2011-11-14 Lucas Forschler Merge 100022 2011-11-11 Beth Dakin https://bugs.webkit.org/show_bug.cgi?id=72167 REGRESSION: Scroll position not restored on back after scroll -and corresponding- Reviewed by Simon Fraser. We can't just return early if we are not on an active page. notifyPositionChanged() is called when a page is going into the page cache (and therefore when not on an active page). We should not notify AppKit that the page has scrolled in that case, but we still need to call ScrollAnimator::notifyPositionChanged();. So this patch removes the early return, and replaces it with a conditional around the relevant code. * platform/mac/ScrollAnimatorMac.mm: (WebCore::ScrollAnimatorMac::notifyPositionChanged): 2011-11-08 Lucas Forschler Merge 99508 2011-11-07 Dan Bernstein REGRESSION (r98178): World of Warcraft Launcher crashes in FrameView::isOnActivePage() https://bugs.webkit.org/show_bug.cgi?id=71743 Reviewed by Beth Dakin. * page/FrameView.cpp: (WebCore::FrameView::isOnActivePage): Added a check for a null m_frame. 2011-10-31 Lucas Forschler Merge 98936 2011-10-31 Andy Estes Document pointer not null-checked in FrameView::isOnActivePage() https://bugs.webkit.org/show_bug.cgi?id=71265 Reviewed by Dan Bernstein. Return false in FrameView::isOnActivePage() if m_frame->document() is null. Other calls to m_frame->document() in FrameView also have a null check. The frame can have a null document if the FrameLoader is loading the initial empty document. No test possible without triggering assertions in debug builds. This is tracked by . * page/FrameView.cpp: (WebCore::FrameView::isOnActivePage): 2011-10-31 Matthew Delaney Updating patch for revision 98470 to include proper flag name. Reviewed by Mark Rowe. * platform/graphics/cg/ImageBufferCG.cpp: (WebCore::ImageBuffer::context): Updated flag name. 2011-10-31 Lucas Forschler Merge 98389 2011-10-25 Anders Carlsson REGRESSION(97821): HistoryController::itemsAreClones crashes a lot https://bugs.webkit.org/show_bug.cgi?id=70827 Reviewed by Adam Barth. Check that m_currentItem is non-null before passing it to itemsAreClones. While I wasn't able to make a test case that would reproduce this crash, we do check m_currentItem for null everywhere else, and the crash log indicates that this would fix the crash. * loader/HistoryController.cpp: (WebCore::HistoryController::recursiveUpdateForCommit): 2011-10-27 Lucas Forschler Merge 98503 2011-10-25 Alexey Proskuryakov Embedded PDFs should be known to DocumentLoader https://bugs.webkit.org/show_bug.cgi?id=70864 Reviewed by Darin Adler. * WebCore.exp.in: Added exports. 2011-10-27 Lucas Forschler Merge 98304 2011-10-24 Anders Carlsson It should be possible for Widget subclasses to control whether transforms affect the frame rect https://bugs.webkit.org/show_bug.cgi?id=70787 Reviewed by Sam Weinig. Currently RenderWidget sets the frame rect of it's hosted widget to the bounding box of the transformed content box rect (unless the Widget is a frame view). It should be possible for Widget subclasses to override this behavior and have the frame rect set to the absolute content box without any transforms applied. * platform/Widget.h: (WebCore::Widget::transformsAffectFrameRect): Add new member function. * rendering/RenderWidget.cpp: (WebCore::RenderWidget::updateWidgetGeometry): Move shared code from setWidget and updateWidgetPosition out into a new function. If transformsAffectFrameRect returns false, just set the frame rect to the absolute content box. (WebCore::RenderWidget::setWidget): (WebCore::RenderWidget::updateWidgetPosition): Call updateWidgetGeometry. * rendering/RenderWidget.h: 2011-10-26 Lucas Forschler Merge 98178 2011-10-21 Beth Dakin