-keyframe-unexpected-end.html
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createFloatingKeyframeVector):
+        (WebCore):
+        (WebCore::CSSParser::sinkFloatingKeyframeVector):
+        (WebCore::CSSParser::createKeyframesRule):
+        * css/CSSParser.h:
+
+2012-06-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add character data to the DOM section of native memory view
+        https://bugs.webkit.org/show_bug.cgi?id=89968
+
+        Reviewed by Vsevolod Vlasov.
+
+        Count strings referenced from CharacterData node and its descendants
+        as part of the DOM tree structures in the native memory view.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::reportMemoryUsage):
+        (WebCore):
+        * dom/CharacterData.h:
+        (CharacterData):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (WebCore::MemoryObjectInfo::reportString):
+        (MemoryObjectInfo):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+        (WebCore::domTreeInfo):
+        (WebCore::jsExternalResourcesInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove more BUILDING_ON_LEOPARD branches now that no port builds on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90252
+
+        Reviewed by Ryosuke Niwa.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::platformAddPathForRoundedRect):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::setFont):
+        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::showGlyphsWithAdvances):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore):
+        * platform/mac/CursorMac.mm:
+        (WebCore::Cursor::ensurePlatformCursor):
+        * platform/mac/MemoryPressureHandlerMac.mm:
+        (WebCore):
+        * platform/mac/PlatformEventFactoryMac.mm:
+        (WebCore::momentumPhaseForEvent):
+        (WebCore::phaseForEvent):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/text/cf/HyphenationCF.cpp:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldShowPlaceholderWhenFocused):
+
+2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: showConsole() should close previous view in drawer.
+        https://bugs.webkit.org/show_bug.cgi?id=90070
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.showConsole):
+        (WebInspector.showPanel):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove a #include erroneously added in r120896.
+
+        * editing/VisibleSelection.h:
+
+2012-06-29  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement Date Time format parser
+        https://bugs.webkit.org/show_bug.cgi?id=89963
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces Unicode TR35 LDML date time format parser for
+        input type "time" if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS) is true.
+
+        Test: WebKit/chromium/tests/DateTimeFormatTest.cpp
+
+        * CMakeLists.txt: Added DateTimeFormat.cpp
+        * GNUmakefile.list.am: Added DateTimeFormat.{cpp,h}
+        * Target.pri: ditto
+        * WebCore.gypi: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/product.pbxproj: ditto
+        * platform/text/DateTimeFormat.cpp: Added.
+        (WebCore::mapCharacterToFieldTypeInternal):
+        (WebCore::DateTimeFormat::DateTimeFormat):
+        (WebCore::DateTimeFormat::mapCharacterToFieldType):
+        (WebCore::DateTimeFormat::parse):
+        * platform/text/DateTimeFormat.h: Added.
+        (DateTimeFormat):
+        (TokenHandler):
+        (WebCore::DateTimeFormat::TokenHandler::~TokenHandler):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove more BUILDING_ON_LEOPARD usage in PLATFORM(MAC) code
+        https://bugs.webkit.org/show_bug.cgi?id=85846
+
+        Reviewed by Adam Barth.
+
+        PLATFORM(MAC) has not supported Leopard for several months now.
+        This change removes about 1/3 of the remaining BUILDING_ON_LEOPARD
+        uses in the PLATFORM(MAC) codepaths.  PLATFORM(CHROMIUM) still
+        supports BUILDING_ON_LEOPARD for now.
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::updateRangesAfterChildrenChanged):
+        (WebCore::Document::nodeChildrenWillBeRemoved):
+        (WebCore::Document::nodeWillBeRemoved):
+        (WebCore::Document::textInserted):
+        (WebCore::Document::textRemoved):
+        (WebCore::Document::textNodesMerged):
+        (WebCore::Document::textNodeSplit):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedSelection):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::pasteWithPasteboard):
+        * loader/EmptyClients.h:
+        (EmptyEditorClient):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        (WebCore::ContextMenuController::createAndAppendSpellingAndGrammarSubMenu):
+        (WebCore):
+        (WebCore::ContextMenuController::populate):
+        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
+        * page/EditorClient.h:
+        (EditorClient):
+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagSearchWeb):
+        * platform/MemoryPressureHandler.cpp:
+        (WebCore):
+        * platform/SuddenTermination.h:
+        (WebCore):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateContentsImage):
+        (WebCore::GraphicsLayerCA::constrainedSize):
+        * platform/graphics/ca/PlatformCALayer.h:
+        (PlatformCALayer):
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (fromCAValueFunctionType):
+        (PlatformCAAnimation::valueFunction):
+        (PlatformCAAnimation::setValueFunction):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (toCAFilterType):
+        (PlatformCALayer::anchorPoint):
+        (PlatformCALayer::setAnchorPoint):
+        (PlatformCALayer::contentsTransform):
+        (PlatformCALayer::setContentsTransform):
+        (PlatformCALayer::isGeometryFlipped):
+        (PlatformCALayer::setGeometryFlipped):
+        (PlatformCALayer::acceleratesDrawing):
+        (PlatformCALayer::setAcceleratesDrawing):
+        (PlatformCALayer::setMinificationFilter):
+        (PlatformCALayer::setMagnificationFilter):
+        (PlatformCALayer::contentsScale):
+        (PlatformCALayer::setContentsScale):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setScale):
+        (WebCore::TileCache::setAcceleratesDrawing):
+        (WebCore::TileCache::createTileLayer):
+
+2012-06-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Use StringBuilder in SegmentedString::toString()
+        https://bugs.webkit.org/show_bug.cgi?id=90247
+
+        Reviewed by Adam Barth.
+
+        Use a StringBuilder instead of String concatenation because StringBuilder is generally faster.
+        No new tests. Covered by existing tests.
+
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::toString):
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedSubstring::appendTo):
+
+2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix after r121518.
+
+        * WebCore.exp.in:
+
+2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        DOMHTMLCollection::item may return a wrong element after namedItem is called
+        https://bugs.webkit.org/show_bug.cgi?id=90240
+
+        Reviewed by Antti Koivisto.
+
+        The bug was caused by namedItem updating m_cache.current without updating m_cache.position.
+        Fixed the bug by updating both. This is similar to the bug I fixed in r121478.
+
+        WebKit API Test: WebKit1.HTMLCollectionNamedItemTest
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItem):
+
+2012-06-28  Kentaro Hara  <haraken@chromium.org>
+
+        Change argument types of Element::getAttribute*() from String to AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=90246
+
+        Reviewed by Ryosuke Niwa.
+
+        This is a follow-up patch for r121439. r121439 changed an argument type of
+        Element::getAttribute() from String to AtomicString, which optimized
+        performance of Dromaeo/dom-attr.html. This patch changes other argument types
+        of Element::getAttribute*() from String to AtomicString. See the ChangeLog in
+        http://trac.webkit.org/changeset/121439 for more details about why this change
+        optimizes performance.
+
+        No tests. No change in behavior.
+
+        * dom/DatasetDOMStringMap.cpp:
+        (WebCore::convertPropertyNameToAttributeName):
+        * dom/Element.cpp:
+        (WebCore::Element::getAttributeNS):
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::removeAttributeNS):
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        (WebCore::Element::hasAttribute):
+        (WebCore::Element::hasAttributeNS):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::getAttributeNode):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+
+2012-06-28  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r106388): Form hidden element values being restored
+        incorrectly for dynamically generated content
+        https://bugs.webkit.org/show_bug.cgi?id=88685
+
+        Reviewed by Hajime Morita.
+
+        We should not save value attribute updated during parsing.
+
+        Test: fast/forms/state-restore-to-non-edited-controls.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        Initialize m_valueAttributeWasUpdatedAfterParsing.
+        (WebCore::HTMLInputElement::parseAttribute):
+        Set true to m_valueAttributeWasUpdatedAfterParsing if value
+        attribute is updated and it's not in parsing.
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::valueAttributeWasUpdatedAfterParsing):
+        Added for HiddenInputType.
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::saveFormControlState):
+        Save the value only if valueAttributeWasUpdatedAfterParsing() is true.
+
+2012-06-28  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] NodeRenderingContext ctor could be built on top of the ComposedShadowTreeWalker
+        https://bugs.webkit.org/show_bug.cgi?id=89732
+
+        Reviewed by Dimitri Glazkov.
+
+        The constructor of NodeRenderingContext implements almost same
+        logic as ComposedShadowTreeWalker::parent().  This change
+        eliminates the duplication by employing ComposedShadowTreeWalker in the constructor.
+
+        ComposedShadowTreeWalker has same difference from
+        NodeRenderingContext though. So this change also extends
+        ComposedShadowTreeWalker to support these missing pieces, which
+        are encapsulated in newly introduced ParentTranversalDetails
+        class where:
+
+        - not only the parent, but also the insertion point of the child is returned,
+        - resetStyleInheritance from the child-parent traversal is computed and
+        - if the starting point is out of the composition, it returns null as a parent.
+
+        This change also inlines some ComposedShadowTreeWalker methods for speed.
+
+        No new tests. Covered by existing tests.
+
+        * WebCore.exp.in:
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::shadowOfParent):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didTraverseInsertionPoint):
+        (WebCore):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didTraverseShadowRoot):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didFindNode):
+        (WebCore::ComposedShadowTreeWalker::findParent):
+        (WebCore::ComposedShadowTreeWalker::escapeFallbackContentElement):
+        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
+        (WebCore::ComposedShadowTreeWalker::traverseParent):
+        (WebCore::ComposedShadowTreeWalker::traverseParentInCurrentTree):
+        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):
+        * dom/ComposedShadowTreeWalker.h:
+        (ParentTranversalDetails):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::ParentTranversalDetails):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::node):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::insertionPoint):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::resetStyleInheritance):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::outOfComposition):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::childWasOutOfComposition):
+        (ComposedShadowTreeWalker):
+        (WebCore::ComposedShadowTreeWalker::ComposedShadowTreeWalker):
+        (WebCore):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::parentRenderer):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::parentNodeForRenderingAndStyle):
+        (WebCore::NodeRenderingContext::resetStyleInheritance):
+        (WebCore::NodeRenderingContext::insertionPoint):
+
+2012-06-28  Stephen White  <senorblanco@chromium.org>
+
+        Implement filter url() function.
+        https://bugs.webkit.org/show_bug.cgi?id=72443
+
+        url() references can be internal, in which case the DOM nodes are
+        retrieved directly from the current document, or external, in which
+        case a CachedSVGDocument request is made, and the filter node build is
+        deferred until the document is loaded.  WebKitSVGDocumentValue
+        holds the CachedSVGDocument (if any) and the URL as a CSSValue,
+        and is stored in the CSSValue chain as the argument to the reference
+        filter.
+
+        One notable difference between internal and external references is
+        that internal references will automatically update on an SVG filter node
+        attribute change, while external references will not, since they live
+        in a separate document.  This is consistent with the Mozilla
+        implementation.  In order to make this work, the RenderLayer is made a
+        client of the RenderSVGResourceContainer, and calls
+        filterNeedsRepaint() when the SVG nodes are invalidated.
+
+        Some plumbing:  The CSS StyleResolver was refactored to load all
+        all external resources (images, shaders and (now) SVG filters) in a
+        single function, loadPendingResources().  The PlatformLayer typedef
+        was moved out into its own file, in order to break a cyclic
+        dependency.  SVGFilterBuilder was modified to accept the SourceGraphic
+        and SourceAlpha FilterEffects in its constructor and factory function,
+        rather than extracting them from the parent Filter.  (This is necessary
+        so that the url() filter can correctly hook up its inputs from
+        previous CSS filters.)
+
+        Reviewed by Dean Jackson.
+
+        Tests: css3/filters/effect-reference-external.html
+               css3/filters/effect-reference-hw.html
+               css3/filters/effect-reference-ordering.html
+               css3/filters/effect-reference.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add WebKitCSSSVGDocumentValue to the various build files.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        Use the reference filter's url when getting the computed style for
+        a reference filter.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFilter):
+        Create the referenceFilterValue's argument as a
+        WebKitCSSSVGDocumentValue instead of a CSS string.
+        * css/CSSValue.cpp:
+        (WebCore::CSSValue::cssText):
+        Add support for WebKitCSSSVGDocumentValue.
+        (WebCore::CSSValue::destroy):
+        Add support for WebKitCSSSVGDocumentValue.
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isWebKitCSSSVGDocumentValue):
+        Add support for WebKitCSSSVGDocumentValue.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        Keep track of pending SVG document references, and load them when
+        necessary.
+        * css/StyleResolver.h:
+        * css/WebKitCSSSVGDocumentValue.cpp: Added.
+        New CSSValue subclass for holding SVG document references.
+        (WebCore::WebKitCSSSVGDocumentValue::WebKitCSSSVGDocumentValue):
+        (WebCore::WebKitCSSSVGDocumentValue::~WebKitCSSSVGDocumentValue):
+        (WebCore::WebKitCSSSVGDocumentValue::load):
+        (WebCore::WebKitCSSSVGDocumentValue::customCssText):
+        * css/WebKitCSSSVGDocumentValue.h: Added.
+        (WebCore::WebKitCSSSVGDocumentValue::create):
+        (WebCore::WebKitCSSSVGDocumentValue::cachedSVGDocument):
+        (WebCore::WebKitCSSSVGDocumentValue::url):
+        (WebCore::WebKitCSSSVGDocumentValue::loadRequested):
+        * platform/graphics/GraphicsLayer.h:
+        Refactor PlatformLayer out into its own file, to avoid circular
+        includes.
+        * platform/graphics/ImageBuffer.h:
+        Include PlatformLayer.h instead of GraphicsLayer.h.
+        * platform/graphics/PlatformLayer.h: Added.
+        Refactor PlatformLayer out into its own file, to avoid circular
+        includes.
+        * platform/graphics/filters/FilterOperation.h:
+        (WebCore::ReferenceFilterOperation::create):
+        (WebCore::ReferenceFilterOperation::clone):
+        (WebCore::ReferenceFilterOperation::url):
+        (WebCore::ReferenceFilterOperation::fragment):
+        (ReferenceFilterOperation):
+        (WebCore::ReferenceFilterOperation::data):
+        (WebCore::ReferenceFilterOperation::setData):
+        (WebCore::ReferenceFilterOperation::operator==):
+        (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
+        Augment ReferenceFilterOperation to maintain a data pointer,
+        in order to preserve context while loading external SVG documents.
+        Replace "reference" with "url" and "fragment" members, in order to
+        ease retrieval of the appropriate DOM objects.
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasReferenceFilter):
+        Convenience function for finding reference filters.
+        * platform/graphics/filters/FilterOperations.h:
+        (FilterOperations):
+        * platform/mac/ScrollbarThemeMac.mm:
+        Include GraphicsLayer.h explicitly, since ImageBuffer.h no longer
+        includes it (and only includes PlatformLayer.h).
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRenderer::buildReferenceFilter):
+        Utility function to build a FilterEffect node graph for a
+        ReferenceFilterOperation.
+        (WebCore::FilterEffectRenderer::build):
+        Call the above builder function for ReferenceFilterOperations.
+        * rendering/FilterEffectRenderer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateOrRemoveFilterEffect):
+        If we have reference filters, update them along with other filters.
+        (WebCore::RenderLayer::filterNeedsRepaint):
+        * rendering/RenderLayerFilterInfo.cpp:
+        (WebCore::RenderLayerFilterInfo::~RenderLayerFilterInfo):
+        (WebCore::RenderLayerFilterInfo::notifyFinished):
+        Implement callback function when external SVGDocuments are loaded.
+        (WebCore::RenderLayerFilterInfo::updateReferenceFilterClients):
+        Add the FilterInfo as a client to be called when SVGDocuments are
+        loaded.
+        (WebCore::RenderLayerFilterInfo::removeReferenceFilterClients):
+        Remove this from the list of notified clients.
+        * rendering/RenderLayerFilterInfo.h:
+        Add new member vars for tracking internal and external SVG
+        references, so we can remove ourselves as a client when done.
+        * rendering/svg/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
+        When marking client DOM nodes for repaint, also mark any RenderLayers
+        referring to this DOM tree via filters as needing repaint.
+        (WebCore::RenderSVGResourceContainer::addClientRenderLayer):
+        (WebCore::RenderSVGResourceContainer::removeClientRenderLayer):
+        * rendering/svg/RenderSVGResourceContainer.h:
+        Maintain a list of RenderLayer clients on each SVG resource container,
+        and turn SVG DOM repaint notifications into filter repaint (CSS)
+        notifications.
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::buildPrimitives):
+        Construct a SourceGraphic and SourceAlpha node explicitly for the
+        SVG builder case.
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
+        * svg/graphics/filters/SVGFilterBuilder.h:
+        (WebCore::SVGFilterBuilder::create):
+        Add the SourceGraphic and SourceAlpha as parameters to the constructor
+        and create() methods, so they can be supplied by the caller.
+
+2012-06-28  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] CTFontCopyTable of MacOSX10.5 SDK doesn't work for layout tables
+        https://bugs.webkit.org/show_bug.cgi?id=90235
+
+        Reviewed by Kent Tamura.
+
+        Use CGFontCopyTableForTag instead.
+
+        No new tests. css3/font-feature-settings-rendering.html should pass. I'll rebase expectations once bots get the result.
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp:
+        (WebCore::harfbuzzCoreTextGetTable):
+
+2012-06-28  Philip Rogers  <pdr@google.com>
+
+        Add preventative assert in SVGTRefElement
+        https://bugs.webkit.org/show_bug.cgi?id=90203
+
+        Reviewed by Abhishek Arya.
+
+        SVGTRefElement::detachTarget() adds a pending resource via addPendingResource.
+        Due to some recent bugs in this area, an assert is being added to prevent
+        users from calling detachTarget when not in a document. Doing
+        so would create a bug such as in WK90042.
+
+        This assert will not fire currently because detachTarget is only called after
+        a DOMNodeRemovedFromDocumentEvent event fires, which only comes from
+        dispatchChildRemovalEvents when the node is in a document.
+
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::detachTarget):
+
+2012-06-28  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        [Qt] Remove unnecessary AffineTransform calls
+        https://bugs.webkit.org/show_bug.cgi?id=90178
+
+        Reviewed by Noam Rosenthal.
+
+        Qt currently ignores the const AffineTransform& parameter on
+        Pattern::createPlatformPattern, so removing it from all its Qt calls and
+        changing the function signature if platform is Qt.
+
+        * platform/graphics/Pattern.h:
+        (Pattern):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::fillPenForContext):
+        (WebCore::strokePenForContext):
+        * platform/graphics/qt/FontQt4.cpp:
+        (WebCore::fillPenForContext):
+        (WebCore::strokePenForContext):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::drawRepeatPattern):
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2012-06-28  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] When uploading an opaque image to a texture for TextureMapper, unnecessary alpha operations take place
+        https://bugs.webkit.org/show_bug.cgi?id=90229
+
+        Reviewed by Luiz Agostini.
+
+        For opaque web content in WebKit2, we use the RGB32 image format. When we special-case
+        it in GraphicsContext3DQt, we can avoid any alpha operations and perform a regular copy.
+
+        Covered existing API tests, as this code path is always used when rendering.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Compile chromium compositor implementation files into separate .lib
+        https://bugs.webkit.org/show_bug.cgi?id=90233
+
+        Reviewed by Adam Barth.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-06-28  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] NodeList wrappers are not kept alive as needed
+        https://bugs.webkit.org/show_bug.cgi?id=90194
+
+        Reviewed by Ojan Vafai.
+
+        We need to add custom reachability code for DynamicNodeLists. If the owner of
+        a DynamicNodeList is reachable then the DynamicNodeList must also be reachable.
+
+        Test: fast/dom/NodeList/nodelist-reachable.html
+
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::visitDOMWrapper): AddImplicitReferences from the owner wrapper.
+        (WebCore):
+        * dom/NodeList.idl:
+
+2012-06-28  Elliott Sprehn  <esprehn@gmail.com>
+
+        frameborder="no" on frameset is ignored if border attribute set
+        https://bugs.webkit.org/show_bug.cgi?id=17767
+
+        Reviewed by Tony Chang.
+
+        Fixes <frameset> frameborder and border handling. Previously we'd
+        override the frameborder=no setting if border was set. We also
+        treated frameborder="anything" the same as frameborder=0 since we
+        we just converted it to a number so frameborder=yes was incorrectly
+        treated the same as frameborder=no.
+
+        Tests: fast/frames/frameset-frameborder-boolean-values.html
+               fast/frames/frameset-frameborder-inheritance.html
+               fast/frames/frameset-frameborder-overrides-border.html
+
+        * html/HTMLFrameSetElement.cpp: Proper parsing of yes,no,1,0 values.
+        (WebCore::HTMLFrameSetElement::parseAttribute):
+        * html/HTMLFrameSetElement.h:
+        (WebCore::HTMLFrameSetElement::border): Border should be 0 if frameborder=no.
+
+2012-06-28  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Implement IDBTransaction internal active flag
+        https://bugs.webkit.org/show_bug.cgi?id=89379
+
+        Reviewed by Tony Chang.
+
+        IDB transactions should only be "active" during IDB success/error callbacks;
+        attempts to make new requests otherwise (e.g. in a setTimeout callback)
+        should fail even if the transaction has not yet finished. Implement this logic,
+        and the closely related requirement that transactions are deactivated when
+        the context they were created in returns to the event loop, and finally that
+        when so deactivated they should commit rather than abort (as previously
+        implemented) if no requests have been filed.
+
+        Tests: storage/indexeddb/transaction-active-flag.html
+               storage/indexeddb/transaction-complete-with-js-recursion-cross-frame.html
+               storage/indexeddb/transaction-complete-with-js-recursion.html
+               storage/indexeddb/transaction-complete-workers.html
+
+        * Modules/indexeddb/IDBPendingTransactionMonitor.cpp: Simplify API.
+        (WebCore::transactions):
+        (WebCore::IDBPendingTransactionMonitor::addNewTransaction):
+        (WebCore::IDBPendingTransactionMonitor::deactivateNewTransactions):
+        * Modules/indexeddb/IDBPendingTransactionMonitor.h:
+        (WebCore):
+        (IDBPendingTransactionMonitor):
+        * Modules/indexeddb/IDBRequest.cpp: Unregisters from transaction when done,
+        not on destruction. No longer responsible for working with the pending monitor.
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::~IDBRequest):
+        (WebCore::IDBRequest::markEarlyDeath):
+        (WebCore::IDBRequest::resetReadyState):
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent): Set active flag on transaction during callback.
+        * Modules/indexeddb/IDBTransaction.cpp: Use state enum to better track lifecycle, and
+        take ownership of relationship with pending monitor.
+        (WebCore::IDBTransaction::IDBTransaction): Special cases for version change
+        transactions.
+        (WebCore::IDBTransaction::~IDBTransaction):
+        (WebCore::IDBTransaction::error):
+        (WebCore::IDBTransaction::setError):
+        (WebCore::IDBTransaction::objectStore):
+        (WebCore::IDBTransaction::objectStoreCreated):
+        (WebCore::IDBTransaction::objectStoreDeleted):
+        (WebCore::IDBTransaction::setActive): Let IDBRequest and IDBPendingTransactionMonitor
+        toggle the active state. Needs some smarts because (1) state may move to Finishing during
+        the request's dispatch phase due to an implicit/explicit abort, and (2) a monitor call
+        will only trigger a commit if the transaction hasn't had any requests filed.
+        (WebCore):
+        (WebCore::IDBTransaction::abort):
+        (WebCore::IDBTransaction::registerRequest):
+        (WebCore::IDBTransaction::unregisterRequest):
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        (WebCore::IDBTransaction::hasPendingActivity):
+        (WebCore::IDBTransaction::dispatchEvent):
+        (WebCore::IDBTransaction::canSuspend):
+        (WebCore::IDBTransaction::enqueueEvent):
+        * Modules/indexeddb/IDBTransaction.h:
+        (WebCore::IDBTransaction::isFinished):
+        (IDBTransaction):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::commit): Allow explicit commit() calls from the front end
+        if no requests have been filed.
+        * Modules/indexeddb/IDBTransactionBackendInterface.h:
+        (IDBTransactionBackendInterface): Expose commit() method.
+        * bindings/js/JSMainThreadExecState.cpp:
+        (WebCore::JSMainThreadExecState::didLeaveScriptContext): Change target function name.
+        * bindings/v8/V8RecursionScope.cpp:
+        (WebCore::V8RecursionScope::didLeaveScriptContext): Change target function name.
+
+2012-06-28  Philip Rogers  <pdr@google.com>
+
+        Prevent crash in animate resource handling
+        https://bugs.webkit.org/show_bug.cgi?id=90042
+
+        Reviewed by Abhishek Arya.
+
+        This patch adds a check that we are in a document before registering animation
+        resources and creating a target element in SVGSMILElement. This prevents a crash where
+        we would register resources and create the target when we were not in a document
+        but fail to deregister / reset the target when we were removed from a document.
+        In failing to reset the target, we can crash when trying to deregister resources that
+        were not created after being inserted into a document and then removed.
+
+        The existence of m_targetResources and registered animation resources is now
+        tied to being in a document.
+
+        Test: svg/custom/animate-reference-crash.html
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::targetElement):
+
+2012-06-28  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: IDBDatabase should have a close pending field.
+        https://bugs.webkit.org/show_bug.cgi?id=71129
+
+        Reviewed by Tony Chang.
+
+        Handle the IDB spec case that "versionchange" events should not be fired 
+        against connections that have the internal "closePending" flag set but 
+        are not yet closed due to running transactions.
+
+        Test: storage/indexeddb/database-closepending-flag.html
+
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::onVersionChange):
+
+2012-06-28  Adrienne Walker  <enne@google.com>
+
+        [chromium] Split WebScrollbar into WebPluginScrollbar and WebScrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=90117
+
+        Reviewed by James Robinson.
+
+        Make WebCore also depend on Platform.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-06-28  Hayato Ito  <hayato@chromium.org>
+
+        CompositeShadowTreeWalker should use InsertionPoint::hasDistribution() instead of InsertionPoint::isActive().
+        https://bugs.webkit.org/show_bug.cgi?id=89177
+
+        Reviewed by Dimitri Glazkov.
+
+        Prevents ComposedShadowTreeWalker from escaping out of an
+        insertion point (which has distributed nodes) from a non-used
+        fallback element in the insertion point.  Such a fallback element
+        should be treated as in an orphaned subtree.
+
+        ComposedShadowTreeParentWalker will be also fixed in a follow-up patch.
+
+        Test: fast/dom/shadow/composed-shadow-tree-walker.html
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
+
+2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Cleanup HTMLFormCollection
+        https://bugs.webkit.org/show_bug.cgi?id=90111
+
+        Reviewed by Andreas Kling.
+
+        Got rid of getNamedItem and renamed getNamedFormItem to firstNamedItem and got rid of duplicateNumber argument since
+        it's always 0. Also made it a static local function. In addition, removed nextItem() since it's not used anywhere.
+
+        WebKit API Test: WebKit1.HTMLFormCollectionNamedItemTest
+
+        * html/HTMLFormCollection.cpp:
+        (WebCore::firstNamedItem):
+        (WebCore):
+        (WebCore::HTMLFormCollection::namedItem):
+        * html/HTMLFormCollection.h:
+        (HTMLFormCollection):
+
+2012-06-28  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Hook up render-side key ASSERTing for get()
+        https://bugs.webkit.org/show_bug.cgi?id=90001
+
+        Reviewed by Tony Chang.
+
+        Hook up the new onSuccess and add it to the interface. For now,
+        simply assert that the right value is set. Add the same assertion
+        logic in the value-construction logic when the cursor advances.
+
+        No new tests, existing tests verify this refactor is correct.
+
+        * Modules/indexeddb/IDBCallbacks.h:
+        (IDBCallbacks):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::getInternal):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore):
+        (WebCore::IDBRequest::onSuccess):
+        * Modules/indexeddb/IDBRequest.h:
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+
+2012-06-28  Gregg Tavares  <gman@google.com>
+
+        Add support for DEPTH_STENCIL to WEBGL_depth_texture
+        https://bugs.webkit.org/show_bug.cgi?id=90109
+
+        Reviewed by Kenneth Russell.
+
+        * html/canvas/WebGLDepthTexture.idl:
+        * html/canvas/WebGLFramebuffer.cpp:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::validateTexFuncFormatAndType):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move chromium compositor implementation files into separate section in WebCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=90201
+
+        Reviewed by Adam Barth.
+
+        This moves the chromium compositor implementation files to a separate gyp variable to make future changes
+        easier. The files still all link into webcore_platform.lib, as before.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Use Eina_Module API instead of dlopen in PluginPackageEfl
+        https://bugs.webkit.org/show_bug.cgi?id=89972
+
+        Reviewed by Antonio Gomes.
+
+        Use convenience helpers in Eina_Module to load plugins instead
+        of POSIX dlopen().
+
+        No new tests, behavior has not changed.
+
+        * platform/FileSystem.h:
+        (WebCore):
+        * platform/efl/FileSystemEfl.cpp:
+        (WebCore::unloadModule):
+        * plugins/efl/PluginPackageEfl.cpp:
+        (WebCore::PluginPackage::load):
+
+2012-06-28  Jocelyn Turcotte  <turcotte.j@gmail.com>
+
+        [Qt] Fix TextureMapper rendering of GraphicsSurface on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=90154
+
+        Reviewed by Noam Rosenthal.
+
+        Fix a regression introduced in r120608.
+        texture2DRect takes texel coordinates, unlike texture2D which needs normalized coordinates.
+
+        Pass an additional textureSize uniform and multiply it by the normalized coordinates.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawTextureRectangleARB):
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        (WebCore::TextureMapperShaderProgram::TextureMapperShaderProgram):
+        (WebCore::TextureMapperShaderProgramRectSimple::TextureMapperShaderProgramRectSimple):
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (WebCore::TextureMapperShaderProgram::textureSizeLocation):
+        (TextureMapperShaderProgram):
+
+2012-06-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Improve compositing logging output
+        https://bugs.webkit.org/show_bug.cgi?id=90199
+
+        Reviewed by Tim Horton (w00t!).
+
+        Improve the compositing logging channel output in a few
+        useful ways:
+        1. Report memory use, rather than megapixels
+        2. Show element class names
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::backingStoreMemoryEstimate):
+        * platform/graphics/GraphicsLayer.h:
+        (GraphicsLayer):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::backingStoreMemoryEstimate):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::nameForLayer):
+        (WebCore::RenderLayerBacking::backingStoreMemoryEstimate):
+        * rendering/RenderLayerBacking.h:
+        (RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::logLayerInfo):
+        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Fix up more includes in compositor code
+        https://bugs.webkit.org/show_bug.cgi?id=90200
+
+        Reviewed by Adrienne Walker.
+
+        Adds includes we are using and removes ones that we aren't using.
+
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        * platform/graphics/chromium/ProgramBinding.cpp:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        * platform/graphics/chromium/cc/CCGraphicsContext.h:
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+
+2012-06-28  Andrei Onea  <onea@adobe.com>
+
+        [CSSRegions]Rename NamedFlow::contentNodes to NamedFlow::getContent()
+        https://bugs.webkit.org/show_bug.cgi?id=90163
+
+        Reviewed by Andreas Kling.
+
+        Latest CSS Regions spec defines the NamedFlow interface as having a function named getContent,
+        rather than an attribute named contentNodes.
+        http://www.w3.org/TR/css3-regions/#the-namedflow-interface
+
+        Test: fast/regions/webkit-named-flow-get-content.html
+
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::getContent):
+        * dom/WebKitNamedFlow.h:
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+
+2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r121232): named properties on document and window may return wrong object
+        https://bugs.webkit.org/show_bug.cgi?id=90133
+
+        Reviewed by Andreas Kling.
+
+        Fixed the bug. Also replaced hasAnyItem by isEmpty (hasAnyItem() is equivalent to !isEmpty()).
+
+        Test: fast/dom/HTMLDocument/named-item-multiple-match.html
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::GetNamedProperty):
+        * html/HTMLCollection.h:
+        (WebCore::HTMLCollection::isEmpty):
+        (WebCore::HTMLCollection::hasExactlyOneItem):
+
+2012-06-28  Zeev Lieber  <zlieber@chromium.org>
+
+        [Skia] Computing the resampling mode ignores scale applied to the canvas
+        https://bugs.webkit.org/show_bug.cgi?id=72073
+
+        Reviewed by Stephen White.
+
+        Re-basing earlier patch by Daniel Sievers; updated tests.
+
+        Take into account canvas scale when computing image resampling mode.
+
+        When drawing a bitmap and computing the best resampling mode based
+        on the requested scale, take into account CSS scale and page scale
+        that are applied to the canvas. This allows for single-pass scaling
+        in potentially better quality (RESAMPLE_AWESOME) and also takes
+        better advantage of the scaled image cache in that codepath.
+
+        Existing tests updated to expect different resampling method (and
+        therefore a different image) whenever canvas scaling changes.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Should schedule a commit when dropping contents textures
+        https://bugs.webkit.org/show_bug.cgi?id=90031
+
+        Reviewed by Adrienne Walker.
+
+        If we're dropping contents textures on the impl thread, we need to schedule a commit to pick up new contents at
+        the next commit opportunity. Also adds some traces to make debugging issues like this easier.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::commitComplete):
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::processScheduledActions):
+
+2012-06-28  Antti Koivisto  <antti@apple.com>
+
+        Don't malloc RenderGeometryMap steps individually
+        https://bugs.webkit.org/show_bug.cgi?id=90074
+
+        Reviewed by Simon Fraser.
+
+        Mallocs and frees for steps under RenderGeometryMap::pus/popMappingsToAncestor can total ~2% of the profile when animating transforms.
+
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore):
+        (WebCore::RenderGeometryMap::absolutePoint):
+        (WebCore::RenderGeometryMap::absoluteRect):
+        (WebCore::RenderGeometryMap::mapToAbsolute):
+        (WebCore::RenderGeometryMap::push):
+        (WebCore::RenderGeometryMap::pushView):
+        (WebCore::RenderGeometryMap::popMappingsToAncestor):
+        * rendering/RenderGeometryMap.h:
+        (WebCore):
+        (WebCore::RenderGeometryMapStep::RenderGeometryMapStep):
+        
+            Move to header.
+
+        (RenderGeometryMapStep):
+        (RenderGeometryMap):
+        
+            Make the step vector hold RenderGeometryMapSteps instead of RenderGeometryMapStep*'s.
+
+        (WTF):
+        
+            Give RenderGeometryMapSteps SimpleClassVectorTraits. This is needed for dealing with OwnPtr in the struct (and makes it faster too).
+            The type is simple enought to move by memcpy.
+
+2012-06-28  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Remove Windows support from plugins/gtk/
+        https://bugs.webkit.org/show_bug.cgi?id=89501
+
+        Reviewed by Martin Robinson.
+
+        The GTK+ port now uses plugins/gtk/ on Windows, which leaves
+        PluginPackageGtk.cpp and PluginViewGtk.cpp solely for XP_UNIX platforms.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::webkitgtkXError):
+        (WebCore::PluginPackage::load):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::getRootWindow):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        (WebCore::getPluginDisplay):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2012-06-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Change FrameView::scrollContentsFastPath to use m_fixedObjects
+        https://bugs.webkit.org/show_bug.cgi?id=90045
+
+        Reviewed by James Robinson.
+        
+        FrameView now has a hash set of fixed-position objects, so use
+        that instead of RenderBlock::positionedObjects(); we'll avoid traversing
+        through absolutely positioned objects, and this will work better for sticky
+        positioning in future.
+
+        No behavior change, so no new tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+
+2012-06-28  Tony Chang  <tony@chromium.org>
+
+        Split flex into flex-grow/flex-shrink/flex-basis
+        https://bugs.webkit.org/show_bug.cgi?id=86525
+
+        Reviewed by Ojan Vafai.
+
+        Split flex into 3 separate properties per the spec:
+        http://dev.w3.org/csswg/css3-flexbox/#flex-components
+
+        Tests: css3/flexbox/flex-longhand-parsing.html
+               css3/flexbox/flex-property-parsing.html: Updated test results.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore): -webkit-flex is no longer enumerable.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add new css property names and use
+        getCSSPropertyValuesForShorthandProperties for WebkitFlex. Also sort flex propery names.
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue): Fix indent.
+        (WebCore::CSSParser::parseValue): Add parsing for new properties and handle -webkit-flex: none.
+        (WebCore::CSSParser::parseFlex): Switch to new names (positive -> grow, negative -> shrink,
+        preferred size -> basis) and assign to longhand properties.
+        * css/CSSParser.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty): Add new properties.
+        * css/CSSPropertyNames.in: Add new properties.
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder): Delete special handling of applying flex and just use shorthand handlers.
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::getPropertyValue): Add new shorthand.
+        (WebCore::StylePropertySet::asText):
+        * css/StylePropertyShorthand.cpp:
+        (WebCore::webkitFlexShorthand): Add new shorthand.
+        (WebCore::shorthandForProperty):
+        * css/StylePropertyShorthand.h:
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList): Add to list of properties applied by StyleBuilder.
+        Handle initial and inherit for flex.
+
+2012-06-28  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK][Win]: Fix plugin drawing to an offscreen buffer
+        https://bugs.webkit.org/show_bug.cgi?id=89499
+
+        Reviewed by Brent Fulgham.
+
+        Take into account that the GTK+ port draws to a backing store and adjust
+        the target rectangle calculation accordingly.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::setNPWindowRect):
+
+2012-06-28  Kentaro Hara  <haraken@chromium.org>
+
+        Optimize Dromaeo/dom-attr.html by speeding up Element::getAttribute()
+        https://bugs.webkit.org/show_bug.cgi?id=90174
+
+        Reviewed by Adam Barth.
+
+        This patch improves performance of Dromaeo/dom-attr.html by 4.0%.
+        The patch improves performance of getAttribute() and JavaScript
+        property setter for DOM objects (e.g. 'div.foo = 123').
+        The performance improvement becomes larger, as the number of
+        attributes defined on the DOM object increases.
+
+        Without the patch in Chromium/Linux (runs/s)
+        7679.4, 7739.7, 7634.0, 7726.4, 7663.9
+
+        With the patch in Chromium/Linux (runs/s)
+        7977.7, 8032.2, 8112.8, 7948.1, 7924.5
+
+        This patch just changes a type of 'name' of Element::getAttribute(String& name)
+        from String& to AtomicString&.
+
+        The key observation is that AtomicString(String& x) is faster than
+        operator==(String& x, AtomicString& y). AtomicString(String& x) calculates
+        a hash of a given String and adds it to a hash table. The calculation
+        complexity is O(the length of x). On the other hand,
+        operator==(String& x, AtomicString& y) compares a String and an AtomicString by
+        StringImpl::equal(StringImpl*, StringImpl*), the calculation complexity of
+        which is O(2 * min(the length of x, the length of y)).
+        In addition, the comparison logic is more complicated than the logic
+        of calculating the hash. Consequently, AtomicString(String& x) is
+        faster than operator==(String& x, AtomicString& y).
+
+        Keeping that in mind, let's estimate the performance of
+        Element::getAttribute("class") for <div id="A" lang="B" title="C" class="D" dir="E">.
+        Here "id", "lang", "title", "class" and "dir" are stored as AtomicStrings
+        in QualifiedName::localName(). Initially, "class" in Element::getAttribute("class")
+        is a String.
+
+        If we use Element::getAttribute(String& name) (i.e. without the patch),
+        ElementAttributeData::getAttributeItemIndex() executes four
+        operator==(String&, AtomicString&) by the time it finds the "class" attribute:
+
+        (1) if ("class" == "id")       // operator==(String&, AtomicString&)
+        (2) if ("class" == "lang")     // operator==(String&, AtomicString&)
+        (3) if ("class" == "title")    // operator==(String&, AtomicString&)
+        (4) if ("class" == "class")    // operator==(String&, AtomicString&)
+
+        On the other hand, if we use Element::getAttribute(AtomicString& name)
+        (i.e. with the patch), ElementAttributeData::getAttributeItemIndex()
+        executes one AtomicString(String&) and four operator==(AtomicString&, AtomicString&)
+        by the time it finds the "class" attribute:
+
+        (1) AtomicString("class")      // AtomicString(String&)
+        (2) if ("class" == "id")       // operator==(AtomicString&, AtomicString&)
+        (3) if ("class" == "lang")     // operator==(AtomicString&, AtomicString&)
+        (4) if ("class" == "title")    // operator==(AtomicString&, AtomicString&)
+        (5) if ("class" == "class")    // operator==(AtomicString&, AtomicString&)
+
+        Considering that the overhead of operator==(AtomicString&, AtomicString&) is close
+        to 0 since it is just a pointer comparison, the latter approach is faster than
+        the former approach.
+
+        Performance improvement will be large for elements that have multiple attributes,
+        but it is faster even for elements that have only one attribute.
+        For exmaple, Dromaeo/dom-attr.html tests getAttribute() for an element that has
+        only one attribute, the result shows 4.0% improvement.
+
+        Another example optimized by this patch is 'div.foo = 123', where foo is not
+        an attribute of div. In this case, before 123 is set, JavaScript calls back
+        Element::getAttribute() to check whether 'foo' is defined on div by
+        scanning all the attributes of div.
+
+        No tests. No change in behavior.
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::getAttributeItemIndex):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        (WebCore::ElementAttributeData::getAttributeItem):
+        (WebCore::ElementAttributeData::getAttributeItemIndex):
+
+2012-06-28  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Don't dispatch end event after ActiveDOMObject::stop()
+        https://bugs.webkit.org/show_bug.cgi?id=90176
+
+        Reviewed by Adam Barth.
+
+        It is probably not safe to dispatch an event on an object that has
+        been ActiveDOMObject::stop()'ed.
+
+        This used to happen in the navigate-away.html test, which I believe
+        then caused speechgrammar-basics.html (which was typically run
+        afterwards, by the same worker), to crash flakily. See Bug 89717.
+
+        Test: speechgrammar-basics.html should no longer be flaky.
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::didEnd):
+        (WebCore::SpeechRecognition::stop):
+        (WebCore::SpeechRecognition::SpeechRecognition):
+        * Modules/speech/SpeechRecognition.h:
+
+2012-06-28  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [GTK] [WK2] Memory leak in ResourceHandleSoup.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=90168
+
+        Reviewed by Martin Robinson.
+
+        Fixed a memory leak in WebCoreSynchronousLoader by using adoptGRef
+        instead of just getting new reference of GMainLoop.
+
+        No new tests. No change in behavior.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+
+2012-06-27  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Do not multiply bounds by contentsScale in TiledLayerChromium and CanvasLayerTextureUpdater
+        https://bugs.webkit.org/show_bug.cgi?id=90103
+
+        Reviewed by Adrienne Walker.
+
+        Non-integer scale factors can scale the bounds of a layer such that
+        different rounding is applied to the width and height in the content
+        bounds. We should never multiply bounds by contentsScale in order to
+        work correctly with non-integer scale factors. Instead, always use the
+        contentBounds/bounds ratio for width and height independently.
+
+        Tests: TiledLayerChromiumTest.nonIntegerContentsScaleIsNotDistortedDuringPaint
+               TiledLayerChromiumTest.nonIntegerContentsScaleIsNotDistortedDuringInvalidation
+
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapCanvasLayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
+        (BitmapCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        (BitmapSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        (WebCore::CanvasLayerTextureUpdater::paintContents):
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.h:
+        (CanvasLayerTextureUpdater):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        (WebCore::LayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::updatePart):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::SkPictureCanvasLayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
+        (SkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::setNeedsDisplayRect):
+        (WebCore::TiledLayerChromium::updateTiles):
+
+2012-06-28  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        [Qt] Make GC's fill{Rounded}Rect use optimized shadow blur code
+        https://bugs.webkit.org/show_bug.cgi?id=90082
+
+        Reviewed by Noam Rosenthal.
+
+        ShadowBlur::drawRectShadow makes use of optimized tiles-based drawPattern, which
+        is not present when using {begin/end}shadowLayer.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::pushTransparencyLayerInternal):
+
+2012-06-28  Rahul Tiwari  <rahultiwari.cse.iitr@gmail.com>
+
+        Web Inspector: Provide context menu 'Delete all watch expressions.'
+        https://bugs.webkit.org/show_bug.cgi?id=89735
+
+        Reviewed by Yury Semikhatsky.
+
+        Added context menu delete and delete all watch expressions.
+
+        No new tests required as its a minor UI related change.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+        (WebInspector.WatchExpressionsSection.prototype._deleteAllExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype._contextMenu):
+        (WebInspector.WatchExpressionTreeElement.prototype._deleteAllButtonClicked):
+
+2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>
+
+        m_cssVariablesEnabled member is not initialized in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=90147
+
+        Reviewed by Simon Hausmann.
+
+        Properly initialize the m_cssVariablesEnabled member in Page
+        Settings.
+
+        No new tests, no behavior change.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2012-06-28  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] plugin is loaded to the web process via MainResourceLoader::substituteMIMETypeFromPluginDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=86489
+
+        Reviewed by Simon Hausmann.
+
+        Removed the substituteMIMETypeFromPluginDatabase quirk from
+        MainResourceLoader. It would be possible to fix it in a way
+        that is compatible with WebKit2, but given that it was a Qt
+        only fix, and that it's not clear that we still need it, and
+        it's not even work currently, I decided to remove it. At least
+        it is -1 platform ifdef in common code.
+
+        Just removed a non-tested quirk, no test needed.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+
+2012-06-28  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Optimize Integer::New() by caching persistent handles for small integers
+        https://bugs.webkit.org/show_bug.cgi?id=90043
+
+        Reviewed by Adam Barth.
+
+        The patch improves performance of Dromaeo/dom-query.html by 3.6%,
+        and Bindings/scroll-top.html by 17.3%.
+
+        The performance results in my Chromium/Linux:
+
+        [Dromaeo/dom-query.html]
+        796310.4 runs/s => 824745.4 runs/s (+3.6%)
+
+        [Bindings/scroll-top.html]
+        204.68 runs/s => 240.15 runs/s (+17.3%)
+
+        This patch introduces V8BindingPerIsolateData::IntegerCache (just like
+        V8BindingPerIsolateData::StringCache) to cache persistent handles
+        for small integers.
+
+        No new tests. No change in behavior.
+
+        * bindings/v8/V8Binding.h: Implemented v8Integer() and v8UnsignedInteger(),
+        which returns cached persistent handles for integers smaller than 64.
+        (WebCore):
+        (IntegerCache):
+        (WebCore::IntegerCache::IntegerCache):
+        (WebCore::IntegerCache::v8Integer):
+        (WebCore::IntegerCache::v8UnsignedInteger):
+        (WebCore::V8BindingPerIsolateData::integerCache):
+        (V8BindingPerIsolateData):
+        (WebCore::v8Integer):
+        (WebCore::v8UnsignedInteger):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore):
+        (WebCore::IntegerCache::createSmallIntegers):
+        * bindings/v8/WorkerScriptController.cpp:
+        (~WorkerScriptController): ~V8BindingPerIsolateData() should be called before
+        isolate->Exit(), since ~V8BindingPerIsolateData() calls V8 APIs that requires
+        the current isolate.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Replaced Integer::New() and Integer::NewFromUnsigned()
+        with v8Integer() and v8UnsignedInteger().
+        (GenerateNormalAttrGetter):
+        (NativeToJSValue):
+
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp: Updated run-bindings-tests results.
+        (WebCore::TestActiveDOMObjectV8Internal::excitingAttrAttrGetter):
+        * bindings/scripts/test/V8/V8TestObj.cpp: Ditto.
+        (WebCore::TestObjV8Internal::readOnlyIntAttrAttrGetter):
+        (WebCore::TestObjV8Internal::shortAttrAttrGetter):
+        (WebCore::TestObjV8Internal::unsignedShortAttrAttrGetter):
+        (WebCore::TestObjV8Internal::intAttrAttrGetter):
+        (WebCore::TestObjV8Internal::reflectedIntegralAttrAttrGetter):
+        (WebCore::TestObjV8Internal::reflectedUnsignedIntegralAttrAttrGetter):
+        (WebCore::TestObjV8Internal::reflectedCustomIntegralAttrAttrGetter):
+        (WebCore::TestObjV8Internal::attrWithGetterExceptionAttrGetter):
+        (WebCore::TestObjV8Internal::attrWithSetterExceptionAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptStateAttributeAttrGetter):
+        (WebCore::TestObjV8Internal::conditionalAttr1AttrGetter):
+        (WebCore::TestObjV8Internal::conditionalAttr2AttrGetter):
+        (WebCore::TestObjV8Internal::conditionalAttr3AttrGetter):
+        (WebCore::TestObjV8Internal::enabledAtRuntimeAttr1AttrGetter):
+        (WebCore::TestObjV8Internal::enabledAtRuntimeAttr2AttrGetter):
+        (WebCore::TestObjV8Internal::enabledAtContextAttr1AttrGetter):
+        (WebCore::TestObjV8Internal::enabledAtContextAttr2AttrGetter):
+        (WebCore::TestObjV8Internal::strawberryAttrGetter):
+        (WebCore::TestObjV8Internal::descriptionAttrGetter):
+        (WebCore::TestObjV8Internal::idAttrGetter):
+        (WebCore::TestObjV8Internal::intMethodCallback):
+        (WebCore::TestObjV8Internal::intMethodWithArgsCallback):
+        (WebCore::TestObjV8Internal::classMethodWithOptionalCallback):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp: Ditto.
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::portsAttrGetter):
+
+2012-06-28  Kent Tamura  <tkent@chromium.org>
+
+        Classify form control states by their owner forms
+        https://bugs.webkit.org/show_bug.cgi?id=89950
+
+        Reviewed by Hajime Morita.
