Merge 123798 - Guard Prerenderer against inserting prerenders into detached documents.

Source/WebCore/ChangeLog

Index: Source/WebCore/ChangeLog
===================================================================
--- Source/WebCore/ChangeLog	(revision 124493)
+++ Source/WebCore/ChangeLog	(working copy)
@@ -1,3 +1,7230 @@
+2012-07-26  Gavin Peters  <gavinp@chromium.org>
+
+        Guard Prerenderer against inserting prerenders into detached documents.
+        https://bugs.webkit.org/show_bug.cgi?id=92401
+
+        Reviewed by Adam Barth.
+
+        If the document is detached, we should not launch a prerender.
+
+        Test: fast/dom/HTMLLinkElement/prerender-insert-after-stop.html
+
+        * loader/Prerenderer.cpp:
+        (WebCore::Prerenderer::render):
+
+2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123525.
+        http://trac.webkit.org/changeset/123525
+        https://bugs.webkit.org/show_bug.cgi?id=92421
+
+        it needed to be rolled out after r123779 too (Requested by
+        jchaffraix on #webkit).
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::insertChildNode):
+
+2012-07-26  Pravin D  <pravind.2k4@gmail.com>
+
+        Outline is always painted on the first table row regardless of the row it's set on
+        https://bugs.webkit.org/show_bug.cgi?id=92389
+
+        Reviewed by Eric Seidel.
+
+        The outlines of all the rows are drawn on the row instead of their respective rows.
+        The paint offset for the outlines does not take the row location into account.
+
+        Test: fast/table/table-row-outline-paint.html
+
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::paintOutlineForRowIfNeeded):
+        The row's location is taken into account for calculating the correct paint offset
+        for its outline.
+
+2012-07-26  Antoine Labour  <piman@chromium.org>
+
+        [chromium] Combine color matrix filters and apply them in a single pass.
+        https://bugs.webkit.org/show_bug.cgi?id=92059
+
+        Reviewed by Stephen White.
+
+        Sequential color matrix filters can easily be combined, by simply
+        multiplying the color matrices and applying it in a single pass. This
+        helps dramatically with performance (bandwidth savings by avoiding extra
+        copy & clear, also saves fragment shader processing).
+
+        Covered by css3/filters layout tests, added effect-brightness-clamping
+        and effect-brightness-clamping-hw.
+
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+        (WebCore::CCRenderSurfaceFilters::apply):
+
+2012-07-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Href attribute with javascript protocol is stripped when content is pasted into a XML doucment
+        https://bugs.webkit.org/show_bug.cgi?id=92310
+
+        Reviewed by Adam Barth.
+
+        The bug was caused by setAttributeNS's stripping attributes for which isAttributeToRemove
+        return true instead of setting an empty string. Changing this in setAttributeNS is problematic
+        because it will trigger a logic, in HTMLAnchorElement for example, to resolve the URL.
+
+        Fixed the bug by making XML parsers call parserSetAttributes instead of setAttributeNS.
+        After this patch, handleNamespaceAttributes and handleElementAttributes simply fills up a Vector
+        with which startElementNs (or parseStartElement in Qt) calls parserSetAttributes.
+
+        * dom/Element.cpp:
+        (WebCore::Element::parserSetAttributes): Sets emptyAtom instead of nullAtom as nullAtom can be
+        turned into "null".
+        (WebCore::Element::parseAttributeName): Extracted from setAttributeNS.
+        (WebCore::Element::setAttributeNS): No longer takes FragmentScriptingPermission.
+        * dom/Element.h:
+        (Element):
+        * editing/markup.cpp:
+        (WebCore::completeURLs): Don't resolve URLs when it's empty since empty attribute has a canonical
+        meaning in some cases. e.g. <frame src=""></iframe>
+        * xml/parser/XMLDocumentParserLibxml2.cpp:
+        (WebCore::handleNamespaceAttributes): Renamed from handleElementNamespaces. Call
+        parserSetAttributes even when exiting early to be maintain the same behavior.
+        (WebCore::handleElementAttributes):
+        (WebCore::XMLDocumentParser::startElementNs):
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::handleNamespaceAttributes): Use XMLNSNames::xmlnsNamespaceURI. Call parserSetAttributes
+        even when exiting early to be maintain the same behavior.
+        (WebCore::handleElementAttributes):
+        (WebCore::XMLDocumentParser::parseStartElement):
+
+2012-07-26  Dan Bernstein  <mitz@apple.com>
+
+        <svg> element with no intrinsic size and max-width gets sized incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=92410
+
+        Reviewed by Dean Jackson.
+
+        Test: svg/css/max-width-2.html
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computeReplacedLogicalWidth): The rule for computing the width for
+        elements whose computed width and height are both auto and which have no intrinsic size, but
+        have an intrinsic ratio was applied only to elements with a content renderer (such as <img>
+        with an SVG source). Removed the requirement to have a content renderer, so that it will
+        apply to all elements including <svg>.
+
+2012-07-26  Tony Chang  <tony@chromium.org>
+
+        Regression: r123696 made css3/flexbox tests failing
+        https://bugs.webkit.org/show_bug.cgi?id=92352
+
+        Reviewed by Levi Weintraub.
+
+        Use roundedLayoutUnit so ports without subpixel layout still pass existing tests.
+
+        Covered by css3/flexbox/flex-algorithm-min-max.html which should pass again.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
+
+2012-07-26  Emil A Eklund  <eae@chromium.org>
+
+        Contained div with right 0 sometimes overlaps parent div
+        https://bugs.webkit.org/show_bug.cgi?id=91521
+
+        Reviewed by Levi Weintraub.
+
+        Due to unnecessary rounding in clientLogicalWidth and clientLogicalHeight
+        we lost precision when computing the width and position of render boxes.
+        Change clientLogicalWidth/Height to return values with subpixel precision
+        to avoid this.
+
+        Test: fast/sub-pixel/position-right-aligns-with-container.html
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::clientLogicalWidth):
+        (WebCore::RenderBox::clientLogicalHeight):
+        Remove unnecessary rounding.
+
+2012-07-26  Chang Shu  <cshu@webkit.org>
+
+        Build broken when svg is disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=92393.
+
+        Reviewed by Laszlo Gombos.
+
+        Need to surpress unused parameters warning.
+
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRenderer::buildReferenceFilter):
+
+2012-07-25  Jer Noble  <jer.noble@apple.com>
+
+        Add diagnostic messages when media and plugins load or fail to load.
+        https://bugs.webkit.org/show_bug.cgi?id=92341
+
+        Reviewed by Anders Carlsson.
+
+        Send diagnostic messages when a media or plugin element loads or fails to load. Include in
+        the trace the media engine description, error code, or plugin mime type.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget): Send a diagnostic message.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::stringForNetworkState): Added convenience function to stringify network states.
+        (WebCore::HTMLMediaElement::mediaLoadingFailed): Send a diagnostic message.
+        (WebCore::HTMLMediaElement::setReadyState): Send a diagnostic message.
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget): Send a diagnostic message.
+
+2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123159, r123165, r123168, r123492,
+        and r123650.
+        http://trac.webkit.org/changeset/123159
+        http://trac.webkit.org/changeset/123165
+        http://trac.webkit.org/changeset/123168
+        http://trac.webkit.org/changeset/123492
+        http://trac.webkit.org/changeset/123650
+        https://bugs.webkit.org/show_bug.cgi?id=92406
+
+        allowing inline-table anonymous wrappers is a bad idea due to
+        tons of corner cases that should be properly handled
+        (Requested by jchaffraix on #webkit).
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::createAnonymousWithParentRenderer):
+
+2012-07-26  Jer Noble  <jer.noble@apple.com>
+
+        Add a ChromeClient method to send diagnostic logging messages from WebCore to the client.
+        https://bugs.webkit.org/show_bug.cgi?id=92340
+
+        Reviewed by Anders Carlsson.
+
+        Add a new ChromeClient menthod, to be implemented by WebKit and WebKit2, which sends
+        a diagnostic logging message up to the client.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::logDiagnosticMessage):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::logDiagnosticMessage):
+        (ChromeClient):
+        * page/DiagnosticLoggingKeys.cpp: Added.
+        (WebCore::DiagnosticLoggingKeys::mediaLoadedKey):
+        (WebCore::DiagnosticLoggingKeys::mediaLoadingFailedKey):
+        (WebCore::DiagnosticLoggingKeys::pluginLoadedKey):
+        (WebCore::DiagnosticLoggingKeys::pluginLoadingFailedKey):
+        (WebCore::DiagnosticLoggingKeys::passKey):
+        (WebCore::DiagnosticLoggingKeys::failKey):
+        (WebCore::DiagnosticLoggingKeys::noopKey):
+        * page/DiagnosticLoggingKeys.h: Added.
+        (DiagnosticLoggingKeys):
+
+        Add the new files DiagnosticLoggingKeys.cpp,h to the project:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-07-25  Jer Noble  <jer.noble@apple.com>
+
+        Add setting to enable and disable diagnostic logging.
+        https://bugs.webkit.org/show_bug.cgi?id=92337
+
+        Reviewed by Anders Carlsson.
+
+        Add a new entry in Settings, defaulting to false.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Default the new setting to false.
+        * page/Settings.h:
+        (WebCore::Settings::setDiagnosticLoggingEnabled): Simple accessor.
+        (WebCore::Settings::diagnosticLoggingEnabled): Ditto.
+
+2012-07-26  Olivier Blin  <olivier.blin@softathome.com>
+
+        Add FastMalloc statistics in window.internals
+        https://bugs.webkit.org/show_bug.cgi?id=91274
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: fast/harness/fastmallocstatistics-object.html
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCoreTestSupport.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * testing/FastMallocStatistics.h: Added.
+        (WebCore):
+        (FastMallocStatistics):
+        (WebCore::FastMallocStatistics::create):
+        (WebCore::FastMallocStatistics::reservedVMBytes):
+        (WebCore::FastMallocStatistics::committedVMBytes):
+        (WebCore::FastMallocStatistics::freeListBytes):
+        (WebCore::FastMallocStatistics::FastMallocStatistics):
+        * testing/FastMallocStatistics.idl: Added.
+        * testing/Internals.cpp:
+        (WebCore::Internals::fastMallocStatistics):
+        (WebCore):
+        * testing/Internals.h:
+        (WebCore):
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-26  Adrienne Walker  <enne@google.com>
+
+        [chromium] Remove redundant surface origin transforms
+        https://bugs.webkit.org/show_bug.cgi?id=91815
+
+        Reviewed by Stephen White.
+
+        Bug 91417 changed draw transforms to become equivalent to origin
+        transforms for surfaces. This change removes them as they are no
+        longer needed for anything.
+
+        No new tests. Just a refactoring.
+
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (RenderSurfaceChromium):
+        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
+        (WebCore::CCDamageTracker::extendDamageForRenderSurface):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::computeScrollCompensationMatrixForChildren):
+        (WebCore::calculateDrawTransformsInternal):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::leaveToRenderTarget):
+        (WebCore::::unoccludedContributingSurfaceContentRect):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
+        (WebCore::CCRenderPassDrawQuad::create):
+        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
+        (CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::createSharedQuadState):
+        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
+        (WebCore::CCRenderSurface::appendQuads):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (CCRenderSurface):
+
+2012-07-25  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: simplify handling of status bar items
+        https://bugs.webkit.org/show_bug.cgi?id=92143
+
+        Reviewed by Pavel Feldman.
+
+        - split status bars into "global" (always in the bottom) and "panel"
+            (on top of the drawer when drawer is shown)
+        - use "inner" status bar section in global status bar to display either
+            panel status bar items or drawer view items (depending on drawer visibility)
+        - let panels/views manage their counters as part of their status bar
+            items, not through special interface members;
+        - get rid of absolute positioning in the status bars where possible;
+
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView.prototype.get statusBarItems):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.wasShown):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.willHide):
+        * inspector/front-end/elementsPanel.css:
+        (.crumbs):
+        * inspector/front-end/inspector.css:
+        (#main):
+        (body.drawer-visible #main-panels):
+        (.status-bar):
+        (.status-bar-item):
+        (#panel-status-bar-placeholder):
+        (body.drawer-visible #panel-status-bar-placeholder):
+        (#panel-status-bar-resizer):
+        (#panel-status-bar):
+        (#panel-status-bar > div):
+        (#error-warning-count):
+        (#drawer):
+        (#drawer-contents):
+        (.status-bar-items):
+        (.drawer-header):
+        (#inner-status-bar):
+        (.search-status-bar-item):
+        (.search-status-bar-message):
+        (.search-status-bar-progress):
+        (body:not(.platform-mac) .search-status-bar-progress):
+        (body.platform-mac .search-status-bar-progress):
+        (.search-status-bar-stop-button-item):
+        (.search-status-bar-stop-button .glyph):
+        (.search-results-status-bar-message):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createGlobalStatusBarItems):
+        (WebInspector.showViewInDrawer):
+        (WebInspector._closePreviousDrawerView):
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-records-counter):
+
+2012-07-26  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Implement Network Information provider
+        https://bugs.webkit.org/show_bug.cgi?id=92343
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved Network Information provider code from WebKit1
+        to WebCore so that it can be shared with WebKit2.
+
+        No new tests, no behavior change.
+
+        * PlatformEfl.cmake:
+        * platform/efl/NetworkInfoProviderEfl.cpp: Copied from Source/WebKit/efl/WebCoreSupport/NetworkInfoClientEfl.cpp.
+        (WebCore):
+        (WebCore::NetworkInfoProviderEfl::NetworkInfoProviderEfl):
+        (WebCore::NetworkInfoProviderEfl::startUpdating):
+        (WebCore::NetworkInfoProviderEfl::stopUpdating):
+        (WebCore::NetworkInfoProviderEfl::bandwidth):
+        * platform/efl/NetworkInfoProviderEfl.h: Added.
+        (WebCore):
+        (NetworkInfoProviderEfl):
+
+2012-07-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: SASS source mapping straw man (behind experiment)
+        https://bugs.webkit.org/show_bug.cgi?id=92265
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change introduces SASS mapping support (behind the experiment).
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel):
+        (WebInspector.CSSStyleModel.prototype.resourceBinding):
+        (WebInspector.CSSStyleModel.prototype.setSourceMapping):
+        (WebInspector.CSSStyleModel.prototype.resetSourceMappings):
+        (WebInspector.CSSStyleModel.prototype._rawLocationToUILocation):
+        (WebInspector.CSSLocation):
+        (WebInspector.CSSRule):
+        (WebInspector.CSSRule.prototype.get isRegular):
+        (WebInspector.CSSRule.prototype.uiLocation):
+        * inspector/front-end/ContentProviders.js:
+        (WebInspector.StaticContentProvider.prototype.contentType):
+        * inspector/front-end/SASSSourceMapping.js: Added.
+        (WebInspector.SASSSourceMapping):
+        (WebInspector.SASSSourceMapping.prototype._populate):
+        (WebInspector.SASSSourceMapping.prototype._resourceAdded.didRequestContent):
+        (WebInspector.SASSSourceMapping.prototype._resourceAdded):
+        (rawLocationToUILocation):
+        (uiLocationToRawLocation):
+        (uiSourceCodes):
+        (reset):
+        (WebInspector.SASSSource):
+        (WebInspector.SASSSource.prototype.isEditable):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StylesUISourceCodeProvider):
+        (WebInspector.StylesUISourceCodeProvider.prototype.rawLocationToUILocation):
+        (WebInspector.StylesUISourceCodeProvider.prototype.uiLocationToRawLocation):
+        (WebInspector.StylesUISourceCodeProvider.prototype._resourceAdded):
+        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UILocation.prototype.uiLocationToRawLocation):
+        (WebInspector.UILocation.prototype.url):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.Workspace):
+        * inspector/front-end/inspector.html:
+
+2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed r123761 follow-up, inspector closure compilation fix.
+
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.Location.prototype.uiLocation):
+        * inspector/front-end/ScriptSnippetModel.js:
+
+2012-07-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
+        https://bugs.webkit.org/show_bug.cgi?id=92113
+
+        Reviewed by Simon Hausmann.
+
+        Cleanup the definition of the two methods across different ports and
+        replace the calls to them with LocalWindowsContext where possible.
+
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintThumb):
+
+2012-07-27 Chris Fleizach <cfleizach@apple.com>
+
+        WebKit should expose @title as label (AXTitle or AXDescription) sometimes instead of AXHelp, according to the ARIA text alt computation
+        https://bugs.webkit.org/show_bug.cgi?id=91911
+
+        Reviewed by Anders Carlsson.
+
+        The ARIA spec states that the title attribute should be used as the last resort for a description of an element. WebKit needs to honor that.
+
+        Test: platform/mac/accessibility/title-attribute-used-as-last-resort.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::helpText):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+
+2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed r123761 follow-up, inspector closure compilation fix.
+
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.Location.prototype.uiLocation):
+        * inspector/front-end/ScriptSnippetModel.js:
+
+2012-07-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
+        https://bugs.webkit.org/show_bug.cgi?id=92113
+
+        Reviewed by Simon Hausmann.
+
+        Cleanup the definition of the two methods across different ports and
+        replace the calls to them with LocalWindowsContext where possible.
+
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintThumb):
+
+2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed r123761 follow-up, inspector closure compilation fix.
+
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.Location.prototype.uiLocation):
+        * inspector/front-end/ScriptSnippetModel.js:
+
+2012-07-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
+        https://bugs.webkit.org/show_bug.cgi?id=92113
+
+        Reviewed by Simon Hausmann.
+
+        Cleanup the definition of the two methods across different ports and
+        replace the calls to them with LocalWindowsContext where possible.
+
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintThumb):
+
+2012-07-26  Olivier Blin  <olivier.blin@softathome.com>
+
+        Add FastMalloc statistics in window.internals
+        https://bugs.webkit.org/show_bug.cgi?id=91274
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: fast/harness/fastmallocstatistics-object.html
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCoreTestSupport.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * testing/FastMallocStatistics.h: Added.
+        (WebCore):
+        (FastMallocStatistics):
+        (WebCore::FastMallocStatistics::create):
+        (WebCore::FastMallocStatistics::reservedVMBytes):
+        (WebCore::FastMallocStatistics::committedVMBytes):
+        (WebCore::FastMallocStatistics::freeListBytes):
+        (WebCore::FastMallocStatistics::FastMallocStatistics):
+        * testing/FastMallocStatistics.idl: Added.
+        * testing/Internals.cpp:
+        (WebCore::Internals::fastMallocStatistics):
+        (WebCore):
+        * testing/Internals.h:
+        (WebCore):
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-26  Adrienne Walker  <enne@google.com>
+
+        [chromium] Remove redundant surface origin transforms
+        https://bugs.webkit.org/show_bug.cgi?id=91815
+
+        Reviewed by Stephen White.
+
+        Bug 91417 changed draw transforms to become equivalent to origin
+        transforms for surfaces. This change removes them as they are no
+        longer needed for anything.
+
+        No new tests. Just a refactoring.
+
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (RenderSurfaceChromium):
+        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
+        (WebCore::CCDamageTracker::extendDamageForRenderSurface):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::computeScrollCompensationMatrixForChildren):
+        (WebCore::calculateDrawTransformsInternal):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::leaveToRenderTarget):
+        (WebCore::::unoccludedContributingSurfaceContentRect):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
+        (WebCore::CCRenderPassDrawQuad::create):
+        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
+        (CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::createSharedQuadState):
+        (WebCore::CCRenderSurface::createReplicaSharedQuadState):
+        (WebCore::CCRenderSurface::appendQuads):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (CCRenderSurface):
+
+2012-07-25  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: simplify handling of status bar items
+        https://bugs.webkit.org/show_bug.cgi?id=92143
+
+        Reviewed by Pavel Feldman.
+
+        - split status bars into "global" (always in the bottom) and "panel"
+            (on top of the drawer when drawer is shown)
+        - use "inner" status bar section in global status bar to display either
+            panel status bar items or drawer view items (depending on drawer visibility)
+        - let panels/views manage their counters as part of their status bar
+            items, not through special interface members;
+        - get rid of absolute positioning in the status bars where possible;
+
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView.prototype.get statusBarItems):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.wasShown):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.willHide):
+        * inspector/front-end/elementsPanel.css:
+        (.crumbs):
+        * inspector/front-end/inspector.css:
+        (#main):
+        (body.drawer-visible #main-panels):
+        (.status-bar):
+        (.status-bar-item):
+        (#panel-status-bar-placeholder):
+        (body.drawer-visible #panel-status-bar-placeholder):
+        (#panel-status-bar-resizer):
+        (#panel-status-bar):
+        (#panel-status-bar > div):
+        (#error-warning-count):
+        (#drawer):
+        (#drawer-contents):
+        (.status-bar-items):
+        (.drawer-header):
+        (#inner-status-bar):
+        (.search-status-bar-item):
+        (.search-status-bar-message):
+        (.search-status-bar-progress):
+        (body:not(.platform-mac) .search-status-bar-progress):
+        (body.platform-mac .search-status-bar-progress):
+        (.search-status-bar-stop-button-item):
+        (.search-status-bar-stop-button .glyph):
+        (.search-results-status-bar-message):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createGlobalStatusBarItems):
+        (WebInspector.showViewInDrawer):
+        (WebInspector._closePreviousDrawerView):
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-records-counter):
+
+2012-07-26  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Implement Network Information provider
+        https://bugs.webkit.org/show_bug.cgi?id=92343
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved Network Information provider code from WebKit1
+        to WebCore so that it can be shared with WebKit2.
+
+        No new tests, no behavior change.
+
+        * PlatformEfl.cmake:
+        * platform/efl/NetworkInfoProviderEfl.cpp: Copied from Source/WebKit/efl/WebCoreSupport/NetworkInfoClientEfl.cpp.
+        (WebCore):
+        (WebCore::NetworkInfoProviderEfl::NetworkInfoProviderEfl):
+        (WebCore::NetworkInfoProviderEfl::startUpdating):
+        (WebCore::NetworkInfoProviderEfl::stopUpdating):
+        (WebCore::NetworkInfoProviderEfl::bandwidth):
+        * platform/efl/NetworkInfoProviderEfl.h: Added.
+        (WebCore):
+        (NetworkInfoProviderEfl):
+
+2012-07-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: SASS source mapping straw man (behind experiment)
+        https://bugs.webkit.org/show_bug.cgi?id=92265
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change introduces SASS mapping support (behind the experiment).
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel):
+        (WebInspector.CSSStyleModel.prototype.resourceBinding):
+        (WebInspector.CSSStyleModel.prototype.setSourceMapping):
+        (WebInspector.CSSStyleModel.prototype.resetSourceMappings):
+        (WebInspector.CSSStyleModel.prototype._rawLocationToUILocation):
+        (WebInspector.CSSLocation):
+        (WebInspector.CSSRule):
+        (WebInspector.CSSRule.prototype.get isRegular):
+        (WebInspector.CSSRule.prototype.uiLocation):
+        * inspector/front-end/ContentProviders.js:
+        (WebInspector.StaticContentProvider.prototype.contentType):
+        * inspector/front-end/SASSSourceMapping.js: Added.
+        (WebInspector.SASSSourceMapping):
+        (WebInspector.SASSSourceMapping.prototype._populate):
+        (WebInspector.SASSSourceMapping.prototype._resourceAdded.didRequestContent):
+        (WebInspector.SASSSourceMapping.prototype._resourceAdded):
+        (rawLocationToUILocation):
+        (uiLocationToRawLocation):
+        (uiSourceCodes):
+        (reset):
+        (WebInspector.SASSSource):
+        (WebInspector.SASSSource.prototype.isEditable):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StylesUISourceCodeProvider):
+        (WebInspector.StylesUISourceCodeProvider.prototype.rawLocationToUILocation):
+        (WebInspector.StylesUISourceCodeProvider.prototype.uiLocationToRawLocation):
+        (WebInspector.StylesUISourceCodeProvider.prototype._resourceAdded):
+        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UILocation.prototype.uiLocationToRawLocation):
+        (WebInspector.UILocation.prototype.url):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.Workspace):
+        * inspector/front-end/inspector.html:
+
+2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed r123761 follow-up, inspector closure compilation fix.
+
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.Location.prototype.uiLocation):
+        * inspector/front-end/ScriptSnippetModel.js:
+
+2012-07-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
+        https://bugs.webkit.org/show_bug.cgi?id=92113
+
+        Reviewed by Simon Hausmann.
+
+        Cleanup the definition of the two methods across different ports and
+        replace the calls to them with LocalWindowsContext where possible.
+
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintThumb):
+
+2012-07-27 Chris Fleizach <cfleizach@apple.com>
+
+        WebKit should expose @title as label (AXTitle or AXDescription) sometimes instead of AXHelp, according to the ARIA text alt computation
+        https://bugs.webkit.org/show_bug.cgi?id=91911
+
+        Reviewed by Anders Carlsson.
+
+        The ARIA spec states that the title attribute should be used as the last resort for a description of an element. WebKit needs to honor that.
+
+        Test: platform/mac/accessibility/title-attribute-used-as-last-resort.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::helpText):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+
+2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed r123761 follow-up, inspector closure compilation fix.
+
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.Location.prototype.uiLocation):
+        * inspector/front-end/ScriptSnippetModel.js:
+
+2012-07-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
+        https://bugs.webkit.org/show_bug.cgi?id=92113
+
+        Reviewed by Simon Hausmann.
+
+        Cleanup the definition of the two methods across different ports and
+        replace the calls to them with LocalWindowsContext where possible.
+
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintThumb):
+
+2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed r123761 follow-up, inspector closure compilation fix.
+
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.Location.prototype.uiLocation):
+        * inspector/front-end/ScriptSnippetModel.js:
+
+2012-07-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup GraphicsContext::(getWindowsContext|releaseWindowsContext)
+        https://bugs.webkit.org/show_bug.cgi?id=92113
+
+        Reviewed by Simon Hausmann.
+
+        Cleanup the definition of the two methods across different ports and
+        replace the calls to them with LocalWindowsContext where possible.
+
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintThumb):
+
+2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Introduce generic LiveLocation, make Script.Location inherit it.
+        https://bugs.webkit.org/show_bug.cgi?id=92388
+
+        Reviewed by Pavel Feldman.
+
+        Introduced abstract LiveLocation implemented by Script.Location.
+
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.Location):
+        (WebInspector.Script.Location.prototype.uiLocation):
+        (WebInspector.Script.Location.prototype.dispose):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+        (WebInspector.LiveLocation):
+        (WebInspector.LiveLocation.prototype.update):
+        (WebInspector.LiveLocation.prototype.rawLocation):
+        (WebInspector.LiveLocation.prototype.uiLocation):
+        (WebInspector.LiveLocation.prototype.dispose):
+        * inspector/front-end/inspector.html:
+
+2012-07-26  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] readPixels on FBOs are limited to canvas size on SGX platforms
+        https://bugs.webkit.org/show_bug.cgi?id=92301
+
+        Reviewed by Rob Buis.
+
+        This fixes fast/canvas/webgl/uninitialized-test.html on BlackBerry, no new tests.
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):
+
+2012-07-26  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: reduce auto refresh rate of the live native memory diagram
+        https://bugs.webkit.org/show_bug.cgi?id=92372
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemoryBarChart.prototype.wasShown):
+
+2012-07-26  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: add GC button to the profiles panel toolbar.
+        https://bugs.webkit.org/show_bug.cgi?id=92369
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype._garbageCollectButtonClicked):
+        * inspector/front-end/profilesPanel.css:
+        (.garbage-collect-status-bar-item .glyph):
+
+2012-07-26  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Move region from HitTestResult to HitTestPoint.
+        https://bugs.webkit.org/show_bug.cgi?id=92367
+
+        Reviewed by Antonio Gomes.
+
+        Moves the region to HitTestPoint where it makes more sense, and use this
+        change to simplify hit-testing a new region in RenderFlowThread.
+
+        No new functionality. No new tests.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestPoint::HitTestPoint):
+        (WebCore::HitTestPoint::operator=):
+        (WebCore::HitTestResult::HitTestResult):
+        (WebCore::HitTestResult::operator=):
+        * rendering/HitTestResult.h:
+        (HitTestPoint):
+        (WebCore::HitTestPoint::region):
+        (HitTestResult):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::hitTestRegion):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::nodeAtPoint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+
+2012-07-26  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: ExtensionView constructor shouldn't take parent argument
+        https://bugs.webkit.org/show_bug.cgi?id=92326
+
+        Reviewed by Pavel Feldman.
+
+        ExtensionView's constructor took a parent element parameter and auto-
+        showed itself in the constructor. This didn't allow lazy showing and
+        was confusing because it didn't work like a classic View object. Fixed.
+
+        No new tests needed: Refactoring with no behavior changes.
+
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionPanel):
+        (WebInspector.ExtensionSidebarPane.prototype.setPage):
+        * inspector/front-end/ExtensionView.js:
+        (WebInspector.ExtensionView):
+
+2012-07-26  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [WebGL] ANGLEWebKitBridge should support ESSL platforms
+        https://bugs.webkit.org/show_bug.cgi?id=92295
+
+        Reviewed by Rob Buis.
+
+        This tells ANGLEWebKitBridge to output ESSL code for the BlackBerry
+        platform. This eliminates the need for a previous hack. In addition,
+        some (GLSL) ANGLE output that could not be compiled (for example,
+        glsl-mat4-to-mat3.html) now compiles.
+
+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
+        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE):
+
+2012-07-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: replace "textInput" keyboard event listener breakpoint with "input"
+        https://bugs.webkit.org/show_bug.cgi?id=92384
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+
+2012-07-26  Jer Noble  <jer.noble@apple.com>
+
+        Add a MediaPlayer API to retrieve the description of the current media engine.
+        https://bugs.webkit.org/show_bug.cgi?id=92336
+
+        Reviewed by Eric Carlson.
+
+        Add a utility function which retrieves, for diagnostic purposes, a brief description
+        of the current media engine. Stubs have been added for each of the MediaPlayerPrivate
+        subclasses which return the name of the class.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::engineDescription):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::engineDescription):
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        (WebCore::MediaPlayerPrivateAVFoundation::engineDescription):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
+        (WebCore::MediaPlayerPrivate::engineDescription):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivateGStreamer::engineDescription):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        (WebCore::MediaPlayerPrivateQTKit::engineDescription):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        (WebCore::MediaPlayerPrivateQt::engineDescription):
+        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
+        (WebCore::MediaPlayerPrivate::engineDescription):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::engineDescription):
+
+2012-07-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: Edits of styles declared after invalid selector are not applied
+        https://bugs.webkit.org/show_bug.cgi?id=92382
+
+        Reviewed by Vsevolod Vlasov.
+
+        Now popping selectorless rules as well.
+
+        Test: inspector/styles/styles-edit-property-after-invalid-rule.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createStyleRule):
+
+2012-07-26  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [WebGL] GraphicsContext3D::readPixels has extraneous code from GraphicsContext3D::readPixelsIMG
+        https://bugs.webkit.org/show_bug.cgi?id=92302
+
+        Reviewed by Noam Rosenthal.
+
+        This undoes a mistake from https://bugs.webkit.org/show_bug.cgi?id=90567.
+
+        No new tests, because it introduces no new functionality, but it makes the WebGL aquarium demo
+        run quite a bit smoother on SGX :)
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
+        (WebCore::GraphicsContext3D::readPixels):
+
+2012-07-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Revert r123740 as it breaks AppleMac compilation.
+
+        * WebCore.exp.in:
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-07-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fix AppleMac compilation after r123740.
+
+        * WebCore.exp.in: Added missing symbol.
+
+2012-07-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: move StringImpl size calculation to StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=92359
+
+        Reviewed by Pavel Feldman.
+
+        Moved stringSize(StringImpl*) implementation from InspectorMemoryAgent to
+        StringImpl::sizeInBytes();
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-07-26  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Remove redundant include of PageGroup.h in FrameLoader.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=92357
+
+        Reviewed by Kentaro Hara.
+
+
+        No new tests, just remove redundant include file.