https://bugs.webkit.org/show_bug.cgi?id=70647 Common but unreproducible crash under [ScrollbarPartAnimation setCurrentProgress:] -and corresponding- Reviewed by Sam Weinig. This patch implements two speculative fixes for this crash. First, block exceptions around all of the code responsible for calling stopAnimation. If that code throws any exceptions, we want to make sure the other animations are still stopped. * platform/mac/ScrollAnimatorMac.mm: (-[WebScrollbarPartAnimation scrollAnimatorDestroyed]): (-[WebScrollbarPainterDelegate scrollAnimatorDestroyed]): (WebCore::ScrollAnimatorMac::~ScrollAnimatorMac): Only send AppKit these notifications for active pages. I originally made these assertions, and I found that they were hit a surprising number of times. If we only send notifications for active pages, then we should greatly reduce and possibly eliminate our chances of hitting this crash. (WebCore::ScrollAnimatorMac::notifyPositionChanged): (WebCore::ScrollAnimatorMac::contentAreaWillPaint): (WebCore::ScrollAnimatorMac::mouseEnteredContentArea): (WebCore::ScrollAnimatorMac::mouseExitedContentArea): (WebCore::ScrollAnimatorMac::mouseMovedInContentArea): (WebCore::ScrollAnimatorMac::willStartLiveResize): (WebCore::ScrollAnimatorMac::contentsResized): (WebCore::ScrollAnimatorMac::willEndLiveResize): (WebCore::ScrollAnimatorMac::contentAreaDidShow): (WebCore::ScrollAnimatorMac::contentAreaDidHide): (WebCore::ScrollAnimatorMac::didBeginScrollGesture): (WebCore::ScrollAnimatorMac::didEndScrollGesture): 2011-10-26 Lucas Forschler Merge 98171 2011-10-21 Matthew Delaney Ensure periodic flushing of canvas drawing context https://bugs.webkit.org/show_bug.cgi?id=70646 Reviewed by Simon Fraser. No new tests. No current way to track tests that cause hangs or non-deterministic drops in performance. * platform/graphics/cg/ImageBufferDataCG.h: Adds a timestamp of last tracked flush. * platform/graphics/cg/ImageBufferCG.cpp: Ensures periodic flushes on the drawing context. (WebCore::ImageBuffer::ImageBuffer): (WebCore::ImageBuffer::context): Flushes context if we're beyond flush interval. (WebCore::ImageBuffer::copyNativeImage): Updates last flush timestamp. (WebCore::ImageBuffer::getUnmultipliedImageData): Updates last flush timestamp. (WebCore::ImageBuffer::getPremultipliedImageData): Updates last flush timestamp. (WebCore::ImageBuffer::putUnmultipliedImageData): Updates last flush timestamp. (WebCore::ImageBuffer::putPremultipliedImageData): Updates last flush timestamp. 2011-10-24 Lucas Forschler Update Localizable strings. * English.lproj/Localizable.strings: 2011-10-21 Lucas Forschler Merge 98112 2011-10-21 Simon Fraser Fix Windows build. * rendering/RenderLayerCompositor.cpp: (WebCore::RenderLayerCompositor::hasAnyAdditionalCompositedLayers): 2011-10-21 Lucas Forschler Merge 98027 2011-10-20 Alexey Proskuryakov REGRESSION (r96823): Contextual menu closes immediately when control-clicking in Flash plug-in https://bugs.webkit.org/show_bug.cgi?id=70534 Reviewed by Darin Adler. * plugins/PluginView.cpp: (WebCore::PluginView::handleEvent): Return true for contextmenu event, so that plug-ins won't get a default WebKit context menu. We can't know if the plug-in is handling mousedown (or even mouseup) by displaying a menu. 2011-10-21 Lucas Forschler Merge 97810 & 97813 2011-10-18 Sam Weinig Fix the build. * rendering/HitTestResult.cpp: (WebCore::HitTestResult::absolutePDFURL): Fix typo. 2011-10-18 Alexey Proskuryakov Expose PDF information in hit test result https://bugs.webkit.org/show_bug.cgi?id=70353 Reviewed by Sam Weinig. * WebCore.exp.in: * rendering/HitTestResult.cpp: (WebCore::HitTestResult::absolutePDFURL): * rendering/HitTestResult.h: Added HitTestResult::absolutePDFURL(). It will contain a URL when over a PDF object or embed; not sure if we want this for PDFImageDocuments. 