+
+        To improve robustness of the form state restore feature, we classify
+        form control states by their owner forms. Owner forms are identified by
+        their action URLs and index numbers in forms with the same action URLs.
+
+        Implementation approach:
+        Extend FormElementKey class to have "formKey" string, which is a
+        combination of the action URL and an index number, or a fixed string for
+        no form owner.
+        FormKeyGenerator class is responsible to generate the "formKey" strings
+
+        Test: fast/forms/state-restore-per-form.html
+
+        * html/FormController.cpp:
+        (FormKeyGenerator):
+        (WebCore::FormKeyGenerator::create): A factory function.
+        (WebCore::FormKeyGenerator::FormKeyGenerator): A private constructor.
+        (WebCore::createKey):
+        A helper for formKey(). This makes strings like "<action URL> #<index>".
+        (WebCore::FormKeyGenerator::formKey):
+        Returns a formKey for the specified HTMLFormElement*.
+        (WebCore::FormKeyGenerator::willDeleteForm):
+        Unregister HTMLFormElement*. This function is necessary because form
+        restore feature works during parsing and a script might delete form
+        elements.
+        (WebCore::formStateSignature): Bump the version.
+        (WebCore::FormController::formElementsState):
+        Records a formKey string for each of control state.
+        (WebCore::FormController::setStateForNewFormElements):
+        Loads formKeys from stateVector, and uses them for FormElementKey.
+        (WebCore::FormController::takeStateForFormElement):
+        - Construct and destruct FormKeyGenerator if needed.
+        - Passing a formKey for the specified form control to FormElementKey.
+        (WebCore::FormController::willDeleteForm):
+        Delegate to FormKeyGenerator::willDeleteForm.
+
+        (WebCore::FormElementKey::FormElementKey): Add formKey argument and member.
+        (WebCore::FormElementKey::operator=): ditto.
+        (WebCore::FormElementKey::ref): ditto.
+        (WebCore::FormElementKey::deref): ditto.
+        * html/FormController.h:
+        (FormElementKey): Add formKey argument and member.
+        (FormController): Add a FormKeyGenerator member which is used during restoring.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::~HTMLFormElement): Notify the death to FormController.
+
+2012-06-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121395.
+        http://trac.webkit.org/changeset/121395
+        https://bugs.webkit.org/show_bug.cgi?id=90143
+
+        Patch causes crashes in fast/workers/worker-context-gc.html
+        (Requested by zdobersek on #webkit).
+
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        * workers/DedicatedWorkerThread.h:
+        (DedicatedWorkerThread):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/SharedWorkerThread.h:
+        (SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WorkerThreadStartupData):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::WorkerThread):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-06-28  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement functions for localized time format information
+        https://bugs.webkit.org/show_bug.cgi?id=89965
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces three functions for time format:
+          1. localizedTimeFormatText()
+          2. localizedShortTimeFormatText()
+          2. timeAMPMLabels()
+        for input type "time" if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS) is true.
+
+        Having both localizedTimeFormat and localizedShortTimeFormat is for
+        displaying only two fields hour and minute when step >= 60. There is
+        no way to remove second field from "h:m:s" pattern string. We don't
+        know whether ":" after "m" belongs minute or second field.
+
+        Test: WebKit/chromium/tests/LocalizedDateICUTest.cpp
+
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::LocaleICU):
+        (WebCore::createFallbackAMPMLabels): Added.
+        (WebCore::LocaleICU::initializeDateTimeFormat):  Added.
+        (WebCore::LocaleICU::localizedTimeFormatText):  Added.
+        (WebCore::LocaleICU::localizedShortTimeFormatText):  Added.
+        (WebCore::LocaleICU::timeAMPMLabels):  Added.
+        * platform/text/LocaleICU.h:
+        (LocaleICU):
+        * platform/text/LocalizedDate.h:
+        * platform/text/LocalizedDateICU.cpp:
+        (WebCore::localizedTimeFormatText):  Added.
+        (WebCore::localizedShortTimeFormatText):  Added.
+        (WebCore::timeAMPMLabels):  Added.
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        Performance: Optimize Dromaeo/dom-query.html by caching NodeRareData on Document
+        https://bugs.webkit.org/show_bug.cgi?id=90059
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch improves performance of document.getElementsBy*().
+        e.g. the patch makes Dromaeo/dom-query.html 5.4% faster.
+
+        Dromaeo/dom-query.html without the patch (Chromium/Linux):
+        784714 runs/s, 765947 runs/s, 803109 runs/s, 804450 runs/s
+
+        Dromaeo/dom-query.html with the patch (Chromium/Linux):
+        839245 runs/s, 829867 runs/s, 811032 runs/s, 847486 runs/s
+
+        Based on the assumption that document.getElementsByClassName(),
+        document.getElementsByTagName() and document.getElementsByName()
+        would be used frequently in the real world, this patch implements
+        a fast path for Document methods that require to access NodeRareData.
+        Specifically, this patch caches a pointer to NodeRareData on Document,
+        by which Document can access NodeRareData without looking up a HashMap.
+
+        The only performance concern is the overhead of the isDocumentNode() check
+        that this patch added to Node::ensureRareData. However, I could not
+        observe any performance regression caused by the overhead.
+
+        No tests. No change in behavior.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::setCachedRareData): I didn't inline this method,
+        since the inlining slightly regressed performance for some reason.
+        (WebCore):
+        * dom/Document.h:
+        (WebCore):
+        (WebCore::Document::cachedRareData):
+        (Document):
+        (~Document): Moved 'm_document = 0' to the tail of the destructor,
+        since isDocumentNode() has to return true in clearRareData() that is called
+        in ~Document().
+        * dom/Node.cpp:
+        (WebCore::Node::ensureRareData):
+        (~Node): Moved the assertion into clearRareData().
+
+2012-06-27  Mary Wu  <mary.wu@torchmobile.com.cn>
+
+        [BlackBerry] 0-length response with no content-type shouldn't download
+        https://bugs.webkit.org/show_bug.cgi?id=89860
+
+        Reviewed by Rob Buis.
+
+        RIM PR# 168419
+
+        For 0-length response, if we can't get its mimetype from the filename,
+        we set the mimetype to "text/plain" instead of "application/octet-stream",
+        so it won't go to download.
+
+        Reviewed internally by Charles Wei.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::sendResponseIfNeeded):
+
+2012-06-27  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement localizedDecimalSeparator function
+        https://bugs.webkit.org/show_bug.cgi?id=90036
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces new function localizedDecimalSeparator() when
+        ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS). It will be used for
+        displaying millisecond for time fields UI.
+
+        Test: WebKit/chromium/tests/LocalizedNumberICUTest.cpp
+
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::localizedDecimalSeparator): Added
+        * platform/text/LocaleICU.h:
+        (LocaleICU): Added localizedDecimalSeparator.
+        * platform/text/LocalizedNumber.h:
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::localizedDecimalSeparator): Added.
+        * platform/text/LocalizedNumberNone.cpp:
+        (WebCore::localizedDecimalSeparator): Added.
+        * platform/text/mac/LocalizedNumberMac.mm:
+        (WebCore::localizedDecimalSeparator): Added.
+
+2012-06-27  Lu Guanqun  <guanqun.lu@intel.com>
+
+        Add OVERRIDE to functions in UnthrottledTextureUploader class
+        https://bugs.webkit.org/show_bug.cgi?id=90130
+
+        Reviewed by James Robinson.
+
+        No new tests required.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+
+2012-06-27  Pablo Flouret  <pablof@motorola.com>
+
+        pattern="" should only accept the empty string
+        https://bugs.webkit.org/show_bug.cgi?id=89569
+
+        Reviewed by Kent Tamura.
+
+        An empty pattern attribute was being treated essentially as if the
+        pattern wasn't present.
+
+        No new tests. Covered by existing tests (plus a modified one).
+
+        * html/BaseTextInputType.cpp:
+        (WebCore::BaseTextInputType::patternMismatch):
+            Check if the pattern attribute is present. If it is then use the
+            pattern as is (in the particular case of this bug, an empty pattern
+            will only match an empty value).
+
+2012-06-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use SkColor in compositor internals
+        https://bugs.webkit.org/show_bug.cgi?id=90108
+
+        Reviewed by Adrienne Walker.
+
+        As the title says, cutting dependencies. If we support color spaces in the compositor we will probably need to
+        use a more sophisticated type, but for our current use SkColor is sufficient and matches our API better.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setBackgroundColor):
+        (WebCore::LayerChromium::setDebugBorderColor):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        (WebCore::LayerChromium::backgroundColor):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
+        (WebCore::LayerRendererChromium::drawSolidColorQuad):
+        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp:
+        (WebCore::CCDebugBorderDrawQuad::create):
+        (WebCore::CCDebugBorderDrawQuad::CCDebugBorderDrawQuad):
+        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h:
+        (CCDebugBorderDrawQuad):
+        (WebCore::CCDebugBorderDrawQuad::color):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::setBackgroundColor):
+        (WebCore::CCLayerImpl::setDebugBorderColor):
+        (WebCore::CCLayerImpl::hasDebugBorders):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::backgroundColor):
+        (WebCore::CCLayerImpl::debugBorderColor):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeHost::setBackgroundColor):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore::CCLayerTreeHostImpl::backgroundColor):
+        (WebCore::CCLayerTreeHostImpl::setBackgroundColor):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::appendQuadInternal):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::appendQuadsToFillScreen):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (WebCore):
+        (CCRenderPass):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::appendQuads):
+        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp:
+        (WebCore::CCSolidColorDrawQuad::create):
+        (WebCore::CCSolidColorDrawQuad::CCSolidColorDrawQuad):
+        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.h:
+        (CCSolidColorDrawQuad):
+        (WebCore::CCSolidColorDrawQuad::color):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::CCTiledLayerImpl::appendQuads):
+
+2012-06-27  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        IndexedDB: should make the LevelDB persistant to the directory indicated in PageGroupSettings::indexedDBDataBasePath
+        https://bugs.webkit.org/show_bug.cgi?id=88338
+
+        Reviewed by David Levin.
+
+        If the indexedDB runs in main thread it can access the GroupSettings via the document;
+        otherwise, we need to pass the page GroupSettings to the worker thread so that accessible
+        to the indexedDB running in WorkerContext.
+
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        * workers/DedicatedWorkerThread.h:
+        (DedicatedWorkerThread):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::groupSettings):
+        (WebCore):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/SharedWorkerThread.h:
+        (SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WorkerThreadStartupData):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::groupSettings):
+        (WebCore):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121359.
+        http://trac.webkit.org/changeset/121359
+        https://bugs.webkit.org/show_bug.cgi?id=90115
+
+        Broke many inspector tests (Requested by jpfau on #webkit).
+
+        * bindings/js/ScriptCallStackFactory.cpp:
+        (WebCore::createScriptCallStack):
+
+2012-06-27  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Implement selectedOptions attribute of HTMLSelectElement.
+        https://bugs.webkit.org/show_bug.cgi?id=80631
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a new collection as a member of HTMLSelectElement which is
+        used to store the selected elements. Extend HTMLCollection to
+        support the new collection type needed by this feature. Make sure
+        that we invalidate the collection when the select state of an
+        option changes as the select state change does not trigger a dom
+        tree version change.
+
+        Reference : http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#dom-select-selectedoptions
+
+        Test: fast/dom/HTMLSelectElement/select-selectedOptions.html
+
+        * html/CollectionType.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::shouldIncludeChildren):
+        (WebCore::HTMLCollection::clearCache):
+        (WebCore):
+        (WebCore::HTMLCollection::isAcceptableElement):
+        * html/HTMLCollection.h:
+        (HTMLCollection):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setSelectedState):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedOptions):
+        (WebCore):
+        (WebCore::HTMLSelectElement::invalidateSelectedItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        * html/HTMLSelectElement.h:
+        (WebCore):
+        (HTMLSelectElement):
+        * html/HTMLSelectElement.idl:
+
+2012-06-27  Daniel Cheng  <dcheng@chromium.org>
+
+        Fix crash in Frame::nodeImage.
+        https://bugs.webkit.org/show_bug.cgi?id=89911
+
+        Reviewed by Abhishek Arya.
+
+        We were caching a pointer to a RenderObject and then calling updateLayout(). Instead, we
+        need to get a pointer to the RenderObject again after updateLayout().
+
+        Test: fast/events/drag-display-none-element.html
+
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::snapshotDragImage):
+        (WebCore::Frame::nodeImage):
+
+2012-06-27  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r121380.
+        http://trac.webkit.org/changeset/121380
+        https://bugs.webkit.org/show_bug.cgi?id=86525
+
+        Hits an ASSERT in debug.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFlex):
+        * css/CSSParser.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/StyleBuilder.cpp:
+        (ApplyPropertyFlex):
+        (WebCore::ApplyPropertyFlex::applyInheritValue):
+        (WebCore::ApplyPropertyFlex::applyInitialValue):
+        (WebCore::ApplyPropertyFlex::applyValue):
+        (WebCore::ApplyPropertyFlex::createHandler):
+        (WebCore::ApplyPropertyFlex::getFlexValue):
+        (WebCore):
+        (WebCore::StyleBuilder::StyleBuilder):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::getPropertyValue):
+        (WebCore::StylePropertySet::asText):
+        * css/StylePropertyShorthand.cpp:
+        (WebCore::webkitFlexFlowShorthand):
+        (WebCore::shorthandForProperty):
+        * css/StylePropertyShorthand.h:
+        (WebCore):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-27  Rakesh KN  <rakesh.kn@motorola.com>
+
+        HTMLFieldSetElement::m_documentVersion is not initialized
+        https://bugs.webkit.org/show_bug.cgi?id=90038
+
+        Reviewed by Kent Tamura.
+
+        Initialised m_documentVersion member as HTMLFieldSetElement::elements can return an wrong collection.
+
+        Covered by existing tests.
+
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
+        Initialised m_documentVersion.
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests. Current regression tests are sufficient.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::garbageCollectSoon):
+        (WebCore::GCController::garbageCollectNow):
+        (WebCore::GCController::discardAllCompiledCode):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::nodeAsScriptValue):
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadExecState::evaluate):
+        * bindings/js/JSMutationCallbackCustom.cpp:
+        (WebCore::JSMutationCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
+        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
+        * bindings/js/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::cacheableBindingRootObject):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::dispatchDidPause):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::eventListenerHandlerBody):
+        (WebCore::eventListenerHandlerLocation):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptCallArgumentHandler::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptCallback::call):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::toInspectorValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::disableEval):
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject hasWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallbackImplementation):
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithNoParam):
+        (WebCore::JSTestCallback::callbackWithClass1Param):
+        (WebCore::JSTestCallback::callbackWithClass2Param):
+        (WebCore::JSTestCallback::callbackWithStringList):
+        (WebCore::JSTestCallback::callbackWithBoolean):
+        (WebCore::JSTestCallback::callbackRequiresThisToPass):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jsc/JavaMethodJSC.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::utf8):
+        (JSC::Bindings::JavaString::init):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeObjcMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::gcProtect):
+        (JSC::Bindings::RootObject::gcUnprotect):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::npObject):
+        (WebCore::PluginView::privateBrowsingStateChanged):
+        * plugins/blackberry/PluginViewBlackBerry.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::getWindowInfo):
+        * plugins/efl/PluginViewEfl.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::injectInternalsObject):
+        (WebCoreTestSupport::resetInternalsObject):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2012-06-27  Tony Chang  <tony@chromium.org>
+
+        Split flex into flex-grow/flex-shrink/flex-basis
+        https://bugs.webkit.org/show_bug.cgi?id=86525
+
+        Reviewed by Ojan Vafai.
+
+        Split flex into 3 separate properties per the spec:
+        http://dev.w3.org/csswg/css3-flexbox/#flex-components
+
+        Tests: css3/flexbox/flex-longhand-parsing.html
+               css3/flexbox/flex-property-parsing.html: Updated test results.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore): -webkit-flex is no longer enumerable.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add new css property names and use
+        getCSSPropertyValuesForShorthandProperties for WebkitFlex. Also sort flex propery names.
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue): Fix indent.
+        (WebCore::CSSParser::parseValue): Add parsing for new properties and handle -webkit-flex: none.
+        (WebCore::CSSParser::parseFlex): Switch to new names (positive -> grow, negative -> shrink,
+        preferred size -> basis) and assign to longhand properties.
+        * css/CSSParser.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty): Add new properties.
+        * css/CSSPropertyNames.in: Add new properties.
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder): Delete special handling of applying flex and just use shorthand handlers.
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::getPropertyValue): Add new shorthand.
+        (WebCore::StylePropertySet::asText):
+        * css/StylePropertyShorthand.cpp:
+        (WebCore::webkitFlexShorthand): Add new shorthand.
+        (WebCore::shorthandForProperty):
+        * css/StylePropertyShorthand.h:
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList): Add to list of properties applied by StyleBuilder.
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        Make Element::elementRareData() and Element::ensureElementRareData() private
+        https://bugs.webkit.org/show_bug.cgi?id=90060
+
+        Reviewed by Andreas Kling.
+
+        This is a simple refactoring. Element::elementRareData() and
+        Element::ensureElementRareData() can be private methods.
+
+        No tests. No change in behavior.
+
+        * dom/Element.h:
+        (Element):
+
+2012-06-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Delete unused includes and forward declarations from compositor code
+        https://bugs.webkit.org/show_bug.cgi?id=90102
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        * platform/graphics/chromium/ShaderChromium.h:
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateTiles):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+
+2012-06-27  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: make IDBKey immutable
+        https://bugs.webkit.org/show_bug.cgi?id=90016
+
+        Reviewed by Tony Chang.
+
+        Make all members of IDBKey const, so that this can be considered
+        an immutable, and thus safe to copy and/or stop ref-counting.
+
+        No new tests, existing tests show this works.
+
+        * Modules/indexeddb/IDBKey.cpp:
+        (WebCore::IDBKey::compare):
+        * Modules/indexeddb/IDBKey.h:
+        (WebCore::IDBKey::createInvalid):
+        (WebCore::IDBKey::createNumber):
+        (WebCore::IDBKey::createString):
+        (WebCore::IDBKey::createDate):
+        (WebCore::IDBKey::createMultiEntryArray):
+        (WebCore::IDBKey::createArray):
+        (WebCore::IDBKey::date):
+        (WebCore::IDBKey::IDBKey):
+        (IDBKey):
+
+2012-06-27  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Improve variable resolution order on window
+        https://bugs.webkit.org/show_bug.cgi?id=84247
+
+        Reviewed by Ojan Vafai.
+
+        This changes the V8 flag to turn on es52_globals and updates the layout tests to reflect the fixed behavior.
+
+        This is the second (third?) try. Last time there was a bug in the V8 code related to the split window.
+        I added a test that tests the failure that caused this to be rolled back last time.
+
+        Tests: fast/dom/Window/es52-globals.html
+               fast/dom/Window/window-property-shadowing-onclick.html
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initIsolate):
+
+2012-06-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use categorized TRACE_EVENTN() macros in compositor code
+        https://bugs.webkit.org/show_bug.cgi?id=90100
+
+        Reviewed by Adrienne Walker.
+
+        Specify the category in all traces in the compositor. Patch generated mostly by the sed command
+        's/TRACE_EVENT(\(.*\), this, 0)/TRACE_EVENT0("cc", \1)/'.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::beginDrawingFrame):
+        (WebCore::LayerRendererChromium::finish):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::tileCheckerboardProgram):
+        (WebCore::LayerRendererChromium::solidColorProgram):
+        (WebCore::LayerRendererChromium::headsUpDisplayProgram):
+        (WebCore::LayerRendererChromium::renderPassProgram):
+        (WebCore::LayerRendererChromium::renderPassProgramAA):
+        (WebCore::LayerRendererChromium::renderPassMaskProgram):
+        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
+        (WebCore::LayerRendererChromium::tileProgram):
+        (WebCore::LayerRendererChromium::tileProgramOpaque):
+        (WebCore::LayerRendererChromium::tileProgramAA):
+        (WebCore::LayerRendererChromium::tileProgramSwizzle):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleOpaque):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleAA):
+        (WebCore::LayerRendererChromium::textureProgram):
+        (WebCore::LayerRendererChromium::textureProgramFlip):
+        (WebCore::LayerRendererChromium::textureIOSurfaceProgram):
+        (WebCore::LayerRendererChromium::videoYUVProgram):
+        (WebCore::LayerRendererChromium::videoStreamTextureProgram):
+        * platform/graphics/chromium/LayerTextureSubImage.cpp:
+        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
+        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::SkPictureCanvasLayerTextureUpdater::drawPicture):
+        * platform/graphics/chromium/TextureCopier.cpp:
+        (WebCore::AcceleratedTextureCopier::copyTexture):
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::evictTexture):
+        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
+        (WebCore::CCFrameRateController::setActive):
+        (WebCore::CCFrameRateController::onTimerTick):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initialize):
+        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::beginCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::didLoseContext):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::animateLayers):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::~CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::compositeAndReadback):
+        (WebCore::CCSingleThreadProxy::stop):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::~CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::initializeContext):
+        (WebCore::CCThreadProxy::initializeLayerRenderer):
+        (WebCore::CCThreadProxy::setNeedsAnimate):
+        (WebCore::CCThreadProxy::setNeedsCommit):
+        (WebCore::CCThreadProxy::onSwapBuffersCompleteOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsCommitOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsForcedCommitOnImplThread):
+        (WebCore::CCThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsRedraw):
+        (WebCore::CCThreadProxy::setNeedsRedrawOnImplThread):
+        (WebCore::CCThreadProxy::stop):
+        (WebCore::CCThreadProxy::finishAllRenderingOnImplThread):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
+        (WebCore::CCThreadProxy::scheduledActionCommit):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
+        (WebCore::CCThreadProxy::acquireLayerTextures):
+        (WebCore::CCThreadProxy::initializeImplOnImplThread):
+        (WebCore::CCThreadProxy::initializeContextOnImplThread):
+        (WebCore::CCThreadProxy::initializeLayerRendererOnImplThread):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+
+2012-06-27  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] ScrollbarLayerChromium should support painting forward-track and back-track in different styles.
+        https://bugs.webkit.org/show_bug.cgi?id=89908
+
+        Reviewed by Adrienne Walker.
+
+        Test: platform/chromium/compositing/scrollbars/custom-composited-different-track-parts.html
+
+        Adds support for accelerated drawing (impl thread) of scrollbars with different styles for the
+        forward-track and back-track parts.
+
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
+        (WebCore::ScrollbarBackgroundPainter::create):
+        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
+        (ScrollbarBackgroundPainter):
+        (WebCore::ScrollbarLayerChromium::setLayerTreeHost):
+        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
+        (WebCore::ScrollbarLayerChromium::update):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
+        (WebCore):
+        (WebCore::CCScrollbarLayerImpl::appendQuads):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        (WebCore::CCScrollbarLayerImpl::setBackTrackTextureId):
+        (WebCore::CCScrollbarLayerImpl::setForeTrackTextureId):
+        (CCScrollbarLayerImpl):
+
+2012-06-27  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Allow screen space rects and occluding rects to be visualized for debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=90012
+
+        Reviewed by Adrienne Walker.
+
+        No new tests. No new functionality.
+
+        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
+        (WebCore::CCDebugRectHistory::enabled):
+        (WebCore::CCDebugRectHistory::saveDebugRectsForCurrentFrame):
+        (WebCore::CCDebugRectHistory::saveScreenSpaceRects):
+        (WebCore):
+        (WebCore::CCDebugRectHistory::saveOccludingRects):
+        * platform/graphics/chromium/cc/CCDebugRectHistory.h:
+        (WebCore):
+        (CCDebugRectHistory):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::showDebugRects):
+        (WebCore::CCHeadsUpDisplay::draw):
+        (WebCore::CCHeadsUpDisplay::drawDebugRects):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
+        (CCLayerTreeSettings):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (FrameData):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::CCOcclusionTrackerBase):
+        (WebCore::addOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::setOccludingScreenSpaceRectsContainer):
+
+2012-06-27  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
+        https://bugs.webkit.org/show_bug.cgi?id=40118
+
+        Reviewed by Yong Li.
+
+        Implemented stub for createScriptCallStack to call into
+        Interpreter and extract the current stack frames, iterate
+        through the frames and create the return result required.
+
+        No new tests, manually tested thrown exception and inspector
+        tracebacks.
+
+        * bindings/js/ScriptCallStackFactory.cpp:
+        (WebCore::createScriptCallStack):
+
+2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Let Xcode have its own way.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION (Safari 5?): Pasting a line into textarea inserts two newlines
+        https://bugs.webkit.org/show_bug.cgi?id=49288
+
+        Reviewed by Tony Chang.
+
+        The bug was caused by positionAvoidingPrecedingNodes getting out of a block when the insertion point is at a line break.
+        It caused the subsequent code to be misinformed of the insertion position and ended up not pruning the extra line break.
+
+        Fixed the bug by checking this special case and bailing out so that we don't crawl out of the enclosing block.
+        It's similar to checks several lines below it.
+
+        Test: editing/pasteboard/copy-paste-pre-line-content.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::positionAvoidingPrecedingNodes):
+
+2012-06-27  Andrei Onea  <onea@adobe.com>
+
+        [CSSRegions]Change display values that allow regions
+        https://bugs.webkit.org/show_bug.cgi?id=89759
+
+        Reviewed by Tony Chang.
+
+        Allow only elements with display values of block, inline-block,
+        table-cell, table-caption and list-item to become regions, as per
+        CSSRegions spec: http://dev.w3.org/csswg/css3-regions .
+        Also added test for checking whether regions are destroyed and/or created
+        when changing display value.
+
+        Test: fast/regions/region-element-display-change.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyle.h:
+
+2012-06-27  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: blending involving expressions
+        https://bugs.webkit.org/show_bug.cgi?id=86160
+
+        Reviewed by Tony Chang.
+
+        If either endpoint of a blend involves a calc expression, we create a new
+        expression to perform the blend calculation.
+
+        Test: css3/calc/transitions.html
+              css3/calc/transitions-dependent.html
+
+        * platform/Length.cpp:
+        (WebCore):
+        (WebCore::Length::blendCalculation):
+        * platform/Length.h:
+        (WebCore::Length::blend):
+        (Length):
+
+2012-06-27  Hans Muller  <hmuller@adobe.com>
+
+        Move CSSWrapShape style resolution from StyleResolver to StyleBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=89668
+
+        Reviewed by Andreas Kling.
+
+        Moved the resolution of the shapeInside and shapeOutside CSS properties
+        from the StyleResolver class to StyleBuilder. This is just refactoring
+        in preparation for fixing https://bugs.webkit.org/show_bug.cgi?id=89670.
+
+        No new tests were required.
+
+        * css/StyleBuilder.cpp:
+        (WebCore):
+        (ApplyPropertyWrapShape):
+        (WebCore::ApplyPropertyWrapShape::setValue):
+        (WebCore::ApplyPropertyWrapShape::applyValue):
+        (WebCore::ApplyPropertyWrapShape::createHandler):
+        (WebCore::StyleBuilder::StyleBuilder):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-27  Alexandru Chiculita  <achicu@adobe.com>
+
+        Blur filter causes issues when scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=89475
+
+        Reviewed by Simon Fraser.
+
+        This patch disables the fast scrolling when there is a fixed postioned element that
+        has a filter applied on its parent layer. Otherwise the scroll blitting will just
+        copy the outsets of the blur effect.
+
+        Test: css3/filters/blur-filter-page-scroll.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+
+2012-06-27  Andreas Kling  <kling@webkit.org>
+
+        REGRESSION(r121296): New zero-size background tests asserting on Mac.
+        <http://webkit.org/b/90071>
+
+        Reviewed by Dan Bernstein.
+
+        Remove ASSERT(patternTransform.isInvertible()) as this is now a valid scenario.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+
+2012-06-27  Shinya Kawanaka  <shinyak@chromium.org>
+
+        HTMLStyleElement::removedFrom seems incorrect.
+        https://bugs.webkit.org/show_bug.cgi?id=89986
+
+        Reviewed by Hajime Morita.
+
+        This is a follow-up patch for Bug 88495. The Same bug as Bug 88495 seems to exist on
+        HTMLStyleElement::removedFrom().
+
+        No new tests, hard to write a test case.
+
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFrom):
+
+2012-06-27  Mike Reed  <reed@google.com>
+
+        Cleanup scaling code in text-decorations for SVG InlineText. Use scale() instead of getCTM/normalizeTransform/setCTM
+        to use more standard pattern for scaling, and to allow for these operations to be recorded and played back later
+        (potentially with a different starting matrix). This effectively reverts change# 78704.
+        https://bugs.webkit.org/show_bug.cgi?id=89888
+
+        Reviewed by Nikolas Zimmermann.
+
+        No new tests. Current layouttests exercise this code path.
+
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintDecorationWithStyle):
+        (WebCore::SVGInlineTextBox::paintTextWithShadows):
+
+2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove redundant NDEBUG definition
+
+        Already handled in default_post.prf.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WebCore.pri:
+
+2012-06-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Unexpected end of style sheet in @font-face rule discards it rather than closes all open constructs
+        https://bugs.webkit.org/show_bug.cgi?id=89980
+
+        Reviewed by Antti Koivisto.
+
+        Use the "closing_brace" at the end of font_face rather than the explicit "'}' maybe_space".
+
+        Test: fast/css/font-face-unexpected-end.html
+
+        * css/CSSGrammar.y:
+
+2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Add missing heades to HEADERS
+
+        For JavaScriptCore there aren't any Qt specific files, so we include all
+        headers for easy editing in Qt Creator.
+
+        Reviewed by Simon Hausmann.
+
+        * Target.pri:
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        Rename Element::rareData() to Element::elementRareData(), and Element::ensureRareData() to Element::ensureElementRareData()
+        https://bugs.webkit.org/show_bug.cgi?id=90050
+
+        Reviewed by Ryosuke Niwa.
+
+        Element::rareData()/Element::ensureRareData() and
+        Node::rareData()/Node::ensureRareData() are confusing. They are not virtual
+        methods. For clarification, we can rename Element::rareData() to
+        Element::elementRareData(), and Element::ensureRareData() to
+        Element::ensureElementRareData().
+
+        c.f. SVGRareData uses SVGElement::rareSVGData() and SVGElement::ensureRareSVGData().
+        (We might want to rename them to SVGElement::svgRareData() and
+        SVGElement::ensureSVGRareData() in a follow-up patch.)
+
+        No tests. No change in behavior.
+
+        * dom/Element.cpp:
+        (WebCore::Element::~Element):
+        (WebCore::Element::elementRareData):
+        (WebCore::Element::ensureElementRareData):
+        (WebCore::Element::attributes):
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::shadow):
+        (WebCore::Element::ensureShadow):
+        (WebCore::Element::shadowPseudoId):
+        (WebCore::Element::setShadowPseudoId):
+        (WebCore::Element::focus):
+        (WebCore::Element::minimumSizeForResizing):
+        (WebCore::Element::setMinimumSizeForResizing):
+        (WebCore::Element::computedStyle):
+        (WebCore::Element::setStyleAffectedByEmpty):
+        (WebCore::Element::styleAffectedByEmpty):
+        (WebCore::Element::cancelFocusAppearanceUpdate):
+        (WebCore::Element::classList):
+        (WebCore::Element::optionalClassList):
+        (WebCore::Element::dataset):
+        (WebCore::Element::containsFullScreenElement):
+        (WebCore::Element::setContainsFullScreenElement):
+        (WebCore::Element::hasNamedNodeMap):
+        (WebCore::Element::ensureCachedHTMLCollection):
+        (WebCore::Element::savedLayerScrollOffset):
+        (WebCore::Element::setSavedLayerScrollOffset):
+        * dom/Element.h:
+        (Element):
+        * html/LabelableElement.cpp:
+        (WebCore::LabelableElement::labels):
+
+2012-06-26  Dominic Cooney  <dominicc@chromium.org>
+
+        [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
+        https://bugs.webkit.org/show_bug.cgi?id=90029
+
+        * gyp: Removed empty dir.
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121271.
+        http://trac.webkit.org/changeset/121271
+        https://bugs.webkit.org/show_bug.cgi?id=90056
+
+        Broke a whole bunch of tests and also caused crashes in some
+        tests (Requested by rniwa on #webkit).
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAndReplaceFor):
+
+2012-06-27  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Add support for the Gamepad API
+        https://bugs.webkit.org/show_bug.cgi?id=87503
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add support for the Gamepad feature on the GTK port.
+
+        The support is available only on Linux, with each gamepad device being presented
+        through a GamepadDeviceLinux object. The implementation of this class relies on
+        the Linux kernel joystick API.
+
+        Gamepad devices are recognized through the GamepadsGtk class, of which implementation
+        is based on GUdev. This way devices are properly registered on connection as objects of
+        the GamepadDeviceGtk class which inherits GamepadDeviceLinux. GamepadDeviceGtk reads the
+        joystick data through GIO pollable streams and updates the device state accordingly. The
+        GamepadsGtk object is then polled for gamepads data through the sampleGamepads method.
+
+        No new tests - tests already exist but require additional testing infrastructure.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * bindings/gobject/GNUmakefile.am:
+        * bindings/js/JSDOMBinding.h: Add the jsArray method that operates on a Vector of floats.
+        (WebCore):
+        (WebCore::jsArray):
+        * platform/gtk/GamepadsGtk.cpp: Added.
+        (WebCore):
+        (GamepadDeviceGtk):
+        (WebCore::GamepadDeviceGtk::create):
+        (WebCore::GamepadDeviceGtk::GamepadDeviceGtk):
+        (WebCore::GamepadDeviceGtk::~GamepadDeviceGtk):
+        (WebCore::GamepadDeviceGtk::readCallback):
+        (GamepadsGtk):
+        (WebCore::GamepadsGtk::GamepadsGtk):
+        (WebCore::GamepadsGtk::~GamepadsGtk):
+        (WebCore::GamepadsGtk::registerDevice):
+        (WebCore::GamepadsGtk::unregisterDevice):
+        (WebCore::GamepadsGtk::updateGamepadList):
+        (WebCore::GamepadsGtk::onUEventCallback):
+        (WebCore::GamepadsGtk::isGamepadDevice):
+        (WebCore::sampleGamepads):
+        * platform/linux/GamepadDeviceLinux.cpp: Added.
+        (WebCore):
+        (WebCore::GamepadDeviceLinux::GamepadDeviceLinux):
+        (WebCore::GamepadDeviceLinux::~GamepadDeviceLinux):
+        (WebCore::GamepadDeviceLinux::updateForEvent):
+        (WebCore::GamepadDeviceLinux::normalizeAxisValue):
+        (WebCore::GamepadDeviceLinux::normalizeButtonValue):
+        * platform/linux/GamepadDeviceLinux.h: Added.
+        (WebCore):
+        (GamepadDeviceLinux):
+        (WebCore::GamepadDeviceLinux::connected):
+        (WebCore::GamepadDeviceLinux::id):
+        (WebCore::GamepadDeviceLinux::timestamp):
+        (WebCore::GamepadDeviceLinux::axesCount):
+        (WebCore::GamepadDeviceLinux::axesData):
+        (WebCore::GamepadDeviceLinux::buttonsCount):
+        (WebCore::GamepadDeviceLinux::buttonsData):
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        Rename rareSVGData() to svgRareData()
+        https://bugs.webkit.org/show_bug.cgi?id=90051
+
+        Reviewed by Nikolas Zimmermann.
+
+        Since rareSVGData() returns SVGRareData, it would make sense to
+        rename rareSVGData() to svgRareData(). Similarly, we can rename
+        ensureRareSVGData() to ensureSVGRareData(), and hasRareSVGData()
+        to hasSVGRareData().
+
+        c.f. bug 90050 is trying to introduce elementRareData() and
+        ensureElementRareData().
+
+        No tests. No change in behavior.
+
+        * WebCore.order:
+        * dom/Node.h:
+        (WebCore::Node::hasSVGRareData):
+        (WebCore::Node::setHasSVGRareData):
+        (WebCore::Node::clearHasSVGRareData):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::~SVGElement):
+        (WebCore::SVGElement::willRecalcStyle):
+        (WebCore::SVGElement::svgRareData):
+        (WebCore::SVGElement::ensureSVGRareData):
+        (WebCore::SVGElement::mapInstanceToElement):
+        (WebCore::SVGElement::removeInstanceMapping):
+        (WebCore::SVGElement::instancesForElement):
+        (WebCore::SVGElement::setCursorElement):
+        (WebCore::SVGElement::cursorElementRemoved):
+        (WebCore::SVGElement::setCursorImageValue):
+        (WebCore::SVGElement::cursorImageValueRemoved):
+        (WebCore::SVGElement::correspondingElement):
+        (WebCore::SVGElement::setCorrespondingElement):
+        (WebCore::SVGElement::animatedSMILStyleProperties):
+        (WebCore::SVGElement::ensureAnimatedSMILStyleProperties):
+        (WebCore::SVGElement::setUseOverrideComputedStyle):
+        (WebCore::SVGElement::computedStyle):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::hasPendingResources):
+        (WebCore::SVGStyledElement::setHasPendingResources):
+        (WebCore::SVGStyledElement::clearHasPendingResourcesIfPossible):
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        LabelableElement.cpp should include not ElementRareData.h but NodeRareData.h
+        https://bugs.webkit.org/show_bug.cgi?id=90047
+
+        Reviewed by Kent Tamura.
+
+        This is a simple refactoring. What LabelableElement uses is
+        not ElementRareData but NodeRareData.
+
+        No tests. No change in behavior.
+
+        * html/LabelableElement.cpp:
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Refactor V8BindingPerIsolateData::current() and V8BindingPerIsolateData::get()
+        https://bugs.webkit.org/show_bug.cgi?id=90044
+
+        Reviewed by Adam Barth.
+
+        'static_cast<V8BindingPerIsolateData*>(isolate->GetData())' is duplicated
+        in V8BindingPerIsolateData::current() and V8BindingPerIsolateData::get().
+        This patch removes the duplication.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::V8BindingPerIsolateData::current):
+
+2012-06-26  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Change implementation of LocaleICU class to support more UDateFormat.
+        https://bugs.webkit.org/show_bug.cgi?id=89967
+
+        Reviewed by Kent Tamura.
+
+        This patch changes internal functions of LocaleICU class to process
+        multiple ICU date time format handles in addition to short date time
+        format handle.
+
+        This patch is a part of implementing input type time. I'll add time
+        format related ICU date time format handles.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::initializeShortDateFormat): Changed to use openDateFormat().
+        (WebCore::LocaleICU::openDateFormat): Added for common usage of udt_open().
+        (WebCore::getDateFormatPattern): Added for common usage of udt_toPattern().
+        (WebCore::localizeFormat): Changed to take String parameter.
+        (WebCore::LocaleICU::initializeLocalizedDateFormatText): Changed to use getDateFormatPattern.
+        (WebCore::LocaleICU::createLabelVector): Changed to take UDateFormat parameter.
+        (WebCore::LocaleICU::initializeCalendar): Changed for helper functions.
+        * platform/text/LocaleICU.h:
+        (LocaleICU):
+
+2012-06-26  Luke Macpherson  <macpherson@chromium.org>
+
+        Return correct value for css variables enabled runtime flag.
+        https://bugs.webkit.org/show_bug.cgi?id=90040
+
+        Reviewed by Dimitri Glazkov.
+
+        Was always returning true for the runtime flag when the compile time flag was on. That was good for testing,
+        but not so much for production.
+
+        * page/Settings.h:
+        (WebCore::Settings::cssVariablesEnabled):
+
+2012-06-26  Xueqing Huang  <huangxueqing@baidu.com>
+
+        DragData::asFilenames should not push same file names to result in Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=79861
+
+        Reviewed by Alexey Proskuryakov.
+
+        Test: platform/win/fast/forms/file/drag-and-drop-files.html 
+
+        * platform/win/DragDataWin.cpp:
+        (WebCore::DragData::asFilenames):
+
+2012-06-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reduced (but did not eliminate) use of "berzerker GC"
+        https://bugs.webkit.org/show_bug.cgi?id=89237
+
+        Reviewed by Gavin Barraclough.
+
+        (PART 2)
+
+        Don't ASSERT that RootObject's destructor runs and invalidates all
+        RuntimeObjects before their destructors run.
+
+        We don't guarantee this behavior because some RuntimeObjects may already
+        be garbage by the time RootObject's destructor runs, in which case
+        RootObject's weak pointers will be NULL, and RootObject will not call
+        invalidate() on them.
+
+        It's been theoretically possible for this ASSERT to fire for a while now.
+        This patch makes it fire all the time.
+
+        Luckily, we only needed the behavior guarded by this ASSERT for WebKit1
+        in Safari on Windows (cf. https://bugs.webkit.org/show_bug.cgi?id=61317),
+        to handle the way WebKit1 would unload plugin DLLs. If this ever becomes
+        an issue again, we can fix it by (a) not unloading plugin DLLs,
+        (b) migrating WebKit1 to the WebKit2 JS-plugin binding model, (c) making
+        the Instance pointer in a RuntimeObject an indirect pointer through
+        RootObject, or (c) giving RuntimeObject some sort of special way to
+        access a zombie weak pointer.
+
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::destroy): ASSERT removed. Anders said so.
+
+2012-06-26  Douglas Stockwell  <dstockwell@chromium.org>
+
+        REGRESSION(r107836): box shadow not drawn for opaque images with an opaque background
+        https://bugs.webkit.org/show_bug.cgi?id=89958
+
+        Reviewed by Simon Fraser.
+
+        Don't attempt to draw the box shadow as part of the background if the background is
+        obscured.
+
+        Test: fast/box-shadow/image-box-shadow.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::boxShadowShouldBeAppliedToBackground):
+        (WebCore):
+        * rendering/RenderImage.h:
+        (RenderImage):
+
+2012-06-26  Nico Weber  <thakis@chromium.org>
+
+        Fix new Wunused-private-field violations that crept in
+        https://bugs.webkit.org/show_bug.cgi?id=90032
+
+        Reviewed by Adam Barth.
+
+        * page/Performance.h:
+        (Performance):
+
+2012-06-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Change return type in bandwidth attribute of network information API
+        https://bugs.webkit.org/show_bug.cgi?id=89959
+
+        Reviewed by Adam Barth.
+
+        According to network information API spec, bandwidth attribute should return double type.
+        But, existing implementation has used *long* and *unsigned int* types.
+
+        No new tests. Covered by existing tests.
+
+        * Modules/networkinfo/NetworkInfo.cpp:
+        (WebCore::NetworkInfo::NetworkInfo):
+        * Modules/networkinfo/NetworkInfo.h:
+        (WebCore::NetworkInfo::create):
+        (WebCore::NetworkInfo::bandwidth):
+        (NetworkInfo):
+        * Modules/networkinfo/NetworkInfoClient.h:
+        (NetworkInfoClient):
+        * Modules/networkinfo/NetworkInfoConnection.cpp:
+        (WebCore::NetworkInfoConnection::bandwidth):
+        * Modules/networkinfo/NetworkInfoConnection.h:
+        (NetworkInfoConnection):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setNetworkInformation):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-06-26  Luke Macpherson  <macpherson@chromium.org>
+
+        Be careful not to read past the end of input in CSSParser::lex() when looking for variable definitions.
+        https://bugs.webkit.org/show_bug.cgi?id=89949
+
+        Reviewed by Abhishek Arya.
+
+        Added repro case as fast/css/short-inline-style.html.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+
+2012-06-26  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove WebView::graphicsContext3D getter
+        https://bugs.webkit.org/show_bug.cgi?id=89916
+
+        Reviewed by Adrienne Walker.
+
+        Deletes code supporting compositor context getter.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-06-26  Kulanthaivel Palanichamy  <kulanthaivel@codeaurora.org>
+
+        Unexpected element sizes when mixing inline-table with box-sizing
+        https://bugs.webkit.org/show_bug.cgi?id=89819
+
+        Reviewed by Julien Chaffraix.
+
+        This change handles box-sizing: border-box property for CSS tables properly.
+
+        Test: fast/box-sizing/css-table-with-box-sizing.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth):
+        (WebCore::RenderTable::layout):
+
+2012-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Optimize mappings of simple transforms in RenderGeometryMap
+        https://bugs.webkit.org/show_bug.cgi?id=90034
+
+        Reviewed by Dean Jackson.
+        
+        For transforms that are identity or simple translations, don't
+        fall off the fast path in RenderGeometryMap; we can just
+        treat them as offsets.
+        
+        Improves performance on pages with lots of translateZ(0) elements.
+        
+        Remove RenderGeometryMapStep::mapPoint() and mapQuad(), which
+        were unused.
+
+        No new tests; optimization only, and tested by assertions.
+
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore::RenderGeometryMap::push):
+
+2012-06-26  Kevin Ellis  <kevers@chromium.org>
+
+        Touch adjustment does not target shadow DOM elements
+        https://bugs.webkit.org/show_bug.cgi?id=89556
+
+        The position of internal shadow-DOM nodes were not being considered
+        when determining the snap position when TOUCH_ADJUSTMENT is enabled 
+        for fine tuning the position of synthetic mouse events.  This 
+        restriction results in not being able to select the calendar picker
+        when input type=date, or to clear the search field for input 
+        type=search.
+
+        Reviewed by Antonio Gomes.
+
+        Test: touchadjustment/nested-shadow-node.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::bestClickableNodeForTouchPoint):
+
+2012-06-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Stop calling node() and deprecatedEditingOffset() in comparePositions
+        https://bugs.webkit.org/show_bug.cgi?id=54535
+
+        Reviewed by Enrica Casucci.
+
+        Replaced deprecatedNode() and deprecatedEditingOffset() by containerNode() and computeOffsetInContainerNode()
+        in comparePositions().
+        
+        In addition, fixed a bunch of bugs in DeleteSelectionCommand::handleSpecialCaseBRDelete revealed by this change:
+        - Use node after position instead of deprecated node in determinig whether start and end positions at a br.
+        - Don't set m_startsAtEmptyLine true when BR is wrapped in a block element. The only reason this code had worked
+        was positions like (div, offset, 0) and (br, before) in <div><br> were treated differently, which we no longer do.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::handleSpecialCaseBRDelete):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+
+2012-06-26  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Use eina_file_ls() in EFL implementation of FileSystem listDirectory()
+        https://bugs.webkit.org/show_bug.cgi?id=89976
+
+        Reviewed by Antonio Gomes.
+
+        Rewrite EFL implementation of Filesystem listDirectory() in order to
+        use eina_file_ls() instead of POSIX C functions. This results in
+        shorter code.
+
+        No new tests, behavior has not changed.
+
+        * platform/efl/FileSystemEfl.cpp:
+        (WebCore::listDirectory):
+
+2012-06-26  Alice Cheng  <alice_cheng@apple.com>
+
+        Crash at WebCore::TextIterator::handleTextBox
+        https://bugs.webkit.org/show_bug.cgi?id=89526
+        <rdar://problem/10305315>
+
+        Reviewed by Darin Adler.
+
+        The range used for marking becomes invalid after SpellingCorrectionCommand, due to changes in the DOM made by ReplaceSelectionCommand. 
+        This invalid range caused marking to be incorrect, and Mail.app to crash when iterating through the invalid range.  To fix this,
+        recalculate the range for marking after SpellingCorrectionCommand.
+
+        Test: platform/mac/editing/spelling/autocorrection-blockquote-crash.html
+
+        * editing/AlternativeTextController.cpp:
+        (WebCore::AlternativeTextController::applyAlternativeTextToRange):
+        * editing/Editor.cpp:  (WebCore::Editor::markAndReplaceFor):
+        * testing/Internals.cpp:
+        (WebCore):
+        (WebCore::Internals::hasAutocorrectedMarker):
+        * testing/Internals.h: (Internals):
+        * testing/Internals.idl:
+
+2012-06-26  Tom Sepez  <tsepez@chromium.org>
+
+        [chromium] HTML5 audio/video tags - loading http content from https page doesn't trigger warning.
+        https://bugs.webkit.org/show_bug.cgi?id=89906
+
+        Reviewed by Nate Chapin.
+
+        This patch treats mixed CachedRawResources as affecting the display of insecure content.
+
+        Tests: http/tests/security/mixedContent/insecure-audio-video-in-main-frame.html
+               http/tests/security/mixedContent/insecure-xhr-in-main-frame.html
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::checkInsecureContent):
+
+2012-06-26  Joe Thomas  <joethomas@motorola.com>
+
+        background-size:0 shows as 1px instead of invisible
+        https://bugs.webkit.org/show_bug.cgi?id=86942
+
+        Reviewed by Eric Seidel.
+
+        As per the specification http://www.w3.org/TR/css3-background/#background-size, if the background image's width or height resolves to zero,
+        this causes the image not to be displayed. The effect should be the same as if it had been a transparent image.
+        This is also mentioned in http://www.w3.org/TR/2002/WD-css3-background-20020802/#background-size.
+
+        Test: fast/backgrounds/zero-background-size.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize):
+
+2012-06-26  Adam Klein  <adamk@chromium.org>
+
+        [v8] Clean up generated Dictionary-handling code
+        https://bugs.webkit.org/show_bug.cgi?id=89994
+
+        Reviewed by Adam Barth.
+
+        No change in behavior, so no new tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheck):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::optionsObjectCallback):
+
+2012-06-26  Raymond Toy  <rtoy@google.com>
+
+        Include stdio.h when DEBUG_AUDIONODE_REFERENCES is set
+        https://bugs.webkit.org/show_bug.cgi?id=89997
+
+        Reviewed by Eric Seidel.