+
+        * loader/FrameLoader.cpp:
+
+2012-07-26  Eric Seidel  <eric@webkit.org>
+
+        2% of all samples running grid demo show up in StyleResolver::canShareStyleWithElement, 20% of those due to getAttribute instead of fastGetAttribute
+        https://bugs.webkit.org/show_bug.cgi?id=92257
+
+        Reviewed by Andreas Kling.
+
+        This check was added 7 years ago by hyatt in:
+        http://trac.webkit.org/changeset/10984
+        And then later made slow after triggering an ASSERT added:
+        http://trac.webkit.org/changeset/97670
+
+        SVG uses a "type" attribute (and it is animatable), but only when
+        used on filter elements:
+        http://www.w3.org/TR/SVG/attindex.html
+        In any case, this does not apply here, and is certainly not what
+        this check was originally intended for.
+
+        I've moved the check to canShareStyleWithControl
+        as it is only needed when the elements in question are both input elements.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-07-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add memory reporting routine to StyleResolver
+        https://bugs.webkit.org/show_bug.cgi?id=92259
+
+        Reviewed by Vsevolod Vlasov.
+
+        SyleResolver::reportMemoryUsage is added for estimating StyleResolver
+        memory footprint.
+
+        * css/StyleResolver.cpp:
+        (RuleData):
+        (RuleSet):
+        (RuleSetSelectorPair):
+        (WebCore::StyleResolver::Features::reportMemoryUsage):
+        (WebCore):
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+        (Features):
+        (StyleResolver):
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (WebCore::MemoryClassInfo::addInstrumentedHashSet):
+        (WebCore::MemoryClassInfo::addInstrumentedVector):
+        (WebCore::MemoryInstrumentation::addHashMap):
+        (WebCore):
+        (WebCore::MemoryInstrumentation::addInstrumentedCollection):
+
+2012-07-26  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Remove DeprecatedPeerConnection
+        https://bugs.webkit.org/show_bug.cgi?id=92106
+
+        Reviewed by Adam Barth.
+
+        Since we are getting ready to add an updated PeerConnection
+        the old DeprecatedPeerConnection will have to go.
+
+        No new tests, and old tests converted to use PeerConnection00.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/DOMWindowMediaStream.idl:
+        * Modules/mediastream/DeprecatedPeerConnection.cpp: Removed.
+        * Modules/mediastream/DeprecatedPeerConnection.h: Removed.
+        * Modules/mediastream/DeprecatedPeerConnection.idl: Removed.
+        * Modules/mediastream/SignalingCallback.h: Removed.
+        * Modules/mediastream/SignalingCallback.idl: Removed.
+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        * bindings/js/JSDeprecatedPeerConnectionCustom.cpp: Removed.
+        * dom/EventTargetFactory.in:
+        * platform/mediastream/DeprecatedPeerConnectionHandler.h: Removed.
+        * platform/mediastream/DeprecatedPeerConnectionHandlerClient.h: Removed.
+        * platform/mediastream/blackberry/DeprecatedPeerConnectionHandler.cpp: Removed.
+        * platform/mediastream/chromium/DeprecatedPeerConnectionHandler.cpp: Removed.
+        * platform/mediastream/chromium/DeprecatedPeerConnectionHandlerInternal.cpp: Removed.
+        * platform/mediastream/chromium/DeprecatedPeerConnectionHandlerInternal.h: Removed.
+        * platform/mediastream/gstreamer/DeprecatedPeerConnectionHandler.cpp: Removed.
+
+2012-07-26  Mike West  <mkwst@chromium.org>
+
+        CSP 1.1: Implement the Content Security Policy script interface.
+        https://bugs.webkit.org/show_bug.cgi?id=91707
+
+        Reviewed by Adam Barth.
+
+        The CSP 1.1 editor's draft defines a script interface that gives
+        developers the ability to query a document regarding the restrictions
+        set by it's currently active content security policy[1]. This patch
+        exposes that API in terms of a new DOMSecurityPolicy object.
+
+        Data for the API is gathered from the existing ContentSecurityPolicy
+        object on the containing document. CSP's various methods have been
+        extended with a `reportingStatus` parameter which, unsurprisingly,
+        determines whether a violation report should be sent for blocked
+        resources. This allows us to reuse the same codepaths by simply using
+        ContentSecurityPolicy::SuppressReport when querying on behalf of the
+        API, and ContentSecurityPolicy::SendReport when checking resources a
+        page wants to load.
+
+        This feature is gated on the CSP_NEXT flag, which is currently disabled
+        for all ports other than Chromium.
+
+        [1]: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-interfaces--experimental
+
+        Tests: http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive.html
+               http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi.html
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * bindings/gobject/GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+            We added a new object, so let's tell _everyone!_
+        * dom/Document.cpp:
+        (WebCore::Document::securityPolicy):
+            Expose the SecurityPolicy object via Document, gated on CSP_NEXT.
+        (WebCore):
+        * dom/Document.h:
+        (WebCore):
+        (Document):
+        * dom/Document.idl:
+            Adding the SecurityPolicy object to the document, gated on CSP_NEXT.
+        * page/ContentSecurityPolicy.cpp:
+        (CSPDirectiveList):
+        (WebCore::CSPDirectiveList::checkInline):
+        (WebCore::CSPDirectiveList::checkNonce):
+        (WebCore::CSPDirectiveList::checkSource):
+            Extracting the core checks out into separate methods.
+        (WebCore::CSPDirectiveList::checkEvalAndReportViolation):
+            Use checkEval.
+        (WebCore::CSPDirectiveList::checkNonceAndReportViolation):
+            Use checkNonce.
+        (WebCore::CSPDirectiveList::checkInlineAndReportViolation):
+            Use checkInline.
+        (WebCore::CSPDirectiveList::checkSourceAndReportViolation):
+            Use checkSource.
+        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
+        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
+        (WebCore::CSPDirectiveList::allowInlineScript):
+        (WebCore::CSPDirectiveList::allowInlineStyle):
+        (WebCore::CSPDirectiveList::allowEval):
+        (WebCore::CSPDirectiveList::allowScriptFromSource):
+        (WebCore::CSPDirectiveList::allowObjectFromSource):
+        (WebCore::CSPDirectiveList::allowChildFrameFromSource):
+        (WebCore::CSPDirectiveList::allowImageFromSource):
+        (WebCore::CSPDirectiveList::allowStyleFromSource):
+        (WebCore::CSPDirectiveList::allowFontFromSource):
+        (WebCore::CSPDirectiveList::allowMediaFromSource):
+        (WebCore::CSPDirectiveList::allowConnectToSource):
+            These methods now branch on `reportingStatus`: if `SendReoport`,
+            they call `checkXAndReportViolation`, otherwise, they call `checkX`.
+        (WebCore::CSPDirectiveList::gatherReportURIs):
+            New method that gathers the violation report URIs into a DOMStringList.
+        (WebCore::isAllowedByAllWithCallStack):
+        (WebCore::isAllowedByAllWithContext):
+        (WebCore::isAllowedByAllWithURL):
+            These now pass reportingStatus through to the various `allowX` methods.
+        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
+        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
+        (WebCore::ContentSecurityPolicy::allowInlineScript):
+        (WebCore::ContentSecurityPolicy::allowInlineStyle):
+        (WebCore::ContentSecurityPolicy::allowEval):
+        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
+        (WebCore::ContentSecurityPolicy::allowObjectFromSource):
+        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource):
+        (WebCore::ContentSecurityPolicy::allowImageFromSource):
+        (WebCore::ContentSecurityPolicy::allowStyleFromSource):
+        (WebCore::ContentSecurityPolicy::allowFontFromSource):
+        (WebCore::ContentSecurityPolicy::allowMediaFromSource):
+        (WebCore::ContentSecurityPolicy::allowConnectToSource):
+            These accept a new `reportingStatus` parameter, which is passed through
+            to the CSPDirectiveList methods.
+        (WebCore::ContentSecurityPolicy::isActive):
+            New method that returns `true` if policy is active.
+        (WebCore::ContentSecurityPolicy::gatherReportURIs):
+            New method that returns a DOMStringList of violation report URIs.
+        * page/ContentSecurityPolicy.h:
+        (WebCore):
+        * page/DOMSecurityPolicy.cpp: Added.
+        (WebCore::DOMSecurityPolicy::DOMSecurityPolicy):
+        (WebCore):
+        (WebCore::DOMSecurityPolicy::~DOMSecurityPolicy):
+        (WebCore::DOMSecurityPolicy::isActive):
+        (WebCore::DOMSecurityPolicy::reportURIs):
+        (WebCore::DOMSecurityPolicy::allowsInlineScript):
+        (WebCore::DOMSecurityPolicy::allowsInlineStyle):
+        (WebCore::DOMSecurityPolicy::allowsEval):
+        (WebCore::DOMSecurityPolicy::allowsConnectionTo):
+        (WebCore::DOMSecurityPolicy::allowsFontFrom):
+        (WebCore::DOMSecurityPolicy::allowsFrameFrom):
+        (WebCore::DOMSecurityPolicy::allowsImageFrom):
+        (WebCore::DOMSecurityPolicy::allowsMediaFrom):
+        (WebCore::DOMSecurityPolicy::allowsObjectFrom):
+        (WebCore::DOMSecurityPolicy::allowsScriptFrom):
+        (WebCore::DOMSecurityPolicy::allowsStyleFrom):
+        * page/DOMSecurityPolicy.h: Added.
+        (WebCore):
+        (DOMSecurityPolicy):
+        (WebCore::DOMSecurityPolicy::create):
+        * page/DOMSecurityPolicy.idl: Added.
+
+2012-07-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed. Fix build break on mac win port by r123716.
+
+        * platform/KURL.h:
+        (KURL):
+
+2012-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123715.
+        http://trac.webkit.org/changeset/123715
+        https://bugs.webkit.org/show_bug.cgi?id=92356
+
+        Breaks compilation on multiple platforms (Requested by vsevik
+        on #webkit).
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveData):
+        (WebCore::InspectorResourceAgent::getResponseBody):
+        * inspector/InspectorResourceAgent.h:
+        (InspectorResourceAgent):
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
+        (WebCore::NetworkResourcesData::ResourceData::setContent):
+        (WebCore::NetworkResourcesData::ResourceData::dataLength):
+        (WebCore::NetworkResourcesData::ResourceData::appendData):
+        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
+        (WebCore::NetworkResourcesData::setResourceContent):
+        (WebCore::NetworkResourcesData::maybeAddResourceData):
+        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):
+        (WebCore::NetworkResourcesData::setResourcesDataSizeLimits):
+        (WebCore::NetworkResourcesData::ensureFreeSpace):
+        * inspector/NetworkResourcesData.h:
+        (ResourceData):
+        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
+        (NetworkResourcesData):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::~CachedResource):
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::deleteIfPossible):
+        * loader/cache/CachedResource.h:
+        (CachedResource):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
+        (WebCore::CachedResourceLoader::clearPreloads):
+        * loader/cache/CachedResourceLoader.h:
+        (CachedResourceLoader):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::evict):
+        * testing/InternalSettings.cpp:
+        * testing/Internals.cpp:
+        * testing/Internals.h:
+        (Internals):
+
+2012-07-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Add *explicit* keyword to constructors in WebCore/platform
+        https://bugs.webkit.org/show_bug.cgi?id=92238
+
+        Reviewed by Kentaro Hara.
+
+        As a step to let *explicit* keyword add to constructors which have a parameter,
+        *explicit* keyword is added to Source/WebCore/platform in order to avoid implicit
+        type conversion.
+
+        Some files in platform directory can't use explicit keyword because of build breaks.
+
+        No new tests. Covered by existing tests.
+
+        * platform/AutodrainedPool.h:
+        (AutodrainedPool):
+        * platform/ContentType.h:
+        (ContentType):
+        * platform/ContextMenu.h:
+        (ContextMenu):
+        * platform/ContextMenuItem.h:
+        (ContextMenuItem):
+        * platform/Cursor.h:
+        (WebCore::SharedCursor::SharedCursor):
+        (Cursor):
+        * platform/KURL.h:
+        (WebCore::KURL::KURL):
+        (KURL):
+        * platform/KURLGooglePrivate.h:
+        (KURLGooglePrivate):
+        * platform/PODRedBlackTree.h:
+        (WebCore::PODRedBlackTree::PODRedBlackTree):
+        * platform/Pasteboard.h:
+        (Pasteboard):
+        * platform/PlatformEvent.h:
+        (WebCore::PlatformEvent::PlatformEvent):
+        * platform/PlatformKeyboardEvent.h:
+        (PlatformKeyboardEvent):
+        * platform/PlatformMouseEvent.h:
+        (PlatformMouseEvent):
+        * platform/PlatformPasteboard.h:
+        (PlatformPasteboard):
+        * platform/PlatformTouchEvent.h:
+        (PlatformTouchEvent):
+        * platform/PlatformWheelEvent.h:
+        (PlatformWheelEvent):
+        * platform/RunLoop.h:
+        (TimerBase):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/SharedBuffer.h:
+        (SharedBuffer):
+        * platform/WheelFlingPlatformGestureCurve.h:
+        (WheelFlingPlatformGestureCurve):
+        * platform/Widget.h:
+        (Widget):
+
+2012-07-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Resource agent's reference to cached resources should be weak.
+        https://bugs.webkit.org/show_bug.cgi?id=92108
+
+        Reviewed by Pavel Feldman.
+
+        NetworkResourcesData now stores a raw pointer to CachedResource.
+        CachedResource now notifies InspectorInstrumentation that it will be destroyed.
+        InspectorInstrumentation stores a set of InstrumentingAgents and broadcasts willDestroyCachedResource event to all available resourceAgents.
+        Destroyed resources content is saved to NetworkResourcesData.
+        Changed content size variables type in NetworkResourcesData from int to size_t.
+
+        Tests: http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html
+               http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::willDestroyCachedResourceImpl):
+        (WebCore::InspectorInstrumentation::registerInstrumentingAgents):
+        (WebCore::InspectorInstrumentation::unregisterInstrumentingAgents):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willDestroyCachedResource):
+        (WebCore):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveData):
+        (WebCore::InspectorResourceAgent::willDestroyCachedResource):
+        (WebCore):
+        (WebCore::InspectorResourceAgent::getResponseBody):
+        * inspector/InspectorResourceAgent.h:
+        (InspectorResourceAgent):
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::NetworkResourcesData::ResourceData::ResourceData):
+        (WebCore::NetworkResourcesData::ResourceData::setContent):
+        (WebCore::NetworkResourcesData::ResourceData::dataLength):
+        (WebCore::NetworkResourcesData::ResourceData::appendData):
+        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
+        (WebCore::NetworkResourcesData::setResourceContent):
+        (WebCore::NetworkResourcesData::maybeAddResourceData):
+        (WebCore::NetworkResourcesData::maybeDecodeDataToContent):
+        (WebCore::NetworkResourcesData::removeCachedResource):
+        (WebCore):
+        (WebCore::NetworkResourcesData::setResourcesDataSizeLimits):
+        (WebCore::NetworkResourcesData::ensureFreeSpace):
+        * inspector/NetworkResourcesData.h:
+        (ResourceData):
+        (WebCore::NetworkResourcesData::ResourceData::base64Encoded):
+        (WebCore::NetworkResourcesData::ResourceData::cachedResource):
+        (NetworkResourcesData):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::~CachedResource):
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::deleteIfPossible):
+        * loader/cache/CachedResource.h:
+        (CachedResource):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::garbageCollectDocumentResourcesTimerFired):
+        (WebCore::CachedResourceLoader::garbageCollectDocumentResources):
+        (WebCore::CachedResourceLoader::clearPreloads):
+        * loader/cache/CachedResourceLoader.h:
+        (CachedResourceLoader):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::evict):
+        * testing/InternalSettings.cpp:
+        * testing/Internals.cpp:
+        (WebCore::Internals::garbageCollectDocumentResources):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+
+2012-07-26  Luke Macpherson   <macpherson@chromium.org>
+
+        Fix null ptr deref in CSSParser::storeVariableDeclaration().
+        https://bugs.webkit.org/show_bug.cgi?id=92333
+
+        Reviewed by Andreas Kling.
+
+        Fix null pointer deref that occurs if the CSSParserValue couldn't be converted to a CSSValue.
+
+        Test fast/css/variables/variable-unparseable-value-crash.html added.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::storeVariableDeclaration):
+
+2012-07-26  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Add UserAgentShadowDOM to FormControlElement just before adding AuthorShadowDOM
+        https://bugs.webkit.org/show_bug.cgi?id=90866
+
+        Reviewed by Hajime Morita.
+
+        It ensures that UserAgentShadowDOM is the oldest ShadowDOM.
+
+        To show ValidationMessage, WebKit adds a Shadow DOM to some of FormControlElements.
+        ValidationMessage assumes that the added Shadow DOM is the oldest, however, there was a case
+        that a page author might add a Shadow DOM before ValidationMessage adds a Shadow DOM.
+        It will break the assumption that the Shadow DOM added by ValidationMessage is the oldest.
+        So we have prohibited a page author adding a Shadow DOM to FormControlElement.
+
+        To add UserAgentShadowDOM, we use a callback which is called before a page author adding a Shadow DOM.
+        It adds a UserAgentShadowDOM if it does not exist, so we can ensure that UserAgentShadowDOM is the oldest.
+
+        Tests: fast/dom/shadow/input-with-validation-without-shadow.html
+               fast/dom/shadow/input-with-validation.html
+               fast/dom/shadow/shadowdom-for-button-complex-shadow.html
+               fast/dom/shadow/shadowdom-for-button-only-shadow.html
+               fast/dom/shadow/shadowdom-for-button-without-shadow.html
+               fast/dom/shadow/shadowdom-for-fieldset-complex-shadow.html
+               fast/dom/shadow/shadowdom-for-fieldset-only-shadow.html
+               fast/dom/shadow/shadowdom-for-fieldset-without-shadow.html
+               fast/dom/shadow/shadowdom-for-form-associated-element-useragent.html
+               fast/dom/shadow/shadowdom-for-keygen-complex-shadow.html
+               fast/dom/shadow/shadowdom-for-keygen-only-shadow.html
+               fast/dom/shadow/shadowdom-for-keygen-without-shadow.html
+               fast/dom/shadow/shadowdom-for-object-complex-shadow.html
+               fast/dom/shadow/shadowdom-for-object-only-shadow.html
+               fast/dom/shadow/shadowdom-for-object-without-shadow.html
+               fast/dom/shadow/shadowdom-for-output-complex-shadow.html
+               fast/dom/shadow/shadowdom-for-output-only-shadow.html
+               fast/dom/shadow/shadowdom-for-output-without-shadow.html
+               fast/dom/shadow/shadowdom-for-select-complex-shadow.html
+               fast/dom/shadow/shadowdom-for-select-only-shadow.html
+               fast/dom/shadow/shadowdom-for-select-without-shadow.html
+               fast/dom/shadow/shadowdom-for-textarea-complex-shadow.html
+               fast/dom/shadow/shadowdom-for-textarea-only-shadow.html
+               fast/dom/shadow/shadowdom-for-textarea-without-shadow.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::allowsAuthorShadowRoot):
+        * html/FormAssociatedElement.cpp:
+        (WebCore::FormAssociatedElement::ensureUserAgentShadowRoot): Ensures the existence of a UserAgentShadowRoot.
+        If it does not exist, we create it with empty content.
+        (WebCore):
+        * html/FormAssociatedElement.h:
+        (FormAssociatedElement):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::willAddAuthorShadowRoot):
+        (WebCore):
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement):
+        * html/ValidationMessage.cpp:
+        (WebCore::adjustBubblePosition): When AuthroShadowRoot does not a shadow element, ValidationMessage
+        does not have a renderer. So we have to check the existence of renderer.
+        (WebCore::ValidationMessage::buildBubbleTree):
+
+2012-07-26  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        [DRT] LTC:: pageNumberForElementById() could be moved to Internals
+        https://bugs.webkit.org/show_bug.cgi?id=92091
+
+        Reviewed by Adam Barth.
+
+        Move the pageNumberForElementById from LayoutTestCotroller to Internals and
+        remove the old platform specific implementations as it exclusively tests WebCore functionality.
+
+        Covered by existing test cases.
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::counterValue):
+        (WebCore):
+        (WebCore::Internals::pageNumber):
+        * testing/Internals.h:
+        (Internals):
+        (WebCore::Internals::pageNumber):
+        * testing/Internals.idl:
+
+2012-07-25  MORITA Hajime  <morrita@google.com>
+
+        [Chromium][Win] <progress> animation on RTL direction is reverse
+        https://bugs.webkit.org/show_bug.cgi?id=92236
+
+        Reviewed by Kent Tamura.
+
+        This change modfies the way to handle RTL progress bar painting.
+        Originally it computes the flipped coordinates. This change uses transformation for the flip.
+        DirectionFlippingScope handles it.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::paintProgressBar): Applied DirectionFlippingScope
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::determinateProgressValueRectFor):
+        - Deleted RTL handling in favor of DirectionFlippingScope
+        (WebCore::RenderThemeChromiumSkia::DirectionFlippingScope::DirectionFlippingScope):
+        (WebCore):
+        (WebCore::RenderThemeChromiumSkia::DirectionFlippingScope::~DirectionFlippingScope):
+        * rendering/RenderThemeChromiumSkia.h:
+        (RenderThemeChromiumSkia):
+        (DirectionFlippingScope): Added.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore):
+        (WebCore::RenderThemeChromiumWin::paintProgressBar): Applied DirectionFlippingScope
+
+2012-07-25  Vineet Chaudhary  <rgf748@motorola.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=92260
+        Repalce "int" with "long" from WebCore/*.idls
+
+        Reviewed by Adam Barth.
+
+        As per the WebIDL spec IDL shouldn't have int attributes but long instead.
+        Repalced attributes types int with long from WebCore/*.idls.
+
+        No new tests. TestObj.idl already covers this.
+        There should be no behavioural changes.
+
+        * dom/Touch.idl: Repalce int with long.
+        * dom/WebKitNamedFlow.idl: Ditto.
+        * html/canvas/ArrayBuffer.idl: Ditto.
+        * html/canvas/WebGLActiveInfo.idl: Ditto.
+        * html/canvas/WebGLShaderPrecisionFormat.idl: Ditto.
+        * page/WebKitAnimation.idl: Ditto.
+
+2012-07-25  Shinya Kawanaka  <shinyak@chromium.org>
+
+        The elements in ShadowDOM of meter or progress should not be modifiable.
+        https://bugs.webkit.org/show_bug.cgi?id=92199
+
+        Reviewed by Hajime Morita.
+
+        A user can set -webkit-user-modify: read-write to the elements in Shadow DOM in a meter or progress element.
+        This might cause a undesired crash like Bug 65738. They should be unmodifiable.
+
+        We add default css values to elements in ShadowDOM of meter or progress to prohibit editing them.
+
+        Tests: fast/html/meter-user-modify.html
+               fast/html/progress-user-modify.html
+
+        * css/html.css:
+        Added -webkit-user-modify: read-only !important; for these elements so that they won't be
+        changed by a user.
+        (meter::-webkit-meter-bar):
+        (meter::-webkit-meter-optimum-value):
+        (meter::-webkit-meter-suboptimum-value):
+        (meter::-webkit-meter-even-less-good-value):
+        (progress::-webkit-progress-bar):
+        (progress::-webkit-progress-value):
+
+2012-07-25  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] GraphicsContext3D::paintToCanvas should not swap 0th and 2nd components of color
+        https://bugs.webkit.org/show_bug.cgi?id=92314
+
+        Reviewed by Rob Buis.
+
+        No new tests, because it corrects existing functionality, but it makes BlackBerry
+        pass canvas-text.html and others.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
+        (WebCore::GraphicsContext3D::paintToCanvas):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+
+2012-07-25  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] GraphicsContext3D::reshapeFBOs does not report when bound FBOs should be restored
+        https://bugs.webkit.org/show_bug.cgi?id=92304
+
+        Reviewed by Rob Buis.
+
+        No new tests, because it corrects existing functionality, but it makes BlackBerry
+        pass framebuffer-bindings-unaffected-on-resize.html.
+
+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
+        (WebCore::GraphicsContext3D::reshapeFBOs):
+
+2012-07-25  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] readPixels should set alpha to 255 instead of 0 when alpha is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=92303
+
+        Reviewed by Rob Buis.
+
+        No new tests, because it corrects existing functionality, but it makes BlackBerry
+        pass context-attributes-alpha-depth-stencil-antialias.html.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::readPixels):
+
+2012-07-25  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [WebGL] fast/canvas/webgl/framebuffer-object-attachment.html fails on certain platforms
+        https://bugs.webkit.org/show_bug.cgi?id=92296
+
+        Reviewed by Rob Buis.
+
+        No new tests, because it introduces no new functionality, only fixes the above mentioned test.
+
+        * html/canvas/WebGLFramebuffer.cpp:
+        (WebCore::WebGLFramebuffer::checkStatus):
+
+2012-07-25  Xingnan Wang  <xingnan.wang@intel.com>
+
+        IndexedDB: IDBTransaction::abort() should throw DOMException
+        https://bugs.webkit.org/show_bug.cgi?id=92069
+
+        Reviewed by Kentaro Hara.
+
+        Keep aligned with the W3C spec.
+        http://dvcs.w3.org/hg/IndexedDB/raw-file/tip/Overview.html#widl-IDBTransaction-abort-void
+
+        Test: storage/indexeddb/transaction-abort.html.
+
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::abort):
+        (WebCore):
+        * Modules/indexeddb/IDBTransaction.h:
+        (IDBTransaction):
+        * Modules/indexeddb/IDBTransaction.idl:
+
+2012-07-25  Tony Chang  <tony@chromium.org>
+
+        flexitems can overflow the flexbox due to rounding
+        https://bugs.webkit.org/show_bug.cgi?id=92163
+
+        Reviewed by Levi Weintraub.
+
+        Don't round flex item sizes and use LayoutPoint for the location of flex items.
+
+        Test: css3/flexbox/flex-rounding.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
+        (WebCore::RenderFlexibleBox::layoutColumnReverse):
+
+2012-07-25  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        [BlackBerry] Integrate certmgr with CredentialBackingStore
+        https://bugs.webkit.org/show_bug.cgi?id=92183
+
+        Reviewed by George Staikos.
+
+        Integrated BlackBerry::Platform::CertMgrWrapper with
+        CredentialBackingStore, when certmgr is ready we save
+        the password in certmgr and retrieve it from certmgr.
+
+        RIM PR: 171991
+        Internally reviewed by Joe Mason <jmason@rim.com>.
+
+        No new tests since there's no functional change.
+
+        * platform/network/blackberry/CredentialBackingStore.cpp:
+        (WebCore::hashCredentialInfo):
+        (WebCore):
+        (WebCore::CredentialBackingStore::CredentialBackingStore):
+        (WebCore::CredentialBackingStore::open):
+        (WebCore::CredentialBackingStore::addLogin):
+        (WebCore::CredentialBackingStore::updateLogin):
+        (WebCore::CredentialBackingStore::getLogin):
+        * platform/network/blackberry/CredentialBackingStore.h:
+        (CredentialBackingStore):
+
+2012-07-25  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r121420): Performance regression of form state saving for pages with multiple forms
+        https://bugs.webkit.org/show_bug.cgi?id=91804
+
+        Reviewed by Hajime Morita.
+
+        The complexity of FormKeyGenerator::formKey() was O(N) where N is the
+        number form elements with an identical action URL, and formKey() is
+        called for every form. So, it's O(N^2). A page in www.reddit.com
+        contains hundreds of form elements with action="#". So FormController::
+        formElementsState() took a few seconds on a slow machine.
+
+        In order to avoid O(N^2) operation, storing a map from form signatures
+        to next index numbers, instead of storing existing formKey strings.
+
+        No new tests. Just a performance improvement.
+
+        Note: This is a re-landing of r123191. We rolled it out because of
+        suspicion of a performance regression. However it was innocent.
+
+        * html/FormController.cpp:
+        (FormKeyGenerator): Remove m_existingKeys. Add a map from a form
+        signature string to the next index number.
+        (WebCore::formSignature): Returns a signature string for a form, without
+        an index number. This is like "actionURL [name1 name2 ]"
+        (WebCore::FormKeyGenerator::formKey):
+        Creates a formKey string by concatenating a formSignature and #n. N is
+        obtained from m_formSignatureToNextIndexMap in O(1).
+        (WebCore::FormKeyGenerator::willDeleteForm):
+        Remove the code for m_existingKeys.
+
+2012-07-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        Initialize QualifiedName's strings from the read only data segment
+        https://bugs.webkit.org/show_bug.cgi?id=92226
+
+        Reviewed by Anders Carlsson.
+
+        Modify the initialization of static QualifiedName to initialize the AtomicString
+        with the data from the read only memory.
+
+        Overall, HTMLNames::init() gets 10% faster.
+
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::QualifiedName):
+        * dom/QualifiedName.h:
+        (QualifiedName):
+        Remove the useless constructor taking a char* and get rid of the init() function.
+        The AtomicString representing the name should be constructed by the caller of QualifiedName.
+
+        Because the init() code is relatively large and is only executed once, it is important to
+        keep the AtomicString construction separate. The function createQualifiedName() was added
+        to improve the cache use. The short version let us reduce the code one more instruction per
+        call.
+
+        * dom/make_names.pl:
+        (printQualifiedNameMaker):
+        (printShortQualifiedNameMaker):
+        (printNamesCppFile):
+        (printDefinitions):
+
+2012-07-25  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Move HTMLInputElement::updateInnerTextValue to InputType class
+        https://bugs.webkit.org/show_bug.cgi?id=92230
+
+        Reviewed by Kent Tamura.
+
+        This patch moves implementaion of HTMLInputElement::updateInnerTextValue()
+        into input type classes, removes updateInnerTextValue() from HTMLInputElement,
+        and updates call site of updateInnerTextValue().
+
+        No new tests. This patch doesn't change behavior.
+
+        * html/DateInputType.cpp:
+        (WebCore::DateInputType::handleBlurEvent): Updated call site of updateInnerTextValue().
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateType): Updated call site of updateInnerTextValue().
+        (WebCore::HTMLInputElement::parseAttribute): Updated call site of updateInnerTextValue().
+        (WebCore::HTMLInputElement::copyNonAttributePropertiesFromElement): Updated call site of updateInnerTextValue().
+        (WebCore::HTMLInputElement::setSuggestedValue): Updated call site of updateInnerTextValue().
+        * html/HTMLInputElement.h:
+        (HTMLInputElement): Removed updateInnerTextValue().
+        * html/InputType.cpp:
+        (WebCore::InputType::updateInnerTextValue): Added default implementaion.
+        * html/InputType.h:
+        (InputType): Added declaration of updateInnerTextValue().
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::handleBlurEvent): Updated call site of updateInnerTextValue().
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::setValue): Updated call site of updateInnerTextValue().
+        (WebCore::TextFieldInputType::updateInnerTextValue): Moved implementaion from HTMLInputElement.
+        * html/TextFieldInputType.h:
+        (TextFieldInputType): Added declaration of updateInnerTextValue().
+
+2012-07-25  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Move ephemeral data for a single frame in LayerRendererChromium into a structure with a scoped lifetime equal to the frame
+        https://bugs.webkit.org/show_bug.cgi?id=92294
+
+        Reviewed by Adrienne Walker.
+
+        The LayerRendererChromium class has a number of member variables that are used
+        while drawing a single frame. Because they are member variables, their lifetimes
+        are not clear, and some are even updated between frames, which is not needed.
+
+        This change creates a LRC::DrawingFrame structure that holds the data used
+        while drawing the current frame, and an instance of this structure is held
+        and passed around to functions in LayerRendererChromium, moving all of the
+        data out from being member variables on the class to being function
+        arguments on the relevant methods.
+
+        The projection and window matrices are a part of this frame data, and are not
+        used externally, so they are removed from the CCRenderer interface and included
+        within the DrawingFrame structure.