2011-10-21 Lucas Forschler Merge 2011-10-21 Alexey Proskuryakov Support PDF viewing in subframes in WebKit2 Includes patches landed up to 10/14. * platform/graphics/IntPoint.h: (WebCore::operator-): * platform/graphics/IntRect.h: (WebCore::IntRect::move): (WebCore::IntRect::moveBy): (WebCore::IntRect::expand): (WebCore::IntRect::contract): Merge earlier added functions that are used by BuiltInPDFView. * platform/mac/ScrollbarThemeMac.mm: (WebCore::ScrollbarThemeMac::backButtonRect): Merge an unrelated clang build fix, so that one can actually build and test locally. * English.lproj/Localizable.strings: * WebCore.exp.in: * WebCore.xcodeproj/project.pbxproj: * html/HTMLPlugInElement.cpp: (WebCore::HTMLPlugInElement::defaultEventHandler): * platform/DefaultLocalizationStrategy.cpp: (WebCore::DefaultLocalizationStrategy::builtInPDFPluginName): (WebCore::DefaultLocalizationStrategy::pdfDocumentTypeDescription): * platform/DefaultLocalizationStrategy.h: * platform/LocalizationStrategy.h: * platform/LocalizedStrings.cpp: (WebCore::builtInPDFPluginName): (WebCore::pdfDocumentTypeDescription): * platform/LocalizedStrings.h: * platform/ScrollbarThemeComposite.cpp: (WebCore::pageForScrollView): (WebCore::ScrollbarThemeComposite::paintScrollCorner): * platform/chromium/FramelessScrollView.cpp: * platform/chromium/FramelessScrollView.h: * platform/gtk/ScrollbarThemeGtk.cpp: * platform/gtk/ScrollbarThemeGtk.h: * platform/qt/ScrollbarThemeQt.cpp: (WebCore::ScrollbarThemeQt::paintScrollCorner): * platform/wx/ScrollbarThemeWx.cpp: * platform/wx/ScrollbarThemeWx.h: * plugins/PluginViewBase.h: (WebCore::PluginViewBase::scroll): (WebCore::PluginViewBase::horizontalScrollbar): (WebCore::PluginViewBase::verticalScrollbar): * rendering/RenderEmbeddedObject.cpp: (WebCore::RenderEmbeddedObject::nodeAtPoint): (WebCore::RenderEmbeddedObject::scroll): (WebCore::RenderEmbeddedObject::logicalScroll): * rendering/RenderEmbeddedObject.h: * rendering/RenderWidget.h: 2011-10-21 Lucas Forschler Merge 98060 2011-10-20 Simon Fraser Hidden composited iframes cause infinite loop https://bugs.webkit.org/show_bug.cgi?id=52655 Reviewed by Darin Adler. visibility:hidden is problematic for compositing, because it causes RenderLayers to be removed from the z-order layer tree. This confuses RenderLayerCompositor in several ways; it never sees these layers when traversing the tree as it computes compositing requirements, or rebuilds the layer tree. This is a particular problem with composited iframes. When an iframe becomes composited, scheduleSetNeedsStyleRecalc() is called on that iframe's ownerElement in the parent document. If this happens inside Document::updateStyleForAllDocuments(), we get into an infinite loop because notifyIFramesOfCompositingChange() queues up style update as we bounce in and out of compositing mode, so documentsThatNeedStyleRecalc never empties out. This is an initial, conservative fix that doesn't attempt to fix all the issues with visibility. It changes RenderLayerCompositor to count the number of compositing RenderLayers, and to not leave compositing mode if there are any (even if they are hidden, so not hit while traversing the z-order tree). This avoids the infinite loop. Test: compositing/visibility/hidden-iframe.html * rendering/RenderLayer.cpp: (WebCore::RenderLayer::ensureBacking): (WebCore::RenderLayer::clearBacking): * rendering/RenderLayerCompositor.cpp: (WebCore::RenderLayerCompositor::RenderLayerCompositor): (WebCore::RenderLayerCompositor::hasAnyAdditionalCompositedLayers): (WebCore::RenderLayerCompositor::updateCompositingLayers): (WebCore::RenderLayerCompositor::computeCompositingRequirements): * rendering/RenderLayerCompositor.h: (WebCore::RenderLayerCompositor::layerBecameComposited): (WebCore::RenderLayerCompositor::layerBecameNonComposited): 2011-10-21 Lucas Forschler Merge 97821 2011-10-18 Anders Carlsson Assertion failure when going back in page with navigated subframes https://bugs.webkit.org/show_bug.cgi?id=70389 Reviewed by Darin Adler. Test: fast/history/history-back-twice-with-subframes-assert.html If a single navigation ends up loading multiple frame, the first committed frame will end up calling recursiveUpdateForCommit on the main frame which will null out the provisional item for all frames on the page. This means that it can null out the provisional item for any frames that are still yet to be committed which causes the aforementioned assertion failure. Fix this by only nulling out the provisional history item (and saving/restoring the scroll position and some other things) for frames that already contain the URL that the item requested. If a frame is being loaded, it will null out its provisional history item when it's committed. * loader/HistoryController.cpp: (WebCore::HistoryController::recursiveUpdateForCommit): 2011-10-21 Lucas Forschler Merge 97433 2011-10-13 Michael Saboff REGRESSION: High frequency memory warnings cause Safari to hog the CPU doing useless garbage collection https://bugs.webkit.org/show_bug.cgi?id=69774 Throttle the processing of memory pressure events to no more often than once every 5 seconds. Reviewed by Geoffrey Garen. No new tests. * platform/MemoryPressureHandler.cpp: (WebCore::MemoryPressureHandler::MemoryPressureHandler): * platform/MemoryPressureHandler.h: * platform/mac/MemoryPressureHandlerMac.mm: (WebCore::MemoryPressureHandler::respondToMemoryPressure): 2011-10-21 Lucas Forschler Merge 96874 2011-10-06 Dan Bernstein Flash of white when navigating daringfireball.net https://bugs.webkit.org/show_bug.cgi?id=69581 Reviewed by Darin Adler. * platform/ScrollView.cpp: (WebCore::ScrollView::updateScrollbars): Moved the calls to Scrollbar::setEnabled() into the code section where invalidation is suppressed if necessary, so that they do not trigger premature invalidation. 2011-10-21 Lucas Forschler Merge 95226 2011-09-15 Jon Lee Submitting a form with target=_blank works only once https://bugs.webkit.org/show_bug.cgi?id=28633 Reviewed by Andy Estes. Test: fast/forms/submit-to-blank-multiple-times.html The call to reset the multiple form submission bool is pushed down from the mouseDown handler to handleMousePressEvent(), to include WK2 coverage, similar to keyEvent. * page/EventHandler.cpp: (WebCore::EventHandler::handleMousePressEvent): (WebCore::EventHandler::keyEvent): clarified old FIXME comment. Both key events and mouse events may submit a form multiple times, but the call to reset the handler should probably be in another abstraction layer. * page/mac/EventHandlerMac.mm: (WebCore::EventHandler::mouseDown): 2011-10-21 Lucas Forschler Merge 94371 2011-09-01 Ada Chan Cleanup refactoring for https://bugs.webkit.org/show_bug.cgi?id=67160 Don't ifdef out the data member xslStyleSheets in MemoryCache::Statistics to cut down the ifdefs in getWebCoreMemoryCacheStatistics() in WebKit2/WebProcess/WebProcess.cpp. Reviewed by Darin Adler. No new tests required. Just small code refactoring. * loader/cache/MemoryCache.h: 2011-09-26 Mark Rowe Merge r95863. 