+
+        No new tests needed for a compile issue
+
+        * Modules/webaudio/AudioNode.cpp:  Include stdio.h
+
+2012-06-26  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Use premultiplied alpha when extracting image data in WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=89937
+
+        Reviewed by Jocelyn Turcotte.
+
+        Perform conversion in QImage only if the image format is not ARGB32 or
+        ARGB32_Premultiplied. Otherwise, allow packPixels to perform the conversion if the formats
+        don't match, as packPixels already performs pixel-specific operations.
+
+        Covered by tests in LayoutTests/fast/canvas/webgl, e.g. webgl-composite-modes.html.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2012-06-26  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Move method precondition checks to front end objects
+        https://bugs.webkit.org/show_bug.cgi?id=89377
+
+        Reviewed by Tony Chang.
+
+        Now that metadata exists on the front end, most of the pre-condition validation checks
+        done on IDB method calls from script can be moved to the front end which simplifies the
+        code significantly in the case of complex methods like IDBObjectStore::put().
+
+        Adds an internal "active" flag for transactions, although the behavior is not accurate
+        to the spec (it should only be true during event callbacks - http://webkit.org/b/89379).
+        The back-end methods can then be simplifed to just adding async tasks to the transaction,
+        and the front end methods can take care of all exception cases except for asynchronous
+        transaction abort which still requires plumbing back to the front end.
+
+        No functional changes - no new tests.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::update): Migrate from IDBObjectStoreBackendImpl::put.
+        (WebCore::IDBCursor::advance): Add more explicit transaction-is-active check.
+        (WebCore::IDBCursor::continueFunction): Ditto.
+        (WebCore::IDBCursor::deleteFunction): Ditto.
+        (WebCore::IDBCursor::effectiveObjectStore): Convenience function (source may be store or index).
+        (WebCore):
+        * Modules/indexeddb/IDBCursor.h:
+        (WebCore::IDBCursor::isKeyCursor): Distinguish from IDBCursorWithValue.
+        (IDBCursor):
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::update): Remove migrated check.
+        * Modules/indexeddb/IDBCursorWithValue.h:
+        (IDBCursorWithValue):
+        * Modules/indexeddb/IDBDatabase.cpp: Migrate checks.
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::deleteObjectStore):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp: Replace checks with assertions.
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
+        * Modules/indexeddb/IDBIndex.cpp: Add transaction-is-active checks.
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::count):
+        (WebCore::IDBIndex::openKeyCursor):
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * Modules/indexeddb/IDBObjectStore.cpp: Migrate cehcks.
+        (WebCore::IDBObjectStore::get):
+        (WebCore::IDBObjectStore::add): Delegates to put(PutMode)
+        (WebCore::IDBObjectStore::put): Delegates to put(PutMode)
+        (WebCore): Adds put(PutMode) which has the unified checks migrated from
+        IDBObjectStoreBackendImpl::put.
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore::IDBObjectStore::clear):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::deleteIndex):
+        (WebCore::IDBObjectStore::openCursor):
+        (WebCore::IDBObjectStore::count):
+        * Modules/indexeddb/IDBObjectStore.h: Adds put(PutMode).
+        (IDBObjectStore):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::getInternal): Fix trace symbol.
+        (WebCore::IDBObjectStoreBackendImpl::put): Remove migrated checks.
+        (WebCore::IDBObjectStoreBackendImpl::createIndex): Remove migrated checks.
+        (WebCore::IDBObjectStoreBackendImpl::deleteIndex): Remove migrated checks.
+        * Modules/indexeddb/IDBTransaction.cpp: Add active flag tracking.
+        (WebCore::IDBTransaction::IDBTransaction):
+        (WebCore::IDBTransaction::abort):
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        * Modules/indexeddb/IDBTransaction.h:
+        (WebCore::IDBTransaction::isActive):
+        (WebCore::IDBTransaction::isReadOnly): Group IDL/non-IDL methods.
+        (IDBTransaction):
+
+2012-06-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121285.
+        http://trac.webkit.org/changeset/121285
+        https://bugs.webkit.org/show_bug.cgi?id=90014
+
+        "We misinterpreted 'size of the initial containing block'"
+        (Requested by tomz on #webkit).
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcValue::computeLengthPx):
+        (WebCore::CSSCalcPrimitiveValue::toCalcValue):
+        (WebCore::CSSCalcPrimitiveValue::computeLengthPx):
+        (WebCore::CSSCalcBinaryOperation::toCalcValue):
+        (WebCore::CSSCalcBinaryOperation::computeLengthPx):
+        * css/CSSCalculationValue.h:
+        (CSSCalcExpressionNode):
+        (WebCore::CSSCalcValue::toCalcValue):
+        (CSSCalcValue):
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::addStops):
+        (WebCore::positionFromValue):
+        (WebCore::CSSGradientValue::computeEndPoint):
+        (WebCore::CSSLinearGradientValue::createGradient):
+        (WebCore::CSSRadialGradientValue::resolveRadius):
+        (WebCore::CSSRadialGradientValue::createGradient):
+        * css/CSSGradientValue.h:
+        (CSSGradientValue):
+        (CSSRadialGradientValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLength):
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        * css/CSSPrimitiveValue.h:
+        (CSSPrimitiveValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::convertToLength):
+        * css/CSSToStyleMap.cpp:
+        (WebCore::CSSToStyleMap::mapFillSize):
+        (WebCore::CSSToStyleMap::mapFillXPosition):
+        (WebCore::CSSToStyleMap::mapFillYPosition):
+        (WebCore::CSSToStyleMap::mapNinePieceImageQuad):
+        * css/CSSToStyleMap.h:
+        (CSSToStyleMap):
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::computeLength):
+        (WebCore::device_heightMediaFeatureEval):
+        (WebCore::device_widthMediaFeatureEval):
+        (WebCore::heightMediaFeatureEval):
+        (WebCore::widthMediaFeatureEval):
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::StyleResolver::applySVGProperty):
+        * css/StyleBuilder.cpp:
+        (WebCore::ApplyPropertyAuto::applyValue):
+        (WebCore::ApplyPropertyClip::convertToLength):
+        (WebCore::ApplyPropertyLength::applyValue):
+        (WebCore::ApplyPropertyBorderRadius::applyValue):
+        (WebCore::ApplyPropertyComputeLength::applyValue):
+        (WebCore::ApplyPropertyFontSize::applyValue):
+        (WebCore::ApplyPropertyLineHeight::applyValue):
+        (WebCore::ApplyPropertyPageSize::mmLength):
+        (WebCore::ApplyPropertyPageSize::inchLength):
+        (WebCore::ApplyPropertyPageSize::applyValue):
+        (WebCore::ApplyPropertyVerticalAlign::applyValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+        (StyleResolver):
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+
+2012-06-26  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Expose rendering statistics to WebWidget.
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Reviewed by James Robinson.
+
+        The WebKit side of a basic framework for exposing rendering statistics
+        to Chromium's --enable-benchmarking extension.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeHost::implFrameNumber):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::implFrameNumber):
+        (WebCore):
+        (WebCore::CCThreadProxy::implFrameNumberOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-06-26  Dave Tharp  <dtharp@codeaurora.org>
+
+        ietestcenter/css3/valuesandunits/units-000.htm asserts
+        https://bugs.webkit.org/show_bug.cgi?id=86176
+
+        Reviewed by Beth Dakin.
+
+        Modified computeLengthDouble() to handle vh, vw, and vmin units. Per the spec
+        (http://dev.w3.org/csswg/css3-values/#viewport-relative-lengths) viewport -percentage
+        lengths are "relative to the size of the initial containing block", which I read to be
+        the size of the parent element. Since parentStyle was not available in computeLengthDouble,
+        most of the changes for this patch involved "pushing down" the parentStyle pointer through
+        the network of computeLength methods and dependencies.
+
+        Tests: css3/viewport-percentage-lengths/css3-viewport-percentage-lengths-vh-border.html
+               css3/viewport-percentage-lengths/css3-viewport-percentage-lengths-vmin-border.html
+               css3/viewport-percentage-lengths/css3-viewport-percentage-lengths-vw-border.html
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcValue::computeLengthPx):
+        (WebCore::CSSCalcPrimitiveValue::toCalcValue):
+        (WebCore::CSSCalcPrimitiveValue::computeLengthPx):
+        (WebCore::CSSCalcBinaryOperation::toCalcValue):
+        (WebCore::CSSCalcBinaryOperation::computeLengthPx):
+        * css/CSSCalculationValue.h:
+        (CSSCalcExpressionNode):
+        (WebCore::CSSCalcValue::toCalcValue):
+        (CSSCalcValue):
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::addStops):
+        (WebCore::positionFromValue):
+        (WebCore::CSSGradientValue::computeEndPoint):
+        (WebCore::CSSLinearGradientValue::createGradient):
+        (WebCore::CSSRadialGradientValue::resolveRadius):
+        (WebCore::CSSRadialGradientValue::createGradient):
+        * css/CSSGradientValue.h:
+        (CSSGradientValue):
+        (CSSRadialGradientValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLength):
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        * css/CSSPrimitiveValue.h:
+        (CSSPrimitiveValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::convertToLength):
+        * css/CSSToStyleMap.cpp:
+        (WebCore::CSSToStyleMap::parentStyle):
+        (WebCore):
+        (WebCore::CSSToStyleMap::mapFillSize):
+        (WebCore::CSSToStyleMap::mapFillXPosition):
+        (WebCore::CSSToStyleMap::mapFillYPosition):
+        (WebCore::CSSToStyleMap::mapNinePieceImageQuad):
+        * css/CSSToStyleMap.h:
+        (CSSToStyleMap):
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::computeLength):
+        (WebCore::device_heightMediaFeatureEval):
+        (WebCore::device_widthMediaFeatureEval):
+        (WebCore::heightMediaFeatureEval):
+        (WebCore::widthMediaFeatureEval):
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::StyleResolver::applySVGProperty):
+        * css/StyleBuilder.cpp:
+        (WebCore::ApplyPropertyAuto::applyValue):
+        (WebCore::ApplyPropertyClip::convertToLength):
+        (WebCore::ApplyPropertyLength::applyValue):
+        (WebCore::ApplyPropertyBorderRadius::applyValue):
+        (WebCore::ApplyPropertyComputeLength::applyValue):
+        (WebCore::ApplyPropertyFontSize::applyValue):
+        (WebCore::ApplyPropertyLineHeight::applyValue):
+        (WebCore::ApplyPropertyPageSize::mmLength):
+        (WebCore::ApplyPropertyPageSize::inchLength):
+        (WebCore::ApplyPropertyPageSize::applyValue):
+        (WebCore::ApplyPropertyVerticalAlign::applyValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::parentNode):
+        (StyleResolver):
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+
+2012-06-25  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Add WebLayer API for scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=89913
+
+        Reviewed by Adrienne Walker.
+
+        Use new WebScrollableLayer type in ScrollingCoordinatorChromium. This file peeks "under the hood" a fair amount
+        since we don't have WebLayer API for scrollbar layers yet.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
+        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
+        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
+        (WebCore::ScrollingCoordinatorPrivate::hasScrollLayer):
+        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
+        (ScrollingCoordinatorPrivate):
+        (WebCore::createScrollbarLayer):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+
+2012-06-26  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed, rolling out r120501.
+        http://trac.webkit.org/changeset/120501
+        https://bugs.webkit.org/show_bug.cgi?id=89126
+
+        [skia] Fix is too heavy-handed
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::drawNeedsCopy):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::PlatformContextSkia):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (PlatformContextSkia):
+        (WebCore::PlatformContextSkia::isDeferred):
+        (WebCore::PlatformContextSkia::setDeferred):
+
+2012-06-26  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Crash in FixedTableLayout::layout
+        https://bugs.webkit.org/show_bug.cgi?id=88676
+
+        Unreviewed typo fix, pointed out by Darin Adler.
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::layout):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::layout):
+
+2012-06-26  Adam Klein  <adamk@chromium.org>
+
+        MutationObserver.observe should treat a null or undefined options argument as empty
+        https://bugs.webkit.org/show_bug.cgi?id=89992
+
+        Reviewed by Ojan Vafai.
+
+        The WebIDL spec was recently updated to treat null or undefined
+        Dictionary arguments the same as the empty dictionary. This patch
+        updates MutationObserver.observe to follow that spec.
+
+        Note that we still throw a SYNTAX_ERR in this case, since it's an
+        error not to pass one of "attributes", "childList", or "characterData"
+        as a key in the dictionary.
+
+        * dom/WebKitMutationObserver.cpp:
+        (WebCore::WebKitMutationObserver::observe):
+
+2012-06-26  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] The single thread proxy should not automatically tick new animations.
+        https://bugs.webkit.org/show_bug.cgi?id=89996
+
+        Reviewed by James Robinson.
+
+        No new tests. No change to existing functionality.
+
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::initializeLayerRenderer):
+        (WebCore::CCSingleThreadProxy::didAddAnimation):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (WebCore):
+
+2012-06-26  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Crash in FixedTableLayout::layout
+        https://bugs.webkit.org/show_bug.cgi?id=88676
+
+        Reviewed by Abhishek Arya.
+
+        Tests: fast/table/auto-table-layout-colgroup-removal-crash.html
+               fast/table/fixed-table-layout/colgroup-removal-crash.html
+               fast/table/fixed-table-layout/prepend-in-fixed-table.html
+
+        The issue comes from RenderTable not properly dirtying its preferred logical
+        widths. As the table layout codes (both fixed and auto), recomputes their internal
+        structures at computePreferredLogicalWidth, the internal structure doesn't match
+        the table sizing and we crash.
+
+        This fix adds a work-around in FixedTableLayout::layout (which matches AutoTableLayout).
+        The long-term fix would be to properly fix the logic but this is a lot safer, especially
+        since our logic is really not bullet-proof at the moment.
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::layout):
+        Added an internal structure recomputation, if we have drifted from our table's structure.
+        Also we need to update nEffCols if we call calcWidthArray.
+
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::layout):
+        Added a comment matching FixedTableLayout. The nEffCols is unneeded but kept for consistency
+        with FixedTableLayout.
+
+2012-06-26  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Layer chromium should need a redraw after getting its first non-empty bounds.
+        https://bugs.webkit.org/show_bug.cgi?id=89784
+
+        Reviewed by James Robinson.
+
+        Previously, we'd only set needs redraw if the old bounds were zero,
+        and the new bounds were non-zero, but we should actually have 
+        checked that the old bounds were non-empty.
+
+        Unit test: LayerChromiumTestWithoutFixture.setBoundsTriggersSetNeedsRedrawAfterGettingNonEmptyBounds
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setBounds):
+
+2012-06-26  Jia Pu  <jpu@apple.com>
+
+        On Mac, autocorrection sometimes fails to take place in Safari.
+        https://bugs.webkit.org/show_bug.cgi?id=89982
+
+        Reviewed by Darin Adler.
+
+        Existing test was turned off due to intermittent failure, which is caused by autocorrection result depending on user data
+        that may be altered by previous test runs. Hopefully we can turn the test back on once we have a way to make autocorrection
+        behave consistently.
+
+        Basically we should check the value of shouldCheckForCorrection, not shouldShowCorrectionPanel, to determine if we should
+        early return in markAndReplaceFor(). 
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAndReplaceFor):
+
+2012-06-26  Joe Thomas  <joethomas@motorola.com>
+
+        Do early-return when author and user styles are disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=89947
+
+        Reviewed by Andreas Kling.
+
+        * dom/Document.cpp:
+        (WebCore::Document::collectActiveStylesheets):
+
+2012-06-26  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove dead compositor-related API from GraphicsContext3DPrivate / Extensions3DChromium
+        https://bugs.webkit.org/show_bug.cgi?id=89933
+
+        Reviewed by Kenneth Russell.
+
+        GraphicsContext3DPrivate and Extensions3DChromium had a fair amount of plumbing and boilerplate to support the
+        compositor's use of GraphicsContext3D. A number of extensions, etc, only make sense for a compositor context.
+        Since the compositor doesn't use GC3D any more, these are no longer needed.
+
+        * platform/chromium/support/Extensions3DChromium.cpp:
+        * platform/chromium/support/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::create):
+        * platform/chromium/support/GraphicsContext3DPrivate.cpp:
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::createGraphicsContextFromWebContext):
+        (WebCore::GrMemoryAllocationChangedCallbackAdapter::GrMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DPrivate::grContext):
+        * platform/chromium/support/GraphicsContext3DPrivate.h:
+        (WebCore):
+        (GraphicsContext3DPrivate):
+        * platform/graphics/chromium/Extensions3DChromium.h:
+
+2012-06-26  Yasuhiro Matsuda  <mazda@chromium.org>
+
+        [chromium] Add the workaround of IOSurface-related corruption during readback on Mac OS X.
+        https://bugs.webkit.org/show_bug.cgi?id=89797
+
+        Reviewed by James Robinson.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+
+2012-06-26  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Native memory snapshots crash in debug mode.
+        https://bugs.webkit.org/show_bug.cgi?id=89977
+
+        Reviewed by Yury Semikhatsky.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::maybeDOMWrapper):
+
+2012-06-26  Huang Dongsung  <luxtella@company100.net>
+
+        [Texmap] Bug fix typo about computing bytesPerLine in BitmapTextureGL.
+        https://bugs.webkit.org/show_bug.cgi?id=89924
+
+        "bytesPerLine == targetRect.width() / 4" is invalid.
+        This patch amended it into "bytesPerLine == targetRect.width() * 4".
+        Moreover, changed magic number 4 to bytesPerPixel.
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests. Covered by existing tests.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::updateContents):
+
+2012-06-26  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
+
+        Shader compiler unprepared to make ESSL output when GLES is used
+        https://bugs.webkit.org/show_bug.cgi?id=87718
+
+        Reviewed by Noam Rosenthal.
+
+        Defined a new member that says what type of output code must be generated
+        (SH_GLSL_OUTPUT, SH_ESSL_OUTPUT). It is set within the constructor.
+
+        * platform/graphics/ANGLEWebKitBridge.cpp:
+        (WebCore::ANGLEWebKitBridge::ANGLEWebKitBridge):
+        (WebCore::ANGLEWebKitBridge::validateShaderSource):
+        * platform/graphics/ANGLEWebKitBridge.h:
+        (ANGLEWebKitBridge):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2012-06-26  Philip Rogers  <pdr@google.com>
+
+        Fix bug where animations failed to start
+        https://bugs.webkit.org/show_bug.cgi?id=89943
+
+        Reviewed by Nikolas Zimmermann.
+
+        The unpause code previously checked that the animations had not started
+        before un-setting the pause state. This meant that if an animation was
+        paused and unpaused before the animations started, it would remain in the
+        paused state. This patch simply reorders the unpause logic to fix this bug.
+
+        Test: svg/custom/animate-initial-pause-unpause.html
+
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::resume):
+
+2012-06-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: popover is not shown for detached DOM nodes, not referenced directly from JS
+        https://bugs.webkit.org/show_bug.cgi?id=89955
+
+        Reviewed by Vsevolod Vlasov.
+
+        Show object popover for all heap snapshot nodes event for those whose
+        canBeQueried flag is false. We didn't show popover for such objects before
+        as it could lead to the backend crash. In the meantime the backend shouldn't
+        fail on such DOM wrappers and report an error if it cannot resolve
+        inspected object.
+
+        * inspector/front-end/HeapSnapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGenericObjectNode):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get data):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype._getHoverAnchor):
+
+2012-06-26  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Simplify SharedBuffer::createWithContentsOfFile() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=89655
+
+        Reviewed by Csaba Osztrogonác.
+
+        Simplify the implementation of SharedBuffer::createWithContentsOfFile()
+        in EFL port.
+
+        No new test, no behavior change.
+
+        * platform/efl/SharedBufferEfl.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2012-06-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] REGRESSION (r121163): fast/frames/iframe-access-screen-of-deleted.html crashes
+        https://bugs.webkit.org/show_bug.cgi?id=89964
+
+        Reviewed by Andreas Kling.
+
+        Added missing null pointer check.
+
+        * platform/efl/PlatformScreenEfl.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+
+2012-06-26  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add requestMetadata command and metadataReceived event to FileSystem
+        https://bugs.webkit.org/show_bug.cgi?id=87856
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: http/tests/inspector/filesystem/get-metadata.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorFileSystemAgent::requestFileSystemRoot):
+        (WebCore::InspectorFileSystemAgent::requestDirectoryContent):
+        (WebCore::InspectorFileSystemAgent::requestMetadata):
+        * inspector/InspectorFileSystemAgent.h:
+        (InspectorFileSystemAgent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype._directoryContentReceived):
+        (WebInspector.FileSystemModel.prototype.requestMetadata):
+        (WebInspector.FileSystemModel.Entry.prototype.get isDirectory):
+        (WebInspector.FileSystemModel.Entry.prototype.requestMetadata):
+        (WebInspector.FileSystemRequestManager):
+        (WebInspector.FileSystemRequestManager.prototype._directoryContentReceived):
+        (WebInspector.FileSystemRequestManager.prototype.requestMetadata.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestMetadata):
+        (WebInspector.FileSystemRequestManager.prototype._metadataReceived):
+        (WebInspector.FileSystemDispatcher.prototype.directoryContentReceived):
+        (WebInspector.FileSystemDispatcher.prototype.metadataReceived):
+
+2012-06-25  Jocelyn Turcotte  <turcotte.j@gmail.com>
+
+        [Qt] GraphicsSurface: Fix tile update artifacts on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89887
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
+        (WebCore::GraphicsSurface::platformCopyToGLTexture):
+
+2012-06-25  Jocelyn Turcotte  <turcotte.j@gmail.com>
+
+        GraphicsSurface: Fix IOSurfaceLock failures on Intel video cards.
+        https://bugs.webkit.org/show_bug.cgi?id=89883
+
+        Reviewed by Noam Rosenthal.
+
+        Follow the documentation which says: "If locking the buffer requires a readback,
+        the lock will fail with an error return of kIOReturnCannotLock."
+        Also make sure that we use the same set of flags when locking and unlocking
+        for simplicity and to follow this requirement on the kIOSurfaceLockReadOnly flag.
+
+        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
+        (WebCore::GraphicsSurface::platformLock):
+        (WebCore::GraphicsSurface::platformUnlock):
+
+2012-06-26  Philip Rogers  <pdr@google.com>
+
+        Fix setCurrentTime for paused animations
+        https://bugs.webkit.org/show_bug.cgi?id=81350
+
+        Reviewed by Nikolas Zimmermann.
+
+        SMILTimeContainer::setElapsed was not resetting the pause time, breaking
+        setCurrentTime if the animation was paused.
+
+        Test: svg/custom/animate-pause-resume.html
+
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::setElapsed):
+
+2012-06-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed typo fix after r121144.
+
+        * Target.pri:
+
+2012-06-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: columns in heap snapshot summary view are not resizable
+        https://bugs.webkit.org/show_bug.cgi?id=89952
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/HeapSnapshotDataGrids.js:
+        (WebInspector.HeapSnapshotViewportDataGrid.prototype.onResize): overriden method
+        should call overriden one to make sure column resizers are added to the DataGrid.
+
+2012-06-26  Kent Tamura  <tkent@chromium.org>
+
+        Refactoring: Simplify FormController interface
+        https://bugs.webkit.org/show_bug.cgi?id=89951
+
+        Reviewed by Kentaro Hara.
+
+        - Remove FormController::hasStateForNewFormElements()
+          takeStateForFormElement() can check the emptiness, and return an empty
+          FormControlState.
+
+        - Change the argument of takeStateForFormElement()
+          Passing just one HTMLFormControlElementWithState object instead of two
+          AtomicStringImpl. This is a preparation to use
+          HTMLFormControlElementWithState::form() in FormController.
+
+        No new tests. Just a refactoring.
+
+        * html/FormController.cpp:
+        (WebCore::FormController::takeStateForFormElement):
+        * html/FormController.h:
+        (FormController):
+        * html/HTMLFormControlElementWithState.cpp:
+        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
+
+2012-06-26  Dominic Cooney  <dominicc@chromium.org>
+
+        WheelEvent should inherit from MouseEvent
+        https://bugs.webkit.org/show_bug.cgi?id=76104
+
+        Reviewed by Kentaro Hara.
+
+        The spec for WheelEvent is
+        <http://www.w3.org/TR/DOM-Level-3-Events/#webidl-events-WheelEvent>
+
+        Tests: fast/events/event-creation.html
+               http://samples.msdn.microsoft.com/ietestcenter/dominheritance/showdominheritancetest.htm?Prototype_WheelEvent
+
+        * bindings/objc/PublicDOMInterfaces.h: Remove redundant MouseEvent API from WheelEvent
+        * bindings/scripts/CodeGeneratorObjC.pm: MouseEvents are Events
+        * dom/MouseEvent.h: Expose no-arg constructor to WheelEvent
+        * dom/WheelEvent.cpp:
+        (WebCore::WheelEvent::WheelEvent): Call MouseEvent superconstructor
+        (WebCore::WheelEvent::isMouseEvent): Existing callers use this just for
+        moves and clicks, ie the type is exactly MouseEvent.
+        * dom/WheelEvent.h: Extend MouseEvent
+        * dom/WheelEvent.idl: "
+
+2012-06-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Get rid of firstItem and nextItem from HTMLCollection
+        https://bugs.webkit.org/show_bug.cgi?id=89923
+
+        Reviewed by Andreas Kling.
+
+        Removed HTMLCollection::firstItem and HTMLCollection::nextItem.
+        Also added hasAnyItem() and hasExactlyOneItem() to HTMLCollection so that named getter on Document
+        doesn't need to compute the full length before returning a HTMLCollection.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::getDocumentLinks):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::namedItemGetter):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::GetNamedProperty):
+        * dom/Document.cpp:
+        (WebCore::Document::openSearchDescriptionURL):
+        * html/HTMLCollection.cpp:
+        (WebCore::shouldIncludeChildren):
+        (WebCore::HTMLCollection::HTMLCollection):
+        (WebCore):
+        (WebCore::HTMLCollection::item):
+        * html/HTMLCollection.h:
+        (HTMLCollection):
+        (WebCore::HTMLCollection::hasAnyItem):
+        (WebCore::HTMLCollection::hasExactlyOneItem):
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
+
+2012-06-25  Pratik Solanki  <psolanki@apple.com>
+
+        JavaScript resources have low priority when SVG is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=89932
+        <rdar://problem/11741325>
+
+        Reviewed by Adele Peterson.
+
+        r108785 inadvertently lowered the priority of JavaScript resources. Fix the code so we set
+        the correct priority for scripts. Also, move the code so that all ifdefs are together at the
+        bottom to make it a bit easier to read..
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::defaultPriorityForResourceType):
+
+2012-06-25  Luke Macpherson  <macpherson@chromium.org>
+
+        Add runtime flag to enable/disable CSS variables (in addition to existing compile-time flag).
+        https://bugs.webkit.org/show_bug.cgi?id=89542
+
+        Reviewed by Dimitri Glazkov.
+
+        Added fast/css/variables/build-supports-variables.html to test runtime flag in test environment.
+        Updated all other css variables tests to enable the runtime flag from JS.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParserContext::CSSParserContext):
+        (WebCore::operator==):
+        (WebCore::CSSParser::cssVariablesEnabled):
+        (WebCore):
+        (WebCore::CSSParser::detectDashToken):
+        (WebCore::CSSParser::lex):
+        * css/CSSParser.h:
+        (CSSParser):
+        * css/CSSParserMode.h:
+        (CSSParserContext):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::setCSSVariablesEnabled):
+        (WebCore::Settings::cssVariablesEnabled):
+
+2012-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix after r121223.
+
+        Fix the --minimal Qt build, TextureMapperGL now requires WebGL to be enabled.
+
+        * Target.pri:
+        * WebCore.pri:
+
+2012-06-25  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] CCOverdrawMetrics should use the deviceViewportSize to count actual pixels
+        https://bugs.webkit.org/show_bug.cgi?id=89922
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
+        (WebCore::CCOverdrawMetrics::recordMetricsInternal):
+
+2012-06-25  Huang Dongsung  <luxtella@company100.net>
+
+        [Texmap] Remove platform specific code in BitmapImageGL::updateContents by using
+        GraphicsContext3D::extractImageData.
+        https://bugs.webkit.org/show_bug.cgi?id=89867
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests. Covered by existing tests.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore):
+        (WebCore::BitmapTextureGL::didReset):
+        (WebCore::BitmapTextureGL::updateContents):
+
+2012-06-25  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove uncalled ManagedTexture::framebufferTexture2D
+        https://bugs.webkit.org/show_bug.cgi?id=89930
+
+        Reviewed by Adrienne Walker.
+
+        Removing dead code.
+
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        * platform/graphics/chromium/ManagedTexture.h:
+        (ManagedTexture):
+
+2012-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121206.
+        http://trac.webkit.org/changeset/121206
+        https://bugs.webkit.org/show_bug.cgi?id=89935
+
+        [chromium] webkit_unit_tests
+        WebViewTest.MHTMLWithMissingResourceFinishesLoading crash
+        (Requested by ukai on #webkit).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::scheduleArchiveLoad):
+
+2012-06-25  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        [chromium] Ensure that the compositor code which is aware of flipped status of video-textures
+        per platform executes on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=89914
+        
+        Reviewed by James Robinson.
+
+        No new tests. (HW video decode is still only being tested manually for orientation)
+
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::appendQuads):
+
+2012-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121176.
+        http://trac.webkit.org/changeset/121176
+        https://bugs.webkit.org/show_bug.cgi?id=89934
+
+        [chromium] browser_tests assert failed:
+        FATAL:native_theme_win.cc(1541)] Check failed: false. Invalid
+        part: 16 (Requested by ukai on #webkit).
+
+        * platform/chromium/PlatformSupport.h:
+        (PlatformSupport):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+
+2012-06-25  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] Deleting list distributed to Shadow DOM does not work correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=89170
+
+        Reviewed by Ryosuke Niwa.
+
+        When deleting several elements distributed to Shadow DOM, some renderers might be gone in
+        processing deletion. To fix them, we should call isContentEditable() instead of rendererIsEditable().
+
+        Test: editing/shadow/delete-list-in-shadow.html
+
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply):
+
+2012-06-25  Min Qin  <qinmin@chromium.org>
+
+        [Chromium] Fix the css stylesheet for android media controls after recent changes
+        https://bugs.webkit.org/show_bug.cgi?id=89910
+
+        Reviewed by Adam Barth.
+
+        After the recent changes on upstream chrome video controls, we need to change the css style sheet for chrome on android.
+        No tests needed, just css changes.
+
+        * css/mediaControlsChromiumAndroid.css:
+        (audio):
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        (::-webkit-media-controls):
+        (audio::-webkit-media-controls-enclosure, video::-webkit-media-controls-enclosure):
+        (video::-webkit-media-controls-enclosure):
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
+        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
+        (video::-webkit-media-controls-fullscreen-button):
+        (input[type="range"]::-webkit-media-slider-container):
+        (input[type="range"]::-webkit-media-slider-thumb):
+        (audio::-webkit-media-controls-fullscreen-button):
+
+2012-06-25  Huang Dongsung  <luxtella@company100.net>
+
+        [Qt] Avoid a deep copy of QImage in GraphicsContext3D::getImageData.
+        https://bugs.webkit.org/show_bug.cgi?id=89865
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests. Covered by existing tests.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2012-06-25  Nick Carter  <nick@chromium.org>
+
+        Reduce memory footprint of BitmapImage Vectors.
+        https://bugs.webkit.org/show_bug.cgi?id=86563
+
+        Reviewed by Simon Fraser.
+
+        No new tests, affects template params only.
+
+        * platform/graphics/BitmapImage.h:
+        (BitmapImage): use an inline capacity of 1 for the image frame Vector 
+        * platform/image-decoders/ImageDecoder.h:
+        (ImageDecoder): use an inline capacity of 1 for the image frame Vector
+
+2012-06-25  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, rolling out r121145.
+        http://trac.webkit.org/changeset/121145
+        https://bugs.webkit.org/show_bug.cgi?id=89847
+
+        Had an objection for the change.
+
+        * html/FormController.cpp:
+        (WebCore):
+        (WebCore::FormControlState::serializeTo):
+        (WebCore::FormControlState::deserialize):
+        (WebCore::formStateSignature):
+        (WebCore::FormController::formElementsState):
+        (WebCore::FormController::setStateForNewFormElements):
+        * html/FormController.h:
+        (FormControlState):
+        * html/shadow/CalendarPickerElement.cpp:
+        (WebCore::addJavaScriptString):
+
+2012-06-25  Jay Civelli  <jcivelli@chromium.org>
+
+        Fix progress load reporting for MHTML documents.
+
+        MHTML documents containing references to resources they don't include
+        never finish loading.
+        https://bugs.webkit.org/show_bug.cgi?id=71859
+
+        Reviewed by Nate Chapin.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::scheduleArchiveLoad):
+
+2012-06-25  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use WebGraphicsContext3D in compositor implementation
+        https://bugs.webkit.org/show_bug.cgi?id=89700
+
+        Reviewed by Adrienne Walker.
+
+        This converts the compositor implementation from using WebCore::GraphicsContext3D to using the Platform-provided
+        WebGraphicsContext3D. This removes several unnecessary layers of indirection/wrapping and cuts down the
+        compositor's implementation dependencies. GraphicsContext3D.h is still widely used to provide GL enum values.
+        Most of the changes are purely mechanical - changing type names and the like.
+
+        Ownership is changed a bit. Instead of multiple components holding references to the compositor's context, the
+        context is now owned by the CCGraphicsContext, which is now owned directly by CCLayerTreeHostImpl.
+        CCLayerTreeHostImpl also has ownership of its CCRenderer (LayerRendererChromium in 3D mode) and passes a
+        non-owning pointer down to the CCRenderer.
+
+        Extension checking is a bit different. The compositor does not (and never has) used extensions provided by
+        WebGL's request/ensure mechanism. It simply checks for the existence of extensions it needs in the GL_EXTENSIONS
+        string.
+
+        FrameBufferSkPictureCanvasLayerTextureUpdater had to be patched as well, since it was grabbing a GrContext off
+        of the compositor's GraphicsContext3D. This caused many problems. It was inefficient, since it required a full
+        state flush when switching between ganesh and compositor calls. The gpu memory management was completely broken
+        since the compositor clobbered ganesh's onMemoryAllocationChanged callback. This moves FBSkPCLTU over to using
+        the appropriate SharedGraphicsContext3D, like filters.
+
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
+        (FrameBufferSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/GeometryBinding.cpp:
+        (WebCore::GeometryBinding::GeometryBinding):
+        * platform/graphics/chromium/GeometryBinding.h:
+        (WebKit):
+        (GeometryBinding):
+        (WebCore::GeometryBinding::context):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::create):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::~LayerRendererChromium):
+        (WebCore::LayerRendererChromium::context):
+        (WebCore::LayerRendererChromium::debugGLCall):
+        (WebCore::LayerRendererChromium::setVisible):
+        (WebCore::LayerRendererChromium::drawStreamVideoQuad):
+        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::onMemoryAllocationChanged):
+        (WebCore):
+        (WebCore::LayerRendererChromium::onMemoryAllocationChangedOnImplThread):
+        (WebCore::LayerRendererChromium::discardFramebuffer):
+        (WebCore::LayerRendererChromium::ensureFramebuffer):
+        (WebCore::LayerRendererChromium::onContextLost):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        (WebCore::LayerRendererChromium::getFramebufferTexture):
+        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::tileCheckerboardProgram):
+        (WebCore::LayerRendererChromium::solidColorProgram):
+        (WebCore::LayerRendererChromium::headsUpDisplayProgram):
+        (WebCore::LayerRendererChromium::renderPassProgram):
+        (WebCore::LayerRendererChromium::renderPassProgramAA):
+        (WebCore::LayerRendererChromium::renderPassMaskProgram):
+        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
+        (WebCore::LayerRendererChromium::tileProgram):
+        (WebCore::LayerRendererChromium::tileProgramOpaque):
+        (WebCore::LayerRendererChromium::tileProgramAA):
+        (WebCore::LayerRendererChromium::tileProgramSwizzle):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleOpaque):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleAA):
+        (WebCore::LayerRendererChromium::textureProgram):
+        (WebCore::LayerRendererChromium::textureProgramFlip):
+        (WebCore::LayerRendererChromium::textureIOSurfaceProgram):
+        (WebCore::LayerRendererChromium::videoYUVProgram):
+        (WebCore::LayerRendererChromium::videoStreamTextureProgram):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        (WebCore::LayerRendererChromium::isContextLost):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebKit):
+        (WebCore):
+        (LayerRendererChromium):
+        (WebCore::LayerRendererChromium::isFramebufferDiscarded):
+        * platform/graphics/chromium/LayerTextureSubImage.cpp:
+        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
+        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        (WebCore::ManagedTexture::bindTexture):
+        (WebCore::ManagedTexture::framebufferTexture2D):
+        * platform/graphics/chromium/PlatformColor.h:
+        (WebCore::PlatformColor::bestTextureFormat):
+        * platform/graphics/chromium/ProgramBinding.cpp:
+        (WebCore::contextLost):
+        (WebCore::ProgramBindingBase::init):
+        (WebCore::ProgramBindingBase::cleanup):
+        (WebCore::ProgramBindingBase::loadShader):
+        (WebCore::ProgramBindingBase::createShaderProgram):
+        * platform/graphics/chromium/ProgramBinding.h:
+        (WebKit):
+        (ProgramBindingBase):
+        (WebCore::ProgramBinding::ProgramBinding):
+        (WebCore::ProgramBinding::initialize):
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::VertexShaderPosTex::init):
+        (WebCore::VertexShaderPosTexYUVStretch::init):
+        (WebCore::VertexShaderPos::init):
+        (WebCore::VertexShaderPosTexTransform::init):
+        (WebCore::VertexShaderQuad::init):
+        (WebCore::VertexShaderTile::init):
+        (WebCore::VertexShaderVideoTransform::init):
+        (WebCore::FragmentTexAlphaBinding::init):
+        (WebCore::FragmentTexOpaqueBinding::init):
+        (WebCore::FragmentShaderOESImageExternal::init):
+        (WebCore::FragmentShaderRGBATexAlphaAA::init):
+        (WebCore::FragmentTexClampAlphaAABinding::init):
+        (WebCore::FragmentShaderRGBATexAlphaMask::init):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::init):
+        (WebCore::FragmentShaderYUVVideo::init):
+        (WebCore::FragmentShaderColor::init):
+        (WebCore::FragmentShaderCheckerboard::init):
+        * platform/graphics/chromium/ShaderChromium.h:
+        (WebKit):
+        (VertexShaderPosTex):
+        (VertexShaderPosTexYUVStretch):
+        (VertexShaderPos):
+        (WebCore::VertexShaderPosTexIdentity::init):
+        (VertexShaderPosTexTransform):
+        (VertexShaderQuad):
+        (VertexShaderTile):
+        (VertexShaderVideoTransform):
+        (FragmentTexAlphaBinding):
+        (FragmentTexOpaqueBinding):
+        (FragmentShaderOESImageExternal):
+        (FragmentShaderRGBATexAlphaAA):
+        (FragmentTexClampAlphaAABinding):
+        (FragmentShaderRGBATexAlphaMask):
+        (FragmentShaderRGBATexAlphaMaskAA):
+        (FragmentShaderYUVVideo):
+        (FragmentShaderColor):
+        (FragmentShaderCheckerboard):
+        * platform/graphics/chromium/TextureCopier.cpp:
+        (WebCore::AcceleratedTextureCopier::AcceleratedTextureCopier):
+        (WebCore::AcceleratedTextureCopier::~AcceleratedTextureCopier):
+        (WebCore::AcceleratedTextureCopier::copyTexture):
+        * platform/graphics/chromium/TextureCopier.h:
+        (WebKit):
+        (WebCore):
+        (WebCore::AcceleratedTextureCopier::create):
+        (AcceleratedTextureCopier):
+        * platform/graphics/chromium/TextureManager.h:
+        * platform/graphics/chromium/ThrottledTextureUploader.cpp:
+        (WebCore::ThrottledTextureUploader::Query::Query):
+        (WebCore::ThrottledTextureUploader::Query::~Query):
+        (WebCore::ThrottledTextureUploader::Query::begin):
+        (WebCore::ThrottledTextureUploader::Query::end):
+        (WebCore::ThrottledTextureUploader::Query::isPending):
+        (WebCore::ThrottledTextureUploader::Query::wait):
+        (WebCore::ThrottledTextureUploader::ThrottledTextureUploader):
+        * platform/graphics/chromium/ThrottledTextureUploader.h:
+        (WebKit):
+        (WebCore::ThrottledTextureUploader::create):
+        (WebCore::ThrottledTextureUploader::Query::create):
+        (Query):
+        (ThrottledTextureUploader):
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
+        (WebCore::TrackingTextureAllocator::TrackingTextureAllocator):
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        (WebCore::TrackingTextureAllocator::deleteAllTextures):
+        * platform/graphics/chromium/TrackingTextureAllocator.h:
+        (WebKit):
+        (WebCore::TrackingTextureAllocator::create):
+        (TrackingTextureAllocator):
+        * platform/graphics/chromium/cc/CCGraphicsContext.h:
+        (CCGraphicsContext):
+        (WebCore::CCGraphicsContext::create2D):
+        (WebCore::CCGraphicsContext::create3D):
+        (WebCore::CCGraphicsContext::context3D):
+        (WebCore::CCGraphicsContext::CCGraphicsContext):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
+        (WebCore::CCIOSurfaceLayerImpl::~CCIOSurfaceLayerImpl):
+        (WebCore::CCIOSurfaceLayerImpl::willDraw):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::createContext):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHostClient):
+        (WebCore::LayerRendererCapabilities::LayerRendererCapabilities):
+        (LayerRendererCapabilities):
+        (WebCore::CCLayerTreeHost::needsSharedContext):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::initializeContext):
+        (WebCore::CCSingleThreadProxy::recreateContext):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
+        (WebCore::CCTextureUpdater::update):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::initializeContext):
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::initializeContextOnImplThread):
+        (WebCore::CCThreadProxy::recreateContextOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
+        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
+        (WebCore::CCVideoLayerImpl::copyPlaneData):
+
+2012-06-25  Adrienne Walker  <enne@google.com>
+
+        [chromium] Make CCThreadProxy not draw a frame mid-commit
+        https://bugs.webkit.org/show_bug.cgi?id=89905
+
+        Reviewed by James Robinson.
+
+        If commitComplete is not called before the next frame goes up, then
+        then the max scroll position on the root scroll layer is not updated.
+        This causes the compositor-side scrollbar to have an incorrect
+        visibleSize, causing the thumbRect to become stretched, relative to
+        when it was originally painted.
+
+        CCScheduler::setVisible has the side effect of kicking off a frame, so
+        move it last.
+
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::scheduledActionCommit):
+
+2012-06-25  Pablo Flouret  <pablof@motorola.com>
+
+        EventSource: Events should not be dispatched after close()
+        https://bugs.webkit.org/show_bug.cgi?id=85346
+
+        Reviewed by Adam Barth.
+
+        Spec changed to make sure that no events are dispatched after close() is
+        called, even if more data was received before the call to close().
+
+        See,
+        https://www.w3.org/Bugs/Public/show_bug.cgi?id=14331#c5
+        http://html5.org/tools/web-apps-tracker?from=6771&to=6772
+
+        Firefox behaves like this already.
+
+        Test: http/tests/eventsource/eventsource-events-after-close.html
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::parseEventStream):
+
+2012-06-25  Mike West  <mkwst@chromium.com>
+
+        Fixing compilation failure in StyleResolver.cpp/CSSParser.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=89892
+
+        Reviewed by Alexis Menard.
+
+        Adding CSSPropertyVariable to switch statements in CSSParser and
+        StyleResolver to fix compilation errors under ninja/clang. I've
+        added both as new cases to the switches, with FIXME comments for
+        implementation.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-25  Jay Civelli  <jcivelli@chromium.org>
+
+        Fix for a memory leak with MHTMLArchives.
+
+        MHTML files present a flat list of frames and resources but the WebKit Archive
+        has a tree strcture. So the MHTMLArchive class make sures that every frame
+        knows about any other frames and resources.
+        Because these objects are ref counted, that would introduce circular references
+        preventing the entire Archive from being deleted.
+        This fixes this by:
+        - making sure the top-frame (which appears as the first entry in the MHTML) is
+          not referenced by the other frames.
+        - when the main frame is deleted it traverse the entire subarchive (sub-frames)
+          graph and makes sure they clear all their references to other subarchives.
+
+        https://bugs.webkit.org/show_bug.cgi?id=88470
+
+        Reviewed by Adam Barth.
+
+        * loader/archive/Archive.cpp:
+        (WebCore::Archive::clearAllSubframeArchives):
+        (WebCore):
+        (WebCore::Archive::clearAllSubframeArchivesImpl):
+        * loader/archive/Archive.h:
+        (Archive):
+        * loader/archive/mhtml/MHTMLArchive.cpp:
+        (WebCore::MHTMLArchive::~MHTMLArchive):
+        (WebCore):
+        (WebCore::MHTMLArchive::create):
+        * loader/archive/mhtml/MHTMLArchive.h:
+        (MHTMLArchive):
+
+2012-06-25  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r121178.
+        http://trac.webkit.org/changeset/121178
+        https://bugs.webkit.org/show_bug.cgi?id=89784
+
+        New unit test added is failing on WebKit Linux (dbg)
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setBounds):
+
+2012-06-25  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r121137.
+        http://trac.webkit.org/changeset/121137
+
+        Chromium build fix, (un)touch files to build on Chromium Win
+        Release
+
+        * css/CSSParserMode.h:
+        * css/CSSValue.h:
+        (WebCore):
+        * css/CSSVariableValue.h:
+        * page/Settings.h:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareInheritedData.h:
+        * rendering/style/StyleVariableData.h:
+
+2012-06-25  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r121129.
+        http://trac.webkit.org/changeset/121129
+        https://bugs.webkit.org/show_bug.cgi?id=89542
+
+        Chromium ASan failure: crbug.com/134402
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParserContext::CSSParserContext):
+        (WebCore::operator==):
+        (WebCore):
+        (WebCore::CSSParser::detectDashToken):
+        (WebCore::CSSParser::lex):
+        * css/CSSParser.h:
+        (CSSParser):
+        * css/CSSParserMode.h:
+        (CSSParserContext):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * page/Settings.h:
+        (Settings):
+        * testing/InternalSettings.cpp:
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-06-25  Adam Barth  <abarth@webkit.org>
+
+        Use InterpolationLow on chromium-android
+        https://bugs.webkit.org/show_bug.cgi?id=89849
+
+        Reviewed by Daniel Bates.
+
+        Min Qin writes:
+
+          Using InterpolationHigh is very very expensive when resampling
+          images.  For example, it took 1400ms to decode an image on
+          http://www.crossfitsunnyvale.com/blog/, but it took 2800 ms to do the
+          resampling Switch to InterpolationLow will result in linear
+          resampling. It is much faster as the time it tooks is almost
+          non-noticable [sic] on the trace.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::State::State):
+
+2012-06-25  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove unused backend property accessors
+        https://bugs.webkit.org/show_bug.cgi?id=89893
+
+        Reviewed by Darin Fisher.
+
+        Following the "metadata" API addition in trac.webkit.org/changeset/121059
+        the IDBXXXBackendInterface types no longer need per-property accessors.
+
+        No new tests - no functional changes.
+
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp: Remove method implementation.
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h: Remove methods.
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h: Remove methods.
+        (IDBDatabaseBackendInterface):
+        * Modules/indexeddb/IDBIndexBackendImpl.h: Make methods simple accessors.
+        (IDBIndexBackendImpl):
+        (WebCore::IDBIndexBackendImpl::name):
+        (WebCore::IDBIndexBackendImpl::keyPath):
+        (WebCore::IDBIndexBackendImpl::unique):
+        (WebCore::IDBIndexBackendImpl::multiEntry):
+        * Modules/indexeddb/IDBIndexBackendInterface.h: Remove methods.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Remove method implementation.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h: Make methods simple accessors.
+        (IDBObjectStoreBackendImpl):
+        (WebCore::IDBObjectStoreBackendImpl::name):
+        (WebCore::IDBObjectStoreBackendImpl::keyPath):
+        (WebCore::IDBObjectStoreBackendImpl::autoIncrement):
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Remove methods.
+
+2012-06-25  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [EFL] Add support for building with ENABLE_MEDIA_STREAM
+        https://bugs.webkit.org/show_bug.cgi?id=88413
+
+        Reviewed by Dirk Pranke.
+
+        Add files which are needed for supporting the Media Stream
+        feature.
+
+        No change in functionality so no new tests.
+
+        * PlatformEfl.cmake:
+
+2012-06-25  Huang Dongsung  <luxtella@company100.net>
+
+        [Texmap] TextureMapperPaintOptions should keep current surface.
+        https://bugs.webkit.org/show_bug.cgi?id=89266
+
+        Before this patch, if a replica layer has a descendant replica child, the child
+        layer does not render the result in the parent layer's surface because
+        TextureMapperPaintOptions does not keep current surface.
+        This patch amends that TextureMapperPaintOptions keeps current surface before
+        calling paintSelfAndChildrenWithReplica recursively, so previous surface could be
+        restored after paintSelfAndChildrenWithReplica.
+
+        Reviewed by Noam Rosenthal.
+
+        Test: compositing/reflections/animation-inside-reflection.html
+
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::paintRecursive):
+
+2012-06-25  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Layer chromium should need a redraw after getting its first non-empty bounds.