+
+        Covered by existing tests, no change in behaviour intended.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::viewportChanged):
+        (WebCore::LayerRendererChromium::clearFramebuffer):
+        (WebCore::LayerRendererChromium::drawFrame):
+        (WebCore::LayerRendererChromium::drawRenderPass):
+        (WebCore::LayerRendererChromium::drawQuad):
+        (WebCore::LayerRendererChromium::drawCheckerboardQuad):
+        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
+        (WebCore::LayerRendererChromium::drawBackgroundFilters):
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        (WebCore::LayerRendererChromium::drawSolidColorQuad):
+        (WebCore::LayerRendererChromium::drawTileQuad):
+        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
+        (WebCore::LayerRendererChromium::drawStreamVideoQuad):
+        (WebCore::LayerRendererChromium::drawTextureQuad):
+        (WebCore::LayerRendererChromium::drawIOSurfaceQuad):
+        (WebCore::LayerRendererChromium::finishDrawingFrame):
+        (WebCore::LayerRendererChromium::drawTexturedQuad):
+        (WebCore::LayerRendererChromium::copyTextureToFramebuffer):
+        (WebCore::LayerRendererChromium::isCurrentRenderPass):
+        (WebCore::LayerRendererChromium::useRenderPass):
+        (WebCore::LayerRendererChromium::useScopedTexture):
+        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
+        (WebCore::LayerRendererChromium::setScissorToRect):
+        (WebCore::LayerRendererChromium::setDrawFramebufferRect):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (DrawingFrame):
+        (WebCore::LayerRendererChromium::DrawingFrame::DrawingFrame):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRenderer):
+
+2012-07-19  Adrienne Walker  <enne@google.com>
+
+        [chromium] Make all compositor screen space transforms operate on content rects
+        https://bugs.webkit.org/show_bug.cgi?id=91807
+
+        Reviewed by Kenneth Russell.
+
+        Previously, surface screen space transforms operated on surface
+        content space but layer screen space transforms operated on layer
+        space. For the purpose of consistency, unify these two so that they
+        both operate on content space.
+
+        No tests, because no change in behavior expected. Just a refactoring.
+
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
+        (WebCore::CCDebugRectHistory::savePaintRects):
+        (WebCore::CCDebugRectHistory::savePropertyChangedRects):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsInternal):
+        (WebCore::CCLayerTreeHostCommon::findLayerThatIsHitByPoint):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::::occluded):
+        (WebCore::::unoccludedContentRect):
+
+2012-07-25  Dan Bernstein  <mitz@apple.com>
+
+        Hit testing in one column or in the gap between cloumns along the block axis can return a result from the wrong column
+        https://bugs.webkit.org/show_bug.cgi?id=92311
+
+        Reviewed by Anders Carlsson.
+
+        Tests: fast/multicol/hit-test-end-of-column.html
+               fast/multicol/hit-test-gap-block-axis.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren): To prevent hits after the last
+        line on a given column from returning the next line in the next column, added a check if
+        the hit occurred within the pagination strut of a line. Covered by the first test.
+        (WebCore::RenderBlock::adjustPointToColumnContents): Added clamp-to-column logic for the
+        block-axis case. This prevents hits near the bottom of the top half of the gap from bleeding
+        into the top of the next column. Covered by the second test.
+
+2012-07-25  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Make db.version return an integer if appropriate
+        https://bugs.webkit.org/show_bug.cgi?id=92195
+
+        Reviewed by Tony Chang.
+
+        Make use of the existing IDBAny mechanism to return an integer if
+        integer versions have been used.
+
+        No new tests - no change in behavior expected.
+
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::version):
+        (WebCore):
+        * Modules/indexeddb/IDBDatabase.h:
+        (IDBDatabase):
+        * Modules/indexeddb/IDBDatabase.idl:
+
+2012-07-25  Michael Saboff  <msaboff@apple.com>
+
+        Convert HTML parser to handle 8-bit resources without converting to UChar*
+        https://bugs.webkit.org/show_bug.cgi?id=90321
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests, no new functionality therefore covered by existing tests.
+
+        Changed the parsing of HTML to handle 8-bit strings without converting the 
+        whole string to 16-bits.  Primary change was to use the appropriate 
+        character pointer type (LChar* or UChar*) depending on the source string.
+        This access is abstracted in SegmentedSubstring by getCurrentChar{8,16} and
+        incrementAndGetCurrentChar{8,16} methods.  In SegmentedString, the advance()
+        and advanceAndUpdateLineNumber() methods have been refactored into a
+        state machine managed pair of function pointers.  The possible functions
+        have not only the 8 and 16 bitness factored out, they also have the 
+        "exclude line numbers" logic factored out for advanceAndUpdateLineNumber().
+        This provides a net speed-up even with the 8/16 bit testing.
+        Other changes involve using String methods to access and compare with the
+        source data.
+
+        * html/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryDocumentParser::append): Changed to use currentChar()
+        instead of SegmentedString '*' operator.
+        * html/parser/HTMLEntityParser.cpp: Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::stripLeadingAndTrailingHTMLSpaces): Added 8-bit fast path.
+        * html/parser/HTMLSourceTracker.cpp:
+        (WebCore::HTMLSourceTracker::sourceForToken): Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::script): Updated to use new String::dataSize() method.
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::SegmentedString):
+        (WebCore::SegmentedString::operator=):
+        (WebCore::SegmentedString::clear):
+        (WebCore::SegmentedString::append):
+        (WebCore::SegmentedString::prepend):
+        (WebCore::SegmentedString::advanceSubstring):
+        (WebCore::SegmentedString::advance): Changed to be a wrapper that invokes current 
+        advance function.
+        (WebCore::SegmentedString::advance8): Fast path advance function for 8 bit data.
+        (WebCore::SegmentedString::advance16): Fast path advance function for 16 bit data.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber8IncludeLineNumbers): Fast
+        path advanceAndUpdateLineNumber for 8 bit data when we need to update the line number.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber16IncludeLineNumbers): Fast
+        path advanceAndUpdateLineNumber for 16 bit data when we need to update the line number.
+        (WebCore::SegmentedString::advanceSlowCase): Slow case advance function for both
+        8 and 16 bit advance.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase): Slow case
+        advanceAndUpdateLineNumber function for both 8 and 16 bit data.
+        (WebCore::SegmentedString::advanceEmpty): Advance function when input has been exhausted.
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedSubstring::SegmentedSubstring):
+        (WebCore::SegmentedSubstring::clear):
+        (SegmentedSubstring):
+        (WebCore::SegmentedSubstring::is8Bit): New getter.
+        (WebCore::SegmentedSubstring::appendTo):
+        (WebCore::SegmentedSubstring::getCurrentChar8): New getter for the 8 bit case.
+        (WebCore::SegmentedSubstring::getCurrentChar16): New getter for the 16 bit case.
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar8): New wrapper functions
+        that pre-increments the 8 bit pointer and returns the next character.
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar16): New wrapper functions
+        that pre-increments the 16 bit pointer and returns the next character.
+        (WebCore::SegmentedSubstring::currentSubString):
+        (WebCore::SegmentedSubstring::getCurrentChar):
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar):
+        (WebCore::SegmentedString::SegmentedString):
+        (WebCore::SegmentedString::push):
+        (WebCore::SegmentedString::isEmpty):
+        (WebCore::SegmentedString::lookAhead):
+        (WebCore::SegmentedString::lookAheadIgnoringCase):
+        (WebCore::SegmentedString::advance):
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
+        (WebCore::SegmentedString::advanceAndASSERT):
+        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
+        (WebCore::SegmentedString::advancePastNonNewline):
+        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
+        (WebCore::SegmentedString::currentChar):
+        (WebCore::SegmentedString::setSlowCase): Set advance function pointers to slow case
+        functions.
+        (WebCore::SegmentedString::decrementAndCheckLength): Decrement substring length and
+        change to slow case functions when only one character left.
+        (WebCore::SegmentedString::setAdvanceFunctionPointers): Select appropriate advance
+        functions based on current substring.
+        (WebCore::SegmentedString::lookAheadInline): Changed to use String::startsWith().
+        (WebCore::SegmentedString::lookAheadSlowCase):
+        * xml/parser/CharacterReferenceParserInlineMethods.h:
+        (WebCore::consumeCharacterReference): Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * xml/parser/MarkupTokenizerBase.h:
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek): Changed to use
+        currentChar() instead of SegmentedString '*' operator.
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):
+
+2012-07-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123625 and r123672.
+        http://trac.webkit.org/changeset/123625
+        http://trac.webkit.org/changeset/123672
+        https://bugs.webkit.org/show_bug.cgi?id=92315
+
+        Broke Windows and gcc builds (Requested by rniwa on #webkit).
+
+        * platform/AutodrainedPool.h:
+        (AutodrainedPool):
+        * platform/ContentType.h:
+        (ContentType):
+        * platform/ContextMenu.h:
+        (ContextMenu):
+        * platform/ContextMenuItem.h:
+        (ContextMenuItem):
+        * platform/Cursor.h:
+        (WebCore::SharedCursor::SharedCursor):
+        (Cursor):
+        * platform/KURL.h:
+        (WebCore::KURL::KURL):
+        (KURL):
+        * platform/KURLGooglePrivate.h:
+        (KURLGooglePrivate):
+        * platform/PODRedBlackTree.h:
+        (WebCore::PODRedBlackTree::PODRedBlackTree):
+        * platform/Pasteboard.h:
+        (Pasteboard):
+        * platform/PlatformEvent.h:
+        (WebCore::PlatformEvent::PlatformEvent):
+        * platform/PlatformKeyboardEvent.h:
+        (PlatformKeyboardEvent):
+        * platform/PlatformMouseEvent.h:
+        (PlatformMouseEvent):
+        * platform/PlatformPasteboard.h:
+        (PlatformPasteboard):
+        * platform/PlatformTouchEvent.h:
+        (PlatformTouchEvent):
+        * platform/PlatformWheelEvent.h:
+        (PlatformWheelEvent):
+        * platform/RunLoop.h:
+        (TimerBase):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/SharedBuffer.h:
+        (SharedBuffer):
+        * platform/WheelFlingPlatformGestureCurve.h:
+        (WheelFlingPlatformGestureCurve):
+        * platform/Widget.h:
+        (Widget):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+
+2012-07-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Windows build fix attempt after r123625.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+
+2012-07-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Read tag names and attributes from the saved tokens in HTMLTreeBuilder::resetInsertionModeAppropriately.
+        https://bugs.webkit.org/show_bug.cgi?id=92240
+
+        Reviewed by Adam Barth.
+
+        This is a follow-up patch for r123577. Added ItemType enum to HTMLStackItem to handle
+        the context element case.
+
+        No new tests, covered by existing tests.
+
+        * html/parser/HTMLStackItem.h:
+        (WebCore::HTMLStackItem::create):
+        (WebCore::HTMLStackItem::HTMLStackItem):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):
+
+2012-07-25  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Remove mac_bundle_resources section from WebCore.gyp
+        https://bugs.webkit.org/show_bug.cgi?id=92207
+
+        Reviewed by Tony Chang.
+
+        It's no longer needed after http://crrev.com/148290 and
+        http://crrev.com/148187.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-07-25  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Move WebFilterOperations from RenderPassDrawQuad to RenderPass
+        https://bugs.webkit.org/show_bug.cgi?id=91885
+
+        Reviewed by Adrienne Walker.
+
+        We move the filter operations to CCRenderPass to avoid having
+        variable-length data in a WebCompositorQuad in order to serialize,
+        and also to avoid requiring a virtual destructor for the quad
+        classes.
+
+        The drawFrame method now takes a CCRenderPassIdHashMap in order
+        to connect RenderPass quads to their source RenderPass.
+
+        Covered by existing tests.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
+        (WebCore::LayerRendererChromium::drawFrame):
+        (WebCore::LayerRendererChromium::beginDrawingFrame):
+        (WebCore::LayerRendererChromium::drawBackgroundFilters):
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (WebCore::CCRenderPass::filters):
+        (WebCore::CCRenderPass::setFilters):
+        (CCRenderPass):
+        (WebCore::CCRenderPass::backgroundFilters):
+        (WebCore::CCRenderPass::setBackgroundFilters):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
+        (WebCore::CCRenderPassDrawQuad::create):
+        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
+        (CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::appendQuads):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRenderer):
+
+2012-07-25  Mike Reed  <reed@google.com>
+
+        fix test in beginLayerClippedToImage to check for immutability if we're going to do a shallow-copy
+        https://bugs.webkit.org/show_bug.cgi?id=92276
+
+        Reviewed by Stephen White.
+
+        PlatformContextSkia::beginLayerClippedToImage
+
+        This function wants to apply the provided ImageBuffer as a clip. Skia does not support this natively yet,
+        so the code makes a "copy" of that imageBuffer, to be applied later. The old code, wanting to avoid a
+        deep copy if possible, checked for the presence of a SkPixelRef. If it found one, it made a shallow copy.
+        This is flawed, since the contents of a pixelref are not guaranteed to be immutable. The new code checks
+        against this attribute: if the bitmap is "immutable" then we can make a shallow-copy, else we make a
+        deep copy.
+
+        No new tests. Existing svg layouttests work w/ or w/out this change, but at the next Skia deps roll, we see
+        failures w/o this change. The change is more "correct", though the problem case does not exhibit itself until
+        Skia rev. 4722 or later lands.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::beginLayerClippedToImage):
+
+2012-07-25  Li Yin  <li.yin@intel.com>
+
+        It is invalid when both numberOfInputChannels and numberOfOutputChannels to be zero in JavaScriptAudioNode.
+        https://bugs.webkit.org/show_bug.cgi?id=91364
+
+        Reviewed by Kenneth Russell.
+
+        Spec: http://www.w3.org/TR/webaudio/#JavaScriptAudioNode-section
+        It is invalid for both numberOfInputChannels and numberOfOutputChannels to be zero.
+
+        Test: webaudio/javascriptaudionode.html
+
+        * Modules/webaudio/JavaScriptAudioNode.cpp:
+        (WebCore::JavaScriptAudioNode::create):
+
+2012-07-24  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor CCLayerTreeHostCommon: move root layer special case initialization into internal code.
+        https://bugs.webkit.org/show_bug.cgi?id=88953
+
+        Reviewed by Adrienne Walker.
+
+        This is part 1 of trying to reduce the root layer special
+        case. This tries to reduce the special-ness of the root layer from
+        the perspective of outside code.
+
+        After this patch, code that uses calcDrawTransforms() no longer
+        needs to initialize the root layer's surface, and no longer needs
+        to manually append the root layer to the renderSurfaceLayerList.
+
+        Unit tests were also updated (much cleaner!) to account for this change.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore):
+        (WebCore::setupRootLayerAndSurfaceForRecursion):
+        (WebCore::CCLayerTreeHostCommon::calculateDrawTransforms):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
+        (CCLayerTreeHostCommon):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+
+2012-07-25  Taiju Tsuiki  <tzik@chromium.org>
+
+        FileSystem should provide a way to delete filesystem.
+        https://bugs.webkit.org/show_bug.cgi?id=91861
+
+        Reviewed by Adam Barth.
+
+        We will add a test when we wire-up the feature to Inspector.
+
+        * Modules/filesystem/LocalFileSystem.cpp: Add deleteFileSystem
+        (WebCore::deleteFileSystem):
+        (WebCore):
+        (WebCore::LocalFileSystem::deleteFileSystem):
+        * Modules/filesystem/LocalFileSystem.h:
+        (LocalFileSystem):
+        * platform/AsyncFileSystem.cpp: Add deleteFileSystem
+        (WebCore):
+        (WebCore::AsyncFileSystem::deleteFileSystem):
+        * platform/AsyncFileSystem.h:
+        (AsyncFileSystem):
+        * platform/blackberry/AsyncFileSystemBlackBerry.cpp: Add deleteFileSystem
+        (WebCore::AsyncFileSystem::deleteFileSystem):
+        (WebCore):
+        * platform/gtk/AsyncFileSystemGtk.cpp: Add deleteFileSystem
+        (WebCore::AsyncFileSystem::deleteFileSystem):
+        (WebCore):
+
+2012-07-25  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: Add more jsdocs to InjectedScriptSource.js
+        https://bugs.webkit.org/show_bug.cgi?id=92255
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InjectedScriptSource.js:
+
+2012-07-24  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Turn the debug HUD into a layer so that it can be drawn as a WebCompositorQuad
+        https://bugs.webkit.org/show_bug.cgi?id=92182
+
+        Reviewed by Adrienne Walker.
+
+        By changing the HUD into a quad, we are able to create a HUD and pass
+        it to the host compositor, allowing the HUD to be used for renderers
+        under Ubercompositor.
+
+        This also removes the special drawing code for the HUD from
+        LayerRendererChromium, allowing us to move finishDrawingFrame
+        into LayerRendererChromium as a private method and remove it
+        from the CCRenderer interface.
+
+        Finally, we can remove the CCFontAtlas transport code from CCProxy
+        and its implementations as the atlas can be synced to impl thread
+        through the usual layer commit mechanism.
+
+        The debug HUD is not covered by tests.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.cpp: Added.
+        (WebCore):
+        (WebCore::HeadsUpDisplayLayerChromium::create):
+        (WebCore::HeadsUpDisplayLayerChromium::HeadsUpDisplayLayerChromium):
+        (WebCore::HeadsUpDisplayLayerChromium::~HeadsUpDisplayLayerChromium):
+        (WebCore::HeadsUpDisplayLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/HeadsUpDisplayLayerChromium.h: Added.
+        (WebCore):
+        (HeadsUpDisplayLayerChromium):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawFrame):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
+        (WebCore::CCDebugRectHistory::savePropertyChangedRects):
+        * platform/graphics/chromium/cc/CCDebugRectHistory.h:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.cpp: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp.
+        (WebCore):
+        (WebCore::CCHeadsUpDisplayLayerImpl::CCHeadsUpDisplayLayerImpl):
+        (WebCore::CCHeadsUpDisplayLayerImpl::~CCHeadsUpDisplayLayerImpl):
+        (WebCore::CCHeadsUpDisplayLayerImpl::willDraw):
+        (WebCore::CCHeadsUpDisplayLayerImpl::appendQuads):
+        (WebCore::CCHeadsUpDisplayLayerImpl::didDraw):
+        (WebCore::CCHeadsUpDisplayLayerImpl::didLoseContext):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawHudContents):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounter):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawFPSCounterText):
+        (WebCore::CCHeadsUpDisplayLayerImpl::drawDebugRects):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplayLayerImpl.h: Renamed from Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h.
+        (WebCore):
+        (CCHeadsUpDisplayLayerImpl):
+        (WebCore::CCHeadsUpDisplayLayerImpl::create):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::layerIsAlwaysDamaged):
+        This flag is used to mark the HUD as always damaged, so that it is
+        continually drawn on the impl thread. It is also used as a hint by
+        the CCDebugRectHistory class to not include the layer in the display
+        of damage, since always damaged is not interesting damage.
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::create):
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initialize):
+        (WebCore::CCLayerTreeHost::willCommit):
+        (WebCore::CCLayerTreeHost::didCommit):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeSettings):
+        (WebCore::CCLayerTreeSettings::showDebugInfo):
+        (WebCore::CCLayerTreeSettings::showDebugRects):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRenderer):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-07-25  'Pavel Feldman'  <pfeldman@chromium.org>
+
+        Web Inspector: follow up to r123612, fixing CSS value suggest.
+
+        Not reviewed, minor JS fix.
+
+        * inspector/front-end/CSSCompletions.js:
+        (WebInspector.CSSCompletions):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-07-25  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix after r123624.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::clearGeolocationOverride):
+        Changed ASSERT_UNUSED() to UNUSED_PARAM().
+
+2012-07-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web inspector auto-completes "optimizequality" but then complains
+        https://bugs.webkit.org/show_bug.cgi?id=92262
+
+        Reviewed by Timothy Hatcher.
+
+        Fixed optimizeSpeed, optimizeLegibility, geometricPrecision.
+
+        * inspector/front-end/CSSKeywordCompletions.js:
+
+2012-07-25  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=89114
+        REGRESSION (r112919): Setting scrollTop after setting display from none to block 
+        fails
+        -and corresponding-
+        <rdar://problem/11656050>
+
+        Reviewed by Simon Fraser.
+
+        ScrollAnimatorMac::immediateScrollTo() and ScrollAnimatorMac::immediateScrollBy() 
+        both have an optimization in place so that they do not call 
+        notifyPositionChanged() if the new scroll offset matches the ScrollAnimator's 
+        cached m_currentPosX and m_currentPosY. So revision 112919 caused troubled with 
+        this optimization because it allowed RenderLayers to restore a scrollOffset from 
+        the Element if there is one cached there. This caused the RenderLayer to have a 
+        scrollOffset that is improperly out-of-synch with the ScrollAnimator's 
+        currentPosition (which will just be 0,0 since it is being re-created like the 
+        RenderLayer). This fix makes sure they are in synch by calling 
+        setCurrentPosition() on the ScrollAnimator when the cached position is non-zero.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+
+2012-07-25  Andreas Kling  <kling@webkit.org>
+
+        Make ElementAttributeData a variable-sized object to reduce memory use.
+        <http://webkit.org/b/88240>
+
+        Reviewed by Ryosuke Niwa.
+
+        Take advantage of the fact that we know at ElementAttributeData construction time how many attributes
+        it needs to accomodate and allocate exactly as much space as needed instead of using a Vector.
+        For elements that never have their attribute list mutated (the vast majority), this saves a lot of
+        memory and removes the indirection to Vector<Attribute>'s heap-allocated storage.
+
+        Introduced a mutability flag to ElementAttributeData and sprinkled assertions all over to make sure
+        that nothing tries to mutate an element with a raw attribute array.
+
+        When an Element's attribute(s) are mutated, we reconstruct the ElementAttributeData, this time using
+        a Vector as backing instead. This is triggered when calling Element::mutableAttributeData().
+
+        This reduces memory consumption by 3.2MB when viewing the full HTML5 spec at <http://whatwg.org/c/>.
+        That is a ~35% reduction in DOM attribute memory use.
+
+        Furthermore, that page ends up promoting 27% of the elements to mutable attribute storage due to dynamic
+        adding of "class" attributes. For more static pages, savings are even greater.
+
+        Also did away with ElementAttributeData::removeAttribute(name) and do separate index lookup where
+        needed. Not a big deal but avoids double lookup of attributes when removing them.
+
+        * dom/Element.cpp:
+        (WebCore::Element::detachAttribute):
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::attributes):
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::parserSetAttributes):
+        (WebCore::Element::hasEquivalentAttributes):
+        (WebCore::Element::setAttributeNode):
+        (WebCore::Element::removeAttributeNode):
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        (WebCore::Element::hasAttribute):
+        (WebCore::Element::hasAttributeNS):
+        (WebCore::Element::cloneAttributesFromElement):
+
+            Sprinkle const on ElementAttributeData* pointers.
+            Switch to using mutableAttributeData() in code paths that modify attributes.
+
+        (WebCore::Element::normalizeAttributes):
+
+            Cleaner iteration over attributes, I removed ElementAttributeData::attributeVector() since that
+            was just incurring a bunch of extra Vector copying. Since ElementAttributeData already exposes
+            length() and attributeItem(index), use those to iterate directly over the attributes.
+
+        (WebCore::Element::createMutableAttributeData):
+
+            Added, converts existing ElementAttributeData to a mutable object. Otherwise creates a new
+            ElementAttributeData (mutable and empty.)
+
+        * dom/Element.h:
+        (WebCore::Element::attributeData):
+        (WebCore::Element::updatedAttributeData):
+        (WebCore::Element::ensureAttributeData):
+        (WebCore::Element::ensureUpdatedAttributeData):
+
+            Made all of these return "const ElementAttributeData*" to ensure at compile-time that nothing
+            attempts to modify an ElementAttributeData that may be immutable.
+
+            ensureUpdatedAttributeData() is still const, despite possibly calling mutableAttributeData().
+            The goal of having methods be const is to prevent conversion from one ElementAttributeData
+            object to another, so that pointers remain intact and no unnecessary work gets done.
+
+        (WebCore::Element::mutableAttributeData):
+
+            Added, returns a guaranteed mutable ElementAttributeData* pointer.
+
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::createImmutable):
+
+            Creates a new ElementAttributeData tailored to fit the provided Vector<Attribute>.
+
+        (WebCore::ElementAttributeData::ElementAttributeData):
+
+            Moved constructors out-of-line, getting too complex for header files.
+
+            ElementAttributeData(const Vector<Attribute>&) creates an immutable ElementAttributeData
+            containing the provided attributes in an array tacked onto the end of the object.
+
+        (WebCore::ElementAttributeData::~ElementAttributeData):
+
+            Free the attribute vector if mutable.
+            For immutable objects, manually invoke destructor on each Attribute object,
+            since these won't be destroyed automatically by ~ElementAttributeData.
+
+        (WebCore::ElementAttributeData::attrIfExists):
+
+        (WebCore::ElementAttributeData::ensureAttr):
+        (WebCore::ElementAttributeData::setAttr):
+        (WebCore::ElementAttributeData::removeAttr):
+
+            Make these const, as they should always have been- they don't affect the ElementAttributeData,
+            only the global DOM Attr <-> ElementAttributeData mappings.
+
+        (WebCore::ElementAttributeData::ensureInlineStyle):
+        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
+
+            Sprinkle ASSERT(isMutable()). This doesn't mean that all Elements with inline styles automatically
+            have mutable attribute data. There's still inlineStyle() for that, which may return null.
+            These are only for use where you need a valid StylePropertySet*, even if there is no inline style
+            attribute, e.g in editing code that wants to add style.
+
+        (WebCore::ElementAttributeData::updateInlineStyleAvoidingMutation):
+        (WebCore::ElementAttributeData::destroyInlineStyle):
+
+            Make these const. While destroyInlineStyle() doesn't sound very const-y, immutable objects that
+            contain a style attribute will have a valid inlineStyle() with that style data. This is just
+            an interface for ~StyledElement to destroy the style object.
+            It'd be nice to do that in ~ElementAttributeData(), but we need a StyledElement* pointer to
+            clean up properly and we don't store one in this class.
+
+        (WebCore::ElementAttributeData::addAttribute):
+        (WebCore::ElementAttributeData::removeAttribute):
+        (WebCore::ElementAttributeData::clearAttributes):
+        (WebCore::ElementAttributeData::replaceAttribute):
+
+            Sprinkle ASSERT(isMutable()).
+            Always go straight for m_mutableAttributeVector since we know that's the storage being used.
+
+        (WebCore::ElementAttributeData::isEquivalent):
+        (WebCore::ElementAttributeData::detachAttrObjectsFromElement):
+        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
+        (WebCore::ElementAttributeData::removeAttribute):
+        (WebCore::ElementAttributeData::getAttributeItem):
+        (WebCore::ElementAttributeData::getAttributeItemIndex):
+
+            Use length() and attributeItem(index) to iterate over the attributes.
+
+        (WebCore::ElementAttributeData::cloneDataFrom):
+
+            Sprinkle ASSERT(isMutable()). Added a FIXME that cloning elements could create immutable
+            attribute data. I'm not sure this optimization is worthwhile, as cloning elements is already
+            a semi-rare occurrence.
+
+            Updated code to handle both immutable and mutable source objects. This could 
+
+        (WebCore::ElementAttributeData::getAttributeNode):
+
+            Const correctness.
+
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+
+            Turn attribute storage into what's effectively union { OwnPtr<Vector<Attribute>>; Attribute[]; }
+            The new m_isMutable bit determines which union member should be used for access.
+
+        (WebCore::ElementAttributeData::create):
+        (WebCore::ElementAttributeData::createImmutable):
+
+            Added createImmutable(const Vector<Attribute>&) as a complement to create().
+
+        (WebCore::ElementAttributeData::setClass):
+        (WebCore::ElementAttributeData::setIdForStyleResolution):
+        (WebCore::ElementAttributeData::inlineStyle):
+        (WebCore::ElementAttributeData::setAttributeStyle):
+
+            Make these const, and their data member counterparts 'mutable'.
+            An immutable ElementAttributeData object still has m_classNames, m_idForStyleResolution,
+            m_inlineStyleDecl and m_attributeStyle.
+
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+
+            Updated for isMutable().
+
+        (WebCore::ElementAttributeData::makeMutable):
+
+            Returns a mutable clone of itself.
+
+        (WebCore::ElementAttributeData::isEmpty):
+        (WebCore::ElementAttributeData::length):
+        (WebCore::ElementAttributeData::attributeItem):
+
+            Check isMutable() to know how to access attribute storage.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::style):
+        (WebCore::StyledElement::setInlineStyleProperty):
+
+            Simplify by using StyledElement::ensureInlineStyle().
+
+        (WebCore::StyledElement::classAttributeChanged):
+
+            Use mutableAttributeData() if the attribute is being removed completely.
+            In other cases, tiptoe around without causing the attribute data to go mutable.
+
+        (WebCore::StyledElement::removeInlineStyleProperty):
+
+            Use mutableAttributeData() if/when actually removing something.
+
+        (WebCore::StyledElement::addSubresourceAttributeURLs):
+
+            Const correctness.
+
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::ensureInlineStyle):
+
+            This now implies conversion to mutable attribute data. Used by codepaths that add/remove
+            properties, so conversion is inevitable.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):
+        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
+        * svg/properties/SVGAnimatedPropertyMacros.h:
+        (WebCore::SVGSynchronizableAnimatedProperty::synchronize):
+
+            Use mutableAttributeData() as appropriate.
+
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+
+            Const correctness.
+
+2012-07-25  Andrew Wilson  <atwilson@chromium.org>
+
+        Unreviewed, rolling out r123560.
+        http://trac.webkit.org/changeset/123560
+        https://bugs.webkit.org/show_bug.cgi?id=90321
+
+        Breaks chromium valgrind tests.
+
+        * html/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryDocumentParser::append):
+        * html/parser/HTMLEntityParser.cpp:
+        (WebCore::HTMLEntityParser::consumeNamedEntity):
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::stripLeadingAndTrailingHTMLSpaces):
+        * html/parser/HTMLSourceTracker.cpp:
+        (WebCore::HTMLSourceTracker::sourceForToken):
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::script):
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::SegmentedString):
+        (WebCore::SegmentedString::operator=):
+        (WebCore::SegmentedString::clear):
+        (WebCore::SegmentedString::append):
+        (WebCore::SegmentedString::prepend):
+        (WebCore::SegmentedString::advanceSubstring):
+        (WebCore::SegmentedString::advance):
+        (WebCore::SegmentedString::advanceSlowCase):
+        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase):
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedSubstring::SegmentedSubstring):
+        (WebCore::SegmentedSubstring::clear):
+        (WebCore::SegmentedSubstring::appendTo):
+        (SegmentedSubstring):
+        (WebCore::SegmentedString::SegmentedString):
+        (WebCore::SegmentedString::push):
+        (WebCore::SegmentedString::isEmpty):
+        (WebCore::SegmentedString::lookAhead):
+        (WebCore::SegmentedString::lookAheadIgnoringCase):
+        (WebCore::SegmentedString::advance):
+        (WebCore::SegmentedString::advanceAndASSERT):
+        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
+        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
+        (SegmentedString):
+        (WebCore::SegmentedString::advancePastNonNewline):
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
+        (WebCore::SegmentedString::operator*):
+        (WebCore::SegmentedString::operator->):
+        (WebCore::SegmentedString::current):
+        (WebCore::SegmentedString::equalsLiterally):
+        (WebCore::SegmentedString::equalsIgnoringCase):
+        (WebCore::SegmentedString::lookAheadInline):
+        (WebCore::SegmentedString::lookAheadSlowCase):
+        * xml/parser/CharacterReferenceParserInlineMethods.h:
+        (WebCore::consumeCharacterReference):
+        * xml/parser/MarkupTokenizerBase.h:
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek):
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):
+
+2012-07-25  Konrad Piascik  <kpiascik@rim.com>
+
+        Web Inspector: Geolocation override
+        https://bugs.webkit.org/show_bug.cgi?id=89365
+
+        Reviewed by Pavel Feldman.
+
+        Re-added the m_page member variable for GeolocationController since
+        it's now being used by InspectorInstrumentaiton.