2011-09-23 James Robinson Avoid updating compositing state during paint https://bugs.webkit.org/show_bug.cgi?id=68727 Reviewed by Simon Fraser. We shouldn't update our compositing state in the middle of a paint. The call to updateCompositingAndLayerListsIfNeeded() was added to RenderLayer::paintLayer in r45715, which was intended to fix this exact issue. Based off the ChangeLog entries, I think that this was just a typo. * rendering/RenderLayer.cpp: (WebCore::RenderLayer::paintLayer): (WebCore::RenderLayer::updateCompositingAndLayerListsIfNeeded): * rendering/RenderLayerCompositor.cpp: (WebCore::RenderLayerCompositor::updateCompositingLayers): * rendering/RenderLayerCompositor.h: 2011-09-15 Mark Rowe Merge r89705. 2011-06-24 Abhishek Arya Reviewed by Darin Adler. Add clamping for CSSPrimitiveValues and SVGInlineText font size. https://bugs.webkit.org/show_bug.cgi?id=53449 Test: svg/text/svg-zoom-large-value.xhtml * css/CSSPrimitiveValue.cpp: (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): add asserts to detect if the number created is valid. * css/CSSPrimitiveValue.h: add clamping checks to prevent overflows. (WebCore::CSSPrimitiveValue::getFloatValue): (WebCore::CSSPrimitiveValue::getIntValue): * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::getComputedSizeFromSpecifiedSize): split into two static functions, one specific to CSSStyleSelector and other generic to help in clamping font size for other callers like svg text, etc. * css/CSSStyleSelector.h: * platform/graphics/FontDescription.h: add asserts to detect if the new font size is valid. (WebCore::FontDescription::setComputedSize): (WebCore::FontDescription::setSpecifiedSize): * rendering/svg/RenderSVGInlineText.cpp: (WebCore::RenderSVGInlineText::computeNewScaledFontForStyle): use the new helper from CSSStyleSelector to help in clamping new scaled font size. do not use "smart minimum" since svg allows really small unreadable fonts (tested by existing layout tests). Document's minimum font size clamp (0 in my case) and harmless epsilon check in CSSStyleSelector function should still hold for svg. 2011-09-15 Mark Rowe Merge r91386. 2011-07-20 Tony Chang Stale pointer due to floats not removed (flexible box display) https://bugs.webkit.org/show_bug.cgi?id=64603 Reviewed by David Hyatt. Flexbox items should avoid floats. Test: fast/flexbox/horizontal-box-float-crash.html * rendering/RenderBox.cpp: (WebCore::RenderBox::avoidsFloats): * rendering/RenderBox.h: (WebCore::RenderBox::isDeprecatedFlexItem): 2011-09-15 Mark Rowe Merge r88139. 2011-06-04 Abhishek Arya Reviewed by Kent Tamura. Add some asserts for array boundary checks in TextRun. Fix an integer issue in linux text controller code. https://bugs.webkit.org/show_bug.cgi?id=62085 Testing ComplexTextControllerLinux change requires a testcase > 32 kb which is not feasible. All other changes are tested by existing layouttests. * platform/graphics/TextRun.h: (WebCore::TextRun::operator[]): add assert. (WebCore::TextRun::data): add assert. * platform/graphics/WidthIterator.cpp: (WebCore::WidthIterator::advance): bail early and prevent access to one byte across the text run boundary. * platform/graphics/chromium/ComplexTextControllerLinux.cpp: (WebCore::ComplexTextController::getNormalizedTextRun): wrong int16 vs int comparison. * rendering/svg/SVGTextRunRenderingContext.cpp: (WebCore::SVGTextRunWalker::walk): bail early when from and to is outside the text run boundary. this hit easily after adding the assert when from = to = end and read in run.data(from). 2011-09-15 Mark Rowe Merge r90568. 2011-07-07 Julien Chaffraix Reviewed by David Hyatt. Partial layout when a flex-box has visibility: collapse https://bugs.webkit.org/show_bug.cgi?id=63776 Tests: fast/flexbox/crash-button-input-autofocus.html fast/flexbox/crash-button-keygen.html fast/flexbox/crash-button-relayout.html The issue is that FlexBoxIterator would skip any child if it has visibility: collapsed. However if one of the child is anonymous, it may wrap some other child that would be skipped. Now FlexBoxIterator is called during the layout phase and thus some nodes would not relayouted as expected. * rendering/RenderDeprecatedFlexibleBox.cpp: (WebCore::FlexBoxIterator::next): When iterating, don't skip anonymous content as there may be real content hiding below. 