+        https://bugs.webkit.org/show_bug.cgi?id=89784
+
+        Reviewed by James Robinson.
+
+        Previously, we'd only set needs redraw if the old bounds were zero,
+        and the new bounds were non-zero, but we should actually have 
+        checked that the old bounds were non-empty.
+
+        Unit test: LayerChromiumTestWithoutFixture.setBoundsTriggersSetNeedsRedrawAfterGettingNonEmptyBounds
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setBounds):
+
+2012-06-25  Scott Graham  <scottmg@chromium.org>
+
+        Plumb Scrollbar button dimensions down to WebThemeEngine
+        https://bugs.webkit.org/show_bug.cgi?id=89264
+
+        Reviewed by James Robinson.
+
+        Rather than making the height of the scrollbar buttons the same as the
+        width of the scrollbar, delegate to the WebThemeEngine. This allows
+        matching the Aura theme rather than the standard Windows theme.
+
+        No new tests, as bounds are overridden for DRT.
+
+        * platform/chromium/PlatformSupport.h:
+        (PlatformSupport):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+
+2012-06-25  Antti Koivisto  <antti@apple.com>
+
+        Fast path for simple transform parsing
+        https://bugs.webkit.org/show_bug.cgi?id=89898
+
+        Reviewed by Anders Carlsson.
+
+        When manipulating transforms using script, the transform value parsing can show up in profiles pretty heavily 
+        (up 4% in some cases). We can optimize it easily by implementing a fast path that does not spin up the full CSS
+        parser, like we already do for several other common value types.
+        
+        The patch implements a fast path for transform(), transformX/Y/Z() and transform3D(). It speeds up parsing by >5x.
+
+        * css/CSSParser.cpp:
+        (WebCore):
+        (WebCore::parseTransformArguments):
+        (WebCore::parseTransformValue):
+        (WebCore::CSSParser::parseValue):
+
+2012-06-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unused static function shadowFor
+        https://bugs.webkit.org/show_bug.cgi?id=89824
+
+        Reviewed by Daniel Bates.
+
+        shadowFor is not used anymore after r117796. No behaviour changes.
+
+        * dom/TreeScopeAdopter.cpp:
+
+2012-06-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unused constant timeWithoutMouseMovementBeforeHidingControls
+        https://bugs.webkit.org/show_bug.cgi?id=89823
+
+        Reviewed by Daniel Bates.
+
+        After r87692, timeWithoutMouseMovementBeforeHidingControls is not used anymore.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore):
+
+2012-06-25  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] RenderPass textures are evicted at the end of every frame
+        https://bugs.webkit.org/show_bug.cgi?id=89786
+
+        Reviewed by Adrienne Walker.
+
+        Removed calls to TextureManager::reduceMemoryToLimit inside
+        finishDrawingFrame() method.
+
+        Added unit tests to verify new behavior.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::finishDrawingFrame):
+
+2012-06-25  Allan Xavier  <allan.xavier@undefinedltd.co.uk>
+
+        [GTK] Add graphviz debug output for the gstreamer video pipeline.
+        https://bugs.webkit.org/show_bug.cgi?id=89660
+
+        Reviewed by Martin Robinson.
+
+        Dump the current video pipeline as a graphviz DOT file when the
+        pipeline state changes or when an error occours.
+
+        No new tests as the change is only useful for debugging.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
+
+2012-06-25  Adam Barth  <abarth@webkit.org>
+
+        ASSERT(m_wheelEventHandlerCount > 0) can fire
+        https://bugs.webkit.org/show_bug.cgi?id=89856
+
+        Reviewed by Eric Seidel.
+
+        When a node with a wheel or a touch event is moved from one document to
+        another, the didAddMumble/didRemoveMumble calls do not balance because
+        they're called on different documents. This patch twiddles the counts
+        appropriately in that case.
+
+        Test: fast/events/move-element-with-wheel-and-touch-event-listeners.html
+
+        * dom/EventNames.h:
+        (WebCore::EventNames::isTouchEventType):
+        (EventNames):
+        (WebCore::EventNames::touchEventNames):
+        * dom/Node.cpp:
+        (WebCore::Node::didMoveToNewDocument):
+
+2012-06-25  Eric Seidel  <eric@webkit.org>
+
+        Split map* functions out of StyleResolver into a helper object
+        https://bugs.webkit.org/show_bug.cgi?id=89881
+
+        Reviewed by Daniel Bates.
+
+        These map* functions are completely independent of the rest of StyleResolver
+        and only exist to serve StyleBuilder.
+        CSSToStyleMap doesn't even want to have a StyleResolver pointer, but
+        currently needs one to access the resolve-lifetime caches for the
+        current resolve.  Once we split out that per-resolve state into
+        some sort of ResolveState/ResolveInfo object (akin to PaintInfo/LayoutState)
+        then this object will be even simpler.
+
+        No behavioral change, thus no tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSToStyleMap.cpp: Added.
+        (WebCore):
+        (WebCore::CSSToStyleMap::style):
+        (WebCore::CSSToStyleMap::rootElementStyle):
+        (WebCore::CSSToStyleMap::useSVGZoomRules):
+        (WebCore::CSSToStyleMap::styleImage):
+        (WebCore::CSSToStyleMap::mapFillAttachment):
+        (WebCore::CSSToStyleMap::mapFillClip):
+        (WebCore::CSSToStyleMap::mapFillComposite):
+        (WebCore::CSSToStyleMap::mapFillOrigin):
+        (WebCore::CSSToStyleMap::mapFillImage):
+        (WebCore::CSSToStyleMap::mapFillRepeatX):
+        (WebCore::CSSToStyleMap::mapFillRepeatY):
+        (WebCore::CSSToStyleMap::mapFillSize):
+        (WebCore::CSSToStyleMap::mapFillXPosition):
+        (WebCore::CSSToStyleMap::mapFillYPosition):
+        (WebCore::CSSToStyleMap::mapAnimationDelay):
+        (WebCore::CSSToStyleMap::mapAnimationDirection):
+        (WebCore::CSSToStyleMap::mapAnimationDuration):
+        (WebCore::CSSToStyleMap::mapAnimationFillMode):
+        (WebCore::CSSToStyleMap::mapAnimationIterationCount):
+        (WebCore::CSSToStyleMap::mapAnimationName):
+        (WebCore::CSSToStyleMap::mapAnimationPlayState):
+        (WebCore::CSSToStyleMap::mapAnimationProperty):
+        (WebCore::CSSToStyleMap::mapAnimationTimingFunction):
+        (WebCore::CSSToStyleMap::mapNinePieceImage):
+        (WebCore::CSSToStyleMap::mapNinePieceImageSlice):
+        (WebCore::CSSToStyleMap::mapNinePieceImageQuad):
+        (WebCore::CSSToStyleMap::mapNinePieceImageRepeat):
+        * css/CSSToStyleMap.h: Added.
+        (WebCore):
+        (CSSToStyleMap):
+        (WebCore::CSSToStyleMap::CSSToStyleMap):
+        * css/StyleBuilder.cpp:
+        (WebCore::ApplyPropertyFillLayer::applyValue):
+        (WebCore::ApplyPropertyBorderImage::applyValue):
+        (WebCore::ApplyPropertyBorderImageModifier::applyValue):
+        (WebCore):
+        (WebCore::ApplyPropertyAnimation::map):
+        (WebCore::StyleBuilder::StyleBuilder):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::StyleResolver):
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::styleMap):
+        (StyleResolver):
+
+2012-06-25  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [EFL] Support screenDepth() functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=89423
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Support screenDepth() based on ecore_x_window_depth_get(). This functionality may be used by
+        both WebKit1 and WebKit2. So, concrete function is placed into EflScreenUtilities.cpp.
+
+        This patch can't support existing test cases. Because, EFL DumpRenderTree works without X11 window
+        by default.
+
+        * platform/efl/EflScreenUtilities.cpp:
+        (WebCore::getPixelDepth):
+        (WebCore):
+        * platform/efl/EflScreenUtilities.h:
+        (WebCore):
+        * platform/efl/PlatformScreenEfl.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+
+2012-06-25  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow] Executing Italic and InsertUnorderedList in Shadow DOM causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=88495
+
+        Reviewed by Ryosuke Niwa.
+
+        InsertionPoint::removedFrom(insertionPoint) tries to find its owner ElementShadow from
+        parentNode or insertionPoint. If the parent node exsits but we cannot reach ElementShadow from
+        the parent node, InsertionPoint::removedFrom does not try to find ElementShadow anymore.
+
+        It's OK if the ElementShadow is being destructed, but there is a case ElementShadow is not being
+        destructed in editing. In this case, we should try to find ElementShadow from insertionPoint.
+        Otherwise it will bring inconsistency to Shadow DOM, and causes a crash.
+
+        Actually checking the existence of parentNode() does not make any sense. We should get
+        shadowRoot() directly.
+
+        Test: editing/shadow/insertorderedlist-crash.html
+
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::removedFrom):
+
+2012-06-25  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Remove responseBlob field from XMLHttpResponse.idl
+        https://bugs.webkit.org/show_bug.cgi?id=89859
+
+        Reviewed by Eric Seidel.
+
+        Remove XMLHttpResponse.responseBlob from XMLHttpResponse.idl, which
+        has only been exposed for a very limited time (since r120574) but
+        probably should not have been done so since XHR2 spec no longer has
+        the field.  A quick search also showed that no one seems to be using the field.
+
+        (More context: the field was added long time ago with a runtime guard
+        which had never been enabled until the guard was removed in r120574
+        to remove XHR_RESPONSE_BLOB on all platforms.)
+
+        No new tests as no tests use this field.
+
+        * xml/XMLHttpRequest.idl: Removed responseBlob field.
+
+2012-06-25  Huang Dongsung  <luxtella@company100.net>
+
+        Add static qualifier to GraphicsContext3D::extractImageData.
+        https://bugs.webkit.org/show_bug.cgi?id=89866
+
+        GraphicsContext3D::extractImageData does not use member variables.
+        Each platform Accelerated-compositing implementation can use this method in
+        order to get pixel data of an Image or ImageBuffer object.
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests since there's no change on code behavior.
+
+        * platform/graphics/GraphicsContext3D.h:
+        (GraphicsContext3D):
+
+2012-06-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: toggling style should not start property edit first.
+        https://bugs.webkit.org/show_bug.cgi?id=89834
+
+        Reviewed by Yury Semikhatsky.
+
+        Otherwise property flickers upon toggling.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-06-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: "Emulate Touch Events" breaks selecting elements with "touchstart" event listeners for inspection.
+        https://bugs.webkit.org/show_bug.cgi?id=89861
+
+        Reviewed by Vsevolod Vlasov.
+
+        Upon a mousepress, Inspector should be queried for the "Inspect element" mode up-front,
+        before dispatching a synthetic "touchstart" event.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+
+2012-06-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Cannot visually set caret before the first CSS property name character
+        https://bugs.webkit.org/show_bug.cgi?id=89869
+
+        Reviewed by Vsevolod Vlasov.
+
+        The issue was due to the "editbox" SPAN having a negative margin, thus the leftmost caret position was getting clipped
+        by a synthetic SPAN container added by the TextPrompt.
+
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section .properties > li.child-editing .webkit-css-property):
+        (.styles-section .properties li.child-editing):
+
+2012-06-25  Arko Saha  <arko@motorola.com>
+
+        Microdata: document.getItems(typeNames) is not returning Microdata items when typeNames argument is not specified.
+        https://bugs.webkit.org/show_bug.cgi?id=89757
+
+        Reviewed by Ryosuke Niwa.
+
+        With r120979 change, it creates MicroDataItemList with m_typeNames = "http://webkit.org/microdata/undefinedItemType",
+        when typeNames argument is not specified. Modified the check in nodeMatches() accordingly.
+
+        This fixes the following failing tests :
+            fast/dom/MicroData/002.html
+            fast/dom/MicroData/003.html
+            fast/dom/MicroData/007.html
+            fast/dom/MicroData/009.html
+            fast/dom/MicroData/properties-collection-must-see-the-properties-added-in-itemref.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::getItems): Use undefinedItemType to avoid String conversion.
+        * dom/MicroDataItemList.cpp:
+        (WebCore::MicroDataItemList::undefinedItemType): It defines "http://webkit.org/microdata/undefinedItemType"
+        string using DEFINE_STATIC_LOCAL to avoid String conversion.
+        (WebCore::MicroDataItemList::MicroDataItemList): Use document() method of DynamicNodeList to obtain
+        document of owner element.
+        (WebCore::MicroDataItemList::~MicroDataItemList): Removed originalTypeNames null check.
+        (WebCore::MicroDataItemList::nodeMatches): Return true if originalTypeNames is equal to undefinedItemType.
+        * dom/MicroDataItemList.h:
+
+2012-06-25  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix Win32 debug build
+
+        Reviewed by Tor Arne Vestbø.
+
+        Consistently use use_all_in_one_files when requested in the configuration. The previous
+        Linux condition has been moved to Tools/qmake/mkspecs/features/unix/default_pre.prf
+
+        * Target.pri:
+
+2012-06-25  Philip Rogers  <pdr@google.com>
+
+        Fix rewinding of SVG animations
+        https://bugs.webkit.org/show_bug.cgi?id=89846
+
+        Reviewed by Nikolas Zimmermann.
+
+        r116451 introduced an optimization to only clear non-freeze animations when
+        calling setCurrentTime (via reset()). This causes fill=freeze animations to
+        not clear which breaks rewinding of an animation.
+
+        In the presence of multiple animations, we reset the first animation to the
+        base value and accumulate all results into that; this masked the problem because
+        2 animations were required to hit the bug (our tests primarily cover just 1).
+
+        Test: svg/animations/animate-reset-freeze.html
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::reset):
+
+2012-06-25  Kent Tamura  <tkent@chromium.org>
+
+        Change the serialization format of form control state to make the code simple
+        https://bugs.webkit.org/show_bug.cgi?id=89847
+
+        Reviewed by Hajime Morita.
+
+        We used multiple strings to represent state of single form control. It
+        made the code complex. We change the serialization format so that one
+        CSV string represents state.
+
+        Examples in the old format:
+            "0"
+            "1", "value"
+            "3", "value1", "value2,value2", "value3"
+
+        Examples in the new format:
+            ""
+            ",value"
+            ",value1,value2\,value2,value3"
+
+        Test: fast/forms/state-restore-various-values.html
+
+        * html/FormController.cpp:
+        (WebCore::FormControlState::serialize):
+        Generate comma-separated string.
+        ',' in a value is serialized as "\,".
+        We changed the signature because we don't need the out-argument.
+        (WebCore::FormControlState::deserialize):
+        Parses the input comma-separated string.
+        We changed the signature because we don't need multiple input strings.
+        (formStateSignature):
+        Bump up the version because of the representation change.
+        (WebCore::FormController::formElementsState):
+        The new serialized format occupies just one string for one control.
+        - Expected size is now 3n+1.
+        - Use FormControlState::serialize().
+        (WebCore::FormController::setStateForNewFormElements):
+        The new serialized format occupies just one string for one control.
+        So we can check the vector size before the iteration.
+        * html/FormController.h:
+        (FormControlState): Change the function signatures.
+
+        * html/shadow/CalendarPickerElement.cpp:
+        (WebCore::addJavaScriptString): Use StringBuilder::appendEscaped().
+
+2012-06-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add external resources size to the native memory diagram
+        https://bugs.webkit.org/show_bug.cgi?id=89754
+
+        Reviewed by Vsevolod Vlasov.
+
+        Size of external strings and arrays is now reported through the inspector
+        protocol and displayed on the native memory chart.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptProfiler.h:
+        (WebCore):
+        (WebCore::ScriptProfiler::visitJSDOMWrappers):
+        (WebCore::ScriptProfiler::visitExternalJSStrings):
+        (WebCore::ScriptProfiler::visitExternalJSArrays):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::visitJSDOMWrappers):
+        (WebCore::ScriptProfiler::visitExternalJSStrings):
+        (WebCore::ScriptProfiler::visitExternalJSArrays):
+        (WebCore):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::visitStrings):
+        (WebCore::V8BindingPerIsolateData::visitJSExternalStrings):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        (V8BindingPerIsolateData):
+        * inspector/BindingVisitors.h: Renamed from Source/WebCore/inspector/DOMWrapperVisitor.h.
+        (WTF):
+        (WebCore):
+        (NodeWrapperVisitor):
+        (WebCore::NodeWrapperVisitor::~NodeWrapperVisitor):
+        (ExternalStringVisitor):
+        (WebCore::ExternalStringVisitor::~ExternalStringVisitor):
+        (ExternalArrayVisitor):
+        (WebCore::ExternalArrayVisitor::~ExternalArrayVisitor):
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::jsExternalResourcesInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+
+2012-06-24  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed compile error fix of Chromium Win Release.
+        Touch header files for ENABLE(CSS_VARIABLES) so that
+        it forces to rebuild files by changing ENABLE(CSS_VARIABLES)
+        in Sources/WebKit/chromium/features.gypi at r121129
+
+        * css/CSSParserMode.h:
+        * css/CSSValue.h:
+        (WebCore):
+        * css/CSSVariableValue.h:
+        * page/Settings.h:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareInheritedData.h:
+        * rendering/style/StyleVariableData.h:
+
+2012-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Texmap] Minor cleanup for TextureMapper::accelerationMode()
+        https://bugs.webkit.org/show_bug.cgi?id=89825
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Replace the virtual method with a simple member variable.
+
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::TextureMapper::accelerationMode):
+        (WebCore::TextureMapper::TextureMapper):
+        (TextureMapper):
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::TextureMapperGL):
+        * platform/graphics/texmap/TextureMapperGL.h:
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (WebCore::TextureMapperImageBuffer::TextureMapperImageBuffer):
+
+2012-06-24  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: transitions starting and ending with a calc expression move to end state
+        https://bugs.webkit.org/show_bug.cgi?id=89738
+
+        Reviewed by Tony Chang.
+
+        The equality operator for CalculationValue was not working as expected. The 
+        equality operator for OwnPtr is private, as OwnPtrs should always be different.
+        The OwnPtrs ended up getting cast to bool before being compared, and the 
+        comparison was always returning true.
+
+        The comparison between OwnPtrs has been removed. It doesn't add value to compare
+        the raw pointers either, since OwnPtrs should always be unique. We cannot
+        ASSERT the uniqueness though, as it is legitimate to compare a CalculationValue
+        to itself.
+
+        Test: css3/calc/transition-start-end-with-calc.html
+
+        * platform/CalculationValue.h:
+        (WebCore::CalculationValue::operator==):
+
+2012-06-24  MORITA Hajime  <morrita@google.com>
+
+        NodeRenderingContext::AttachingPhase is redundant.
+        https://bugs.webkit.org/show_bug.cgi?id=79220
+
+        Reviewed by Dimitri Glazkov.
+
+        This change removes NodeRenderingContext::AttachingPhase and
+        NodeRenderingContext::m_phase respectively. The state originally
+        represented as m_phase is naturally encoded into other member variables.
+
+        NodeRenderingContext::m_visualParentShadow is also replaced, with
+        a local variable parentScope.
+
+        Basically, what NodeRenderingContext wants to know is the parent of
+        the composed shadow tree and an optional insertion point where the
+        node is distributed. Once these becomes clear, m_phase is no longer required.
+        It was rather a historical artifact.
+
+        No new tests. No behavioral change.
+
+        * dom/NodeRenderingContext.cpp: Replaced m_phase with implicit states.
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::parentRenderer):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
+        (WebCore::NodeRenderingContext::isOnUpperEncapsulationBoundary):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::parentNodeForRenderingAndStyle): Removed an assert which checks m_phase.
+        (WebCore::NodeRenderingContext::resetStyleInheritance): Removed an assert which checks m_phase.
+        * html/shadow/InsertionPoint.h:
+        (WebCore::isInsertionPoint): Fix null case check.
+        (WebCore::isLowerEncapsulationBoundary): Renamed from isShadowBoundary()
+
+2012-06-24  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION(r121124): LayoutTests/fast/block/inline-children-root-linebox-crash.html asserts
+        https://bugs.webkit.org/show_bug.cgi?id=89844
+        
+        Reviewed by Dan Bernstein.
+
+        We need to check for the flipped writing mode and take the slow path if it is used.
+
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore::RenderGeometryMap::pushMappingsToAncestor):
+
+2012-06-24  Luke Macpherson  <macpherson@chromium.org>
+
+        Add runtime flag to enable/disable CSS variables (in addition to existing compile-time flag).
+        https://bugs.webkit.org/show_bug.cgi?id=89542
+
+        Reviewed by Dimitri Glazkov.
+
+        Added fast/css/variables/build-supports-variables.html to test runtime flag in test environment.
+        Updated all other css variables tests to enable the runtime flag from JS.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParserContext::CSSParserContext):
+        (WebCore::operator==):
+        (WebCore::CSSParser::cssVariablesEnabled):
+        (WebCore):
+        (WebCore::CSSParser::detectDashToken):
+        (WebCore::CSSParser::lex):
+        * css/CSSParser.h:
+        (CSSParser):
+        * css/CSSParserMode.h:
+        (CSSParserContext):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::setCSSVariablesEnabled):
+        (WebCore::Settings::cssVariablesEnabled):
+
+2012-06-22  Kent Tamura  <tkent@chromium.org>
+
+        Selected option is not restored correctly
+        https://bugs.webkit.org/show_bug.cgi?id=89623
+
+        Reviewed by Hajime Morita.
+
+        Details of the bug:
+        We saved a state of a <select> element as a string of which length was
+        the size of <select>'s children. e.g. If a <select> had five children
+        and the second and the fifth items were selected, the state string was:
+                ".X..X"
+
+        This didn't work well if the structure of the children was updated after
+        parsing. For example,
+        1. A page has the following <select> initially:
+          <select multiple>
+            <option>Banana
+            <option>Lemon
+            <option>Orange
+            <option>Strawberry
+          <select>
+
+        2. For some reasons, <option>Apple</option> is prepended to the children.
+        3. Some items are selected.
+        4. The page is unloaded. Selection state is saved.
+        5. A user go back to the page again. A browser parses the page again.
+        6. Try to restore the <select> state with the saved data at 4.
+          But "Apple" is missing. The <select> has wrong selections.
+
+        Solution:
+        We save the state as a set of selected values. If "Banana" and
+        "Strawberry" are selected in the above <select>, we save two strings;
+        "Banana" and "Strawberry", not ".X..X".
+
+        Test: fast/forms/select/select-state-restore.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        Store selected value strings to a FormControlState object.
+        (WebCore::HTMLSelectElement::searchOptionsForValue):
+        A helper function to find an <option> with the specified value.
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        Clear all of selections, then select options with saved values.
+        In order to avoid O(M x N) loop, we start searching at position we found
+        the previous value.
+        * html/HTMLSelectElement.h: Declare searchOptionsForValue.
+        * html/FormController.cpp:
+        (formStateSignature): Bump up the version because this is a incompatible
+        change.
+
+2012-06-24  David Barr  <davidbarr@chromium.org>
+
+        Add snap to css3-images image-resolution
+        https://bugs.webkit.org/show_bug.cgi?id=89745
+
+        Reviewed by Tony Chang.
+
+        Due to floating point imprecision, it is difficult to be precise in dpcm.
+        So use PrimitiveValue::roundForImpreciseConversion rather than just floor.
+
+        No new tests; extended fast/css/image-resolution/image-resolution.html
+
+        * css/CSSParser.cpp: Accept snap identifier in image-resolution property.
+        (WebCore::CSSParser::parseImageResolution): Map CSSValueSnap to identifier value from cssValuePool.
+        * css/CSSValueKeywords.in: Add snap.
+        * css/StyleBuilder.cpp: Extend ApplyPropertyImageResolution to apply RenderStyle::imageResolutionSnap.
+        (WebCore::ApplyPropertyImageResolution::applyInheritValue): Apply RenderStyle::imageResolutionSnap.
+        (WebCore::ApplyPropertyImageResolution::applyInitialValue): Apply RenderStyle::imageResolutionSnap.
+        (WebCore::ApplyPropertyImageResolution::applyValue): Map CSSValueSnap to ImageResolutionSnapPixels.
+        * rendering/RenderImage.cpp: Extend conditions for recalculation of intrinsic size.
+        (WebCore::RenderImage::styleDidChange): Update intrinsic size if RenderStyle::imageResolutionSnap() has changed.
+        (WebCore::RenderImage::imageDimensionsChanged): Floor scale factor to int, round up if less than 0.01 away from ceiling.
+        * rendering/style/RenderStyle.cpp: Include StyleRareInheritedData::m_imageResolutionSnap in style diff.
+        (WebCore::RenderStyle::diff): Map change in StyleRareInheritedData::m_imageResolutionSnap to StyleDifferenceLayout.
+        * rendering/style/RenderStyle.h: Add RenderStyle::imageResolutionSnap, RenderStyle::setImageResolutionSnap, RenderStyle::initialImageResolutionSnap.
+        * rendering/style/RenderStyleConstants.h: Add enum ImageResolutionSnap.
+        * rendering/style/StyleRareInheritedData.cpp: Add StyleRareInheritedData::m_imageResolutionSnap.
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData): Add m_imageResolutionSnap to default and copy constructor.
+        (WebCore::StyleRareInheritedData::operator==): Include m_imageResolutionSnap in comparison.
+        * rendering/style/StyleRareInheritedData.h: Add StyleRareInheritedData::m_imageResolutionSnap.
+        (StyleRareInheritedData): Add 1-bit field StyleRareInheritedData::m_imageResolutionSnap.
+
+2012-06-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121106.
+        http://trac.webkit.org/changeset/121106
+        https://bugs.webkit.org/show_bug.cgi?id=89841
+
+        Caused 85% performance regressions on Dromaeo/jslib-modify-
+        jquery.html (Requested by rniwa on #webkit).
+
+        * dom/Document.cpp:
+        (WebCore::Document::clearNodeListCaches):
+        * dom/Document.h:
+        (Document):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList):
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
+        * dom/Node.cpp:
+        (WebCore::Node::clearRareData):
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
+        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged):
+        (WebCore::Node::getElementsByTagName):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::Node::radioNodeList):
+        (WebCore::NodeListsNodeData::invalidateCaches):
+        (WebCore):
+        (WebCore::NodeRareData::createNodeLists):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (WebCore::NodeListsNodeData::adoptTreeScope):
+        (WebCore::NodeRareData::ensureNodeLists):
+        (NodeRareData):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::TreeScope):
+        * dom/TreeScope.h:
+        (WebCore::TreeScope::addNodeListCache):
+        (WebCore::TreeScope::removeNodeListCache):
+        (WebCore::TreeScope::hasNodeListCaches):
+        (TreeScope):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        * html/LabelableElement.cpp:
+        (WebCore::LabelableElement::labels):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::LabelsNodeList):
+        (WebCore::LabelsNodeList::~LabelsNodeList):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::RadioNodeList):
+        (WebCore::RadioNodeList::~RadioNodeList):
+
+2012-06-24  Adam Barth  <abarth@webkit.org>
+
+        Change the type of the second argument of FrameSelection::revealSelection to use RevealExtentOption
+        https://bugs.webkit.org/show_bug.cgi?id=89833
+
+        Reviewed by Ryosuke Niwa.
+
+        As requested by Ryosuke Niwa.  Rare boolean parameters are hard to read.
+
+        * WebCore.exp.in:
+        * editing/Editor.cpp:
+        (WebCore::Editor::revealSelectionAfterEditingOperation):
+        * editing/Editor.h:
+        (Editor):
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::setSelection):
+        (WebCore::FrameSelection::revealSelection):
+        * editing/FrameSelection.h:
+
+2012-06-24  Antti Koivisto  <antti@apple.com>
+
+        Optimize RenderGeometryMap mappings gathering
+        https://bugs.webkit.org/show_bug.cgi?id=89828
+
+        Reviewed by Simon Fraser.
+
+        RenderGeometryMap currently gathers mappings by climbing the rendering tree. This is slow and can produce 
+        large number of mapping steps. In the common case we already have the child layer coordinates available in
+        the layer tree and we can just use that.
+        
+        The combination of faster mappings gathering and fewer number of applying steps reduces time spent under 
+        RenderLayerCompositor::computeCompositingRequirements to less than half when scrolling the mobile version
+        of twitter.com.
+        
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore):
+        (WebCore::RenderGeometryMap::pushMappingsToAncestor):
+        
+            Use pre-computed mapping from the layer tree when possible.
+
+        (WebCore::RenderGeometryMap::popMappingsToAncestor):
+        * rendering/RenderGeometryMap.h:
+        
+            Add some inline capacity.
+
+        (WebCore):
+        (RenderGeometryMap):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::canUseConvertToLayerCoords):
+        (RenderLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2012-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Rename isPositioned to isOutOfFlowPositioned for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=89836
+
+        Reviewed by Antti Koivisto.
+        
+        RenderObject and RenderStyle had an isPositioned() method that was
+        confusing, because it excluded relative positioning. Rename to 
+        isOutOfFlowPositioned(), which makes it clearer that it only applies
+        to absolute and fixed positioning.
+
+        Simple rename; no behavior change.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::getPositionOffsetValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * dom/Text.cpp:
+        (WebCore::Text::rendererIsNeeded):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::shouldScaleColumns):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
+        (WebCore::InlineFlowBox::requiresIdeographicBaseline):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::flipLinesInBlockDirection):
+        (WebCore::InlineFlowBox::computeOverflow):
+        (WebCore::InlineFlowBox::computeOverAnnotationAdjustment):
+        (WebCore::InlineFlowBox::computeUnderAnnotationAdjustment):
+        * rendering/InlineIterator.h:
+        (WebCore::isIteratorTarget):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::addChildToContinuation):
+        (WebCore::RenderBlock::addChildToAnonymousColumnBlocks):
+        (WebCore::RenderBlock::containingColumnsBlock):
+        (WebCore::RenderBlock::columnsBlockForSpanningElement):
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+        (WebCore::getInlineRun):
+        (WebCore::RenderBlock::isSelfCollapsingBlock):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromBlockChildren):
+        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
+        (WebCore::RenderBlock::handlePositionedChild):
+        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
+        (WebCore::RenderBlock::isSelectionRoot):
+        (WebCore::RenderBlock::blockSelectionGaps):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlock::markSiblingsWithFloatsForLayout):
+        (WebCore::isChildHitTestCandidate):
+        (WebCore::InlineMinMaxIterator::next):
+        (WebCore::RenderBlock::computeBlockPreferredLogicalWidths):
+        (WebCore::RenderBlock::firstLineBoxBaseline):
+        (WebCore::RenderBlock::lastLineBoxBaseline):
+        (WebCore::RenderBlock::updateFirstLetter):
+        (WebCore::shouldCheckLines):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        (WebCore::inNormalFlow):
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        (WebCore::RenderBlock::adjustBlockChildForPagination):
+        (WebCore::RenderBlock::renderName):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::shouldSkipCreatingRunsForObject):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::setMarginsForRubyRun):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::RenderBlock::computeBlockDirectionPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::LineBreaker::skipTrailingWhitespace):
+        (WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace):
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::positionLineBox):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        (WebCore::RenderBox::renderBoxRegionInfo):
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+        (WebCore::RenderBox::availableLogicalHeightUsing):
+        (WebCore::percentageLogicalHeightIsResolvable):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::stretchesToViewport):
+        (WebCore::RenderBox::isDeprecatedFlexItem):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
+        (WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::childDoesNotAffectWidthOrFlexing):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
+        (WebCore::RenderDeprecatedFlexibleBox::renderName):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
+        (WebCore::RenderFlexibleBox::autoMarginOffsetInMainAxis):
+        (WebCore::RenderFlexibleBox::availableAlignmentSpaceForChild):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        (WebCore::RenderFlexibleBox::computeNextFlexLine):
+        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
+        (WebCore::RenderFlexibleBox::prepareChildForPositionedLayout):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
+        (WebCore::RenderFlexibleBox::layoutColumnReverse):
+        (WebCore::RenderFlexibleBox::adjustAlignmentForChild):
+        (WebCore::RenderFlexibleBox::flipForRightToLeftColumn):
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::renderName):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::computeIntrinsicRatioInformation):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::addChildToContinuation):
+        (WebCore::RenderInline::generateCulledLineBoxRects):
+        (WebCore):
+        (WebCore::RenderInline::culledInlineFirstLineBox):
+        (WebCore::RenderInline::culledInlineLastLineBox):
+        (WebCore::RenderInline::culledInlineVisualOverflowBoundingBox):
+        (WebCore::RenderInline::computeRectForRepaint):
+        (WebCore::RenderInline::dirtyLineBoxes):
+        * rendering/RenderLayer.cpp:
+        (WebCore::checkContainingBlockChainForPagination):
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::isPositionedContainer):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderListItem.cpp:
+        (WebCore::getParentOfFirstLineBox):
+        * rendering/RenderMultiColumnBlock.cpp:
+        (WebCore::RenderMultiColumnBlock::renderName):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        (WebCore::RenderObject::setPreferredLogicalWidthsDirty):
+        (WebCore::RenderObject::invalidateContainerPreferredLogicalWidths):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isOutOfFlowPositioned):
+        (WebCore::RenderObject::isInFlowPositioned):
+        (WebCore::RenderObject::hasClip):
+        (WebCore::RenderObject::isFloatingOrOutOfFlowPositioned):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::hasAutoHeightOrContainingBlockWithAutoHeight):
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::rubyText):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        (WebCore::RenderTable::computeLogicalWidth):
+        (WebCore::RenderTable::layout):
+        * rendering/style/RenderStyle.h:
+
+2012-06-24  Oli Lan  <olilan@chromium.org>
+
+        After Editor::setComposition is called, input should scroll to the end of the composition.
+        https://bugs.webkit.org/show_bug.cgi?id=88999
+
+        Reviewed by Ryosuke Niwa.
+
+        This fixes an issue where after a call to setComposition, the start of the composition is revealed
+        (scrolled to) instead of the end (where the caret/editing point should be).
+
+        The change is to allow revealSelectionAfterEditingOperation to take a revealExtent parameter,
+        and to pass that parameter as true when calling from setIgnoreCompositionSelectionChange, which is
+        called at the end of setComposition.
+
+        Test: fast/forms/input-set-composition-scroll.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::revealSelectionAfterEditingOperation):
+        (WebCore::Editor::setIgnoreCompositionSelectionChange):
+        * editing/Editor.h:
+        (Editor):
+
+2012-06-24  Joshua Bell  <jsbell@chromium.org>
+
+        Web Inspector: Simplify InspectorIndexedDBAgent to use IDB metadata API
+        https://bugs.webkit.org/show_bug.cgi?id=89495
+
+        Reviewed by Vsevolod Vlasov.
+
+        No new tests - no functional changes.
+
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+
+2012-06-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: speed up Timeline and Elements panel rendering
+        https://bugs.webkit.org/show_bug.cgi?id=89771
+
+        Reviewed by Yury Semikhatsky.
+
+        I used timeline panel to find unnecessary style operations.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.updateTitle):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._updateEventDividers):
+        (WebInspector.TimelinePanel.prototype._updateFrames):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype.onResize):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+
+2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Inserting nodes is slow due to Node::notifyNodeListsAttributeChanged (20%+)
+        https://bugs.webkit.org/show_bug.cgi?id=73853
+
+        Reviewed by Anders Carlsson and Ojan Vafai.
+
+        Invalidate all node lists at document level to avoid having to walk up the DOM tree in the invalidation.
+        In particular, this makes appending node O(1) with respect to the depth of the tree in common cases when
+        we have node lists somewhere in the tree scope.
+
+        We now invalidate more node lists than we used to but it shouldn't matter much in practice because
+        most websites don't add or remove nodes or modify relevant attributes while iterating through node lists.
+        The change would also register each node list to document thereby consuming one extra pointer, however,
+        this should not have a significant memory impact given we used to do it unintentionally until I fixed it in
+        r110797 three months ago.
+
+        Also, RadioNodeList and LabelsNodeList had always been invalidated at document level so this refactoring
+        also allows us to move calls to registerDynamicSubtreeNodeList and unregisterDynamicSubtreeNodeList in
+        those node lists to DynamicSubtreeNodeList, and even delete NodeListsNodeData::invalidateCaches().
+
+        In addition, removed m_numNodeListCaches from TreeScope since it was only used to avoid walking up
+        the ancestors in invalidateNodeListsCacheAfterAttributeChanged and invalidateNodeListsCacheAfterChildrenChanged
+        but we don't walk up the ancestors any more. Also note that m_listsInvalidatedAtDocument tells us exactly
+        how many node lists are present for each document.
+
+        * dom/Document.cpp:
+        (WebCore::Document::clearNodeListCaches): Optionally takes a qualified attribute name so that we don't
+        have to invalidate tag node lists when only attributes are modified.
+        * dom/Document.h:
+        (Document):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList): Calls unregisterDynamicSubtreeNodeList.
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList): Calls registerDynamicSubtreeNodeList.
+        * dom/Node.cpp:
+        (WebCore::Node::clearRareData):
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged): No longer walks up the tree to invalidate
+        node list caches. All invalidations are done in Document::clearNodeListCaches.
+        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged): Ditto.
+        (WebCore::Node::getElementsByTagName):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::Node::radioNodeList):
+        (WebCore):
+        (WebCore::NodeRareData::createNodeLists):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (WebCore::NodeListsNodeData::adoptTreeScope): Invalidate node list caches while registering and
+        unregistering node lists from old and new documents respectively now that invalidateCaches() has been
+        (WebCore::NodeRareData::ensureNodeLists):
+        (NodeRareData):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::TreeScope):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        * html/LabelableElement.cpp:
+        (WebCore::LabelableElement::labels):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::LabelsNodeList):
+        (WebCore::LabelsNodeList::~LabelsNodeList):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::RadioNodeList):
+        (WebCore::RadioNodeList::~RadioNodeList):
+
+2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Clang and cl.exe build fix after r121103. Don't inherit from WTF::PairHash<unsigned char, StringType>.
+
+        * dom/NodeRareData.h:
+
+2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r120979): getElementsByTagName is 12% slower
+        https://bugs.webkit.org/show_bug.cgi?id=89783
+
+        Reviewed by Darin Adler.
+
+        The problem is that hashing std::pair<unsigned short, AtomicString> is very slow compared to just hashing AtomicString,
+        which internally holds a hash already. Fixed the regression by replacing the default hash function by the one that
+        computes AtomicString's hash + list type. This is okay because we only have 7 node list types at the moment.
+
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (WebCore::NodeListsNodeData::NodeListCacheMapEntryHash::hash):
+        (NodeListCacheMapEntryHash):
+        (WebCore::NodeListsNodeData::NodeListCacheMapEntryHash::equal):
+        (WebCore::NodeListsNodeData::namedNodeListKey):
+
+2012-06-23  Dan Bernstein  <mitz@apple.com>
+
+        RenderText’s minimum preferred width is incorrect automatic hyphenation is used
+        https://bugs.webkit.org/show_bug.cgi?id=89814
+
+        Reviewed by Sam Weinig.
+
+        Test: fast/text/hyphen-min-preferred-width.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::maxWordFragmentWidth): Added this helper function. It returns the width of the
+        widest hyphenated fragment of the word (except for the suffix after the last hyphen) and
+        the offset of the last hyphenation opportunity.
+        (WebCore::RenderText::computePreferredLogicalWidths): Changed this function to consider the
+        widths of hyphenated word fragments rather than entire words when computing the minimum
+        width. Because hyphenating and measuring all fragments is expensive, hyphenation is only
+        attempted if the unhyphenated word is wider than the current minimum width.
+
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::garbageCollectSoon):
+        (WebCore::GCController::garbageCollectNow):
+        (WebCore::GCController::discardAllCompiledCode):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::nodeAsScriptValue):
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadExecState::evaluate):
+        * bindings/js/JSMutationCallbackCustom.cpp:
+        (WebCore::JSMutationCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
+        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
+        * bindings/js/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::cacheableBindingRootObject):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::dispatchDidPause):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::eventListenerHandlerBody):
+        (WebCore::eventListenerHandlerLocation):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptCallArgumentHandler::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptCallback::call):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::toInspectorValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::disableEval):
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
+        (-[WebScriptObject _setOriginRootObject:andRootObject:]):
+        (-[WebScriptObject dealloc]):
+        (-[WebScriptObject finalize]):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject hasWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallbackImplementation):
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithNoParam):
+        (WebCore::JSTestCallback::callbackWithClass1Param):
+        (WebCore::JSTestCallback::callbackWithClass2Param):
+        (WebCore::JSTestCallback::callbackWithStringList):
+        (WebCore::JSTestCallback::callbackWithBoolean):
+        (WebCore::JSTestCallback::callbackRequiresThisToPass):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jsc/JavaMethodJSC.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::utf8):
+        (JSC::Bindings::JavaString::init):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeObjcMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::npObject):
+        (WebCore::PluginView::privateBrowsingStateChanged):
+        * plugins/blackberry/PluginViewBlackBerry.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::getWindowInfo):
+        * plugins/efl/PluginViewEfl.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::injectInternalsObject):
+        (WebCoreTestSupport::resetInternalsObject):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2012-06-23  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Store hit-test rect in HitTestPoint as Rect.
+        https://bugs.webkit.org/show_bug.cgi?id=89454
+
+        Reviewed by Darin Adler.
+
+        Calculate the rectangle early and store that instead of padding
+        to avoid recalculating the rectangle for every single element
+        hit tested.
+
+        No change in functionality. No new tests.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::bestClickableNodeForTouchPoint):
+        (WebCore::EventHandler::bestZoomableAreaForTouchPoint):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestPoint::HitTestPoint):
+        (WebCore::HitTestPoint::operator=):
+        (WebCore::HitTestPoint::setPoint):
+        (WebCore::hitTestPointIntersects):
+        (WebCore::HitTestPoint::intersects):
+        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
+        * rendering/HitTestResult.h:
+        (HitTestPoint):
+        (WebCore::HitTestPoint::boundingBox):
+        (WebCore::HitTestPoint::topPadding):
+        (WebCore::HitTestPoint::rightPadding):
+        (WebCore::HitTestPoint::bottomPadding):
+        (WebCore::HitTestPoint::leftPadding):
+        (HitTestResult):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hitTestColumns):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+
+2012-06-22  Benjamin Poulain  <bpoulain@apple.com>
+
+        Text with text-overflow:ellipsis and text-align:right is left aligned
+        https://bugs.webkit.org/show_bug.cgi?id=88705
+
+        Reviewed by Dan Bernstein.
+
+        When building the line of a text with overflow, we do not know if we can place
+        an ellipsis and where it should be. Because of that, text is laid out as if it does
+        not have text-overflow: ellipsis.
+
+        This causes problems with text-alignement right in LTR and left in RTL. The shortened text
+        did not follow the allignment.
+
+        This patch changes the position of lines with ellipsis after layout to follow the allignment.
+        In RenderBlock::checkLinesForTextOverflow(), the call to RootInlineBox::placeEllipsis() now
+        also gives the width of the truncated text. We use this width to re-compute the alignement and
+        shift the box if necessary.
+
+        In RenderBlock::deleteEllipsisLineBoxes() we revert the text to the position computed with the
+        total width. This way all layout computation is done as usual.
+
+        Tests: fast/css/text-overflow-ellipsis-text-align-left.html
+               fast/css/text-overflow-ellipsis-text-align-right.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::canAccommodateEllipsis): Make the method const for readability, truncating is
+        done later in placeEllipsisBox().
+        (WebCore::InlineBox::placeEllipsisBox): Add an output argument, truncatedWidth, giving the width
+        of the text + ellipsis after truncation (if any truncation can be done).
+        * rendering/InlineBox.h:
+        (InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineBox::adjustLogicalPosition): adjustPosition() logical coordinates.
+        (WebCore::InlineFlowBox::canAccommodateEllipsis):
+        (WebCore::InlineFlowBox::placeEllipsisBox):
+        * rendering/InlineFlowBox.h:
+        (InlineFlowBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        * rendering/InlineTextBox.h:
+        (InlineTextBox):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::deleteEllipsisLineBoxes): In addition to removing the truncation, we
+        need to revert the shift introduced by checkLinesForTextOverflow(). This restore the lines
+        to its original, untruncated position in order to layout the block correctly in RenderBlock::layoutInlineChildren().
+        (WebCore::RenderBlock::checkLinesForTextOverflow): After we truncate the text, we now recompute the shift we need
+        for alignment, and move the line accordingly.
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::placeEllipsis): Return the width of the truncated text + the width of the ellipsis.
+        (WebCore::RootInlineBox::placeEllipsisBox):
+        (WebCore::RootInlineBox::adjustPosition):
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+
+2012-06-22  Eugene Klyuchnikov  <eustas.big@gmail.com>
+
+        Web Inspector: Fix negative time interval on zoom-in
+        https://bugs.webkit.org/show_bug.cgi?id=89798
+
+        Reviewed by Pavel Feldman.
+
+        Steps to reproduce:
+        1) Record timeline
+        2) Select small range with left tick close to zero
+        3) Move pointer to the right end of the ruler
+        4) Zoom-in with mouse-wheel
+
+        Result: right tick goes below the zero.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewWindow.prototype._zoom):
+
+2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89781
+
+        Reviewed by Dean Jackson.
+
+        Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
+
+        No new tests, just re-enabled existing tests.
+
+        * css/CSSValueKeywords.in: Added empty line to force a rebuild of the file on the EWS.
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-06-22  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Avoid infinite loop if we try to encode -1 for leveldb
+        https://bugs.webkit.org/show_bug.cgi?id=89625
+
+        It gets worse, memory is allocated inside the loop so the process is
+        eventually killed by the OS.
+
+        Reviewed by Tony Chang.
+
+        Added tests to Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
+
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeInt):
+        (WebCore::IDBLevelDBCoding::encodeVarInt):
+
+2012-06-22  Hayato Ito  <hayato@chromium.org>
+
+        [Shadow] ShadowRoot.activeElement should use the result of re-targeting algorithm.
+        https://bugs.webkit.org/show_bug.cgi?id=89763
+
+        Reviewed by Dimitri Glazkov.
+
+        Use the result of the re-targeting algorithm in calculating
+        shadow root's activeElement so that ShadowRoot.activeElement returns
+        a focused distributed node correctly as the algorithm says.
+
+        The spec is:
+        https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#active-element
+
+        Tests: fast/dom/shadow/shadow-root-activeElement.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore):
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::focusedNode):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::InsertionPoint::contains):
+
+2012-06-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRendererChromium is not getting visibility messages in single threaded compositing mode.
+        https://bugs.webkit.org/show_bug.cgi?id=89045
+
+        Reviewed by Adrienne Walker.
+
+        Based on patch by Michal Mocny <mmocny@google.com>.
+
+        Invariants:
+
+        1.) We never commit (paint, animate, any of it) when not visible on the main thread -except- for
+        compositeAndReadback, regardless of threaded vs non-threaded mode
+        2.) CCLayerTreeHost::m_contentsTextureManager's memory budget is only set by updateLayers() when we are going to
+        make a frame and is always set to a non-zero value
+        3.) Zero-sized allocations from the GPU process are always serviced immediately on the impl thread.  Non-zero
+        allocations are met in the next frame, whenever we would produce that frame according to our usual frame
+        scheduling logic.
+        4.) The impl thread always knows the set of currently-allocated managed texture IDs and can delete them all
+        whenever it likes without needing the main thread to be responsive.
+
+        Details:
+
+        There are two main changes - tweaking how the contents texture manager's budget is handled and tweaking frame
+        scheduling for the !visible case.
+
+        The scheduling change is a bit more subtle but it unifies the single and multi threaded paths and is really
+        important.  Except for compositeAndReadback (which I'll talk about below), we simply won't produce frames when
+        not visible.  This already happens in the single threaded path thanks to render_widget so the only change is to
+        the threaded path.  The difficulty here is we might post a beginFrame task from the impl thread and then get a
+        setVisible(false) call on the main thread before the beginFrame task runs.  Since I'm making the setVisible()
+        call a blocking call from main thread -> impl thread, when the beginFrame task eventually does run on the main
+        thread we can know that the impl thread's notion of visibility is in sync with the main threads.  Thus I'm
+        planning to simply abort the frame before doing any processing on the main thread.  The scheduler will know if
+        it gets a beginFrameAborted and COMMIT_STATE_IDLE.
+
+        compositeAndReadback is special - this call currently does come in when we aren't visible (in single and
+        threaded mode) and we need to service it.  In particular, we need to send a beginFrame over and have it
+        not be ignored on the main thread.  For this I'm thinking of having the proxy keep track of whether it's
+        servicing a compositeAndReadback() and use that bit on the main thread to know to process the beginFrame
+        normally.  On the impl side, we need a few changes.  First, we have to allocate a default framebuffer
+        (ensureFramebufferCHROMIUM) even if we've dropped it previously and remember to discard it after the
+        readPixels().  Second, we have to provide a non-zero contents texture allocation on the beginFrame message, and
+        again remember to delete the textures after the readPixels().  Third, we have to know that the beginFrame is a
+        forced frame so when we get the beginFrameComplete we go ahead with the rest of the frame.  For this, I think
+        I'll have to add ACTION_BEGIN_FORCED_FRAME and a corresponding COMMIT_STATE_FORCED_FRAME_IN_PROGRESS so the
+        scheduler can keep track of the magicness of this frame, and then add some logic after the readpixels call to
+        drop resources after the readback.  It's probably a good time to stop swapping on readbacks too....