+
+        Added a way to override the GeolocationPosition and GeolocationError
+        using Web Inspector. Curretnly only PositionError can be set.
+
+        This will be hidden behind the experiments flag for now.
+
+        Tests: inspector/geolocation-error.html
+               inspector/geolocation-success.html
+               inspector/geolocation-watchPosition.html
+
+        * English.lproj/localizedStrings.js:
+        * Modules/geolocation/GeolocationController.cpp:
+        (WebCore::GeolocationController::GeolocationController):
+        (WebCore::GeolocationController::positionChanged):
+        * Modules/geolocation/GeolocationController.h:
+        (GeolocationController):
+        * inspector/Inspector.json:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::overrideGeolocationPositionImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::overrideGeolocationPosition):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::setGeolocationOverride):
+        (WebCore):
+        (WebCore::InspectorPageAgent::clearGeolocationOverride):
+        (WebCore::InspectorPageAgent::canOverrideGeolocation):
+        (WebCore::InspectorPageAgent::overrideGeolocationPosition):
+        * inspector/InspectorPageAgent.h:
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.UserAgentSettingsTab):
+        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
+        (WebInspector.UserAgentSettingsTab.prototype._onGeolocationOverrideCheckboxClicked):
+        (WebInspector.UserAgentSettingsTab.prototype._applyGeolocationUserInput):
+        (WebInspector.UserAgentSettingsTab.prototype._setGeolocationPosition.set if):
+        (WebInspector.UserAgentSettingsTab.prototype._setGeolocationPosition):
+        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement.createInput):
+        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement):
+        * inspector/front-end/UserAgentSupport.js:
+        (WebInspector.UserAgentSupport.GeolocationPosition):
+        (WebInspector.UserAgentSupport.GeolocationPosition.prototype.toSetting):
+        (WebInspector.UserAgentSupport.GeolocationPosition.parseSetting):
+        (WebInspector.UserAgentSupport.GeolocationPosition.parseUserInput):
+        (WebInspector.UserAgentSupport.GeolocationPosition.clearGeolocationOverride):
+        * inspector/front-end/inspector.js:
+        (WebInspector.doLoadedDone):
+
+2012-07-25  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Build fix for clang builds after r123628
+        https://bugs.webkit.org/show_bug.cgi?id=92266
+
+        Reviewed by Adrienne Walker.
+
+        An un-used variable was causing build failures for clang builds
+        after the refactoring in r123628.  It is correct to simply remove
+        this value.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsInternal):
+
+2012-07-25  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: extract function from SpeechRecognitionResult::emma()
+        https://bugs.webkit.org/show_bug.cgi?id=92232
+
+        Reviewed by Adam Barth.
+
+        Extract code for creating emma-qualified names to a helper function.
+
+        Just a refactoring; covered by the existing test.
+
+        * Modules/speech/SpeechRecognitionResult.cpp:
+        (WebCore::emmaQualifiedName):
+        (WebCore):
+        (WebCore::SpeechRecognitionResult::emma):
+
+2012-07-25  Adrienne Walker  <enne@google.com>
+
+        [chromium] Unify compositor quadTransform/drawTransform/originTransform
+        https://bugs.webkit.org/show_bug.cgi?id=91417
+
+        Reviewed by Kenneth Russell.
+
+        drawTransform used to operate on centered layer rects. To unify quad
+        transforms, draw transforms, and origin transforms, make draw
+        transforms operate on content rects with the origin in the top left.
+
+        This essentially eliminates the need for surface origin transforms,
+        which will be eliminated in a future patch.
+
+        Also, remove the unused CCLayerImpl::getDrawRect function.
+
+        No-op refactoring. Tested by existing tests.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::drawableContentRect):
+        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
+        (WebCore::CCDamageTracker::extendDamageForLayer):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::createSharedQuadState):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
+        (WebCore::CCLayerSorter::LayerShape::LayerShape):
+        (WebCore::CCLayerSorter::createGraphNodes):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateVisibleContentRect):
+        (WebCore::calculateDrawTransformsInternal):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::::occluded):
+        (WebCore::::unoccludedContentRect):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::appendQuadsToFillScreen):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawableContentRect):
+
+2012-07-25  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Update MediaStreamTrack to match the specification
+        https://bugs.webkit.org/show_bug.cgi?id=90180
+
+        Reviewed by Adam Barth.
+
+        MediaStreamTracks are now required to show the status of the underlying source,
+        and trigger events when that status changes.
+
+        Test: fast/mediastream/MediaStreamTrack.html
+
+        * GNUmakefile.list.am:
+        * Modules/mediastream/MediaStream.cpp:
+        (WebCore::MediaStream::MediaStream):
+        (WebCore::MediaStream::addTrack):
+        * Modules/mediastream/MediaStreamTrack.cpp:
+        (WebCore::MediaStreamTrack::create):
+        (WebCore::MediaStreamTrack::MediaStreamTrack):
+        (WebCore::MediaStreamTrack::~MediaStreamTrack):
+        (WebCore::MediaStreamTrack::setEnabled):
+        (WebCore::MediaStreamTrack::readyState):
+        (WebCore):
+        (WebCore::MediaStreamTrack::sourceChangedState):
+        (WebCore::MediaStreamTrack::stop):
+        (WebCore::MediaStreamTrack::interfaceName):
+        (WebCore::MediaStreamTrack::scriptExecutionContext):
+        (WebCore::MediaStreamTrack::eventTargetData):
+        (WebCore::MediaStreamTrack::ensureEventTargetData):
+        * Modules/mediastream/MediaStreamTrack.h:
+        * Modules/mediastream/MediaStreamTrack.idl:
+        * WebCore.gypi:
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+        * platform/chromium/support/WebMediaStreamDescriptor.cpp:
+        * platform/chromium/support/WebMediaStreamSource.cpp:
+        (WebKit::WebMediaStreamSource::setReadyState):
+        (WebKit):
+        (WebKit::WebMediaStreamSource::readyState):
+        * platform/mediastream/MediaStreamSource.cpp: Copied from Source/WebCore/platform/mediastream/MediaStreamSource.h.
+        (WebCore):
+        (WebCore::MediaStreamSource::create):
+        (WebCore::MediaStreamSource::MediaStreamSource):
+        (WebCore::MediaStreamSource::setReadyState):
+        (WebCore::MediaStreamSource::addObserver):
+        (WebCore::MediaStreamSource::removeObserver):
+        * platform/mediastream/MediaStreamSource.h:
+        (Observer):
+        (WebCore::MediaStreamSource::Observer::~Observer):
+        (MediaStreamSource):
+        (WebCore::MediaStreamSource::readyState):
+        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
+        (WebCore::MediaStreamCenterChromium::queryMediaStreamSources):
+        (WebCore::MediaStreamCenterChromium::didCreateMediaStream):
+
+2012-07-25  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Incorrect rounding in ceiledLayoutUnit and roundedLayoutUnit.
+        https://bugs.webkit.org/show_bug.cgi?id=91061
+
+        Reviewed by Adam Barth.
+
+        The two functions are currently both returning the flooredLayoutUnit when subpixel
+        layout is enabled. This patch changes them to return the correct fractional rounded
+        value.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::fromFloatCeil):
+        (FractionalLayoutUnit):
+        (WebCore::FractionalLayoutUnit::fromFloatRound):
+        * rendering/LayoutTypes.h:
+        (WebCore::roundedLayoutUnit):
+        (WebCore::ceiledLayoutUnit):
+        * rendering/RenderBlock.cpp:
+        (WebCore::updatePreferredWidth):
+
+2012-07-25  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Add *explicit* keyword to constructors in WebCore/platform
+        https://bugs.webkit.org/show_bug.cgi?id=92238
+
+        Reviewed by Kentaro Hara.
+
+        As a step to let *explicit* keyword add to constructors which have a parameter,
+        *explicit* keyword is added to Source/WebCore/platform in order to avoid implicit
+        type conversion.
+
+        Some files in platform directory can't use explicit keyword because of build breaks.
+
+        No new tests. Covered by existing tests.
+
+        * platform/AutodrainedPool.h:
+        (AutodrainedPool):
+        * platform/ContentType.h:
+        (ContentType):
+        * platform/ContextMenu.h:
+        (ContextMenu):
+        * platform/ContextMenuItem.h:
+        (ContextMenuItem):
+        * platform/Cursor.h:
+        (WebCore::SharedCursor::SharedCursor):
+        (Cursor):
+        * platform/KURL.h:
+        (WebCore::KURL::KURL):
+        (KURL):
+        * platform/KURLGooglePrivate.h:
+        (KURLGooglePrivate):
+        * platform/PODRedBlackTree.h:
+        (WebCore::PODRedBlackTree::PODRedBlackTree):
+        * platform/Pasteboard.h:
+        (Pasteboard):
+        * platform/PlatformEvent.h:
+        (WebCore::PlatformEvent::PlatformEvent):
+        * platform/PlatformKeyboardEvent.h:
+        (PlatformKeyboardEvent):
+        * platform/PlatformMouseEvent.h:
+        (PlatformMouseEvent):
+        * platform/PlatformPasteboard.h:
+        (PlatformPasteboard):
+        * platform/PlatformTouchEvent.h:
+        (PlatformTouchEvent):
+        * platform/PlatformWheelEvent.h:
+        (PlatformWheelEvent):
+        * platform/RunLoop.h:
+        (TimerBase):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/SharedBuffer.h:
+        (SharedBuffer):
+        * platform/WheelFlingPlatformGestureCurve.h:
+        (WheelFlingPlatformGestureCurve):
+        * platform/Widget.h:
+        (Widget):
+
+2012-07-25  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        NodesFromRect and area-based hit-testing can not handle CSS transforms.
+        https://bugs.webkit.org/show_bug.cgi?id=85792
+
+        Reviewed by Eric Seidel.
+
+        To support the combination of CSS transforms and rect based hit testing,
+        we need to test against the transformed rect, instead of the original rect.
+
+        This patch makes HitTestPoint store the exact transformed FloatPoint and 
+        FloatQuad, and modifies the intersection methods so that they will use a 
+        new FloatQuad based intersection when transforms requires it.
+
+        Tests: fast/dom/nodesFromRect/nodesFromRect-rotate.html
+               fast/dom/nodesFromRect/nodesFromRect-scale.html
+
+        * platform/graphics/FloatQuad.cpp:
+        (WebCore::determinant):
+        (WebCore::rightMostCornerToVector):
+        (WebCore::FloatQuad::intersectsRect):
+        (WebCore::FloatQuad::isCounterclockwise):
+        * platform/graphics/FloatQuad.h:
+        (FloatQuad):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestPoint::HitTestPoint):
+        (WebCore::HitTestPoint::operator=):
+        (WebCore::HitTestPoint::move):
+        (WebCore::HitTestPoint::intersectsRect):
+        (WebCore::HitTestPoint::intersects):
+        * rendering/HitTestResult.h:
+        (HitTestPoint):
+        (WebCore::HitTestPoint::isRectilinear):
+        (WebCore::HitTestPoint::transformedPoint):
+        (WebCore::HitTestPoint::transformedRect):
+        * rendering/HitTestingTransformState.cpp:
+        (WebCore::HitTestingTransformState::flattenWithTransform):
+        (WebCore::HitTestingTransformState::mappedArea):
+        (WebCore::HitTestingTransformState::boundsOfMappedArea):
+        * rendering/HitTestingTransformState.h:
+        (WebCore::HitTestingTransformState::create):
+        (WebCore::HitTestingTransformState::HitTestingTransformState):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::hitTestRegion):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::RenderLayer::createLocalTransformState):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestChildLayerColumns):
+        * rendering/RenderLayer.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtFloatPoint):
+
+2012-07-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Add HTMLStackItem.h to project files
+        https://bugs.webkit.org/show_bug.cgi?id=92221
+
+        Reviewed by Adam Barth.
+
+        Added HTMLStackItem.h introduced in r123399 to project files.
+
+        Project file changes only, no change in behavior thus no new tests.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-07-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123606.
+        http://trac.webkit.org/changeset/123606
+        https://bugs.webkit.org/show_bug.cgi?id=92247
+
+        broke Windows build of Chromium (Requested by tomhudson on
+        #webkit).
+
+        * Resources/colorSuggestionPicker.css: Removed.
+        * Resources/colorSuggestionPicker.js: Removed.
+        * WebCore.gyp/WebCore.gyp:
+
+2012-07-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: disabling property should remove "overriden" decoration from overriden UA shorthand.
+        https://bugs.webkit.org/show_bug.cgi?id=92253
+
+        Reviewed by Vsevolod Vlasov.
+
+        Bug fix with a test and more compilation markup.
+
+        Test: inspector/styles/styles-disable-then-enable-overriden-ua.html
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.update):
+        (WebInspector.StylePropertyTreeElement):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-07-25  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Improve ObjectPropertiesSection UI by adding a tooltip for the value.
+        https://bugs.webkit.org/show_bug.cgi?id=92225
+
+        Reviewed by Pavel Feldman.
+
+        Added tooltip with property value description on the property's valueElement.
+
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+
+2012-07-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=91931
+
+        Reviewed by Vsevolod Vlasov.
+
+        - Synthetic shorthand values are now only returned for source-less styles
+        - CSSAgents reports longhands along with the property names in getSupportedCSSProperties
+        - StylesSidebarPane now has two paths: for source-enabled styles and for CSSOM-based ones (UA styles)
+        - CSSStyleModel uses style metainfo as a source of shorthand / longhand relationship now
+
+        Test: inspector/styles/styles-overriden-properties.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getSupportedCSSProperties):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::styleWithProperties):
+        * inspector/front-end/CSSCompletions.js:
+        (WebInspector.CSSCompletions):
+        (WebInspector.CSSCompletions.requestCSSNameCompletions):
+        (WebInspector.CSSCompletions.prototype._closest):
+        (WebInspector.CSSCompletions.prototype.longhands):
+        (WebInspector.CSSCompletions.prototype.shorthands):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.prototype.longhandProperties):
+        (WebInspector.CSSStyleDeclaration.prototype.shorthandValue):
+        (WebInspector.CSSStyleDeclaration.prototype.newBlankProperty):
+        (WebInspector.CSSProperty):
+        (WebInspector.CSSProperty.parsePayload):
+        * inspector/front-end/SourceCSSTokenizer.js:
+        (WebInspector.SourceCSSTokenizer):
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+        (WebInspector.StylePropertiesSection.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.onpopulate):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-07-25  Keishi Hattori  <keishi@webkit.org>
+
+        Implement ColorSuggestionPicker page popup
+        https://bugs.webkit.org/show_bug.cgi?id=92109
+
+        Reviewed by Kent Tamura.
+
+        Implements ColorSuggestionPicker page popup. This will be used in
+        certain ports as the datalist UI for <input type=color>.
+
+        No new tests because there is no way to open the popup yet.
+
+        * Resources/colorSuggestionPicker.css: Added.
+        (body):
+        (#main):
+        (.color-swatch):
+        (.color-swatch:hover):
+        (.color-swatch-container):
+        (.other-color):
+        * Resources/colorSuggestionPicker.js: Added.
+        (getScrollbarWidth):When there are more than 20 colors we need to
+        increase the window width to accommodate the scroll bar.
+        (createElement):
+        (handleMessage):
+        (initialize):
+        (handleArgumentsTimeout):
+        (validateArguments):
+        (submitValue): Calls setValueAndClosePopup with a numValue of 0.
+        (handleCancel): Calls setValueAndClosePopup with a numValue of -1.
+        (chooseOtherColor): Calls setValueAndClosePopup with a numValue of -2.
+        (ColorPicker):
+        (ColorPicker.prototype._layout): Lays out the color swatches in a 5x4
+        grid.
+        (ColorPicker.prototype._handleSwatchClick):
+        * WebCore.gyp/WebCore.gyp:
+
+2012-07-25  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Fix arithmetic composite filter for auto-vectorization
+        https://bugs.webkit.org/show_bug.cgi?id=92123
+
+        Reviewed by Nikolas Zimmermann.
+
+        Since only clamping of the result prevents GCC from auto-vectorizing the inner loop, this patch 
+        adds a faster version of the inner loop to handle cases where clamping is unnecessary, 
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::computeArithmeticPixelsUnclamped):
+        (WebCore::arithmeticSoftware):
+
+2012-07-25  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Fix blend filter for autovectorizing
+        https://bugs.webkit.org/show_bug.cgi?id=91398
+
+        Reviewed by Nikolas Zimmermann.
+
+        Get rid of wrapper classes, and use functions directly as template argument.
+
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::feBlendNormal):
+        (WebCore::feBlendMultiply):
+        (WebCore::feBlendScreen):
+        (WebCore::feBlendDarken):
+        (WebCore::feBlendLighten):
+        (WebCore::feBlendUnknown):
+        (WebCore::platformApply):
+        (WebCore::FEBlend::platformApplyGeneric):
+
+2012-07-25  Keishi Hattori  <keishi@webkit.org>
+
+        Add methods to ColorChooserClient so the color chooser can show suggestions
+        https://bugs.webkit.org/show_bug.cgi?id=92114
+
+        Reviewed by Kent Tamura.
+
+        Added methods to ColorChooserClient so the color chooser can ask the
+        client for suggestions and current color.
+
+        No new tests. The methods are not used yet.
+
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::currentColor): Returns what color the color
+        chooser should display.
+        (WebCore):
+        (WebCore::ColorInputType::shouldShowSuggestions): Returns if the UI for
+        suggestions should be shown.
+        (WebCore::ColorInputType::suggestions): Returns a list of colors to be
+        suggested to the user.
+        * html/ColorInputType.h:
+        (ColorInputType):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement): Made dataList() public.
+        * platform/ColorChooserClient.h:
+        (ColorChooserClient):
+
+2012-07-25  Kentaro Hara  <haraken@chromium.org>
+
+        Replace int with long in test IDL files
+        https://bugs.webkit.org/show_bug.cgi?id=92181
+
+        Reviewed by Adam Barth.
+
+        int is not a valid type in WebIDL. It should be long.
+        We should replace int with long in bindings/scripts/test/*.idl.
+        This is a follow-up patch for r123550.
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        (WebDOMTestObj::readOnlyLongAttr):
+        (WebDOMTestObj::Attr):
+        (WebDOMTestObj::setAttr):
+        (WebDOMTestObj::voidMethodWithArgs):
+        (WebDOMTestObj::Method):
+        (WebDOMTestObj::MethodWithArgs):
+        (WebDOMTestObj::objMethodWithArgs):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_set_property):
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        (webkit_dom_test_obj_void_method_with_args):
+        (webkit_dom_test_obj_method):
+        (webkit_dom_test_obj_method_with_args):
+        (webkit_dom_test_obj_obj_method_with_args):
+        (webkit_dom_test_obj_get_read_only_long_attr):
+        (webkit_dom_test_obj_get_attr):
+        (webkit_dom_test_obj_set_attr):
+        (webkit_dom_test_obj_get_strawberry):
+        (webkit_dom_test_obj_set_strawberry):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjReadOnlyLongAttr):
+        (WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
+        (WebCore::jsTestObjAttr):
+        (WebCore::setJSTestObjAttr):
+        (WebCore::setJSTestObjStrawberry):
+        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionMethod):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj readOnlyLongAttr]):
+        (-[DOMTestObj Attr]):
+        (-[DOMTestObj setAttr:]):
+        (-[DOMTestObj voidMethodWithArgs:strArg:objArg:]):
+        (-[DOMTestObj Method]):
+        (-[DOMTestObj MethodWithArgs:strArg:objArg:]):
+        (-[DOMTestObj objMethodWithArgs:strArg:objArg:]):
+        (-[DOMTestObj customMethodWithArgs:strArg:objArg:]):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::readOnlyLongAttrAttrGetter):
+        (WebCore::TestObjV8Internal::staticReadOnlyLongAttrAttrGetter):
+        (WebCore::TestObjV8Internal::AttrAttrGetter):
+        (WebCore::TestObjV8Internal::AttrAttrSetter):
+        (WebCore::TestObjV8Internal::strawberryAttrSetter):
+        (WebCore::TestObjV8Internal::voidMethodWithArgsCallback):
+        (WebCore::TestObjV8Internal::MethodCallback):
+        (WebCore::TestObjV8Internal::MethodWithArgsCallback):
+        (WebCore::TestObjV8Internal::objMethodWithArgsCallback):
+        (WebCore::TestObjV8Internal::methodReturningSequenceCallback):
+        (WebCore::TestObjV8Internal::overloadedMethod2Callback):
+        (WebCore::TestObjV8Internal::overloadedMethod4Callback):
+        (WebCore):
+        (WebCore::ConfigureV8TestObjTemplate):
+
+2012-07-25  Shinya Kawanaka  <shinyak@chromium.org>
+
+        A validation bubble should not be modifiable.
+        https://bugs.webkit.org/show_bug.cgi?id=92217
+
+        Reviewed by Kent Tamura.
+
+        A user can set -webkit-user-modify: read-write to validation message elements.
+        This might cause a undesired crash like Bug 65738. They should be unmodifiable.
+
+        Test: fast/forms/validation-user-modify.html
+
+        * css/html.css:
+        Added -webkit-user-modify: read-only !important; for these elements so that they won't be
+        changed by a user.
+        (::-webkit-validation-bubble):
+        (::-webkit-validation-bubble-message):
+        (::-webkit-validation-bubble-text-block):
+        (::-webkit-validation-bubble-heading):
+        (::-webkit-validation-bubble-arrow):
+        (::-webkit-validation-bubble-arrow-clipper):
+
+2012-07-25  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt][WK2] Disable CopyToTexture for GraphicsSurfaceMac.
+        https://bugs.webkit.org/show_bug.cgi?id=92159
+
+        Disable CopyToTexture feature for GraphicsSurface on Mac.
+        While this is actually working, it is currently used for Tiles
+        that are single buffered, and therefore requires a call to glFlush.
+        This call blocks the GPU for about 40ms which would make smooth animations impossible.
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/surfaces/mac/GraphicsSurfaceMac.cpp:
+        (WebCore::GraphicsSurface::platformCreate):
+        (WebCore::GraphicsSurface::platformImport):
+
+2012-07-25  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Fix up includes in HarfBuzzNGFace.h
+        https://bugs.webkit.org/show_bug.cgi?id=92127
+
+        Reviewed by Hajime Morita.
+
+        Move constructors of FontPlatformData from headers to corresponding cpp files
+        so that we can use forward declaration for HarfBuzzNGFace instead of including HarfBuzzNGFace.h.
+        This way we can include hb.h in HarfBuzzNGFace.h.
+
+        No new tests. No changes in behavior.
+
+        * platform/graphics/FontPlatformData.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Moved from header file.
+        (WebCore):
+        * platform/graphics/FontPlatformData.h:
+        (WebCore):
+        (FontPlatformData): Moved to cpp file.
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm: Include HarfBuzzNGFace.h
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Moved from header file.
+        (WebCore):
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h:
+        (WebCore):
+        (FontPlatformData): Moved to cpp file.
+        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h: Include hb.h.
+
+2012-07-24  Benjamin Poulain  <bpoulain@apple.com> && Joseph Pecoraro  <pecoraro@apple.com>
+
+        QualifiedName's HashSet should be big enough to hold at least all the static names
+        https://bugs.webkit.org/show_bug.cgi?id=91891
+
+        Reviewed by Darin Adler.
+
+        QualifiedName's table has a standard size of 64 buckets. When initializing WebKit,
+        we create 850 static QualifiedName for the standard names (HTMLNames, SVGNames etc).
+
+        The small base size forces us to grow and rehash the table several time on startup.
+
+        This patch solves the issue by defining the initial table size to the minimum size that
+        can hold all the static QualifiedName.
+
+        * dom/QualifiedName.cpp:
+        (QualifiedNameHashTraits):
+        * dom/make_names.pl:
+        (printNamesHeaderFile):
+
+2012-07-24  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove anonymous namespace and make functions static.
+        https://bugs.webkit.org/show_bug.cgi?id=92214
+
+        Reviewed by Adam Barth.
+
+        Mark functions as static instead of enclosing them in anonymous namespaces.
+        One exception to this rule is when a function is passed as a template argument.
+        In this case, the function must have an external linkage.
+
+        No functional change. Covered by existing tests.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::hasImpliedEndTag):
+        (WebCore::causesFosterParenting):
+        (WebCore::isAllWhitespace):
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore):
+        (WebCore::tokenizerStateForContextElement):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::isNumberedHeaderElement):
+        (WebCore::isRootNode):
+        (WebCore):
+        * html/parser/HTMLEntityParser.cpp:
+        (WebCore::isAlphaNumeric):
+        * html/parser/HTMLEntitySearch.cpp:
+        (WebCore::halfway):
+        * html/parser/HTMLPreloadScanner.cpp:
+        (WebCore):
+        * html/parser/HTMLTokenizer.cpp:
+        (WebCore::toLowerCase):
+        (WebCore::vectorEqualsString):
+        (WebCore::isEndTagBufferingState):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore):
+        (WebCore::uninitializedPositionValue1):
+        (WebCore::isAllWhitespace):
+        (WebCore::isAllWhitespaceOrReplacementCharacters):
+        (WebCore::isNumberedHeaderTag):
+        (WebCore::isCaptionColOrColgroupTag):
+        (WebCore::isTableCellContextTag):
+        (WebCore::isTableBodyContextTag):
+        (WebCore::isSpecialNode):
+        (WebCore::isNonAnchorNonNobrFormattingTag):
+        (WebCore::isNonAnchorFormattingTag):
+        (WebCore::isFormattingTag):
+        (WebCore::closestFormAncestor):
+        (WebCore::mapLoweredLocalNameToName):
+        (WebCore::adjustSVGTagNameCase):
+        (WebCore::adjustAttributes):
+        (WebCore::adjustSVGAttributes):
+        (WebCore::adjustMathMLAttributes):
+        (WebCore::addNamesWithPrefix):
+        (WebCore::adjustForeignAttributes):
+
+2012-07-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed r123494 follow-up: fixed inspector undock icon.
+
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+
+2012-07-24  Kwang Yul Seo  <skyul@company100.net>
+
+        Read tag names and attributes from the saved tokens where possible.
+        https://bugs.webkit.org/show_bug.cgi?id=92079
+
+        Reviewed by Adam Barth.
+
+        Read tag names and attributes from the saved tokens, not from the DOM.
+        Also added convenient methods such as hasLocalName, hasTagName, localName,
+        isElementNode and isDocumentFragmentNode to HTMLStackItem class.
+
+        No new tests, covered by existing tests.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLNames::hasImpliedEndTag):
+        (WebCore::HTMLNames::causesFosterParenting):
+        (WebCore::HTMLConstructionSite::generateImpliedEndTagsWithExclusion):
+        (WebCore::HTMLConstructionSite::generateImpliedEndTags):
+        (WebCore::HTMLConstructionSite::shouldFosterParent):
+        * html/parser/HTMLConstructionSite.h:
+        (WebCore::HTMLConstructionSite::currentStackItem):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isNumberedHeaderElement):
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLNames::isScopeMarker):
+        (WebCore::HTMLNames::isListItemScopeMarker):
+        (WebCore::HTMLNames::isTableScopeMarker):
+        (WebCore::HTMLNames::isTableBodyScopeMarker):
+        (WebCore::HTMLNames::isTableRowScopeMarker):
+        (WebCore::HTMLNames::isForeignContentScopeMarker):
+        (WebCore::HTMLNames::isButtonScopeMarker):
+        (WebCore::HTMLNames::isSelectScopeMarker):
+        (WebCore::HTMLElementStack::ElementRecord::replaceElement):
+        (WebCore::HTMLElementStack::popUntilNumberedHeaderElementPopped):
+        (WebCore::HTMLElementStack::popUntilTableScopeMarker):
+        (WebCore::HTMLElementStack::popUntilTableBodyScopeMarker):
+        (WebCore::HTMLElementStack::popUntilTableRowScopeMarker):
+        (WebCore::HTMLElementStack::isMathMLTextIntegrationPoint):
+        (WebCore::HTMLElementStack::isHTMLIntegrationPoint):
+        (WebCore::HTMLElementStack::popUntilForeignContentScopeMarker):
+        (WebCore::HTMLElementStack::pushRootNode):
+        (WebCore::HTMLElementStack::oneBelowTop):
+        (WebCore::HTMLElementStack::topmost):
+        (WebCore):
+        (WebCore::inScopeCommon):
+        (WebCore::HTMLElementStack::hasNumberedHeaderElementInScope):
+        (WebCore::HTMLElementStack::inScope):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::HTMLElementStack::topStackItem):
+        (HTMLElementStack):
+        (WebCore::isInHTMLNamespace):
+        * html/parser/HTMLStackItem.h:
+        (WebCore::HTMLStackItem::isDocumentFragmentNode):
+        (WebCore::HTMLStackItem::isElementNode):
+        (HTMLStackItem):
+        (WebCore::HTMLStackItem::hasLocalName):
+        (WebCore::HTMLStackItem::hasTagName):
+        (WebCore::HTMLStackItem::HTMLStackItem):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore):
+        (WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken):
+        (WebCore::HTMLTreeBuilder::processFakeEndTag):
+        (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::furthestBlockForFormattingElement):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+        (WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
+        (WebCore::HTMLTreeBuilder::processEndTagForInCell):
+        (WebCore::HTMLTreeBuilder::processEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::processCaptionEndTagForInCaption):
+        (WebCore::HTMLTreeBuilder::processTrEndTagForInRow):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processCharacterBuffer):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+        (WebCore::HTMLTreeBuilder::shouldProcessTokenInForeignContent):
+        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):
+        * html/parser/HTMLTreeBuilder.h:
+
+2012-07-24  Hironori Bono  <hbono@chromium.org>
+
+        Avoid moving child objects multiple times when vertical scrollbar are shown at the left side.
+        https://bugs.webkit.org/show_bug.cgi?id=91756
+
+        Reviewed by Tony Chang.
+
+        My r123067 moves the top-left origin of an RTL element right when its vertical
+        scrollbar is shown at its left side. (That is, r123067 moves all child objects
+        in the RTL element right.) This change also increases RenderBox::clientLeft()
+        at the same time, i.e. it also moves child objects right. Furthermore, my r109512
+        moves positioned objects in an RTL element right at the same time. This makes
+        WebKit move objects in an RTL element up to three times by the scrollbar width.
+        (Moving an absolute object right increases the scrollWidth value and it causes
+        this bug.) This change removes unnecessary code that moves objects right in my
+        r109512 and RenderBox::clientLeft().
+
+        Test: scrollbars/rtl/div-absolute.html
+              fast/block/float/026.html
+              fast/block/float/028.html
+              fast/overflow/unreachable-overflow-rtl-bug.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::clientLeft): Increase clientLeft value by the width of a vertical scrollbar as written in the CSSOM specification.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromPositionedObjects): Removed unnecessary code.
+        (WebCore::RenderBlock::determineLogicalLeftPositionForChild): Removed unnecessary code.
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::clientLeft): Removed unnecessary code.
+
+2012-07-24  Dan Bernstein  <mitz@apple.com>
+
+        RenderBlock::positionForPoint can fail when the block or its children have a vertical writing mode
+        https://bugs.webkit.org/show_bug.cgi?id=92202
+
+        Reviewed by Beth Dakin.
+
+        Test: fast/writing-mode/positionForPoint.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPoint): Fixed two issues, each of which are covered by
+        one of the sub-tests in the new regression test: (1) changed to compare children’s logical
+        bounds against pointInLogicalContents, i.e. compare childern’s horizontal bounds to the
+        point’s horizontal component; and (2) changed to use logicalTopForChild and
+        logicalHeightForChild, which account for this block’s writing mode, instead of logicalTop
+        and logicalBottom, which are based on the child’s writing mode.
+
+2012-07-24  MORITA Hajime  <morrita@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=89179
+        Rendering LI having Shadow DOM seems weird
+
+        Reviewed by Dimitri Glazkov.
+
+        This incorrect rendering happend because HTMLLIElement::attach()
+        wasn't aware of composed shadow subtree. This change makes it
+        aware of that using ComposedShadowTreeParentWalker.