2011-09-15 Mark Rowe Merge r95057. 2011-09-13 Jeff Miller WebCore::Cursor::ensurePlatformCursor() should always set a valid platform cursor on Windows https://bugs.webkit.org/show_bug.cgi?id=68043 Make sure we set a valid platform cursor in the Cursor::NoDrop case, and add a default clause that uses the arrow cursor in case another cursor type is added in the future and we forget to update ensurePlatformCursor(). Reviewed by Anders Carlsson. * platform/win/CursorWin.cpp: (WebCore::Cursor::ensurePlatformCursor): Always set a valid platform cursor. 2011-09-15 Mark Rowe Merge r95056. 2011-09-12 Jon Honeycutt MSAA: WebKit reports the document state as disabled https://bugs.webkit.org/show_bug.cgi?id=67974 Reviewed by Brian Weinstein. Test: platform/win/accessibility/document-enabled-state.html * accessibility/AccessibilityScrollView.h: (WebCore::AccessibilityScrollView::isEnabled): This object backs the AccessibleDocument on Windows - always return true for its enabled state. 2011-09-06 Mark Rowe Merge r94251. 2011-08-31 Jeff Miller REGRESSION(92210): AVFoundation media engine is disabled on OS X https://bugs.webkit.org/show_bug.cgi?id=67316 Move the definition of WTF_USE_AVFOUNDATION on the Mac back to JavaScriptCore/wtf/Platform.h, since WebKit2 doesn't have access to WebCore/config.h on this platform. This reverts the changes that were made in r92210. Reviewed by Darin Adler. No new tests, covered by existing media tests. * config.h: Removed definition of WTF_USE_AVFOUNDATION on the Mac, add a comment about fixing this on Windows in the future. 2011-08-29 Lucas Forschler Merged 92982 2011-08-12 Andy Estes Cancel in onbeforeunload dialog sometime causes a button to stop working. https://bugs.webkit.org/show_bug.cgi?id=26211 Reviewed by Alexey Proskuryakov. Test: fast/loader/form-submission-after-beforeunload-cancel.html If an onbeforeunload handler cancels a navigation that was triggered by a form submission, WebCore's multiple form submission protection prevents the form from being submitted a second time even though no first submission actually took place. Fix this by clearing m_submittedFormURL if the onbeforeunload handler cancels the load. This allows the submission to be retried. * loader/FrameLoader.cpp: (WebCore::FrameLoader::shouldClose): Set m_submittedFormURL to KURL() if shouldClose() will return false. 2011-08-29 Lucas Forschler Merged 93459 2011-08-19 Jeff Miller MediaPlayerPrivateAVFoundationCF should use AVCFURLAssetCopyAudiovisualMIMETypes() to get list of supported MIME types https://bugs.webkit.org/show_bug.cgi?id=66612 Reviewed by Darin Adler. No new tests, should be covered by existing media tests. * platform/graphics/avfoundation/cf/AVFoundationCFSoftLinking.h: Added AVCFURLAssetCopyAudiovisualMIMETypes(). * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp: (WebCore::mimeTypeCache): Use AVCFURLAssetCopyAudiovisualMIMETypes() to build the cache of supported MIME types. 2011-08-29 Lucas Forschler Merged 93900 2011-08-26 Darin Adler [Mac] Use the progress cursor instead of the wristwatch for CSS "wait" cursor https://bugs.webkit.org/show_bug.cgi?id=67049 Reviewed by Beth Dakin. * platform/mac/CursorMac.mm: (WebCore::Cursor::ensurePlatformCursor): Use BusyButClickable cursor for wait as well as for Progress. 2011-08-29 Lucas Forschler Merged 93878 2011-08-26 Eric Carlson