+
+        The contents texture manager's budget is only relevant when we want to make a frame, so it's now passed in on
+        the updateLayers().  Since we only make frames when we are visible and we never have a zero allocation when
+        visible (thanks to the frame scheduling changes above), this value is always non-zero.  The other thing the
+        texture manager needs to know about is if we've killed all of the underlying textures from the impl thread -
+        this bit is passed in by the proxy before the updateLayers() call.  This means if we're running while visible
+        and the manager wants to decrease our budget to something other than zero, we'll get a new (non-zero) allocation
+        on the impl thread, schedule a frame, then when it's time to make the frame pass the new lower limit in to
+        updateLayers(), then have the contents texture manager evict down to our new limit and make a frame with the new
+        budget.  When the commit completes we'll get notified on the impl thread of which textures the contents texture
+        manager decided to evict and issue the deleteTexture() calls on them.
+
+        The texture budget we pass in will be based on the most recent non-zero memory allocation we received from the
+        GPU memory manager, or some default value I'll pull out my ass if we haven't heard anything yet.  On compositor
+        initialization, we can't afford to wait for a round-trip through the GPU process to get a budget for the first
+        frame.  I don't think handling a decrease to a non-zero budget on a visible tab needs to be terribly urgent - we
+        can get to it when we get to making the next frame.  If we wanted to satisfy reduced texture budgets directly
+        from the impl thread, we could keep a priority-list ordered set of textures once we have priorities and delete
+        based on that.  Let's worry about that later.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::setVisible):
+        (WebCore::LayerRendererChromium::setGpuMemoryAllocation):
+        (WebCore):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::evictAndRemoveAllDeletedTextures):
+        (WebCore):
+        * platform/graphics/chromium/TextureManager.h:
+        (TextureAllocator):
+        (TextureManager):
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        (WebCore):
+        (WebCore::TrackingTextureAllocator::deleteAllTextures):
+        * platform/graphics/chromium/TrackingTextureAllocator.h:
+        (TrackingTextureAllocator):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setVisible):
+        (WebCore::CCLayerTreeHost::evictAllContentTextures):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::commitComplete):
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::context):
+        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::setMemoryAllocationLimitBytes):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (WebCore::CCLayerTreeHostImpl::contentsTexturesWerePurgedSinceLastCommit):
+        (WebCore::CCLayerTreeHostImpl::memoryAllocationLimitBytes):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::beginFrameComplete):
+        (WebCore::CCScheduler::beginFrameAborted):
+        (WebCore):
+        (WebCore::CCScheduler::didSwapBuffersComplete):
+        (WebCore::CCScheduler::didLoseContext):
+        (WebCore::CCScheduler::didRecreateContext):
+        (WebCore::CCScheduler::vsyncTick):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (CCScheduler):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::beginFrameAborted):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setVisible):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::setVisible):
+        (WebCore):
+        (WebCore::CCThreadProxy::setVisibleOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::beginFrameAbortedOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+        (BeginFrameAndCommitState):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::willDraw):
+        (WebCore::CCVideoLayerImpl::willDrawInternal):
+        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
+        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
+        (WebCore::CCVideoLayerImpl::allocatePlaneData):
+        (WebCore::CCVideoLayerImpl::freePlaneData):
+        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
+        (WebCore::CCVideoLayerImpl::didLoseContext):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (FramePlane):
+
+2012-06-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        REGRESSION(r116446): Crash in RenderBoxModelObject::adjustedPositionRelativeToOffsetParent
+        https://bugs.webkit.org/show_bug.cgi?id=89785
+
+        Reviewed by Abhishek Arya.
+
+        Test: fullscreen/full-screen-crash-offsetLeft.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
+        Added a NULL-check for parent() as it can be NULL in fullscreen mode. Also updated a stale
+        comment while touching the code.
+
+2012-06-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r121064.
+        http://trac.webkit.org/changeset/121064
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Broke Chromium Mac build.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::updateAnimations):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (WebCore::CCLayerTreeHost::frameNumber):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore::CCLayerTreeHostImpl::frameNumber):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (WebCore):
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderingStats.h: Removed.
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-06-22  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL][WK2] Support keyboard event
+        https://bugs.webkit.org/show_bug.cgi?id=89268
+
+        Reviewed by Chang Shu.
+
+        Extract keyDownCommandsMap and keyPressCommandsMap to share WebKit1/Efl and WebKit2/Efl.
+
+        * platform/efl/EflKeyboardUtilities.cpp:
+        (WebCore):
+        (WebCore::keyDownCommandsMap):
+        (WebCore::keyPressCommandsMap):
+        (KeyDownEntry):
+        (KeyPressEntry):
+        (WebCore::createKeyDownCommandMap):
+        (WebCore::createKeyPressCommandMap):
+        (WebCore::getKeyDownCommandName):
+        (WebCore::getKeyPressCommandName):
+        * platform/efl/EflKeyboardUtilities.h:
+        (WebCore):
+
+2012-06-22  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: refactor index-writing to be more self-contained
+        https://bugs.webkit.org/show_bug.cgi?id=89607
+
+        Reviewed by Tony Chang.
+
+        Refactor index-writing into the IndexWriter class. Does not change
+        existing behavior but begins migrating index-writing logic into a
+        self-contained class that can eventually be used in the
+        frontend (renderer) side of IndexedDB.
+
+        No new tests, behavior is unchanged.
+
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::populateIndex):
+
+2012-06-22  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Expose rendering statistics to WebWidget.
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Reviewed by James Robinson.
+
+        The WebKit side of a basic framework for exposing rendering statistics
+        to Chromium's --enable-benchmarking extension.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeHost::implFrameNumber):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::implFrameNumber):
+        (WebCore):
+        (WebCore::CCThreadProxy::implFrameNumberOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-06-22  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Do not accumulate occlusion from 3d layers on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=89704
+
+        Reviewed by James Robinson.
+
+        Layer iterators on the main thread may not iterate over 3d layers
+        in correct front-to-back or back-to-front order, because layer
+        sorting is not performed on the main thread. As a result,
+        occlusion tracking can accidentally think something is occluded if
+        a 3d layer is processed out of order. This patch choses to solve
+        this by avoiding accumulating occlusion for 3d layers. It may be
+        appropriate later to consider adding layer sorting on the main
+        thread, but for now that seemed like an unnecessary heavy-handed
+        approach.
+
+        In addition to a new unit test that covers this, other unit tests
+        were changed to work on the impl thread, so that the 3d layers
+        still accumulate occlusion as required.
+
+        Unit test added to CCOcclusionTrackerTest:
+          CCOcclusionTrackerTestUnsorted3dLayers
+
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::layerIsInUnsorted3dRenderingContext):
+        (WebCore):
+        (WebCore::::markOccludedBehindLayer):
+
+2012-06-22  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Snapshot metadata in front end to avoid IPC round-trips
+        https://bugs.webkit.org/show_bug.cgi?id=88467
+
+        Reviewed by Tony Chang.
+
+        Define a new type (IDBDatabaseMetadata) that captures the "schema" of an
+        IDB database (name, version, properties of stores, properties of indexes).
+        Add a method for the front end to request this from the back end once up
+        front to avoid later calls (which may be slow IPC calls in ports). Implement
+        IDB spec logic that the metadata should be frozen for a particular IDBDatabase
+        connection, and only change within a version change transaction, and the spec's
+        funky requirement for aborted version change transactions.
+
+        Test: storage/indexeddb/metadata.html
+
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::IDBDatabase): Fetch metadata from back end when connection is created.
+        (WebCore::IDBDatabase::transactionCreated):
+        (WebCore::IDBDatabase::transactionFinished): Update metadata at the end of a transaction in 
+        case it was rolled back.
+        (WebCore::IDBDatabase::objectStoreNames): Move implementation to front-end.
+        (WebCore):
+        (WebCore::IDBDatabase::createObjectStore): Update local copy of metadata.
+        (WebCore::IDBDatabase::deleteObjectStore): Update local copy of metadata.
+        * Modules/indexeddb/IDBDatabase.h:
+        (WebCore::IDBDatabase::name): Move implementation to front-end.
+        (WebCore::IDBDatabase::version): Move implementation to front-end.
+        (IDBDatabase):
+        (WebCore::IDBDatabase::metadata):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::metadata): Construct a metadata snapshot.
+        (WebCore):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h:
+        (WebCore):
+        (IDBDatabaseBackendInterface):
+        * Modules/indexeddb/IDBIndex.cpp: Store a copy of the metadata, which will never
+        change during the lifetime of the index.
+        (WebCore::IDBIndex::IDBIndex):
+        * Modules/indexeddb/IDBIndex.h:
+        (WebCore::IDBIndex::create):
+        (WebCore::IDBIndex::name): Move implementation to front-end.
+        (WebCore::IDBIndex::objectStore): Return RefPtr (unrelated tidying).
+        (WebCore::IDBIndex::keyPath): Move implementation to front-end.
+        (WebCore::IDBIndex::unique): Move implementation to front-end.
+        (WebCore::IDBIndex::multiEntry): Move implementation to front-end.
+        (IDBIndex):
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::metadata): Construct a metadata snapshot.
+        (WebCore):
+        * Modules/indexeddb/IDBIndexBackendImpl.h:
+        (IDBIndexBackendImpl):
+        * Modules/indexeddb/IDBMetadata.h: Added new structs.
+        (WebCore):
+        (WebCore::IDBDatabaseMetadata::IDBDatabaseMetadata):
+        (IDBDatabaseMetadata):
+        (WebCore::IDBObjectStoreMetadata::IDBObjectStoreMetadata):
+        (IDBObjectStoreMetadata):
+        (WebCore::IDBIndexMetadata::IDBIndexMetadata):
+        (IDBIndexMetadata):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::IDBObjectStore): Store a "live" copy of the metadata, and
+        and copy in case of an aborted version change transaction.
+        (WebCore::IDBObjectStore::indexNames): Move implementation to front-end.
+        (WebCore::IDBObjectStore::createIndex): Update metadata to include new index.
+        (WebCore::IDBObjectStore::index): Pass along metadata to instance constructor.
+        (WebCore::IDBObjectStore::deleteIndex): Delete index from metadata.
+        * Modules/indexeddb/IDBObjectStore.h:
+        (WebCore::IDBObjectStore::create):
+        (WebCore::IDBObjectStore::name): Move implementation to front-end.
+        (WebCore::IDBObjectStore::keyPath): Move implementation to front-end.
+        (WebCore::IDBObjectStore::transaction): Return RefPtr (unrelated tidying).
+        (WebCore::IDBObjectStore::autoIncrement): Move implementation to front-end.
+        (WebCore::IDBObjectStore::metadata): Allow copying the metadata, in case of abort.
+        (WebCore::IDBObjectStore::resetMetadata): Allow setting the metadata, in case of abort.
+        (IDBObjectStore):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::metadata): Construct a metadata snapshot.
+        (WebCore):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
+        (WebCore):
+        (IDBObjectStoreBackendImpl):
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::objectStore): Pass along metadata to instance constructor.
+        (WebCore::IDBTransaction::objectStoreCreated): Track stores changed during transaction.
+        (WebCore::IDBTransaction::objectStoreDeleted):Track stores changed during transaction.
+        (WebCore::IDBTransaction::onAbort): Revert stores metadata potentially changed during transaction.
+        * Modules/indexeddb/IDBTransaction.h:
+        (IDBTransaction):
+        * WebCore.gypi:
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        No new tests. Current regression tests are sufficient.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::garbageCollectSoon):
+        (WebCore::GCController::garbageCollectNow):
+        (WebCore::GCController::discardAllCompiledCode):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::nodeAsScriptValue):
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadExecState::evaluate):
+        * bindings/js/JSMutationCallbackCustom.cpp:
+        (WebCore::JSMutationCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
+        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
+        * bindings/js/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::cacheableBindingRootObject):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::dispatchDidPause):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::eventListenerHandlerBody):
+        (WebCore::eventListenerHandlerLocation):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptCallArgumentHandler::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptCallback::call):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::toInspectorValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::disableEval):
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
+        (-[WebScriptObject _setOriginRootObject:andRootObject:]):
+        (-[WebScriptObject dealloc]):
+        (-[WebScriptObject finalize]):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject hasWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallbackImplementation):
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithNoParam):
+        (WebCore::JSTestCallback::callbackWithClass1Param):
+        (WebCore::JSTestCallback::callbackWithClass2Param):
+        (WebCore::JSTestCallback::callbackWithStringList):
+        (WebCore::JSTestCallback::callbackWithBoolean):
+        (WebCore::JSTestCallback::callbackRequiresThisToPass):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jsc/JavaMethodJSC.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::utf8):
+        (JSC::Bindings::JavaString::init):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeObjcMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::npObject):
+        (WebCore::PluginView::privateBrowsingStateChanged):
+        * plugins/blackberry/PluginViewBlackBerry.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::getWindowInfo):
+        * plugins/efl/PluginViewEfl.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::injectInternalsObject):
+        (WebCoreTestSupport::resetInternalsObject):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2012-06-22  Jeff Timanus  <twiz@chromium.org>
+
+        [Chromium] Change implementing a fast-path for copying GPU-accelerated Canvas2D instances to WebGL textures.
+        https://bugs.webkit.org/show_bug.cgi?id=86275
+
+        This change adds the necessary plumbing to the various rendering contexts to copy the backing store texture of
+        a Canvas2D instance to be copied to a WebGL texture.  The GL_CHROMIUM_copy_texture extension is necessary
+        because the backing-store for a GPU-accelerated skia Canvas2D is normally in BGRA format, which is not supported
+        by glCopyTexImage.
+
+        Reviewed by Kenneth Russell.
+
+        Test: fast/canvas/webgl/*
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        * platform/chromium/support/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::copyTextureCHROMIUM):
+        (WebCore):
+        * platform/graphics/Extensions3D.h:
+        (Extensions3D):
+        * platform/graphics/ImageBuffer.cpp:
+        (WebCore):
+        (WebCore::ImageBuffer::copyToPlatformTexture):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore):
+        (ImageBuffer):
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        (WebCore::Canvas2DLayerBridge::backBufferTexture):
+        (WebCore):
+        * platform/graphics/chromium/Canvas2DLayerBridge.h:
+        (Canvas2DLayerBridge):
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        (Extensions3DChromium):
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        (WebCore::Extensions3DOpenGL::copyTextureCHROMIUM):
+        (WebCore):
+        * platform/graphics/opengl/Extensions3DOpenGL.h:
+        (Extensions3DOpenGL):
+        * platform/graphics/qt/Extensions3DQt.cpp:
+        (WebCore::Extensions3DQt::copyTextureCHROMIUM):
+        (WebCore):
+        * platform/graphics/qt/Extensions3DQt.h:
+        (Extensions3DQt):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::copyToPlatformTexture):
+        (WebCore):
+
+2012-06-22  Danilo Cesar Lemes de Paula  <danilo.cesar@collabora.co.uk>
+
+        Add url to supportsType
+        https://bugs.webkit.org/show_bug.cgi?id=89514
+
+        Reviewed by Eric Carlson.
+
+        No new tests since there's no change on code behavior.
+
+        When a blob is created as the address for a Media Stream, the MediaEngine
+        will ask it's players if they support that media. However, a player built
+        for MediaStream needs to know to URL to decide if it's supported or not.
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+        * html/HTMLMediaElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (MediaPlayerFactory):
+        (WebCore::MediaPlayerFactory::MediaPlayerFactory):
+        (WebCore):
+        (WebCore::textPlain):
+        (WebCore::bestMediaEngineForTypeAndCodecs):
+        (WebCore::MediaPlayer::load):
+        (WebCore::MediaPlayer::loadWithNextMediaEngine):
+        (WebCore::MediaPlayer::paint):
+        (WebCore::MediaPlayer::supportsType):
+        * platform/graphics/MediaPlayer.h:
+        (WebCore):
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundationCF::supportsType):
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
+        (MediaPlayerPrivateAVFoundationCF):
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
+        (MediaPlayerPrivateAVFoundationObjC):
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsType):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
+        (MediaPlayerPrivate):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        (MediaPlayerPrivateQTKit):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::supportsType):
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::supportsType):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        (MediaPlayerPrivateQt):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::supportsType):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
+        (MediaPlayerPrivateQuickTimeVisualContext):
+        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
+        (MediaPlayerPrivate):
+
+2012-06-22  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] Sanitize GLSL code using ANGLE.
+
+        BlackBerry port does not sanitize GLSL code with ANGLE
+        https://bugs.webkit.org/show_bug.cgi?id=89583
+
+        Reviewed by Rob Buis.
+
+        No new tests are required.
+
+        * CMakeLists.txt: Added ANGLE requirment for CMake builds with WEBGL
+        * platform/graphics/ANGLEWebKitBridge.h: Added include for ANGLE/ShaderLang.h in BlackBerry platform.
+        * platform/graphics/GraphicsContext3D.h: Added include for ANGLEWebKitBridge.h in BlackBerry platform.
+
+2012-06-22  Dan Bernstein  <mitz@apple.com>
+
+        RenderText’s minimum preferred width is incorrect when soft hyphens are used
+        https://bugs.webkit.org/show_bug.cgi?id=89775
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/text/soft-hyphen-min-preferred-width.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::hyphenWidth): Added this helper function.
+        (WebCore::RenderText::computePreferredLogicalWidths): In places where this function tests
+        for the soft hyphen character, added a check that the 'hyphens' style property is not set
+        to 'none', because in that case soft hyphens are not break opportunities. Also added an
+        explicit check to suppress break opportunities from isBreakable() if the occur after a
+        soft hyphen and 'hyphens' is set to 'none'. Finally, when measuring text up to a potential
+        line break, added the width of the hyphen string when needed.
+
+2012-06-22  Dean Jackson  <dino@apple.com>
+
+        BitmapImage duplicates code to calculate size
+        https://bugs.webkit.org/show_bug.cgi?id=89728
+        <rdar://problem/11724321>
+
+        Reviewed by Darin Adler.
+
+        Add a new updateSize method to BitmapImage that
+        avoids duplication in the size and
+        sizeRespectingOrientation methods.
+
+        No new tests needed.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::updateSize): new method that will set
+        m_size and m_sizeRespectingOrientation if necessary.
+        (WebCore):
+        (WebCore::BitmapImage::size):
+        (WebCore::BitmapImage::sizeRespectingOrientation): these each
+        now call updateSize rather than duplicate the update code.
+        * platform/graphics/BitmapImage.h:
+        (BitmapImage):
+
+2012-06-22  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Clean up visitDOMWrapper code
+        https://bugs.webkit.org/show_bug.cgi?id=89774
+
+        Reviewed by Tony Chang.
+
+        This moves the check if domWrapperVisitorFunction is null into a function of the WrapperTypeInfo struct.
+        This is so that users of WrapperTypeInfo does not need to know about the inner details of the struct.
+        It also makes things more consistent since the other fields in the struct have these kind of functions.
+
+        This is a follow up change to http://trac.webkit.org/changeset/120854.
+
+        No new tests. Covered by existing tests.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper): Call WrapperTypeInfo::visitDOMWrapper instead.
+        * bindings/v8/WrapperTypeInfo.h:
+        (WrapperTypeInfo):
+        (WebCore::WrapperTypeInfo::visitDOMWrapper): If domWrapperVisitorFunction is non null call it.
+
+2012-06-22  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: ExtensionPanel.onSearch listener doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=89517
+
+        Reviewed by Yury Semikhatsky.
+
+        Added a test to see if listener fires on search:
+        LayoutTests/inspector/extensions/extensions-panel.html
+
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionPanel.prototype.searchCanceled):
+        (WebInspector.ExtensionPanel.prototype.performSearch):
+        (WebInspector.ExtensionPanel.prototype.jumpToNextSearchResult):
+        (WebInspector.ExtensionPanel.prototype.jumpToPreviousSearchResult):
+
+2012-06-22  Brian Salomon  <bsalomon@google.com>
+
+        Increase the GrContext texture cache count cap to 2K
+        https://bugs.webkit.org/show_bug.cgi?id=89761
+
+        Reviewed by Stephen White.
+
+        Tests: The change is for performance. The code is exercised by all the canvas 2d layout tests.
+
+        * platform/chromium/support/GraphicsContext3DPrivate.cpp:
+
+2012-06-22  Silvia Pfeiffer  <silviapf@chromium.org>
+
+        [Chromium] Adjust the displayed elements of the new Chrome media controls.
+        https://bugs.webkit.org/show_bug.cgi?id=89416
+
+        Reviewed by Eric Carlson.
+
+        No new tests - existing media tests cover these cases.
+
+        Remove the volume slider for videos without audio or media resource.
+        Display the transport bar for videos without a media resource.
+        Don't show the fullscreen button for
+
+        * html/shadow/MediaControlRootElementChromium.cpp:
+        (WebCore::MediaControlRootElementChromium::reset):
+        Don't display volume slider if media controller has no audio.
+        Don't display fullscreen button if media controller supportsFullscreen().
+        (WebCore::MediaControlRootElementChromium::reportedError):
+        Don't hide the timeline for failed videos, e.g. where the resource doesn't load.
+
+2012-06-22  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Elements] Right-clicking on whitespace should show the same context menu as right-clicking on the tag text
+        https://bugs.webkit.org/show_bug.cgi?id=89766
+
+        Reviewed by Vsevolod Vlasov.
+
+        Explicitly check for the TreeElement.representedObject's nodeType()
+        rather than for the event target's enclosing element class.
+        Drive-by: do not consider the "collapsed node has children" ellipsis as a text node.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+
+2012-06-22  Florin Malita  <fmalita@chromium.org>
+
+        REGRESSION (Safari 5.1.5 - ToT): Crash in RenderSVGRoot::computeReplacedLogicalWidth
+        https://bugs.webkit.org/show_bug.cgi?id=85797
+
+        Reviewed by Darin Adler.
+
+        Test: svg/custom/svg-width-intrinsic-crash.html
+
+        RenderSVGRoot::computeReplacedLogicalWidth assumes that if
+        SVGSVGElement::widthAttributeEstablishesViewport returns false, the
+        SVG must be embedded via <object>. This is not always the case, though:
+        widthAttributeEstablishesViewport can also return false for inline
+        SVG if it doesn't have a replaced logical width.
+
+        Updated computeReplacedLogical{Width,Height} to handle the
+        !widthAttributeEstablishesViewport && !isEmbeddedThroughFrameContainingSVGDocument
+        case gracefully.
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+
+2012-06-22  Hayato Ito  <hayato@chromium.org>
+
+        Modify event re-targeting algorithm so that we can tell which distributed node is clicked.
+        https://bugs.webkit.org/show_bug.cgi?id=89073
+
+        Reviewed by Dimitri Glazkov.
+
+        Re-landing r120945 since bug 89172 was resolved.
+
+        Adopt a new event re-targeting algorithm in the latest Shadow DOM spec.
+        The corresponding bug in the shadow DOM spec is:
+        https://www.w3.org/Bugs/Public/show_bug.cgi?id=17090
+
+        This change is introduced to handle the following use case:
+        1. There is an insertion point, with zero or more nodes distributed into it.
+        2. User clicks on one of the items.
+        3. The event handler in shadow DOM subtree wants to know which item was clicked on.
+
+        The new re-targeting algorithm sets an event's target to a
+        distributed node where an event was originally fired, instead of
+        an insertion point to where the node is distributed.
+
+        The similar re-targeting algorithm also applies to an event's
+        relatedTarget.
+
+        Test: fast/dom/shadow/shadow-dom-event-dispatching.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+
+2012-06-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed follow-up to r121030, fix display of "Duration" in timeline event details popup.
+
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+
+2012-06-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r121025.
+        http://trac.webkit.org/changeset/121025
+        https://bugs.webkit.org/show_bug.cgi?id=89580
+
+        Caused crash in
+        EventHandler.shouldTurnVerticalTicksIntoHorizontal webkit unit
+        test on 10.7
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        (EventHandler):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+
+2012-06-21  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: only increase length for timeline bars below minimal width
+        https://bugs.webkit.org/show_bug.cgi?id=89727
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineCalculator.prototype.setDisplayWindow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+
+2012-06-22  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: FormController.cpp fails to build on 32-bit architectures
+
+        This fixes the following build failure introduced in r121004 for
+        Bug 89628:
+
+            FormController.cpp:62:36: error: implicit conversion loses integer precision: 'uint64_t' (aka 'unsigned long long') to 'size_t' (aka 'unsigned long') [-Werror,-Wshorten-64-to-32]
+                state.m_values.reserveCapacity(valueSize);
+                ~~~~~                          ^~~~~~~~~
+
+        * html/FormController.cpp:
+        (WebCore::FormControlState::deserialize): Change type of
+        valueSize from uint64_t to size_t.
+
+2012-06-22  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in DragController::concludeEditDrag.
+        https://bugs.webkit.org/show_bug.cgi?id=89762
+
+        Reviewed by Ryosuke Niwa.
+
+        RefPtr the innerFrame since it can get destroyed due to mutation
+        event fired in DragController::dispatchTextInputEventFor().
+
+        Test: editing/pasteboard/drop-text-events-sideeffect-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+
+2012-06-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: timeline event details popup misses CPU time
+        https://bugs.webkit.org/show_bug.cgi?id=89765
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+
+2012-06-22  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
+        https://bugs.webkit.org/show_bug.cgi?id=88853
+
+        Reviewed by Steve Block.
+
+        The Android exclusions were necessary to fix a gyp generation error, as
+        the gcc_version variable wasn't being defined for Android. Remove these
+        exceptions when Chromium is able to define the gcc_version variable.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-06-22  Takashi Sakamoto  <tasak@google.com>
+
+        [Shadow] parentTreeScope() of nested shadow DOM subtree returns document().
+        https://bugs.webkit.org/show_bug.cgi?id=89172
+
+        Reviewed by Hajime Morita.
+
+        Added setParentTreeScope to set parent treescope of shadow root to be
+        host's treescope in ElementShadow::addShadowRoot.
+
+        Test: fast/dom/shadow/parent-tree-scope-in-shadow.html
+
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::addShadowRoot):
+        Added setParentTreeScope.
+        * testing/Internals.cpp:
+        (WebCore::Internals::parentTreeScope):
+        Newly added. This method returns a parent tree scope's root node of
+        a given node, because a tree scope's root node is either document node
+        or shadow root node and both nodes derive from TreeScope. So root nodes
+        are treated as TreeScope.
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+        Added parentTreeScope.
+
+2012-06-22  Tony Chang  <tony@chromium.org>
+
+        -webkit-flex-flow shouldn't be an enumerable property of the computed style
+        https://bugs.webkit.org/show_bug.cgi?id=89698
+
+        Reviewed by Ojan Vafai.
+
+        flex-flow is a shorthand for flex-direction and flex-wrap:
+        http://dev.w3.org/csswg/css3-flexbox/#flex-flow-property
+        Shorthand properties should not be enumerable in the computed style, although you can still
+        get the value from the computed style.
+
+        Tests: css3/flexbox/css-properties.html: New test case added.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+
+2012-06-22  Robert Kroeger  <rjkroege@chromium.org>
+
+        Suppress horizontal conversion of PlatformWheelEvents when hasPreciseScrollingDeltas is true
+        https://bugs.webkit.org/show_bug.cgi?id=89580
+
+        WebKit GTK and Chromium Linux force vertical wheel events to
+        scroll horizontally when over horizontal scroll bars.  This is
+        undesirable for touchpad scrolling with
+        hasPreciseScrollingDeltas() == true. Modified shouldTurnVerticalTicksIntoHorizontal
+        to not perform this conversion for PlatformWheelEvents with preciseScrollingDeltas.
+
+        Reviewed by Adam Barth.
+
+        Unit tests in EventHandlerTest.cpp
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal): 
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        (EventHandler):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+
+2012-06-22  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: partially instrument DOM Tree native memory.
+        https://bugs.webkit.org/show_bug.cgi?id=89568
+
+        This patch adds MemoryInstrumentation class that counts all visited
+        objects and calls reportMemoryUsage for the instrumented classes.
+
+        Reviewed by Yury Semikhatsky.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::reportMemoryUsage):
+        (ScriptWrappable):
+        * bindings/v8/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::reportMemoryUsage):
+        (ScriptWrappable):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::reportMemoryUsage):
+        (StylePropertySet):
+        * dom/ContainerNode.h:
+        (WebCore::ContainerNode::reportMemoryUsage):
+        (ContainerNode):
+        * dom/Element.h:
+        (WebCore::Element::reportMemoryUsage):
+        (Element):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+        (ElementAttributeData):
+        * dom/MemoryInstrumentation.h: Added.
+        (WebCore):
+        (MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::~MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::reportObject):
+        (WebCore::MemoryInstrumentation::reportPointer):
+        (MemoryObjectInfo):
+        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
+        (WebCore::MemoryObjectInfo::reportInstrumentedPointer):
+        (WebCore::MemoryObjectInfo::reportPointer):
+        (WebCore::MemoryObjectInfo::reportInstrumentedObject):
+        (WebCore::MemoryObjectInfo::reportObject):
+        (WebCore::MemoryObjectInfo::reportObjectInfo):
+        (WebCore::MemoryObjectInfo::objectType):
+        (WebCore::MemoryObjectInfo::objectSize):
+        (WebCore::MemoryInstrumentation::reportInstrumentedPointer):
+        (WebCore::MemoryInstrumentation::reportInstrumentedObject):
+        * dom/Node.cpp:
+        (WebCore::Node::reportMemoryUsage):
+        (WebCore):
+        * dom/Node.h:
+        (Node):
+        * dom/QualifiedName.h:
+        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
+        (WebCore::QualifiedName::reportMemoryUsage):
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::addMemoryBlockFor):
+        (WebCore::domTreeInfo):
+        (WebCore::memoryCacheInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::reportMemoryUsage):
+        (TreeShared):
+
+2012-06-22  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: Support 'Restart frame' in inspector frontend
+        https://bugs.webkit.org/show_bug.cgi?id=89678
+
+        Reviewed by Pavel Feldman.
+
+        Action is added to call frame placard's context menu. Context menu is now built
+        on a call frame level rather than on callback sidebar level.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.Placard):
+        (WebInspector.CallStackSidebarPane.Placard.prototype._update):
+        (WebInspector.CallStackSidebarPane.Placard.prototype._placardContextMenu):
+        (_restartFrame):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.rawLocationToUILocation):
+        (WebInspector.DebuggerModel.prototype.callStackModified):
+        (WebInspector.DebuggerModel.CallFrame.prototype.restart):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.editSource):
+
+2012-06-22  Jocelyn Turcotte  <turcotte.j@gmail.com>
+
+        [Qt] Fix the remote inspector loading problems on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89747
+
+        Reviewed by Simon Hausmann.
+
+        Make sure that the state of a SocketStreamHandle is set properly
+        when created from an existing QTcpSocket.
+
+        This fixes the inspectorserver Qt api auto test on Mac.
+
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+
+2012-06-22  Yoshifumi Inoue  <yosin@chromium.org>
+
+        REGRESSION(r117738):[Forms] validationMessage IDL attribute should not have range overflow message if value isn't range overflow
+        https://bugs.webkit.org/show_bug.cgi?id=89736
+
+        Reviewed by Kent Tamura.
+
+        Tests: fast/forms/date/input-date-validation-message.html
+               fast/forms/number/input-number-validation-message.html
+               fast/forms/range/input-range-validation-message.html
+
+        This patch changes comparison operator for range overflow message in
+        InputType::validationMessage().
+
+        * html/InputType.cpp:
+        (WebCore::InputType::validationMessage):
+
+2012-06-22  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add frontend-side Entry object to FileSystemModel
+        https://bugs.webkit.org/show_bug.cgi?id=89739
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype._fileSystemRootReceived):
+        (WebInspector.FileSystemModel.prototype.requestDirectoryContent):
+        (WebInspector.FileSystemModel.prototype._directoryContentReceived):
+        (WebInspector.FileSystemModel.FileSystem):
+        (WebInspector.FileSystemModel.Entry):
+        (WebInspector.FileSystemModel.Entry.prototype.get fileSystemModel):
+        (WebInspector.FileSystemModel.Entry.prototype.get fileSystem):
+        (WebInspector.FileSystemModel.Entry.prototype.get url):
+        (WebInspector.FileSystemModel.Entry.prototype.get name):
+        (WebInspector.FileSystemModel.Entry.prototype.get isDirectory):
+        (WebInspector.FileSystemModel.Directory):
+        (WebInspector.FileSystemModel.Directory.prototype.requestDirectoryContent):
+        (WebInspector.FileSystemModel.File):
+        (WebInspector.FileSystemModel.File.prototype.get mimeType):
+        (WebInspector.FileSystemModel.File.prototype.get resourceType):
+
+2012-06-22  Amy Ousterhout  <aousterh@chromium.org>
+
+        Renamed DeviceOrientation to DeviceOrientationData
+        https://bugs.webkit.org/show_bug.cgi?id=88663
+
+        Reviewed by Steve Block.
+
+        No new tests because this is simply a name change.
+
+        Renamed DeviceOrientation to DeviceOrientationData in order to be consistent with DeviceMotionData.
+        Updated all files that use DeviceOrientation.
+  
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDeviceOrientationEventCustom.cpp:
+        (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
+        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
+        (WebCore::V8DeviceOrientationEvent::initDeviceOrientationEventCallback):
+        * dom/DOMAllInOne.cpp:
+        * dom/DeviceOrientationClient.h:
+        (WebCore):
+        (DeviceOrientationClient):
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::timerFired):
+        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
+        * dom/DeviceOrientationController.h:
+        (WebCore):
+        (DeviceOrientationController):
+        * dom/DeviceOrientationData.cpp: Renamed from Source/WebCore/dom/DeviceOrientation.cpp.
+        (WebCore):
+        (WebCore::DeviceOrientationData::create):
+        (WebCore::DeviceOrientationData::DeviceOrientationData):
+        (WebCore::DeviceOrientationData::alpha):
+        (WebCore::DeviceOrientationData::beta):
+        (WebCore::DeviceOrientationData::gamma):
+        (WebCore::DeviceOrientationData::absolute):
+        (WebCore::DeviceOrientationData::canProvideAlpha):
+        (WebCore::DeviceOrientationData::canProvideBeta):
+        (WebCore::DeviceOrientationData::canProvideGamma):
+        (WebCore::DeviceOrientationData::canProvideAbsolute):
+        * dom/DeviceOrientationData.h: Renamed from Source/WebCore/dom/DeviceOrientation.h.
+        (WebCore):
+        (DeviceOrientationData):
+        * dom/DeviceOrientationEvent.cpp:
+        (WebCore::DeviceOrientationEvent::DeviceOrientationEvent):
+        (WebCore::DeviceOrientationEvent::initDeviceOrientationEvent):
+        * dom/DeviceOrientationEvent.h:
+        (WebCore):
+        (WebCore::DeviceOrientationEvent::create):
+        (DeviceOrientationEvent):
+        (WebCore::DeviceOrientationEvent::orientation):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyDeviceOrientationClient::lastOrientation):
+        * platform/mock/DeviceOrientationClientMock.cpp:
+        (WebCore::DeviceOrientationClientMock::setOrientation):
+        * platform/mock/DeviceOrientationClientMock.h:
+        (WebCore::DeviceOrientationClientMock::lastOrientation):
+        (DeviceOrientationClientMock):
+        * platform/qt/DeviceOrientationClientQt.cpp:
+        (DeviceOrientationClientQt):
+        * platform/qt/DeviceOrientationClientQt.h:
+        (DeviceOrientationClientQt):
+        * platform/qt/DeviceOrientationProviderQt.h:
+        (DeviceOrientationProviderQt):
+ 
+2012-06-21  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Support separate script compilation and execution.
+        https://bugs.webkit.org/show_bug.cgi?id=89646
+
+        Reviewed by Pavel Feldman.
+
+        Separate script compilation and run commands added to protocol and DebuggerAgent.
+        Separate script compilation and run implemented in v8 ScriptDebugServer, stubs added for js implementation.
+
+        Test: inspector/debugger/debugger-compile-and-run.html
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::compileScript):
+        (WebCore):
+        (WebCore::ScriptDebugServer::clearCompiledScripts):
+        (WebCore::ScriptDebugServer::runScript):
+        * bindings/js/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::supportsSeparateScriptCompilationAndExecution):
+        (ScriptDebugServer):
+        * bindings/v8/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::compileScript):
+        (WebCore):
+        (WebCore::PageScriptDebugServer::clearCompiledScripts):
+        (WebCore::PageScriptDebugServer::runScript):
+        * bindings/v8/PageScriptDebugServer.h:
+        (PageScriptDebugServer):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::compileScript):
+        (WebCore):
+        (WebCore::ScriptDebugServer::clearCompiledScripts):
+        (WebCore::ScriptDebugServer::runScript):
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore):
+        (WebCore::ScriptDebugServer::supportsSeparateScriptCompilationAndExecution):
+        (ScriptDebugServer):
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::supportsSeparateScriptCompilationAndExecution):
+        (WebCore):
+        (WebCore::InspectorDebuggerAgent::compileScript):
+        (WebCore::InspectorDebuggerAgent::runScript):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::injectedScriptManager):
+        * inspector/PageDebuggerAgent.cpp:
+        (WebCore::PageDebuggerAgent::injectedScriptForEval):
+        (WebCore):
+        * inspector/PageDebuggerAgent.h:
+        (PageDebuggerAgent):
+        * inspector/WorkerDebuggerAgent.cpp:
+        (WebCore::WorkerDebuggerAgent::injectedScriptForEval):
+        (WebCore):
+        * inspector/WorkerDebuggerAgent.h:
+        (WorkerDebuggerAgent):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector.doLoadedDone):
+
+2012-06-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: InspectorState::updateCookie should not do JSON serialization if unsupported
+        https://bugs.webkit.org/show_bug.cgi?id=89743
+
+        Since all InspectorClient's are InspectorStateClient's provide a
+        virtual accessor that determines whether or not InspectorClient updates
+        are supported or not.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::updateCookie):
+        Don't serialize and message the client if the client doesn't do anything with it.
+
+        * inspector/InspectorStateClient.h:
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::InspectorStateClient::supportsInspectorStateUpdates):
+        Let the client say whether or not supports updates or not.
+
+2012-06-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120982.
+        http://trac.webkit.org/changeset/120982
+        https://bugs.webkit.org/show_bug.cgi?id=89740
+
+        [chromium] ASSERTION FAILED:
+        m_allocatedTextureIds.contains(textureId) (Requested by ukai
+        on #webkit).
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::setVisible):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/TextureManager.cpp:
+        * platform/graphics/chromium/TextureManager.h:
+        (TextureAllocator):
+        (TextureManager):
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        * platform/graphics/chromium/TrackingTextureAllocator.h:
+        (TrackingTextureAllocator):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setNeedsForcedCommit):
+        (WebCore):
+        (WebCore::CCLayerTreeHost::setVisible):
+        (WebCore::CCLayerTreeHost::setContentsMemoryAllocationLimitBytes):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::commitComplete):
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::context):
+        (WebCore::CCLayerTreeHostImpl::setContentsMemoryAllocationLimitBytes):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (WebCore::CCLayerTreeHostImpl::sourceFrameCanBeDrawn):
+        (WebCore::CCLayerTreeHostImpl::setSourceFrameCanBeDrawn):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::beginFrameComplete):
+        (WebCore::CCScheduler::didSwapBuffersComplete):
+        (WebCore::CCScheduler::didLoseContext):
+        (WebCore::CCScheduler::didRecreateContext):
+        (WebCore::CCScheduler::vsyncTick):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (CCScheduler):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setNeedsForcedCommit):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread):
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::setNeedsForcedCommit):
+        (WebCore):
+        (WebCore::CCThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
+        (WebCore::CCThreadProxy::setContentsMemoryAllocationLimitBytes):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+        (BeginFrameAndCommitState):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::willDraw):
+        (WebCore::CCVideoLayerImpl::willDrawInternal):
+        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
+        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
+        (WebCore::CCVideoLayerImpl::allocatePlaneData):
+        (WebCore::CCVideoLayerImpl::freePlaneData):
+        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
+        (WebCore::CCVideoLayerImpl::didLoseContext):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (FramePlane):
+
+2012-06-21  Kent Tamura  <tkent@chromium.org>
+
+        Make FormControlState capable to store multiple values
+        https://bugs.webkit.org/show_bug.cgi?id=89628
+
+        Reviewed by Hajime Morita.
+
+        Make FormControlState capable to store multiple values in order to
+        clean FileInputType.cpp up and prepare to fix Bug 89623.
+
+        No new tests. This doesn't change web-exposed behavior, and
+        fast/forms/file/recover-file-input-in-unposted-form.html covers
+        major part of this change.
+
+        * html/FormController.cpp:
+        (WebCore::FormControlState::serializeTo): Support for two or more values.
+        (WebCore::FormControlState::deserialize): ditto.
+        (WebCore::formStateSignature):
+        Bump up the version because the state format for <input type=file> is changed.
+        * html/FormController.h:
+         - String m_value -> Vector<String> m_values
+         - Add some functions.
+         - Remove hasValue() and value().
+        (WebCore::FormControlState::FormControlState): m_value -> m_values.
+        (WebCore::FormControlState::valueSize): Added.
+        (WebCore::FormControlState::operator[]): Added.
+        (FormControlState): Add append() declaration, etc.
+        (WebCore::FormControlState::operator=): m_value -> m_values
+        (WebCore::FormControlState::append): Added.
+
+        * html/HTMLFormControlElementWithState.cpp:
+        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
+        Use valueSize() instead of hasValue().
+        * html/HTMLFormControlElementWithState.h:
+        (HTMLFormControlElementWithState): Update the comment.
+
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::saveFormControlState):
+        Use multiple value capability of FormControlState
+        (WebCore::FileInputType::restoreFormControlState): ditto.
+
+        * html/BaseCheckableInputType.cpp:
+        (WebCore::BaseCheckableInputType::restoreFormControlState): Use [0] instead of value().
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::restoreFormControlState): ditto.
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::restoreFormControlState): ditto.
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::restoreFormControlState): ditto.
+        * html/InputType.cpp:
+        (WebCore::InputType::restoreFormControlState): ditto.
+
+2012-06-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        LabelsNodeList isn't updated properly after its owner node is adopted into a new document
+        https://bugs.webkit.org/show_bug.cgi?id=89730
+
+        Reviewed by Darin Adler.
+
+        When a node is adopted, node lists that are invalidated at document level need to be unregistered
+        from old document and registered to new document so that DOM mutations in new document will invalidate
+        caches in the node lists. Done that in NodeListsNodeData::adoptTreeScope, which was extracted from
+        TreeScopeAdopter::moveTreeToNewScope.
+
+        Also renamed DynamicNodeList::node() and m_node to rootNode() and m_ownerNode to better express
+        their semantics and added ownerNode() to make m_ownerNode private to DynamicNodeList.
+
+        Test: fast/forms/label/labels-owner-node-adopted.html
+
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeListOwner::isReachableFromOpaqueRoots):
+        * dom/ChildNodeList.cpp:
+        (WebCore::ChildNodeList::~ChildNodeList):
+        (WebCore::ChildNodeList::length):
+        (WebCore::ChildNodeList::item):
+        (WebCore::ChildNodeList::nodeMatches):
+        * dom/ClassNodeList.cpp:
+        (WebCore::ClassNodeList::ClassNodeList):
+        (WebCore::ClassNodeList::~ClassNodeList):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicSubtreeNodeList::length):
+        (WebCore::DynamicSubtreeNodeList::itemForwardsFromCurrent):
+        (WebCore::DynamicSubtreeNodeList::itemBackwardsFromCurrent):
+        (WebCore::DynamicSubtreeNodeList::item):
+        (WebCore::DynamicNodeList::itemWithName):
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicNodeList::DynamicNodeList):
+        (WebCore::DynamicNodeList::ownerNode):
+        (WebCore::DynamicNodeList::rootedAtDocument):
+        (WebCore::DynamicNodeList::shouldInvalidateOnAttributeChange):
+        (WebCore::DynamicNodeList::rootNode):
+        (WebCore::DynamicNodeList::document):
+        (DynamicNodeList):
+        * dom/NameNodeList.cpp:
+        (WebCore::NameNodeList::~NameNodeList):
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::adoptTreeScope):
+        (NodeListsNodeData):
+        * dom/TagNodeList.cpp:
+        (WebCore::TagNodeList::~TagNodeList):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::~LabelsNodeList):
+        (WebCore::LabelsNodeList::nodeMatches):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::~RadioNodeList):
+        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):
+
+2012-06-21  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Properly display native memory sizes bigger than 2GB
+        https://bugs.webkit.org/show_bug.cgi?id=89661
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::jsHeapInfo):
+        (WebCore::inspectorData):
+        (WebCore::renderTreeInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+
+2012-06-21  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderBlock::layoutPositionedObjects.
+        https://bugs.webkit.org/show_bug.cgi?id=89599
+
+        Reviewed by Julien Chaffraix.
+
+        Test: fast/table/table-split-positioned-object-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitBlocks): no longer need to explicitly call
+        removePositionedObjects, since it is part of moveChildrenTo.
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::hasPositionedObjects): helper to tell if we have
+        positioned objects in our list.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::splitAnonymousBoxesAroundChild): Like r102263, this
+        condition was wrong and while moving children across completely different 
+        trees, we need fullRemoveInsert as true.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::moveChildTo): see code comment.
+        (WebCore::RenderBoxModelObject::moveChildrenTo): see code comment. 
+
+2012-06-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Make HTMLDocumentParser::create(DocumentFragment*,Element*, FragmentScriptingPermission) private.
+        https://bugs.webkit.org/show_bug.cgi?id=89724
+
+        Reviewed by Darin Adler.
+
+        It is used only by HTMLDocumentParser::parseDocumentFragment. No behavioral changes.
+
+        * html/parser/HTMLDocumentParser.h:
+        (WebCore::HTMLDocumentParser::create):
+        (HTMLDocumentParser):
+
+2012-06-21  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Use the empty plugin support on non-X11 and non-Windows platforms
+        https://bugs.webkit.org/show_bug.cgi?id=89501
+
+        Reviewed by Martin Robinson.
+
+        The GTK+ port doesn't currently support NPAPI plugins on platforms other
+        than X11 or Windows. Using PluginPackageNone and PluginViewNone makes it
+        easier to build it on other platforms and also allows us to drop some
+        ifdefs from PluginPackageGtk and PluginViewGtk.
+
+        * GNUmakefile.list.am:
+
+2012-06-21  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow][Editing] Assertion in VisibleSelection::adjuseSelectionToAvoidCrossingBoundaries() is triggered.
+        https://bugs.webkit.org/show_bug.cgi?id=89081
+
+        Reviewed by Ryosuke Niwa.
+
+        firstEditablePositionAfterPositionInRoot and lastEditablePositionBeforePositionInRoot did not
+        consider a case that an argument hiehestRoot can be in Shadow DOM. So when adjusting selection to
+        avoid crossing editing boundaries, VisiblePosition can break shadow boundaries, and it causes
+        an assertion trigger.
+
+        By this patch, firstEditablePositionAfterPositionInRoot and lastEditablePositionBeforePositionInRoot will
+        adjust position to the tree scope of highestRoot instead of its parent tree scope.
+
+        Test: editing/shadow/adjusting-editing-boundary-with-table-in-shadow.html
+
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+
+2012-06-21  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: exception in TimelinePresentationModel when recording timeline
+        https://bugs.webkit.org/show_bug.cgi?id=89716
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline.processRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.filteredRecords):
+        (WebInspector.TimelinePresentationModel.prototype.isVisible):
+
+2012-06-21  Oli Lan  <olilan@chromium.org>
+
+        Add methods to select between offsets in an editable field.
+        https://bugs.webkit.org/show_bug.cgi?id=89098
+
+        Reviewed by Ryosuke Niwa.
+
+        Reviewed by Ryosuke Niwa.
+
+        Adds a new method setSelectionOffsets to Editor. This selects between
+        the two integer offsets provided in the node currently being edited,
+        assuming the offsets are given relative to the rootEditableElement.
+        If no node or field is currently being edited, the method returns false.
+        
+        Test: a new test has been added to the chromium port's WebViewTest that
+        calls this via WebViewImpl::setSelectionEditableOffsets.
+        
+        * editing/Editor.cpp:
+        (WebCore::Editor::setSelectionOffsets):
+        (WebCore):
+        * editing/Editor.h:
+        (Editor):
+
+2012-06-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Add support for the grid and inline-grid display types.
+        https://bugs.webkit.org/show_bug.cgi?id=60732
+
+        Reviewed by Tony Chang.
+
+        Tests: fast/css-grid-layout/containing-block-grids-expected.html
+               fast/css-grid-layout/containing-block-grids.html
+               fast/css-grid-layout/floating-empty-grids-expected.html
+               fast/css-grid-layout/floating-empty-grids.html
+
+        Based on an earlier patch by David Hyatt <hyatt@apple.com>.
+
+        Added the first renderer for grid elements.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added RenderGrid files to the build systems.
+
+        * rendering/RenderGrid.cpp: Added.
+        (WebCore::RenderGrid::RenderGrid):
+        (WebCore::RenderGrid::~RenderGrid):
+        (WebCore::RenderGrid::layoutBlock):
+        (WebCore::RenderGrid::renderName):
+        * rendering/RenderGrid.h: Added.
+        (RenderGrid):
+        Skeleton renderer for now.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        Return our new RenderGrid for our 2 new |display| values.
+
+        * rendering/style/RenderStyle.h:
+        Added INLINE_GRID to the inline and replaced types.
+
+2012-06-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Clang build fix.
+
+        * dom/NodeRareData.h:
+
+2012-06-19  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRendererChromium is not getting visibility messages in single threaded compositing mode.