+
+        Test: fast/dom/shadow/shadow-and-list-elements.html
+
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::attach):
+
+2012-07-24  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: fix #include dependencies so IDBRequest isn't an include root
+        https://bugs.webkit.org/show_bug.cgi?id=92167
+
+        Reviewed by Tony Chang.
+
+        Remove implicit dependencies due to using IDBRequest.h, and fix all
+        places that break as a result.
+
+        * Modules/indexeddb/IDBCallbacks.h:
+        (WebCore):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        * Modules/indexeddb/IDBRequest.h:
+        * inspector/InspectorIndexedDBAgent.cpp:
+
+2012-07-24  Keishi Hattori  <keishi@webkit.org>
+
+        Move PagePopupClient helper functions so they can be shared
+        https://bugs.webkit.org/show_bug.cgi?id=92096
+
+        Reviewed by Kent Tamura.
+
+        Move PagePopupClient helper functions to a separate file,
+        so they can be shared with new PagePopupClients.
+
+        No new tests. Covered by fast/forms/date/calendar-picker-appearance.html
+
+        * WebCore.gypi: Added PagePopupClient.cpp
+        * html/shadow/CalendarPickerElement.cpp:
+        (WebCore::CalendarPickerElement::writeDocument): Modified to use PagePopupClient.
+        * page/PagePopupClient.cpp: Added.
+        (WebCore):
+        (WebCore::PagePopupClient::addJavaScriptString):
+        (WebCore::PagePopupClient::addProperty):
+        * page/PagePopupClient.h:
+        (WebCore::PagePopupClient::addString):
+
+2012-07-24  Jer Noble  <jer.noble@apple.com>
+
+        setting playbackRate on a MediaController doesn't change the playbackRate for slaved media
+        https://bugs.webkit.org/show_bug.cgi?id=92035
+
+        Reviewed by Darin Adler.
+
+        Allow updatePlaybackRate() to change the MediaPlayer rate when the media element has a 
+        current media controller.
+
+        Test: media/media-controller-playbackrate.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::updatePlaybackRate):
+
+2012-07-24  Hayato Ito  <hayato@chromium.org>
+
+        Rename FocusScope to FocusNavigationScope.
+        https://bugs.webkit.org/show_bug.cgi?id=92062
+
+        Reviewed by Dimitri Glazkov.
+
+        FocusNavagationScope is better name than FocusScope since the
+        class is only used for controlling focus navigation.
+
+        No new tests - no functional changes.
+
+        * page/FocusController.cpp:
+        (WebCore::FocusNavigationScope::FocusNavigationScope):
+        (WebCore::FocusNavigationScope::rootNode):
+        (WebCore::FocusNavigationScope::owner):
+        (WebCore::FocusNavigationScope::focusNavigationScopeOf):
+        (WebCore::FocusNavigationScope::focusNavigationScopeOwnedByShadowHost):
+        (WebCore::FocusNavigationScope::focusNavigationScopeOwnedByIFrame):
+        (WebCore::FocusController::findFocusableNodeDecendingDownIntoFrameDocument):
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
+        (WebCore::FocusController::findFocusableNodeAcrossFocusScope):
+        (WebCore::FocusController::findFocusableNodeRecursively):
+        (WebCore::FocusController::findFocusableNode):
+        (WebCore::FocusController::nextFocusableNode):
+        (WebCore::FocusController::previousFocusableNode):
+        * page/FocusController.h:
+        (FocusNavigationScope):
+        (FocusController):
+
+2012-07-24  Michael Saboff  <msaboff@apple.com>
+
+        Convert HTML parser to handle 8-bit resources without converting to UChar*
+        https://bugs.webkit.org/show_bug.cgi?id=90321
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests, no new functionality therefore covered by existing tests.
+
+        Changed the parsing of HTML to handle 8-bit strings without converting the 
+        whole string to 16-bits.  Primary change was to use the appropriate 
+        character pointer type (LChar* or UChar*) depending on the source string.
+        This access is abstracted in SegmentedSubstring by getCurrentChar{8,16} and
+        incrementAndGetCurrentChar{8,16} methods.  In SegmentedString, the advance()
+        and advanceAndUpdateLineNumber() methods have been refactored into a
+        state machine managed pair of function pointers.  The possible functions
+        have not only the 8 and 16 bitness factored out, they also have the 
+        "exclude line numbers" logic factored out for advanceAndUpdateLineNumber().
+        This provides a net speed-up even with the 8/16 bit testing.
+        Other changes involve using String methods to access and compare with the
+        source data.
+
+        * html/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryDocumentParser::append): Changed to use currentChar()
+        instead of SegmentedString '*' operator.
+        * html/parser/HTMLEntityParser.cpp: Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::stripLeadingAndTrailingHTMLSpaces): Added 8-bit fast path.
+        * html/parser/HTMLSourceTracker.cpp:
+        (WebCore::HTMLSourceTracker::sourceForToken): Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::script): Updated to use new String::dataSize() method.
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::SegmentedString):
+        (WebCore::SegmentedString::operator=):
+        (WebCore::SegmentedString::clear):
+        (WebCore::SegmentedString::append):
+        (WebCore::SegmentedString::prepend):
+        (WebCore::SegmentedString::advanceSubstring):
+        (WebCore::SegmentedString::advance): Changed to be a wrapper that invokes current 
+        advance function.
+        (WebCore::SegmentedString::advance8): Fast path advance function for 8 bit data.
+        (WebCore::SegmentedString::advance16): Fast path advance function for 16 bit data.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber8IncludeLineNumbers): Fast
+        path advanceAndUpdateLineNumber for 8 bit data when we need to update the line number.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber16IncludeLineNumbers): Fast
+        path advanceAndUpdateLineNumber for 16 bit data when we need to update the line number.
+        (WebCore::SegmentedString::advanceSlowCase): Slow case advance function for both
+        8 and 16 bit advance.
+        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase): Slow case
+        advanceAndUpdateLineNumber function for both 8 and 16 bit data.
+        (WebCore::SegmentedString::advanceEmpty): Advance function when input has been exhausted.
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedSubstring::SegmentedSubstring):
+        (WebCore::SegmentedSubstring::clear):
+        (SegmentedSubstring):
+        (WebCore::SegmentedSubstring::is8Bit): New getter.
+        (WebCore::SegmentedSubstring::appendTo):
+        (WebCore::SegmentedSubstring::getCurrentChar8): New getter for the 8 bit case.
+        (WebCore::SegmentedSubstring::getCurrentChar16): New getter for the 16 bit case.
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar8): New wrapper functions
+        that pre-increments the 8 bit pointer and returns the next character.
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar16): New wrapper functions
+        that pre-increments the 16 bit pointer and returns the next character.
+        (WebCore::SegmentedSubstring::currentSubString):
+        (WebCore::SegmentedSubstring::getCurrentChar):
+        (WebCore::SegmentedSubstring::incrementAndGetCurrentChar):
+        (WebCore::SegmentedString::SegmentedString):
+        (WebCore::SegmentedString::push):
+        (WebCore::SegmentedString::isEmpty):
+        (WebCore::SegmentedString::lookAhead):
+        (WebCore::SegmentedString::lookAheadIgnoringCase):
+        (WebCore::SegmentedString::advance):
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
+        (WebCore::SegmentedString::advanceAndASSERT):
+        (WebCore::SegmentedString::advanceAndASSERTIgnoringCase):
+        (WebCore::SegmentedString::advancePastNonNewline):
+        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
+        (WebCore::SegmentedString::currentChar):
+        (WebCore::SegmentedString::setSlowCase): Set advance function pointers to slow case
+        functions.
+        (WebCore::SegmentedString::decrementAndCheckLength): Decrement substring length and
+        change to slow case functions when only one character left.
+        (WebCore::SegmentedString::setAdvanceFunctionPointers): Select appropriate advance
+        functions based on current substring.
+        (WebCore::SegmentedString::lookAheadInline): Changed to use String::startsWith().
+        (WebCore::SegmentedString::lookAheadSlowCase):
+        * xml/parser/CharacterReferenceParserInlineMethods.h:
+        (WebCore::consumeCharacterReference): Changed to use currentChar() instead of
+        SegmentedString '*' operator.
+        * xml/parser/MarkupTokenizerBase.h:
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::nextInputCharacter):
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek): Changed to use
+        currentChar() instead of SegmentedString '*' operator.
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):
+
+2012-07-24  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Hint garbage collector to run if page uses Canvas contexts
+        https://bugs.webkit.org/show_bug.cgi?id=76225
+
+        Reviewed by Kentaro Hara.
+
+        Upon creating a canvas context, set a hint in the current isolate
+        indicating that a full GC should be done upon the next page
+        navigation.
+
+        This improves Chrome's robustness on some WebGL stress tests which
+        simulate real-world behavior by repeatedly navigating among
+        several samples. More general measures are being investigated, but
+        this change makes V8 behave the same as JSC on these stress tests.
+        JSC doesn't currently use generational garbage collection, so it
+        has more opportunities to discover unreferenced canvas contexts.
+
+        Test: fast/canvas/webgl/context-creation-and-destruction.html
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::V8BindingPerIsolateData::V8BindingPerIsolateData):
+            Initialize per-isolate low memory hint.
+        * bindings/v8/V8Binding.h:
+        (V8BindingPerIsolateData):
+        (WebCore::V8BindingPerIsolateData::setLowMemoryNotificationHint):
+            Set a per-isolate hint to signal a low memory condition upon the next page navigation.
+        (WebCore::V8BindingPerIsolateData::clearLowMemoryNotificationHint):
+            Clear the previously set hint.
+        (WebCore::V8BindingPerIsolateData::isLowMemoryNotificationHint):
+            Get the previously set hint.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::hintForGCIfNecessary):
+            If necessary, send V8 a hint that it should GC.
+        (WebCore):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+            Call hintForGCIfNecessary.
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+            Set a hint that we should GC upon the next page navigation.
+
+2012-07-24  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Add time spent painting to GPU benchmarking renderingStats() API.
+        https://bugs.webkit.org/show_bug.cgi?id=90019
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapCanvasLayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
+        (BitmapCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::prepareRect):
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::prepareToUpdate):
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::paintContentsRect):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        (Texture):
+        (BitmapSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        (WebCore::CanvasLayerTextureUpdater::paintContents):
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.h:
+        (CanvasLayerTextureUpdater):
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::update):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (ContentLayerChromium):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::update):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        (ImageLayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (WebCore::LayerChromium::update):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        (WebCore):
+        (WebCore::LayerTextureUpdater::Texture::prepareRect):
+        (WebCore::LayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::updatePart):
+        (WebCore::ScrollbarLayerChromium::update):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::SkPictureCanvasLayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
+        (SkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateTiles):
+        (WebCore::TiledLayerChromium::updateContentRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::updateAnimations):
+        (WebCore::CCLayerTreeHost::renderingStats):
+        (WebCore::CCLayerTreeHost::paintMasksForRenderSurface):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCRenderingStats.h:
+        (CCRenderingStats):
+        (WebCore::CCRenderingStats::CCRenderingStats):
+
+2012-07-24  Jian Li  <jianli@chromium.org>
+
+        [V8] Correct WebIDL type should be used in the testing IDL file 
+        https://bugs.webkit.org/show_bug.cgi?id=92168
+
+        Reviewed by Kentaro Hara.
+
+        Updated bindings test.
+
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_strict_function):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjPrototypeFunctionStrictFunction):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod1Callback):
+        (WebCore::TestObjV8Internal::enabledAtRuntimeMethod2Callback):
+        (WebCore::TestObjV8Internal::enabledPerContextMethod1Callback):
+        (WebCore::TestObjV8Internal::enabledPerContextMethod2Callback):
+        (WebCore::TestObjV8Internal::strictFunctionCallback):
+
+2012-07-24  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, rolling out r123191.
+        http://trac.webkit.org/changeset/123191
+        https://bugs.webkit.org/show_bug.cgi?id=91804
+
+        It might cause another performance regression.
+        http://code.google.com/p/chromium/issues/detail?id=138410
+
+        * html/FormController.cpp:
+        (FormKeyGenerator):
+        (WebCore::createKey):
+        (WebCore::FormKeyGenerator::formKey):
+        (WebCore::FormKeyGenerator::willDeleteForm):
+
+2012-07-24  Vineet Chaudhary  <rgf748@motorola.com>
+
+        [JSBinding] Merging jsUnsignedLongArrayToVector() to toNativeArray() using traits.
+        https://bugs.webkit.org/show_bug.cgi?id=90381
+
+        Reviewed by Kentaro Hara.
+
+        We can remove jsUnsignedLongArrayToVector() implementaion
+        merging it to current and toNativeArray() traits.
+
+        Tests: TestObj.idl
+        There should be no behavoiral changes as just refactoring.
+
+        * Modules/vibration/NavigatorVibration.idl: Use sequence<T> as method param than T[]
+        * bindings/js/JSDOMBinding.cpp: Moved toJSSequence() to header file.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::toJSSequence): Moved toJSSequence() to header file.
+        (WebCore::jsArray): Renamed Traits to JSValueTraits
+        (WebCore::toNativeArray): Using traits.
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::fillMessagePortArray):
+        * bindings/scripts/CodeGeneratorJS.pm: Removed unsigned long[] specific binding code.
+        (AddIncludesForType):
+        (GenerateParametersCheckExpression):
+        (JSValueToNative):
+        (NativeToJSValue):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheckExpression): Added check sequence<T> check for overloaded methods.
+        * bindings/scripts/test/JS/JSTestObj.cpp: Rebased binding test.
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
+        * bindings/scripts/test/JS/JSTestObj.h: Rebased binding test.
+        * bindings/scripts/test/TestObj.idl: Added test for sequence<T> as method parameter.
+        * bindings/scripts/test/V8/V8TestObj.cpp: Rebased binding test.
+        (WebCore::TestObjV8Internal::overloadedMethod10Callback):
+        (TestObjV8Internal):
+        (WebCore::TestObjV8Internal::overloadedMethodCallback):
+
+2012-07-24  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove an invalid assertion introduced in r123536. Unreviewed.
+
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore::AtomicMarkupTokenBase::clearExternalCharacters):
+
+2012-07-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123504.
+        http://trac.webkit.org/changeset/123504
+        https://bugs.webkit.org/show_bug.cgi?id=92169
+
+        broke a bunch of text-related tests in chromium mac debug
+        (Requested by zhenyao on #webkit).
+
+        * platform/text/cf/StringCF.cpp:
+        (WTF::String::createCFString):
+        * platform/text/cf/StringImplCF.cpp:
+        (WTF::StringImpl::createCFString):
+
+2012-07-24  Kwang Yul Seo  <skyul@company100.net>
+
+        Ensure Noah's ark without reading the DOM tree.
+        https://bugs.webkit.org/show_bug.cgi?id=92065
+
+        Reviewed by Adam Barth.
+
+        Technically we shouldn't read attributes back from the DOM. If JavaScript changes
+        the attributes values, we could get a slightly wrong output here.
+
+        Read attributes from tokens saved in the active formatting element list.
+
+        No new tests, covered by existing tests.
+
+        * html/parser/HTMLFormattingElementList.cpp:
+        (WebCore::attributeCount):
+        (WebCore::HTMLFormattingElementList::append):
+        (WebCore::HTMLFormattingElementList::tryToEnsureNoahsArkConditionQuickly):
+        (WebCore::HTMLFormattingElementList::ensureNoahsArkCondition):
+        * html/parser/HTMLFormattingElementList.h:
+        (HTMLFormattingElementList):
+        * html/parser/HTMLStackItem.h:
+        (WebCore::HTMLStackItem::localName):
+        (HTMLStackItem):
+
+2012-07-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Clear the external characters pointer of an AtomicHTMLToken before the raw token is cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=92056
+
+        Reviewed by Adam Barth.
+
+        AtomicHTMLToken keeps a pointer to the HTMLToken's buffer instead of copying the
+        characters for performance. Clear the external characters pointer before the raw token
+        is cleared to make sure that we won't have a dangling pointer.
+
+        No new tests - no functional changes.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore::AtomicMarkupTokenBase::clearExternalCharacters):
+        (AtomicMarkupTokenBase):
+
+2012-07-24  Jian Li  <jianli@chromium.org>
+
+        Add per-context setting for html notifications
+        https://bugs.webkit.org/show_bug.cgi?id=91295
+
+        Reviewed by Adam Barth.
+
+        Added a new per-context setting to control the enabling of html notifications.
+        For chromium port, we're going to disable html notifications for web
+        pages, but still keep it enabled for extensions.
+
+        Also enhance V8 code generator to support V8EnabledPerContext attribute
+        for methods.
+
+        Updated the binding tests.
+
+        * Modules/notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::document): Expose document for being used by installPerContextProperties.
+        (WebCore):
+        * Modules/notifications/NotificationCenter.h:
+        (NotificationCenter):
+        * Modules/notifications/NotificationCenter.idl: Add V8EnabledPerContext attribute.
+        * bindings/scripts/CodeGeneratorV8.pm: V8EnabledPerContext now supports methods.
+        (GenerateHeader):
+        (IsStandardFunction):
+        (GenerateNonStandardFunction):
+        (GenerateImplementation):
+        (GenerateToV8Converters):
+        (GetContextEnableFunction):
+        * bindings/scripts/test/TestObj.idl: Add test case for V8EnabledPerContext methods.
+        * bindings/scripts/test/V8/V8TestObj.cpp: Update test result.
+        (WebCore::TestObjV8Internal::enabledAtContextMethod1Callback):
+        (TestObjV8Internal):
+        (WebCore::TestObjV8Internal::enabledAtContextMethod2Callback):
+        (WebCore::V8TestObj::installPerContextProperties):
+        (WebCore::V8TestObj::wrapSlow):
+        * dom/ContextFeatures.cpp: Add a new per-context feature.
+        (WebCore::ContextFeatures::htmlNotificationsEnabled):
+        (WebCore):
+        * dom/ContextFeatures.h: Add a new per-context feature.
+
+2012-07-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123499.
+        http://trac.webkit.org/changeset/123499
+        https://bugs.webkit.org/show_bug.cgi?id=92161
+
+        Android fails to compile (Requested by zhenyao on #webkit).
+
+        * GNUmakefile.list.am:
+        * Modules/mediastream/MediaStream.cpp:
+        (WebCore::MediaStream::MediaStream):
+        (WebCore::MediaStream::addTrack):
+        * Modules/mediastream/MediaStreamTrack.cpp:
+        (WebCore::MediaStreamTrack::create):
+        (WebCore::MediaStreamTrack::MediaStreamTrack):
+        (WebCore::MediaStreamTrack::~MediaStreamTrack):
+        (WebCore::MediaStreamTrack::setEnabled):
+        * Modules/mediastream/MediaStreamTrack.h:
+        (MediaStreamTrack):
+        * Modules/mediastream/MediaStreamTrack.idl:
+        * WebCore.gypi:
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+        * platform/chromium/support/WebMediaStreamDescriptor.cpp:
+        (WebKit):
+        (WebKit::WebMediaStreamDescriptor::sources):
+        * platform/chromium/support/WebMediaStreamSource.cpp:
+        * platform/mediastream/MediaStreamSource.cpp: Removed.
+        * platform/mediastream/MediaStreamSource.h:
+        (WebCore::MediaStreamSource::create):
+        (WebCore::MediaStreamSource::muted):
+        (WebCore::MediaStreamSource::setMuted):
+        (WebCore::MediaStreamSource::MediaStreamSource):
+        (MediaStreamSource):
+        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
+        (WebCore::MediaStreamCenterChromium::queryMediaStreamSources):
+        (WebCore::MediaStreamCenterChromium::didCreateMediaStream):
+
+2012-07-24  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Crash in RenderTableSection::layoutRows
+        https://bugs.webkit.org/show_bug.cgi?id=92145
+
+        Reviewed by Abhishek Arya.
+
+        The crash came from the insertChildNode logic being confused and choosing the wrong
+        renderer for insertion. This is because after r123159, table anonymous wrappers can
+        be created as 'inline-table' and wouldn't pass the isAnonymousBlock() check.
+
+        This change also aligns the ancestor iteration with RenderBlock::addChildToAnonymousColumnBlocks.
+
+        Test: fast/table/crash-table-section-layoutRows.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::insertChildNode):
+        Changed the code to always get the right child. There is no justification to not
+        walking up to the |owner|'s direct child in all cases.
+
+2012-07-24  Tony Chang  <tony@chromium.org>
+
+        Make RenderBlock::paintChildren virtual so sub classes can change the paint order
+        https://bugs.webkit.org/show_bug.cgi?id=92042
+
+        Reviewed by Ojan Vafai.
+
+        The flexbox spec says that the order property should change the paint order of flex children.
+        To make that possible, make paintChildren virtual so RenderFlexibleBox can override it.
+
+        No new tests, this is just a refactoring.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintContents): Move some code out of paintChildren into paintContents.
+        (WebCore::RenderBlock::paintChildren): Make virtual and just have it be a simple for loop.
+        (WebCore::RenderBlock::paintChild): Move code out of paintChildren so subclasses can reuse.
+        * rendering/RenderBlock.h:
+        (RenderBlock): Make paintChildren virtual and protected so sub classes can call paintChild.
+
+2012-07-24  Anna Cavender  <annacc@chromium.org>
+
+        Create SourceBuffer and SourceBufferList objects
+        https://bugs.webkit.org/show_bug.cgi?id=91771
+
+        Reviewed by Eric Carlson.
+
+        SourceBuffer and SourceBufferList objects are needed in order to
+        implement the new object-oriented MediaSource API:
+        http://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html
+
+        No new tests - will be able to test after landing BUGWK91775
+
+        Adding new files to build files:
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        New objects:
+        * Modules/mediasource/SourceBuffer.cpp: Added.
+        * Modules/mediasource/SourceBuffer.h: Added.
+        * Modules/mediasource/SourceBuffer.idl: Added.
+        * Modules/mediasource/SourceBufferList.cpp: Added.
+        * Modules/mediasource/SourceBufferList.h: Added.
+        * Modules/mediasource/SourceBufferList.idl: Added.
+
+        New events:
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventTarget.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+
+        Object constructors:
+        * page/DOMWindow.idl:
+
+2012-07-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Store the full year in GregorianDateTime
+        https://bugs.webkit.org/show_bug.cgi?id=92067
+
+        Reviewed by Geoffrey Garen.
+
+        Use the full year instead of the offset from year 1900 
+        for the year member variable of GregorianDateTime.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2012-07-24  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not perform 8 to 16bits characters conversion when converting a WTFString to NSString/CFString
+        https://bugs.webkit.org/show_bug.cgi?id=90720
+
+        Reviewed by Geoffrey Garen.
+
+        In most String to CFString conversion, we should be able to use the "NoCopy" constructor and have
+        a relatively cheap conversion from WTF::String to CFString.
+
+        When the String is 8 bits, it was converted to 16 bits by getData16SlowCase() because of the call
+        to String::characters().
+
+        This patch adds a path for creating a CFString from a 8bits string using CFStringCreateWithBytes.
+
+        This is covered by existing tests.
+
+        * platform/text/cf/StringCF.cpp:
+        (WTF::String::createCFString): CFSTR() create static CFString, it is unecessary to retain it.
+        * platform/text/cf/StringImplCF.cpp:
+        (WTF::StringImpl::createCFString): The logic to avoid the StringWrapperCFAllocator has also been simplified.
+        The allocator creation is now closer to where it is useful.
+
+2012-07-24  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] String wrappers should be marked Independent
+        https://bugs.webkit.org/show_bug.cgi?id=91251
+
+        Reviewed by Adam Barth.
+
+        Currently V8 String wrappers are not marked Independent.
+        By marking them Independent, they can be reclaimed by the scavenger GC.
+        Although I couldn't find a case where this change reduces memory usage,
+        this change would be important for upcoming changes in string conversion
+        between V8 and WebKit (https://bugs.webkit.org/show_bug.cgi?id=91850).
+
+        'm_lastStringImpl = 0' in StringCache::remove() is important.
+        Look at the following code:
+
+            static void cachedStringCallback(v8::Persistent<v8::Value> wrapper, void* parameter)
+            {
+                ...;
+                stringCache()->remove(stringImpl);
+                wrapper.Dispose();
+            }
+
+            void StringCache::remove(StringImpl* stringImpl)
+            {
+                ...
+                if (m_lastStringImpl.get() == stringImpl)
+                    m_lastStringImpl = 0;
+            }
+
+            v8::Local<v8::String> v8ExternalString(StringImpl* stringImpl, v8::Isolate* isolate)
+            {
+                if (m_lastStringImpl.get() == stringImpl) {
+                    return v8::Local<v8::String>::New(m_lastV8String); // m_lastV8String points to a wrapper object that was accessed most recently.
+                }
+                return v8ExternalStringSlow(stringImpl, isolate);
+            }
+
+        Without 'm_lastStringImpl = 0', already disposed m_lastV8String can be used
+        in v8ExternalString(). This was a cause of the crashes of r122614.
+
+        Tests: At the initial commit of this patch (r122614),
+               the following tests had been broken due to missing 'm_lastStringImpl = 0'.
+               fast/workers/worker-location.html
+               Dromaeo/cssquery-jquery.html
+               Dromaeo/jslib-event-jquery.html
+               Dromaeo/jslib-style-jquery.html
+               Dromaeo/jslib-style-prototype.html
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::StringCache::remove):
+        (WebCore::StringCache::v8ExternalStringSlow):
+
+2012-07-24  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Update MediaStreamTrack to match the specification
+        https://bugs.webkit.org/show_bug.cgi?id=90180
+
+        Reviewed by Adam Barth.
+
+        MediaStreamTracks are now required to show the status of the underlying source,
+        and trigger events when that status changes.
+
+        Test: fast/mediastream/MediaStreamTrack.html
+
+        * GNUmakefile.list.am:
+        * Modules/mediastream/MediaStream.cpp:
+        (WebCore::MediaStream::MediaStream):
+        (WebCore::MediaStream::addTrack):
+        * Modules/mediastream/MediaStreamTrack.cpp:
+        (WebCore::MediaStreamTrack::create):
+        (WebCore::MediaStreamTrack::MediaStreamTrack):
+        (WebCore::MediaStreamTrack::~MediaStreamTrack):
+        (WebCore::MediaStreamTrack::setEnabled):
+        (WebCore::MediaStreamTrack::readyState):
+        (WebCore):
+        (WebCore::MediaStreamTrack::sourceChangedState):
+        (WebCore::MediaStreamTrack::stop):
+        (WebCore::MediaStreamTrack::interfaceName):
+        (WebCore::MediaStreamTrack::scriptExecutionContext):
+        (WebCore::MediaStreamTrack::eventTargetData):
+        (WebCore::MediaStreamTrack::ensureEventTargetData):
+        * Modules/mediastream/MediaStreamTrack.h:
+        * Modules/mediastream/MediaStreamTrack.idl:
+        * WebCore.gypi:
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+        * platform/chromium/support/WebMediaStreamDescriptor.cpp:
+        * platform/chromium/support/WebMediaStreamSource.cpp:
+        (WebKit::WebMediaStreamSource::setReadyState):
+        (WebKit):
+        (WebKit::WebMediaStreamSource::readyState):
+        * platform/mediastream/MediaStreamSource.cpp: Copied from Source/WebCore/platform/mediastream/MediaStreamSource.h.
+        (WebCore):
+        (WebCore::MediaStreamSource::create):
+        (WebCore::MediaStreamSource::MediaStreamSource):
+        (WebCore::MediaStreamSource::setReadyState):
+        (WebCore::MediaStreamSource::addObserver):
+        (WebCore::MediaStreamSource::removeObserver):
+        * platform/mediastream/MediaStreamSource.h:
+        (Observer):
+        (WebCore::MediaStreamSource::Observer::~Observer):
+        (MediaStreamSource):
+        (WebCore::MediaStreamSource::readyState):
+        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
+        (WebCore::MediaStreamCenterChromium::queryMediaStreamSources):
+        (WebCore::MediaStreamCenterChromium::didCreateMediaStream):
+
+2012-07-24  Scott Graham  <scottmg@chromium.org>
+
+        Use native (non-cygwin) binaries for perl, gperf, and bison in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=91667
+
+        Reviewed by Tony Chang.
+
+        Using native tools instead of cygwin version improves build time
+        performance by roughly 50% (on top of previous cl-instead-of-gcc
+        change).
+
+        Also, use - instead of / for cl flags, otherwise preprocessing fails
+        very slowly (due to retry loop). And, replace \ with / in gperf
+        command line. Without this, gperf emits the filename literally in
+        #line directives which causes VS to error with "unescaped \ in
+        string". Bizarrely, building ColorData.cpp with those \ in place
+        causes the IDE to exit with no error message, which was the cause of
+        the previous canary failures.
+
+        No new tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/rule_bison.py:
+        * bindings/scripts/preprocessor.pm:
+        (applyPreprocessor):
+        * make-hash-tools.pl:
+
+2012-07-24  Daniel Cheng  <dcheng@chromium.org>
+
+        Files from drag and file <input> should use getMIMETypeForExtension to determine content type.
+        https://bugs.webkit.org/show_bug.cgi?id=91702
+
+        Reviewed by Jian Li.
+
+        Awhile back, we changed File to only use getWellKnownMIMETypeForExtension to prevent web
+        pages from being able to detect what applications a user has installed indirectly through
+        the MIME types. However, some sites like YouTube's drag and drop uploader use MIME types
+        that aren't in WebKit's internal list, so we relax the restriction for Files that originate
+        from an user action.
+
+        * fileapi/File.cpp:
+        (WebCore::getContentTypeFromFileName):
+        (WebCore::createBlobDataForFile):
+        (WebCore::createBlobDataForFileWithName):
+        (WebCore::createBlobDataForFileWithMetadata):
+        (WebCore::File::createWithRelativePath):
+        (WebCore::File::File):
+        * fileapi/File.h:
+        (File):
+        (WebCore::File::create):
+        (WebCore::File::createWithName):
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::createFileList):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::addFilename):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::files):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::files):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::files):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+
+2012-07-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Snippets UI polish
+        https://bugs.webkit.org/show_bug.cgi?id=92142
+
+        Reviewed by Pavel Feldman.
+
+        Changed snippets context menu items.
+        Added run snippet status bar button.
+        Removed unused edit source button.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.SnippetJavaScriptSourceFrame):
+        (WebInspector.SnippetJavaScriptSourceFrame.prototype.statusBarItems):
+        (WebInspector.SnippetJavaScriptSourceFrame.prototype._runButtonClicked):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.SnippetsNavigatorView.prototype.getOrCreateFolderTreeElement):
+        (WebInspector.SnippetsNavigatorView.prototype.handleContextMenu):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._updateScriptViewStatusBarItems):
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.statusBarItems):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/scriptsPanel.css:
+        (.evaluate-snippet-status-bar-item .glyph):
+        (.evaluate-snippet-status-bar-item.toggled .glyph):
+
+2012-07-24  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Remove webcore_resource_files from WebCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=92129
+
+        Reviewed by Adam Barth.
+
+        It was added in http://trac.webkit.org/changeset/81706/trunk/Source/WebCore/WebCore.gypi .
+        The changes in that revision were mostly reverted in http://trac.webkit.org/changeset/119921 ,
+        but this block was forgotten. Since it just confused me for a bit, remove it.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-07-24  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        inline-table wrapper should be generated for display: inline element only
+        https://bugs.webkit.org/show_bug.cgi?id=92054
+
+        Reviewed by Abhishek Arya.
+
+        CSS 2.1 only takes into account the display when determining if we should generate
+        an inline-table. My misreading of the spec would make us generate an inline-table
+        wrapper for any inline formatting context.
+
+        Test: fast/table/inline-block-generates-table-wrapper.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::createAnonymousWithParentRenderer):
+        Changed to use display instead of isInline to properly match the spec.
+
+2012-07-24  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Temporarily continue generating backend keys for empty key lists
+        https://bugs.webkit.org/show_bug.cgi?id=92012
+
+        Reviewed by Tony Chang.