+        https://bugs.webkit.org/show_bug.cgi?id=89045
+
+        Reviewed by Adrienne Walker.
+
+        Based on patch by Michal Mocny <mmocny@google.com>.
+
+        Invariants:
+
+        1.) We never commit (paint, animate, any of it) when not visible on the main thread -except- for
+        compositeAndReadback, regardless of threaded vs non-threaded mode
+        2.) CCLayerTreeHost::m_contentsTextureManager's memory budget is only set by updateLayers() when we are going to
+        make a frame and is always set to a non-zero value
+        3.) Zero-sized allocations from the GPU process are always serviced immediately on the impl thread.  Non-zero
+        allocations are met in the next frame, whenever we would produce that frame according to our usual frame
+        scheduling logic.
+        4.) The impl thread always knows the set of currently-allocated managed texture IDs and can delete them all
+        whenever it likes without needing the main thread to be responsive.
+
+        Details:
+
+        There are two main changes - tweaking how the contents texture manager's budget is handled and tweaking frame
+        scheduling for the !visible case.
+
+        The scheduling change is a bit more subtle but it unifies the single and multi threaded paths and is really
+        important.  Except for compositeAndReadback (which I'll talk about below), we simply won't produce frames when
+        not visible.  This already happens in the single threaded path thanks to render_widget so the only change is to
+        the threaded path.  The difficulty here is we might post a beginFrame task from the impl thread and then get a
+        setVisible(false) call on the main thread before the beginFrame task runs.  Since I'm making the setVisible()
+        call a blocking call from main thread -> impl thread, when the beginFrame task eventually does run on the main
+        thread we can know that the impl thread's notion of visibility is in sync with the main threads.  Thus I'm
+        planning to simply abort the frame before doing any processing on the main thread.  The scheduler will know if
+        it gets a beginFrameAborted and COMMIT_STATE_IDLE.
+
+        compositeAndReadback is special - this call currently does come in when we aren't visible (in single and
+        threaded mode) and we need to service it.  In particular, we need to send a beginFrame over and have it
+        not be ignored on the main thread.  For this I'm thinking of having the proxy keep track of whether it's
+        servicing a compositeAndReadback() and use that bit on the main thread to know to process the beginFrame
+        normally.  On the impl side, we need a few changes.  First, we have to allocate a default framebuffer
+        (ensureFramebufferCHROMIUM) even if we've dropped it previously and remember to discard it after the
+        readPixels().  Second, we have to provide a non-zero contents texture allocation on the beginFrame message, and
+        again remember to delete the textures after the readPixels().  Third, we have to know that the beginFrame is a
+        forced frame so when we get the beginFrameComplete we go ahead with the rest of the frame.  For this, I think
+        I'll have to add ACTION_BEGIN_FORCED_FRAME and a corresponding COMMIT_STATE_FORCED_FRAME_IN_PROGRESS so the
+        scheduler can keep track of the magicness of this frame, and then add some logic after the readpixels call to
+        drop resources after the readback.  It's probably a good time to stop swapping on readbacks too....
+
+        The contents texture manager's budget is only relevant when we want to make a frame, so it's now passed in on
+        the updateLayers().  Since we only make frames when we are visible and we never have a zero allocation when
+        visible (thanks to the frame scheduling changes above), this value is always non-zero.  The other thing the
+        texture manager needs to know about is if we've killed all of the underlying textures from the impl thread -
+        this bit is passed in by the proxy before the updateLayers() call.  This means if we're running while visible
+        and the manager wants to decrease our budget to something other than zero, we'll get a new (non-zero) allocation
+        on the impl thread, schedule a frame, then when it's time to make the frame pass the new lower limit in to
+        updateLayers(), then have the contents texture manager evict down to our new limit and make a frame with the new
+        budget.  When the commit completes we'll get notified on the impl thread of which textures the contents texture
+        manager decided to evict and issue the deleteTexture() calls on them.
+
+        The texture budget we pass in will be based on the most recent non-zero memory allocation we received from the
+        GPU memory manager, or some default value I'll pull out my ass if we haven't heard anything yet.  On compositor
+        initialization, we can't afford to wait for a round-trip through the GPU process to get a budget for the first
+        frame.  I don't think handling a decrease to a non-zero budget on a visible tab needs to be terribly urgent - we
+        can get to it when we get to making the next frame.  If we wanted to satisfy reduced texture budgets directly
+        from the impl thread, we could keep a priority-list ordered set of textures once we have priorities and delete
+        based on that.  Let's worry about that later.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::setVisible):
+        (WebCore::LayerRendererChromium::setGpuMemoryAllocation):
+        (WebCore):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::evictAndRemoveAllDeletedTextures):
+        (WebCore):
+        * platform/graphics/chromium/TextureManager.h:
+        (TextureAllocator):
+        (TextureManager):
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        (WebCore):
+        (WebCore::TrackingTextureAllocator::deleteAllTextures):
+        * platform/graphics/chromium/TrackingTextureAllocator.h:
+        (TrackingTextureAllocator):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setVisible):
+        (WebCore::CCLayerTreeHost::evictAllContentTextures):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::commitComplete):
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::context):
+        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::setMemoryAllocationLimitBytes):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (WebCore::CCLayerTreeHostImpl::contentsTexturesWerePurgedSinceLastCommit):
+        (WebCore::CCLayerTreeHostImpl::memoryAllocationLimitBytes):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::beginFrameComplete):
+        (WebCore::CCScheduler::beginFrameAborted):
+        (WebCore):
+        (WebCore::CCScheduler::didSwapBuffersComplete):
+        (WebCore::CCScheduler::didLoseContext):
+        (WebCore::CCScheduler::didRecreateContext):
+        (WebCore::CCScheduler::vsyncTick):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (CCScheduler):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::beginFrameAborted):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setVisible):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::setVisible):
+        (WebCore):
+        (WebCore::CCThreadProxy::setVisibleOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::beginFrameAbortedOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+        (BeginFrameAndCommitState):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::willDraw):
+        (WebCore::CCVideoLayerImpl::willDrawInternal):
+        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
+        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
+        (WebCore::CCVideoLayerImpl::allocatePlaneData):
+        (WebCore::CCVideoLayerImpl::freePlaneData):
+        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
+        (WebCore::CCVideoLayerImpl::didLoseContext):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (FramePlane):
+
+2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Shrink NodeListsNodeData
+        https://bugs.webkit.org/show_bug.cgi?id=89036
+
+        Reviewed by Andreas Kling.
+
+        Replaced 6 hash maps of AtomicString, String, and RefPtr<QualifiedName::QualifiedNameImpl> and a raw pointer
+        by 3 hash maps of std::pair<unsigned short, AtomicString>, std::pair<unsigned short, String>, and QualifiedName,
+        to halve the NodeListsNodeData's size (Reduced from 7 pointers to 3 pointers). Made those hash maps private and
+        added addCacheWith* and removeCacheWith* member functions to reduce the code duplication.
+
+        Also got rid of removeCached*NodeList member functions from Node and Document now that DynamicSubtreeNodeList can
+        simply call nodeLists()->removeCacheWith* on m_node.
+
+        * dom/ChildNodeList.cpp:
+        (WebCore::ChildNodeList::ChildNodeList):
+        * dom/ClassNodeList.cpp:
+        (WebCore::ClassNodeList::~ClassNodeList):
+        * dom/Document.cpp:
+        (WebCore::Document::getItems): Use addCacheWithName.
+        * dom/Document.h: Got rid of removeCachedMicroDataItemList.
+        (Document):
+        * dom/DynamicNodeList.cpp:
+        (WebCore): Moved the constructor to the header file.
+        * dom/DynamicNodeList.h: Added NodeListType and InvalidationType to be used in NodeListsNodeData.
+        (WebCore::DynamicNodeList::DynamicNodeList): Takes the invalidation type.
+        (WebCore::DynamicNodeList::document): Added.
+        (WebCore::DynamicNodeList::shouldInvalidateOnAttributeChange): Added.
+        (WebCore::DynamicNodeList::Caches::Caches): Added shouldInvalidateOnAttributeChange to retain the invalidation type.
+        (Caches):
+        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
+        * dom/MicroDataItemList.cpp:
+        (WebCore::MicroDataItemList::~MicroDataItemList):
+        * dom/NameNodeList.cpp:
+        (WebCore::NameNodeList::NameNodeList):
+        (WebCore::NameNodeList::~NameNodeList):
+        (WebCore::NameNodeList::nodeMatches):
+        * dom/NameNodeList.h:
+        (WebCore):
+        (NameNodeList):
+        (WebCore::NameNodeList::create):
+        * dom/Node.cpp:
+        (WebCore::Node::nodeLists): Added so that node lists can directly call removeCacheWith*.
+        (WebCore::Node::getElementsByTagName):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::Node::radioNodeList):
+        (WebCore::NodeListsNodeData::invalidateCaches): Merged invalidateCachesThatDependOnAttributes. The function takes
+        the attribute name to avoid invalidating tag node lists when only attributes are modified. Also, now we have exactly
+        three hash maps to invalidate: m_atomicNameCaches, m_nameCaches, and m_tagNodeListCacheNS.
+        (WebCore): NodeListsNodeData::isEmpty is moved to NodeRareData.h.
+        * dom/Node.h:
+        (WebCore):
+        (Node):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (WebCore::NodeListsNodeData::addCacheWithAtomicName):
+        (WebCore::NodeListsNodeData::addCacheWithName):
+        (WebCore::NodeListsNodeData::addCacheWithQualifiedName):
+        (WebCore::NodeListsNodeData::removeCacheWithAtomicName):
+        (WebCore::NodeListsNodeData::removeCacheWithName):
+        (WebCore::NodeListsNodeData::removeCacheWithQualifiedName):
+        (WebCore::NodeListsNodeData::isEmpty): Moved from Node.cpp now that this function is much shorter.
+        (WebCore::NodeListsNodeData::NodeListsNodeData):
+        (WebCore::NodeListsNodeData::namedNodeListKey): Helper member functions to obtain the key for AtomicString and
+        String hash maps.
+        * dom/TagNodeList.cpp:
+        (WebCore::TagNodeList::TagNodeList):
+        (WebCore::TagNodeList::~TagNodeList):
+        (WebCore::HTMLTagNodeList::HTMLTagNodeList): Hard code namespaceURI = starAtom since other values are never used.
+        (WebCore::HTMLTagNodeList::nodeMatches): Given that, assert m_namespace == starAtom.
+        * dom/TagNodeList.h:
+        (WebCore::TagNodeList::create): Add a new version of create that doesn't take namespace (assume starAtom) so that
+        addCacheWithAtomicName works with this class.
+        (WebCore::HTMLTagNodeList::create): Removed namespaceURI from the argument list since it's always starAtom.
+        (HTMLTagNodeList):
+        * html/LabelableElement.cpp:
+        (WebCore::LabelableElement::labels):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::LabelsNodeList): Removed redundant m_forNode (identical to m_node in DynamicNodeList).
+        (WebCore::LabelsNodeList::~LabelsNodeList):
+        (WebCore::LabelsNodeList::nodeMatches):
+        * html/LabelsNodeList.h:
+        (WebCore::LabelsNodeList::create):
+        (LabelsNodeList):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::RadioNodeList): Removed redundant m_baseElement (identical to m_node in DynamicNodeList).
+        Also changed the first argument's type from Element* to Node* so that it works better with new template member
+        functions of NodeListsNodeData.
+        (WebCore::RadioNodeList::~RadioNodeList):
+        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):
+        * html/RadioNodeList.h:
+        (WebCore::RadioNodeList::create):
+        (RadioNodeList):
+
+2012-06-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120945.
+        http://trac.webkit.org/changeset/120945
+        https://bugs.webkit.org/show_bug.cgi?id=89703
+
+        editing/shadow/breaking-editing-boundaries.html started to
+        crash (Requested by hayato on #webkit).
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+
+2012-06-21  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] Use setGstElementClassMetadata.
+
+        Rubber/stamped by Martin Robinson.
+
+        This function was introduced in r120790 but I forgot to actually
+        use it in that patch.
+
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_class_init):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+
+2012-06-21  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Use v8::V8::AddImplicitReferences instead of SetHiddenValue
+        https://bugs.webkit.org/show_bug.cgi?id=80880
+
+        Reviewed by Adam Barth.
+
+        We used to add a hidden property in the getter to the returned wrapper.
+        With this patch we instead handle the liveness of the wrapper in the GC phase by
+        calling v8::V8::AddHiddenReference.
+
+        To reduce the amount of custom code we need, the V8 code generator now supports
+        GenerateIsReachable (as well as CustomIsReachable) which, even though different
+        from the JSC attribute, is used in the same cases and takes the same values (even though
+        at the moment not all JSC values are supported by V8). Interfaces that have *IsReachable
+        also have a dependent life time (just like if V8DependentLifetime was present).
+
+        No new tests. Covered by existing tests.
+
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GetGenerateIsReachable): Abstracted GenerateIsReachable and JSGenerateIsReachable.
+        (GetCustomIsReachable): Ditto.
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (NeedsToVisitDOMWrapper):
+        (GetGenerateIsReachable):
+        (GetCustomIsReachable):
+        (GenerateVisitDOMWrapper):
+        (GenerateHeader):
+        (GenerateNamedConstructorCallback):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (V8Float64Array):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (V8TestActiveDOMObject):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (V8TestCustomNamedGetter):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (V8TestEventConstructor):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (V8TestEventTarget):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (V8TestException):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (V8TestInterface):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (V8TestMediaQueryListListener):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (V8TestNamedConstructor):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNode.h:
+        (V8TestNode):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (V8TestSerializedScriptValueInterface):
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8TextTrackListCustom.cpp: Removed.
+        * css/CSSStyleSheet.idl:
+        * css/StyleSheet.idl:
+        * dom/DOMStringMap.idl:
+        * dom/NamedNodeMap.idl:
+        * html/DOMTokenList.idl:
+        * html/track/TextTrackList.idl:
+
+2012-06-21  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Implement spec behavior for multiEntry indexes with invalid/duplicate subkeys
+        https://bugs.webkit.org/show_bug.cgi?id=86123
+
+        Reviewed by Darin Fisher.
+
+        Distinguish between an actual invalid IDBKey, and an array of
+        possibly-invalid subkeys by making IDBKey::isValid() check subkeys
+        if the type is an array.
+
+        Introduce a new way to transform an IDBKey into a
+        multiEntry-specific IDBKey, (IDBKey::createMultiEntryArray)
+        throwing out duplicates and invalid keys. Use it when storing
+        index entries for multiEntry indexes.
+
+        No new tests: existing tests have been altered to include new behavior.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::continueFunction):
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::cmp):
+        * Modules/indexeddb/IDBIndex.cpp:
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * Modules/indexeddb/IDBKey.cpp:
+        (WebCore::IDBKey::isValid):
+        (WebCore):
+        * Modules/indexeddb/IDBKey.h:
+        (WebCore::IDBKey::createMultiEntryArray):
+        (IDBKey):
+        * Modules/indexeddb/IDBKeyRange.cpp:
+        (WebCore::IDBKeyRange::only):
+        (WebCore::IDBKeyRange::lowerBound):
+        (WebCore::IDBKeyRange::upperBound):
+        (WebCore::IDBKeyRange::bound):
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::putObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::putIndexDataForRecord):
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeIDBKey):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::get):
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromValue):
+
+2012-06-21  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Overlays when using the web inspector are blurry with device scale factor > 1
+        https://bugs.webkit.org/show_bug.cgi?id=89676
+
+        Reviewed by James Robinson.
+
+        Whenever we construct a GraphicsLayerChromium, make initialize the
+        device and page scale factors, if possible.
+
+        Unit test: GraphicsLayerChromiumTest.shouldStartWithCorrectContentsScale
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+
+2012-06-21  Philippe Normand  <pnormand@igalia.com>
+
+        [Qt] REGRESSION(r120790): broke video rendering
+        https://bugs.webkit.org/show_bug.cgi?id=89619
+
+        Reviewed by Alexis Menard.
+
+        Invert the pixel components of the Image on little endian architectures.
+
+        * platform/graphics/gstreamer/ImageGStreamerQt.cpp:
+        (ImageGStreamer::ImageGStreamer):
+
+2012-06-21  James Simonsen  <simonjam@chromium.org>
+
+        [Resource Timing] Implement Resource Timing interface
+        https://bugs.webkit.org/show_bug.cgi?id=61152
+
+        This patch implements the Resource Timing interface. It doesn't do anything
+        useful, because nothing populates the timeline yet. There are also some gaps
+        in the implementation, which have been filed as bugs.
+
+        http://dvcs.w3.org/hg/webperf/raw-file/tip/specs/ResourceTiming/Overview.html
+
+        Reviewed by Tony Gentilcore.
+
+        No new tests. Feature is disabled on all platforms.
+
+        * CMakeLists.txt:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/v8/custom/V8PerformanceEntryCustom.cpp:
+        (WebCore):
+        (WebCore::toV8): Support PerformanceEntry polymorphism.
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+        * page/Performance.cpp:
+        (WebCore::Performance::~Performance):
+        (WebCore):
+        (WebCore::Performance::interfaceName): Reqired for EventTarget.
+        (WebCore::Performance::scriptExecutionContext): Ditto.
+        (WebCore::Performance::webkitGetEntries): Return "resource" entries.
+        (WebCore::Performance::webkitGetEntriesByType): Ditto.
+        (WebCore::Performance::webkitGetEntriesByName): Ditto.
+        (WebCore::Performance::webkitClearResourceTimings): New.
+        (WebCore::Performance::webkitSetResourceTimingBufferSize): New. Unimplemented.
+        (WebCore::Performance::addResourceTiming): This is how resources in WebCore will report to the timeline.
+        (WebCore::Performance::eventTargetData): Required for EventTarget.
+        (WebCore::Performance::ensureEventTargetData): Ditto.
+        * page/Performance.h:
+        (Performance):
+        (WebCore::Performance::refEventTarget):
+        (WebCore::Performance::derefEventTarget):
+        * page/Performance.idl:
+        * page/PerformanceEntry.cpp:
+        (WebCore::PerformanceEntry::~PerformanceEntry):
+        (WebCore):
+        * page/PerformanceEntry.h:
+        (PerformanceEntry):
+        (WebCore::PerformanceEntry::isResource):
+        * page/PerformanceEntry.idl:
+        * page/PerformanceResourceTiming.cpp: Added.
+        (WebCore):
+        (WebCore::PerformanceResourceTiming::PerformanceResourceTiming):
+        (WebCore::PerformanceResourceTiming::initiatorType):
+        (WebCore::PerformanceResourceTiming::redirectStart):
+        (WebCore::PerformanceResourceTiming::redirectEnd):
+        (WebCore::PerformanceResourceTiming::fetchStart):
+        (WebCore::PerformanceResourceTiming::domainLookupStart):
+        (WebCore::PerformanceResourceTiming::domainLookupEnd):
+        (WebCore::PerformanceResourceTiming::connectStart):
+        (WebCore::PerformanceResourceTiming::connectEnd):
+        (WebCore::PerformanceResourceTiming::secureConnectionStart):
+        (WebCore::PerformanceResourceTiming::requestStart):
+        (WebCore::PerformanceResourceTiming::responseStart):
+        (WebCore::PerformanceResourceTiming::responseEnd):
+        (WebCore::PerformanceResourceTiming::monotonicTimeToDocumentMilliseconds):
+        (WebCore::PerformanceResourceTiming::resourceTimeToMilliseconds):
+        * page/PerformanceResourceTiming.h: Added.
+        (WebCore):
+        (PerformanceResourceTiming):
+        (WebCore::PerformanceResourceTiming::create):
+        (WebCore::PerformanceResourceTiming::isResource):
+        * page/PerformanceResourceTiming.idl: Added.
+
+2012-06-21  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Remove FIXMEs about whether events bubble and are cancelable
+        https://bugs.webkit.org/show_bug.cgi?id=89657
+
+        Reviewed by Adam Barth.
+
+        The spec has been updated to clarify that the events do not bubble and
+        are not cancelable.
+
+        No new tests, just removing comments.
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::didStartAudio):
+        * Modules/speech/SpeechRecognitionError.cpp:
+        (WebCore::SpeechRecognitionError::SpeechRecognitionError):
+
+2012-06-21  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [WebGL] Rename InjectedWebGLScriptSource.js -> InjectedScriptWebGLModuleSource.js
+        https://bugs.webkit.org/show_bug.cgi?id=89675
+
+        Reviewed by Pavel Feldman.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptWebGLModule.cpp:
+        (WebCore::InjectedScriptWebGLModule::source):
+        * inspector/InjectedScriptWebGLModuleSource.js: Renamed from Source/WebCore/inspector/InjectedWebGLScriptSource.js.
+        (.):
+
+2012-06-21  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Fix NPAPI plugins on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=54531
+
+        Reviewed by Martin Robinson.
+
+        Switch to using PluginPackageWin.cpp and PluginViewWin.cpp on Windows
+        platform, and leave plugins/gtk/ only for XP_UNIX platforms. With this
+        we can share a lot of code with other ports and don't have to
+        reimplement all the Windows-specific code in plugins/gtk/.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * platform/FileSystem.h:
+        (WebCore):
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (GraphicsContextPlatformPrivate):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (TransformationMatrix):
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore):
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::unloadModule):
+        * plugins/PluginView.h:
+        (PluginView):
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::snapshot):
+
+2012-06-21  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/11718988> and https://bugs.webkit.org/show_bug.cgi?id=89673
+        showModalDialog fix creates risk of never returning from RunLoop::performWork, potentially blocking other event sources
+
+        In case handling a function on the queue places additional functions on the queue, we should
+        limit the number of functions each invocation of performWork() performs so it can return and
+        other event sources have a chance to spin.
+
+        The showModalDialog fix in question is http://trac.webkit.org/changeset/120879
+
+        Reviewed by Darin Adler and Anders Carlson.
+
+        * platform/RunLoop.cpp:
+        (WebCore::RunLoop::performWork): If there are only N functions in the queue when performWork is called,
+          only handle up to N functions before returning. Any additional functions will be handled the next time
+          the runloop spins.
+
+2012-06-21  Tim Horton  <timothy_horton@apple.com>
+
+        SVGImageCache isn't invalidated for <img> on dynamic page scale changes
+        https://bugs.webkit.org/show_bug.cgi?id=89621
+        <rdar://problem/11714677>
+
+        Reviewed by Simon Fraser.
+
+        Previously, device and page scale factors were being cached as a part of the SVGImageCache's
+        size request. However, an <img> never has a reason to update its size request when the page
+        scale is changed via gesture zooming, as no layout occurs.
+
+        Instead, look up the relevant scales when the image is requested (which will occur during every
+        repaint), allowing page scale changes to take effect without requiring an updated size request.
+
+        Test: svg/as-image/image-respects-pageScaleFactor-change.html
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::lookupOrCreateImageForRenderer):
+        (WebCore::CachedImage::setContainerSizeForRenderer):
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):
+        * svg/graphics/SVGImageCache.h:
+        (WebCore::SVGImageCache::SizeAndScales::SizeAndScales):
+        (SizeAndScales):
+
+2012-06-21  Philip Rogers  <pdr@google.com>
+
+        Add pending resource even if others are pending
+        https://bugs.webkit.org/show_bug.cgi?id=89633
+
+        Reviewed by Dirk Schulze.
+
+        An element can have multiple simultaneous pending resources but some of
+        this code was legacy, before the hasPendingResource()->hasPendingResources()
+        change (r105573). This patch continues adding a pending resource even if
+        there are other pending resources. In some cases, this can lead to marking
+        a resource as pending twice but the performance impact of that is negligible.
+
+        Other than SVGUseElement, SVGTrefElement and SVGFEImageElement are also
+        changed. These elements are unaffected because they can only have
+        a single resource at the moment (href), with other Style url() references
+        being handled by their parent containers.
+
+        Tests: svg/custom/use-multiple-pending-resources-expected.svg
+               svg/custom/use-multiple-pending-resources.svg
+
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::buildPendingResource):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::detachTarget):
+        (WebCore::SVGTRefElement::buildPendingResource):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+
+2012-06-21  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Replace the use of "struct stat" with GStatBuf
+        https://bugs.webkit.org/show_bug.cgi?id=89488
+
+        Reviewed by Martin Robinson.
+
+        Make sure we pass GStatBuf to g_stat(); depending on the platform, it
+        isn't always the same as "struct stat", e.g. on Windows.
+
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+
+2012-06-21  Min Qin  <qinmin@chromium.org>
+
+        remove ENABLE_FULLSCREEN_MEDIA_CONTROL flag
+        https://bugs.webkit.org/show_bug.cgi?id=89614
+
+        Reviewed by Eric Carlson.
+
+        Desktop chromium also starts to use fullscreen button after https://bugs.webkit.org/show_bug.cgi?id=88818
+        we don't need this flag any more
+        No test needed as this change just removes a flag.
+
+        * html/shadow/MediaControlRootElementChromium.cpp:
+        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
+        (WebCore::MediaControlRootElementChromium::create):
+        (WebCore::MediaControlRootElementChromium::setMediaController):
+        (WebCore::MediaControlRootElementChromium::reset):
+        (WebCore::MediaControlRootElementChromium::reportedError):
+        * html/shadow/MediaControlRootElementChromium.h:
+        (MediaControlRootElementChromium):
+
+2012-06-21  Hayato Ito  <hayato@chromium.org>
+
+        Modify event re-targeting algorithm so that we can tell which distributed node is clicked.
+        https://bugs.webkit.org/show_bug.cgi?id=89073
+
+        Reviewed by Dimitri Glazkov.
+
+        Adopt a new event re-targeting algorithm in the latest Shadow DOM spec.
+        The corresponding bug in the shadow DOM spec is:
+        https://www.w3.org/Bugs/Public/show_bug.cgi?id=17090
+
+        This change is introduced to handle the following use case:
+        1. There is an insertion point, with zero or more nodes distributed into it.
+        2. User clicks on one of the items.
+        3. The event handler in shadow DOM subtree wants to know which item was clicked on.
+
+        The new re-targeting algorithm sets an event's target to a
+        distributed node where an event was originally fired, instead of
+        an insertion point to where the node is distributed.
+
+        The similar re-targeting algorithm also applies to an event's
+        relatedTarget.
+
+        Test: fast/dom/shadow/shadow-dom-event-dispatching.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+
+2012-06-21  Andrei Onea  <onea@adobe.com>
+
+        [CSSRegions]Change WEBKIT_REGION_RULE value to 16
+        https://bugs.webkit.org/show_bug.cgi?id=89421
+
+        Reviewed by Tony Chang.
+
+        Modified WEBKIT_REGION_RULE where applicable to match CSS Regions spec.
+        The new value for WEBKIT_REGION_RULE is 16 (was 10).
+
+        * css/CSSRule.cpp:
+        (WebCore):
+        Added COMPILE_ASSERT to ensure StyleRule::Region and CSSRule::WEBKIT_REGION_RULE will
+        * css/CSSRule.h:
+        (CSSRule):
+        Modified m_type bitfield length to 5
+        * css/CSSRule.idl:
+        * css/StyleRule.cpp:
+        (SameSizeAsStyleRuleBase):
+        (WebCore):
+        Added COMPILE_ASSERT to ensure that StyleRuleBase will always have exactly 32bits.
+        * css/StyleRule.h:
+        (StyleRuleBase):
+        Modified m_type bitfield to 5 to accommodate the new value, and modified
+        m_sourceLine bitfield to 27 bits in order to keep StyleRule 32
+        bits long. Consequently, any css rule longer than 67,108,863 lines will
+        cause overflow - however, the value is large enough not to cause
+        problems.
+
+2012-06-21  Silvia Pfeiffer  <silviapf@chromium.org>
+
+        Paint played and buffered ranges differently in Chrome video controls.
+        https://bugs.webkit.org/show_bug.cgi?id=89284
+
+        Reviewed by Eric Carlson.
+
+        No new tests; existing video control tests cover this case.
+
+        The Chrome video controls are receiving a visual update. This patch changes
+        the format in which the playback position slider displays the buffered range.
+        It is painted in a lighter color left of the position thumb and darker right
+        of the position thumb
+
+        * css/mediaControlsChromium.css:
+        (input[type="range"]::-webkit-media-slider-container):
+        Adjust the border color of the playback position slider.
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintRoundedSliderBackground):
+        Adjust the background color of the position slider.
+        (WebCore::paintSliderRangeHighlight):
+        Make the color of the range region a function parameter,
+        provide start and end position as pixel width instead of percentage,
+        and make sure the rounded corners at beginning and end don't turn into rectangles.
+        (WebCore):
+        Move the mediaSliderThumbWidth variable up to be used in paintMediaSlider().
+        (WebCore::paintMediaSlider):
+        Calculate start, current and end position instead of fractions,
+        adjust the current position by half the thumb's width for improved rendering,
+        and draw two highlight areas: one bright one before current position and
+        one grey one after current position.
+        (WebCore::paintMediaVolumeSlider):
+        Adjust the paintSliderRangeHighlight function call and add the colors.
+
+2012-06-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unused static variable uninitializedLineNumberValue.
+        https://bugs.webkit.org/show_bug.cgi?id=89643
+
+        Reviewed by Alexey Proskuryakov.
+
+        No behavioral changes.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore):
+
+2012-06-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unused static function skipComment.
+        https://bugs.webkit.org/show_bug.cgi?id=89641
+
+        Reviewed by Alexey Proskuryakov.
+
+        No behavioral changes.
+
+        * loader/TextResourceDecoder.cpp:
+
+2012-06-21  Nico Weber  <thakis@chromium.org>
+
+        Remove two more member variables found by clang's Wunused-private-field
+        https://bugs.webkit.org/show_bug.cgi?id=89672
+
+        Reviewed by Anders Carlsson.
+
+        * html/shadow/MediaControlRootElementChromium.h:
+        (MediaControlRootElementChromium):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter):
+        * platform/graphics/filters/FECustomFilter.h:
+        (FECustomFilter):
+
+2012-06-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Non-fixed length margins don't work with align=center
+        https://bugs.webkit.org/show_bug.cgi?id=89626
+
+        Reviewed by Levi Weintraub.
+
+        Tests: fast/block/negative-start-margin-align-center-percent.html
+               fast/block/positive-margin-block-child-align-center-calc.html
+
+        Calling Length::value() is a bad idea as it returns the *raw* value of
+        the length. For percent and calculated length this is a bad idea as they
+        bear not relation to the actual computed length.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+        Fixed the code to use minimumValueForLength as this nicely takes care of the 'auto' case.
+
+2012-06-21  Robert Kroeger  <rjkroege@chromium.org>
+
+        [chromium] style improvement for setDeviceScaleFactor code
+        https://bugs.webkit.org/show_bug.cgi?id=89665
+
+        Correct a coding style error committed in https://bugs.webkit.org/show_bug.cgi?id=88916
+
+        Reviewed by Adrienne Walker.
+
+        Purely code hygiene: existing tests suffice.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::setDeviceScaleFactor):
+
+2012-06-21  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Crash][Editing] Pressing enter on LI element triggers assertion in Shadow DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=89171
+
+        Reviewed by Ryosuke Niwa.
+
+        Since modidying Shadow DOM removes renderer of elements in Shadow DOM and shadow host,
+        assertion to check the existence of renderer was triggered.
+
+        We should update layout here to create renderer again.
+
+        Test: editing/shadow/pressing-enter-on-list.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::appendBlockPlaceholder):
+
+2012-06-21  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [WebGL] Add injected WebGL module class
+        https://bugs.webkit.org/show_bug.cgi?id=89592
+
+        Reviewed by Pavel Feldman.
+
+        Adding a new InjectedScriptWebGLModule class and moving WebGL-related
+        stuff out of InjectedScriptManager class.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptManager.cpp:
+        * inspector/InjectedScriptManager.h:
+        (InjectedScriptManager):
+        * inspector/InjectedScriptModule.cpp:
+        (WebCore::InjectedScriptModule::ensureInjected):
+        * inspector/InjectedScriptModule.h:
+        (InjectedScriptModule):
+        * inspector/InjectedScriptWebGLModule.cpp: Copied from Source/WebCore/inspector/InjectedScriptModule.cpp.
+        (WebCore):
+        (WebCore::InjectedScriptWebGLModule::InjectedScriptWebGLModule):
+        (WebCore::InjectedScriptWebGLModule::moduleForState):
+        (WebCore::InjectedScriptWebGLModule::source):
+        (WebCore::InjectedScriptWebGLModule::wrapWebGLContext):
+        (WebCore::InjectedScriptWebGLModule::captureFrame):
+        * inspector/InjectedScriptWebGLModule.h: Copied from Source/WebCore/inspector/InjectedScriptModule.h.
+        (WebCore):
+        (InjectedScriptWebGLModule):
+        * inspector/InspectorWebGLAgent.cpp:
+        (WebCore::InspectorWebGLAgent::wrapWebGLRenderingContextForInstrumentation):
+
+2012-06-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: do not add separator to the end of the context menu.
+        https://bugs.webkit.org/show_bug.cgi?id=89634
+
+        Reviewed by Vsevolod Vlasov.
+
+        Attaching separators only before menu items now.
+
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextSubMenuItem.prototype.appendItem):
+        (WebInspector.ContextSubMenuItem.prototype.appendSubMenuItem):
+        (WebInspector.ContextSubMenuItem.prototype.appendCheckboxItem):
+        (WebInspector.ContextSubMenuItem.prototype.appendSeparator):
+        (WebInspector.ContextSubMenuItem.prototype._pushItem):
+
+2012-06-21  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Unify FileSystem callbacks
+        https://bugs.webkit.org/show_bug.cgi?id=89420
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+
+2012-06-20  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: SpeechRecognition should hook up with ActiveDOMObject more
+        https://bugs.webkit.org/show_bug.cgi?id=89217
+
+        Reviewed by Adam Barth.
+
+        Previously, the SpeechRecognition was kept alive while waiting for
+        pending events by making the embedder hold a reference to the object.
+        We should do this by using ActiveDOMObject's setPendingActivity() instead.
+
+        Also, override ActiveDOMObject::stop() to get notified when the user
+        leaves the page.
+
+        Test: fast/speech/scripted/navigate-away.html
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::start):
+        (WebCore::SpeechRecognition::didEnd):
+        (WebCore::SpeechRecognition::stop):
+        (WebCore):
+        * Modules/speech/SpeechRecognition.h:
+        (SpeechRecognition):
+
+2012-06-21  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Move requestId allocation from FileSystem frontend to backend
+        https://bugs.webkit.org/show_bug.cgi?id=89555
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: http/tests/inspector/filesystem/get-filesystem-root.html:
+              http/tests/inspector/filesystem/read-directory.html:
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorFileSystemAgent::requestFileSystemRoot):
+        (WebCore::InspectorFileSystemAgent::requestDirectoryContent):
+        (WebCore::InspectorFileSystemAgent::InspectorFileSystemAgent):
+        * inspector/InspectorFileSystemAgent.h:
+        (InspectorFileSystemAgent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype._originAdded):
+        (WebInspector.FileSystemModel.prototype._fileSystemRootReceived):
+        (WebInspector.FileSystemRequestManager):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot):
+        (WebInspector.FileSystemRequestManager.prototype._fileSystemRootReceived):
+        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent):
+        (WebInspector.FileSystemRequestManager.prototype._directoryContentReceived):
+        (WebInspector.FileSystemDispatcher.prototype.fileSystemRootReceived):
+        (WebInspector.FileSystemDispatcher.prototype.directoryContentReceived):
+
+2012-06-20  Arnaud Renevier  <arno@renevier.net>
+
+        [cairo] improve putByteArray speed by avoiding max/min checks at Color construction.
+        https://bugs.webkit.org/show_bug.cgi?id=89138
+
+        Reviewed by Adam Barth.
+
+        Color constructor accepts integer arguments and checks if they are
+        between 0 and 255. In some cases, we already known those numbers to be
+        within those boundaries. For example when using unsigned chars. So
+        this patch introduces Color::createUnChecked which return a Color
+        object without checking for boundaries.
+
+        No new tests: no behaviour change
+
+        * platform/graphics/Color.cpp:
+        (WebCore::colorFromPremultipliedARGB):
+        * platform/graphics/Color.h:
+        (WebCore::Color::createUnCheked):
+        (Color):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::putByteArray):
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Damage tracker is not used without partial swap, causing valid render passes to be removed
+        https://bugs.webkit.org/show_bug.cgi?id=89589
+
+        Reviewed by Adrienne Walker.
+
+        When not using partial swap, the CCDamageTracker was not used, and
+        its m_currentDamageRect was always empty. As a result,
+        CCLayerTreeHostImpl was thinking no content was changed and was
+        removing more textures than needed. Fixed this by turning on
+        CCDamageTracker usage even if not using partial swap, but
+        overwriting the rootScissorRect with viewport rect if required.
+
+        Added unit tests to exercise this scenario.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+
+2012-06-20  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make step action of SpinButtonElement replaceable
+        https://bugs.webkit.org/show_bug.cgi?id=89439
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces SpinButtonElement::Callback to specify step
+        action by control clients for using SpinButtonElement by
+        TextFieldInputType and future version of TimeInputField.
+
+        In addition to this improving flexibility of SpinButtonElement, we
+        free HTMLInputElement from SpinButtonElement dependency on
+        stepUpFromRenderer.
+
+        No new tests. This patch doesn't change behavior.
+
+        * html/HTMLInputElement.cpp: Removed stepUpFromRenderer().
+        * html/HTMLInputElement.h: Removed stepUpFromRenderer().
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::~TextFieldInputType): Added to call SpinButtonElement::removeStepActionHandler.
+        (WebCore::TextFieldInputType::handleKeydownEventForSpinButton): Changed to call spinButtonStep{Down,Up}
+        (WebCore::TextFieldInputType::handleWheelEventForSpinButton): Changed to call spinButtonStep{Down,Up}
+        (WebCore::TextFieldInputType::createShadowSubtree): Added SpinButtonElement::StepActionHandler parameter.
+        (WebCore::TextFieldInputType::destroyShadowSubtree): Added to call SpinButtonElement::removeStepActionHandler.
+        (WebCore::TextFieldInputType::spinButtonStepDown): Added for implementation of SpinButtonElement::StepActionHandler.
+        (WebCore::TextFieldInputType::spinButtonStepUp): Added for implementation of SpinButtonElement::StepActionHandler.
+        * html/TextFieldInputType.h:
+        (TextFieldInputType):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SpinButtonElement::SpinButtonElement): Added StepActionHandler parameter.
+        (WebCore::SpinButtonElement::defaultEventHandler): Changed to call doStepAction.
+        (WebCore::SpinButtonElement::doStepAction): Added to call StepActionHandler if possible.
+        (WebCore::SpinButtonElement::step): Changed to call doStepAction.
+        * html/shadow/TextControlInnerElements.h:
+        (StepActionHandler): Added.
+
+2012-06-20  Adrienne Walker  <enne@google.com>
+
+        [chromium] Modify CCDamageTracker hash to allow for layer id 0
+        https://bugs.webkit.org/show_bug.cgi?id=89631
+
+        Reviewed by James Robinson.
+
+        HashMap has the bizarre property that 0 is the empty value for integer
+        keys. Modify the damage tracking HashMap to use negative values for
+        both the empty and the deleted key traits. Additionally, make sure we
+        never generate negative layer IDs in practice.
+
+        Test: passes webkit_unit_tests with the patch in bug 89589 applied.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        * platform/graphics/chromium/cc/CCDamageTracker.h:
+        (RectMapKeyTraits):
+        (WebCore::CCDamageTracker::RectMapKeyTraits::emptyValue):
+        (WebCore::CCDamageTracker::RectMapKeyTraits::constructDeletedValue):
+        (WebCore::CCDamageTracker::RectMapKeyTraits::isDeletedValue):
+        (CCDamageTracker):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+
+2012-06-20  Adam Klein  <adamk@chromium.org>
+
+        Use Dictionary in MutationObserver.observe to kill custom code
+        https://bugs.webkit.org/show_bug.cgi?id=89629
+
+        Reviewed by Ryosuke Niwa.
+
+        Move code for dictionary parsing in MutationObserver.observe
+        that used to be duplicated (with different implementations)
+        in JSC and V8 bindings into WebKitMutationObserver.cpp, using
+        the new Dictionary interface.
+
+        No new tests, no change in behavior.
+
+        * bindings/js/JSWebKitMutationObserverCustom.cpp:
+        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
+        * dom/WebKitMutationObserver.cpp:
+        (WebCore::WebKitMutationObserver::observe):
+        * dom/WebKitMutationObserver.h:
+        (WebCore):
+        * dom/WebKitMutationObserver.idl:
+
+2012-06-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120889.
+        http://trac.webkit.org/changeset/120889
+        https://bugs.webkit.org/show_bug.cgi?id=89630
+
+        [Chromium] webkit_unit_tests didDrawNotCalledOnHiddenLayer
+        start failing (Requested by ukai on #webkit).
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+
+2012-06-20  Hayato Ito  <hayato@chromium.org>
+
+        [Shadow][Editing] Deleting character in distributed element caused a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=88484
+
+        Reviewed by Ryosuke Niwa.
+
+        If we mutate nodes which are children of a shadow host, it causes
+        ElementShadow::invalidateDistribution().  As a result, shadow host
+        is detached (and lazyAttached()) and its renderer is gone.  That
+        causes assertion error since isEditablePosition() assumes
+        anchorNode's style was correctly calculated.
+
+        This patch makes isEditablePosition() call
+        document->updateLayoutIgnorePendingStylesheets() so that it does
+        not return a bogus result.
+
+        There is an exceptional caller of isEditablePosition,
+        RenderBlock::paintCaret(), from where we can not call
+        updateLayout() in isEditablePosition because it hits assertion,
+        ASSERT(!isPainting). So I've added the third parameter to
+        isEditablePosition to control updating the style.
+
+        Test: edition/shadow/delete-characters-in-distributed-node.html
+
+        * editing/FrameSelection.h:
+        (WebCore::FrameSelection::rendererIsEditable):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::rendererIsEditable):
+        (WebCore):
+        * editing/VisibleSelection.h:
+        (VisibleSelection):
+        * editing/htmlediting.cpp:
+        (WebCore::isEditablePosition):
+        * editing/htmlediting.h:
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret):
+
+2012-06-20  Kent Tamura  <tkent@chromium.org>
+
+        Unmodified form control value are overwritten by another form
+        control value with the same name after navigating and going back
+        https://bugs.webkit.org/show_bug.cgi?id=89409
+
+        Reviewed by Hajime Morita.
+
+        Detail of the bug:
+        If a page had multiple form controls of which names and types were
+        identical like the following:
+          <input type=text name=name1 id=input1>
+          <input type=text name=name1 id=input2>
+        and a user updated the value of the second control, then went to
+        another page and went back to the page again, we restored the updated
+        value to the first element, and didn't update the second element.
+
+        We didn't save unmodified control state, and the form state data
+        had no ways to represent "this control should be skipped".
+
+        How to resovle the bug:
+        We need to represent "this control should be skipped" in the
+        seriazlied form state vector.
+
+        - A serialized control state had three items:
+                name, type, value.
+          Now we change it to:
+                name, type, flag, optional value
+
+        - It is definitely incompatible with serizlized state produced by
+        older WebCore. So, we need to add the signature string to
+        represent the version of serialized state format.
+
+        - Because the state for a form control is variable-length and we
+        can't deserialize it in reverse-order, we change the on-memory
+        representation from Vector<> to Deque<>.
+
+        Test: fast/forms/state-restore-to-non-edited-controls.html
+
+        * html/FormController.cpp:
+        (WebCore::FormControlState::serializeTo):
+        Added. Serialize a state for a form control to a string vector.
+        (WebCore::FormControlState::deserialize):
+        Added. Produce a FormControlState object from the specified string vector.
+        It can produce a FromControlState of the failure type.
+        (WebCore::formStateSignature): The signature string of the serialized state.
+        (WebCore::FormController::formElementsState):
+         - Capacity:
+          The size of seirlized data for one form control is typically 4.
+          +1 for the signature.
+         - We need to store a FormControlState with no values.
+        (WebCore::FormController::setStateForNewFormElements):
+         - We can't iterate over the stateVector in reverse order any more
+           because serialized control state is variable-length.
+         - We put FormControlState objects to HashMap instead of String objects.
+        (WebCore::FormController::takeStateForFormElement):
+         Updated for Deque<>.
+        * html/FormController.h:
+        (FormControlState): Declare deserialize() and serializeTo().
+        (WebCore::FormControlState::isFailure): Added.
+        (WebCore::FormControlState::FormControlState):
+        Added to create a FormControlState with failure type.
+        (FormController):
+        Change the value type of m_stateForNewFormElements from Vector<String>
+        to Deque<FormControlState>.
+
+2012-06-20  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Rename CustomFilterShader class name to CustomFilterCompiledProgram
+        https://bugs.webkit.org/show_bug.cgi?id=89578
+
+        Reviewed by Dean Jackson.
+
+        I've renamed CustomFilterShader to CustomFilterCompiledProgram to make it obvious that it is the result of 
+        calling CustomFilterProgram::compileProgramWithContext.
+
+        No new tests, just renamed an existing class.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/CustomFilterCompiledProgram.cpp: Renamed from Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp.
+        (WebCore):
+        (WebCore::CustomFilterCompiledProgram::defaultVertexShaderString):
+        (WebCore::CustomFilterCompiledProgram::defaultFragmentShaderString):
+        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
+        (WebCore::CustomFilterCompiledProgram::compileShader):
+        (WebCore::CustomFilterCompiledProgram::linkProgram):
+        (WebCore::CustomFilterCompiledProgram::initializeParameterLocations):
+        (WebCore::CustomFilterCompiledProgram::uniformLocationByName):
+        (WebCore::CustomFilterCompiledProgram::~CustomFilterCompiledProgram):
+        * platform/graphics/filters/CustomFilterCompiledProgram.h: Renamed from Source/WebCore/platform/graphics/filters/CustomFilterShader.h.
+        (WebCore):
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore::CustomFilterProgram::compileProgramWithContext): Renamed method from createShaderWithContext to compileProgramWithContext.
+        * platform/graphics/filters/CustomFilterProgram.h:
+        (WebCore):
+        * platform/graphics/filters/FECustomFilter.cpp: Renamed m_shader to m_compiledProgram.
+        (WebCore::FECustomFilter::platformApplySoftware):
+        (WebCore::FECustomFilter::initializeContext):
+        (WebCore::FECustomFilter::bindProgramParameters):
+        (WebCore::FECustomFilter::bindProgramAndBuffers):
+        * platform/graphics/filters/FECustomFilter.h:
+        (WebCore):
+        (FECustomFilter):
+
+2012-06-19  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: reduce timeline refresh rate
+        https://bugs.webkit.org/show_bug.cgi?id=89548
+
+        Reviewed by Pavel Feldman.
+
+        Minimize resource contention with the inspected page during refresh:
+
+        - reduce refresh for both overview and main panes to 300ms
+        - automatically limit window size to approximately one pageful of events in the lower pane
+        - do not refresh lower pane for events that are outside of the window
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._update):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        (WebInspector.TimelineOverviewPane.prototype.setWindowTimes): Set overview window by times.
+        (WebInspector.TimelineOverviewPane.prototype._updateWindow):
+        (WebInspector.TimelineOverviewPane.prototype._scheduleRefresh): Refresh once in 300ms (insted of once in 100ms).
+        (WebInspector.TimelineOverviewWindow.prototype._setWindow):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded): Do not refresh if the new record is outside of window.
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh): Refresh rate: 100ms -> 300ms.
+        (WebInspector.TimelinePanel.prototype._refreshRecords): Automatically set overview window.
+        * inspector/front-end/TimelinePresentationModel.js: Expose filterRecords
+        (WebInspector.TimelinePresentationModel.prototype.filteredRecords):
+        (WebInspector.TimelinePresentationModel.prototype.filterRecords):
+        (WebInspector.TimelinePresentationModel.prototype._innerFilterRecords):
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Damage tracker is not used without partial swap, causing valid render passes to be removed
+        https://bugs.webkit.org/show_bug.cgi?id=89589
+
+        Reviewed by Adrienne Walker.
+
+        When not using partial swap, the CCDamageTracker was not used, and
+        its m_currentDamageRect was always empty. As a result,
+        CCLayerTreeHostImpl was thinking no content was changed and was
+        removing more textures than needed. Fixed this by turning on
+        CCDamageTracker usage even if not using partial swap, but
+        overwriting the rootScissorRect with viewport rect if required.
+
+        Added unit tests to exercise this scenario.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+
+2012-06-20  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove redundant IDBObjectStore.delete() overloads
+        https://bugs.webkit.org/show_bug.cgi?id=89587
+
+        Reviewed by Darin Fisher.
+
+        The IDBObjectStore.delete(IDBKey) overload can delegate to the delete(IDBKeyRange)
+        overload. Also cleaned up redundant checks in related overloads.
+
+        Test: storage/indexeddb/deleted-objects.html
+
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::deleteFunction): Call keyRange variant instead.
+        * Modules/indexeddb/IDBIndex.cpp:
+        (WebCore::IDBIndex::get): Remove redundant deleted/invalid IDBKey checks.
+        (WebCore::IDBIndex::getKey): Remove redundant deleted/invalid IDBKey checks.
+        * Modules/indexeddb/IDBKeyRange.cpp: Null IDBKeys are not acceptable; currently
+        not passed in by any callers.
+        (WebCore::IDBKeyRange::only):
+        (WebCore::IDBKeyRange::lowerBound):
+        (WebCore::IDBKeyRange::upperBound):
+        (WebCore::IDBKeyRange::bound):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::get): Was missing deleted check in IDBKeyRange overload.