+
+        Temporarily change key behavior to allow chromium in_process_webkit
+        to call putWithIndexKeys without inadvertently preventing index
+        key generation. Note this is temporary until frontend key generation
+        patch lands.
+
+        No new tests, this is part of a refactor that doesn't change behavior.
+
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+
+2012-07-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: introduce UISourceCodeFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=92124
+
+        Reviewed by Vsevolod Vlasov.
+
+        Generic implementation of SourceFrame over UISourceCode added.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        * inspector/front-end/StylesPanel.js:
+        * inspector/front-end/UISourceCodeFrame.js: Added.
+        (WebInspector.UISourceCodeFrame):
+        (WebInspector.UISourceCodeFrame.prototype.canEditSource):
+        (WebInspector.UISourceCodeFrame.prototype.commitEditing):
+        (WebInspector.UISourceCodeFrame.prototype.afterTextChanged):
+        (WebInspector.UISourceCodeFrame.prototype._didEditContent):
+        (WebInspector.UISourceCodeFrame.prototype._onContentChanged):
+        (WebInspector.UISourceCodeFrame.prototype.populateTextAreaContextMenu):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-07-24  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11945102> REGRESSION (r109451): Overlay scrollbars always use the default style, regardless of background color
+        https://bugs.webkit.org/show_bug.cgi?id=92115
+
+        Reviewed by Mark Rowe.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scrollbarOverlayStyle): Reversed an incorrect null check.
+
+2012-07-24  Andrew Wilson  <atwilson@chromium.org>
+
+        Another prospective build fix for Chromium. Unreviewed.
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h:
+
+2012-07-24  Andrew Wilson  <atwilson@chromium.org>
+
+        Unreviewed prospective build fix for Chromium. Changed include of hb.h in HarfBuzzNGFace.h
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h:
+
+2012-07-24  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        HarfBuzzFaceNG.h forward declarations conflict with newer versions of Harfbuzz
+        https://bugs.webkit.org/show_bug.cgi?id=92103
+
+        Reviewed by Philippe Normand.
+
+        As preparation for enabling harfbuzz-ng for EFL, I would like to include the header
+        here since the forward declarations are conflicting with the harfbuzz version
+        we will use for EFL.
+
+        No new tests, no change in behavior.
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h:
+
+2012-07-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Fix blend filter for autovectorizing
+        https://bugs.webkit.org/show_bug.cgi?id=91398
+
+        Reviewed by Nikolas Zimmermann.
+
+        To support auto-vectorizing, the loop had to be unswitched, and regular arrays used that 
+        did not do boundary-checks in the inner loop. Finally the integer division by 255
+        was optimized not use integer division intrinsics.
+
+        On a X86-64 architechture using GCC -O3 on the file, this gives a speed-up of 2.9x.
+
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::fastDivideBy255):
+        (BlendNormal):
+        (WebCore::BlendNormal::apply):
+        (BlendMultiply):
+        (WebCore::BlendMultiply::apply):
+        (BlendScreen):
+        (WebCore::BlendScreen::apply):
+        (BlendDarken):
+        (WebCore::BlendDarken::apply):
+        (BlendLighten):
+        (WebCore::BlendLighten::apply):
+        (BlendUnknown):
+        (WebCore::BlendUnknown::apply):
+        (WebCore::platformApply):
+        (WebCore::FEBlend::platformApplyGeneric):
+        (WebCore::FEBlend::platformApplySoftware):
+        * platform/graphics/filters/FEBlend.h:
+        (FEBlend):
+
+2012-07-23  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Add the SpeechRecognitionResult.emma attribute
+        https://bugs.webkit.org/show_bug.cgi?id=91743
+
+        Reviewed by Adam Barth.
+
+        Implement the 'emma' attribute as described in the spec draft at
+        http://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html
+
+        Test: fast/speech/scripted/emma.html
+
+        * Modules/speech/SpeechRecognitionResult.cpp:
+        (WebCore::SpeechRecognitionResult::~SpeechRecognitionResult):
+        (WebCore):
+        (WebCore::SpeechRecognitionResult::emma):
+        * Modules/speech/SpeechRecognitionResult.h:
+        (WebCore):
+        (SpeechRecognitionResult):
+        * Modules/speech/SpeechRecognitionResult.idl:
+        * WebCore.gypi:
+        * bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp:
+        (WebCore):
+        (WebCore::V8SpeechRecognitionResult::visitDOMWrapper):
+          We need to add an implicit reference from the result object to the
+          emma object to keep the latters DOM tree alive across
+          garbage-collection.
+
+2012-07-24  Andrei Poenaru  <poenaru@adobe.com>
+
+        Web Inspector: Protocol Extension: add getFlowByName command
+        https://bugs.webkit.org/show_bug.cgi?id=91855
+
+        Reviewed by Pavel Feldman.
+
+        The "getFlowByName" command should return a NamedFlow for a given document and name.
+
+        Test: inspector/styles/protocol-css-regions-commands.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getFlowByName):
+        (WebCore):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):
+        (WebInspector.CSSStyleModel.prototype.getFlowByNameAsync):
+        (WebInspector.NamedFlow):
+        (WebInspector.NamedFlow.parsePayload):
+
+2012-07-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Fix compilation against namespaced Qt
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/Font.h:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/qt/ThirdPartyCookiesQt.h:
+
+2012-07-24  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Enable initiator column in network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=65533
+
+        Reviewed by Vsevolod Vlasov.
+
+        With 40118 fixed for webkit, Preferences.displayInitiator should be set to true.
+        Removed references to it since the optionality is no longer required.
+
+        Test: http/tests/inspector/network/network-initiator.html
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._createTable):
+        (WebInspector.NetworkLogView.prototype.switchToDetailedView):
+        (WebInspector.NetworkLogView.prototype.switchToBriefView):
+        (WebInspector.NetworkDataGridNode.prototype.createCells):
+        (WebInspector.NetworkDataGridNode.prototype.refreshRequest):
+        * inspector/front-end/Settings.js:
+
+2012-07-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Missing *explicit* keyword in dom and page.
+        https://bugs.webkit.org/show_bug.cgi?id=92074
+
+        Reviewed by Kentaro Hara.
+
+        Some constructors missed to use *explicit* keyword. They need to be added
+        *explicit* keyword to contructor which has a parameter in order to avoid
+        implicit type conversion.
+
+        Some files in dom directory can't use explicit keyword because of build breaks.
+
+        No new tests. Covered by existing tests.
+
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeTextInsertedEvent.h:
+        (BeforeTextInsertedEvent):
+        * dom/ChildListMutationScope.h:
+        (WebCore::ChildListMutationScope::ChildListMutationScope):
+        * dom/ChildNodeList.h:
+        (ChildNodeList):
+        * dom/ClientRect.h:
+        (ClientRect):
+        * dom/ClientRectList.h:
+        (ClientRectList):
+        * dom/ComposedShadowTreeWalker.h:
+        (ComposedShadowTreeParentWalker):
+        * dom/DOMCoreException.h:
+        (WebCore::DOMCoreException::DOMCoreException):
+        * dom/DOMImplementation.h:
+        (DOMImplementation):
+        * dom/DatasetDOMStringMap.h:
+        (WebCore::DatasetDOMStringMap::DatasetDOMStringMap):
+        * dom/DeviceMotionController.h:
+        (DeviceMotionController):
+        * dom/DeviceOrientationController.h:
+        (DeviceOrientationController):
+        * dom/DocumentParser.h:
+        (DocumentParser):
+        * dom/EventException.h:
+        (WebCore::EventException::EventException):
+        * dom/EventListener.h:
+        (WebCore::EventListener::EventListener):
+        * dom/ExceptionBase.h:
+        (ExceptionBase):
+        * dom/GenericEventQueue.h:
+        (GenericEventQueue):
+        * dom/KeyboardEvent.h:
+        (WebCore::KeypressCommand::KeypressCommand):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
+        * dom/MessageChannel.h:
+        (MessageChannel):
+        * dom/MessagePort.h:
+        (MessagePort):
+        * dom/MessagePortChannel.h:
+        (MessagePortChannel):
+        * dom/MutationObserver.h:
+        * dom/NamedNodeMap.h:
+        (WebCore::NamedNodeMap::NamedNodeMap):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::NodeFilter):
+        * dom/NodeWithIndex.h:
+        (WebCore::NodeWithIndex::NodeWithIndex):
+        * dom/Range.h:
+        * dom/RangeException.h:
+        (WebCore::RangeException::RangeException):
+        * dom/RawDataDocumentParser.h:
+        (WebCore::RawDataDocumentParser::RawDataDocumentParser):
+        * dom/ScriptRunner.h:
+        (ScriptRunner):
+        * dom/SelectorQuery.h:
+        (SelectorQuery):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/SpaceSplitString.h:
+        (SpaceSplitStringData):
+        * dom/StaticHashSetNodeList.h:
+        (StaticHashSetNodeList):
+        * dom/StaticNodeList.h:
+        (WebCore::StaticNodeList::StaticNodeList):
+        * dom/TransformSource.h:
+        (TransformSource):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * dom/WebKitNamedFlowCollection.h:
+        (WebKitNamedFlowCollection):
+        * page/EventHandler.h:
+        (EventHandler):
+        * page/FocusController.h:
+        (FocusController):
+        * page/FrameView.h:
+        (FrameView):
+        * page/MemoryInfo.h:
+        (MemoryInfo):
+        * page/Page.h:
+        (Page):
+        * page/PageGroup.h:
+        (PageGroup):
+        * page/PrintContext.h:
+        (PrintContext):
+        * page/Settings.h:
+        (Settings):
+        * page/SpeechInput.h:
+        (SpeechInput):
+        * page/SpeechInputResultList.h:
+        (SpeechInputResultList):
+        * page/WebKitAnimation.h:
+        * page/WindowFeatures.h:
+        (WindowFeatures):
+        * page/WorkerNavigator.h:
+        (WorkerNavigator):
+
+2012-07-24  Kent Tamura  <tkent@chromium.org>
+
+        Replace some callsites of shadowAncestorNode() with shadowHost()
+        https://bugs.webkit.org/show_bug.cgi?id=92060
+
+        Reviewed by Hajime Morita.
+
+        shadowAncestorNode() is deprecated.
+
+        No new tests. This shouldn't change behaviors.
+
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement):
+        * html/shadow/TextControlInnerElements.h:
+        (WebCore::SpinButtonElement::isEnabledFormControl):
+        (WebCore::SpinButtonElement::isReadOnlyFormControl):
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintMediaFullscreenButton):
+        (WebCore::RenderThemeEfl::paintMediaMuteButton):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::getMediaElementFromRenderObject):
+        (WebCore::centerRectVerticallyInParentInputElement):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeQt::paintMediaSliderThumb):
+        Removed an ASSERT() because nullness of o->node() is already asserted.
+        * rendering/RenderInputSpeech.cpp:
+        (WebCore::RenderInputSpeech::paintInputFieldSpeechButton):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSliderThumb):
+        Passing shadowHost() to toParentMediaElement(), which accepts 0 and will return 0.
+        (WebCore::paintMediaVolumeSliderThumb): ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        Remove an ASSERT(input) because input never be null unless o->node() is
+        null. If o->node() is null, this function crashes.
+        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        It's ok to ignore "node is a media element" case because this function
+        works only if node->isMediaControlElement().
+        (WebCore::RenderThemeMac::paintMediaPlayButton): ditto.
+        (WebCore::RenderThemeMac::paintMediaSliderTrack): ditto.
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSearchFieldCancelButton):
+        Remove an ASSERT(input) because input never be null unless o->node() is
+        null. If o->node() is null, this function crashes.
+        (WebCore::RenderThemeSafari::paintSearchFieldResultsDecoration): ditto.
+        (WebCore::RenderThemeSafari::paintSearchFieldResultsButton): ditto.
+        * rendering/RenderThemeWinCE.cpp:
+        (WebCore::mediaElementParent):
+
+2012-07-24  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Build fix for Android after r123424
+        https://bugs.webkit.org/show_bug.cgi?id=92082
+
+        Unreviewed build fix.
+
+        Mark removed the PlatformSupport.h header from ScrollbarThemeChromiumAndroid.cpp
+        in r123424, while there still are two references left to another method and a
+        constant. Re-add the include directive.
+
+        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
+
+2012-07-24  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] REGRESSION(r122912): CodeGeneratorJS.pm generates wrong code
+        for static attributes in supplemental IDL files
+        https://bugs.webkit.org/show_bug.cgi?id=91925
+
+        Reviewed by Adam Barth.
+
+        r122912 implemented static attributes in CodeGeneratorJS.pm.
+        However, it generates wrong code for static attributes in supplemental
+        IDL files. This patch fixes it as shown in JSTestInterface.cpp.
+        This fix aligns with the fix in CodeGeneratorV8.pm (r123308).
+
+        Test: bindings/scripts/test/TestSupplemental.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
+
+2012-07-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Add *explicit* keyword to constructor which has a parameter in bridge, history, loader and plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=92064
+
+        Reviewed by Kentaro Hara.
+
+        Some constructors missed to use *explicit* keyword. They need to be added
+        *explicit* keyword to contructor which has a parameter in order to avoid
+        implicit type conversion.
+
+        No new tests. Covered by existing tests.
+
+        * bridge/IdentifierRep.h:
+        (WebCore::IdentifierRep::IdentifierRep):
+        * history/BackForwardListImpl.h:
+        (BackForwardListImpl):
+        * history/CachedFrame.h:
+        (CachedFrame):
+        * history/HistoryItem.h:
+        (HistoryItem):
+        * loader/DocumentWriter.h:
+        (DocumentWriter):
+        * loader/FrameNetworkingContext.h:
+        (WebCore::FrameNetworkingContext::FrameNetworkingContext):
+        * loader/HistoryController.h:
+        * loader/ImageLoader.h:
+        (ImageLoader):
+        * loader/LinkLoader.h:
+        (LinkLoader):
+        * loader/MainResourceLoader.h:
+        (MainResourceLoader):
+        * loader/NavigationAction.h:
+        (NavigationAction):
+        * loader/NavigationScheduler.h:
+        (NavigationScheduler):
+        * loader/PolicyChecker.h:
+        (PolicyChecker):
+        * loader/SubframeLoader.h:
+        (SubframeLoader):
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
+        * plugins/PluginData.h:
+        (PluginData):
+        * plugins/PluginViewBase.h:
+        (WebCore::PluginViewBase::PluginViewBase):
+
+2012-07-24  Patrick Gansterer  <paroga@webkit.org>
+
+        [Qt] Fix conversion from GregorianDateTime to QTime
+        https://bugs.webkit.org/show_bug.cgi?id=92068
+
+        Reviewed by Simon Hausmann.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2012-07-24  Arko Saha  <arko@motorola.com>
+
+        Microdata: Implement PropertyNodeList interface.
+        https://bugs.webkit.org/show_bug.cgi?id=80269
+
+        Reviewed by Ryosuke Niwa.
+
+        Added support for PropertyNodeList interface. Currently HTMLPropertiesCollection.namedItem(name)
+        returns NodeList object. Made changes so that it will return PropertyNodeList object.
+
+        Implemented propertyNodeList.getValues() method. It returns an array of various values. Its
+        values are obtained from the "itemValue" DOM property of each of the elements represented by
+        the object, in tree order.
+
+        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/common-dom-interfaces.html#propertynodelist
+
+        Tests: fast/dom/MicroData/nameditem-returns-propertynodelist.html
+               fast/dom/MicroData/propertynodelist-getvalues-array-values-obtained-from-itemvalue-of-each-element.html
+               fast/dom/MicroData/propertynodelist-getvalues-test.html
+               fast/dom/MicroData/propertynodelist-test-add-remove-element.html
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/gobject/GNUmakefile.am:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSMicroDataItemValueCustom.cpp: Added.
+        (WebCore):
+        (WebCore::toJS): Added toJS() custom method. Returns Node if itemValue is node else returns String.
+        * bindings/v8/custom/V8MicroDataItemValueCustom.cpp: Added.
+        (WebCore):
+        (WebCore::toV8): Added toV8 custom code.
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeListCacheBase::rootNode): Return document if owner node has itemref attribute specified.
+        (WebCore):
+        (WebCore::DynamicNodeListCacheBase::ownerNodeHasItemRefAttribute): Returns true if owner node has itemref attribute
+        specified with root type NodeListRootedAtDocumentIfOwnerHasItemrefAttr.
+        (WebCore::DynamicNodeListCacheBase::invalidateCache):
+        (WebCore::DynamicNodeList::itemWithName): Update itemrefElements cache if root type is
+        NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr.
+        * dom/DynamicNodeList.h: Added m_hasItemRefElements in DynamicNodeListCacheBase to check if itemRefElmenets cache
+        is valid.
+        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument):
+        (DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeListCacheBase::isItemRefElementsCacheValid):
+        (WebCore::DynamicNodeListCacheBase::setItemRefElementsCacheValid):
+        (WebCore::DynamicNodeListCacheBase::rootType): Returns cached root type.
+        (WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange): Invalidate NodeListCache on itemref
+        attribute change.
+        * dom/Node.cpp:
+        (WebCore::Node::propertyNodeList):
+        * dom/Node.h:
+        (WebCore):
+        (Node):
+        * dom/PropertyNodeList.cpp: Added.
+        (WebCore):
+        (WebCore::PropertyNodeList::PropertyNodeList):
+        (WebCore::PropertyNodeList::~PropertyNodeList):
+        (WebCore::PropertyNodeList::elementIsPropertyOfRefElement): Checks if the testElement is a property of Microdata
+        item.
+        (WebCore::PropertyNodeList::updateRefElements):
+        (WebCore::PropertyNodeList::nodeMatches):
+        (WebCore::PropertyNodeList::getValues): Returns PropertyValueArray whose values are obtained from the
+        itemValue DOM property of each of the elements represented by the object, in tree order.
+        * dom/PropertyNodeList.h: Added.
+        (WebCore):
+        (PropertyNodeList):
+        (WebCore::PropertyNodeList::create):
+        * dom/PropertyNodeList.idl: Added.
+        * html/HTMLCollection.cpp:
+        (WebCore::DynamicNodeListCacheBase::itemCommon): Update itemrefElements cache if its a NodeListCollectionType with
+        root type NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::properties):
+        (WebCore):
+        (WebCore::HTMLElement::getItemRefElements): Returns the ItemRefElements list of given element. Added this
+        method to share the code between HTMLPropertiesCollection and PropertyNodeList to update itemRefElements.
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
+        (WebCore::HTMLPropertiesCollection::updateRefElements):
+        (WebCore::HTMLPropertiesCollection::updateNameCache):
+        (WebCore::HTMLPropertiesCollection::namedItem): Return PropertyNodeList object instead of NodeList.
+        (WebCore::HTMLPropertiesCollection::hasNamedItem): Return true if it finds an item with given
+        name in the properties collection.
+        * html/HTMLPropertiesCollection.h: Removed m_hasItemRefElements member variable, now DynamicNodeListCacheBase
+        has isItemRefElementsCacheValid. Also removed m_hasPropertyNameCache, as DynamicNodeListCacheBase already has
+        hasNameCache() and setHasNameCache().
+        (WebCore):
+        (HTMLPropertiesCollection):
+        (WebCore::HTMLPropertiesCollection::invalidateCache):
+        (WebCore::HTMLPropertiesCollection::updatePropertyCache):
+        * html/HTMLPropertiesCollection.idl:
+        * html/MicroDataItemValue.idl: Added.
+        * page/DOMWindow.idl:
+
+2012-07-24  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] REGRESSION(r122912): CodeGeneratorJS.pm should not
+        implicitly assume ScriptExecutionContext for static attributes
+        https://bugs.webkit.org/show_bug.cgi?id=91924
+
+        Reviewed by Adam Barth.
+
+        r122912 implemented static attributes in CodeGeneratorJS.pm.
+        However, the generated code assumes that static attributes
+        always require ScriptExecutionContext, which is wrong.
+        If we need a ScriptExecutionContext, we should specify
+        [CallWith=ScriptExecutionContext].
+
+        This patch fixes CodeGeneratorJS.pm so that static attributes
+        do not assume ScriptExecutionContext. This fix aligns with
+        the fix in CodeGeneratorV8.pm in r123308.
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjConstructorStaticReadOnlyIntAttr):
+        (WebCore::jsTestObjConstructorStaticStringAttr):
+        (WebCore::setJSTestObjConstructorStaticStringAttr):
+
+2012-07-23  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Missing *explicit* keyword in editing.
+        https://bugs.webkit.org/show_bug.cgi?id=92055
+
+        Reviewed by Ryosuke Niwa.
+
+        Some constructors missed to use *explicit* keyword. They need to be added
+        *explicit* keyword to contructor which has a parameter in order to avoid
+        implicit type conversion.
+
+        No new tests. Covered by existing tests.
+
+        * editing/AlternativeTextController.h:
+        (WebCore::AlternativeTextController::UNLESS_ENABLED):
+        * editing/BreakBlockquoteCommand.h:
+        (BreakBlockquoteCommand):
+        * editing/DeleteButton.h:
+        (DeleteButton):
+        * editing/DeleteButtonController.h:
+        (DeleteButtonController):
+        * editing/EditCommand.h:
+        (EditCommand):
+        (WebCore::SimpleEditCommand::SimpleEditCommand):
+        * editing/EditingBehavior.h:
+        (WebCore::EditingBehavior::EditingBehavior):
+        * editing/EditingStyle.h:
+        (EditingStyle):
+        * editing/Editor.h:
+        (Editor):
+        * editing/FrameSelection.h:
+        (FrameSelection):
+        * editing/InsertLineBreakCommand.h:
+        (InsertLineBreakCommand):
+        * editing/ModifySelectionListLevel.h:
+        (ModifySelectionListLevelCommand):
+        (DecreaseSelectionListLevelCommand):
+        * editing/RemoveFormatCommand.h:
+        (RemoveFormatCommand):
+        * editing/RemoveNodeCommand.h:
+        (RemoveNodeCommand):
+        * editing/RemoveNodePreservingChildrenCommand.h:
+        (RemoveNodePreservingChildrenCommand):
+        * editing/ReplaceNodeWithSpanCommand.h:
+        (ReplaceNodeWithSpanCommand):
+        * editing/TextInsertionBaseCommand.h:
+        (TextInsertionBaseCommand):
+        * editing/UndoManager.h:
+        (UndoManager):
+        * editing/UnlinkCommand.h:
+        (UnlinkCommand):
+        * editing/WrapContentsInDummySpanCommand.h:
+        (WrapContentsInDummySpanCommand):
+
+2012-07-23  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Need AccessibilityObjects for nodes without renderers in canvas subtree
+        https://bugs.webkit.org/show_bug.cgi?id=87899
+
+        Reviewed by Chris Fleizach.
+
+        Refactors AccessibilityRenderObject so that it inherits from a new class,
+        AccessibilityNodeObject, that can be constructed from a Node without a
+        renderer. Modifies AXObjectCache so that it automatically creates an
+        AccessibilityNodeObject for elements in a canvas subtree but not otherwise.
+        A new layout test verifies that this correctly exposes an accessibility
+        tree with appropriate roles for elements in a canvas subtree.
+
+        This patch does not try to complete the implementation of
+        AccessibilityNodeObject. Most AX methods are still unimplemented and need
+        to be migrated from AccessibilityRenderObject to AccessibilityNodeObject
+        in a future patch.
+        
+        This patch also doesn't change anything outside of WebCore/accessibility, so
+        the rest of WebCore only calls AXObjectCache when there are changes to a
+        RenderObject, not to a Node. Accessible notifications on nodes without
+        renderers need to be implemented in a future patch.
+
+        Test: accessibility/canvas-accessibilitynodeobject.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::get):
+        (WebCore):
+        (WebCore::createFromNode):
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        * accessibility/AXObjectCache.h:
+        (AXObjectCache):
+        (WebCore::AXObjectCache::get):
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::AccessibilityARIAGrid):
+        (WebCore):
+        (WebCore::AccessibilityARIAGrid::~AccessibilityARIAGrid):
+        (WebCore::AccessibilityARIAGrid::init):
+        (WebCore::AccessibilityARIAGrid::create):
+        * accessibility/AccessibilityARIAGrid.h:
+        (AccessibilityARIAGrid):
+        * accessibility/AccessibilityARIAGridCell.cpp:
+        (WebCore::AccessibilityARIAGridCell::create):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::create):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::create):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::create):
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::create):
+        (WebCore::AccessibilityMediaControlsContainer::create):
+        (WebCore::AccessibilityMediaTimeline::create):
+        (WebCore::AccessibilityMediaTimeDisplay::create):
+        * accessibility/AccessibilityMenuList.cpp:
+        (WebCore::AccessibilityMenuList::create):
+        (WebCore):
+        * accessibility/AccessibilityMenuList.h:
+        (AccessibilityMenuList):
+        * accessibility/AccessibilityNodeObject.cpp: Added.
+        (WebCore):
+        (WebCore::AccessibilityNodeObject::AccessibilityNodeObject):
+        (WebCore::AccessibilityNodeObject::~AccessibilityNodeObject):
+        (WebCore::AccessibilityNodeObject::init):
+        (WebCore::AccessibilityNodeObject::create):
+        (WebCore::AccessibilityNodeObject::detach):
+        (WebCore::AccessibilityNodeObject::childrenChanged):
+        (WebCore::AccessibilityNodeObject::updateAccessibilityRole):
+        (WebCore::AccessibilityNodeObject::firstChild):
+        (WebCore::AccessibilityNodeObject::lastChild):
+        (WebCore::AccessibilityNodeObject::previousSibling):
+        (WebCore::AccessibilityNodeObject::nextSibling):
+        (WebCore::AccessibilityNodeObject::parentObjectIfExists):
+        (WebCore::AccessibilityNodeObject::parentObject):
+        (WebCore::AccessibilityNodeObject::elementRect):
+        (WebCore::AccessibilityNodeObject::setNode):
+        (WebCore::AccessibilityNodeObject::document):
+        (WebCore::AccessibilityNodeObject::determineAccessibilityRole):
+        (WebCore::AccessibilityNodeObject::addChildren):
+        (WebCore::AccessibilityNodeObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):
+        (WebCore::AccessibilityNodeObject::determineAriaRoleAttribute):
+        (WebCore::AccessibilityNodeObject::ariaRoleAttribute):
+        (WebCore::AccessibilityNodeObject::remapAriaRoleDueToParent):
+        * accessibility/AccessibilityNodeObject.h: Added.
+        (WebCore):
+        (AccessibilityNodeObject):
+        (WebCore::AccessibilityNodeObject::isAccessibilityNodeObject):
+        (WebCore::AccessibilityNodeObject::node):
+        (WebCore::AccessibilityNodeObject::isDetached):
+        (WebCore::toAccessibilityNodeObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isAccessibilityNodeObject):
+        * accessibility/AccessibilityProgressIndicator.cpp:
+        (WebCore::AccessibilityProgressIndicator::create):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        (WebCore::AccessibilityRenderObject::init):
+        (WebCore):
+        (WebCore::AccessibilityRenderObject::create):
+        (WebCore::AccessibilityRenderObject::detach):
+        (WebCore::AccessibilityRenderObject::setRenderer):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        (WebCore::AccessibilityRenderObject::addCanvasChildren):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::create):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::AccessibilityTable):
+        (WebCore):
+        (WebCore::AccessibilityTable::~AccessibilityTable):
+        (WebCore::AccessibilityTable::init):
+        (WebCore::AccessibilityTable::create):
+        * accessibility/AccessibilityTable.h:
+        (AccessibilityTable):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::create):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::create):
+
+2012-07-23  David Barr  <davidbarr@chromium.org>
+
+        Fix ENABLE_CSS_IMAGE_ORIENTATION compile flag
+        https://bugs.webkit.org/show_bug.cgi?id=91961
+
+        Reviewed by Tony Chang.
+
+        https://bugs.webkit.org/show_bug.cgi?id=89055
+        A rule was missed implementing the ENABLE_CSS_IMAGE_ORIENTATION compile flag.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+        Half of the missing rule was inadvertently added together with ENABLE_CSS_STICKY_POSITION.
+
+        No new tests; build configuration fix.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Douglas Stockwell  <dstockwell@chromium.org>
+
+        Null-pointer crash when a derived color like -webkit-activelink is set in a gradient stop
+        https://bugs.webkit.org/show_bug.cgi?id=89148
+
+        Reviewed by Simon Fraser.
+
+        CSSGradientValue attempted to resolve colors during paint, this crashed
+        when a derived color like -webkit-activelink was encountered because the
+        corresponding element was no longer available in the StyleResolver.
+        Instead, by adding a field to CSSGradientColorStop we can resolve and
+        then cache the resolved colors at the correct time. To avoid sharing
+        cached derived colors between elements we clone the gradient values when
+        needed.
+
+        Test: fast/css/crash-on-gradient-with-derived-color.html
+
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::gradientWithStylesResolved): Added. Resolve and cache
+        resolved colors, clone if colors are derived from the element.
+        (WebCore):
+        (WebCore::CSSGradientValue::addStops):
+        (WebCore::CSSGradientValue::isCacheable): Defer to new logic in
+        StyleResolver.
+        * css/CSSGradientValue.h:
+        (CSSGradientColorStop): Added cache of resolved color.
+        (CSSGradientValue):
+        (CSSLinearGradientValue):
+        (CSSRadialGradientValue):
+        * css/CSSImageGeneratorValue.h:
+        (WebCore):
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isGradientValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+        (StyleResolver):
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::image): Revert change from r96449. This
+        is no longer necessary as the gradient colors are now resolved at a
+        time when the style is set on StyleResolver.
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Move GregorianDateTime from JSC to WTF namespace
+        https://bugs.webkit.org/show_bug.cgi?id=91948
+
+        Reviewed by Geoffrey Garen.
+
+        Moving GregorianDateTime into the WTF namespace allows us to us to
+        use it in WebCore too. The new class has the same behaviour as the
+        old struct. Only the unused timeZone member has been removed.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2012-07-23  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Move layoutTestMode to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=92010
+
+        Reviewed by Adam Barth.
+
+        Part of a refactoring series. See tracking bug 82948.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        * platform/LayoutTestSupport.cpp: Added.
+        (WebCore):
+        (WebCore::isRunningLayoutTest):
+        (WebCore::setIsRunningLayoutTest):
+        * platform/LayoutTestSupport.h: Added.
+        (WebCore):
+        * platform/chromium/PlatformSupport.h:
+        (PlatformSupport):
+        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
+        (WebCore::ScrollbarThemeChromiumAndroid::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumAndroid::paintScrollbarBackground):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore):
+        (WebCore::LookupAltName):
+        (WebCore::fontContainsCharacter):
+        (WebCore::FillLogFont):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/skia/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/skia/FontSkia.cpp:
+        (WebCore::Font::drawGlyphs):
+        * rendering/RenderThemeChromiumAndroid.cpp:
+        (WebCore::RenderThemeChromiumAndroid::systemColor):
+        (WebCore::RenderThemeChromiumAndroid::adjustInnerSpinButtonStyle):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::usesTestModeFocusRingColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore):
+        (WebCore::RenderThemeChromiumWin::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumWin::systemColor):
+        (WebCore::menuListButtonWidth):
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+
+2012-07-23  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Add droppedFrameCount to renderingStats.
+        https://bugs.webkit.org/show_bug.cgi?id=91694
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/cc/CCFrameRateCounter.cpp:
+        (WebCore):
+        (WebCore::CCFrameRateCounter::frameInterval):
+        (WebCore::CCFrameRateCounter::frameIndex):
+        (WebCore::CCFrameRateCounter::CCFrameRateCounter):
+        (WebCore::CCFrameRateCounter::markBeginningOfFrame):
+        (WebCore::CCFrameRateCounter::isBadFrame):
+        * platform/graphics/chromium/cc/CCFrameRateCounter.h:
+        (WebCore::CCFrameRateCounter::droppedFrameCount):
+        (CCFrameRateCounter):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::renderingStats):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCRenderingStats.h:
+        (CCRenderingStats):
+        (WebCore::CCRenderingStats::CCRenderingStats):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::implSideRenderingStats):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::implSideRenderingStatsOnImplThread):
+
+2012-07-23  Dan Bernstein  <mitz@apple.com>
+
+        Fixed the build after r123418.