+        Removed redundant checks in IDBKey overload.
+        (WebCore::IDBObjectStore::deleteFunction): Delegate to IDBKeyRange overload.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Remove IDBKey overload.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h: Remove IDBKey overload.
+        (IDBObjectStoreBackendImpl):
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Remove IDBKey overload.
+
+2012-06-20  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow][Editing] Selection will break editing boundaries in Shadow DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=89075
+
+        Reviewed by Antti Koivisto.
+
+        At the shadow boundary, some styles (e.g. user-modify, text-decoration) cannot be inherited
+        from the shadow host. However, when style property cache is used, such styles are wrongly
+        inherited from the cache.
+
+        So this patch makes not to use cache for inehrited styles at the shadow boundary.
+
+        Tests: editing/shadow/breaking-editing-boundary-with-table.html
+               editing/shadow/contenteditable-propagation-at-shadow-boundary.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-20  Garret Kelly  <gdk@chromium.org>
+
+        Moving cookieEnabled/setCookieEnabled from Page to Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=89545
+
+        Reviewed by Adam Barth.
+
+        * dom/Document.cpp:
+        (WebCore::Document::cookie):
+        (WebCore::Document::setCookie):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::cookieEnabled):
+        * page/Page.h:
+        (Page):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setCookieEnabled):
+        (WebCore::Settings::cookieEnabled):
+        (Settings):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::setUpCookiesForQuickTime):
+
+2012-06-20  Adam Barth  <abarth@webkit.org>
+
+        internals.settings.setDeviceScaleFactor doesn't work for WebKit2 and must be removed
+        https://bugs.webkit.org/show_bug.cgi?id=89274
+
+        Reviewed by James Robinson.
+
+        Using this window.internals API causes the apple-mac port to ASSERT in
+        WebKit2 because WebKit2 keeps a copy of this state in the UI process.
+        When a test uses this internals API, the WebCore state gets out of sync
+        with the state in the UI process.
+
+        Tests should use setBackingScaleFactor instead.
+
+        * testing/InternalSettings.cpp:
+        (WebCore):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-06-20  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: persist timeline panel overview mode
+        https://bugs.webkit.org/show_bug.cgi?id=88711
+
+        Reviewed by Pavel Feldman.
+
+        - replace all internal methods of switching to a new mode of TimelineOverviewPane with setMode();
+        - make current mode a persistent setting;
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.setMode):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+
+2012-06-20  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/11653784> and https://bugs.webkit.org/show_bug.cgi?id=89590
+        showModalDialog message handling is flaky in WebKit2
+
+        Because RunLoop::performWork() swaps the function queue to a temporary Vector before calling
+        the functions an inner run-loop - such as we see with running a modal dialog - does not have
+        a change to handle any of the functions that were queued after the WebPageProxy::RunModal message.
+
+        By servicing the functions in the queue one at a time we can give the RunLoop a chance to pick up
+        where it left off if RunLoop::performWork is re-entered.
+
+        To guarantee RunLoop::performWork is re-entered to handle those functions we also need to signal
+        its source before entering the modal run loop so our RunLoop is woken up.
+
+        Reviewed by Darin Adler.
+
+        * WebCore.exp.in:
+        * platform/RunLoop.cpp:
+        (WebCore::RunLoop::performWork): Take the first function off the queue one at a time so subsequent
+          functions remain in the queue and can be handled by an inner modal run loop.
+        * platform/RunLoop.h:
+        (RunLoop): Change the function queue to be a Deque to efficiently support "takeFirst" 
+
+2012-06-20  Varun Jain  <varunjain@chromium.org>
+
+        Account for device scale factor when creating image for dragging.
+        https://bugs.webkit.org/show_bug.cgi?id=89489
+
+        Reviewed by Adam Barth.
+
+        Manual Test: ManualTests/chromium/drag-image-accounts-for-device-scale.html
+
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        (WebCore::Frame::dragImageForSelection):
+
+2012-06-20  Jacky Jiang  <zhajiang@rim.com>
+
+        Add a != operator to ViewportArguments
+        https://bugs.webkit.org/show_bug.cgi?id=87505
+
+        Reviewed by Antonio Gomes.
+        Patch by Jacky Jiang  <zhajiang@rim.com>
+
+        Add a != operator to ViewportArguments for convenience.
+
+        * dom/ViewportArguments.h:
+        (ViewportArguments):
+        (WebCore::ViewportArguments::operator!=):
+
+2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Let Xcode have its own way.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Move m_listsInvalidatedAtDocument from NodeListsNodeData to Document
+        https://bugs.webkit.org/show_bug.cgi?id=89603
+
+        Reviewed by Andreas Kling.
+
+        Moved the variable. m_listsInvalidatedAtDocument is never used in non-Document nodes
+        so it was just wasting memory space.
+
+        * dom/Document.cpp:
+        (WebCore::Document::registerDynamicSubtreeNodeList):
+        (WebCore::Document::unregisterDynamicSubtreeNodeList):
+        (WebCore):
+        (WebCore::Document::clearNodeListCaches):
+        * dom/Document.h:
+        (Document):
+        * dom/DynamicNodeList.h:
+        (DynamicSubtreeNodeList):
+        * dom/Node.cpp:
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
+        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged):
+        (WebCore):
+        (WebCore::NodeListsNodeData::invalidateCachesThatDependOnAttributes): RadioNodeList
+        is invalidated at document level. No need to invalidate it again here.
+        (WebCore::NodeListsNodeData::isEmpty):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+
+2012-06-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120854.
+        http://trac.webkit.org/changeset/120854
+        https://bugs.webkit.org/show_bug.cgi?id=89604
+
+        Broke Chromium WebKit Linux (dbg) (Requested by arv on
+        #webkit).
+
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateNamedConstructorCallback):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (V8Float64Array):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (V8TestActiveDOMObject):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (V8TestCustomNamedGetter):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (V8TestEventConstructor):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (V8TestEventTarget):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (V8TestException):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (V8TestInterface):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (V8TestMediaQueryListListener):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (V8TestNamedConstructor):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNode.h:
+        (V8TestNode):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (V8TestSerializedScriptValueInterface):
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
+        (WebCore):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        (WebCore):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
+        (WebCore):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+        (WebCore):
+        * bindings/v8/custom/V8StyleSheetCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8TextTrackListCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
+        (WebCore):
+        (WebCore::toV8):
+        * css/CSSStyleSheet.idl:
+        * css/StyleSheet.idl:
+        * dom/DOMStringMap.idl:
+        * dom/NamedNodeMap.idl:
+        * html/DOMTokenList.idl:
+        * html/track/TextTrackList.idl:
+
+2012-06-20  Abhishek Arya  <inferno@chromium.org>
+
+        Crash on accessing a removed renderer from percent height descendant map.
+        https://bugs.webkit.org/show_bug.cgi?id=88017
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/block/percent-height-descendant-not-removed-crash2.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hasPercentHeightContainerMap): helper to tell
+        if we have a height container map.
+        (WebCore):
+        (WebCore::RenderBlock::hasPercentHeightDescendant): change from a debug
+        only function to a regular function for use. no need to null check
+        for a percent height container map in this function.
+        (WebCore::RenderBlock::clearPercentHeightDescendantsFrom): helper to
+        clear all percent height descendants under us.
+        (WebCore::RenderBlock::removePercentHeightDescendantIfNeeded): helper to
+        clear the box if it exists in the percent height descendant map.
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed): remove the assert and change the
+        percent height detection check to use removePercentHeightDescendantIfNeeded.
+        We shouldn't rely on logicalHeight().isPercent() as it can change when our
+        writing mode changes. Instead, just query the map directly to see if we exist.
+        (WebCore::RenderBox::styleDidChange): when our writing mode changes from
+        horizontal to vertical or vice versa, we clear all our descendants from
+        the percent height descendant map. Cache the value of isHorizontalWritingMode()
+        before it changes in styleDidChange and compare it with the new value
+        (can't use oldStyle->isHorizontalWritingMode() since it can be inherited
+        and already updated).
+
+2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        REGRESSION(r113885): Margin not properly applied to elements with align=center
+        https://bugs.webkit.org/show_bug.cgi?id=89515
+
+        Reviewed by Levi Weintraub.
+
+        Reviewed by Levi Weintraub.
+
+        Tests: fast/block/negative-margin-start-positive-margin-end.html
+               fast/block/negative-start-margin-align-center.html
+               fast/block/positive-margin-block-child-align-center-rtl.html
+               fast/block/positive-margin-block-child-align-center.html
+               fast/block/positive-margin-start-align-center.html
+               fast/block/positive-margin-start-negative-margin-end-align-center.html
+               fast/table/table-cell-negative-start-margin-align-center.html
+
+        r113885 changed the code-path for elements with auto width to call computeInlineDirectionMargins.
+        However this uncovered an existing bug in the function when dealing with align="center" (text-align: -webkit-center)
+        where we would ignore the margin. This goes against what other browsers are doing and our previous behavior.
+
+        Note that align="left" and "right" are likely impacted too and will be investigated / fixed in follow-up changes.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+        To match other browsers' behavior, changed the function to include margin in our computations.
+
+2012-06-19  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Separate LayerRenderer initialization from updateLayers
+        https://bugs.webkit.org/show_bug.cgi?id=89525
+
+        Reviewed by Adrienne Walker.
+
+        This adds an explicit call to initialize the layer renderer of a given CCLayerTreeHost instead of having it be
+        implicit in updateLayers(). This way the proxies can control the initialization sequence more closely and do
+        useful work between the two calls.
+
+        Refactor, no change in behavior. Covered by existing tests.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::compositeAndReadback):
+        (WebCore::CCLayerTreeHost::initializeLayerRendererIfNeeded):
+        (WebCore):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::beginFrame):
+
+2012-06-20  Yong Li  <yoli@rim.com>
+
+        SecurityOrigin::canDisplay() should return true when m_universalAccess is true
+        https://bugs.webkit.org/show_bug.cgi?id=84865
+
+        Reviewed by Adam Barth.
+
+        Add an early return (true) in canDisplay() for if (m_universalAccess),
+        as we did for canAccess() and canRequest().
+
+        No new tests. We should be good as long as this change doesn't break existing
+        tests, which means the contents supposed to be blocked are still blocked when
+        m_universalAccess is false.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canDisplay):
+
+2012-06-20  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Use v8::V8::AddImplicitReferences instead of SetHiddenValue
+        https://bugs.webkit.org/show_bug.cgi?id=80880
+
+        Reviewed by Adam Barth.
+
+        We used to add a hidden property in the getter to the returned wrapper.
+        With this patch we instead handle the liveness of the wrapper in the GC phase by
+        calling v8::V8::AddHiddenReference.
+
+        To reduce the amount of custom code we need, the V8 code generator now supports
+        GenerateIsReachable (as well as CustomIsReachable) which, even though different
+        from the JSC attribute, is used in the same cases and takes the same values (even though
+        at the moment not all JSC values are supported by V8). Interfaces that have *IsReachable
+        also have a dependent life time (just like if V8DependentLifetime was present).
+
+        Retry. Last time we got ASAN issues on some Cromium Linux bots. 
+
+        No new tests. Covered by existing tests.
+
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GetGenerateIsReachable): Abstracted GenerateIsReachable and JSGenerateIsReachable.
+        (GetCustomIsReachable): Ditto.
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (NeedsToVisitDOMWrapper):
+        (GetGenerateIsReachable):
+        (GetCustomIsReachable):
+        (GenerateVisitDOMWrapper):
+        (GenerateHeader):
+        (GenerateNamedConstructorCallback):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (V8Float64Array):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (V8TestActiveDOMObject):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (V8TestCustomNamedGetter):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (V8TestEventConstructor):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (V8TestEventTarget):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (V8TestException):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (V8TestInterface):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (V8TestMediaQueryListListener):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (V8TestNamedConstructor):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNode.h:
+        (V8TestNode):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (V8TestSerializedScriptValueInterface):
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8TextTrackListCustom.cpp: Removed.
+        * css/CSSStyleSheet.idl:
+        * css/StyleSheet.idl:
+        * dom/DOMStringMap.idl:
+        * dom/NamedNodeMap.idl:
+        * html/DOMTokenList.idl:
+        * html/track/TextTrackList.idl:
+
+2012-06-20  Tony Chang  <tony@chromium.org>
+
+        Regression(r116408): Ctrl-A (select all) on large text file hangs the tab with high CPU usage
+        https://bugs.webkit.org/show_bug.cgi?id=89562
+
+        Reviewed by Ryosuke Niwa.
+
+        Rather than replace the newlines in-place (in O(n^2)), build a new string using StringBuilder, which takes O(n).
+
+        No new tests, this is a perf improvement.
+
+        * platform/chromium/ClipboardUtilitiesChromium.cpp:
+        (WebCore::replaceNewlinesWithWindowsStyleNewlines):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::replaceNewlinesWithWindowsStyleNewlines):
+
+2012-06-20  Elliott Sprehn  <esprehn@gmail.com>
+
+        Add support for fit-content etc
+        https://bugs.webkit.org/show_bug.cgi?id=38919
+
+        Reviewed by Tony Chang.
+
+        Implement the CSS3 intrinsic dimension keywords for width properties and
+        add most of the plumbing for height properties but don't expose them
+        yet since this patch doesn't enforce them (matching current Gecko).
+        http://dev.w3.org/csswg/css3-writing-modes/#intrinsic-sizing
+
+        This patch implements -webkit-min-content, -webkit-max-content,
+        -webkit-fill-available and -webkit-fit-content for all width
+        properties.
+
+        Tests: fast/css-intrinsic-dimensions/height-dynamic-property-value.html
+               fast/css-intrinsic-dimensions/height-property-value.html
+               fast/css-intrinsic-dimensions/max-width-constrained.html
+               fast/css-intrinsic-dimensions/max-width-unconstrained.html
+               fast/css-intrinsic-dimensions/min-width.html
+               fast/css-intrinsic-dimensions/width-avoid-floats.html
+               fast/css-intrinsic-dimensions/width-dynamic-property-value.html
+               fast/css-intrinsic-dimensions/width-property-value.html
+               fast/css-intrinsic-dimensions/width.html
+
+        * css/CSSParser.cpp: Add parser support for the new keywords.
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSValueKeywords.in:
+        * css/LengthFunctions.cpp: Implement conversion functions.
+        (WebCore::minimumValueForLength):
+        (WebCore::valueForLength):
+        (WebCore::floatValueForLength):
+        * css/StyleBuilder.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        (WebCore::StyleBuilder::StyleBuilder): Clean up the template for old
+           intrinsic values and add new values. Rename old intrinsic to
+           LegacyIntrinsic and add support for the new dimension keywords as
+           Intrinsic.
+        * platform/Length.h:
+        (WebCore::Length::isIntrinsicOrAuto):
+        (WebCore::Length::isLegacyIntrinsic): New method to check for old
+            min-intrinsic and intrinsic keywords.
+        (WebCore::Length::isIntrinsic): New method to check for CSS3 intrinsic
+            dimension keywords like min-content.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing): Expose the max
+           and min logical preferred widths as the new keywords.
+        (WebCore::RenderBox::sizesLogicalWidthToFitContent): Renamed method to
+           be more consistent with the new MinContent naming in the spec.
+        * rendering/RenderBox.h:
+        (RenderBox):
+
+2012-06-20  Christopher Cameron  <ccameron@chromium.org>
+
+        [chromium] webkit-backface-visibility doesn't work with video
+        https://bugs.webkit.org/show_bug.cgi?id=88908
+
+        When determining a contents layer's backface culling, use the parent
+        layer's transform and backface-visibility properties. Track which
+        layers need this special treatment with useParentBackfaceVisibility
+        and setUseParentBackfaceVisibility functions in WebCore::LayerChromium,
+        WebKit::WebLayer, and WebCore::CCLayerImpl.
+
+        Reviewed by Adrienne Walker.
+
+        Tests: compositing/backface-visibility/backface-visibility-image.html
+               compositing/backface-visibility/backface-visibility-webgl.html
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setupContentsLayer):
+            When a contents layer is added, tag it as inheriting its backface
+            culling from its parent.
+        * platform/graphics/chromium/LayerChromium.cpp:
+            (WebCore::LayerChromium::LayerChromium):
+                Initialize new m_useParentBackfaceVisibility member variable.
+            (WebCore::LayerChromium::pushPropertiesTo):
+                Propagate m_useParentBackfaceVisibility to CCLayerImpl.
+        * platform/graphics/chromium/LayerChromium.h:
+            (WebCore::LayerChromium::setUseParentBackfaceVisibility):
+            (WebCore::LayerChromium::useParentBackfaceVisibility):
+            (LayerChromium):
+                Add m_useParentBackfaceVisibility member variable and modify
+                and query accessors.
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+            (WebCore::CCLayerImpl::CCLayerImpl):
+                Initialize new m_useParentBackfaceVisibility member variable.
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+            (WebCore::CCLayerImpl::setUseParentBackfaceVisibility):
+            (WebCore::CCLayerImpl::useParentBackfaceVisibility):
+            (CCLayerImpl):
+                Add m_useParentBackfaceVisibility member variable and modify
+                and query accessors.
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+            (WebCore::layerShouldBeSkipped):
+                When examining a layer, if the layer has 
+                useParentBackfaceVisibility set then use the layer's parent
+                layer to determine backface culling.
+
+2012-06-20  Nate Chapin  <japhet@chromium.org>
+
+        Don't re-enter CachedResource::removeClient() if an XHR
+        is canceled and restarted multiple times.
+        https://bugs.webkit.org/show_bug.cgi?id=89378
+
+        Reviewed by Eric Seidel.
+
+        Test: http/tests/xmlhttprequest/reentrant-cancel.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::cancel):
+        (WebCore::DocumentThreadableLoader::clearResource): Save off a copy of m_resource
+           then clear it, so we don't call clearResource() multiple times for the same resource.
+
+2012-06-20  Robert Hogan  <robert@webkit.org>
+
+        Negative margin block doesn't properly clear a float enclosed by a previous sibling
+        https://bugs.webkit.org/show_bug.cgi?id=10900
+
+        Reviewed by Eric Seidel.
+
+        Tests: fast/block/float/previous-sibling-abspos-001.html
+               fast/block/float/previous-sibling-abspos-002.html
+               fast/block/float/previous-sibling-float-001.html
+               fast/block/float/previous-sibling-float-002.html
+               fast/css/clear-float-sibling.html
+
+        Parent blocks keep a list of child floats that extend out of the parent block and
+        by implication overhang into the parent's siblings. But this doesn't work if the
+        sibling has collapsing margins - it will not find the float in the previous block's
+        list so will ignore the float and fail to clear it.
+
+        RenderBlock:collapseMargins() needs to check if a child's collapsing margin has 
+        reduced the height of the parent up past the bottom of its previous sibling's lowest float
+        and add the now overhanging float to the parent's float list if appropriate. No need to do
+        this if the previous sibling is a float or is positioned - the child will clear/avoid it anyway
+        and attempting to avoid floated children of floats causes incorrect layout.
+        
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+
+2012-06-20  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: Allow module injections into the InjectedScript
+        https://bugs.webkit.org/show_bug.cgi?id=89530
+
+        Add a new InjectedScriptModule abstract class that inherits InjectedScriptBase
+        to reuse implementation, and which javascript code is injected via
+        InjectedScript.
+
+        Reviewed by Pavel Feldman.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore):
+        * bindings/js/ScriptObject.h:
+        (ScriptObject):
+        (WebCore::ScriptObject::ScriptObject):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore):
+        * bindings/v8/ScriptObject.h:
+        (ScriptObject):
+        (WebCore::ScriptObject::~ScriptObject):
+        * inspector/InjectedScript.cpp:
+        * inspector/InjectedScript.h:
+        (WebCore):
+        (WebCore::InjectedScript::name):
+        (InjectedScript):
+        * inspector/InjectedScriptBase.cpp:
+        (WebCore::InjectedScriptBase::callFunctionWithEvalEnabled):
+        * inspector/InjectedScriptBase.h:
+        (WebCore):
+        (InjectedScriptBase):
+        * inspector/InjectedScriptManager.h:
+        (InjectedScriptManager):
+        (WebCore::InjectedScriptManager::inspectedStateAccessCheck):
+        * inspector/InjectedScriptModule.cpp: Copied from Source/WebCore/inspector/InjectedScriptBase.h.
+        (WebCore):
+        (WebCore::InjectedScriptModule::InjectedScriptModule):
+        (WebCore::InjectedScriptModule::ensureInjected):
+        * inspector/InjectedScriptModule.h: Copied from Source/WebCore/bindings/js/ScriptObject.h.
+        (WebCore):
+        (InjectedScriptModule):
+        * inspector/InjectedScriptSource.js:
+        (.):
+
+2012-06-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: Timeline label bar jiggles when scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=89579
+
+        Reviewed by Vsevolod Vlasov.
+
+        Adding timeline header into the timeline panel and settings its position
+        to absolute. Drive-by fix that updates rulers on sidebar resize.
+
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get gridHeaderElement):
+        (WebInspector.TimelineGrid.prototype.addEventDividers):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype.onResize):
+        * inspector/front-end/timelinePanel.css:
+        (#timeline-grid-header):
+
+2012-06-20  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Make sure that render surfaces are not pixel doubled with a device scale factor of 2
+        https://bugs.webkit.org/show_bug.cgi?id=86882
+
+        Reviewed by Adrienne Walker.
+
+        To ensure that render surfaces are not pixel doubled when device scale factor is
+        two, the render surface's owning layer's draw transform is scaled by the
+        contents scale (in the same way that the parent matrix is scaled by the device
+        scale factor). The transformedLayerRect's dimensions also need to be in pixel
+        space. The surface origin transform should not scale, but needs to offset the
+        correct number of pixels, and the replica transforms need to be modified to
+        account for the scaling.
+
+        To accomplish this, CCLayerImpl's needed to be made aware of contentsScale.
+
+        Thanks to Adrienne Walker for the computation of the replica draw transform.
+
+        Unit test: CCLayerTreeHostCommonTest.verifyRenderSurfaceTranformsInHighDPI
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::setContentsScale):
+        (WebCore::CCLayerImpl::contentsScale):
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsInternal):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):
+
+2012-06-20  Alexis Menard  <alexis.menard@openbossa.org>
+
+        [CSS3 Backgrounds and Borders] Implement box-decoration-break rendering.
+        https://bugs.webkit.org/show_bug.cgi?id=88228
+
+        Reviewed by Eric Seidel.
+
+        Implement the new CSS property box-decoration-break. It modifies
+        where we decide whether the borders needs to be sliced or not by
+        checking if the box-decoration-break is set to clone. If it's the case
+        then we need to explicitely redraw all edges.
+
+        Test: fast/box-decoration-break/box-decoration-break-rendering.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::paintFillLayer):
+
+2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Use IntSize in RenderLayer to represent scroll offsets
+        https://bugs.webkit.org/show_bug.cgi?id=89154
+
+        Reviewed by Eric Seidel.
+
+        Refactoring, covered by existing tests.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::scrollTo):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::forwardEvent):
+        * page/SpatialNavigation.cpp:
+        (WebCore::scrollInDirection):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        Updated those call-sites to use the IntSize variant of the scrolling function.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+        Updated the signature to use IntPoint to avoid an extra round-trip to LayoutPoint
+        (furthermore touch points should be in device pixels).
+
+        (WebCore::RenderLayer::clampScrollOffset):
+        Added this function that clamps a scroll offset to the box's size. This enables more
+        code sharing between the different functions. Also removed a NULL-check that shouldn't
+        be needed: scrolling is a RenderBox concept so any callers should ensure that we have
+        a RenderBox or it makes no sense to try to scroll.
+
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::adjustedScrollDelta):
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        Updated to do IntSize arithmetic. Reuse clampScrollOffset when applicable.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::scrollToXOffset):
+        (WebCore::RenderLayer::scrollToYOffset):
+        Updated the functions to take IntSize as much as possible.
+
+2012-06-20  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: mark used/allocated JS heap on the native memory bar chart.
+        https://bugs.webkit.org/show_bug.cgi?id=89476
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemoryBarChart):
+        (WebInspector.NativeMemoryBarChart.prototype._updateView):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.memory-bar-chart-bar):
+        (.memory-bar-chart-unused):
+        (.memory-bar-chart-percent):
+
+2012-06-20  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: Don't close database if pending connections are in flight
+        https://bugs.webkit.org/show_bug.cgi?id=89512
+
+        Add a counter tracking connections between the two phases, which is used along with
+        the completed connection count to determine the total number of connections.
+
+        Reviewed by Tony Chang.
+
+        Test: webkit_unit_tests --gtest_filter='IDBDatabaseBackendTest.ConnectionLifecycle'
+
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::connectionCount):
+        (WebCore):
+        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
+        (WebCore::IDBDatabaseBackendImpl::openConnection):
+        (WebCore::IDBDatabaseBackendImpl::close):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::openInternal):
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+
+2012-06-20  Sergey Rogulenko  <rogulenko@google.com>
+
+        Web Inspector: duplicating selected text when Enter key is pressed 
+        https://bugs.webkit.org/show_bug.cgi?id=89559
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype.handleEnterKey):
+        The returned result of method normalize() should be used.
+
+2012-06-20  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [Cairo] Fix memory leak in GraphicsContext3DCairo.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=89561
+
+        Reviewed by Martin Robinson.
+
+        Fix a memory leak in GraphicsContext3D::getImageData().
+
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+        (WebCore::GraphicsContext3D::getImageData): asNewNativeImage() returns a
+        caller-owned pointer to the native image data. So, using OwnPtr to manage
+        memory automatically.
+
+2012-06-20  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Use HitTestPoint instead of LayoutPoint for nodeAtPoint.
+        https://bugs.webkit.org/show_bug.cgi?id=89448
+
+        Reviewed by Eric Seidel.
+
+        This patch updates the API of nodeAtPoint without changing any 
+        functionality. This is largest change necessary to support
+        transforms in area-based hit-testing, but is only boilerplate.
+
+        No change in functionality. No new tests. 
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/EllipsisBox.h:
+        (EllipsisBox):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestPoint::intersects):
+        (HitTestPoint):
+        (HitTestResult):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::nodeAtPoint):
+        * rendering/InlineBox.h:
+        (InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        * rendering/InlineFlowBox.h:
+        (InlineFlowBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::nodeAtPoint):
+        * rendering/InlineTextBox.h:
+        (InlineTextBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::hitTestFloats):
+        (WebCore::RenderBlock::hitTestColumns):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::nodeAtPoint):
+        * rendering/RenderEmbeddedObject.h:
+        (RenderEmbeddedObject):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::hitTestRegion):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::nodeAtPoint):
+        * rendering/RenderFrameSet.h:
+        (RenderFrameSet):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint):
+        * rendering/RenderImage.h:
+        (RenderImage):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::nodeAtPoint):
+        * rendering/RenderInline.h:
+        (RenderInline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::ClipRect::intersects):
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::RenderLayer::createLocalTransformState):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestContents):
+        (WebCore::RenderLayer::hitTestList):
+        (WebCore::RenderLayer::hitTestPaginatedChildLayer):
+        (WebCore::RenderLayer::hitTestChildLayerColumns):
+        * rendering/RenderLayer.h:
+        (ClipRect):
+        (RenderLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderLineBoxList.h:
+        (RenderLineBoxList):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::nodeAtPoint):
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::hitTest):
+        (WebCore::RenderObject::nodeAtPoint):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::nodeAtPoint):
+        * rendering/RenderRegion.h:
+        (RenderRegion):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTable.h:
+        (RenderTable):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::nodeAtPoint):
+        * rendering/RenderTableRow.h:
+        (RenderTableRow):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderTableSection.h:
+        (RenderTableSection):
+        * rendering/RenderText.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/RenderTextControlMultiLine.h:
+        (RenderTextControlMultiLine):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::nodeAtPoint):
+        * rendering/RenderWidget.h:
+        (RenderWidget):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::nodeAtPoint):
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+        * rendering/svg/RenderSVGForeignObject.cpp:
+        (WebCore::RenderSVGForeignObject::nodeAtFloatPoint):
+        (WebCore::RenderSVGForeignObject::nodeAtPoint):
+        * rendering/svg/RenderSVGForeignObject.h:
+        (RenderSVGForeignObject):
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::nodeAtPoint):
+        * rendering/svg/RenderSVGModelObject.h:
+        (RenderSVGModelObject):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/svg/RenderSVGRoot.h:
+        (RenderSVGRoot):
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtFloatPoint):
+        (WebCore::RenderSVGText::nodeAtPoint):
+        * rendering/svg/RenderSVGText.h:
+        (RenderSVGText):
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::nodeAtPoint):
+        * rendering/svg/SVGInlineTextBox.h:
+        (SVGInlineTextBox):
+
+2012-06-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: don't report context ids before DidCommitLoad
+        https://bugs.webkit.org/show_bug.cgi?id=89567
+
+        Reviewed by Pavel Feldman.
+
+        When inspector state is restored only report existing context ids
+        if "did commit load" even has already been dispatched.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/PageRuntimeAgent.cpp:
+        (WebCore::PageRuntimeAgent::PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::restore):
+        * inspector/PageRuntimeAgent.h:
+        (WebCore):
+        (WebCore::PageRuntimeAgent::create):
+        (PageRuntimeAgent):
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Remove redundant #includes in compositor
+        https://bugs.webkit.org/show_bug.cgi?id=89503
+
+        Reviewed by Adrienne Walker.
+
+        Removed some redundant #includes to clarify dependency
+        picture. Some 90 #includes removed, some 50 less disruptive
+        #includes added. This brings the number of class dependencies to
+        902 from 1383.
+
+        No new tests are required, as this is only affects compile-time behavior.
+
+        * platform/graphics/chromium/AnimationTranslationUtil.h:
+        (WebCore):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        * platform/graphics/chromium/Canvas2DLayerBridge.h:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        * platform/graphics/chromium/ProgramBinding.h:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        * platform/graphics/chromium/TextureCopier.cpp:
+        * platform/graphics/chromium/TextureLayerChromium.cpp:
+        * platform/graphics/chromium/TextureManager.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/cc/CCActiveAnimation.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
+        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
+        * platform/graphics/chromium/cc/CCFrameRateController.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCProxy.cpp:
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        * platform/graphics/chromium/cc/CCScopedThreadProxy.h:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCTimer.cpp:
+        * platform/graphics/chromium/cc/CCTimer.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+
+2012-06-20  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Implement native memory bar diagram
+        https://bugs.webkit.org/show_bug.cgi?id=89106
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemoryBarChart):
+        (WebInspector.NativeMemoryBarChart.prototype._updateStats):
+        (WebInspector.NativeMemoryBarChart.prototype.willHide):
+        (WebInspector.NativeMemoryBarChart.prototype.wasShown):
+        (WebInspector.NativeMemoryBarChart.prototype._updateView):
+        * inspector/front-end/ProfileLauncherView.js:
+        (WebInspector.ProfileLauncherView):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.memory-bar-chart-name):
+        (.memory-bar-chart-bar):
+        (.memory-bar-chart-size):
+        (.memory-bar-chart-total):
+
+2012-06-20  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: add SpeechRecognition.maxAlternatives attribute
+        https://bugs.webkit.org/show_bug.cgi?id=89459
+
+        Reviewed by Eric Seidel.
+
+        Add the SpeechRecognition.maxAlternatives attribute.
+
+        Test: fast/speech/scripted/basics.html:
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::start):
+        (WebCore::SpeechRecognition::SpeechRecognition):
+        * Modules/speech/SpeechRecognition.h:
+        (WebCore::SpeechRecognition::maxAlternatives):
+        (WebCore::SpeechRecognition::setMaxAlternatives):
+        (SpeechRecognition):
+        * Modules/speech/SpeechRecognition.idl:
+        * Modules/speech/SpeechRecognitionClient.h:
+        (SpeechRecognitionClient):
+        * Modules/speech/SpeechRecognitionController.h:
+        (WebCore::SpeechRecognitionController::start):
+        (SpeechRecognitionController):
+
+2012-06-20  Takashi Sakamoto  <tasak@google.com>
+
+        applyAuthorStyles makes rules declared in all enclosing shadow dom subtrees applicable.
+        https://bugs.webkit.org/show_bug.cgi?id=89061
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing apply-author-styles bug. If there exists some shadow subtree A
+        and A has apply-author-styles flag set, whether some rules declared in
+        a tree B is applicable in A or not depends on:
+        - the tree B encloses the tree A, and
+        - all trees which enclose A and are enclosed by B has
+          apply-author-styles set.
+        c.f.
+        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#styles
+        However the second rule was not implemented.
+
+        Test: fast/css/style-scoped/style-scoped-apply-author-styles.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::setupScopeStack):
+        Modified to add a new member variable, authorStyleBoundsIndex to
+        ScopeStackFrame used by m_scopeStack. The index means: if shadow dom
+        subtree A and B has the same value and A encloses B, all shadow dom
+        subtrees which enclose B and are enclosed by B have
+        apply-author-styles set. And B also has apply-author-styles set.
+        This means, if some element X has authorStyleBoundsIndex N, all
+        rulesets whose scopes have authorStyleBoundsIndex N are applicable in
+        B's tree scope. If all shadow dom subtrees have apply-author-styles
+        unset, the index looks almost the same as treeScope(). In this case,
+        Rules in different tree scopes have different author style bounds
+        index.
+        (WebCore::StyleResolver::pushScope):
+        (WebCore::StyleResolver::popScope):
+        Added the code for updating m_scopeStackParentBoundsIndex. The member
+        variable keeps m_scopeStackParent's author style bounds index.
+        (WebCore::StyleResolver::matchScopedAuthorRules):
+        Modified to consider author style's bounds index. Firstly applying
+        scoped styles declared in document if apply-author-styles is set.
+        Next, applying scoped styles declared in shadow dom subtree with
+        considering author style bounds index, i.e. considering
+        apply-author-styles flag.
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::ScopeStackFrame::ScopeStackFrame):
+        (ScopeStackFrame):
+        Added m_authorStyleBoundsIndex to keep apply-author-styles flag
+        information. m_authorStyleBoundsIndex increments by 1 if shadow root is
+        given and it has apply-author-styles unset.
+        Now rules in the same authorStyleBoundsIndex should be applied.
+        (StyleResolver):
+        Added m_scopeStackParentBoundsIndex.
+        As m_scopeStackParentAuthorStyleBoundsIndex is a little long,
+        used m_scopeStackParentBoundsIndex.
+
+2012-06-20  Amy Ousterhout  <aousterh@chromium.org>
+
+        Adds DeviceMotionClientMock
+        https://bugs.webkit.org/show_bug.cgi?id=89220
+
+        Reviewed by Steve Block.
+
+        No new tests because DeviceMotionClientMock is designed to enable future testing and cannot be tested in itself.
+
+        Adds DeviceMotionClientMock in WebCore to enable testing of DeviceMotion once it is fully implemented in WebKit.
+        This addition was originally included in https://bugs.webkit.org/show_bug.cgi?id=89197 but was split into a separate patch for easier review.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/mock/DeviceMotionClientMock.cpp: Added.
+        (WebCore):
+        (WebCore::DeviceMotionClientMock::DeviceMotionClientMock):
+        (WebCore::DeviceMotionClientMock::setController):
+        (WebCore::DeviceMotionClientMock::startUpdating):
+        (WebCore::DeviceMotionClientMock::stopUpdating):
+        (WebCore::DeviceMotionClientMock::setMotion):
+        (WebCore::DeviceMotionClientMock::timerFired):
+        * platform/mock/DeviceMotionClientMock.h: Added.
+        (WebCore):
+        (DeviceMotionClientMock):
+
+2012-06-19  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: Clicking "Clear all profiles" while ongoing recording should reset the ProfileLauncherView
+        https://bugs.webkit.org/show_bug.cgi?id=89464
+
+        Reviewed by Yury Semikhatsky.
+
+        Resetting the ProfileLauncherView in order to reflect the correct states of buttons
+
+        No new tests as UI related minor fix.
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._reset):
+
+2012-06-19  Hayato Ito  <hayato@chromium.org>
+
+        Assertion for event's target is wrong.
+        https://bugs.webkit.org/show_bug.cgi?id=89479
+
+        Reviewed by Hajime Morita.
+
+        Fix an assertion to ensure that event's target is reachable from a current target.
+
+        No new tests. Fix an assert condition.
+
+        * dom/EventContext.cpp:
+        (WebCore::EventContext::EventContext):
+        * dom/EventContext.h:
+        (EventContext):
+        (WebCore::EventContext::setRelatedTarget):
+        (WebCore::EventContext::isUnreachableNode):
+        (WebCore):
+        (WebCore::EventContext::isReachable):
+
+2012-06-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        Refactoring: Geolocation::startRequest() should not create the GeoNotifiers
+        https://bugs.webkit.org/show_bug.cgi?id=89533
+
+        Reviewed by David Kilzer.
+
+        It was odd to create the GeoNotifiers in Geolocation::startRequest() and having
+        assertions from the call site.
+
+        This patch move GeoNotifiers initialization to the exposed methods and pass them to
+        startRequest() as needed.
+        This will also help when adding support for dynamic permission reset and suspend/resume.
+
+        * Modules/geolocation/Geolocation.cpp:
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::startRequest):
+        * Modules/geolocation/Geolocation.h:
+        (Geolocation):
+
+2012-06-19  Cris Neckar  <cdn@chromium.org>
+
+        Fixes condition where inserting a CounterNode subtree which could result in incorrect placement.
+        https://bugs.webkit.org/show_bug.cgi?id=88142
+
+        Reviewed by Adam Barth.
+
+        Test: fast/css/counters/counter-reset-subtree-insert-crash.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::insertAfter):
+
+2012-06-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r120790. Typo fix.
+
+        * platform/graphics/gstreamer/ImageGStreamerQt.cpp:
+        (ImageGStreamer::ImageGStreamer):
+
+2012-06-19  Takashi Sakamoto  <tasak@google.com>
+
+        [Shadow DOM] ShadowRoot.host should be gone
+        https://bugs.webkit.org/show_bug.cgi?id=88387
+
+        According to the w3c spec change,
+        i.e. https://www.w3.org/Bugs/Public/show_bug.cgi?id=16764
+        Removed host attribute from ShadowRoot.idl.
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests, because this change modified only idl.
+
+        * dom/ShadowRoot.idl:
+        Just removed host attribute.
+
+2012-06-19  Adam Klein  <adamk@chromium.org>
+
+        Pass ScriptValue by const ref where possible
+        https://bugs.webkit.org/show_bug.cgi?id=89531
+
+        Reviewed by Kentaro Hara.
+
+        Previously ScriptValue was sometimes passed by value, sometimes by const ref.
+
+        For consistency and optimality, pass by const ref everywhere (except where
+        ScriptValue is returned from non-accessor methods).
+
+        No new tests, no change in behavior.
+
+        * bindings/js/ScriptFunctionCall.h:
+        (ScriptCallback):
+        * bindings/js/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::getHeapObjectId):
+        * bindings/js/ScriptProfiler.h:
+        (ScriptProfiler):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::setException):
+        * bindings/js/WorkerScriptController.h:
+        (WorkerScriptController):
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptCallback::ScriptCallback):
+        * bindings/v8/ScriptFunctionCall.h:
+        (ScriptCallback):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::getHeapObjectId):
+        (WebCore):
+        * bindings/v8/ScriptProfiler.h:
+        (ScriptProfiler):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::operator==):
+        (WebCore::ScriptValue::operator!=):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::setException):
+        * bindings/v8/WorkerScriptController.h:
+        (WorkerScriptController):
+        * css/MediaQueryListListener.h:
+        (WebCore::MediaQueryListListener::create):
+        (WebCore::MediaQueryListListener::MediaQueryListListener):
+        * dom/CustomEvent.cpp:
+        (WebCore::CustomEvent::initCustomEvent):
+        * dom/CustomEvent.h:
+        (CustomEvent):
+        (WebCore::CustomEvent::detail):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::dataAsScriptValue):
+        * dom/PopStateEvent.h:
+        (WebCore::PopStateEvent::state):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::wrapObject):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+
+2012-06-18  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] 0.11 video-sink
+        https://bugs.webkit.org/show_bug.cgi?id=77087
+
+        Reviewed by Martin Robinson.
+
+        Port the video sink to GStreamer 0.11 APIs. There is no change in
+        functionality compared to 0.10, for now.
+
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (webkitGetVideoSizeAndFormatFromCaps):
+        (webkitGstCreateBuffer):
+        * platform/graphics/gstreamer/GStreamerVersioning.h:
+        (WebCore):
+        * platform/graphics/gstreamer/ImageGStreamer.h:
+        (WebCore::ImageGStreamer::createImage):
+        (WebCore::ImageGStreamer::setCropRect):
+        (WebCore::ImageGStreamer::rect):
+        (ImageGStreamer):
+        * platform/graphics/gstreamer/ImageGStreamerCairo.cpp:
+        (ImageGStreamer::ImageGStreamer):
+        * platform/graphics/gstreamer/ImageGStreamerQt.cpp:
+        (ImageGStreamer::ImageGStreamer):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer):
+        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (_WebKitVideoSinkPrivate):
+        (webkitVideoSinkRender):
+        (webkitVideoSinkProposeAllocation):
+        (webkit_video_sink_class_init):
+        * platform/graphics/gstreamer/VideoSinkGStreamer.h:
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+
+2012-06-19  Tony Payne  <tpayne@chromium.org>
+
+        Add monitor profile support for Win
+        https://bugs.webkit.org/show_bug.cgi?id=88565
+
+        Reviewed by Eric Seidel.
+
+        Tests: fast/images/jpeg-with-color-profile.html
+        fast/images/png-with-color-profile.html. Also covered by numerous
+        layout tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * platform/PlatformScreen.h:
+        (WebCore):
+        * platform/blackberry/PlatformScreenBlackBerry.cpp:
+        (WebCore::screenColorProfile):
+        (WebCore):
+        * platform/chromium/PlatformScreenChromium.cpp:
+        (WebCore::screenColorProfile):
+        (WebCore):
+        * platform/efl/PlatformScreenEfl.cpp:
+        (WebCore::screenColorProfile):
+        (WebCore):
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::screenColorProfile):
+        (WebCore):
+        * platform/image-decoders/ImageDecoder.h:
+        (ImageFrame):
+        (ImageDecoder):
+        (WebCore::ImageDecoder::qcmsOutputDeviceProfile):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (turboSwizzled):
+        (colorSpaceHasAlpha):
+
+2012-06-19  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Fix issue where a callback got a null calling context
+        https://bugs.webkit.org/show_bug.cgi?id=89532
+
+        Reviewed by Kentaro Hara.
+
+        Test: fast/dom/Window/post-message-crash.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::handlePostMessageCallback): Check the calling context and throw a type error (like JSC) if it is null.
+
+2012-06-19  Tony Chang  <tony@chromium.org>
+
+        Refactor RenderFlexibleBox terminology to use grow/shrink instead of positive/negative
+        https://bugs.webkit.org/show_bug.cgi?id=89493
+
+        Reviewed by Eric Seidel.
+
+        The spec stopped referring to positive and negative flex and now
+        talks about flex grow and flex shrink. Also, the preferred size is
+        now known as the flex basis. Make the code match the terms used in
+        the spec. http://dev.w3.org/csswg/css3-flexbox/
+
+        This will also make it easier to split flex into long hand notation
+        (flex-grow, flex-shrink and flex-basis).
+
+        No new tests, covered by existing tests.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/StyleBuilder.cpp:
+        (WebCore::ApplyPropertyFlex::applyInheritValue):
+        (WebCore::ApplyPropertyFlex::applyInitialValue):
+        (WebCore::ApplyPropertyFlex::applyValue):
+        * page/animation/CSSPropertyAnimation.cpp:
+        (WebCore::PropertyWrapperFlex::equals):
+        (WebCore::PropertyWrapperFlex::blend):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::flexBasisForChild):
+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
+        (WebCore::RenderFlexibleBox::layoutFlexItems):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        (WebCore::RenderFlexibleBox::computeNextFlexLine):
+        (WebCore::RenderFlexibleBox::freezeViolations):
+        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
+        * rendering/RenderFlexibleBox.h:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleFlexibleBoxData.cpp:
+        (WebCore::StyleFlexibleBoxData::StyleFlexibleBoxData):
+        (WebCore::StyleFlexibleBoxData::operator==):
+        * rendering/style/StyleFlexibleBoxData.h:
+        (StyleFlexibleBoxData):
+
+2012-06-19  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Make DOMFileSystem selectively structure clonable so it can be the body of a web intent.
+        https://bugs.webkit.org/show_bug.cgi?id=88267
+
+        Reviewed by David Levin.
+
+        This functionality will allow FileSystem API objects to be dispatched to
+        web content in order to enable, for instance, an intent notifying web
+        content that a particular filesystem has been mounted by the local
+        system. The goal at this point is not to enable across-the-board
+        clonability, but just for handling the particular use case.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::V8ObjectMap::Writer::writeDOMFileSystem):
+        (WebCore::V8ObjectMap::Serializer::writeDOMFileSystem):
+        (WebCore::V8ObjectMap::Serializer::doSerialize):
+        (WebCore::V8ObjectMap::Reader::read):
+        (WebCore::V8ObjectMap::Reader::readDOMFileSystem):
+
+2012-06-19  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r120772.
+        http://trac.webkit.org/changeset/120772
+        https://bugs.webkit.org/show_bug.cgi?id=89503
+
+        Broke build on Chromium Mac
+
+        * platform/graphics/chromium/AnimationTranslationUtil.h:
+        (WebCore):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        * platform/graphics/chromium/Canvas2DLayerBridge.h:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (WebCore):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        * platform/graphics/chromium/ProgramBinding.h:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        * platform/graphics/chromium/TextureCopier.cpp:
+        * platform/graphics/chromium/TextureLayerChromium.cpp:
+        * platform/graphics/chromium/TextureManager.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCActiveAnimation.h:
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
+        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
+        * platform/graphics/chromium/cc/CCFrameRateController.h:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        * platform/graphics/chromium/cc/CCProxy.cpp:
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCScopedThreadProxy.h:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        * platform/graphics/chromium/cc/CCTimer.cpp:
+        * platform/graphics/chromium/cc/CCTimer.h:
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+
+2012-06-19  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Remove redundant #includes in compositor
+        https://bugs.webkit.org/show_bug.cgi?id=89503
+
+        Reviewed by Adrienne Walker.
+
+        Removed some redundant #includes to clarify dependency
+        picture. Some 90 #includes removed, some 50 less disruptive
+        #includes added. This brings the number of class dependencies to
+        902 from 1383.
+
+        No new tests are required, as this is only affects compile-time behavior.
+
+        * platform/graphics/chromium/AnimationTranslationUtil.h:
+        (WebCore):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        * platform/graphics/chromium/Canvas2DLayerBridge.h:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        * platform/graphics/chromium/ProgramBinding.h:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        * platform/graphics/chromium/TextureCopier.cpp:
+        * platform/graphics/chromium/TextureLayerChromium.cpp:
+        * platform/graphics/chromium/TextureManager.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/cc/CCActiveAnimation.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
+        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
+        * platform/graphics/chromium/cc/CCFrameRateController.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCProxy.cpp:
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        * platform/graphics/chromium/cc/CCScopedThreadProxy.h:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCTimer.cpp:
+        * platform/graphics/chromium/cc/CCTimer.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+
+2012-06-19  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Align RenderLayer's descendant dependent flags semantics
+        https://bugs.webkit.org/show_bug.cgi?id=89241
+
+        Reviewed by Simon Fraser.
+
+        Refactoring only, covered by existing tests.
+
+        This change aligns the naming and implementation of the different descendant
+        dependent flags. While aligning, I found some bugs (inefficiencies) with how
+        the visible descendant flags was computed.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::setHasVisibleContent):
+        Changed this method to not take a boolean as every callers was passing 'true'.
+        Reworked the logic under this assumption.
+
+        (WebCore::RenderLayer::dirtyVisibleContentStatus):
+        Updated after the following renaming.
+
+        (WebCore::RenderLayer::dirtyAncestorChainVisibleDescendantStatus):
+        Renamed this function from dirtyVisibleDescendantStatus to match the hasSelfPaintingLayer
+        naming and implementation.
+
+        (WebCore::RenderLayer::setAncestorChainHasVisibleDescendant):
+        Added this function to factor the visible descendant setting out of defunct childVisibilityChanged.
+        Also improved the efficiency of the function by clearing the dirty flag as it goes up (an unnoticed bug).
+
+        (WebCore::RenderLayer::addChild):
+        (WebCore::RenderLayer::removeChild):
+        Updated to use the new functions lieu of childVisibilityChanged.
+        * rendering/RenderLayer.h:
+        (RenderLayer::childVisibilityChanged):
+        Removed this function as it wasn't adding much and it's a lot more clear to call
+        dirtyAncestorChainVisibleDescendantStatus / setAncestorChainHasVisibleDescendant.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::appendChildNode):
+        (WebCore::RenderObjectChildList::insertChildNode):
+        Updated those callers after removing the boolean parameter from setHasVisibleContent.
+
+2012-06-19  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: Extract InjectedScriptBase class from the InjectedScript
+        https://bugs.webkit.org/show_bug.cgi?id=89107
+
+        Extract methods from the InjectedScript that do not depend on
+        the concrete InjectedScriptSource.js implementation.