+
+        * WebCore.exp.in: Added DocumentMarkerController::addTextMatchMarker.
+
+2012-07-23  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: optimise blending expression
+        https://bugs.webkit.org/show_bug.cgi?id=90037
+
+        Reviewed by Tony Chang.
+
+        Introduce a new calc expression node - a BlendLength node. Given two Lengths and a progress
+        this blends them together when evaluated.
+
+        An alternative and more general approach of being able to blend two CalcExpressionNodes was
+        tested, but involves more memory allocations, was measurably slower, and nothing currently
+        would make use of the generality. 
+
+        No functional change. Covered by existing tests.
+
+        * platform/CalculationValue.h:
+        (CalcExpressionBlendLength):
+        (WebCore::CalcExpressionBlendLength::CalcExpressionBlendLength):
+        (WebCore::CalcExpressionBlendLength::operator==):
+        (WebCore::CalcExpressionBlendLength::evaluate):
+        (WebCore):
+        * platform/Length.cpp:
+        (WebCore::Length::blendCalculation):
+
+2012-07-23  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Show search tickmarks on css-styled scrollbars
+        https://bugs.webkit.org/show_bug.cgi?id=91949
+
+        Reviewed by Adrienne Walker.
+
+        This is done by letting RenderScrollbarTheme::paintTickmarks()
+        delegate to the native ScrollbarTheme. To make this possible,
+        move paintTickmarks() from ScrollbarThemeComposite to the
+        superclass ScrollbarTheme.
+
+        For testing, add internals.addTextMatchMarker() and add a pixel test.
+
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paintTickmarks):
+        Moved paintTickmarks() from ScrollbarThemeComposite to here.
+        * platform/ScrollbarThemeComposite.h:
+        Remove paintTickmarks().
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        Switch to drawing tickmarks as vectors, so they can be arbitrarily wide.
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        (ScrollbarThemeChromiumMac):
+        Implement paintTickmarks(), so that css-styled scrollbars get tickmarks on mac.
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        (WebCore::ScrollbarThemeChromiumMac::paintTickmarks):
+        Implement paintTickmarks(), so that css-styled scrollbars get tickmarks on mac.
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::paintTickmarks):
+        Delegate to the native ScrollbarTheme for tickmark drawing.
+        (WebCore):
+        * rendering/RenderScrollbarTheme.h:
+        (RenderScrollbarTheme):
+        Override paintTickmarks().
+
+2012-07-23  Brian Anderson  <brianderson@chromium.org>
+
+        [chromium] Use shallow flushes that don't glFlush
+        https://bugs.webkit.org/show_bug.cgi?id=90325
+
+        Reviewed by Kenneth Russell.
+
+        Adds plumbing for the shallowFlushCHROMIUM extension and uses
+        shallow flushes instead of normal flushes when uploading textures.
+        Shallow flushes allow us to initiate command buffer flushes to
+        the GPU thread/process without the overhead of a true glFlush.
+
+        CCTextureUpdaterTest updated to recognize shallow flushes.
+
+        * platform/chromium/support/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::shallowFlushCHROMIUM):
+        (WebCore):
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        (Extensions3DChromium):
+        * platform/graphics/chromium/cc/CCGraphicsContext.h:
+        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
+        (WebCore::CCResourceProvider::shallowFlushIfSupported):
+        (WebCore):
+        (WebCore::CCResourceProvider::CCResourceProvider):
+        (WebCore::CCResourceProvider::initialize):
+        * platform/graphics/chromium/cc/CCResourceProvider.h:
+        (CCResourceProvider):
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
+        (WebCore::CCTextureUpdater::update):
+
+2012-07-23  Hanyee Kim  <choco@company100.net>
+
+        When using TextureMapper, WebKit does not retain final value of opacity in animations, unless it is specified on the last key frame.
+        https://bugs.webkit.org/show_bug.cgi?id=91322
+
+        Reviewed by Noam Rosenthal.
+
+        When -webkit-fill-mode is forwards, GraphicsLayerAnimation::apply does not apply
+        the property values defined in the last executing keyframe after the final iteration of animation.
+
+        This patch does not return right after the end of animation, but it keeps applying
+        the property values defined in the last executing keyframe.
+        Add normalizedAnimationValueForFillsForwards function that returns a normalized value of the
+        last executing keyframe.
+
+        Link to CSS Animations spec: http://www.w3.org/TR/css3-animations/#animation-fill-mode-property
+
+        Test: animations/fill-mode-forwards2.html
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::normalizedAnimationValueForFillsForwards):
+        (WebCore):
+        (WebCore::GraphicsLayerAnimation::apply):
+
+2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123184, r123195, and r123197.
+        http://trac.webkit.org/changeset/123184
+        http://trac.webkit.org/changeset/123195
+        http://trac.webkit.org/changeset/123197
+        https://bugs.webkit.org/show_bug.cgi?id=92049
+
+        pagecycler regression (Requested by morrita on #webkit).
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::suggestedMIMEType):
+        * dom/Document.h:
+        (WebCore):
+        (WebCore::Node::isDocumentNode):
+        (WebCore::Node::Node):
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::setDocument):
+        (WebCore):
+        (WebCore::Node::setTreeScope):
+        (WebCore::Node::treeScope):
+        (WebCore::Node::isInShadowTree):
+        (WebCore::Node::reportMemoryUsage):
+        * dom/Node.h:
+        (Node):
+        (WebCore::Node::document):
+        (WebCore::Node::inDocument):
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::NodeRareData):
+        (WebCore::NodeRareData::treeScope):
+        (WebCore::NodeRareData::setTreeScope):
+        (NodeRareData):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::TreeScope):
+        (WebCore::TreeScope::setParentTreeScope):
+        * dom/TreeScope.h:
+        (WebCore):
+        (WebCore::TreeScope::idTargetObserverRegistry):
+        (TreeScope):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        (WebCore::TreeScopeAdopter::moveNodeToNewDocument):
+        * editing/MoveSelectionCommand.cpp:
+        * editing/RemoveNodeCommand.cpp:
+        * editing/RemoveNodePreservingChildrenCommand.cpp:
+        * inspector/PageConsoleAgent.cpp:
+
+2012-07-23  Roger Fong  <roger_fong@apple.com>
+
+        On Windows, if select element is off screen horizontally, 
+        menu is either inappropriately resized or positioned offscreen.
+        https://bugs.webkit.org/show_bug.cgi?id=91913
+        <rdar://problem/7611229>
+
+        Reviewed by Tim Horton.
+
+        If the select element is positioned off the edge of the screen to the left, 
+        the menu is resized. It should not be resized, just shifted to remain on the screen.
+        If the select element is positioned off the edge of the screen to the right, 
+        the menu goes off screen instead of being shifted over to appear on screen.
+        This problem only occurs on Windows.
+        
+        Test: ManualTests/win/select-menu-off-screen.html
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::calculatePositionAndSize):
+        Modified final horizontal position calculation code to position
+        popup menu on screen if it would otherwise go off.
+        
+2012-07-23  David Dorwin  <ddorwin@chromium.org>
+
+        Fixed crash in webkitAddKey() when key parameter is null.
+        https://bugs.webkit.org/show_bug.cgi?id=85444
+
+        Reviewed by Kentaro Hara.
+
+        Reference: Step 1 of http://dvcs.w3.org/hg/html-media/raw-file/5f76a0b43836/encrypted-media/encrypted-media.html#dom-addkey
+
+        Tests: media/encrypted-media/encrypted-media-syntax.html 
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::webkitAddKey):
+
+2012-07-23  Hayato Ito  <hayato@chromium.org>
+
+        A FocusScope for a distributed node should not be its TreeScope.
+        https://bugs.webkit.org/show_bug.cgi?id=91829
+
+        Reviewed by Dimitri Glazkov.
+
+        Current implementation of FocusScope::focusScopeOf(Node*) returns
+        the given node's treeScope().  That does not apply if the node is
+        a distributed node.  We should calculate a FocusScope for a
+        distributed node by traversing ancestor nodes in Composed Shadow
+        Tree.
+
+        Test: fast/dom/shadow/focus-navigation-with-distributed-nodes.html
+
+        * page/FocusController.cpp:
+        (WebCore::FocusScope::focusScopeOf):
+
+2012-07-23  Douglas Stockwell  <dstockwell@google.com>
+
+        Null-pointer crash when parsing border-image
+        https://bugs.webkit.org/show_bug.cgi?id=91963
+
+        Reviewed by Darin Adler.
+
+        Test: fast/css/border-image-fill-crash.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseBorderImageRepeat): Handle the case where
+        parseBorderImageRepeat is called when the value list is empty.
+
+2012-07-23  Bem Jones-Bey  <bjonesbe@adobe.com>
+
+        [CSS Exclusions] SVG shape errors should invalidate exclusion shapes
+        https://bugs.webkit.org/show_bug.cgi?id=91761
+
+        Reviewed by Andreas Kling.
+
+        CSS exclusion shapes that are specified with negative radiuses or
+        height/width are now considered invalid and ignored.
+
+        Tests added to
+        LayoutTests/fast/exclusions/parsing-wrap-shape-lengths.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseExclusionShapeRectangle):
+        (WebCore::CSSParser::parseExclusionShapeCircle):
+        (WebCore::CSSParser::parseExclusionShapeEllipse):
+
+2012-07-23  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Implement scrollbar theme for Android
+        https://bugs.webkit.org/show_bug.cgi?id=91674
+
+        Reviewed by Adam Barth.
+
+        Previously the scrollbar for Android was implemented as an extra
+        drawing pass in the compositor. Now we switch to use the standard
+        ScrollbarTheme mechanism.
+
+        No new tests. We use mock scrollbars during layout test to share
+        pixel results with Linux.
+
+        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
+        (WebCore::ScrollbarThemeChromiumAndroid::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumAndroid::thumbPosition):
+        (WebCore::ScrollbarThemeChromiumAndroid::thumbLength):
+        (WebCore::ScrollbarThemeChromiumAndroid::backButtonRect):
+        (WebCore::ScrollbarThemeChromiumAndroid::forwardButtonRect):
+        (WebCore::ScrollbarThemeChromiumAndroid::trackRect):
+        (WebCore):
+        (WebCore::ScrollbarThemeChromiumAndroid::paintThumb):
+        (WebCore::ScrollbarThemeChromiumAndroid::paintScrollbarBackground):
+        * platform/chromium/ScrollbarThemeChromiumAndroid.h:
+        (WebCore::ScrollbarThemeChromiumAndroid::usesOverlayScrollbars):
+        (ScrollbarThemeChromiumAndroid):
+        (WebCore::ScrollbarThemeChromiumAndroid::hasButtons):
+        (WebCore::ScrollbarThemeChromiumAndroid::hasThumb):
+
+2012-07-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Use the original token to create an element in "reconstruct the active formatting elements" and "call the adoption agency"
+        https://bugs.webkit.org/show_bug.cgi?id=91703
+
+        Reviewed by Adam Barth.
+
+        The current WebKit HTML5 parser implementation does not hold the original token
+        in the stack of open elements and the active formatting elements. This is
+        problematic because the original token is used to create an element in
+        "reconstruct the active formatting elements" and "call the adoption agency".
+
+        As a workaround, WebKit uses the saved element instead of the original token
+        to create an element. But this causes us to fail examples like this:
+        <b id="1"><p><script>document.getElementById("1").id = "2"</script></p>TEXT</b>
+        reconstructTheActiveFormattingElements calls this method to open a second <b>
+        tag to wrap TEXT, it will have id "2", even though the HTML5 spec implies it
+        should be "1".
+
+        Created a ref-counted container class, HTMLStackItem to hold the original token
+        and the namespace URI as well as the element. Changed HTMLElementStack and
+        HTMLFormattingElementList to use HTMLStackItem.
+        Changed HTMLConstructionSite::reconstructTheActiveFormattingElements and
+        HTMLTreeBuilder::callTheAdoptionAgency to create an element from the saved token
+        instead of the saved element.
+
+        Updated test expectation for html5lib/runner-expected.txt
+        because now resources/scripted/adoption01.dat passes.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
+        (WebCore::HTMLConstructionSite::insertHTMLBodyElement):
+        (WebCore::HTMLConstructionSite::insertHTMLFormElement):
+        (WebCore::HTMLConstructionSite::insertHTMLElement):
+        (WebCore::HTMLConstructionSite::insertFormattingElement):
+        (WebCore::HTMLConstructionSite::insertScriptElement):
+        (WebCore::HTMLConstructionSite::insertForeignElement):
+        (WebCore::HTMLConstructionSite::createElementFromSavedToken):
+        (WebCore::HTMLConstructionSite::reconstructTheActiveFormattingElements):
+        * html/parser/HTMLConstructionSite.h:
+        (HTMLConstructionSite):
+        (WebCore::HTMLConstructionSite::currentElementRecord):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLElementStack::ElementRecord::ElementRecord):
+        (WebCore::HTMLElementStack::ElementRecord::replaceElement):
+        (WebCore::HTMLElementStack::pushRootNode):
+        (WebCore::HTMLElementStack::pushHTMLHtmlElement):
+        (WebCore::HTMLElementStack::pushRootNodeCommon):
+        (WebCore::HTMLElementStack::pushHTMLHeadElement):
+        (WebCore::HTMLElementStack::pushHTMLBodyElement):
+        (WebCore::HTMLElementStack::push):
+        (WebCore::HTMLElementStack::insertAbove):
+        (WebCore::HTMLElementStack::pushCommon):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::HTMLElementStack::ElementRecord::element):
+        (WebCore::HTMLElementStack::ElementRecord::node):
+        (WebCore::HTMLElementStack::ElementRecord::stackItem):
+        (ElementRecord):
+        (HTMLElementStack):
+        * html/parser/HTMLFormattingElementList.cpp:
+        (WebCore::HTMLFormattingElementList::swapTo):
+        (WebCore::HTMLFormattingElementList::append):
+        * html/parser/HTMLFormattingElementList.h:
+        (WebCore::HTMLFormattingElementList::Entry::Entry):
+        (WebCore::HTMLFormattingElementList::Entry::isMarker):
+        (WebCore::HTMLFormattingElementList::Entry::stackItem):
+        (WebCore::HTMLFormattingElementList::Entry::element):
+        (WebCore::HTMLFormattingElementList::Entry::replaceElement):
+        (WebCore::HTMLFormattingElementList::Entry::operator==):
+        (WebCore::HTMLFormattingElementList::Entry::operator!=):
+        (Entry):
+        (HTMLFormattingElementList):
+        * html/parser/HTMLStackItem.h: Added.
+        (WebCore):
+        (HTMLStackItem):
+        (WebCore::HTMLStackItem::create):
+        (WebCore::HTMLStackItem::element):
+        (WebCore::HTMLStackItem::node):
+        (WebCore::HTMLStackItem::token):
+        (WebCore::HTMLStackItem::namespaceURI):
+        (WebCore::HTMLStackItem::HTMLStackItem):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
+2012-07-23  Andreas Kling  <kling@webkit.org>
+
+        Report the extra memory used by immutable StylePropertySet objects.
+        <http://webkit.org/b/92032>
+
+        Reviewed by Anders Carlsson.
+
+        Add an optional parameter to the MemoryClassInfo constructor for passing in additional base object
+        size on top of sizeof(T).
+
+        Use this in StylePropertySet::reportMemoryUsage() to properly account for the CSSProperty array
+        tacked onto the end of the object when m_isMutable == false.
+
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::reportMemoryUsage):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryObjectInfo::reportObjectInfo):
+        (WebCore::MemoryClassInfo::MemoryClassInfo):
+
+2012-07-23  Gregg Tavares  <gman@google.com>
+
+        Fix WebGL texSubImage2D for cube maps
+        https://bugs.webkit.org/show_bug.cgi?id=91927
+
+        Reviewed by Kenneth Russell.
+
+        Fixes texSubImage2D so any size rectangle can be passed in
+        for cube maps.
+
+        Test: fast/canvas/webgl/tex-sub-image-cube-maps.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::copyTexImage2D):
+        (WebCore::WebGLRenderingContext::texImage2DBase):
+        (WebCore::WebGLRenderingContext::texSubImage2DBase):
+        (WebCore::WebGLRenderingContext::validateTexFuncParameters):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebGLRenderingContext):
+
+2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123387.
+        http://trac.webkit.org/changeset/123387
+        https://bugs.webkit.org/show_bug.cgi?id=92036
+
+        Broke chromium win build (Requested by tony^work on #webkit).
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/rule_bison.py:
+        * bindings/scripts/preprocessor.pm:
+        (applyPreprocessor):
+        * make-hash-tools.pl:
+
+2012-07-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Ref-count AtomicHTMLToken
+        https://bugs.webkit.org/show_bug.cgi?id=91981
+
+        Reviewed by Adam Barth.
+
+        Ref-count AtomicHTMLToken to avoid copying AtomicHTMLToken in Bug 91703.
+
+        No new tests - no functional changes.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        (WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagInBody):
+        (WebCore::HTMLConstructionSite::insertHTMLBodyStartTagInBody):
+        (WebCore::HTMLConstructionSite::insertDoctype):
+        (WebCore::HTMLConstructionSite::insertComment):
+        (WebCore::HTMLConstructionSite::insertCommentOnDocument):
+        (WebCore::HTMLConstructionSite::insertCommentOnHTMLHtmlElement):
+        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
+        (WebCore::HTMLConstructionSite::insertHTMLBodyElement):
+        (WebCore::HTMLConstructionSite::insertHTMLFormElement):
+        (WebCore::HTMLConstructionSite::insertHTMLElement):
+        (WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement):
+        (WebCore::HTMLConstructionSite::insertFormattingElement):
+        (WebCore::HTMLConstructionSite::insertScriptElement):
+        (WebCore::HTMLConstructionSite::insertForeignElement):
+        (WebCore::HTMLConstructionSite::createElement):
+        (WebCore::HTMLConstructionSite::createHTMLElement):
+        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
+        * html/parser/HTMLConstructionSite.h:
+        (HTMLConstructionSite):
+        * html/parser/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::create):
+        (AtomicHTMLToken):
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::ExternalCharacterTokenBuffer):
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        (WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken):
+        (WebCore::HTMLTreeBuilder::processToken):
+        (WebCore::HTMLTreeBuilder::processDoctypeToken):
+        (WebCore::HTMLTreeBuilder::processFakeStartTag):
+        (WebCore::HTMLTreeBuilder::processFakeEndTag):
+        (WebCore::HTMLTreeBuilder::processFakePEndTagIfPInButtonScope):
+        (WebCore::HTMLTreeBuilder::attributesForIsindexInput):
+        (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
+        (WebCore):
+        (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processStartTagForInTable):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processBodyEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+        (WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
+        (WebCore::HTMLTreeBuilder::processEndTagForInRow):
+        (WebCore::HTMLTreeBuilder::processEndTagForInCell):
+        (WebCore::HTMLTreeBuilder::processEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::processEndTagForInTable):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processComment):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+        (WebCore::HTMLTreeBuilder::defaultForBeforeHTML):
+        (WebCore::HTMLTreeBuilder::defaultForBeforeHead):
+        (WebCore::HTMLTreeBuilder::defaultForInHead):
+        (WebCore::HTMLTreeBuilder::defaultForInHeadNoscript):
+        (WebCore::HTMLTreeBuilder::defaultForAfterHead):
+        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
+        (WebCore::HTMLTreeBuilder::processGenericRCDATAStartTag):
+        (WebCore::HTMLTreeBuilder::processGenericRawTextStartTag):
+        (WebCore::HTMLTreeBuilder::processScriptStartTag):
+        (WebCore::HTMLTreeBuilder::shouldProcessTokenInForeignContent):
+        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):
+        (WebCore::HTMLTreeBuilder::parseError):
+        * html/parser/HTMLTreeBuilder.h:
+        (HTMLTreeBuilder):
+        * html/parser/TextDocumentParser.cpp:
+        (WebCore::TextDocumentParser::insertFakePreElement):
+
+2012-07-23  Scott Graham  <scottmg@google.com>
+
+        Use native (non-cygwin) binaries for perl, gperf, and bison in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=91667
+
+        Reviewed by Tony Chang.
+
+        Using native tools instead of cygwin version improves build time
+        performance by roughly 50% (on top of previous cl-instead-of-gcc
+        change).
+
+        Also, use - instead of / for cl flags because a layer of project
+        generator converts them to \ otherwise, which causes the preprocessing
+        to fail (very slowly because of the cygwin-loop with a sleep 1).
+
+        No new tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/rule_bison.py:
+        * bindings/scripts/preprocessor.pm:
+        (applyPreprocessor):
+        * make-hash-tools.pl:
+
+2012-06-12  Jer Noble  <jer.noble@apple.com>
+
+        MediaController.currentTime should be kept stable during script execution.
+        https://bugs.webkit.org/show_bug.cgi?id=88555
+
+        Reviewed by Eric Carlson.
+
+        Test: media/media-controller-time-constant.html
+
+        To keep MediaController.currentTime stable, add a new m_position variable and 
+        a new m_clearPositionTimer timer.  Both must be mutable variables as they will
+        be updated from within const functions.  Calls to currentTime() will result in
+        stable values until the next runloop iteration.
+
+        * html/MediaController.cpp:
+        (MediaController::MediaController):
+        (MediaController::currentTime):
+        (MediaController::setCurrentTime):
+        (MediaController::clearPositionTimerFired):
+        * html/MediaController.h:
+
+2012-07-23  Huang Dongsung  <luxtella@company100.net>
+
+        Destroy CSS decoded data more eagerly once they become dead caches.
+        https://bugs.webkit.org/show_bug.cgi?id=91733
+
+        Reviewed by Geoffrey Garen.
+
+        Internal review by Kwang Yul Seo.
+
+        There are three CachedResources with decoded data: CachedImage, CachedScript
+        and CachedCSSStyleSheet. In the cases of CachedImage and CachedScript, we
+        eagerly destroy the decoded data using Timer in CacehdResource::allClientsRemoved().
+        We must apply the same policy here in CachedCSSStyleSheet because priority
+        inversion can occur. For example, we can't destroy the decoded data of CachedImages
+        when they are referenced by CachedCSSStyleSheet as background, mask or border
+        images.
+
+        No new tests - no new testable functionality.
+
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet):
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
+        (WebCore::CachedCSSStyleSheet::destroyDecodedData):
+        (WebCore):
+        (WebCore::CachedCSSStyleSheet::decodedDataDeletionTimerFired):
+        * loader/cache/CachedCSSStyleSheet.h:
+        (CachedCSSStyleSheet):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 2 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Turn on ENABLE_CSS_STICKY_POSITION. Add support for parsing the new '-webkit-sticky'
+        value for position, returning it from getComputedStyle(), and storing it in RenderStyle.
+
+        Test: fast/css/sticky/parsing-position-sticky.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::getPositionOffsetValue):
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EPosition):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2012-07-23  Stephen Chenney  <schenney@chromium.org>
+
+        Crash when setting empty class name on a new element
+        https://bugs.webkit.org/show_bug.cgi?id=92024
+
+        Reviewed by Andreas Kling.
+
+        Add a check for null attributeData() when setting the className to an
+        empty string on a newly created element. New SVG elements have null
+        attributeData() on baseVal upon creation.
+
+        Test: svg/custom/empty-className-baseVal-crash.html
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged): Add check for null attributeData()
+
+2012-07-23  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor CCLayerTreeHostCommon: clean up clipRect and drawableContentRect design
+        https://bugs.webkit.org/show_bug.cgi?id=80622
+
+        Reviewed by Adrienne Walker.
+
+        clipRect(), usesLayerClipping(), and drawableContentRect() have been
+        very confusing in CCLayerTreeHostCommon for a while. This patch
+        refactors it so that (1) clipping is only done locally in
+        calcDrawTransforms, and (2) the layer's drawableContentRect value
+        is now meaningful value outside of calcDrawTransforms.
+        Additionally, the layer is now always clipped to the root
+        surface's contentBounds (which are set to the viewport bounds).
+        This refactor not only makes calcDrawTransforms far more readable and intuitive, but
+        this patch enables more upcoming beneficial refactors, including
+        the pending refactor in https://bugs.webkit.org/show_bug.cgi?id=88953.
+
+        Tests are also significantly updated to keep up with this refactoring change.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        Removed m_usesLayerClipping and m_clipRect and associated accessors.
+
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (RenderSurfaceChromium):
+        Updated comment
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        Removed m_usesLayerClipping and m_clipRect and associated accessors.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::updateLayers):
+        removed setClipRect code that no longer applies
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateLayerScissorRect):
+        scissor rect is now a little bit tighter, the intersection between damage and layer's new drawableContentRect.
+
+        (WebCore::calculateSurfaceScissorRect):
+        scissor rect is now a little bit tighter, except when filters are involved.
+
+        (WebCore::layerClipsSubtree):
+        new helper function
+
+        (WebCore):
+        (WebCore::calculateVisibleContentRect):
+        (WebCore::subtreeShouldRenderToSeparateSurface):
+        (WebCore::calculateDrawTransformsInternal):
+           - added drawableContentRectOfSubtree to the function args, it is valid only after recursion returns,
+           - added clipRectFromAncestor and bool ancestorClipsSubtree to function args, this replaces the layer's clipRect and usesLayerClipping.
+           - removed the boolean return value, which was redundant with drawableContentRectOfSubtree.
+           - replaced all the "setDrawableContentRect" logic with more intuitive, clear logic.
+           - now, layer's drawableContentRect represents the clipped bounds of the layer expressed in the target surface space.
+
+        (WebCore::CCLayerTreeHostCommon::calculateDrawTransforms):
+        (WebCore::pointIsClippedBySurfaceOrClipRect):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::layerScissorRectInTargetSurface):
+        Updated this accessor.  It could be removed in the future, but not appropriate for this patch.
+
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMAKE] Added missing RenderLayerFilterInfo.cpp to build system.
+
+        * CMakeLists.txt:
+
+2012-07-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r123281): childNodes sometimes returns wrong nodes
+        https://bugs.webkit.org/show_bug.cgi?id=92014
+
+        Reviewed by Anders Carlsson.
+
+        The bug was caused by a typo in itemBeforeOrAfter. Namely, it should have been calling firstNode as
+        firstNode(forward, rootNode(), shouldOnlyIncludeDirectChildren()),
+        NOT firstNode(forward, rootNode(), previous)
+        as evident from the argument list of the function.
+
+        Test: fast/dom/NodeList/childNodes-reverse-iteration.html
+
+        * html/HTMLCollection.cpp:
+        (WebCore::DynamicNodeListCacheBase::itemBeforeOrAfter):
+
+2012-07-23  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Chrome/Skia: PDF print output does not have clickable links.
+        https://bugs.webkit.org/show_bug.cgi?id=91171
+
+        Reviewed by Stephen White.
+
+        Connect GraphicsContext::setURLForRect to Skia's new API for annotations.
+
+        Printing is not generally testable.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setURLForRect):
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        The rationale here is that the client doesn't need to know about the touch
+        event handler count. needTouchEvents was already used for that purpose.
+
+        Test: fast/events/touch/touch-handler-count.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::didAddTouchEventHandler): Only notify the client if needed.
+        (WebCore::Document::didRemoveTouchEventHandler): Ditto. Also unset the TOUCH_LISTENER
+        flag for the document if we reach a count of zero. The rationale being that
+        hasListenerType() is relied upon in other places in combination with TOUCH_LISTENER for
+        the same purpose.
+        * dom/Document.h:
+        (Document):
+        (WebCore::Document::touchEventHandlerCount):
+        * loader/EmptyClients.h:
+        * page/ChromeClient.h:
+        (ChromeClient):
+        * page/Frame.cpp: Removed notifyChromeClientTouchEventHandlerCountChanged.
+        (WebCore::Frame::setDocument): call needsTouchEvents directly.
+        * page/Frame.h: Ditto.
+        (Frame):
+        * testing/Internals.cpp:
+        (WebCore::Internals::hasTouchEventListener): expose Document::hasListenerType indirectly
+        for additional testing.
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-23  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] RenderThemeQtMobile highlight colors are not being used
+        https://bugs.webkit.org/show_bug.cgi?id=92004
+
+        Reviewed by Noam Rosenthal.
+
+        The issue here is that setPaletteFromPageClientIfExists() is being used as a
+        virtual function, but it isn't, so when platformActiveSelectionBackgroundColor()
+        runs, it doesn't pick the right palette.
+
+        Besides fixing this virtual behavior, the patch changes the structure a bit,
+        because setPaletteFromPageClientIfExists() was being "overriden" in mobile theme
+        to set the palette, which isn't exactly what the function name says.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeQt::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeQt::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeQt::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeQt::platformFocusRingColor):
+        (WebCore::RenderThemeQt::systemColor):
+        (WebCore::RenderThemeQt::getMediaControlForegroundColor):
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderTrack):
+        Use the virtual colorPalette() to get the palette.
+
+        (WebCore::RenderThemeQt::colorPalette):
+        (WebCore): Removed the code for getting the page client from here since it is
+        used only by the QStyle variant.
+
+        * platform/qt/RenderThemeQt.h:
+        (RenderThemeQt):
+        * platform/qt/RenderThemeQtMobile.cpp:
+        (WebCore::RenderThemeQtMobile::colorPalette):
+        (WebCore):
+        * platform/qt/RenderThemeQtMobile.h:
+        (RenderThemeQtMobile):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 1 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
+        
+        Sort the ENABLE_CSS lines in the file. Make sure all the flags
+        are in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123339.
+        http://trac.webkit.org/changeset/123339
+        https://bugs.webkit.org/show_bug.cgi?id=92006
+
+        massive media tests failure (Requested by philn on #webkit).
+
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::adoptGRef):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (setGstElementClassMetadata):
+        * platform/graphics/gstreamer/GStreamerVersioning.h:
+
+2012-07-21  Vincent Scheib  <scheib@chromium.org>
+
+        webkitFullscreenElement, webkitCurrentFullScreenElement, webkitPointerLockElement block cross origin access.
+        https://bugs.webkit.org/show_bug.cgi?id=91892
+
+        Reviewed by Adam Barth.
+
+        PointerLockElement only returned when requested from the document that owns it.
+
+        Tests: http/tests/fullscreen/fullscreenelement-different-origin.html
+               http/tests/fullscreen/fullscreenelement-same-origin.html
+               http/tests/pointer-lock/pointerlockelement-different-origin.html
+               http/tests/pointer-lock/pointerlockelement-same-origin.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitPointerLockElement):
+
+2012-07-23  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK][jhbuild] Switch to GStreamer 0.11 build
+        https://bugs.webkit.org/show_bug.cgi?id=91727
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add a new function to encapsulate the GStreamer API removal of
+        GST_OBJECT_IS_FLOATING in the upcoming 1.0 release. Use of this
+        macro can now be replaced by calling the g_object_is_floating
+        function.
+
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::adoptGRef):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (gstObjectIsFloating):
+        * platform/graphics/gstreamer/GStreamerVersioning.h:
+
+2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] media/controls-styling.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=91984
+
+        Reviewed by Eric Carlson.
+
+        Make sure that the CSS properties letter-spacing, word-spacing,
+        line-height, text-transform, text-indent, text-shadow,
+        text-decoration and color do not affect the media element controls,
+        that display text.
+
+        No new tests. Already tested by media/controls-styling.html and
+        media/controls-styling-strict.html
+
+        * css/mediaControlsEfl.css:
+        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
+
+2012-07-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header files.
+
+2012-07-23  Kent Tamura  <tkent@chromium.org>
+
+        Replace some instances of shadowAncestorNode() with shadowHost()
+        https://bugs.webkit.org/show_bug.cgi?id=91966
+
+        Reviewed by Hajime Morita.
+
+        shadowAncestorNode() is deprecated. We should use shadowHost().
+        No new tests. This doesn't change any behavior.
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector):
+        * dom/TreeScope.cpp:
+        (WebCore::listTreeScopes):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::isClickableControl):
+        * html/shadow/DetailsMarkerControl.cpp:
+        (WebCore::DetailsMarkerControl::summaryElement):
+        * html/shadow/MeterShadowElement.cpp:
+        (WebCore::MeterShadowElement::meterElement):
+        * html/shadow/ProgressShadowElement.cpp:
+        (WebCore::ProgressShadowElement::progressElement):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::RenderSliderThumb::layout):
+        (WebCore::RenderSliderContainer::layout):
+        (WebCore::SliderThumbElement::hostInput):
+        (WebCore::TrackLimiterElement::shadowPseudoId):
+        (WebCore::SliderContainerElement::shadowPseudoId):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::customStyleForRenderer):
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+        (WebCore::TextControlInnerTextElement::createRenderer):
+        (WebCore::TextControlInnerTextElement::customStyleForRenderer):
+        (WebCore::SearchFieldResultsButtonElement::shadowPseudoId):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
+        (WebCore::SpinButtonElement::defaultEventHandler):
+        (WebCore::SpinButtonElement::step):
+        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
+        (WebCore::InputFieldSpeechButtonElement::setState):
+        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
+        (WebCore::InputFieldSpeechButtonElement::startSpeechInput):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+
+2012-07-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        [WK2] REGRESSION r122966: Crash when closing tab with Web Inspector open in WebKit::PageOverlay
+        https://bugs.webkit.org/show_bug.cgi?id=91782
+
+        Reviewed by Yury Semikhatsky.
+
+        hideHighlight was never called once user hovered over a node.
+
+        * inspector/DOMNodeHighlighter.cpp:
+        (WebCore::InspectorOverlay::update):
+
+2012-07-23  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Build fix for the Windows builder following r123311
+        https://bugs.webkit.org/show_bug.cgi?id=91979
+
+        Unreviewed build fix.
+
+        Changeset r123311 moved the TextCodecWinCE.{cpp,h} files to the Windows
+        directory. Update Chromium's references to these files to fix the build.
+
+        * WebCore.gypi:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Remove ICU dependencies from UniscribeController
+        https://bugs.webkit.org/show_bug.cgi?id=91921
+
+        Reviewed by Ryosuke Niwa.
+
+        Replace ICU specific functions and macros with the corresponding code from WTF::Unicode.
+        This allows us to use UniscribeController with an other Unicode implementation too.
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::advance):
+
+2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] media/controls-styling-strict.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=91960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use "display: -webkit-box;" instead of inline-block
+        for current-time control. This is needed because
+        inline-block behaves differently in strict mode.
+
+        No new test, already tested by media/controls-styling-strict.html
+
+        * css/mediaControlsEfl.css:
+        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
+
+2012-07-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build with ENABLE_DATALIST_ELEMENT.
+
+        Add an implementation for virtual pure methods sliderTickSize()
+        and sliderTickOffsetFromTrackCenter() when HTML5 datalist element
+        is enabled.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore):
+        (WebCore::RenderThemeGtk::sliderTickSize):
+        (WebCore::RenderThemeGtk::sliderTickOffsetFromTrackCenter):
+        * platform/gtk/RenderThemeGtk.h:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace getCurrentLocalTime() with GetLocalTime() in LocaleWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=91937
+
+        Reviewed by Ryosuke Niwa.
+
+        The windows function returns the required year directly and
+        removes one additonal dependecy on getCurrentLocalTime().
+
+        * platform/text/LocaleWin.cpp:
+        (WebCore::LocaleWin::LocaleWin):
+
+2012-07-23  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Drag and drop should not be started on right mouse click.
+        https://bugs.webkit.org/show_bug.cgi?id=91728
+
+        Reviewed by Pavel Feldman.
+
+        Introduced WebInspector.installDragHandle method to control drag and drop support, checking whichg mouse button is pressed.
+        Simplified WebInspector._elementDragStart, removed "element" parameter.
+        Simplified tab moving support in TabbedPane, removed "mousemove" handler.
+        Removed while loop determining which element was dragged in TimelineOverviewPane, each drag support is now installed independently.
+        Drive-by: fixed TimelineOverviewPane window moving on resources-dividers-label-bar drang-and-drop.
+        Drive-by: fixed CSSStyleModel compilation.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._positionResizers):
+        (WebInspector.DataGrid.prototype._startResizerDragging):
+        (WebInspector.DataGrid.prototype._endResizerDragging):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype._animationDuration):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype._startRetainersHeaderDragging):
+        (WebInspector.HeapSnapshotView.prototype._endRetainersHeaderDragging):
+        * inspector/front-end/SidebarOverlay.js:
+        (WebInspector.SidebarOverlay.prototype.set _startResizerDragging):
+        (WebInspector.SidebarOverlay.prototype._endResizerDragging):
+        (WebInspector.SidebarOverlay.prototype._installResizer):
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/SplitView.js:
+        (WebInspector.SplitView.prototype._startResizerDragging):
+        (WebInspector.SplitView.prototype._endResizerDragging):
+        (WebInspector.SplitView.prototype.installResizer):
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPaneTab.prototype._createTabElement):
+        (WebInspector.TabbedPaneTab.prototype._tabMouseDown):
+        (WebInspector.TabbedPaneTab.prototype._startTabDragging):
+        (WebInspector.TabbedPaneTab.prototype._endTabDragging):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewWindow):
+        (WebInspector.TimelineOverviewWindow.prototype._leftResizeElementDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._rightResizeElementDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._startWindowSelectorDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._endWindowSelectorDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._startWindowDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._windowDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._endWindowDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._moveWindow):
+        (WebInspector.TimelineOverviewWindow.prototype._onMouseWheel):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._startSplitterDragging):
+        (WebInspector.TimelinePanel.prototype._endSplitterDragging):
+        * inspector/front-end/Toolbar.js:
+        (WebInspector.Toolbar):
+        (WebInspector.Toolbar.prototype._toolbarDragStart):
+        (WebInspector.Toolbar.prototype._toolbarDragEnd):
+        * inspector/front-end/UIUtils.js:
+        (WebInspector.installDragHandle):
+        (WebInspector._elementDragStart):
+        (WebInspector._elementDragEnd):
+        * inspector/front-end/timelinePanel.css:
+        (#timeline-overview-grid .resources-dividers-label-bar):
+
+2012-07-23  Hayato Ito  <hayato@chromium.org>
+
+        ComposedShadowTreeWalker should skip an empty insertion points.
+        https://bugs.webkit.org/show_bug.cgi?id=91826
+
+        Reviewed by Hajime Morita.
+
+        ComposedShadowTreeWalker wrongly returns 'null' if it encounters
+        an insertion point into where no nodes are distributed.  We should
+        skip such an insertion point and continue walking using the next
+        possible node, which might be a next sibling or a next distributed
+        node, and resolve the next node recursively.
+
+        Test: fast/dom/shadow/composed-shadow-tree-walker.html
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseLightChildren):
+        (WebCore):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblings):
+        (WebCore::ComposedShadowTreeWalker::traverseNode):
+        (WebCore::ComposedShadowTreeWalker::traverseDistributedeNodes):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingInCurrentTree):
+        (WebCore::ComposedShadowTreeWalker::traverseBackToYoungerShadowRoot):
+        * dom/ComposedShadowTreeWalker.h:
+        (ComposedShadowTreeWalker):
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Rename TextCodecWinCE to TextCodecWin
+        https://bugs.webkit.org/show_bug.cgi?id=91947
+
+        Reviewed by Ryosuke Niwa.
+
+        Since TextCodecWinCE is used by other (non-upstreamed) windows ports too,
+        TextCodecWin is a better name for the implementation.
+        Also remove the dependency on WinCE FontCache to make it more usable.
+
+        * PlatformWinCE.cmake:
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::extendTextCodecMaps):
+        * platform/text/win/TextCodecWin.cpp: Renamed from Source/WebCore/platform/text/wince/TextCodecWinCE.cpp.
+        * platform/text/win/TextCodecWin.h: Renamed from Source/WebCore/platform/text/wince/TextCodecWinCE.h.
+
+2012-07-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] CodeGeneratorV8.pm should support static attributes
+        https://bugs.webkit.org/show_bug.cgi?id=91764
+
+        Reviewed by Adam Barth.
+
+        CodeGeneratorJS.pm already supports static attributes.
+        CodeGeneratorV8.pm should also support them.
+
+        Tests: bindings/scripts/test/TestObj.idl
+               bindings/scripts/test/TestSupplemental.idl
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (GenerateNormalAttrSetter):
+
+        * bindings/scripts/test/TestObj.idl: Added defined(TESTING_V8).
+        * bindings/scripts/test/TestSupplemental.idl: Added test cases for static attributes in supplemental IDL files.
+
+        * bindings/scripts/test/JS/JSTestInterface.cpp: Updated run-bindings-tests results.
+        (WebCore):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
+        The generated code is wrong since CodeGeneratorJS.pm does not support static attributes for
+        supplemental IDL files. I will fix it in a follow-up patch.
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.cpp: Updated run-bindings-tests results.
+        (WebCore::TestInterfaceV8Internal::supplementalStaticReadOnlyAttrAttrGetter):
+        (TestInterfaceV8Internal):
+        (WebCore::TestInterfaceV8Internal::supplementalStaticAttrAttrGetter):
+        (WebCore::TestInterfaceV8Internal::supplementalStaticAttrAttrSetter):
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::staticReadOnlyIntAttrAttrGetter):
+        (TestObjV8Internal):
+        (WebCore::TestObjV8Internal::staticStringAttrAttrGetter):
+        (WebCore::TestObjV8Internal::staticStringAttrAttrSetter):
+        (WebCore):
+
+2012-07-22  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Missing *explicit* keyword in storage and workers.
+        https://bugs.webkit.org/show_bug.cgi?id=91934
+
+        Reviewed by Kentaro Hara.
+
+        Some constructors missed to use *explicit* keyword. They need to be added
+        *explicit* keyword to contructor which has a parameter in order to avoid
+        implicit type conversion.
+
+        No new tests. Convered by existing tests.
+
+        * storage/StorageAreaImpl.h:
+        (StorageAreaImpl):
+        * storage/StorageMap.h:
+        (StorageMap):
+        * storage/StorageSyncManager.h:
+        (StorageSyncManager):
+        * storage/StorageTask.h:
+        (StorageTask):
+        * storage/StorageTracker.h:
+        (StorageTracker):
+        * workers/SharedWorker.h:
+        (SharedWorker):
+        * workers/Worker.h:
+        (Worker):
+        * workers/WorkerLocation.h:
+        (WebCore::WorkerLocation::WorkerLocation):
+        * workers/WorkerMessagingProxy.h:
+        (WorkerMessagingProxy):
+
+2012-07-23  Kent Tamura  <tkent@chromium.org>
+
+        Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
+        https://bugs.webkit.org/show_bug.cgi?id=91941
+
+        Reviewed by Kentaro Hara.
+
+        A flag name for an elmement should be ENABLE_*_ELEMENT.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::createFromRenderer):
+        * accessibility/AccessibilityProgressIndicator.cpp:
+        * accessibility/AccessibilityProgressIndicator.h:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/html.css:
+        * html/HTMLMeterElement.cpp:
+        * html/HTMLMeterElement.h:
+        * html/HTMLMeterElement.idl:
+        * html/HTMLProgressElement.cpp:
+        * html/HTMLProgressElement.h:
+        * html/HTMLProgressElement.idl:
+        * html/HTMLTagNames.in:
+        * html/shadow/MeterShadowElement.cpp:
+        * html/shadow/MeterShadowElement.h: Wrap with #if ENABLE(METER_ELEMENT).
+        * html/shadow/ProgressShadowElement.cpp:
+        * html/shadow/ProgressShadowElement.h: Wrap with #if ENABLE(PROGRESS_ELEMENT).
+        * page/DOMWindow.idl:
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintThemePart):
+        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
+        (WebCore):
+        * platform/efl/RenderThemeEfl.h:
+        (RenderThemeEfl):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore):
+        * platform/gtk/RenderThemeGtk.h:
+        (RenderThemeGtk):
+        * platform/gtk/RenderThemeGtk2.cpp:
+        (WebCore):
+        * platform/gtk/RenderThemeGtk3.cpp:
+        (WebCore):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore):
+        * platform/qt/RenderThemeQt.h:
+        (WebCore):
+        (RenderThemeQt):
+        * platform/qt/RenderThemeQtMobile.cpp:
+        (WebCore):
+        * platform/qt/RenderThemeQtMobile.h:
+        (RenderThemeQtMobile):
+        * rendering/RenderMeter.cpp:
+        * rendering/RenderMeter.h:
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderProgress.cpp:
+        * rendering/RenderProgress.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        (WebCore):
+        * rendering/RenderTheme.h:
+        (WebCore):
+        (RenderTheme):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore):
+        * rendering/RenderThemeChromiumSkia.h:
+        (RenderThemeChromiumSkia):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore):
+        * rendering/RenderThemeChromiumWin.h:
+        (RenderThemeChromiumWin):
+        * rendering/RenderThemeMac.h:
+        (RenderThemeMac):
+        * rendering/RenderThemeMac.mm:
+        (WebCore):
+
+2012-07-22  Kent Tamura  <tkent@chromium.org>
+
+        Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT
+        https://bugs.webkit.org/show_bug.cgi?id=91928
+
+        Reviewed by Kentaro Hara.
+
+        A flag name for an elmement should be ENABLE_*_ELEMENT.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * html/HTMLDetailsElement.cpp:
+        * html/HTMLDetailsElement.idl:
+        * html/HTMLSummaryElement.cpp:
+        * html/HTMLTagNames.in:
+        * html/shadow/DetailsMarkerControl.cpp:
+        * rendering/RenderDetailsMarker.cpp:
+        * rendering/RenderDetailsMarker.h:
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::RenderTreeAsText::writeRenderObject):
+
+2012-07-21  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11928576> SVG-as-image (constrained) intrinsic size calculation is wrong in vertical writing modes
+        https://bugs.webkit.org/show_bug.cgi?id=91918
+
+        Reviewed by Anders Carlsson.
+
+        Test: svg/as-image/svg-intrinsic-size-rectangular-vertical.html
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computeAspectRatioInformationForRenderBox): When there is a content
+        renderer, it returns a physical intrinsic size and aspect ratio. The code was already
+        accounting for this by taking the reciprocal of the aspect ratio in the vertical case. Made
+        it also transpose the size itself, turning it from physical to logical. Moved this code
+        after setting m_intrinsicSize, since that member variable is always physical.
+
+2012-07-21  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup TextEncoding USE(XXX_UNICODE) macros
+        https://bugs.webkit.org/show_bug.cgi?id=91923
+
+        Reviewed by Andreas Kling.
+
+        Replace PLATFORM(QT) with USE(QT4_UNICODE) and OS(WINCE) with USE(WINCE_UNICODE).
+        This gives us more flexibility in choosing the unicode backend for a port.
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::extendTextCodecMaps):
+
+2012-07-21  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove unnecessary ICU header includes from SimpleFontDataWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=91922
+
+        Reviewed by Kentaro Hara.
+
+        This allows us to use SimpleFontDataWin with an other Unicode implementation too.
+
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+
+2012-07-21  Kwang Yul Seo  <skyul@company100.net>
+
+        A start tag whose tag name is "html" in the "in body" insertion mode is a parse error
+        https://bugs.webkit.org/show_bug.cgi?id=91916
+
+        Reviewed by Eric Seidel.
+
+        According to the HTML5 spec, a start tag whose tag name is "html" in the "in body"
+        insertion mode is a parse error.
+
+        Added HTMLTreeBuilder::processHtmlStartTagForInBody(AtomicHTMLToken&) to call parseError(token).
+        Removed "FIXME: parse error" from HTMLConstructionSite::insertHTMLHtmlStartTagInBody and
+        HTMLConstructionSite::insertHTMLBodyStartTagInBody because we already marked the call sites
+        of these two methods with parseError(token).
+
+        No behavior change because parseError(token) is just a marker.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagInBody):
+        (WebCore::HTMLConstructionSite::insertHTMLBodyStartTagInBody):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
+        (WebCore):
+        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
+        * html/parser/HTMLTreeBuilder.h:
+
+2012-07-20  Czene Tamás  <tczene@inf.u-szeged.hu>
+
+        double data type shoud be changed to float in ColorMatrix
+        https://bugs.webkit.org/show_bug.cgi?id=91499
+
+        Reviewed by Nikolas Zimmermann.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::matrix):
+        (WebCore::saturate):
+        (WebCore::huerotate):
+        (WebCore::luminance):
+        (WebCore::effectType):
+
+2012-07-20  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Take current transformation matrix into account when
+        deciding on resize algorithm for drawPattern.
+        https://bugs.webkit.org/show_bug.cgi?id=90624
+
+        Reviewed by Adrienne Walker.
+
+        Since the pattern shader uses both the current transformation matrix
+        and the pattern matrix when transforming pixels, we need to
+        do the same when computing the resampling mode.  Also removed the
+        resampling hint code, added in r60658, since it appears to be dead
+        (caller was removed in r76379).
+
+        Covered by existing tests, such as
+        fast/borders/border-image-scale-transform.html.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::computeResamplingMode):
+        Pass in the matrix to be used for computing the destination width and
+        height (for awesome resampling).  Remove the image resampling hint code.
+        (WebCore::paintSkBitmap):
+        Pass in the CTM to computeResamplingMode().
+        (WebCore::Image::drawPattern):
+        Concatenate the CTM and the pattern matrix, and pass that to 
+        computeResamplingMode() and TransformDimensions().  Invert the
+        CTM's scale and apply it to the pattern transform, so their
+        concatenation gives identity scale.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        * platform/graphics/skia/PlatformContextSkia.h:
+        Remove the image resampling hint (dead code).
+
+2012-07-20  Kwang Yul Seo  <skyul@company100.net>
+
+        Anything else in the "in table" insertion mode is a parse error
+        https://bugs.webkit.org/show_bug.cgi?id=91915
+
+        Reviewed by Adam Barth.
+
+        According to the HTML5 spec, anything else in the "in table" insertion mode is a parse error.
+
+        No behavior change because parseError(token) is just a marker.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTagForInTable):
+
+2012-07-20  Kent Tamura  <tkent@chromium.org>
+
+        Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT
+        https://bugs.webkit.org/show_bug.cgi?id=91846
+
+        Reviewed by Kentaro Hara.
+
+        A flag name for an elmement should be ENABLE_*_ELEMENT.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * css/html.css:
+        * html/HTMLDataListElement.cpp:
+        * html/HTMLDataListElement.h:
+        * html/HTMLDataListElement.idl:
+        * html/HTMLInputElement.cpp:
+        (WebCore):
+        (WebCore::HTMLInputElement::parseAttribute):
+        (WebCore::HTMLInputElement::insertedInto):
+        (WebCore::HTMLInputElement::removedFrom):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/HTMLInputElement.idl:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::parseAttribute):
+        (WebCore::HTMLOptionElement::childrenChanged):
+        (WebCore):
+        * html/HTMLOptionElement.h:
+        (HTMLOptionElement):
+        * html/HTMLTagNames.in:
+        * html/InputType.cpp:
+        (WebCore):
+        * html/InputType.h:
+        (InputType):
+        * html/RangeInputType.cpp:
+        (WebCore):
+        * html/RangeInputType.h:
+        (RangeInputType):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::RenderSliderContainer::layout):
+        * page/DOMWindow.idl:
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore):
+        * platform/efl/RenderThemeEfl.h:
+        (RenderThemeEfl):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore):
+        * platform/qt/RenderThemeQt.h:
+        (RenderThemeQt):
+        * rendering/RenderTheme.cpp:
+        (WebCore):
+        * rendering/RenderTheme.h:
+        (RenderTheme):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore):
+        (WebCore::RenderThemeChromiumLinux::paintSliderTrack):
+        * rendering/RenderThemeChromiumLinux.h:
+        (RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore):
+        (WebCore::RenderThemeChromiumWin::paintSliderTrack):
+        * rendering/RenderThemeChromiumWin.h:
+        (RenderThemeChromiumWin):
+        * rendering/RenderThemeMac.h:
+        (RenderThemeMac):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSliderTrack):
+        (WebCore):
+
+2012-07-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unify HTMLCollection and DynamicNodeList
+        https://bugs.webkit.org/show_bug.cgi?id=91335
+
+        Reviewed by Anders Carlsson.
+
+        This is the grand unification of HTMLCollection and DynamicNodeList.
+
+        It merges implementations of item() and length() in ChildNodeList, DynamicNodeList,
+        and HTMLCollection. The unified implementation is based on the one used for HTMLCollection,
+        that has been improved over the last few days; see r122660 and r122672 for examples.
+
+        There are five key changes:
+        1. Made itemBeforeOrAfter aware of DynamicNodeList.
+        2. itemBeforeOrAfter and related functions take and return Node* to support ChildNodeList.
+        3. Renamed InvalidCollectionType to NodeListCollectionType since DynamicNodeLists need to be
+        identified itemBeforeOrAfter.
+        4. Renamed itemAfter to virtualItemAfter in subclasses of HTMLCollection, and devirtualized
+        itemAfter used in common cases to avoid performance regressions. To make this intent clear,
+        SupportItemBefore and DoNotSupportItemBefore have been renamed to DoesNotOverrideItemAfter
+        and OverridesItemAfter. This change also help us detect a subclass of HTMLCollection that
+        passes in a wrong value to ItemBeforeSupportType by making forward iterations fail (hit an
+        assertion or doesn't iterate at all) as well as backward iterations.
+        5. Restricted the use of elementsArrayOffset to subclasses that provide virtualItemAfter.
+
+        This patch completes my effort to share code between HTMLCollection and DynamicNodeList.
+
+        * dom/ChildNodeList.cpp:
+        (WebCore::ChildNodeList::ChildNodeList):
+        (WebCore): Removed length() and item().
+        (WebCore::ChildNodeList::nodeMatches):
+        * dom/ChildNodeList.h:
+        (ChildNodeList):
+        * dom/ClassNodeList.cpp:
+        (WebCore::ClassNodeList::ClassNodeList):
+        * dom/Document.cpp:
+        (WebCore::Document::registerNodeListCache):
+        (WebCore::Document::unregisterNodeListCache):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeListCacheBase::invalidateCache):
+        (WebCore::DynamicNodeList::length):
+        (WebCore::DynamicNodeList::item):
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase): Takes new boolean argument
+        shouldOnlyIncludeDirectChildren indicating whether the non-child descendents should be
+        included or not. This is necessary to identify ChildNodeList in itemBeforeOrAfter.
+        (WebCore::DynamicNodeListCacheBase::ownerNode): Moved from DynamicNodeListCacheBase and
+        HTMLCollectionCacheBase.
+        (WebCore::DynamicNodeListCacheBase::document): Moved from DynamicNodeListCacheBase.
+        (WebCore::DynamicNodeListCacheBase::rootNode): Ditto.
+        (WebCore::DynamicNodeListCacheBase::overridesItemAfter): Renamed from supportsItemBefore
+        and the return value has been negated.
+        (WebCore::DynamicNodeListCacheBase::shouldOnlyIncludeDirectChildren): Added.
+        (WebCore::DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeList::DynamicNodeList): Takes NodeListType to determine the value of
+        shouldOnlyIncludeDirectChildren.
+        (DynamicNodeList):
+        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList):
+        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
+        * dom/MicroDataItemList.cpp:
+        (WebCore::MicroDataItemList::MicroDataItemList):
+        * dom/NameNodeList.cpp:
+        (WebCore::NameNodeList::NameNodeList):
+        * dom/TagNodeList.cpp:
+        (WebCore::TagNodeList::TagNodeList):
+        * html/CollectionType.h:
+        * html/HTMLAllCollection.cpp:
+        (WebCore::HTMLAllCollection::HTMLAllCollection):
+        * html/HTMLCollection.cpp:
+        (WebCore::shouldOnlyIncludeDirectChildren):
+        (WebCore::rootTypeFromCollectionType):
+        (WebCore::invalidationTypeExcludingIdAndNameAttributes):
+        (WebCore::HTMLCollection::HTMLCollection):
+        (WebCore::HTMLCollection::create):
+        (WebCore::HTMLCollection::~HTMLCollection):
+        (WebCore::isAcceptableElement):
+        (WebCore::firstNode): Extracted from itemBeforeOrAfter.
+        (WebCore::DynamicNodeListCacheBase::iterateForNextNode): Ditto.
+        (WebCore::DynamicNodeListCacheBase::itemBeforeOrAfter): Takes and returns Node*.
+        Special case ChildNodeList since there is no need to skip any node. When "this" is a
+        node list, call nodeMatches instead of isAcceptableElement.
+        (WebCore::DynamicNodeListCacheBase::itemBefore): No longer takes offsetInArray since
+        the use of elementsArrayOffset has been restricted to HTMLCollections that provides
+        virtualItemAfter.
+        (WebCore::DynamicNodeListCacheBase::itemAfter): Calls virtualItemAfter if necessary.
+        Otherwise assert offsetInArray is zero since we should never be using this variable
+        when virtualItemAfter is not provided.
+        (WebCore::DynamicNodeListCacheBase::isLastItemCloserThanLastOrCachedItem):
+        (WebCore::DynamicNodeListCacheBase::isFirstItemCloserThanCachedItem):
+        (WebCore::DynamicNodeListCacheBase::setItemCache): Updates m_cachedElementsArrayOffset
+        in HTMLCollection if and only if virtualItemAfter is provided. This is safe because
+        node lists never provide virtualItemAfter.
+        (WebCore::DynamicNodeListCacheBase::cachedElementsArrayOffset): Similarly, returns
+        m_cachedElementsArrayOffset if virtualItemAfter is provided.
+        (WebCore::DynamicNodeListCacheBase::lengthCommon):
+        (WebCore::DynamicNodeListCacheBase::itemCommon): Note that supportsItemBefore() is
+        equivalent to !overridesItemAfter() here.
+        (WebCore::DynamicNodeListCacheBase::itemBeforeOrAfterCachedItem): Uses Node* through
+        out the function. Since itemBefore never uses offsetInArray, always sets 0 for that.
+        Note that we never call itemBefore and virtualItemAfter on the same object.
+        (WebCore::HTMLCollection::virtualItemAfter): Added only to make the class "concrete".
+        (WebCore::HTMLCollection::namedItem):
+        (WebCore::HTMLCollection::updateNameCache):
+        (WebCore::HTMLCollection::tags):
+        * html/HTMLCollection.h:
+        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
+        (HTMLCollectionCacheBase):
+        (WebCore::HTMLCollection::length):
+        (WebCore::HTMLCollection::item):
+        (WebCore::HTMLCollection::base):
+        (HTMLCollection):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::HTMLFormCollection):
+        (WebCore::HTMLFormCollection::virtualItemAfter):
+        * html/HTMLFormCollection.h:
+        (HTMLFormCollection):
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::HTMLNameCollection):
+        (WebCore::HTMLNameCollection::virtualItemAfter):
+        * html/HTMLNameCollection.h:
+        (HTMLNameCollection):
+        * html/HTMLOptionsCollection.cpp:
+        (WebCore::HTMLOptionsCollection::HTMLOptionsCollection):
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
+        (WebCore::HTMLPropertiesCollection::virtualItemAfter):
+        (WebCore::HTMLPropertiesCollection::updateNameCache):
+        * html/HTMLPropertiesCollection.h:
+        (HTMLPropertiesCollection):
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection):
+        (WebCore::HTMLTableRowsCollection::virtualItemAfter):
+        * html/HTMLTableRowsCollection.h:
+        (HTMLTableRowsCollection):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::LabelsNodeList):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::RadioNodeList):
+
+2012-07-20  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Simplify backend interface classes
+        https://bugs.webkit.org/show_bug.cgi?id=91901
+
+        Reviewed by Tony Chang.
+
+        The IDBTransactionBackendInterface included several methods only used by the
+        real implementation objects, not via the interfaces. Expose a static Impl::from(Interface)
+        method for transaction, and migrate all of the backend-internal uses from Interface to Impl.
+
+        No new tests - no functional changes.
+
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::IDBCursorBackendImpl):
+        * Modules/indexeddb/IDBCursorBackendImpl.h:
+        (WebCore):
+        (WebCore::IDBCursorBackendImpl::create):
+        (IDBCursorBackendImpl):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::createObjectStoreInternal):
+        (WebCore::IDBDatabaseBackendImpl::objectStore):
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::deleteObjectStoreInternal):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::setVersionInternal):
+        (WebCore::IDBDatabaseBackendImpl::transactionStarted):
+        (WebCore::IDBDatabaseBackendImpl::transactionFinished):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (WebCore):
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursorInternal):
+        (WebCore::IDBIndexBackendImpl::openCursor):
+        (WebCore::IDBIndexBackendImpl::openKeyCursor):
+        (WebCore::IDBIndexBackendImpl::countInternal): Drop unused transaction argument.
+        (WebCore::IDBIndexBackendImpl::count):
+        (WebCore::IDBIndexBackendImpl::get):
+        (WebCore::IDBIndexBackendImpl::getKey):
+        * Modules/indexeddb/IDBIndexBackendImpl.h:
+        (IDBIndexBackendImpl):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::get):
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putWithIndexKeys):
+        (WebCore):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
+        (WebCore::IDBObjectStoreBackendImpl::clear):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteIndex):
+        (WebCore::IDBObjectStoreBackendImpl::deleteIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::openCursor):
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
+        (WebCore::IDBObjectStoreBackendImpl::count):
+        (WebCore::IDBObjectStoreBackendImpl::countInternal): Drop unused transaction argument.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
+        (WebCore):
+        (IDBObjectStoreBackendImpl):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::objectStore):
+        * Modules/indexeddb/IDBTransactionBackendImpl.h:
+        (WebCore::IDBTransactionBackendImpl::from):
+        (IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::mode):
+        * Modules/indexeddb/IDBTransactionBackendInterface.h:
+        (IDBTransactionBackendInterface):
+
+2012-07-20  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: "ASSERTION FAILED: !m_requestFinished" hit in IDBRequest::dispatchEvent
+        https://bugs.webkit.org/show_bug.cgi?id=86911
+
+        Reviewed by Tony Chang.
+
+        Clean up the IDBRequest/IDBCursor relationship and the IDBRequest lifecycle.
+
+        The IDBRequest's m_cursor/setCursor() calls are renamed to m_pendingCursor/setPendingCursor() to
+        clarify that the request will move between two states - either there's a cursor request in-flight
+        c/o a continue() or advance() call, or the result has come in (cursor, null-for-done, or error).
+        Since they were only ever used together, resetReadyState() is merged into setResultCursor(). The
+        m_requestFinished flag becomes redundant and is dropped - the ASSERT reported in the bug
+        becomes an ASSERT(m_readyState == PENDING) and m_readyState tracking is already correct.
+
+        Test: storage/indexeddb/request-continue-abort.html
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::advance): Unreachable code path now dead and gone.
+        (WebCore::IDBCursor::continueFunction): Ditto.
+        * Modules/indexeddb/IDBRequest.cpp: Most functions just add state assertions.
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::abort):
+        (WebCore::IDBRequest::setCursorDetails):
+        (WebCore::IDBRequest::setPendingCursor): Merge with old resetReadyState().
+        (WebCore):
+        (WebCore::IDBRequest::getResultCursor): Helper, since digging cursor out of IDBAny is pesky.
+        (WebCore::IDBRequest::setResultCursor): Just moved in the file to be with its friends.
+        (WebCore::IDBRequest::finishCursor):
+        (WebCore::IDBRequest::onError): Just assertions, re-ordering, re-naming.
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::onSuccessWithContinuation):
+        (WebCore::IDBRequest::hasPendingActivity):
+        (WebCore::IDBRequest::dispatchEvent): Simplify!
+        (WebCore::IDBRequest::enqueueEvent):
+        * Modules/indexeddb/IDBRequest.h:
+        (IDBRequest):
+
 2012-07-20  Andrew Scherkus  <scherkus@chromium.org>
 
         [chromium] Don't display fullscreen button for video elements not containing video