+
+        Reviewed by Pavel Feldman.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::InjectedScript):
+        (WebCore::InjectedScript::evaluate):
+        (WebCore::InjectedScript::callFunctionOn):
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getFunctionDetails):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::nodeForObjectId):
+        (WebCore::InjectedScript::releaseObject):
+        (WebCore::InjectedScript::wrapCallFrames):
+        (WebCore::InjectedScript::wrapObject):
+        (WebCore::InjectedScript::wrapSerializedObject):
+        (WebCore::InjectedScript::findObjectById):
+        (WebCore::InjectedScript::inspectNode):
+        (WebCore::InjectedScript::releaseObjectGroup):
+        (WebCore::InjectedScript::nodeAsScriptValue):
+        * inspector/InjectedScript.h:
+        (WebCore):
+        (InjectedScript):
+        * inspector/InjectedScriptBase.cpp: Added.
+        (WebCore):
+        (WebCore::InjectedScriptBase::InjectedScriptBase):
+        (WebCore::InjectedScriptBase::canAccessInspectedWindow):
+        (WebCore::InjectedScriptBase::injectedScriptObject):
+        (WebCore::InjectedScriptBase::callFunctionWithEvalEnabled):
+        (WebCore::InjectedScriptBase::makeCall):
+        (WebCore::InjectedScriptBase::makeEvalCall):
+        * inspector/InjectedScriptBase.h: Copied from Source/WebCore/bindings/js/ScriptObject.h.
+        (WebCore):
+        (InjectedScriptBase):
+        (WebCore::InjectedScriptBase::~InjectedScriptBase):
+        (WebCore::InjectedScriptBase::hasNoValue):
+        (WebCore::InjectedScriptBase::scriptState):
+        * inspector/InspectorAllInOne.cpp:
+
+2012-06-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120621.
+        http://trac.webkit.org/changeset/120621
+        https://bugs.webkit.org/show_bug.cgi?id=89518
+
+        Memory graph should have been behind the experimental flag.
+        (Requested by pfeldman on #webkit).
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        * inspector/front-end/ProfileLauncherView.js:
+        (WebInspector.ProfileLauncherView):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.memory-blocks-list .item):
+
+2012-06-19  Hans Muller  <hmuller@adobe.com>
+
+        The CSS_WRAP_SHAPE CSSWrapShape::Type is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=89403
+
+        Reviewed by Eric Seidel.
+
+        Removed CSS_WRAP_SHAPE_PATH definition from CSSWrapShapes.h.
+        It's no longer required. This definition was never used or
+        tested, no new tests are required.
+
+        * css/CSSWrapShapes.h:
+
+2012-06-19  Ken Buchanan  <kenrb@chromium.org>
+
+        Absolute positioned objects should not be added to anonymous block lists
+        https://bugs.webkit.org/show_bug.cgi?id=87768
+
+        Reviewed by Abhishek Arya.
+
+        containingBlock() was returning an anonymous block for absolute
+        positioned objects under a relative positioned inline in the case
+        that the inline is split and the object is underneath the block
+        continuation. Anonymous blocks should never have anything in their
+        positioned object lists because they can be destroyed at any time
+        for a different reasons such as anonymous block merging, which is
+        a problem for layout if they have m_posChildNeedsLayout set.
+
+        This patch adds a generic check for anonymous blocks in
+        containingBlock() to correct this problem.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+
+2012-06-19  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: extensionPanel.onSearch `action` strings should be
+        enumerated.
+        https://bugs.webkit.org/show_bug.cgi?id=89509
+
+        Reviewed by Pavel Feldman.
+
+        Fixed LayoutTests/inspector/extensions/extensions-api-expected.txt
+        accordingly.
+
+        * inspector/front-end/ExtensionAPI.js:
+        (defineCommonExtensionSymbols):
+        (injectedExtensionAPI.Panels.prototype.setOpenResourceHandler):
+        (injectedExtensionAPI.Panels.prototype.get SearchAction):
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionPanel.prototype.searchCanceled):
+        (WebInspector.ExtensionPanel.prototype.performSearch):
+        (WebInspector.ExtensionPanel.prototype.jumpToNextSearchResult):
+        (WebInspector.ExtensionPanel.prototype.jumpToPreviousSearchResult):
+
+2012-06-19  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Add an allocation step for CCRenderer before drawing a frame
+        https://bugs.webkit.org/show_bug.cgi?id=88924
+
+        Reviewed by Adrienne Walker.
+
+        This step will be used to decide which RenderPass textures can be kept
+        alive and do not need to be drawn again.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore):
+        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
+        (WebCore::LayerRendererChromium::beginDrawingFrame):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRenderer):
+
+2012-06-19  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Create a shared object between FECustomFilter objects to store the shared resources
+        https://bugs.webkit.org/show_bug.cgi?id=87878
+
+        Reviewed by Dean Jackson.
+
+        An object called CustomFilterGlobalContext is created the first time a new FECustomFilter is needed in a document.
+        It is used to store the GraphicsContext3D needed to render the CSS Shaders. The context is shared by all the elements
+        in a document (no cross-domain).
+
+        More resources will be shared in following patches, including precompiled shaders and vertices/indices data.
+        https://bugs.webkit.org/show_bug.cgi?id=88427
+        https://bugs.webkit.org/show_bug.cgi?id=88429
+
+        The plan is to make CustomFilterGlobalContext and FECustomFilter (or a base class extracted out of it) usable from platform
+        code in the hardware accelerated compositing layer. The only dependency of the code is on the GraphicsContext3D.
+
+        No new tests. No functionality is changed yet, just added the new objects.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/CustomFilterGlobalContext.cpp: Added.
+        (WebCore):
+        (WebCore::CustomFilterGlobalContext::CustomFilterGlobalContext):
+        (WebCore::CustomFilterGlobalContext::~CustomFilterGlobalContext):
+        (WebCore::CustomFilterGlobalContext::prepareContextIfNeeded):
+        * platform/graphics/filters/CustomFilterGlobalContext.h: Added.
+        (WebCore):
+        (CustomFilterGlobalContext):
+        (WebCore::CustomFilterGlobalContext::context):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter): Changed to use the global context instead of the host window.
+        (WebCore::FECustomFilter::create):
+        (WebCore::FECustomFilter::initializeContext):
+        * platform/graphics/filters/FECustomFilter.h:
+        (WebCore):
+        (FECustomFilter):
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRenderer::build): Changed to initialize the global context if needed and pass it to the FECustomFilter.
+        * rendering/RenderView.cpp:
+        (WebCore):
+        (WebCore::RenderView::customFilterGlobalContext):
+        * rendering/RenderView.h:
+        (WebCore):
+        (RenderView):
+
+2012-06-19  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [cairo] Fix LayoutTests/fast/canvas/patternfill-repeat.html
+        https://bugs.webkit.org/show_bug.cgi?id=53085
+
+        Reviewed by Martin Robinson.
+
+        Clipping previously unlimited vertical and horizontal pattern repeats with
+        a clip rectangle similar to the Qt Graphics Context.
+
+        No new tests, this patch fixes
+        canvas/philip/tests/2d.pattern.paint.repeat* tests.
+
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::getPatternSpaceTransform): Adding constant getter method to be able to map to pattern space externally, needed by PlatformContextCairo::clipForPatternFilling.
+        * platform/graphics/cairo/PlatformContextCairo.cpp:
+        (WebCore::PlatformContextCairo::prepareForFilling):
+        (WebCore::PlatformContextCairo::clipForPatternFilling): Clip pattern repeats if needed.
+        * platform/graphics/cairo/PlatformContextCairo.h:
+
+2012-06-19  Hayato Ito  <hayato@chromium.org>
+
+        [Shadow DOM] An upper boundary breaks if a child node of an insertion point is clicked.
+        https://bugs.webkit.org/show_bug.cgi?id=89407
+
+        Reviewed by Dimitri Glazkov.
+
+        Update an event re-targeting algorithm so that it can set event's
+        target correctly when a fallback element in an insertion point is
+        clicked. To distinguish between distributed nodes and fallback
+        elements in an ancestor chain of composite shadow tree, an event
+        dispatcher checks explicitly whether a node is actually
+        distributed or assigned to the given insertion point.
+
+        Test: fast/dom/shadow/shadow-dom-event-dispatching.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::isAssignedTo):
+        (WebCore):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::InsertionPoint::contains):
+
+2012-06-19  Adrienne Walker  <enne@google.com>
+
+        Fix scrollbar layers being misplaced with a clipped owner layer
+        https://bugs.webkit.org/show_bug.cgi?id=89486
+
+        Reviewed by Simon Fraser.
+
+        Scrollbar layers are positioned relative to their parent layer. If
+        that parent gets clipped, then that positioning becomes incorrect and
+        scrollbars get positioned relative to the clipped bounds instead of
+        the full bounds. Fix by not clipping in this case.
+
+        Test: compositing/overflow/scrollbars-with-clipped-owner.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::shouldClipCompositedBounds):
+
+2012-06-19  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow][Editing] applying document.execCommand('bold') twice to elements having shadow insertion points causes a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=88502
+
+        Reviewed by Ryosuke Niwa.
+
+        When inserting or removing insertion points (<shadow> or <content>) into or from Shdaow DOM,
+        ElementShadow::invalidateDistribution() will be called immediately. It will remove all the renderers
+        of elements in the Shadow DOM. Since Node::rendererIsEditable() returns false when an renderer does not
+        exist, all the elements in the Shadow DOM will be considered as non-content-editable until recalculating
+        layout, though some of them may actually be content-editable.
+
+        Actually the current code does not recalculate layout inside editing command, so a disaster happens.
+        For example, performing an editing command quits before completing all the commands, because the command
+        thinks it is adding some elements to a non-content-editable element (but actually it's content-editable).
+
+        So we have to recalculate layout if necessary when checking an element is content-editable or not.
+        This can be achieved by using Node::isContentEditable() instead of Node::rendererIsEditable().
+
+        Test: editing/shadow/bold-twice-in-shadow.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        (WebCore::InsertNodeBeforeCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+
+2012-06-19  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r120744.
+        http://trac.webkit.org/changeset/120744
+        https://bugs.webkit.org/show_bug.cgi?id=89220
+
+        Broke build on Chromium Windows canary bots
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/mock/DeviceMotionClientMock.cpp: Removed.
+        * platform/mock/DeviceMotionClientMock.h: Removed.
+
+2012-06-18  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to look at disassembly
+        https://bugs.webkit.org/show_bug.cgi?id=89319
+
+        Reviewed by Sam Weinig.
+        
+        Just fixing EFL's build system now that JSC has a new directory.
+
+        * CMakeLists.txt:
+
+2012-06-19  Amy Ousterhout  <aousterh@chromium.org>
+
+        Adds DeviceMotionClientMock
+        https://bugs.webkit.org/show_bug.cgi?id=89220
+
+        Reviewed by Steve Block.
+
+        Adds DeviceMotionClientMock in WebCore to enable testing of DeviceMotion once it is fully implemented in WebKit.
+        This addition was originally included in https://bugs.webkit.org/show_bug.cgi?id=89197 but was split into a separate patch for easier review.
+
+        No new tests because DeviceMotionClientMock is designed to enable future testing and cannot be tested in itself.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/mock/DeviceMotionClientMock.cpp: Added.
+        (WebCore):
+        (WebCore::DeviceMotionClientMock::DeviceMotionClientMock):
+        (WebCore::DeviceMotionClientMock::setController):
+        (WebCore::DeviceMotionClientMock::startUpdating):
+        (WebCore::DeviceMotionClientMock::stopUpdating):
+        (WebCore::DeviceMotionClientMock::setMotion):
+        (WebCore::DeviceMotionClientMock::timerFired):
+        * platform/mock/DeviceMotionClientMock.h: Added.
+        (WebCore):
+        (DeviceMotionClientMock):
+        
+2012-06-19  Alexandre Elias  <aelias@google.com>
+
+        Fix link error with fillWithEmptyClients
+        https://bugs.webkit.org/show_bug.cgi?id=89484
+
+        Reviewed by Ryosuke Niwa.
+
+        fillWithEmptyClients() was within #if ENABLE() guard in the .cpp file
+        but not in the header.  There is now a caller unrelated to these ENABLEs
+        in WebHelperPluginImpl, so linking fails if both SVG and PAGE_POPUP
+        are disabled.
+
+        This function looks generic, so just remove the ENABLE guards.
+
+        No new tests. (Build fix.)
+
+        * loader/EmptyClients.cpp:
+        (WebCore::fillWithEmptyClients):
+
+2012-06-19  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderInline::willBeDestroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=89386
+
+        Reviewed by Julien Chaffraix.
+
+        We were unable to find the previous continuation during the process
+        of cleaning up empty anonymous block continuation. The reason being
+        that we were just looking till our immediate parent and ignoring the
+        fact that it can be enclosed in anonymous blocks. The change skips
+        over anonymous blocks in the parent chain.
+
+        Test: fullscreen/empty-anonymous-block-continuation-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+
+2012-06-19  Andreas Kling  <kling@webkit.org>
+
+        Remove the -webkit-match-nearest-mail-blockquote-color property.
+        <http://webkit.org/b/89480>
+
+        Reviewed by Antti Koivisto.
+
+        This property does nothing except taking up a bit on StyleRareNonInheritedData.
+        It's apparently famous for being the longest property name we support.
+        This passes the torch to -webkit-border-bottom-right-radius.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        (WebCore::isKeywordPropertyID):
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSValueKeywords.in:
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+        (StyleRareNonInheritedData):
+
+2012-06-19  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Animations continue to request frames after they have finished
+        https://bugs.webkit.org/show_bug.cgi?id=89483
+
+        Reviewed by Rob Buis.
+
+        Don't report that we have running animations if all the animations
+        are finished. This prevents unnecessary requesting of animation frames.
+        Internal PR165119
+        Internally Reviewed by Arvid Nilsson.
+
+        * platform/graphics/blackberry/LayerAnimation.cpp:
+        (WebCore::progress):
+        (WebCore::fetchIntervalEndpoints):
+        (WebCore::LayerAnimation::apply):
+        * platform/graphics/blackberry/LayerAnimation.h:
+        (WebCore::LayerAnimation::finished):
+        (WebCore::LayerAnimation::LayerAnimation):
+        (LayerAnimation):
+        * platform/graphics/blackberry/LayerCompositingThread.cpp:
+        (WebCore::LayerCompositingThread::updateAnimations):
+
+2012-06-19  Abhishek Arya  <inferno@chromium.org>
+
+        Wrong repaintContainerSkipped in RenderObject::container()
+        when positioned objects are enclosed in a <foreignObject>.
+        https://bugs.webkit.org/show_bug.cgi?id=89384
+
+        Reviewed by Simon Fraser.
+
+        No new tests. The bug was found in a code audit.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::container):
+
+2012-06-19  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in WebCore::RenderSVGModelObject::checkIntersection
+        https://bugs.webkit.org/show_bug.cgi?id=89059
+
+        Reviewed by Rob Buis.
+
+        getElementCTM updates layout causing the renderer to be destroyed. We get
+        the new renderer by storing the element pointer and later accessing it using
+        the element pointer.
+
+        Test: svg/custom/intersection-list-crash.svg
+
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::checkIntersection):
+        (WebCore::RenderSVGModelObject::checkEnclosure):
+
+2012-06-13  Eric Uhrhane  <ericu@chromium.org>
+
+        FileWriter progress events should be throttled to 50ms
+        https://bugs.webkit.org/show_bug.cgi?id=89022
+
+        Reviewed by Kent Tamura.
+
+        No new tests; existing tests validate our event sequences, and testing
+        timing is likely to be flaky.
+
+        * Modules/filesystem/FileWriter.cpp:
+        (WebCore):
+        (WebCore::FileWriter::FileWriter):
+        (WebCore::FileWriter::didWrite): Throttle sending progress events.
+        * Modules/filesystem/FileWriter.h:
+        (FileWriter): Add a variable that remembers when the last event was
+        sent.
+
+2012-06-19  Dan Bernstein  <mitz@apple.com>
+
+        WebCore part of: Paginated display API doesn’t allow setting the page progression direction
+        https://bugs.webkit.org/show_bug.cgi?id=89394
+
+        Reviewed by Darin Adler.
+
+        Updated fast/multicol/pagination-*.html.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::styleForDocument): Changed to handle the new Pagination::Mode enum
+        values and set the column progression in addition to the column axis.
+        * page/Page.h: Changed the Pagination::Mode enum values to ones that specify an axis and a
+        direction along that axis.
+        * testing/Internals.cpp:
+        (WebCore::Internals::setPagination): Changed to support the new Pagination::Mode enum values.
+
+2012-06-19  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Make RenderTableSection - nodeAtPoint and paintObject reuse spanning logic.
+        https://bugs.webkit.org/show_bug.cgi?id=88066
+
+        Reviewed by Julien Chaffraix.
+
+        Makes dirtiedRows and dirtiedColumns reuse spannedRows and spannedColumns
+        internally. This also changes their API to accept a damage-rect flipped 
+        by logicalRectForWritingModeAndDirection.
+
+        The generic code in spannedRows and spannedColumns solves a few FIXMEs 
+        surrounding RTL tables, which should improve performance.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::dirtiedRows):
+        (WebCore::RenderTableSection::dirtiedColumns):
+        (WebCore::RenderTableSection::paintObject):
+        * rendering/RenderTableSection.h:
+        (WebCore::CellSpan::start):
+        (WebCore::CellSpan::end):
+        (CellSpan):
+        (RenderTableSection):
+
+2012-06-19  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [JSC] Implement support for JSDictionary::convertValue(Vector<String>& result)
+        https://bugs.webkit.org/show_bug.cgi?id=89447
+
+        Reviewed by Adam Barth.
+
+        Add implementation for JSDictionary::convertValue(Vector<String>& result)
+        so that IDBDatabase::createObjectStore() compiles with JSC.
+
+        Tests: storage/indexeddb
+
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue):
+        (WebCore):
+        * bindings/js/JSDictionary.h:
+
+2012-06-19  Andy Estes  <aestes@apple.com>
+
+        [Mac] AudioFileReader::createBus() leaks an AudioBufferList if ExtAudioFileRead() returns an error
+        https://bugs.webkit.org/show_bug.cgi?id=89429
+
+        Reviewed by Darin Adler.
+
+        * platform/audio/mac/AudioFileReaderMac.cpp:
+        (WebCore::AudioFileReader::createBus): Call destroyAudioBufferList()
+        before returning if ExtAudioFileRead() returns an error.
+
+2012-06-19  Martin Robinson  <mrobinson@igalia.com>
+
+        2012-06-19  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the GTK+ build by adding some missing source files to the source list.
+
+        * GNUmakefile.list.am: WebGLDepthTexture.cpp/h to the source list.
+
+2012-06-19  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Remove the function ScriptDebugServer::supportsNativeBreakpoints()
+        https://bugs.webkit.org/show_bug.cgi?id=88759
+
+        Reviewed by Pavel Feldman.
+
+        Since both JSC and V8 support DOM breakpoint now, remove the conditional interface and related code.
+        So there is no new tests.
+
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/ScriptDebugServer.h:
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.wasShown):
+        (WebInspector.ElementsPanel.prototype._populateContextMenu):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._createTable):
+        (WebInspector.NetworkLogView.prototype.switchToDetailedView):
+        (WebInspector.NetworkLogView.prototype.switchToBriefView):
+        (WebInspector.NetworkDataGridNode.prototype.createCells):
+        (WebInspector.NetworkDataGridNode.prototype.refreshRequest):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.wasShown):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector.doLoadedDone):
+
+2012-06-19  Nikita Vasilyev  <me@elv1s.ru>
+
+        Web Inspector: Make text in WebSocket Frames tab selectable
+        https://bugs.webkit.org/show_bug.cgi?id=89307
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/ResourceWebSocketFrameView.js:
+        (WebInspector.ResourceWebSocketFrameView):
+        * inspector/front-end/networkPanel.css:
+        (.resource-websocket-frame-view):
+
+2012-06-19  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: Support 'Restart frame' in protocol and backend
+        https://bugs.webkit.org/show_bug.cgi?id=89147
+
+        Reviewed by Yury Semikhatsky.
+
+        Inspector.json got new command in Debugger domain.
+        A call path from InspectorDebuggerAgent to V8 Debug.LiveEdit.RestartFrame API
+        is built.
+        JSC implementation is a stub with fix me (40300). 
+
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::restart):
+        (WebCore):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore):
+        (WebCore::ScriptDebugServer::updateCallStack):
+        * bindings/js/ScriptDebugServer.h:
+        (ScriptDebugServer):
+        * bindings/v8/DebuggerScript.js:
+        (.):
+        * bindings/v8/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::restart):
+        (WebCore):
+        * bindings/v8/JavaScriptCallFrame.h:
+        (JavaScriptCallFrame):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore):
+        (WebCore::ScriptDebugServer::updateCallStack):
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        * bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp:
+        (WebCore::V8JavaScriptCallFrame::restartCallback):
+        (WebCore):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::restartFrame):
+        (WebCore):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InjectedScriptExterns.js:
+        (JavaScriptCallFrame.prototype.restart):
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::restartFrame):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        * inspector/JavaScriptCallFrame.idl:
+
+2012-06-19  Andrei Poenaru  <poenaru@adobe.com>
+
+        Replaced printf with fprintf in DEBUG_AUDIONODE_REFERENCES
+
+        Change printf to fprintf in DEBUG_AUDIONODE_REFERENCES
+        https://bugs.webkit.org/show_bug.cgi?id=86564
+
+        Reviewed by Csaba Osztrogonác.
+
+        There is no need for new tests: writing data to stderr, instead of stdout.
+
+        * Modules/webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::~AudioContext):
+        * Modules/webaudio/AudioNode.cpp:
+        (WebCore::AudioNode::~AudioNode):
+        (WebCore::AudioNode::ref):
+        (WebCore::AudioNode::finishDeref):
+        (WebCore::AudioNode::printNodeCounts):
+
+2012-06-19  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        [GTK] Assert failure in svg/batik/text/textDecoration.svg,textEffect3.svg for 64bit Debug bot
+        https://bugs.webkit.org/show_bug.cgi?id=89104
+
+        Reviewed by Nikolas Zimmermann.
+
+        Adding SVGInline to assertion to fix assertion failure. Same assertion was hit on Chromium.
+
+        Covered by existing tests
+        svg/batik/text/textDecoration.svg
+        svg/batik/text/textEffect3.svg
+        where the assertion failure was hit.
+
+        * rendering/svg/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::shouldTransformOnTextPainting):
+
+2012-06-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Buildfix for newer Qt5, use QPointer instead of the deprecated QWeakPointer.
+        https://bugs.webkit.org/show_bug.cgi?id=89449
+
+        Reviewed by Simon Hausmann.
+
+        * bridge/qt/qt_instance.h:
+        (QtInstance):
+        * bridge/qt/qt_runtime.h:
+        (QtField):
+        * platform/Widget.h:
+        (Widget):
+
+2012-06-19  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: FileSystem tree should hide uninitialized FileSystem
+        https://bugs.webkit.org/show_bug.cgi?id=88602
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: http/tests/inspector/filesystem/get-filesystem-root.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorFileSystemAgent::getFileSystemRoot):
+        * inspector/InspectorFileSystemAgent.h:
+        (InspectorFileSystemAgent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype._originAdded):
+        (WebInspector.FileSystemModel.prototype.refreshFileSystemList):
+        (WebInspector.FileSystemModel.prototype._gotFileSystem):
+        (WebInspector.FileSystemModel.FileSystem):
+        (WebInspector.FileSystemRequestManager):
+        (WebInspector.FileSystemRequestManager.prototype.getFileSystemRoot):
+        (WebInspector.FileSystemRequestManager.prototype._gotFileSystemRoot):
+        (WebInspector.FileSystemDispatcher.prototype.gotFileSystemRoot):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.FileSystemListTreeElement.prototype._fileSystemRemoved):
+
+2012-06-19  Mike West  <mkwst@chromium.org>
+
+        Introduce ENABLE_CSP_NEXT configuration flag.
+        https://bugs.webkit.org/show_bug.cgi?id=89300
+
+        Reviewed by Adam Barth.
+
+        The 1.0 draft of the Content Security Policy spec is just about to
+        move to Last Call. We'll hide work on the upcoming 1.1 spec behind
+        this ENABLE flag, disabled by default.
+
+        Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-06-19  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Make StylePropertySet::merge() always override on conflict
+        https://bugs.webkit.org/show_bug.cgi?id=89348
+
+        Reviewed by Ryosuke Niwa.
+
+        merge() was only used with argOverridesOnConflict = true, which
+        makes the extra parameter useless. It will also save a boolean check.
+
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::mergeAndOverrideOnConflict):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::overrideWithStyle):
+        (WebCore::styleFromMatchedRulesForElement):
+        (WebCore::EditingStyle::mergeStyleFromRules):
+        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):
+
+2012-06-19  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Move isKeyboardFocusable and isMouseFocusable to InputType from HTMLInputElement
+        https://bugs.webkit.org/show_bug.cgi?id=89425
+
+        Reviewed by Kent Tamura.
+
+        This patch moves implementation of HTMLInpueElement::isKeyboardFocusable
+        and isMouseFocusable to InputType class to allow each implementation
+        of InputType can decide focus-ability.
+
+        No new tests. This patch doesn't change behavior.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isKeyboardFocusable): Changed to call InputType::isKeyboardFocusable.
+        (WebCore::HTMLInputElement::isMouseFocusable): Changed to call InputType::isMouseFocusable.
+        (WebCore::HTMLInputElement::isTextFormControlFocusable): Added to allow InputType can call a method in HTMLTextFormControlElement.
+        (WebCore::HTMLInputElement::isTextFormControlKeyboardFocusable): Added to allow InputType can call a method in HTMLTextFormControlElement.
+        (WebCore::HTMLInputElement::isTextFormControlMouseFocusable): Added to allow InputType can call a method in HTMLTextFormControlElement.
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/InputType.cpp:
+        (WebCore::InputType::isKeyboardFocusable): Changed to call isTextFormControlKeyboardFocusable.
+        (WebCore::InputType::isMouseFocusable): Added for default method of derived InputType classes.
+        * html/InputType.h:
+        (InputType): Chagned signature of isKeyboardFocusable.
+        * html/RadioInputType.cpp:
+        (WebCore::RadioInputType::isKeyboardFocusable): Changed to call isTextFormControlKeyboardFocusable which was done in HTMLInputElement.
+        * html/RadioInputType.h:
+        (RadioInputType):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::isKeyboardFocusable): Moved implementation from HTMLInputElement.
+        (WebCore::TextFieldInputType::isMouseFocusable): Moved implementation from HTMLInputElement.
+        * html/TextFieldInputType.h:
+        (TextFieldInputType):
+
+2012-06-19  Sergio Villar Senin  <svillar@igalia.com>
+
+        Calling nativeImageForCurrentFrame() causes assertion failure: m_verifier.isSafeToUse()
+        https://bugs.webkit.org/show_bug.cgi?id=67582
+
+        Reviewed by David Levin.
+
+        Added a new synchronous method to the IconDatabase that returns a
+        native image for the platform instead of a WebCore::Image*.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::synchronousNativeIconForPageURL):
+        (WebCore):
+        * loader/icon/IconDatabase.h:
+        (IconDatabase):
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::synchronousNativeIconForPageURL):
+        (IconDatabaseBase):
+
+2012-06-19  Andy Estes  <aestes@apple.com>
+
+        [Mac] Use AutodrainedPool instead of NSAutoreleasePool in AudioBus::loadPlatformResource()
+        https://bugs.webkit.org/show_bug.cgi?id=89427
+
+        Reviewed by Dan Bernstein.
+
+        loadPlatformResource() called -[NSAutoreleasePool release] at each of
+        its exit points, which is not only an error-prone pattern but is
+        incorrect in garbage-collected environments. AutodrainedPool solves
+        both these problems by automatically calling -[NSAutoreleasePool drain]
+        when going out of scope.
+
+        * platform/audio/mac/AudioBusMac.mm:
+        (WebCore::AudioBus::loadPlatformResource):
+
+2012-06-19  Mike West  <mkwst@chromium.org>
+
+        Compilation failure in StyleResolver.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=89446
+
+        Reviewed by Ryosuke Niwa.
+
+        Adding 'CSSPropertyWebkitColumnProgression' to a switch statement from
+        which it was missing.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed build system fix after r120051.
+
+        * Target.pri:
+
+2012-06-19  Mike West  <mkwst@chromium.org>
+
+        Add a scheme registry for bypassing Content Security Policy.
+        https://bugs.webkit.org/show_bug.cgi?id=89373
+
+        Reviewed by Adam Barth.
+
+        The Content Security Policy specification notes that "Enforcing a CSP
+        policy should not interfere with the operation of user-supplied scripts
+        such as third-party user-agent add-ons and JavaScript bookmarklets."
+        (https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#processing-model)
+        This use case can be at least partially addressed by adding a scheme
+        registry for certain types of URLs whose resources should be loaded
+        regardless of a page's defined policy directives.
+
+        See http://crbug.com/133223 for additional context.
+
+        Test: http/tests/security/contentSecurityPolicy/register-bypassing-scheme.html
+
+        * WebCore.exp.in:
+            Exporting new symbols for use by Internals.
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::isAllowedByAllWithURL):
+            Adding a check against the new SchemeRegistry method to determine
+            whether or not we should proceed with checking the URL against the
+            policy.
+        * platform/SchemeRegistry.cpp:
+        (WebCore::CSPBypassingSchemes):
+        (WebCore):
+        (WebCore::SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy):
+        (WebCore::SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy):
+        (WebCore::SchemeRegistry::schemeShouldBypassContentSecurityPolicy):
+        * platform/SchemeRegistry.h:
+        (SchemeRegistry):
+            Adding the scheme registry for CSP-bypassing URL schemes.
+        * testing/Internals.cpp:
+        (WebCore):
+        (WebCore::Internals::registerURLSchemeAsBypassingContentSecurityPolicy):
+        (WebCore::Internals::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+            Adding a method to Internals so that we can write a layout test.
+
+2012-06-18  Andy Estes  <aestes@apple.com>
+
+        [Mac] Editor::fontAttributesForSelectionStart() leaks a NSShadow
+        https://bugs.webkit.org/show_bug.cgi?id=89424
+
+        Reviewed by Dan Bernstein.
+
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::fontAttributesForSelectionStart): Store the NSShadow
+        in a RetainPtr so that it's released before going out of scope.
+
+2012-06-18  Kent Tamura  <tkent@chromium.org>
+
+        Refactoring: Introduce a class to represent restoring state of a form control
+        https://bugs.webkit.org/show_bug.cgi?id=89412
+
+        Reviewed by Hajime Morita.
+
+        HTMLFormControlElementWithState::saveFormControlState had two return
+        values; One is a boolean to represent whether we should save the state
+        or not, and another is form control value. This patch introduces
+        FormControlState class representing these values.
+
+        We're going to extend FormControlState class so that it can contain
+        multiple strings to fix a FileInputType issue and it have another type
+        to fix Bug 89409.
+
+        No new tests. Just a refactoring.
+
+        * html/FormController.cpp:
+        (WebCore::FormController::formElementsState):
+        Gets a state string from a FormControlState instance.
+        (WebCore::FormController::takeStateForFormElement):
+        Creates a FormControlState instance with a state string.
+        * html/FormController.h:
+        (WebCore::FormControlState): Added.
+
+        * html/BaseCheckableInputType.cpp:
+        (WebCore::BaseCheckableInputType::saveFormControlState):
+        Use FormControlState class.
+        (WebCore::BaseCheckableInputType::restoreFormControlState): ditto.
+        * html/BaseCheckableInputType.h:
+        (BaseCheckableInputType): ditto.
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::saveFormControlState): ditto.
+        (WebCore::FileInputType::restoreFormControlState): ditto.
+        * html/FileInputType.h:
+        (FileInputType): ditto.
+        * html/HTMLFormControlElementWithState.cpp:
+        (WebCore::HTMLFormControlElementWithState::saveFormControlState): ditto.
+        (WebCore::HTMLFormControlElementWithState::finishParsingChildren): ditto.
+        * html/HTMLFormControlElementWithState.h:
+        (HTMLFormControlElementWithState): ditto.
+        (WebCore::HTMLFormControlElementWithState::restoreFormControlState): ditto.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::saveFormControlState): ditto.
+        (WebCore::HTMLInputElement::restoreFormControlState): ditto.
+        * html/HTMLInputElement.h:
+        (HTMLInputElement): ditto.
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::saveFormControlState): ditto.
+        (WebCore::HTMLSelectElement::restoreFormControlState): ditto.
+        * html/HTMLSelectElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::saveFormControlState): ditto.
+        (WebCore::HTMLTextAreaElement::restoreFormControlState): ditto.
+        * html/HTMLTextAreaElement.h:
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::saveFormControlState): ditto.
+        (WebCore::HiddenInputType::restoreFormControlState): ditto.
+        * html/HiddenInputType.h:
+        (HiddenInputType): ditto.
+        * html/InputType.cpp:
+        (WebCore::InputType::saveFormControlState): ditto.
+        (WebCore::InputType::restoreFormControlState): ditto.
+        * html/InputType.h:
+        (InputType): ditto.
+        * html/PasswordInputType.cpp:
+        (WebCore::PasswordInputType::saveFormControlState): ditto.
+        (WebCore::PasswordInputType::restoreFormControlState): ditto.
+        * html/PasswordInputType.h:
+        (PasswordInputType): ditto.
+
+2012-06-18  Joone Hur  <joone.hur@intel.com>
+
+        [EFL] Fontconfig can't be linked properly
+        https://bugs.webkit.org/show_bug.cgi?id=89418
+
+        Unreviewed build fix.
+
+        Make Fontconfig be linked correctly.
+
+        No new tests. This is only a build fix.
+
+        * PlatformEfl.cmake: add FONTCONFIG_LIBRARIES to WebCore_LIBRARIES.
+
+2012-06-18  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [Cairo] Fix memory leaks in GLContextGLX.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=89346
+
+        Reviewed by Martin Robinson.
+
+        Fix memory leaks found in GLContextGLX.cpp.
+
+        * platform/graphics/glx/GLContextGLX.cpp:
+        (WebCore::GLContextGLX::cleanupActiveContextsAtExit): Removing element reduces
+        size of the vector, so the loop termination condition was failing in the last
+        iteration, when the vector contains more than one element. This patch fixes the
+        issue by iterating the vector backwards, so the termination condition doesn't
+        fail until the size() reaches 0.
+        (WebCore::GLContextGLX::createPbufferContext): Delete GLXPbuffer
+        returned by glXCreatePbuffer().
+        (WebCore::GLContextGLX::createPixmapContext): Delete XVisualInfo
+        returned by glXChooseVisual().
+
+2012-06-18  Gregg Tavares  <gman@google.com>
+
+        Expose WEBGL_depth_texture extension to WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=87029
+        
+        Reviewed by Kenneth Russell.
+
+        Test: fast/canvas/webgl/webgl-depth-texture.html
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
+        * html/canvas/WebGLDepthTexture.cpp: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        (WebCore):
+        (WebCore::WebGLDepthTexture::WebGLDepthTexture):
+        (WebCore::WebGLDepthTexture::~WebGLDepthTexture):
+        (WebCore::WebGLDepthTexture::getName):
+        (WebCore::WebGLDepthTexture::create):
+        (WebCore::WebGLDepthTexture::supported):
+        * html/canvas/WebGLDepthTexture.h: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        (WebCore):
+        (WebGLDepthTexture):
+        * html/canvas/WebGLDepthTexture.idl: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        * html/canvas/WebGLExtension.h:
+        * html/canvas/WebGLFramebuffer.cpp:
+        (WebCore::WebGLFramebuffer::initializeAttachments):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::validateSettableTexFormat):
+        (WebCore::WebGLRenderingContext::copyTexImage2D):
+        (WebCore::WebGLRenderingContext::copyTexSubImage2D):
+        (WebCore::WebGLRenderingContext::generateMipmap):
+        (WebCore::WebGLRenderingContext::getExtension):
+        (WebCore::WebGLRenderingContext::getSupportedExtensions):
+        (WebCore::WebGLRenderingContext::texImage2DBase):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2DBase):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        (WebCore::WebGLRenderingContext::validateTexFuncFormatAndType):
+        (WebCore::WebGLRenderingContext::validateTexFuncParameters):
+        (WebCore::WebGLRenderingContext::validateTexFuncData):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore):
+        (WebGLRenderingContext):
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::getClearBitsByAttachmentType):
+        (WebCore):
+        (WebCore::GraphicsContext3D::getClearBitsByFormat):
+        * platform/graphics/GraphicsContext3D.h:
+
+2012-06-12  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Support File/DirectoryEntry access for <input type=file> if FileSystem API is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=88293
+
+        Reviewed by Tony Chang.
+
+        Proposal email on whatwg: http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-November/033814.html
+        Proposal draft: http://wiki.whatwg.org/wiki/DragAndDropEntries
+
+        Test: fast/forms/file/input-file-entries.html
+
+        * Modules/filesystem/HTMLInputElementFileSystem.cpp: Added.
+        * Modules/filesystem/HTMLInputElementFileSystem.h: Added.
+        * Modules/filesystem/HTMLInputElementFileSystem.idl: Added.
+        * WebCore.gypi:
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::receiveDroppedFiles): Retrieves dropped file
+        system Id if the given DragData has it.
+        (WebCore::FileInputType::droppedFileSystemId): Added. This returns
+        dropped file system Id retrieved in receiveDroppedFiles, or an empty
+        string if the platform does not support isolated file system for
+        dropped files.
+        * html/FileInputType.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::droppedFileSystemId): Added.
+        * html/HTMLInputElement.h:
+        * html/InputType.cpp:
+        (WebCore::InputType::droppedFileSystemId): Added.
+        * html/InputType.h:
+        * platform/DragData.cpp:
+        * platform/DragData.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::droppedFileSystemId): Added.
+
+2012-06-18  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Crash][Editing] VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries() crashes in some Shadow DOM case.
+        https://bugs.webkit.org/show_bug.cgi?id=88500
+
+        Reviewed by Ryosuke Niwa.
+
+        When selecting from a child of shadow host to an element in Shadow DOM, the start position of
+        Selection comes after the end position of Selection in some cases. This caused a crash.
+
+        For example, let's think '<div id="host">A</div>D' and host has a Shadow DOM whose innerHTML
+        is 'B<content></content>C'. When selecting from just after A (p1 = (PositionIsOffsetInAnchor,
+        #text, 1)) to just before B (p2 = (PositionIsOffsetInAnchor, shadowRoot, 0)), since
+        comparePosition always judge as p2 is before p1, m_start and m_end in VisibleSelection
+        will be p2 and p1 respectively.
+
+        However, the anchorNodes of p1 and p2 have the different tree scope, we have to adjust p2 to
+        the same tree scope as p1. Since p2 is m_start, m_start was adjusted to positionAfterNode(div).
+        This breaks the assumption that m_start is always before (or equal to) m_end.
+
+        This patch keeps the assumption. When we cannot move m_start to positionAfterNode(div),
+        we move m_start to positionBeforeNode(div). Note that we cannot always move m_start to
+        positionBeforeNode(div), because when selecting just after D (p3 = (PositionIsOffsetInAnchor,
+        D's parent, 2), we don't want to select A.
+
+        In this case, m_start should be adjusted to positionAfterNode(div).
+
+        Test: editing/shadow/breaking-editing-boundaries.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::adjustPositionForEnd):
+        (WebCore):
+        (WebCore::adjustPositionForStart):
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingShadowBoundaries):
+        * editing/VisibleSelection.h:
+        (VisibleSelection):
+
+2012-06-18  Mike Lawther  <mikelawther@chromium.org>
+
+        Crash when setting title dynamically
+        https://bugs.webkit.org/show_bug.cgi?id=88083
+
+        Reviewed by Dan Bernstein.
+
+        Test: fast/text/title-crash.html
+
+        The crashing code takes a rare branch in StyleResolver::styleForElement() where
+        m_parentStyle is set to point to m_style. Consequently, while applying properties
+        to m_style we end up mutating m_parentStyle.
+
+        In this situation, we clone style() and point m_parentStyle at the clone. The
+        clone is destroyed at the end of StyleResolver::styleForElement().
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-18  Adrienne Walker  <enne@google.com>
+
+        RenderLayerBacking sometimes doesn't attach scrollbars to graphics layer tree
+        https://bugs.webkit.org/show_bug.cgi?id=89402
+
+        Reviewed by James Robinson.
+
+        RenderLayerBacking only attaches scrollbar layers to the graphics
+        layer tree if there's a clip layer. This is wrong, because these
+        scrollbars become orphans and other code expects them to handle
+        repainting the scrollbars (which now become invisible). Fix by always
+        attaching scrollbar layers.
+
+        Test: compositing/overflow/image-load-overflow-scrollbars.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+
+2012-06-18  Amy Ousterhout  <aousterh@chromium.org>
+
+        [Chromium] DeviceOrientation Cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=89354
+
+        Reviewed by Kent Tamura.
+
+        No new tests because there is no intended change in behavior.
+
+        * platform/mock/DeviceOrientationClientMock.h: added OVERRIDE specifier for virtual functions
+        (DeviceOrientationClientMock):
+
+2012-06-18  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] media/video-seek-past-end-playing.html is flaky
+        https://bugs.webkit.org/show_bug.cgi?id=89301
+
+        Reviewed by Philippe Normand.
+
+        Switch to double for media duration and playback position
+        calculations to avoid precision problems.
+        This patch also removes the workaround for the precision
+        problem in didEnd() which is no longer needed.
+
+        Test: media/video-seek-past-end-playing.html
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
+        (WebCore::MediaPlayerPrivateGStreamer::duration):
+
+2012-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120593.
+        http://trac.webkit.org/changeset/120593
+        https://bugs.webkit.org/show_bug.cgi?id=89404
+
+        Caused failures in fast/forms/file/input-file-entries.html
+        (Requested by atwilson on #webkit).
+
+        * Modules/filesystem/DOMFileSystem.cpp:
+        (WebCore::DOMFileSystem::createIsolatedFileSystem):
+        * Modules/filesystem/HTMLInputElementFileSystem.cpp: Removed.
+        * Modules/filesystem/HTMLInputElementFileSystem.h: Removed.
+        * Modules/filesystem/HTMLInputElementFileSystem.idl: Removed.
+        * WebCore.gypi:
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::receiveDroppedFiles):
+        * html/FileInputType.h:
+        (FileInputType):
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/InputType.cpp:
+        * html/InputType.h:
+        (InputType):
+        * platform/DragData.cpp:
+        (WebCore::DragData::modifierKeyState):
+        (WebCore):
+        * platform/DragData.h:
+        (DragData):
+        * platform/chromium/DragDataChromium.cpp:
+
+2012-06-14  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use WebImageLayer in GraphicsLayerChromium for image layers
+        https://bugs.webkit.org/show_bug.cgi?id=89150
+
+        Reviewed by Adrienne Walker.
+
+        Uses WebImageLayer instead of ImageLayerChromium for GraphicsLayerChromium::setContentsToImage.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsToImage):
+
+2012-06-14  James Robinson  <jamesr@chromium.org>
+
+        [chromium] GraphicsLayerChromium should use WebContentLayer directly
+        https://bugs.webkit.org/show_bug.cgi?id=89145
+
+        Reviewed by Adrienne Walker.
+
+        Ports GraphicsLayerChromium (or more specifically OpaqueRectTrackingContentLayerDelegate) to implement
+        WebContentLayerClient instead of ContentLayerDelegate. In addition to the mechanical changes, this requires
+        eagerly setting drawsContent on GraphicsLayerChromium::m_layer since WebContentLayerImpl's default value is
+        different from LayerChromium's. Covered by all of compositing/
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
+        (OpaqueRectTrackingContentLayerDelegate):
+
+2012-06-18  David Barr  <davidbarr@chromium.org>
+
+        Add from-image to css3-images image-resolution
+        https://bugs.webkit.org/show_bug.cgi?id=85451
+
+        Reviewed by Tony Chang.
+
+        The css3-images module is at candidate recommendation.
+        http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-resolution
+
+        No new tests; extended fast/css/image-resolution/image-resolution.html
+
+        * css/CSSParser.cpp: Accept from-image identifier in image-resolution property.
+        (WebCore::CSSParser::parseImageResolution): Map CSSValueFromImage to identifier value from cssValuePool.
+        * css/CSSValueKeywords.in: Add from-image.
+        * css/StyleBuilder.cpp: Extend ApplyPropertyImageResolution to apply RenderStyle::imageResolutionSource.
+        (WebCore::ApplyPropertyImageResolution::applyInheritValue): Apply RenderStyle::imageResolutionSource.
+        (WebCore::ApplyPropertyImageResolution::applyInitialValue): Apply RenderStyle::imageResolutionSource.
+        (WebCore::ApplyPropertyImageResolution::applyValue): Map CSSValueFromImage to ImageResolutionFromImage.
+        * rendering/RenderImage.cpp: Extend conditions for recalculation of intrinsic size.
+        (WebCore::RenderImage::styleDidChange): Update intrinsic size if RenderStyle::imageResolutionSource() has changed.
+        * rendering/style/RenderStyle.cpp: Include StyleRareInheritedData::m_imageResolutionSource in style diff.
+        (WebCore::RenderStyle::diff): Map change in StyleRareInheritedData::m_imageResolutionSource to StyleDifferenceLayout.
+        * rendering/style/RenderStyle.h: Add RenderStyle::imageResolutionSource, RenderStyle::setImageResolutionSource, RenderStyle::initialImageResolutionSource.
+        * rendering/style/RenderStyleConstants.h: Add enum ImageResolutionSource.
+        * rendering/style/StyleRareInheritedData.cpp: Add StyleRareInheritedData::m_imageResolutionSource.
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData): Add m_imageResolutionSource to default and copy constructor.
+        (WebCore::StyleRareInheritedData::operator==): Include m_imageResolutionSource in comparison.
+        * rendering/style/StyleRareInheritedData.h: Add StyleRareInheritedData::m_imageResolutionSource.
+        (StyleRareInheritedData): Add 1-bit field StyleRareInheritedData::m_imageResolutionSource.
+
+2012-06-18  James Robinson  <jamesr@chromium.org>
+
+        [chromium] REGRESSION(r120346) ContentLayerPainter should clear rect to be painted
+        https://bugs.webkit.org/show_bug.cgi?id=89376
+
+        Reviewed by Adrienne Walker.
+
+        In r120346, a refactor moved a clearRect()/clip() call from ContentLayerPainter - which all
+        ContentLayerChromiums use - out to OpaqueRectTrackingContentLayerDelegate - which all GraphicsLayerChromium
+        backed layers use, but which callers using WebContentLayer directly do not use. This meant that the canvas
+        wasn't cleared/clipped as WebContentLayerClient.h claimed it would be. This moves the clear and the clip
+        into CanvasLayerTextureUpdater which all paths use, including layers that don't use the ContentLayerPainter.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerPainter::paint):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+
+2012-06-18  Igor Oliveira  <igor.o@sisa.samsung.com>
+
+        Unreviewed, rolling out r120119.
+        http://trac.webkit.org/changeset/120119
+
+        Multiple regressions on ClusterFuzz
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimations):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::cancelAnimations):
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::pauseAnimation):
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+        (WebCore::KeyframeAnimation::pauseAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetterStyle):
+        (WebCore::RenderBlock::createFirstLetterRenderer):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        (RenderObject):
+
+2012-06-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r118414): some pages on concursolutions.com doesn't show up
+        https://bugs.webkit.org/show_bug.cgi?id=89399
+
+        Reviewed by Adam Barth.
+
+        The bug was caused by insertAdjacentHTML's not passing context element to createFragmentForInnerOuterHTML.
+
+        Test: fast/html/adjacent-html-context-element.html
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::insertAdjacentHTML):
+
+2012-06-18  Zhenyao Mo  <zmo@google.com>
+
+        Fix framebuffer-object-attachment.html failures
+        https://bugs.webkit.org/show_bug.cgi?id=89387
+
+        Reviewed by Kenneth Russell.
+
+        * html/canvas/WebGLFramebuffer.cpp: fix detachment behavior with depth/stencil/depth_stencil conflicts
+        (WebCore::WebGLFramebuffer::setAttachmentForBoundFramebuffer):
+        (WebCore::WebGLFramebuffer::removeAttachmentFromBoundFramebuffer):
+        * html/canvas/WebGLFramebuffer.h:
+        (WebGLFramebuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer): move logic to WebGLFramebuffer
+        (WebCore::WebGLRenderingContext::framebufferTexture2D): Ditto.
+        (WebCore::WebGLRenderingContext::getParameter): Correct the wrong assumption that it's always checking the drawingbuffer's DEPTH_BITS/STENCIL_BITS
+        * html/canvas/WebGLRenderingContext.h:
+        (WebGLRenderingContext):
+
+2012-06-18  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure that skipping frames during an accelerated animation doesn't cause starvation
+        https://bugs.webkit.org/show_bug.cgi?id=87766
+
+        Reviewed by James Robinson.
+
+        Unit tests:
+            CCLayerTreeHostTestCheckerboardDoesNotStarveDraws.runMultiThread
+            CCSchedulerStateMachineTest.TestFailedDrawsWillEventuallyForceADrawAfterTheNextCommit
+
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::CCSchedulerStateMachine):
+        (WebCore::CCSchedulerStateMachine::updateState):
+        (WebCore::CCSchedulerStateMachine::didDrawIfPossibleCompleted):
+        (WebCore::CCSchedulerStateMachine::setMaximumNumberOfFailedDrawsBeforeDrawIsForced):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        (CCSchedulerStateMachine):
+
 2012-06-18  Nico Weber  <thakis@chromium.org>
 
         [chromium/mac] Unbreak smooth scrolling.